circle-ir-ai 2.21.0 → 2.26.0

package/dist/cache/classification-cache.js

@@ -1,14 +1,28 @@
 /**
  * Classification Cache
  *
- * Caches LLM classification results by composite key (content hash + classifier name).
+ * Caches LLM classification results by composite key
+ * (content hash + classifier name + per-phase model fingerprint).
  * Optimized for batch classifier workloads with shorter TTL than FileCache.
  *
  * Key differences from FileCache:
- * - Composite key: SHA-256(content + '\0' + classifierName)
+ * - Composite key: SHA-256(content + '\0' + classifierName + '\0' + modelFingerprint)
  * - Shorter default TTL (24h vs 7d)
  * - Cache directory: .cognium/cache/
  * - Hit/miss tracking for observability
+ *
+ * Model dimension (cognium-ai#151 P0 spike):
+ *   When `modelFingerprint` is supplied (typically via
+ *   `getPhaseModelFingerprint()` from `../llm/config.ts`) it becomes part
+ *   of the cache key. This prevents a `gemma3:12b` discovery result from
+ *   being silently reused when the operator switches to `gpt-4o-mini` for
+ *   discovery. The fingerprint is the same identity the persistent cache
+ *   (#158) uses, so call-site cache and S3 cache stay in lockstep.
+ *
+ *   Backward compat: when omitted the key falls through to the prior
+ *   2-component shape, so existing callers (and on-disk entries from
+ *   ≤2.21.0) keep working — the first run after wire-through is a cache
+ *   miss only for the call sites that opt into the fingerprint.
  */
 import * as fs from 'fs';
 import * as path from 'path';
@@ -18,6 +32,7 @@ export class ClassificationCache {
     cacheDir;
     maxAge;
     enabled;
+    modelFingerprint;
     memoryCache = new Map();
     hits = 0;
     misses = 0;
@@ -25,12 +40,24 @@ export class ClassificationCache {
         this.cacheDir = options.cacheDir || path.join(process.cwd(), '.cognium', 'cache');
         this.maxAge = options.maxAge ?? DEFAULT_MAX_AGE;
         this.enabled = options.enabled ?? true;
+        this.modelFingerprint = options.modelFingerprint ?? '';
         if (this.enabled) {
             this.ensureCacheDir();
         }
     }
+    /** Per-phase model identity used in cache key (cognium-ai#151). */
+    getModelFingerprint() {
+        return this.modelFingerprint;
+    }
     computeKey(content, classifier) {
-        return crypto.createHash('sha256').update(content + '\0' + classifier).digest('hex');
+        // 3-component key when fingerprint present (cognium-ai#151). When
+        // empty falls through to the prior 2-component shape via the trailing
+        // `'\0' + ''` collapse — bit-identical to ≤2.21.0 only when no
+        // fingerprint is supplied at all, which is the back-compat path.
+        const parts = this.modelFingerprint
+            ? content + '\0' + classifier + '\0' + this.modelFingerprint
+            : content + '\0' + classifier;
+        return crypto.createHash('sha256').update(parts).digest('hex');
     }
     getCachePath(key) {
         const subdir = key.substring(0, 2);
@@ -147,10 +174,15 @@ export class ClassificationCache {
         };
     }
 }
-// Singleton
+// Singleton — keyed on cacheDir + modelFingerprint so two scans with
+// different per-phase models in the same process get distinct caches
+// (cognium-ai#151). Without the fingerprint dimension, switching
+// `LLM_DISCOVERY_MODEL` between scans would silently reuse the first
+// scan's classifier results.
 let classificationCache = null;
 export function getClassificationCache(options) {
-    if (!classificationCache) {
+    const wantFingerprint = options?.modelFingerprint ?? '';
+    if (!classificationCache || classificationCache.getModelFingerprint() !== wantFingerprint) {
         classificationCache = new ClassificationCache(options);
     }
     return classificationCache;

