kodi-dev 1.0.1 → 1.2.0

package/dist/index.js

@@ -98,6 +98,10 @@ function registerAddCommand(program2) {
   });
 }
 
+// src/commands/hook.ts
+import { existsSync as existsSync4 } from "fs";
+import { isAbsolute as isAbsolute3, relative as relative2 } from "path";
+
 // src/bootstrap.ts
 var ORCHESTRATOR_BOOTSTRAP = `# You are the kodi orchestrator
 
@@ -138,43 +142,19 @@ board \u2014 there is no message bus.
 - Manage tickets and PRs ONLY through the \`kodi\` CLI (\`kodi tickets \u2026\`,
   \`kodi pr \u2026\`) \u2014 it proxies \`gh\`/\`az\` and enforces the templates. Remote
   mutations are dry-run unless \`--yes\`.
+- Persist and recall project knowledge with \`kodi memory\`: \`kodi memory query
+  <text>\` before working a subsystem, and \`kodi memory store\` a durable finding
+  (decision / gotcha / convention / architecture / reference / task-note) as you
+  learn it. Cross-session and project-scoped \u2014 see the memory rule.
 - The thin \`CLAUDE.md\` is the single source of truth for the stack, gate
   commands, provider, and installed skill-packs.
 `;
 
-// src/commands/hook.ts
-function registerHookCommand(program2) {
-  const hook = program2.command("hook").description("Emit Claude Code hook output (internal)");
-  hook.command("session-start").description("Emit the orchestrator bootstrap as SessionStart additionalContext").action(() => {
-    const payload = {
-      hookSpecificOutput: {
-        hookEventName: "SessionStart",
-        additionalContext: ORCHESTRATOR_BOOTSTRAP
-      }
-    };
-    process.stdout.write(JSON.stringify(payload));
-  });
-  return hook;
-}
-
-// src/commands/init.ts
-import {
-  copyFileSync as copyFileSync2,
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync3,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync4,
-  statSync as statSync2,
-  writeFileSync as writeFileSync3
-} from "fs";
-import { dirname as dirname4, join as join3, relative as relative2 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { stringify as stringifyYaml2 } from "yaml";
-
 // src/config.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir } from "os";
 import { dirname as dirname3, join as join2 } from "path";
-import { parse as parseYaml3 } from "yaml";
+import { parse as parseYaml3, stringify as stringifyYaml2 } from "yaml";
 
 // src/providers/status-index.ts
 import {
@@ -260,21 +240,21 @@ var KEY_RE = /^[A-Z][A-Z0-9]*-\d+$/;
 var SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var FILE_RE = /^([A-Z][A-Z0-9]*-\d+)-([a-z0-9]+(?:-[a-z0-9]+)*)\.md$/;
 function slugForStatus(status) {
-  const slug = STATUS_TO_SLUG[status];
-  if (slug === void 0) {
+  const slug2 = STATUS_TO_SLUG[status];
+  if (slug2 === void 0) {
     throw new Error(`unknown ticket status: ${String(status)}`);
   }
-  return slug;
+  return slug2;
 }
 function assertKey(key) {
   if (!KEY_RE.test(key)) {
     throw new Error(`invalid ticket key ${JSON.stringify(key)}: must match ${KEY_RE.source}`);
   }
 }
-function assertSlug(slug) {
-  if (!SLUG_RE.test(slug)) {
+function assertSlug(slug2) {
+  if (!SLUG_RE.test(slug2)) {
     throw new Error(
-      `invalid slug ${JSON.stringify(slug)}: must be strict kebab-case (${SLUG_RE.source})`
+      `invalid slug ${JSON.stringify(slug2)}: must be strict kebab-case (${SLUG_RE.source})`
     );
   }
 }
@@ -284,10 +264,10 @@ function isTicketStatus(value) {
 function freshTickets() {
   return /* @__PURE__ */ Object.create(null);
 }
-function composeFile(status, key, slug) {
+function composeFile(status, key, slug2) {
   assertKey(key);
-  assertSlug(slug);
-  return `${slugForStatus(status)}/${key}-${slug}.md`;
+  assertSlug(slug2);
+  return `${slugForStatus(status)}/${key}-${slug2}.md`;
 }
 function emptyDocument() {
   return {
@@ -302,12 +282,12 @@ function serialize(doc) {
     const entry = doc.tickets[key];
     tickets[key] = { column: entry.column, file: entry.file };
   }
-  const out2 = {
+  const out3 = {
     version: doc.version,
     columns: [...TICKET_STATUSES],
     tickets
   };
-  const text = stringifyYaml(out2, { lineWidth: 0 });
+  const text = stringifyYaml(out3, { lineWidth: 0 });
   return text.endsWith("\n") ? text : `${text}
 `;
 }
@@ -406,6 +386,13 @@ function resolveFile(statusYamlPath, key, entry) {
 }
 
 // src/config.ts
+function kodiHome() {
+  const override = process.env.KODI_HOME?.trim();
+  return override && override.length > 0 ? override : join2(homedir(), ".kodi");
+}
+function ragDbPath() {
+  return join2(kodiHome(), "rag.db");
+}
 var DEFAULTS = { provider: "local", prefix: "KODI" };
 var STATE_FILE = "kodi-dev.yaml";
 function stateFilePath(root) {
@@ -430,6 +417,18 @@ function loadBoardConfig(cwd = process.cwd()) {
     return { ...DEFAULTS };
   }
 }
+function writeMemoryBinding(root, memory) {
+  const path = stateFilePath(root);
+  if (!existsSync3(path)) return;
+  let raw = {};
+  try {
+    raw = parseYaml3(readFileSync3(path, "utf-8")) ?? {};
+  } catch {
+    raw = {};
+  }
+  raw.memory = memory;
+  writeFileSync3(path, stringifyYaml2(raw), "utf-8");
+}
 function localPaths(cwd = process.cwd()) {
   const root = join2(findProjectRoot(cwd), "docs", "tickets");
   return {
@@ -443,6 +442,774 @@ function localPaths(cwd = process.cwd()) {
   };
 }
 
