dsh-continual-evolve 0.5.0 → 0.6.0

package/lib/command.js

@@ -8,7 +8,7 @@ import { saveHarnessState } from "./state.js";
 import { appendResult, storePaths } from "./store.js";
 import { entrySourceOf } from "./source.js";
 import { filterLogBySession, formatLogLine, pluginLogFilePath } from "./logfile.js";
-import { readBenchmarkFailures, readReviewFailures, summarizeFailures, formatFailureSummary } from "./failures.js";
+import { collectFailureSummary, formatFailureSummary } from "./failures.js";
 import { executeGoalCommand } from "./goal-command.js";
 import { executeMountCommand, executeUnmountCommand } from "./mount-command.js";
 import { executeBenchmarkCommand } from "./benchmark-command.js";
@@ -26,8 +26,10 @@ const USAGE = `Usage:
   /evolve archive <id> [global]   hide an entry from injection (data kept, restorable)
   /evolve unarchive <id> [global] restore an archived entry
   /evolve demote <id>             hide a (global) entry from injection, keep data
-  /evolve consolidate [apply]     report (or apply) a batch archive of conflict-hinted
-                                  and stale zero-use global entries
+  /evolve consolidate [apply] [merge]
+                                  report (or apply) a batch archive of conflict-hinted
+                                  and stale zero-use global entries; "merge" folds
+                                  near-duplicate content into the surviving original
   /evolve log [tail N]            show the recent plugin log (default 50 lines)
   /evolve failures               aggregated failure counts (gate + benchmark, by class)
   /evolve export [global] <path>  backup a store to a JSON file
@@ -180,20 +182,29 @@ async function executeEvolveCommand(ctx, engine, invocation, opts, runtime) {
                 // R3: deterministic global-store hygiene. Report by default;
                 // `apply` re-scans fresh state and lands the whole batch as ONE
                 // refinement (single snapshot + audit record, fully rollback-able).
+                // `merge` (P1 反膨胀) additionally merges conflict-pair content
+                // into the surviving original instead of only archiving.
                 const apply = rest[0] === "apply";
+                const merge = rest.includes("merge");
                 const state = engine.load("global", undefined);
-                const { candidates, edits } = planConsolidation(state, loadUsage(engine.baseDir));
+                const { candidates, edits } = planConsolidation(state, loadUsage(engine.baseDir), Date.now(), { mergeDuplicates: merge });
                 if (candidates.length === 0) {
                     return success("global store is already consolidated — no conflict-hinted or stale zero-use entries.");
                 }
-                const report = candidates.map((candidate, index) => `${index + 1}. [${candidate.kind}:${candidate.id}] ${candidate.title}\n   ${candidate.reason}`).join("\n");
+                const mergeCount = merge ? candidates.filter((candidate) => candidate.mergeInto).length : 0;
+                const report = candidates
+                    .map((candidate, index) => {
+                    const mergeNote = candidate.mergeInto && merge ? ` → 内容并入 ${candidate.mergeInto.id}` : "";
+                    return `${index + 1}. [${candidate.kind}:${candidate.id}] ${candidate.title}${mergeNote}\n   ${candidate.reason}`;
+                })
+                    .join("\n");
                 if (!apply) {
-                    return success(`consolidation plan — ${candidates.length} archive candidate(s):\n${report}\n(run "/evolve consolidate apply" to archive all of them in one refinement)`);
+                    return success(`consolidation plan — ${candidates.length} archive candidate(s):\n${report}\n(run "/evolve consolidate apply" to archive all of them in one refinement; add "merge" to fold near-duplicate content into the survivors)`);
                 }
                 const result = engine.apply("global", undefined, {
-                    summary: `Consolidate global store: archive ${candidates.length} entries`,
+                    summary: `Consolidate global store: archive ${candidates.length} entries${mergeCount > 0 ? `, merge ${mergeCount} into survivors` : ""}`,
                     rationale: "Human-invoked batch consolidation via /evolve consolidate apply.",
-                    expectedOutcome: "Candidate entries are hidden from injection (data kept; restorable via /evolve unarchive).",
+                    expectedOutcome: "Candidate entries are hidden from injection (data kept; restorable via /evolve unarchive). Merged survivors carry the near-duplicate content with a mergedFrom provenance stamp.",
                     edits,
                 }, { scope: "global" });
                 return success(`${report}\n\napplied:\n${renderResult(result)}`);
@@ -201,10 +212,9 @@ async function executeEvolveCommand(ctx, engine, invocation, opts, runtime) {
             case "failures": {
                 // /evolve failures — failure-signature aggregation (D1 observation):
                 // failed review-gate records + failed benchmark cells, counted by class.
-                const failed = [...readReviewFailures(engine.baseDir), ...readBenchmarkFailures(engine.baseDir)];
-                const summary = summarizeFailures(failed);
+                const { summary, records } = collectFailureSummary(engine.baseDir);
                 const parts = formatFailureSummary(summary).split("\n");
-                const recent = failed
+                const recent = records
                     .sort((a, b) => (b.timestamp ?? "").localeCompare(a.timestamp ?? ""))
                     .slice(0, 10)
                     .map((f) => `  [${f.timestamp ?? "(benchmark)"}] ${f.kind} · ${f.source}: ${f.message.slice(0, 140)}`);
@@ -260,7 +270,7 @@ async function executeEvolveCommand(ctx, engine, invocation, opts, runtime) {
                     refinements: state.refinements,
                     history,
                 };
-                writeFileSync(path, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+                writeFileSync(path, `${JSON.stringify(payload, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
                 return success(`exported ${scope} store (${Object.values(state.entries).reduce((n, e) => n + Object.keys(e).length, 0)} entries, ${history.length} refinements) to ${path}`);
             }
             case "import": {

