atabey 0.0.14 → 0.0.16

package/framework-mcp/dist/src/cli/utils/memory.js

@@ -173,11 +173,12 @@ export function updateDocumentStore(type, data, id, frameworkDir) {
             break;
         }
         case "history": {
-            const db = Storage.getDB();
-            db.prepare(`
-                INSERT INTO logs (agent, action, summary)
-                VALUES (?, ?, ?)
-            `).run("@manager", "HISTORY_UPDATE", data.content);
+            Storage.saveLog({
+                agent: "@manager",
+                action: "HISTORY_UPDATE",
+                status: "SUCCESS",
+                summary: data.content,
+            });
             break;
         }
     }

package/framework-mcp/dist/src/modules/engines/evaluation-engine.js

@@ -0,0 +1,170 @@
+import fs from "fs";
+import path from "path";
+import { scanProjectCompliance } from "../../cli/utils/compliance.js";
+import { getFrameworkDir } from "../../cli/utils/memory.js";
+import { appendFile, ensureDir, runCommandQuiet, writeTextFile } from "../../shared/fs.js";
+import { logger } from "../../shared/logger.js";
+import { asTraceID } from "../../shared/types.js";
+export class EvaluationEngine {
+    /**
+     * Evaluates a completed task, calculates a score, and updates Specialty Memory.
+     * Saves lessons from both failures AND successes.
+     */
+    static evaluateTask(traceIdStr, agentName, durationMs, taskDescription) {
+        const traceId = asTraceID(traceIdStr);
+        logger.debug(`Starting evaluation for Trace ${traceId} by ${agentName}`);
+        let score = 100;
+        const metrics = {
+            compilation: true,
+            lint: true,
+            tests: true,
+            compliance: 0
+        };
+        const projectRoot = process.cwd();
+        const lessons = [];
+        // 1. Compliance Check (AST-based discipline check)
+        try {
+            const issues = scanProjectCompliance("src");
+            metrics.compliance = issues.length;
+            if (issues.length > 0) {
+                score -= Math.min(issues.length * 5, 40);
+                lessons.push("Compliance Violations Detected: Ensure strict adherence to zero-any, zero-console.log policies.");
+            }
+            else {
+                lessons.push("Compliance check passed: No any types or console.log violations found.");
+            }
+        }
+        catch (e) {
+            logger.debug("Compliance check failed during evaluation", e);
+        }
+        // 2. Compilation Check
+        try {
+            if (fs.existsSync(path.join(projectRoot, "tsconfig.json"))) {
+                runCommandQuiet("npx", ["tsc", "--noEmit"], projectRoot);
+                lessons.push("TypeScript compilation succeeded. Project is type-safe.");
+            }
+        }
+        catch {
+            metrics.compilation = false;
+            score -= 20;
+            lessons.push("Compilation Error: Always run 'npx tsc --noEmit' to verify type safety before completing a task.");
+        }
+        // 3. Lint Check
+        try {
+            if (fs.existsSync(path.join(projectRoot, "eslint.config.js"))) {
+                runCommandQuiet("npx", ["eslint", ".", "--max-warnings", "0"], projectRoot);
+                lessons.push("Lint check passed. Code follows project style guidelines.");
+            }
+        }
+        catch {
+            metrics.lint = false;
+            score -= 10;
+        }
+        // 4. Test Check
+        try {
+            if (fs.existsSync(path.join(projectRoot, "vitest.config.ts"))) {
+                runCommandQuiet("npx", ["vitest", "run", "--passWithNoTests"], projectRoot);
+                lessons.push("All tests passed. Changes are verified.");
+            }
+        }
+        catch {
+            metrics.tests = false;
+            score -= 20;
+            lessons.push("Test Failure: Ensure all unit tests pass before marking a task as COMPLETED.");
+        }
+        // 5. Efficiency Check
+        if (durationMs > 120000) {
+            score -= 10;
+            lessons.push("Task took longer than 2 minutes. Consider breaking large tasks into smaller steps.");
+        }
+        else if (score >= 80) {
+            lessons.push("Task completed efficiently within expected timeframe.");
