hippo-memory 1.61.0 → 1.63.0

package/dist/predictions/store.js

@@ -1,5 +1,5 @@
 /**
- * E2 prediction first-class object (v0.31 / docs/plans/2026-05-26-e2-prediction-object.md).
+ * Prediction first-class object.
  *
  * Canonical store for ex-ante claims that can be closed against ex-post
  * outcomes. The `predictions` table holds every field (including
@@ -19,10 +19,8 @@
  * a failure in either step rolls back both. Pattern matches supersede
  * (api.ts:1486) and the Slack/GitHub connectors.
  *
- * J3 (reference-class / planning-fallacy detector) reads from
- * `loadPredictionsByClass` to compute per-class base rates from
- * (estimate_value, actual_value) at query time. J3 is a follow-up episode;
- * this module ships the data layer.
+ * The planning-fallacy detector reads `loadPredictionsByClass` and computes
+ * per-class base rates from (estimate_value, actual_value) at query time.
  */
 import { BadRequestError, NotFoundError } from '../api-errors.js';
 import { openHippoDb, closeHippoDb } from '../db.js';
@@ -68,7 +66,7 @@ function rowToPrediction(row) {
  * The memory is tagged `['prediction', classTag]` with `source='prediction'`
  * and `kind='distilled'`. It surfaces in `hippo recall` so the agent can
  * see open predictions naturally; the predictions table is the canonical
- * structured store used by J3.
+ * structured store used by the planning-fallacy detector.
  */
 export function savePrediction(hippoRoot, tenantId, opts, actor = 'cli') {
     assertTenantId('savePrediction', tenantId);
@@ -142,8 +140,7 @@ function insertPredictionRow(db, memoryId, tenantId, opts, now, actor) {
 /**
  * Close an existing open prediction. Updates the predictions row only;
  * the memory mirror is NOT mutated in v1 (predictions table is canonical).
- * J3 computes accuracy (clean vs regressed) from (estimateValue,
- * actualValue) at query time.
+ * Accuracy is computed from (estimateValue, actualValue) at query time.
  */
 export function closePrediction(hippoRoot, tenantId, id, opts, actor = 'cli') {
     assertTenantId('closePrediction', tenantId);
@@ -175,13 +172,8 @@ export function closePrediction(hippoRoot, tenantId, id, opts, actor = 'cli') {
 }
 /** Closes the row, reloads it and audits the close; the caller owns the transaction. */
 function closeOpenPredictionRow(db, tenantId, id, opts, now, actor) {
-    // Codex review finding 2026-05-26: WHERE clause requires
-    // closure_state='open' so duplicate close requests / retries against
-    // an already-closed prediction return a clear error instead of
-    // silently overwriting actual_value + emitting a duplicate
-    // predict_close audit row. Zero changed rows → caller decides
-    // whether it's a "not found" or "already closed" case based on the
-    // load-then-close pattern.
+    // closure_state='open' in the WHERE stops a retried close from overwriting
+    // actual_value and auditing twice; zero changed rows means not found or already closed.
     const updateResult = db.prepare(`
         UPDATE predictions
         SET actual_value = ?, closure_state = ?, closed_at = ?, closure_note = ?
@@ -283,29 +275,41 @@ export function loadPredictionsByClass(hippoRoot, tenantId, classTag, opts = {})
         closeHippoDb(db);
     }
 }
+/** Every prediction in the tenant, open and closed, across all classes: the `status=all` list without a class. */
+export function loadAllPredictions(hippoRoot, tenantId, opts = {}) {
+    assertTenantId('loadAllPredictions', tenantId);
+    const after = keysetAfter('created_at', 'id', opts.after);
+    const db = openHippoDb(hippoRoot);
+    try {
+        // SAFETY: rows' shape matches the columns named in the SELECT.
+        const rows = db.prepare(`
+      SELECT id, memory_id, tenant_id, class_tag, claim_text,
+             estimate_value, estimate_unit, target_date,
+             actual_value, closure_state, closed_at, closure_note, created_at
+      FROM predictions
+      WHERE tenant_id = ?${after.sql}
+      ORDER BY created_at DESC, id DESC
+      LIMIT ?
+    `).all(tenantId, ...after.params, opts.limit ?? 100);
+        return rows.map(rowToPrediction);
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
 /**
- * Compute base-rate stats for closed predictions in a class. Used by J3
- * reference-class / planning-fallacy detector. Direct application of
- * Lovallo-Kahneman (2003) inside-vs-outside view.
+ * Compute base-rate stats for closed predictions in a class for the
+ * planning-fallacy detector: Lovallo-Kahneman (2003) inside-vs-outside view.
  *
  * Filter: closure_state='closed' AND estimate_value IS NOT NULL AND
  * actual_value IS NOT NULL. Excludes closed-unknown (no actual to
  * compare against) and open (not yet resolved).
  *
- * Audit-emit is BUILT IN here (single source of truth, no caller-site
- * drift risk). Plan-eng-critic round 1 HIGH recommendation: emit inside
- * helper, not at 3 call sites.
+ * Audit-emit is built in here, not at the 3 call sites, so callers cannot drift.
  */
 export function computePredictionBaserate(hippoRoot, tenantId, classTag, actor = 'cli', 
-/** v0.32 / J3.2 — when false, skip the predict_baserate audit emit. The
- *  J3.2 orchestrator (computePlanningFallacyOutput, below) calls this with
- *  emitAudit=false and emits its own `recall_autodebias_hint` audit row
- *  instead, so the predict_baserate channel stays scoped to deliberate
- *  CLI / HTTP / MCP predict-baserate calls and does NOT pollute on every
- *  recall containing a forward-claim phrase. Default true preserves the
- *  v1.13.0 J3 audit semantics for the 3 direct callers (cmdPredict
- *  baserate, /v1/predictions/stats route, hippo_predict_baserate MCP
- *  handler) — none of them pass this argument. */
+/** False skips the predict_baserate audit so that channel only records deliberate
+ *  baserate calls, not every recall the planning-fallacy orchestrator inspects. */
 emitAudit = true) {
     assertTenantId('computePredictionBaserate', tenantId);
     if (!classTag)
@@ -325,9 +329,8 @@ emitAudit = true) {
         const nClosed = rows.length;
         if (nClosed === 0) {
             // Audit zero-result reads too — agents probing empty classes is
-            // a signal worth recording. Skipped when emitAudit=false (J3.2
-            // orchestrator path; its own recall_autodebias_hint audit fires
-            // only when nClosed > 0 anyway, so no signal is lost).
+            // a signal worth recording. Skipped when emitAudit=false: the orchestrator's own
+            // recall_autodebias_hint audit fires only when nClosed > 0, so no signal is lost.
             if (emitAudit)
                 auditBaserateRead(db, tenantId, actor, classTag, 0);
             return {