package/lib/consolidate.d.ts

@@ -35,6 +35,17 @@ export interface ConsolidationCandidate {
     id: string;
     title: string;
     reason: string;
+    /**
+     * Merge tier (P1 反膨胀): set on conflict-pair candidates — the entry's
+     * content merges into this survivor (pointed-to original) before the
+     * entry itself archives, so nothing readable is lost by the archive. The
+     * plan only EMITS the merge when `mergeDuplicates` is on.
+     */
+    mergeInto?: {
+        kind: RefinementKind;
+        id: string;
+        title: string;
+    };
 }
 /**
  * Entries stamped by the write-time conflict guard whose target still exists
@@ -48,16 +59,30 @@ export declare function findConflictPairs(state: HarnessState): ConsolidationCan
  * it is handed (callers pass the global store).
  */
 export declare function findStaleEntries(state: HarnessState, store: UsageStore, now: number, minAgeMs?: number): ConsolidationCandidate[];
+/**
+ * Append a source entry's content to a survivor with an attributed divider,
+ * so the survivor's reader can see which part came from which entry.
+ */
+export declare function mergeContent(target: string, source: string, sourceRef: string, dateIso: string): string;
 /**
  * Merge both scans (conflict reason wins on overlap), deduped by kind:id,
  * and build the batch archive edits. Each edit preserves the entry's full
  * content and existing metadata — only ARCHIVED_AT_KEY is added — so
  * `/evolve unarchive` restores everything intact.
  *
+ * With `opts.mergeDuplicates`, conflict-pair candidates additionally merge
+ * their content INTO the pointed-to survivor (an attributed `mergeContent`
+ * section + a `mergedFrom` provenance stamp) before archiving — the #11
+ * candidate-c tier the 2026-08-28 ecosystem review promoted. Per-target
+ * accumulation composes multiple hints into one survivor (update edits
+ * replace content/metadata wholesale, so parallel merge edits would clobber
+ * each other).
+ *
  * @param now Epoch ms used for the archivedAt stamp (injected for tests).
  */
 export declare function planConsolidation(state: HarnessState, store: UsageStore, now?: number, opts?: {
     minAgeMs?: number;
+    mergeDuplicates?: boolean;
 }): {
     candidates: ConsolidationCandidate[];
     edits: RefinementEdit[];