package/dist/cache/classification-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"classification-cache.js","sourceRoot":"","sources":["../../src/cache/classification-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAiBjC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAExD,MAAM,OAAO,mBAAmB;IACtB,QAAQ,CAAS;IACjB,MAAM,CAAS;IACf,OAAO,CAAU;IACjB,WAAW,GAA+B,IAAI,GAAG,EAAE,CAAC;IACpD,IAAI,GAAG,CAAC,CAAC;IACT,MAAM,GAAG,CAAC,CAAC;IAEnB,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QAEvC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,OAAe,EAAE,UAAkB;QACpD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvF,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IACzD,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,KAAoB;QAClC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;IACvD,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,UAAkB;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEjD,eAAe;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;QAED,aAAa;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACjD,MAAM,KAAK,GAAkB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAE9C,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACjC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACZ,OAAO,KAAK,CAAC,MAAM,CAAC;gBACtB,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,UAAkB,EAAE,MAAS;QAChD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACjD,MAAM,KAAK,GAAkB,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;QAEpE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAEjC,iEAAiE;QACjE,mEAAmE;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5F,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChC,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,CAAC;YACD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACjD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,UAAkB;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC;IAChD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAEhB,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3D,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;oBACpD,IAAI,CAAC;wBACH,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;4BAC1C,WAAW,IAAI,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;wBACnD,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,0BAA0B;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;QACtC,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;YACpC,WAAW;YACX,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;CACF;AAED,YAAY;AACZ,IAAI,mBAAmB,GAA+B,IAAI,CAAC;AAE3D,MAAM,UAAU,sBAAsB,CAAC,OAAoC;IACzE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,mBAAmB,GAAG,IAAI,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"classification-cache.js","sourceRoot":"","sources":["../../src/cache/classification-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAyBjC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAExD,MAAM,OAAO,mBAAmB;IACtB,QAAQ,CAAS;IACjB,MAAM,CAAS;IACf,OAAO,CAAU;IACjB,gBAAgB,CAAS;IACzB,WAAW,GAA+B,IAAI,GAAG,EAAE,CAAC;IACpD,IAAI,GAAG,CAAC,CAAC;IACT,MAAM,GAAG,CAAC,CAAC;IAEnB,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QACvC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAEvD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,mBAAmB;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAEO,UAAU,CAAC,OAAe,EAAE,UAAkB;QACpD,kEAAkE;QAClE,sEAAsE;QACtE,+DAA+D;QAC/D,iEAAiE;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB;YACjC,CAAC,CAAC,OAAO,GAAG,IAAI,GAAG,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC,gBAAgB;YAC5D,CAAC,CAAC,OAAO,GAAG,IAAI,GAAG,UAAU,CAAC;QAChC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IACzD,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,KAAoB;QAClC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;IACvD,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,UAAkB;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEjD,eAAe;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;QAED,aAAa;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACjD,MAAM,KAAK,GAAkB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAE9C,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACjC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACZ,OAAO,KAAK,CAAC,MAAM,CAAC;gBACtB,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,UAAkB,EAAE,MAAS;QAChD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACjD,MAAM,KAAK,GAAkB,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;QAEpE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAEjC,iEAAiE;QACjE,mEAAmE;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5F,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChC,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,CAAC;YACD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACjD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,UAAkB;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC;IAChD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAEhB,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3D,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;oBACpD,IAAI,CAAC;wBACH,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;4BAC1C,WAAW,IAAI,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;wBACnD,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,0BAA0B;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;QACtC,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;YACpC,WAAW;YACX,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;CACF;AAED,qEAAqE;AACrE,qEAAqE;AACrE,iEAAiE;AACjE,qEAAqE;AACrE,6BAA6B;AAC7B,IAAI,mBAAmB,GAA+B,IAAI,CAAC;AAE3D,MAAM,UAAU,sBAAsB,CAAC,OAAoC;IACzE,MAAM,eAAe,GAAG,OAAO,EAAE,gBAAgB,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,KAAK,eAAe,EAAE,CAAC;QAC1F,mBAAmB,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,mBAAmB,GAAG,IAAI,CAAC;AAC7B,CAAC"}