package/dist/processes.d.ts

@@ -1,5 +1,5 @@
 /**
- * E2 process first-class object (docs/plans/2026-05-29-e2-process-object.md).
+ * Process first-class object.
  *
  * A `process` is a "living process map": a named, ordered list of steps that
  * evolves over time. Unlike `incident` (open->resolved->closed, no supersede),
@@ -31,13 +31,9 @@
  * them back. Pattern matches saveDecision (decisions.ts).
  */
 import { type KeysetPosition } from './keyset.js';
+import type { JsonValue } from './json.js';
 export type ProcessStatus = 'active' | 'superseded' | 'closed';
 export declare const VALID_PROCESS_STATES: ReadonlySet<ProcessStatus>;
-/** Arbitrary JSON-shaped value; the domain type for untrusted input at the
- *  steps I/O boundary (validateProcessSteps parses this into string[]). */
-type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
 /** DoS / abuse caps on the steps body (untrusted at the HTTP/SDK boundary). */
 export declare const MAX_PROCESS_STEPS = 200;
 export declare const MAX_PROCESS_STEP_LEN = 2000;
@@ -109,5 +105,4 @@ export declare function loadProcesses(hippoRoot: string, tenantId: string, opts?
 export declare function loadActiveProcesses(hippoRoot: string, tenantId: string, opts?: {
     limit?: number;
 }): Process[];
-export {};
 //# sourceMappingURL=processes.d.ts.map

