fastify 6.0.0-alpha.0 → 6.0.0-alpha.2

package/.pi/self-learning-memory/core/index.json

@@ -0,0 +1,735 @@
+{
+  "version": 1,
+  "updatedAt": "2026-08-18T19:46:43.092Z",
+  "items": [
+    {
+      "key": "pass workflow input through `env.npm_package` and read it from `process.env` inside the script.",
+      "text": "Pass workflow input through `env.NPM_PACKAGE` and read it from `process.env` inside the script.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-06T15:46:17.613Z",
+      "lastSeen": "2026-07-06T15:46:17.613Z"
+    },
+    {
+      "key": "validate the package name with an npm package-name regex before using it.",
+      "text": "Validate the package name with an npm package-name regex before using it.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-06T15:46:17.613Z",
+      "lastSeen": "2026-07-06T15:46:17.613Z"
+    },
+    {
+      "key": "use `encodeuricomponent(packagename)` in the npm registry url.",
+      "text": "Use `encodeURIComponent(packageName)` in the npm registry URL.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-06T15:46:17.613Z",
+      "lastSeen": "2026-07-06T15:46:17.613Z"
+    },
+    {
+      "key": "check `response.ok` and throw explicit errors for failed registry fetches or unsupported repository urls.",
+      "text": "Check `response.ok` and throw explicit errors for failed registry fetches or unsupported repository URLs.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-06T15:46:17.613Z",
+      "lastSeen": "2026-07-06T15:46:17.613Z"
+    },
+    {
+      "key": "avoid: interpolated `${{ inputs.package }}` directly into `actions/github-script` javascript, allowing malformed input to break or inject code.",
+      "text": "Avoid: Interpolated `${{ inputs.package }}` directly into `actions/github-script` JavaScript, allowing malformed input to break or inject code.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-06T15:46:17.613Z",
+      "lastSeen": "2026-07-06T15:46:17.613Z"
+    },
+    {
+      "key": "avoid: fetched npm metadata with the raw package name instead of url-encoding it.",
+      "text": "Avoid: Fetched npm metadata with the raw package name instead of URL-encoding it.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-06T15:46:17.613Z",
+      "lastSeen": "2026-07-06T15:46:17.613Z"
+    },
+    {
+      "key": "avoid: assumed `data.repository.url` always existed and was a github `.git` url.",
+      "text": "Avoid: Assumed `data.repository.url` always existed and was a GitHub `.git` URL.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-06T15:46:17.613Z",
+      "lastSeen": "2026-07-06T15:46:17.613Z"
+    },
+    {
+      "key": "avoid: used a brittle repository url regex that missed scoped/modern github url formats and failed without a clear error.",
+      "text": "Avoid: Used a brittle repository URL regex that missed scoped/modern GitHub URL formats and failed without a clear error.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-06T15:46:17.613Z",
+      "lastSeen": "2026-07-06T15:46:17.613Z"
+    },
+    {
+      "key": "renamed pr #6833 to `ci: harden citgm package workflow input handling` using `gh pr edit`, then watched checks until `pull-request-title-check` passed.",
+      "text": "Renamed PR #6833 to `ci: harden CITGM package workflow input handling` using `gh pr edit`, then watched checks until `pull-request-title-check` passed.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-06T16:04:51.833Z",
+      "lastSeen": "2026-07-06T16:04:51.833Z"
+    },
+    {
+      "key": "avoid: pr title did not satisfy the repository's conventional title check before opening/updating the pr.",
+      "text": "Avoid: PR title did not satisfy the repository's conventional title check before opening/updating the PR.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-06T16:04:51.833Z",
+      "lastSeen": "2026-07-06T16:04:51.833Z"
+    },
+    {
+      "key": "honor soft tool-budget and interruption signals immediately; stop browsing and provide a bounded reflection.",
+      "text": "Honor soft tool-budget and interruption signals immediately; stop browsing and provide a bounded reflection.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T19:37:37.132Z",
+      "lastSeen": "2026-07-29T19:37:37.132Z"
+    },
+    {
+      "key": "run only the single highest-value targeted test before the budget limit, then report if execution is blocked.",
+      "text": "Run only the single highest-value targeted test before the budget limit, then report if execution is blocked.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T19:37:37.132Z",
+      "lastSeen": "2026-07-29T19:37:37.132Z"
+    },
+    {
+      "key": "reproduce root primitive coercion with the repository’s actual validatorcompiler path rather than relying on ajv internals alone.",