package/lib/consolidate.js

@@ -1,4 +1,4 @@
-import { ARCHIVED_AT_KEY, CONFLICT_HINT_KEY, isArchived } from "./types.js";
+import { ARCHIVED_AT_KEY, CONFLICT_HINT_KEY, MERGED_FROM_KEY, isArchived } from "./types.js";
 import { getUsageCount } from "./usage.js";
 /** Zero-use entries at least this old are stale candidates (30d, matching the injection recency half-life scale). */
 export const STALE_MIN_AGE_MS = 30 * 24 * 60 * 60 * 1000;
@@ -48,6 +48,7 @@ export function findConflictPairs(state) {
                 id: entry.id,
                 title: entry.title,
                 reason: `near-duplicate of ${hint.id} 「${target.title}」 (${Math.round(hint.score * 100)}%) — keep the original`,
+                mergeInto: { kind: hint.kind, id: hint.id, title: target.title },
             });
         }
     }
@@ -79,12 +80,36 @@ export function findStaleEntries(state, store, now, minAgeMs = STALE_MIN_AGE_MS)
     }
     return candidates;
 }
+/**
+ * Append a source entry's content to a survivor with an attributed divider,
+ * so the survivor's reader can see which part came from which entry.
+ */
+export function mergeContent(target, source, sourceRef, dateIso) {
+    const body = source.trim();
+    if (body.length === 0) {
+        return target;
+    }
+    return `${target.trimEnd()}\n\n---\n[Merged from ${sourceRef} on ${dateIso.slice(0, 10)} — near-duplicate consolidated]\n${body}`;
+}
+/** Existing `<kind>:<id>` strings of a target's {@link MERGED_FROM_KEY} trail. */
+function existingMergedFrom(metadata) {
+    const value = metadata[MERGED_FROM_KEY];
+    return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
 /**
  * Merge both scans (conflict reason wins on overlap), deduped by kind:id,
  * and build the batch archive edits. Each edit preserves the entry's full
  * content and existing metadata — only ARCHIVED_AT_KEY is added — so
  * `/evolve unarchive` restores everything intact.
  *
+ * With `opts.mergeDuplicates`, conflict-pair candidates additionally merge
+ * their content INTO the pointed-to survivor (an attributed `mergeContent`
+ * section + a `mergedFrom` provenance stamp) before archiving — the #11
+ * candidate-c tier the 2026-08-28 ecosystem review promoted. Per-target
+ * accumulation composes multiple hints into one survivor (update edits
+ * replace content/metadata wholesale, so parallel merge edits would clobber
+ * each other).
+ *
  * @param now Epoch ms used for the archivedAt stamp (injected for tests).
  */
 export function planConsolidation(state, store, now = Date.now(), opts) {
@@ -96,9 +121,17 @@ export function planConsolidation(state, store, now = Date.now(), opts) {
         }
     }
     const candidates = [...byKey.values()];
-    const edits = candidates.map((candidate) => {
+    const dateIso = new Date(now).toISOString();
+    // A merge survivor must not itself be an archive candidate in the same
+    // batch: its archive edit is built from the ORIGINAL state snapshot, so it
+    // would overwrite the merge edit's content/mergedFrom wholesale and then
+    // archive the survivor (review audit 2026-08-28 S2). Survivors stay live;
+    // their merge lands, the source archives.
+    const mergeTargets = new Set(candidates.filter((candidate) => candidate.mergeInto).map((candidate) => `${candidate.mergeInto.kind}:${candidate.mergeInto.id}`));
+    const archiveCandidates = candidates.filter((candidate) => !mergeTargets.has(`${candidate.kind}:${candidate.id}`));
+    const edits = archiveCandidates.map((candidate) => {
         const entry = state.entries[candidate.kind][candidate.id];
-        const metadata = { ...entry?.metadata, [ARCHIVED_AT_KEY]: new Date(now).toISOString() };
+        const metadata = { ...entry?.metadata, [ARCHIVED_AT_KEY]: dateIso };
         return {
             action: "update",
             kind: candidate.kind,
@@ -108,6 +141,40 @@ export function planConsolidation(state, store, now = Date.now(), opts) {
             metadata,
         };
     });
+    if (opts?.mergeDuplicates) {
+        const merges = new Map();
+        for (const candidate of candidates) {
+            if (!candidate.mergeInto)
+                continue;
+            const source = state.entries[candidate.kind][candidate.id];
+            const target = state.entries[candidate.mergeInto.kind]?.[candidate.mergeInto.id];
+            if (!source || !target)
+                continue;
+            const key = `${candidate.mergeInto.kind}:${candidate.mergeInto.id}`;
+            const acc = merges.get(key) ??
+                {
+                    kind: candidate.mergeInto.kind,
+                    id: candidate.mergeInto.id,
+                    title: target.title,
+                    content: target.content,
+                    mergedFrom: existingMergedFrom(target.metadata),
+                    metadata: target.metadata,
+                };
+            acc.content = mergeContent(acc.content, source.content ?? "", `${candidate.kind}:${candidate.id}`, dateIso);
+            acc.mergedFrom.push(`${candidate.kind}:${candidate.id}`);
+            merges.set(key, acc);
+        }
+        for (const acc of merges.values()) {
+            edits.unshift({
+                action: "update",
+                kind: acc.kind,
+                id: acc.id,
+                title: acc.title,
+                content: acc.content,
+                metadata: { ...acc.metadata, [MERGED_FROM_KEY]: acc.mergedFrom },
+            });
+        }
+    }
     return { candidates, edits };
 }
 //# sourceMappingURL=consolidate.js.map