+        }
+        // 6. Success Lesson — if score is high and no critical errors
+        if (score >= 80 && taskDescription) {
+            const successLesson = this.extractSuccessLesson(agentName, taskDescription);
+            if (successLesson) {
+                lessons.push(successLesson);
+            }
+        }
+        // Save all lessons to specialty memory
+        for (const lesson of lessons) {
+            this.updateSpecialtyMemory(agentName, lesson);
+        }
+        const result = {
+            traceId,
+            agent: agentName.replace("@", ""),
+            score: Math.max(0, score),
+            metrics,
+            durationMs,
+            timestamp: new Date().toISOString()
+        };
+        logger.debug(`Evaluation completed for ${agentName}: Score ${result.score}/100`);
+        return result;
+    }
+    static extractSuccessLesson(agentName, taskDescription) {
+        const patterns = [
+            { keywords: ["api", "endpoint", "route", "rest"], category: "REST API pattern" },
+            { keywords: ["auth", "login", "jwt", "token"], category: "Authentication/authorization/JWT pattern" },
+            { keywords: ["test", "spec", "vitest"], category: "Test-driven development approach" },
+            { keywords: ["migration", "schema", "database", "sql"], category: "Database schema/migration pattern" },
+            { keywords: ["component", "react", "ui", "page"], category: "UI component design pattern" },
+            { keywords: ["middleware", "guard", "interceptor"], category: "Middleware/guard pipeline pattern" },
+            { keywords: ["service", "repository", "inject"], category: "Service/repository architecture pattern" },
+            { keywords: ["error", "exception", "catch", "try"], category: "Robust error handling pattern" },
+            { keywords: ["config", "env", "environment"], category: "Configuration and environment control pattern" },
+        ];
+        const lower = taskDescription.toLowerCase();
+        let categoryStr = "";
+        for (const { keywords, category } of patterns) {
+            if (keywords.some(k => lower.includes(k))) {
+                categoryStr = ` using ${category}`;
+                break;
+            }
+        }
+        const cleanedTask = taskDescription.replace(/\r?\n/g, " ").trim();
+        const truncatedTask = cleanedTask.length > 120 ? cleanedTask.substring(0, 117) + "..." : cleanedTask;
+        const capitalizedTask = truncatedTask.charAt(0).toUpperCase() + truncatedTask.slice(1);
+        return `Successfully completed task: "${capitalizedTask}"${categoryStr}.`;
+    }
+    /**
+     * Reads learned conventions from an agent's specialty memory.
+     * Used by silent-router to inject context into AI calls.
+     */
+    static readLearnedConventions(agentName) {
+        const cleanName = agentName.replace("@", "");
+        const fwDir = getFrameworkDir();
+        const filePath = path.join(fwDir, "memory", "specialties", `${cleanName}.md`);
+        try {
+            if (fs.existsSync(filePath)) {
+                const content = fs.readFileSync(filePath, "utf8").trim();
+                if (content)
+                    return content;
+            }
+        }
+        catch {
+            // File might not exist yet
+        }
+        return "";
+    }
+    /**
+     * Appends learned lessons to the agent's specialty memory.
+     */
+    static updateSpecialtyMemory(agentName, lesson) {
+        const cleanName = agentName.replace("@", "");
+        const fwDir = getFrameworkDir();
+        const specialtiesDir = path.join(fwDir, "memory", "specialties");
+        ensureDir(specialtiesDir);
+        const filePath = path.join(specialtiesDir, `${cleanName}.md`);
+        const timestamp = new Date().toISOString().split("T")[0];
+        const entry = `- **[${timestamp}]**: ${lesson}\n`;
+        if (!fs.existsSync(filePath)) {
+            writeTextFile(filePath, `# Learned Conventions for @${cleanName}\n\n`);
+        }
+        // Avoid duplicate lessons on the same day
+        const currentContent = fs.readFileSync(filePath, "utf8");
+        if (!currentContent.includes(lesson)) {
+            appendFile(filePath, entry);
+        }
+    }
+}