+      "text": "Reproduce root primitive coercion with the repository’s actual validatorCompiler path rather than relying on Ajv internals alone.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T19:37:37.132Z",
+      "lastSeen": "2026-07-29T19:37:37.132Z"
+    },
+    {
+      "key": "add focused tests covering custom validator compilation, schemaenv availability, and root primitive coercion.",
+      "text": "Add focused tests covering custom validator compilation, schemaEnv availability, and root primitive coercion.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T19:37:37.132Z",
+      "lastSeen": "2026-07-29T19:37:37.132Z"
+    },
+    {
+      "key": "avoid: continued initiating tool work after the tool-budget warning instead of stopping to assess the existing evidence.",
+      "text": "Avoid: Continued initiating tool work after the tool-budget warning instead of stopping to assess the existing evidence.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T19:37:37.132Z",
+      "lastSeen": "2026-07-29T19:37:37.132Z"
+    },
+    {
+      "key": "avoid: started a test command that was aborted, leaving the primitive-coercion fix unverified.",
+      "text": "Avoid: Started a test command that was aborted, leaving the primitive-coercion fix unverified.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T19:37:37.132Z",
+      "lastSeen": "2026-07-29T19:37:37.132Z"
+    },
+    {
+      "key": "avoid: investigated ajv internals and custom compiler compatibility without first isolating the exact failing repository behavior.",
+      "text": "Avoid: Investigated Ajv internals and custom compiler compatibility without first isolating the exact failing repository behavior.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T19:37:37.132Z",
+      "lastSeen": "2026-07-29T19:37:37.132Z"
+    },
+    {
+      "key": "avoid: did not establish regression coverage for missing schemaenv handling and root primitive coercion before changing direction.",
+      "text": "Avoid: Did not establish regression coverage for missing schemaEnv handling and root primitive coercion before changing direction.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T19:37:37.132Z",
+      "lastSeen": "2026-07-29T19:37:37.132Z"
+    },
+    {
+      "key": "pass request and parameter metadata as ajv parentdata/parentdataproperty so root coercions update the original request value.",
+      "text": "Pass request and parameter metadata as Ajv parentData/parentDataProperty so root coercions update the original request value.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:03:27.706Z",
+      "lastSeen": "2026-07-29T20:03:27.706Z"
+    },
+    {
+      "key": "add a regression test asserting quoted numeric json becomes a number in the handler while out-of-range values remain rejected.",
+      "text": "Add a regression test asserting quoted numeric JSON becomes a number in the handler while out-of-range values remain rejected.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:03:27.706Z",
+      "lastSeen": "2026-07-29T20:03:27.706Z"
+    },
+    {
+      "key": "verify targeted test execution separately from the full suite to avoid mistaking aggregate counts for focused coverage.",
+      "text": "Verify targeted test execution separately from the full suite to avoid mistaking aggregate counts for focused coverage.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:03:27.706Z",
+      "lastSeen": "2026-07-29T20:03:27.706Z"
+    },
+    {
+      "key": "avoid: root primitive request values were validated without a parent reference, so ajv coercion changed only its local value and left request.body as a string.",
+      "text": "Avoid: Root primitive request values were validated without a parent reference, so Ajv coercion changed only its local value and left request.body as a string.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:03:27.706Z",
+      "lastSeen": "2026-07-29T20:03:27.706Z"
+    },
+    {
+      "key": "avoid: test command output was misread: borp ran the broader suite despite a specific file argument, making targeted coverage unclear.",
+      "text": "Avoid: Test command output was misread: Borp ran the broader suite despite a specific file argument, making targeted coverage unclear.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:03:27.706Z",
+      "lastSeen": "2026-07-29T20:03:27.706Z"
+    },
+    {
+      "key": "pass parentdata and parentdataproperty to ajv validators so root primitive coercions update the request object.",
+      "text": "Pass parentData and parentDataProperty to Ajv validators so root primitive coercions update the request object.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:06:55.452Z",