package/dist/cache/discovery-cache.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Discovery Cache
+ *
+ * Persistent on-disk cache for LLM discovery results per (className,
+ * methodName, methodCode, CWE-set) tuple (cognium-ai#134, P2 of epic
+ * #155). Sits in front of the in-memory `_discoveryDedupCache` from
+ * discovery.ts (#136) so that identical method-level discovery requests
+ * survive across processes, CI runs, and developer iterations — not just
+ * within one process.
+ *
+ * Built on top of `ClassificationCache<DiscoveryResult>` (which already
+ * carries the cognium-ai#151 model-fingerprint key dimension), with
+ * discovery-specific key construction:
+ *
+ *   content    = className + '\\0' + methodName + '\\0' +
+ *                SHA-256(methodCode) + '\\0' + sortedCweSet
+ *   classifier = 'discovery-method'
+ *   fingerprint = getPhaseModelFingerprint(config)  // includes discovery model
+ *
+ * Cache directory: `.cognium/cache/discovery/` (separate from the
+ * verify-phase `.cognium/cache/verify/` so each phase can be cleared
+ * independently — `rm -rf .cognium/cache/discovery/` only nukes
+ * discovery entries).
+ *
+ * Invalidation matrix (#134 acceptance criteria):
+ *   - Edit one method     → only that method's entry invalidates
+ *                           (methodCode SHA-256 is part of the key)
+ *   - Add a new CWE       → existing entries still hit for old CWE-sets;
+ *                           new CWE-set requests miss
+ *   - Change disc model   → entire cache invalidates
+ *                           (fingerprint is part of the singleton key)
+ *
+ * Env toggles:
+ *   LLM_DISCOVERY_CACHE=0  → disable persistent discovery cache
+ *                             (in-memory dedup from #136 still applies)
+ */
+import { ClassificationCache } from './classification-cache.js';
+import { type LLMConfig } from '../llm/config.js';
+import type { DiscoveryResult } from '../llm/discovery.js';
+/**
+ * Get the discovery-phase persistent cache, keyed by per-phase model
+ * fingerprint. When `LLM_DISCOVERY_CACHE=0` returns a disabled cache that
+ * no-ops on get/set (callers don't need to branch).
+ */
+export declare function getDiscoveryCache(config?: LLMConfig): ClassificationCache<DiscoveryResult>;
+/** Reset the module-scoped singleton — test-only. */
+export declare function resetDiscoveryCache(): void;
+/**
+ * Compute the `(content, classifier)` tuple for the underlying
+ * ClassificationCache. The fingerprint dimension is folded in by the
+ * cache itself (see classification-cache.ts:computeKey).
+ *
+ * Components:
+ *   - className — disambiguates same-named methods across classes
+ *   - methodName — per-method granularity (matches the per-method LLM call)
+ *   - methodCode SHA-256 — method edit invalidates only that method's entry
+ *   - sortedCweSet — different CWE-set requests on the same method don't
+ *     reuse each other's prompts (different system prompt, different answer)
+ *   - classifier 'discovery-method' — namespace for future
+ *     'discovery-file' / 'discovery-class' tiers without collision
+ */
+export declare function computeDiscoveryCacheKey(input: {
+    className: string;
+    methodName: string;
+    methodCode: string;
+    targetCWEs: ReadonlyArray<string>;
+}): {
+    content: string;
+    classifier: string;
+};
+//# sourceMappingURL=discovery-cache.d.ts.map

package/dist/cache/discovery-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-cache.d.ts","sourceRoot":"","sources":["../../src/cache/discovery-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAiD,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAa3D;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,GAAE,SAAiC,GACxC,mBAAmB,CAAC,eAAe,CAAC,CActC;AAED,qDAAqD;AACrD,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACnC,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAO1C"}