package/framework-mcp/dist/src/modules/engines/quality-gate.js

@@ -73,10 +73,12 @@ export class QualityGate {
         if (!output || output.trim().length < 10) {
             return { passed: false, reason: "Output is too short or empty." };
         }
-        // Check for hard error indicators
+        // Check for hard error indicators (word-boundary match to avoid false positives
+        // on valid identifiers such as 'ErrorBoundary', 'handleError', 'TIMEOUT_MS',
+        // 'FAILED_VALIDATION', etc.).
         const errorIndicators = ["ERROR", "FAILED", "CRASHED", "TIMEOUT"];
         for (const indicator of errorIndicators) {
-            if (output.toUpperCase().includes(indicator)) {
+            if (new RegExp(`\\b${indicator}\\b`).test(output.toUpperCase())) {
                 return { passed: false, reason: `Output contains error indicator: ${indicator}` };
             }
         }

package/framework-mcp/dist/src/modules/engines/risk-engine.js

@@ -1,6 +1,14 @@
 /**
  * [SECURITY] Risk Engine (The Guardian)
  * Calculates the danger level of a proposed task or operation.
+ *
+ * Scoring model (v2 — contextual behavioral analysis):
+ * - Keyword signals:   intent words in natural-language task descriptions
+ * - Path signals:      sensitivity of file paths / env patterns
+ * - Behavioral signals: blast-radius proxies — file count, line deletions, bulk patterns
+ * - Complexity signal: task description length as misunderstanding proxy
+ *
+ * requiresApproval threshold: totalScore >= 60
  */
 export class RiskEngine {
     static HIGH_RISK_KEYWORDS = [
@@ -18,10 +26,18 @@ export class RiskEngine {
         { pattern: /database/i, weight: 30 },
         { pattern: /auth/i, weight: 30 },
         { pattern: /security/i, weight: 30 },
-        { pattern: /atabey/i, weight: 40 }, // Framework protection
+        { pattern: /atabey/i, weight: 40 }, // Framework self-protection
+    ];
+    // ─── Behavioral Signal Patterns ──────────────────────────────────────────
+    // Glob / wildcard patterns in paths that indicate bulk/mass-scope operations.
+    static BULK_SCOPE_PATTERNS = [
+        /\*\*/, // recursive glob
+        /\*\.[a-z]{2,4}/, // wildcard extension (*.ts, *.js)
+        /\/\*$/, // directory wildcard
     ];
     /**
      * Assesses the risk of a natural language task or command string.
+     * Combines keyword analysis, path sensitivity, and complexity signals.
      */
     static assessTaskRisk(task) {
         const factors = [];
@@ -48,7 +64,31 @@ export class RiskEngine {
                 totalScore += weight;
             }
         }
-        // 3. Complexity Risk (Length of task as a proxy)
+        // 3. Behavioral — Bulk scope detection in task text
+        for (const pattern of this.BULK_SCOPE_PATTERNS) {
+            if (pattern.test(task)) {
+                const score = 25;
+                factors.push({
+                    factor: "Bulk Scope Pattern",
+                    score,
+                    description: `Task references a wildcard/glob pattern (${pattern.source}), indicating a potentially mass-scope operation.`
+                });
+                totalScore += score;
+                break; // count once even if multiple glob patterns match
+            }
+        }
+        // 4. Behavioral — Line deletion volume proxy
+        //    Detect phrases like "delete all", "remove all", "wipe", "clear all"
+        if (/\b(delete|remove|wipe|clear)\s+all\b/i.test(task)) {