+      "lastSeen": "2026-07-29T20:06:55.452Z"
+    },
+    {
+      "key": "retain the direct-call path for validators without schemaenv to avoid changing non-ajv validator behavior.",
+      "text": "Retain the direct-call path for validators without schemaEnv to avoid changing non-Ajv validator behavior.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:06:55.452Z",
+      "lastSeen": "2026-07-29T20:06:55.452Z"
+    },
+    {
+      "key": "add a regression test asserting quoted numeric json reaches the handler as number 10.",
+      "text": "Add a regression test asserting quoted numeric JSON reaches the handler as number 10.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:06:55.452Z",
+      "lastSeen": "2026-07-29T20:06:55.452Z"
+    },
+    {
+      "key": "determine pr from the deployed route’s authentication requirements; use pr:n for unauthenticated endpoints.",
+      "text": "Determine PR from the deployed route’s authentication requirements; use PR:N for unauthenticated endpoints.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:06:55.452Z",
+      "lastSeen": "2026-07-29T20:06:55.452Z"
+    },
+    {
+      "key": "base c/i impact on the specific handler and data affected rather than assigning a universal fastify score.",
+      "text": "Base C/I impact on the specific handler and data affected rather than assigning a universal Fastify score.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:06:55.452Z",
+      "lastSeen": "2026-07-29T20:06:55.452Z"
+    },
+    {
+      "key": "avoid: ajv was called with a primitive root value without parentdata context, so coerced values were not written back to request.body.",
+      "text": "Avoid: Ajv was called with a primitive root value without parentData context, so coerced values were not written back to request.body.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:06:55.452Z",
+      "lastSeen": "2026-07-29T20:06:55.452Z"
+    },
+    {
+      "key": "avoid: the regression scenario was initially vulnerable because the handler received string \"10\" after validation accepted it.",
+      "text": "Avoid: The regression scenario was initially vulnerable because the handler received string \"10\" after validation accepted it.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:06:55.452Z",
+      "lastSeen": "2026-07-29T20:06:55.452Z"
+    },
+    {
+      "key": "avoid: the cvss rating assumed pr:l without repository evidence that authentication is required; many affected routes may be unauthenticated.",
+      "text": "Avoid: The CVSS rating assumed PR:L without repository evidence that authentication is required; many affected routes may be unauthenticated.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:06:55.452Z",
+      "lastSeen": "2026-07-29T20:06:55.452Z"
+    },
+    {
+      "key": "avoid: the impact rating was stated as application-dependent without defining the affected endpoint’s actual confidentiality and integrity consequences.",
+      "text": "Avoid: The impact rating was stated as application-dependent without defining the affected endpoint’s actual confidentiality and integrity consequences.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:06:55.452Z",
+      "lastSeen": "2026-07-29T20:06:55.452Z"
+    },
+    {
+      "key": "updated `lib/validation.js` to retain and return coerced root values.",
+      "text": "Updated `lib/validation.js` to retain and return coerced root values.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:09:41.212Z",
+      "lastSeen": "2026-07-29T20:09:41.212Z"
+    },
+    {
+      "key": "added `test/fix-root-primitive-coercion.test.js` to prevent recurrence.",
+      "text": "Added `test/fix-root-primitive-coercion.test.js` to prevent recurrence.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:09:41.212Z",
+      "lastSeen": "2026-07-29T20:09:41.212Z"
+    },
+    {
+      "key": "avoid: validation coerced a root primitive but failed to preserve the coerced value for the caller.",
+      "text": "Avoid: Validation coerced a root primitive but failed to preserve the coerced value for the caller.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:09:41.212Z",
+      "lastSeen": "2026-07-29T20:09:41.212Z"
+    },
+    {
+      "key": "avoid: the regression scenario was not covered by existing tests.",
+      "text": "Avoid: The regression scenario was not covered by existing tests.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-07-29T20:09:41.212Z",
+      "lastSeen": "2026-07-29T20:09:41.212Z"
+    },
+    {
+      "key": "always log/compare the exact pathname string passed into send(), including after encodeuri",
+      "text": "Always log/compare the exact pathname string passed into send(), including after encodeURI",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T10:59:32.673Z",