package/dist/cache/discovery-cache.js

@@ -0,0 +1,95 @@
+/**
+ * Discovery Cache
+ *
+ * Persistent on-disk cache for LLM discovery results per (className,
+ * methodName, methodCode, CWE-set) tuple (cognium-ai#134, P2 of epic
+ * #155). Sits in front of the in-memory `_discoveryDedupCache` from
+ * discovery.ts (#136) so that identical method-level discovery requests
+ * survive across processes, CI runs, and developer iterations — not just
+ * within one process.
+ *
+ * Built on top of `ClassificationCache<DiscoveryResult>` (which already
+ * carries the cognium-ai#151 model-fingerprint key dimension), with
+ * discovery-specific key construction:
+ *
+ *   content    = className + '\\0' + methodName + '\\0' +
+ *                SHA-256(methodCode) + '\\0' + sortedCweSet
+ *   classifier = 'discovery-method'
+ *   fingerprint = getPhaseModelFingerprint(config)  // includes discovery model
+ *
+ * Cache directory: `.cognium/cache/discovery/` (separate from the
+ * verify-phase `.cognium/cache/verify/` so each phase can be cleared
+ * independently — `rm -rf .cognium/cache/discovery/` only nukes
+ * discovery entries).
+ *
+ * Invalidation matrix (#134 acceptance criteria):
+ *   - Edit one method     → only that method's entry invalidates
+ *                           (methodCode SHA-256 is part of the key)
+ *   - Add a new CWE       → existing entries still hit for old CWE-sets;
+ *                           new CWE-set requests miss
+ *   - Change disc model   → entire cache invalidates
+ *                           (fingerprint is part of the singleton key)
+ *
+ * Env toggles:
+ *   LLM_DISCOVERY_CACHE=0  → disable persistent discovery cache
+ *                             (in-memory dedup from #136 still applies)
+ */
+import * as crypto from 'crypto';
+import * as path from 'path';
+import { ClassificationCache } from './classification-cache.js';
+import { getDefaultLLMConfig, getPhaseModelFingerprint } from '../llm/config.js';
+const DISCOVERY_CACHE_SUBDIR = path.join('.cognium', 'cache', 'discovery');
+/**
+ * Module-scoped singleton — distinct from the discovery-phase singleton
+ * in `classification-cache.ts` and the verify-phase singleton in
+ * `verify-cache.ts` so each phase can carry its own model fingerprint
+ * (e.g. cheap discovery + strong verifier) without thrashing.
+ */
+let _instance = null;
+let _instanceFingerprint = '';
+/**
+ * Get the discovery-phase persistent cache, keyed by per-phase model
+ * fingerprint. When `LLM_DISCOVERY_CACHE=0` returns a disabled cache that
+ * no-ops on get/set (callers don't need to branch).
+ */
+export function getDiscoveryCache(config = getDefaultLLMConfig()) {
+    const enabled = process.env.LLM_DISCOVERY_CACHE !== '0';
+    const fingerprint = getPhaseModelFingerprint(config);
+    if (!_instance || _instanceFingerprint !== fingerprint || _instance.getModelFingerprint() !== fingerprint) {
+        _instance = new ClassificationCache({
+            cacheDir: path.join(process.cwd(), DISCOVERY_CACHE_SUBDIR),
+            modelFingerprint: fingerprint,
+            enabled,
+        });
+        _instanceFingerprint = fingerprint;
+    }
+    return _instance;
+}
+/** Reset the module-scoped singleton — test-only. */
+export function resetDiscoveryCache() {
+    _instance = null;
+    _instanceFingerprint = '';
+}
+/**
+ * Compute the `(content, classifier)` tuple for the underlying
+ * ClassificationCache. The fingerprint dimension is folded in by the
+ * cache itself (see classification-cache.ts:computeKey).
+ *
+ * Components:
+ *   - className — disambiguates same-named methods across classes
+ *   - methodName — per-method granularity (matches the per-method LLM call)
+ *   - methodCode SHA-256 — method edit invalidates only that method's entry
+ *   - sortedCweSet — different CWE-set requests on the same method don't
+ *     reuse each other's prompts (different system prompt, different answer)
+ *   - classifier 'discovery-method' — namespace for future
+ *     'discovery-file' / 'discovery-class' tiers without collision
+ */
+export function computeDiscoveryCacheKey(input) {
+    const methodSha = crypto.createHash('sha256').update(input.methodCode).digest('hex');
+    const sortedCweSet = [...input.targetCWEs].sort().join(',');
+    return {
+        content: `${input.className}\0${input.methodName}\0${methodSha}\0${sortedCweSet}`,
+        classifier: 'discovery-method',
+    };
+}
+//# sourceMappingURL=discovery-cache.js.map

package/dist/cache/discovery-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-cache.js","sourceRoot":"","sources":["../../src/cache/discovery-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAkB,MAAM,kBAAkB,CAAC;AAGjG,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,IAAI,SAAS,GAAgD,IAAI,CAAC;AAClE,IAAI,oBAAoB,GAAG,EAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAoB,mBAAmB,EAAE;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC;IACxD,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAErD,IAAI,CAAC,SAAS,IAAI,oBAAoB,KAAK,WAAW,IAAI,SAAS,CAAC,mBAAmB,EAAE,KAAK,WAAW,EAAE,CAAC;QAC1G,SAAS,GAAG,IAAI,mBAAmB,CAAkB;YACnD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,sBAAsB,CAAC;YAC1D,gBAAgB,EAAE,WAAW;YAC7B,OAAO;SACR,CAAC,CAAC;QACH,oBAAoB,GAAG,WAAW,CAAC;IACrC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,mBAAmB;IACjC,SAAS,GAAG,IAAI,CAAC;IACjB,oBAAoB,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAKxC;IACC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,YAAY,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,KAAK,SAAS,KAAK,YAAY,EAAE;QACjF,UAAU,EAAE,kBAAkB;KAC/B,CAAC;AACJ,CAAC"}