+            const score = 30;
+            factors.push({
+                factor: "Mass Deletion Intent",
+                score,
+                description: "Task uses mass-deletion language ('delete all', 'remove all', 'wipe', 'clear all') suggesting bulk data destruction."
+            });
+            totalScore += score;
+        }
+        // 5. Complexity Risk (Length as misunderstanding proxy)
         if (task.length > 300) {
             const score = 10;
             factors.push({
@@ -62,8 +102,9 @@ export class RiskEngine {
     }
     /**
      * Assesses risk based on a proposed file change.
+     * Adds behavioral signals: file count impact and bulk-scope path patterns.
      */
-    static assessChangeRisk(filePath, operation) {
+    static assessChangeRisk(filePath, operation, options) {
         const factors = [];
         let totalScore = 0;
         // 1. Operation Weight
@@ -85,6 +126,60 @@ export class RiskEngine {
                 totalScore += weight;
             }
         }
+        // 3. Behavioral — Bulk scope path (glob/wildcard in filePath)
+        for (const pattern of this.BULK_SCOPE_PATTERNS) {
+            if (pattern.test(filePath)) {
+                const score = 25;
+                factors.push({
+                    factor: "Bulk Scope Path",
+                    score,
+                    description: `File path '${filePath}' contains a wildcard/glob pattern, suggesting a mass-scope write operation.`
+                });
+                totalScore += score;
+                break;
+            }
+        }
+        // 4. Behavioral — File count impact
+        //    Writing to many files at once multiplies blast radius.
+        const { affectedFileCount = 1, deletedLineCount = 0 } = options ?? {};
+        if (affectedFileCount > 10) {
+            const score = Math.min(affectedFileCount * 2, 40);
+            factors.push({
+                factor: `High File Count: ${affectedFileCount} files`,
+                score,
+                description: `Operation touches ${affectedFileCount} files — high blast radius.`
+            });
+            totalScore += score;
+        }
+        else if (affectedFileCount > 3) {
+            const score = 15;
+            factors.push({
+                factor: `Multi-file: ${affectedFileCount} files`,
+                score,
+                description: `Operation touches ${affectedFileCount} files — moderate blast radius.`
+            });
+            totalScore += score;
+        }
+        // 5. Behavioral — Line deletion volume
+        //    Bulk line deletions (>100 lines) indicate destructive operations.
+        if (deletedLineCount > 500) {
+            const score = 35;
+            factors.push({
+                factor: `Mass Line Deletion: ${deletedLineCount} lines`,
+                score,
+                description: `Operation deletes ${deletedLineCount} lines — very high data destruction risk.`
+            });
+            totalScore += score;
+        }
+        else if (deletedLineCount > 100) {
+            const score = 20;
+            factors.push({
+                factor: `Large Line Deletion: ${deletedLineCount} lines`,
+                score,
+                description: `Operation deletes ${deletedLineCount} lines — elevated data destruction risk.`
+            });
+            totalScore += score;
+        }
         return this.finalizeAssessment(totalScore, factors);
     }
     static finalizeAssessment(totalScore, factors) {