+      "lastSeen": "2026-08-04T10:59:32.673Z"
+    },
+    {
+      "key": "when statuses differ for \"same\" path, diff charcodes for % vs %25 double-encoding first",
+      "text": "When statuses differ for \"same\" path, diff charCodes for % vs %25 double-encoding first",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T10:59:32.673Z",
+      "lastSeen": "2026-08-04T10:59:32.673Z"
+    },
+    {
+      "key": "instrument static handler vs router to separate callnotfound from unmatched routes",
+      "text": "Instrument static handler vs router to separate callNotFound from unmatched routes",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T10:59:32.673Z",
+      "lastSeen": "2026-08-04T10:59:32.673Z"
+    },
+    {
+      "key": "trace full pipeline: raw.url → getpathnameforsend → dotdot guards → encodeuri → @fastify/send",
+      "text": "Trace full pipeline: raw.url → getPathnameForSend → dotDot guards → encodeURI → @fastify/send",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T10:59:32.673Z",
+      "lastSeen": "2026-08-04T10:59:32.673Z"
+    },
+    {
+      "key": "reproduce with send(root, p) using both raw and encodeuri(p) before changing triage conclusions",
+      "text": "Reproduce with send(root, p) using both raw and encodeURI(p) before changing triage conclusions",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T10:59:32.673Z",
+      "lastSeen": "2026-08-04T10:59:32.673Z"
+    },
+    {
+      "key": "avoid: assumed /static/..%2f… 404 meant getpathnameforsend/route miss instead of later send pipeline behavior",
+      "text": "Avoid: Assumed /static/..%2f… 404 meant getPathnameForSend/route miss instead of later send pipeline behavior",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T10:59:32.673Z",
+      "lastSeen": "2026-08-04T10:59:32.673Z"
+    },
+    {
+      "key": "avoid: did not check that encodeuri() re-encodes residual % as %25 before blaming path guards",
+      "text": "Avoid: Did not check that encodeURI() re-encodes residual % as %25 before blaming path guards",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T10:59:32.673Z",
+      "lastSeen": "2026-08-04T10:59:32.673Z"
+    },
+    {
+      "key": "avoid: conflated reply.callnotfound() json (\"route get:… not found\") with an actual find-my-way miss",
+      "text": "Avoid: Conflated reply.callNotFound() JSON (\"Route GET:… not found\") with an actual find-my-way miss",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T10:59:32.673Z",
+      "lastSeen": "2026-08-04T10:59:32.673Z"
+    },
+    {
+      "key": "avoid: debugged isolated getpathnameforsend reimplementation before tracing pumpsendtoreply → encodeuri(pathnameforsend) → @fastify/send",
+      "text": "Avoid: Debugged isolated getPathnameForSend reimplementation before tracing pumpSendToReply → encodeURI(pathnameForSend) → @fastify/send",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T10:59:32.673Z",
+      "lastSeen": "2026-08-04T10:59:32.673Z"
+    },
+    {
+      "key": "avoid: compared send() on decoded ../ paths (403) to static outcomes without using the exact post-encodeuri string static passes",
+      "text": "Avoid: Compared send() on decoded ../ paths (403) to static outcomes without using the exact post-encodeURI string static passes",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T10:59:32.673Z",
+      "lastSeen": "2026-08-04T10:59:32.673Z"
+    },
+    {
+      "key": "empirically print encodeuri output/charcodes: '%' → '%25', so static sees '/..%252ftop-secret.txt' (safe 404) not a '..' segment.",
+      "text": "Empirically print encodeURI output/charCodes: '%' → '%25', so static sees '/..%252ftop-secret.txt' (safe 404) not a '..' segment.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T11:12:27.539Z",
+      "lastSeen": "2026-08-04T11:12:27.539Z"
+    },
+    {
+      "key": "reproduce with @fastify/send directly for raw percent, encodeuri(percent), and decoded '../' to map 403 vs 404 to normalize/root logic.",
+      "text": "Reproduce with @fastify/send directly for raw percent, encodeURI(percent), and decoded '../' to map 403 vs 404 to normalize/root logic.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T11:12:27.539Z",
+      "lastSeen": "2026-08-04T11:12:27.539Z"
+    },
+    {
+      "key": "keep reporter response framed as app-level path.join(param) misuse; cite static/sendfile containment and express parity, not a core cve.",
+      "text": "Keep reporter response framed as app-level path.join(param) misuse; cite static/sendFile containment and Express parity, not a core CVE.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T11:12:27.539Z",
+      "lastSeen": "2026-08-04T11:12:27.539Z"
+    },
+    {