package/lib/failures.d.ts

@@ -33,7 +33,10 @@ export declare function readReviewFailures(baseDir: string): FailureRecord[];
  */
 export declare function readBenchmarkFailures(baseDir: string): FailureRecord[];
 /** Combine both sources into one summary. */
-export declare function collectFailureSummary(baseDir: string): FailureSummary;
+export declare function collectFailureSummary(baseDir: string): {
+    summary: FailureSummary;
+    records: FailureRecord[];
+};
 /** Human-readable report for the command line. */
 export declare function formatFailureSummary(summary: FailureSummary): string;
 //# sourceMappingURL=failures.d.ts.map

package/lib/failures.js

@@ -143,7 +143,8 @@ export function readBenchmarkFailures(baseDir) {
 }
 /** Combine both sources into one summary. */
 export function collectFailureSummary(baseDir) {
-    return summarizeFailures([...readReviewFailures(baseDir), ...readBenchmarkFailures(baseDir)]);
+    const records = [...readReviewFailures(baseDir), ...readBenchmarkFailures(baseDir)];
+    return { summary: summarizeFailures(records), records };
 }
 /** Human-readable report for the command line. */
 export function formatFailureSummary(summary) {

package/lib/index.d.ts

@@ -34,6 +34,12 @@ export declare const Config: z<Schemastery.ObjectS<{
     logMaxBytes: z<number, number>;
     /** After a benchmark decision rejects a candidate, roll the refinement back automatically. */
     autoRollbackOnReject: z<boolean, boolean>;
+    /**
+     * P1 auto-case capture: failed evolution attempts (benchmark-rejected
+     * candidates, gate proposals without consent) land as draft cases in the
+     * auto-regression container benchmark, seeding the regression loop.
+     */
+    autoCase: z<boolean, boolean>;
     /**
      * Gap C1: optional model override for the review gate (cheaper model).
      * Format: "provider/model" or just "model" (same provider as the agent).
@@ -97,6 +103,12 @@ export declare const Config: z<Schemastery.ObjectS<{
     logMaxBytes: z<number, number>;
     /** After a benchmark decision rejects a candidate, roll the refinement back automatically. */
     autoRollbackOnReject: z<boolean, boolean>;
+    /**
+     * P1 auto-case capture: failed evolution attempts (benchmark-rejected
+     * candidates, gate proposals without consent) land as draft cases in the
+     * auto-regression container benchmark, seeding the regression loop.
+     */
+    autoCase: z<boolean, boolean>;
     /**
      * Gap C1: optional model override for the review gate (cheaper model).
      * Format: "provider/model" or just "model" (same provider as the agent).