package/dist/cache/tree-cache.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Tree Cache
+ *
+ * Persistent on-disk cache for `runPatternMatch` output (cognium-ai#153,
+ * P3 of epic #155). Pattern-match output is a pure function of file
+ * content + engine version, so caching it eliminates the parse +
+ * AST-walk + SAST-rule firing on warm runs.
+ *
+ * Empirically (v2.20.6 gson re-verify, 2026-06-29) the scan stage ate
+ * 179s of 358s end-to-end — ~half the wall-clock is re-discovering
+ * structure circle-ir already knows. Caching the pattern-match seam
+ * is the smallest empirical win in the cache stack (no LLM-token
+ * reduction, only CPU + wall-clock), but it stacks cleanly on the
+ * #145 static pre-filter — a cached tree means the pre-filter has
+ * more to chew on, which reduces enrichment calls downstream.
+ *
+ * **Scope:** caches `PatternMatchResult` only, NOT full `CircleIR`.
+ * The full graph (cross-file CFG, project-level type hierarchy) is
+ * too entangled with project context to cache safely without a full
+ * `CircleIR.serialize()` upstream — that's a separate D3 design
+ * question, file separately if pursued.
+ *
+ * **Key composition:**
+ *   content = SHA-256(sourceCode) + '\0' +
+ *             circleIrVersion + '\0' +
+ *             circleIrAiVersion + '\0' +
+ *             language + '\0' +
+ *             ruleSetFingerprint
+ *   classifier = 'tree-pattern-match'
+ *
+ * Any of: file edit, circle-ir bump, circle-ir-ai bump, language
+ * change, or rule-set change → cache miss.
+ *
+ * **Storage:** `ClassificationCache<PatternMatchResult>` under
+ * `.cognium/cache/tree/`, 7-day TTL (longer than discovery cache
+ * because the input is structural and stable — pattern-match output
+ * doesn't drift between scans the way an LLM call would).
+ *
+ * **Env toggles:**
+ *   LLM_TREE_CACHE=0  → disable persistent tree cache.
+ *
+ * **Versioning note:** unlike discovery-cache / verify-cache, this
+ * cache is NOT keyed on the LLM model fingerprint (pattern-match is
+ * static — circle-ir doesn't call any LLM). It IS keyed on the
+ * circle-ir and circle-ir-ai package versions because either bump
+ * can change the workflow-level transforms applied to the result.
+ */
+import { ClassificationCache } from './classification-cache.js';
+import type { TaintSource, TaintSink, TypeInfo, DFG, SastFinding } from 'circle-ir';
+/**
+ * Shape persisted to disk. Mirrors the return of `runPatternMatch` in
+ * `src/agents/mastra/workflow.ts`. All fields are plain JSON-serializable
+ * (no class instances, no cycles) so the underlying ClassificationCache
+ * round-trip is safe.
+ */
+export interface PatternMatchResult {
+    patternSources: TaintSource[];
+    patternSinks: TaintSink[];
+    types: TypeInfo[];
+    imports: string[];
+    sastFindings: SastFinding[];
+    dfg: DFG;
+}
+/**
+ * Get the tree-cache singleton. When `LLM_TREE_CACHE=0` returns a
+ * disabled cache that no-ops on get/set (callers don't need to branch).
+ */
+export declare function getTreeCache(): ClassificationCache<PatternMatchResult>;
+/** Reset the module-scoped singleton — test-only. */
+export declare function resetTreeCache(): void;
+/**
+ * Compute the `(content, classifier)` tuple for the underlying
+ * ClassificationCache.
+ *
+ * Components:
+ *   - source code SHA-256 — file edit invalidates only that file's entry
+ *   - circleIrVersion — bumping circle-ir invalidates all entries
+ *   - circleIrAiVersion — bumping circle-ir-ai (which may change
+ *     workflow-level transforms applied to pattern-match output)
+ *     invalidates all entries
+ *   - language — same source, different language tag must miss (the
+ *     analyzer's behavior depends on the language argument)
+ *   - ruleSetFingerprint — caller-supplied digest of the active rule
+ *     set (disabledPasses + projectProfile). Empty string is fine for
+ *     the default rule set.
+ */
+export declare function computeTreeCacheKey(input: {
+    sourceCode: string;
+    language: string;
+    ruleSetFingerprint?: string;
+}): {
+    content: string;
+    classifier: string;
+};
+/**
+ * Compute a stable fingerprint over an arbitrary rule-set descriptor
+ * (disabledPasses array + projectProfile object). Result is suitable to
+ * pass as `ruleSetFingerprint` to `computeTreeCacheKey`. Order-stable
+ * for arrays so re-ordering `--disable a,b` vs `--disable b,a` still
+ * hits the cache.
+ */
+export declare function computeRuleSetFingerprint(input: {
+    disabledPasses?: string[];
+    projectProfile?: unknown;
+}): string;
+/** Test-only: expose the captured engine versions for assertions. */
+export declare function getTreeCacheVersions(): {
+    circleIrVersion: string;
+    circleIrAiVersion: string;
+};
+//# sourceMappingURL=tree-cache.d.ts.map