+      "key": "avoid: assumed encodeuri leaves '%' intact on paths like '/..%2ftop-secret.txt', so static 404 vs raw '..' 403 looked inconsistent.",
+      "text": "Avoid: Assumed encodeURI leaves '%' intact on paths like '/..%2ftop-secret.txt', so static 404 vs raw '..' 403 looked inconsistent.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T11:12:27.539Z",
+      "lastSeen": "2026-08-04T11:12:27.539Z"
+    },
+    {
+      "key": "avoid: treated encoded traversal and decoded param sinks as the same layer before separating find-my-way dual-decode from @fastify/send root checks.",
+      "text": "Avoid: Treated encoded traversal and decoded param sinks as the same layer before separating find-my-way dual-decode from @fastify/send root checks.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T11:12:27.539Z",
+      "lastSeen": "2026-08-04T11:12:27.539Z"
+    },
+    {
+      "key": "avoid: relied on log/message shape alone (callnotfound 'route ... not found') to infer static failure mode without probing @fastify/send inputs.",
+      "text": "Avoid: Relied on log/message shape alone (callNotFound 'Route ... not found') to infer static failure mode without probing @fastify/send inputs.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T11:12:27.539Z",
+      "lastSeen": "2026-08-04T11:12:27.539Z"
+    },
+    {
+      "key": "re-run markdownlint scoped strictly to docs/reference/request.md and docs/reference/routes.md.",
+      "text": "Re-run markdownlint scoped strictly to docs/Reference/Request.md and docs/Reference/Routes.md.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T12:31:54.341Z",
+      "lastSeen": "2026-08-04T12:31:54.341Z"
+    },
+    {
+      "key": "stage only those two paths (git add docs/reference/request.md docs/reference/routes.md); never git add .",
+      "text": "Stage only those two paths (git add docs/Reference/Request.md docs/Reference/Routes.md); never git add .",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T12:31:54.341Z",
+      "lastSeen": "2026-08-04T12:31:54.341Z"
+    },
+    {
+      "key": "manually awk length>80 on changed files to confirm new lines stay ≤80 before commit.",
+      "text": "Manually awk length>80 on changed files to confirm new lines stay ≤80 before commit.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T12:31:54.341Z",
+      "lastSeen": "2026-08-04T12:31:54.341Z"
+    },
+    {
+      "key": "leave response.md untracked and verify git status/diff --stat before commit and pr.",
+      "text": "Leave response.md untracked and verify git status/diff --stat before commit and PR.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T12:31:54.341Z",
+      "lastSeen": "2026-08-04T12:31:54.341Z"
+    },
+    {
+      "key": "avoid: markdown lint invoked in a way that flooded output with unrelated files (agents.md, .pi memory, response.md) instead of only the two edited docs.",
+      "text": "Avoid: Markdown lint invoked in a way that flooded output with unrelated files (AGENTS.md, .pi memory, response.md) instead of only the two edited docs.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T12:31:54.341Z",
+      "lastSeen": "2026-08-04T12:31:54.341Z"
+    },
+    {
+      "key": "avoid: untracked response.md sat in the working tree and could have been staged if git add was too broad.",
+      "text": "Avoid: Untracked response.md sat in the working tree and could have been staged if git add was too broad.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T12:31:54.341Z",
+      "lastSeen": "2026-08-04T12:31:54.341Z"
+    },
+    {
+      "key": "avoid: relied on noisy repo-wide lint signal before confirming md013 on the actual changed regions.",
+      "text": "Avoid: Relied on noisy repo-wide lint signal before confirming MD013 on the actual changed regions.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-04T12:31:54.341Z",
+      "lastSeen": "2026-08-04T12:31:54.341Z"
+    },
+    {
+      "key": "before any security-fix push, explicitly ask whether targets are the private advisory fork, public `origin`, or both; treat a draft advisory as a warning, not implicit authorization policy.",
+      "text": "Before any security-fix push, explicitly ask whether targets are the private advisory fork, public `origin`, or both; treat a draft advisory as a warning, not implicit authorization policy.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:37:20.498Z",
+      "lastSeen": "2026-08-18T19:37:20.498Z"
+    },
+    {
+      "key": "always state push destinations and exact resulting refs, e.g. `advisory-ghsa-3m5p/main` changed while `origin/main` remained at `6e95cb9f`.",
+      "text": "Always state push destinations and exact resulting refs, e.g. `advisory-ghsa-3m5p/main` changed while `origin/main` remained at `6e95cb9f`.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:37:20.498Z",