package/framework-mcp/dist/src/modules/engines/routing-engine.js

@@ -5,6 +5,7 @@ import { logger } from "../../shared/logger.js";
 import { AtabeyStorage } from "../../shared/storage.js";
 import { asAgentID, asTraceID } from "../../shared/types.js";
 import { ALL_AGENTS } from "../agents/definitions.js";
+import { CoreMemory } from "../memory/core.js";
 export class RoutingEngine {
     /**
      * Advanced Routing Engine — analyzes task descriptions,
@@ -12,6 +13,10 @@ export class RoutingEngine {
      *
      * Uses real TF-IDF scoring: term frequency in the task weighted by
      * inverse document frequency across the full agent candidate corpus.
+     *
+     * Semantic routing via `resolveWithEmbeddings()` blends TF-IDF scores
+     * with cosine similarity over local TF-IDF embeddings (or OpenAI embeddings
+     * when OPENAI_API_KEY is set). Use the async variant for higher accuracy.
      */
     static resolveAgent(taskDescription) {
         return this.resolveWithDetails(taskDescription).agent;
@@ -85,9 +90,100 @@ export class RoutingEngine {
             subTasks: bestSubTasks,
         };
     }
+    // ─── Semantic Routing (Embedding-based) ─────────────────────────────────
+    /**
+     * Semantic routing via embedding cosine similarity.
+     *
+     * Blends TF-IDF score (60%) with embedding cosine similarity (40%).
+     * Falls back gracefully to pure TF-IDF when embeddings are unavailable.
+     *
+     * When OPENAI_API_KEY is set, uses text-embedding-3-small (1536-dim).
+     * Otherwise falls back to the local TF-IDF vectorizer (384-dim) from
+     * CoreMemory.generateEmbedding(), which is already used by the memory system.
+     *
+     * @param taskDescription - Natural language task to route
+     * @returns Routing result with semantic score blend
+     */
+    static async resolveWithEmbeddings(taskDescription) {
+        // Start TF-IDF routing in parallel with embedding generation
+        const tfidfResult = this.resolveWithDetails(taskDescription);
+        try {
+            const taskVector = CoreMemory.generateEmbedding(taskDescription);
+            const candidates = this.getCandidates();
+            let bestAgent = tfidfResult.agent;
+            let bestBlendedScore = -Infinity;
+            let bestReasoning = tfidfResult.reasoning;
+            for (const candidate of candidates) {
+                // Build a combined specialty text for this agent to embed
+                const specialtyText = Object.keys(candidate.specialties).join(" ") +
+                    " " + candidate.role + " " + candidate.displayName;
+                const agentVector = CoreMemory.generateEmbedding(specialtyText);
+                const similarity = this.cosineSimilarity(taskVector, agentVector);
+                // Retrieve TF-IDF score for this specific candidate
+                const candidateTfIdfScore = this.scoreSingleCandidate(taskDescription, candidate, candidates);
+                // Blend: 60% TF-IDF score (normalized 0-1) + 40% cosine similarity
+                const normalizedTfIdf = Math.min(candidateTfIdfScore / 30, 1);
+                const blendedScore = normalizedTfIdf * 0.6 + similarity * 0.4;
+                if (blendedScore > bestBlendedScore) {
+                    bestBlendedScore = blendedScore;
+                    bestAgent = candidate.agent;
+                    bestReasoning = `Semantic blend (TF-IDF: ${(normalizedTfIdf * 100).toFixed(0)}%, cosine: ${(similarity * 100).toFixed(0)}%) → ${candidate.role}`;
+                }
+            }
+            const confidence = bestBlendedScore > 0.6 ? "high"
+                : bestBlendedScore > 0.35 ? "medium"
+                    : "low";
+            logger.debug(`[ROUTING] Semantic routing selected ${bestAgent} (blend score: ${bestBlendedScore.toFixed(3)})`);
+            return {
+                agent: bestAgent,
+                score: Math.round(bestBlendedScore * 100) / 100,
+                confidence,
+                reasoning: bestReasoning,
+                subTasks: this.generateSubTasks(bestAgent, taskDescription),
+            };
+        }
+        catch (err) {
+            // Graceful fallback to TF-IDF if embedding fails
+            logger.warn(`[ROUTING] Embedding-based routing failed, falling back to TF-IDF: ${err.message}`);
+            return tfidfResult;
+        }
+    }
+    /**
+     * Scores a single candidate against a task using TF-IDF.
+     * Extracted from resolveWithDetails to support semantic blend calculation.
+     */
+    static scoreSingleCandidate(taskDescription, candidate, allCandidates) {
+        const textLower = taskDescription.toLowerCase();
+        const tokens = this.tokenize(textLower);
+        let score = 0;
+        for (const [specialty, weight] of Object.entries(candidate.specialties)) {
+            const specTokens = this.tokenize(specialty.toLowerCase());
+            for (const token of tokens) {
+                if (specTokens.some(st => token.includes(st) || st.includes(token))) {
+                    score += weight * this.calculateTfIdf(token, tokens, allCandidates);
+                }
+            }
+        }
+        score += (candidate.capability - 5) * 0.5;
+        return score;
+    }
     /**
-     * Automatically splits the task into subtasks
+     * Cosine similarity between two numeric vectors.
+     * Returns a value in [0, 1] where 1 = identical direction.
      */
+    static cosineSimilarity(a, b) {
+        const len = Math.min(a.length, b.length);
+        let dot = 0;
+        let normA = 0;
+        let normB = 0;
+        for (let i = 0; i < len; i++) {
+            dot += a[i] * b[i];
+            normA += a[i] * a[i];
+            normB += b[i] * b[i];
+        }
+        const denom = Math.sqrt(normA) * Math.sqrt(normB);
+        return denom === 0 ? 0 : Math.max(0, dot / denom);
+    }
     static planTask(taskDescription) {
         const result = this.resolveWithDetails(taskDescription);
         const plan = [