package/dist/processes.js

@@ -1,5 +1,5 @@
 /**
- * E2 process first-class object (docs/plans/2026-05-29-e2-process-object.md).
+ * Process first-class object.
  *
  * A `process` is a "living process map": a named, ordered list of steps that
  * evolves over time. Unlike `incident` (open->resolved->closed, no supersede),
@@ -130,9 +130,82 @@ function buildProcessContent(processName, steps, description) {
         content += `\n\nDescription: ${description}`;
     return content;
 }
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
+// Preflight the supersede target BEFORE inserting the new row. The new
+// row's autoincrement id could otherwise collide with a non-existent
+// supersedesProcessId (e.g. superseding id 1 on an empty store), making
+// the row supersede itself. Validating first means the new row is never a
+// candidate for its own supersede UPDATE. Mirrors saveDecision.
+// The same SELECT reads the predecessor version so the
+// successor's version is server-derived, never client-supplied.
+function preflightProcessSupersede(db, tenantId, supersedesId) {
+    // SAFETY: SELECT status, version FROM processes; row shape matches
+    // the two selected columns 1:1.
+    const pred = db.prepare(`SELECT status, version FROM processes WHERE id = ? AND tenant_id = ?`).get(supersedesId, tenantId);
+    if (!pred) {
+        throw new NotFoundError(`saveProcess: process ${supersedesId} to supersede not found for tenant ${tenantId}`);
+    }
+    if (pred.status !== 'active') {
+        throw new ConflictError(`saveProcess: process ${supersedesId} is not active (status='${pred.status}'); only active processes can be superseded.`);
+    }
+    return pred.version + 1;
+}
+function insertProcessRow(db, memoryId, w, version) {
+    const result = db.prepare(`
+    INSERT INTO processes(
+      memory_id, tenant_id, process_name, description, steps, version,
+      status, superseded_by, superseded_at, change_summary, closed_at, created_at
+    ) VALUES (?, ?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
+  `).run(memoryId, w.tenantId, w.processName, w.description ?? null, JSON.stringify(w.steps), version, w.changeSummary, w.now);
+    return Number(result.lastInsertRowid ?? 0);
+}
+function supersedeProcessRow(db, w, supersedesId, processId, version) {
+    const sup = db.prepare(`
+    UPDATE processes
+    SET status = 'superseded', superseded_by = ?, superseded_at = ?
+    WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
+  `).run(processId, w.now, supersedesId, w.tenantId, processId);
+    if (sup.changes === 0) {
+        throw new ConflictError(`saveProcess: process ${supersedesId} could not be superseded (no longer active or self-reference).`);
+    }
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'process_supersede',
+        targetId: String(supersedesId),
+        metadata: {
+            process_id: supersedesId,
+            superseded_by: processId,
+            new_version: version,
+        },
+    });
+}
+/** The afterWrite body: preflight, INSERT, supersede, reload, create audit, all in one SAVEPOINT. */
+function writeProcessRow(db, memoryId, w) {
+    const version = w.supersedesId !== undefined ? preflightProcessSupersede(db, w.tenantId, w.supersedesId) : 1;
+    const processId = insertProcessRow(db, memoryId, w, version);
+    if (w.supersedesId !== undefined)
+        supersedeProcessRow(db, w, w.supersedesId, processId, version);
+    // SAFETY: SELECT ${PROCESS_COLS} enumerates every ProcessRow field
+    // 1:1 (see PROCESS_COLS above).
+    const row = db.prepare(`SELECT ${PROCESS_COLS} FROM processes WHERE id = ?`)
+        .get(processId);
+    if (!row)
+        throw new Error('saveProcess: failed to reload saved process row');
+    // GDPR-light metadata: ids + counts only, no process_name / step text.
+    appendAuditEvent(db, {
+        tenantId: w.tenantId,
+        actor: w.actor,
+        op: 'process_create',
+        targetId: String(processId),
+        metadata: {
+            process_id: processId,
+            version,
+            step_count: w.steps.length,
+            has_description: w.description !== undefined && w.description !== null && w.description !== '',
+        },
+    });
+    return row;
+}
 /**
  * Create a process (or a new version that supersedes an existing one). Writes
  * the memory mirror + the processes row atomically inside writeEntry's SAVEPOINT
@@ -163,78 +236,21 @@ export function saveProcess(hippoRoot, tenantId, opts, actor = 'cli') {
         baseHalfLifeDays: objectHalfLifeDays(hippoRoot),
         tenantId,
     });
+    const w = {
+        tenantId,
+        actor,
+        processName: opts.processName,
+        description: opts.description,
+        steps,
+        changeSummary,
+        supersedesId: opts.supersedesProcessId,
+        now,
+    };
     let savedRow;
     writeEntry(hippoRoot, mem, {
         actor,
         afterWrite: (db, memoryId) => {