package/lib/index.js

@@ -53,6 +53,12 @@ export const Config = z.object({
     logMaxBytes: z.natural().default(5 * 1024 * 1024),
     /** After a benchmark decision rejects a candidate, roll the refinement back automatically. */
     autoRollbackOnReject: z.boolean().default(true),
+    /**
+     * P1 auto-case capture: failed evolution attempts (benchmark-rejected
+     * candidates, gate proposals without consent) land as draft cases in the
+     * auto-regression container benchmark, seeding the regression loop.
+     */
+    autoCase: z.boolean().default(true),
     /**
      * Gap C1: optional model override for the review gate (cheaper model).
      * Format: "provider/model" or just "model" (same provider as the agent).
@@ -127,9 +133,11 @@ export function apply(ctx, config) {
         minPromoteChars: config.promotionMinChars,
     });
     registerEvolveTools(ctx, engine, gate);
+    const rubricKey = resolveRubricKey(baseDir, config.rubricKey, process.env, (m) => ctx.logger("continual-evolve").warn(m));
     registerEvolveCommand(ctx, engine, gate, {
-        rubricKey: resolveRubricKey(baseDir, config.rubricKey, process.env, (m) => ctx.logger("continual-evolve").warn(m)),
+        rubricKey,
         autoRollbackOnReject: config.autoRollbackOnReject ?? true,
+        autoCase: config.autoCase ?? true,
         promotionPolicy,
     });
     // Plugin-owned file logging: every cordis log message lands in
@@ -155,6 +163,8 @@ export function apply(ctx, config) {
             fateIntervalTurns: config.fateIntervalTurns ?? config.reviewIntervalTurns ?? 6,
             goalBlockedWrapupTurns: config.goalBlockedWrapupTurns ?? 3,
             promotionPolicy,
+            autoCase: config.autoCase ?? true,
+            rubricKey,
             ...(config.reviewModel ? { reviewModel: config.reviewModel } : {}),
         });
         ctx.logger("continual-evolve").info(`continual-evolve auto-review enabled (every ${config.reviewIntervalTurns ?? 6} turns; local-fate ${config.localFate ?? true ? "on" : "off"} every ${config.fateIntervalTurns ?? config.reviewIntervalTurns ?? 6} turns)`);

package/lib/inject.d.ts

@@ -70,14 +70,16 @@ export interface InjectContext {
  */
 export declare function recencyScore(entry: HarnessEntry, now: number): number;
 /**
- * Rank entries for injection, best first. With no query the ranking is pure
- * recency (newest first). With a query, entries are scored once against a
- * per-call BM25 index (CJK bigrams; field-weighted title ×2 — see
- * search.ts): any entry with a positive score (≥1 matched token) outranks
- * every hit-less entry (score exactly 0), scores decide the order among
- * relevant entries, recency breaks remaining ties, and the stable dictionary
- * order is the final tiebreak, so the result is deterministic. The input is
- * never mutated.
+ * Rank entries for injection, best first. With no query the ranking is
+ * negative-valence first (contradicted entries last), then pure recency
+ * (newest first). With a query, entries are scored once against a per-call
+ * BM25 index (CJK bigrams; field-weighted title ×2 — see search.ts): any
+ * entry with a positive score (≥1 matched token) outranks every hit-less
+ * entry (score exactly 0), scores decide the order among relevant entries,
+ * the negative-valence counter breaks remaining ties (contradicted entries
+ * sink), recency breaks remaining ties, and the stable dictionary order is
+ * the final tiebreak, so the result is deterministic. The input is never
+ * mutated.
  */
 export declare function rankEntries(entries: readonly HarnessEntry[], query?: string, now?: number): HarnessEntry[];
 /**