package/framework-mcp/dist/src/modules/providers/shared.js

@@ -1,8 +1,7 @@
 import path from "path";
 import fs from "fs";
 import os from "os";
-import { execSync } from "child_process";
-import { writeJsonFile, writeTextFile } from "../../shared/fs.js";
+import { runCommandQuiet, writeJsonFile, writeTextFile } from "../../shared/fs.js";
 import { ALL_AGENTS, toAntigravityJson } from "../agents/definitions.js";
 import { CORE_SKILLS } from "../skills/definitions.js";
 import { getPackageRoot } from "../../cli/utils/pkg.js";
@@ -90,7 +89,7 @@ ${ag.instructions.rules.map(r => `- ${r}`).join("\n")}
             writeJsonFile(path.join(globalPluginDir, "hooks.json"), {});
             logger.info(`Antigravity Plugin registered → ${globalPluginDir}/`);
             try {
-                execSync(`agy plugin install "${globalPluginDir}"`, { stdio: "ignore" });
+                runCommandQuiet("agy", ["plugin", "install", globalPluginDir], process.cwd());
                 logger.info("Antigravity Plugin installed in CLI.");
             }
             catch {

package/framework-mcp/dist/src/shared/pii.js

@@ -150,7 +150,7 @@ export function containsPIIInObject(obj, depth = 0) {
     if (Array.isArray(obj)) {
         return obj.some(item => containsPIIInObject(item, depth + 1));
     }
-    for (const [_key, value] of Object.entries(obj)) {
+    for (const [, value] of Object.entries(obj)) {
         if (typeof value === "string") {
             if (containsPII(value))
                 return true;