-            // Preflight the supersede target BEFORE inserting the new row. The new
-            // row's autoincrement id could otherwise collide with a non-existent
-            // supersedesProcessId (e.g. superseding id 1 on an empty store), making
-            // the row supersede itself. Validating first means the new row is never a
-            // candidate for its own supersede UPDATE. Mirrors saveDecision (codex P1
-            // 2026-05-28). The same SELECT reads the predecessor version so the
-            // successor's version is server-derived, never client-supplied.
-            let version = 1;
-            if (opts.supersedesProcessId !== undefined) {
-                // SAFETY: SELECT status, version FROM processes; row shape matches
-                // the two selected columns 1:1.
-                const pred = db.prepare(`SELECT status, version FROM processes WHERE id = ? AND tenant_id = ?`).get(opts.supersedesProcessId, tenantId);
-                if (!pred) {
-                    throw new NotFoundError(`saveProcess: process ${opts.supersedesProcessId} to supersede not found for tenant ${tenantId}`);
-                }
-                if (pred.status !== 'active') {
-                    throw new ConflictError(`saveProcess: process ${opts.supersedesProcessId} is not active (status='${pred.status}'); only active processes can be superseded.`);
-                }
-                version = pred.version + 1;
-            }
-            const result = db.prepare(`
-        INSERT INTO processes(
-          memory_id, tenant_id, process_name, description, steps, version,
-          status, superseded_by, superseded_at, change_summary, closed_at, created_at
-        ) VALUES (?, ?, ?, ?, ?, ?, 'active', NULL, NULL, ?, NULL, ?)
-      `).run(memoryId, tenantId, opts.processName, opts.description ?? null, JSON.stringify(steps), version, changeSummary, now);
-            const processId = Number(result.lastInsertRowid ?? 0);
-            if (opts.supersedesProcessId !== undefined) {
-                const sup = db.prepare(`
-          UPDATE processes
-          SET status = 'superseded', superseded_by = ?, superseded_at = ?
-          WHERE id = ? AND tenant_id = ? AND status = 'active' AND id != ?
-        `).run(processId, now, opts.supersedesProcessId, tenantId, processId);
-                if (sup.changes === 0) {
-                    throw new ConflictError(`saveProcess: process ${opts.supersedesProcessId} could not be superseded (no longer active or self-reference).`);
-                }
-                appendAuditEvent(db, {
-                    tenantId,
-                    actor,
-                    op: 'process_supersede',
-                    targetId: String(opts.supersedesProcessId),
-                    metadata: {
-                        process_id: opts.supersedesProcessId,
-                        superseded_by: processId,
-                        new_version: version,
-                    },
-                });
-            }
-            // SAFETY: SELECT ${PROCESS_COLS} enumerates every ProcessRow field
-            // 1:1 (see PROCESS_COLS above).
-            const row = db.prepare(`SELECT ${PROCESS_COLS} FROM processes WHERE id = ?`)
-                .get(processId);
-            if (!row)
-                throw new Error('saveProcess: failed to reload saved process row');
-            savedRow = row;
-            // GDPR-light metadata: ids + counts only, no process_name / step text.
-            appendAuditEvent(db, {
-                tenantId,
-                actor,
-                op: 'process_create',
-                targetId: String(processId),
-                metadata: {
-                    process_id: processId,
-                    version,
-                    step_count: steps.length,
-                    has_description: opts.description !== undefined && opts.description !== null && opts.description !== '',
-                },
-            });
+            savedRow = writeProcessRow(db, memoryId, w);
         },
     });
     if (!savedRow) {

package/dist/project-briefs.d.ts

@@ -1,6 +1,5 @@
 /**
- * E2 project_brief first-class object
- * (docs/plans/2026-05-30-e2-project-brief-object.md).
+ * Project_brief first-class object.
  *
  * A `project_brief` is the living, repo-scoped summary of a repository's state: a
  * `summary` body scoped to a `repo`, evolving via the supersede delta lifecycle.
@@ -94,7 +93,7 @@ export declare function loadProjectBriefs(hippoRoot: string, tenantId: string, o
 /**
  * The repo's CURRENT active brief, or null. By convention there is one active brief
  * per (tenant, repo); if an operator created more than one (the DB does not prevent
- * it, consistent with every other E2 object), the MOST-RECENT active row wins.
+ * it, consistent with every other first-class object), the MOST-RECENT active row wins.
  */
 export declare function loadActiveBriefForRepo(hippoRoot: string, tenantId: string, repo: string): ProjectBrief | null;
 /**