+      "lastSeen": "2026-08-18T19:37:20.498Z"
+    },
+    {
+      "key": "run workspace-sensitive pr operations separately: attempt the comment, record an expected permission denial, then independently close only if authorized.",
+      "text": "Run workspace-sensitive PR operations separately: attempt the comment, record an expected permission denial, then independently close only if authorized.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:37:20.498Z",
+      "lastSeen": "2026-08-18T19:37:20.498Z"
+    },
+    {
+      "key": "describe pr state from verified fields (`closed`, `mergedat: null`, head/base oids) rather than inferring that it is empty.",
+      "text": "Describe PR state from verified fields (`CLOSED`, `mergedAt: null`, head/base OIDs) rather than inferring that it is empty.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:37:20.498Z",
+      "lastSeen": "2026-08-18T19:37:20.498Z"
+    },
+    {
+      "key": "keep local security branches until the user confirms the intended public/private publication state; delete them only after final authorization and ref verification.",
+      "text": "Keep local security branches until the user confirms the intended public/private publication state; delete them only after final authorization and ref verification.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:37:20.498Z",
+      "lastSeen": "2026-08-18T19:37:20.498Z"
+    },
+    {
+      "key": "avoid: assumed the draft advisory meant `origin/main` and `origin/5.x` must remain untouched without first confirming whether the user expected public pushes.",
+      "text": "Avoid: Assumed the draft advisory meant `origin/main` and `origin/5.x` must remain untouched without first confirming whether the user expected public pushes.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:37:20.498Z",
+      "lastSeen": "2026-08-18T19:37:20.498Z"
+    },
+    {
+      "key": "avoid: reported that the private branches were complete without clearly distinguishing advisory-fork refs from public `origin` refs, prompting the user to stop and verify deployment status.",
+      "text": "Avoid: Reported that the private branches were complete without clearly distinguishing advisory-fork refs from public `origin` refs, prompting the user to stop and verify deployment status.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:37:20.498Z",
+      "lastSeen": "2026-08-18T19:37:20.498Z"
+    },
+    {
+      "key": "avoid: combined pr closing with an unsupported workspace-repository comment under `set -e`, causing the entire command to fail before the close could occur.",
+      "text": "Avoid: Combined PR closing with an unsupported workspace-repository comment under `set -e`, causing the entire command to fail before the close could occur.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:37:20.498Z",
+      "lastSeen": "2026-08-18T19:37:20.498Z"
+    },
+    {
+      "key": "avoid: called the pr “now-empty” even though github still reported it as mergeable with different head and base oids.",
+      "text": "Avoid: Called the PR “now-empty” even though GitHub still reported it as mergeable with different head and base OIDs.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:37:20.498Z",
+      "lastSeen": "2026-08-18T19:37:20.498Z"
+    },
+    {
+      "key": "avoid: deleted local security branches before resolving whether the user wanted the commits pushed to public branches, reducing convenient recovery points.",
+      "text": "Avoid: Deleted local security branches before resolving whether the user wanted the commits pushed to public branches, reducing convenient recovery points.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:37:20.498Z",
+      "lastSeen": "2026-08-18T19:37:20.498Z"
+    },
+    {
+      "key": "obtained explicit approval before public disclosure, then atomically fast-forwarded `origin/main` to `af079bd4` and `origin/5.x` to `8acfea7e`, verifying both refs with `git ls-remote`.",
+      "text": "Obtained explicit approval before public disclosure, then atomically fast-forwarded `origin/main` to `af079bd4` and `origin/5.x` to `8acfea7e`, verifying both refs with `git ls-remote`.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:38:15.045Z",
+      "lastSeen": "2026-08-18T19:38:15.045Z"
+    },
+    {
+      "key": "fast-forwarded local `main` to `origin/main` and confirmed a clean synchronized status.",
+      "text": "Fast-forwarded local `main` to `origin/main` and confirmed a clean synchronized status.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:38:15.045Z",
+      "lastSeen": "2026-08-18T19:38:15.045Z"
+    },
+    {