package/lib/inject.js

@@ -1,4 +1,4 @@
-import { isArchived } from "./types.js";
+import { isArchived, VALENCE_NEGATIVE_KEY } from "./types.js";
 import { mergeHarnessStates } from "./state.js";
 import { entryLine } from "./render.js";
 import { recordInjection } from "./usage.js";
@@ -38,19 +38,35 @@ export function recencyScore(entry, now) {
     return Math.max(0, 1 - age / RECENCY_HALF_LIFE_MS);
 }
 /**
- * Rank entries for injection, best first. With no query the ranking is pure
- * recency (newest first). With a query, entries are scored once against a
- * per-call BM25 index (CJK bigrams; field-weighted title ×2 — see
- * search.ts): any entry with a positive score (≥1 matched token) outranks
- * every hit-less entry (score exactly 0), scores decide the order among
- * relevant entries, recency breaks remaining ties, and the stable dictionary
- * order is the final tiebreak, so the result is deterministic. The input is
- * never mutated.
+ * Negative-valence counter (P1 效价反馈): entries contradicted by later
+ * assessments sink below clean ones at equal relevance/recency — the
+ * behavioral analog of a confidence penalty (pi-continuous-learning's
+ * contradicted −0.15), without inventing a new score axis.
+ */
+function negativeValence(entry) {
+    const value = entry.metadata[VALENCE_NEGATIVE_KEY];
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
+}
+/**
+ * Rank entries for injection, best first. With no query the ranking is
+ * negative-valence first (contradicted entries last), then pure recency
+ * (newest first). With a query, entries are scored once against a per-call
+ * BM25 index (CJK bigrams; field-weighted title ×2 — see search.ts): any
+ * entry with a positive score (≥1 matched token) outranks every hit-less
+ * entry (score exactly 0), scores decide the order among relevant entries,
+ * the negative-valence counter breaks remaining ties (contradicted entries
+ * sink), recency breaks remaining ties, and the stable dictionary order is
+ * the final tiebreak, so the result is deterministic. The input is never
+ * mutated.
  */
 export function rankEntries(entries, query, now = Date.now()) {
     const q = (query ?? "").trim();
     if (q.length === 0) {
         return [...entries].sort((a, b) => {
+            const valenceDelta = negativeValence(a) - negativeValence(b);
+            if (valenceDelta !== 0) {
+                return valenceDelta;
+            }
             const recencyDelta = recencyScore(b, now) - recencyScore(a, now);
             if (recencyDelta !== 0) {
                 return recencyDelta;
@@ -68,6 +84,10 @@ export function rankEntries(entries, query, now = Date.now()) {
         if (relevanceDelta !== 0) {
             return relevanceDelta;
         }
+        const valenceDelta = negativeValence(a) - negativeValence(b);
+        if (valenceDelta !== 0) {
+            return valenceDelta;
+        }
         const recencyDelta = recencyScore(b, now) - recencyScore(a, now);
         if (recencyDelta !== 0) {
             return recencyDelta;

package/lib/mount.js

@@ -16,6 +16,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { skillNameOf } from "./skill.js";
+import { secretLeakReason } from "./promotion.js";
 export function mountedDir(baseDir) {
     return join(baseDir, "evolve", "mounted");
 }
@@ -41,6 +42,14 @@ export function saveLedger(baseDir, ledger) {
 }
 /** Generate the plugin package files for one skill entry; returns the package dir. */
 export function renderMountPackage(baseDir, entry) {
+    // Secret-leak quarantine: the entry content AND its reference contract are
+    // embedded verbatim into the generated index.js, so a credential in either
+    // would be written to disk (and executed in-process). Block before ANY
+    // file is created (review audit 2026-08-28 B2: reference was unscreened).
+    const secret = secretLeakReason([entry.title, entry.content, JSON.stringify(entry.reference ?? {}), JSON.stringify(entry.arguments ?? {})].join("\n"));
+    if (secret) {
+        throw new Error(`mount blocked: ${secret}`);
+    }
     const dir = join(mountedDir(baseDir), skillNameOf(entry.id));
     mkdirSync(dir, { recursive: true });
     const toolName = `skill_${skillNameOf(entry.id)}`;