package/dist/cache/tree-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree-cache.d.ts","sourceRoot":"","sources":["../../src/cache/tree-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAMH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAKpF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,WAAW,EAAE,CAAC;IAC9B,YAAY,EAAE,SAAS,EAAE,CAAC;IAC1B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,GAAG,EAAE,GAAG,CAAC;CACV;AAiDD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAUtE;AAED,qDAAqD;AACrD,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAO1C;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,MAAM,CAWT;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,IAAI;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAKA"}

package/dist/cache/tree-cache.js

@@ -0,0 +1,171 @@
+/**
+ * Tree Cache
+ *
+ * Persistent on-disk cache for `runPatternMatch` output (cognium-ai#153,
+ * P3 of epic #155). Pattern-match output is a pure function of file
+ * content + engine version, so caching it eliminates the parse +
+ * AST-walk + SAST-rule firing on warm runs.
+ *
+ * Empirically (v2.20.6 gson re-verify, 2026-06-29) the scan stage ate
+ * 179s of 358s end-to-end — ~half the wall-clock is re-discovering
+ * structure circle-ir already knows. Caching the pattern-match seam
+ * is the smallest empirical win in the cache stack (no LLM-token
+ * reduction, only CPU + wall-clock), but it stacks cleanly on the
+ * #145 static pre-filter — a cached tree means the pre-filter has
+ * more to chew on, which reduces enrichment calls downstream.
+ *
+ * **Scope:** caches `PatternMatchResult` only, NOT full `CircleIR`.
+ * The full graph (cross-file CFG, project-level type hierarchy) is
+ * too entangled with project context to cache safely without a full
+ * `CircleIR.serialize()` upstream — that's a separate D3 design
+ * question, file separately if pursued.
+ *
+ * **Key composition:**
+ *   content = SHA-256(sourceCode) + '\0' +
+ *             circleIrVersion + '\0' +
+ *             circleIrAiVersion + '\0' +
+ *             language + '\0' +
+ *             ruleSetFingerprint
+ *   classifier = 'tree-pattern-match'
+ *
+ * Any of: file edit, circle-ir bump, circle-ir-ai bump, language
+ * change, or rule-set change → cache miss.
+ *
+ * **Storage:** `ClassificationCache<PatternMatchResult>` under
+ * `.cognium/cache/tree/`, 7-day TTL (longer than discovery cache
+ * because the input is structural and stable — pattern-match output
+ * doesn't drift between scans the way an LLM call would).
+ *
+ * **Env toggles:**
+ *   LLM_TREE_CACHE=0  → disable persistent tree cache.
+ *
+ * **Versioning note:** unlike discovery-cache / verify-cache, this
+ * cache is NOT keyed on the LLM model fingerprint (pattern-match is
+ * static — circle-ir doesn't call any LLM). It IS keyed on the
+ * circle-ir and circle-ir-ai package versions because either bump
+ * can change the workflow-level transforms applied to the result.
+ */
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import { createRequire } from 'module';
+import { ClassificationCache } from './classification-cache.js';
+const TREE_CACHE_SUBDIR = path.join('.cognium', 'cache', 'tree');
+const TREE_CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days — structural, stable
+/**
+ * Module-scoped singleton — distinct from the verify/discovery
+ * singletons so the tree cache (which doesn't depend on the LLM model)
+ * doesn't get invalidated when the operator swaps discovery model.
+ */
+let _instance = null;
+/**
+ * Read package versions once at module load (best-effort). Wrapped in a
+ * try/catch so unit tests that don't ship a package.json next to the
+ * source can still construct the cache; in that case the version
+ * component degrades to 'unknown' and the cache still works (just isn't
+ * cross-version-safe).
+ */
+function safeReadVersion(spec, baseUrl) {
+    try {
+        const require = createRequire(baseUrl);