+      "key": "do not retry forbidden workspace graphql actions; use permitted repository operations or ask the user for an authorized alternative before attempting comments or metadata changes.",
+      "text": "Do not retry forbidden workspace GraphQL actions; use permitted repository operations or ask the user for an authorized alternative before attempting comments or metadata changes.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:38:15.045Z",
+      "lastSeen": "2026-08-18T19:38:15.045Z"
+    },
+    {
+      "key": "avoid: initially pushed the security fix only to the private advisory fork, leaving `origin/main` and `origin/5.x` unchanged without first confirming the intended publication target.",
+      "text": "Avoid: Initially pushed the security fix only to the private advisory fork, leaving `origin/main` and `origin/5.x` unchanged without first confirming the intended publication target.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:38:15.045Z",
+      "lastSeen": "2026-08-18T19:38:15.045Z"
+    },
+    {
+      "key": "avoid: after pushing remote refs, local `main` remained one commit behind, creating temporary local/remote inconsistency.",
+      "text": "Avoid: After pushing remote refs, local `main` remained one commit behind, creating temporary local/remote inconsistency.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:38:15.045Z",
+      "lastSeen": "2026-08-18T19:38:15.045Z"
+    },
+    {
+      "key": "avoid: a graphql `addcomment` action was attempted despite workspace-repository restrictions; the denial indicates an intentional permission boundary that should not be bypassed.",
+      "text": "Avoid: A GraphQL `addComment` action was attempted despite workspace-repository restrictions; the denial indicates an intentional permission boundary that should not be bypassed.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:38:15.045Z",
+      "lastSeen": "2026-08-18T19:38:15.045Z"
+    },
+    {
+      "key": "closed pr #1 without merging after confirming its head sha was already the intended private `main` commit.",
+      "text": "Closed PR #1 without merging after confirming its head SHA was already the intended private `main` commit.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:46:43.092Z",
+      "lastSeen": "2026-08-18T19:46:43.092Z"
+    },
+    {
+      "key": "fetched current `origin/main` and `origin/5.x`, verified each security commit’s parent exactly matched the corresponding remote tip, then used an atomic push.",
+      "text": "Fetched current `origin/main` and `origin/5.x`, verified each security commit’s parent exactly matched the corresponding remote tip, then used an atomic push.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:46:43.092Z",
+      "lastSeen": "2026-08-18T19:46:43.092Z"
+    },
+    {
+      "key": "verified public and private `main`/`5.x` refs matched, fast-forwarded local `main`, deleted temporary security branches, and confirmed a clean synchronized checkout.",
+      "text": "Verified public and private `main`/`5.x` refs matched, fast-forwarded local `main`, deleted temporary security branches, and confirmed a clean synchronized checkout.",
+      "kind": "learning",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:46:43.092Z",
+      "lastSeen": "2026-08-18T19:46:43.092Z"
+    },
+    {
+      "key": "avoid: private pr #1 remained open after its head commit had already been placed on private `main`; its mergeability was `unknown` and it was no longer the correct landing path.",
+      "text": "Avoid: Private PR #1 remained open after its head commit had already been placed on private `main`; its mergeability was `UNKNOWN` and it was no longer the correct landing path.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:46:43.092Z",
+      "lastSeen": "2026-08-18T19:46:43.092Z"
+    },
+    {
+      "key": "avoid: local `main` and temporary security branches were left out of sync after updating the remote branches.",
+      "text": "Avoid: Local `main` and temporary security branches were left out of sync after updating the remote branches.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:46:43.092Z",
+      "lastSeen": "2026-08-18T19:46:43.092Z"
+    },
+    {
+      "key": "avoid: direct public branch updates bypassed the repository’s pull-request-only rules, so ancestry and target refs required explicit validation to avoid unsafe rewrites.",
+      "text": "Avoid: Direct public branch updates bypassed the repository’s pull-request-only rules, so ancestry and target refs required explicit validation to avoid unsafe rewrites.",
+      "kind": "antiPattern",
+      "hits": 1,
+      "score": 1,
+      "firstSeen": "2026-08-18T19:46:43.092Z",
+      "lastSeen": "2026-08-18T19:46:43.092Z"
+    }
+  ]
+}