package/lib/promotion.d.ts

@@ -33,6 +33,13 @@ export declare const DEFAULT_PROMOTION_POLICY: PromotionPolicy;
 export declare const CONFLICT_BLOCK_SCORE = 0.8;
 /** Similarity at/above this stamps {@link CONFLICT_HINT_KEY} but lets the write proceed. */
 export declare const CONFLICT_WARN_SCORE = 0.5;
+/**
+ * First reason the content reads as carrying a live credential, or undefined
+ * when it screens clean. Unlike {@link projectScopedReason} this guard is
+ * NOT policy-configurable — it protects every sink at once (promotion path,
+ * global writes at the engine throat, mount materialization).
+ */
+export declare function secretLeakReason(content: string): string | undefined;
 /**
  * Build a policy from config values (schemastery strings compiled here so
  * the config layer never touches RegExp). Invalid patterns are skipped —
@@ -50,9 +57,13 @@ export declare function resolvePromotionPolicy(options: {
  */
 export declare function projectScopedReason(content: string, policy: PromotionPolicy): string | undefined;
 /**
- * Tokenize for cheap similarity: ASCII words plus CJK character bigrams
- * (single CJK chars are too ambiguous; bigrams survive segmentation-free
- * Chinese text). Lowercased; single-char ASCII tokens dropped as noise.
+ * Token set for cheap similarity, built on the search module's tokenizer —
+ * one home for "how this project splits words" (ASCII words lowercased plus
+ * CJK character bigrams; bigrams survive segmentation-free Chinese text).
+ * The set form feeds Jaccard overlap (review audit 2026-08-28 C: the
+ * previous private tokenizer duplicated the definition; the calibrated
+ * 0.6/0.8 thresholds are judgment values, not data-fitted, so the merge
+ * costs at most a test re-pin).
  */
 export declare function normalizedTokens(text: string): Set<string>;
 /** Jaccard similarity of two texts' normalized token sets (0..1). */

package/lib/promotion.js

@@ -1,4 +1,5 @@
 import { isArchived } from "./types.js";
+import { tokenize } from "./search.js";
 /** Regex sources that mark content as project-scoped (never global). */
 const DEFAULT_BLOCK_PATTERNS = [
     String.raw `\/(?:mnt|home|Users)\/`, // absolute POSIX paths: "/home/…", "/mnt/…", "/Users/…"
@@ -19,6 +20,59 @@ export const DEFAULT_PROMOTION_POLICY = {
 export const CONFLICT_BLOCK_SCORE = 0.8;
 /** Similarity at/above this stamps {@link CONFLICT_HINT_KEY} but lets the write proceed. */
 export const CONFLICT_WARN_SCORE = 0.5;
+/**
+ * Fixed secret-detection patterns — a security invariant, deliberately NOT
+ * part of the configurable {@link PromotionPolicy}: a user pattern typo must
+ * never be able to disable secret screening. Each entry pairs a human label
+ * with a regex tuned for low false positives (placeholders like
+ * "YOUR_API_KEY_HERE" don't match; realistic mixed literals do).
+ */
+const SECRET_PATTERNS = [
+    { label: "AnySearch API key", regex: /\bas_sk_[A-Za-z0-9]{8,}\b/ },
+    { label: "Anthropic API key", regex: /\bsk-ant-[A-Za-z0-9_-]{16,}\b/ },
+    { label: "OpenAI-style API key", regex: /\bsk-(?:proj-)?[A-Za-z0-9_-]{16,}\b/ },
+    { label: "GitHub token", regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/ },
+    { label: "GitHub fine-grained PAT", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/ },
+    { label: "AWS access key", regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/ },
+    { label: "Google API key", regex: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+    { label: "Slack token", regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/ },
+    { label: "npm grant token", regex: /\bnpm_[A-Za-z0-9]{36}\b/ },
+    { label: "private key block", regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/ },
+    {
+        label: "credential assignment",
+        // The credential-name group is manually case-insensitive ("apiKey" in
+        // JSON, "API_KEY" in env examples) so the placeholder lookahead stays
+        // case-sensitive: it excludes only ALL-CAPS placeholders
+        // ("YOUR_KEY_HERE"), not real mixed/lowercase literals.
+        regex: /\b(?:[Aa][Pp][Ii][_-]?[Kk][Ee][Yy]|[Ss][Ee][Cc][Rr][Ee][Tt]|[Tt][Oo][Kk][Ee][Nn]|[Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd]|[Pp][Aa][Ss][Ss][Ww][Dd]|[Pp][Ww][Dd])\b["']?\s*[:=]\s*["'](?!["']*[A-Z0-9_]+["'])[A-Za-z0-9+/_-]{16,}["']/,
+    },
+];
+/**
+ * Redact a matched secret for error/audit surfaces: enough to identify the
+ * credential family, never the full value (reasons land in reviews.jsonl,
+ * question texts, and logs).
+ */
+function redactSecret(matched) {
+    if (matched.length <= 10) {
+        return `${matched.slice(0, 3)}…`;
+    }
+    return `${matched.slice(0, 6)}…${matched.slice(-3)}`;
+}
+/**
+ * First reason the content reads as carrying a live credential, or undefined
+ * when it screens clean. Unlike {@link projectScopedReason} this guard is
+ * NOT policy-configurable — it protects every sink at once (promotion path,
+ * global writes at the engine throat, mount materialization).
+ */
+export function secretLeakReason(content) {
+    for (const { label, regex } of SECRET_PATTERNS) {
+        const match = regex.exec(content);
+        if (match?.[0]) {
+            return `possible ${label} ("${redactSecret(match[0])}") — secrets must never be sedimented into harness state; rotate the credential and keep it out of the store`;
+        }
+    }
+    return undefined;
+}
 /**
  * Build a policy from config values (schemastery strings compiled here so
  * the config layer never touches RegExp). Invalid patterns are skipped —
@@ -55,26 +109,16 @@ export function projectScopedReason(content, policy) {
     return undefined;
 }
 /**
- * Tokenize for cheap similarity: ASCII words plus CJK character bigrams
- * (single CJK chars are too ambiguous; bigrams survive segmentation-free
- * Chinese text). Lowercased; single-char ASCII tokens dropped as noise.
+ * Token set for cheap similarity, built on the search module's tokenizer —
+ * one home for "how this project splits words" (ASCII words lowercased plus
+ * CJK character bigrams; bigrams survive segmentation-free Chinese text).
+ * The set form feeds Jaccard overlap (review audit 2026-08-28 C: the
+ * previous private tokenizer duplicated the definition; the calibrated
+ * 0.6/0.8 thresholds are judgment values, not data-fitted, so the merge
+ * costs at most a test re-pin).
  */
 export function normalizedTokens(text) {
-    const lowered = text.toLowerCase();
-    const tokens = new Set();
-    for (const match of lowered.matchAll(/[a-z0-9_]{2,}/g)) {
-        tokens.add(match[0] ?? "");
-    }
-    let previous;
-    for (const match of lowered.matchAll(/[\u3400-\u9fff]/g)) {
-        const char = match[0] ?? "";
-        if (previous !== undefined) {
-            tokens.add(`${previous}${char}`);
-        }
-        previous = char;
-    }
-    tokens.delete("");
-    return tokens;
+    return new Set(tokenize(text));
 }
 /** Jaccard similarity of two texts' normalized token sets (0..1). */
 export function contentOverlap(a, b) {