+        return require(spec).version || 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+const _circleIrVersion = safeReadVersion('circle-ir/package.json', import.meta.url);
+const _circleIrAiVersion = (() => {
+    // The package's own version is harder to resolve via require, so read
+    // it directly from disk by walking up from this file.
+    try {
+        // Compiled output sits at dist/cache/tree-cache.js → ../../package.json
+        const candidates = [
+            path.resolve(new URL(import.meta.url).pathname, '../../../package.json'),
+            path.resolve(new URL(import.meta.url).pathname, '../../package.json'),
+        ];
+        for (const p of candidates) {
+            if (fs.existsSync(p)) {
+                const pkg = JSON.parse(fs.readFileSync(p, 'utf8'));
+                if (pkg.name === 'circle-ir-ai' && pkg.version) {
+                    return pkg.version;
+                }
+            }
+        }
+    }
+    catch {
+        /* fallthrough */
+    }
+    return 'unknown';
+})();
+/**
+ * Get the tree-cache singleton. When `LLM_TREE_CACHE=0` returns a
+ * disabled cache that no-ops on get/set (callers don't need to branch).
+ */
+export function getTreeCache() {
+    const enabled = process.env.LLM_TREE_CACHE !== '0';
+    if (!_instance) {
+        _instance = new ClassificationCache({
+            cacheDir: path.join(process.cwd(), TREE_CACHE_SUBDIR),
+            maxAge: TREE_CACHE_TTL_MS,
+            enabled,
+        });
+    }
+    return _instance;
+}
+/** Reset the module-scoped singleton — test-only. */
+export function resetTreeCache() {
+    _instance = null;
+}
+/**
+ * Compute the `(content, classifier)` tuple for the underlying
+ * ClassificationCache.
+ *
+ * Components:
+ *   - source code SHA-256 — file edit invalidates only that file's entry
+ *   - circleIrVersion — bumping circle-ir invalidates all entries
+ *   - circleIrAiVersion — bumping circle-ir-ai (which may change
+ *     workflow-level transforms applied to pattern-match output)
+ *     invalidates all entries
+ *   - language — same source, different language tag must miss (the
+ *     analyzer's behavior depends on the language argument)
+ *   - ruleSetFingerprint — caller-supplied digest of the active rule
+ *     set (disabledPasses + projectProfile). Empty string is fine for
+ *     the default rule set.
+ */
+export function computeTreeCacheKey(input) {
+    const sourceSha = crypto.createHash('sha256').update(input.sourceCode).digest('hex');
+    const ruleSet = input.ruleSetFingerprint ?? '';
+    return {
+        content: `${sourceSha}\0${_circleIrVersion}\0${_circleIrAiVersion}\0${input.language}\0${ruleSet}`,
+        classifier: 'tree-pattern-match',
+    };
+}
+/**
+ * Compute a stable fingerprint over an arbitrary rule-set descriptor
+ * (disabledPasses array + projectProfile object). Result is suitable to
+ * pass as `ruleSetFingerprint` to `computeTreeCacheKey`. Order-stable
+ * for arrays so re-ordering `--disable a,b` vs `--disable b,a` still
+ * hits the cache.
+ */
+export function computeRuleSetFingerprint(input) {
+    const passes = [...(input.disabledPasses ?? [])].sort().join(',');
+    // projectProfile JSON-stringifies; key order in objects matters only
+    // if the producer is non-deterministic — `@cognium/project-profile-detect`
+    // emits stable keys, so this is fine. If a future profile producer is
+    // less stable we can switch to a sorted-keys serializer.
+    const profile = input.projectProfile === undefined
+        ? ''
+        : JSON.stringify(input.projectProfile);
+    if (!passes && !profile)
+        return '';
+    return crypto.createHash('sha256').update(`${passes}\0${profile}`).digest('hex');
+}
+/** Test-only: expose the captured engine versions for assertions. */
+export function getTreeCacheVersions() {
+    return {
+        circleIrVersion: _circleIrVersion,
+        circleIrAiVersion: _circleIrAiVersion,
+    };
+}
+//# sourceMappingURL=tree-cache.js.map