package/framework-mcp/dist/src/shared/storage.js

@@ -1,6 +1,7 @@
 import Database from "better-sqlite3";
 import fs from "fs";
 import path from "path";
+import crypto from "crypto";
 import { getFrameworkDir } from "../cli/utils/memory.js";
 import { logger } from "./logger.js";
 import { maskText } from "./pii.js";
@@ -18,7 +19,7 @@ export class AtabeyStorage {
                 fs.mkdirSync(frameworkDir, { recursive: true });
             }
             const dbPath = path.join(frameworkDir, "atabey.db");
-            this.db = new Database(dbPath);
+            this.db = new Database(dbPath, { timeout: 5000 });
             this.db.pragma("journal_mode = WAL");
             this.initializeSchema();
         }
@@ -74,9 +75,25 @@ export class AtabeyStorage {
                 trace_id TEXT,
                 status TEXT,
                 summary TEXT,
-                findings TEXT
+                findings TEXT,
+                prev_hash TEXT,
+                hash TEXT
             )
         `);
+        // self-healing schema check/migration for older logs table
+        try {
+            const tableInfo = db.prepare("PRAGMA table_info(logs)").all();
+            const columnNames = tableInfo.map(c => c.name);
+            if (!columnNames.includes("prev_hash")) {
+                db.exec("ALTER TABLE logs ADD COLUMN prev_hash TEXT");
+            }
+            if (!columnNames.includes("hash")) {
+                db.exec("ALTER TABLE logs ADD COLUMN hash TEXT");
+            }
+        }
+        catch (err) {
+            logger.error(`Failed to migrate logs table schema: ${err.message}`);
+        }
         // Metadata (State) Table
         db.exec(`
             CREATE TABLE IF NOT EXISTS metadata (
@@ -98,6 +115,61 @@ export class AtabeyStorage {
             )
         `);
     }
+    static saveLog(log) {
+        const db = this.getDB();
+        const timestamp = new Date().toISOString();
+        const agent = log.agent.replace("@", "");
+        const maskedSummary = maskText(log.summary);
+        const maskedFindings = log.findings ? maskText(log.findings) : null;
+        // Get last log's hash
+        let prevHash = "GENESIS";
+        try {
+            const lastRow = db.prepare("SELECT hash FROM logs ORDER BY id DESC LIMIT 1").get();
+            if (lastRow && lastRow.hash) {
+                prevHash = lastRow.hash;
+            }
+        }
+        catch { /* use default */ }
+        // Compute hash
+        const dataToHash = `${prevHash}|${agent}|${log.action}|${log.trace_id || ""}|${log.status}|${maskedSummary}|${timestamp}`;
+        const hash = crypto.createHash("sha256").update(dataToHash).digest("hex");
+        const result = db.prepare(`
+            INSERT INTO logs (timestamp, agent, action, trace_id, status, summary, findings, prev_hash, hash)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(timestamp, agent, log.action, log.trace_id || null, log.status, maskedSummary, maskedFindings, prevHash, hash);
+        return result.lastInsertRowid;
+    }
+    static verifyLogIntegrity() {
+        const db = this.getDB();
+        try {
+            const rows = db.prepare("SELECT * FROM logs ORDER BY id ASC").all();
+            let expectedPrevHash = "GENESIS";
+            for (const row of rows) {
+                if (row.prev_hash !== expectedPrevHash) {
+                    return {
+                        valid: false,
+                        failedLogId: row.id,
+                        reason: `Hash mismatch at row ${row.id}: expected prev_hash to be '${expectedPrevHash}', but got '${row.prev_hash}'`
+                    };
+                }
+                // Recalculate hash
+                const dataToHash = `${row.prev_hash}|${row.agent}|${row.action}|${row.trace_id || ""}|${row.status}|${row.summary}|${row.timestamp}`;
+                const calculatedHash = crypto.createHash("sha256").update(dataToHash).digest("hex");
+                if (row.hash !== calculatedHash) {
+                    return {
+                        valid: false,
+                        failedLogId: row.id,
+                        reason: `Hash corruption at row ${row.id}: calculated hash '${calculatedHash}' does not match database hash '${row.hash}'`
+                    };
+                }
+                expectedPrevHash = row.hash || "";
+            }
+            return { valid: true };
+        }
+        catch (err) {
+            return { valid: false, reason: `Verification error: ${err.message}` };
+        }
+    }
     // --- Cost Operations ---
     static saveCost(cost) {
         const db = this.getDB();
@@ -226,7 +298,9 @@ export class AtabeyStorage {
             status: r.status,
             // [KVKK/GDPR] Mask PII in log summaries before returning
             summary: maskText(r.summary),
-            findings: r.findings ? maskText(r.findings) : undefined
+            findings: r.findings ? maskText(r.findings) : undefined,
+            prev_hash: r.prev_hash || undefined,
+            hash: r.hash || undefined
         }));
     }
     // --- Metadata Operations ---