package/lib/rollback.js

@@ -19,6 +19,8 @@ export function rollbackProposal(target) {
 function inverseEdit(edit, refinementId) {
     if (edit.before && edit.after) {
         // Forward action was an update: restore the before snapshot.
+        // skill_kind rides along (review audit 2026-08-28 B4): without it a
+        // rollback could flip the skill form or fail validation on re-apply.
         return {
             action: "update",
             kind: edit.kind,
@@ -28,12 +30,16 @@ function inverseEdit(edit, refinementId) {
             path: edit.before.path,
             reference: edit.before.reference,
             arguments: edit.before.arguments,
+            ...(edit.before.skill_kind !== undefined ? { skill_kind: edit.before.skill_kind } : {}),
             metadata: edit.before.metadata,
             reason: `Rollback ${refinementId}`,
         };
     }
     if (edit.before) {
         // Forward action was a delete: re-create the entry from the snapshot.
+        // skill_kind is required for the re-created skill to pass the same
+        // contract validation as the original create (B4: a deleted guidance
+        // skill was previously unrecoverable via rollback).
         return {
             action: "create",
             kind: edit.kind,
@@ -43,6 +49,7 @@ function inverseEdit(edit, refinementId) {
             path: edit.before.path,
             reference: edit.before.reference,
             arguments: edit.before.arguments,
+            ...(edit.before.skill_kind !== undefined ? { skill_kind: edit.before.skill_kind } : {}),
             metadata: edit.before.metadata,
             reason: `Rollback ${refinementId}`,
         };