package/dist/cache/tree-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree-cache.js","sourceRoot":"","sources":["../../src/cache/tree-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACjE,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,8BAA8B;AAiBjF;;;;GAIG;AACH,IAAI,SAAS,GAAmD,IAAI,CAAC;AAErE;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe;IACpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpF,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE;IAC/B,sEAAsE;IACtE,sDAAsD;IACtD,IAAI,CAAC;QACH,wEAAwE;QACxE,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;YACxE,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtE,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBACnD,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAC/C,OAAO,GAAG,CAAC,OAAiB,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC,EAAE,CAAC;AAEL;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,IAAI,mBAAmB,CAAqB;YACtD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC;YACrD,MAAM,EAAE,iBAAiB;YACzB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,cAAc;IAC5B,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAInC;IACC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC/C,OAAO;QACL,OAAO,EAAE,GAAG,SAAS,KAAK,gBAAgB,KAAK,kBAAkB,KAAK,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE;QAClG,UAAU,EAAE,oBAAoB;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAGzC;IACC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,yDAAyD;IACzD,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,KAAK,SAAS;QAChD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB;IAIlC,OAAO;QACL,eAAe,EAAE,gBAAgB;QACjC,iBAAiB,EAAE,kBAAkB;KACtC,CAAC;AACJ,CAAC"}

package/dist/cache/verify-cache.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Verify Cache
+ *
+ * Persistent on-disk cache for LLM verification batch results
+ * (cognium-ai#152, P1 of epic #155). Sits in front of the in-memory
+ * `_verifierDedupCache` from verification.ts (#138 step 3) so that
+ * identical `(file SHA, pair-set)` requests survive across processes,
+ * CI runs, and developer iterations — not just within one process.
+ *
+ * Built on top of `ClassificationCache<BatchVerificationResult>` (which
+ * already carries the cognium-ai#151 model-fingerprint key dimension),
+ * with verify-specific key construction:
+ *
+ *   content    = SHA-256(code) + '\\0' + pairsFingerprint
+ *   classifier = 'verify-batch'
+ *   fingerprint = getPhaseModelFingerprint(config)  // includes verify model
+ *
+ * Cache directory: `.cognium/cache/verify/` (separate from the
+ * discovery-phase `.cognium/cache/` so a `rm -rf .cognium/cache/verify/`
+ * only nukes verifier entries).
+ *
+ * Invalidation matrix (acceptance criteria #152):
+ *   - Edit one file in a project   → only that file's entries invalidate
+ *     (file SHA-256 is part of the cache content key)
+ *   - Add a new sink to the engine → existing entries still hit if the
+ *     new sink doesn't change the pair-set for that file
+ *   - Change verification model    → entire cache invalidates
+ *     (model fingerprint is part of the singleton key)
+ *
+ * Env toggles:
+ *   LLM_VERIFY_CACHE=0  → disable persistent verify cache (in-memory
+ *                         dedup from #138 still applies)
+ */
+import { ClassificationCache } from './classification-cache.js';
+import { type LLMConfig } from '../llm/config.js';
+import type { BatchVerificationInput, BatchVerificationResult } from '../llm/verification.js';
+/**
+ * Get the verify-phase persistent cache, keyed by per-phase model
+ * fingerprint. When `LLM_VERIFY_CACHE=0` returns a disabled cache that
+ * no-ops on get/set (callers don't need to branch).
+ */
+export declare function getVerifyCache(config?: LLMConfig): ClassificationCache<BatchVerificationResult>;
+/** Reset the module-scoped singleton — test-only. */
+export declare function resetVerifyCache(): void;
+/**
+ * Compute the `(content, classifier)` tuple for the underlying
+ * ClassificationCache. The fingerprint dimension is folded in by the
+ * cache itself (see classification-cache.ts:computeKey).
+ *
+ * Components:
+ *   - file SHA-256 — file edit invalidates only that file's entry
+ *   - pairs fingerprint — sort-invariant over the source/sink set
+ *   - classifier 'verify-batch' — namespace for future
+ *     'verify-pair' / 'verify-flow' tiers without collision
+ */
+export declare function computeVerifyCacheKey(input: BatchVerificationInput): {
+    content: string;
+    classifier: string;
+};
+//# sourceMappingURL=verify-cache.d.ts.map

package/dist/cache/verify-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-cache.d.ts","sourceRoot":"","sources":["../../src/cache/verify-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAiD,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,KAAK,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAa9F;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,GAAE,SAAiC,GACxC,mBAAmB,CAAC,uBAAuB,CAAC,CAc9C;AAED,qDAAqD;AACrD,wBAAgB,gBAAgB,IAAI,IAAI,CAGvC;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,sBAAsB,GAC5B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAOzC"}