+// src/memory/db.ts
+import { mkdirSync as mkdirSync3 } from "fs";
+import { createRequire } from "module";
+import { dirname as dirname4 } from "path";
+var nodeRequire = createRequire(import.meta.url);
+var nodeSqlite = nodeRequire(["node", "sqlite"].join(":"));
+var SCHEMA = `
+CREATE TABLE IF NOT EXISTS collections (
+  id         TEXT PRIMARY KEY,
+  name       TEXT NOT NULL,
+  root_path  TEXT UNIQUE,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS memories (
+  id           TEXT PRIMARY KEY,
+  collection_id TEXT NOT NULL,
+  content      TEXT NOT NULL,
+  title        TEXT NOT NULL,
+  type         TEXT NOT NULL,
+  ticket       TEXT,
+  files_json   TEXT NOT NULL DEFAULT '[]',
+  created_at   TEXT NOT NULL,
+  content_hash TEXT NOT NULL,
+  -- veracity score (see docs/memory-veracity-score.md): 0-5, fresh = 3.
+  score            INTEGER NOT NULL DEFAULT 3,
+  status           TEXT NOT NULL DEFAULT 'active',   -- active | tombstoned
+  needs_reverify   INTEGER NOT NULL DEFAULT 0,
+  file_hashes      TEXT,                              -- JSON { path: sha256 }
+  verified_at      TEXT,
+  tombstone_reason TEXT,
+  UNIQUE(collection_id, content_hash)
+);
+CREATE INDEX IF NOT EXISTS idx_memories_collection ON memories(collection_id);
+
+CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(
+  memory_id UNINDEXED,
+  content,
+  title
+);
+`;
+var VERACITY_COLUMNS = [
+  ["score", "INTEGER NOT NULL DEFAULT 3"],
+  ["status", "TEXT NOT NULL DEFAULT 'active'"],
+  ["needs_reverify", "INTEGER NOT NULL DEFAULT 0"],
+  ["file_hashes", "TEXT"],
+  ["verified_at", "TEXT"],
+  ["tombstone_reason", "TEXT"]
+];
+function migrate(db) {
+  const rows = db.prepare("PRAGMA table_info(memories)").all();
+  const cols = new Set(rows.map((c) => c.name));
+  for (const [name2, ddl] of VERACITY_COLUMNS) {
+    if (!cols.has(name2)) db.exec(`ALTER TABLE memories ADD COLUMN ${name2} ${ddl}`);
+  }
+}
+function openDb(path = ragDbPath()) {
+  mkdirSync3(dirname4(path), { recursive: true });
+  const db = new nodeSqlite.DatabaseSync(path);
+  db.exec("PRAGMA busy_timeout = 5000;");
+  db.exec("PRAGMA journal_mode = WAL;");
+  db.exec("PRAGMA synchronous = NORMAL;");
+  db.exec("PRAGMA foreign_keys = ON;");
+  db.exec(SCHEMA);
+  migrate(db);
+  return db;
+}
+
+// src/memory/store.ts
+import { createHash as createHash3, randomUUID } from "crypto";
+import { basename as basename3 } from "path";
+
+// src/memory/template.ts
+import { createHash } from "crypto";
+import { basename as basename2 } from "path";
+import { z as z3 } from "zod";
+var MEMORY_TYPES = [
+  "decision",
+  // a choice made + why (mini-ADR)
+  "gotcha",
+  // a trap / bug root-cause to not repeat
+  "convention",
+  // a project rule/pattern to follow
+  "architecture",
+  // how a subsystem/flow works
+  "reference",
+  // pointer to a doc/URL/resource
+  "task-note"
+  // context tied to a ticket's implementation
+];
+var MemoryDraftSchema = z3.object({
+  content: z3.string().trim().min(1, "content is required"),
+  type: z3.enum(MEMORY_TYPES),
+  /** Ticket/task in flight when this was learned — optional (null when absent). */
+  ticket: z3.string().trim().min(1).nullish().transform((v) => v ?? null),
+  /**
+   * Repo-relative paths the finding touches — at least one is REQUIRED: the veracity
+   * loop verifies a memory against its files, so a memory with no file can't be scored.
+   */
+  files: z3.array(z3.string().trim().min(1)).min(1, "at least one --file is required"),
+  /** Optional display title; a preview of `content` is derived when omitted. */
+  title: z3.string().trim().min(1).optional()
+});
+var MemoryImportRecordSchema = z3.object({
+  content: z3.string().trim().min(1),
+  type: z3.enum(MEMORY_TYPES),
+  ticket: z3.string().trim().min(1).nullish().transform((v) => v ?? null),
+  files: z3.array(z3.string().trim().min(1)).min(1, "at least one file is required"),
+  title: z3.string().trim().min(1).optional(),
+  /** Preserved when present so an export→import keeps the original timestamp. */
+  createdAt: z3.string().trim().min(1).optional()
+});
+var MemoryExportDocSchema = z3.object({
+  collection: z3.string().optional(),
+  exportedAt: z3.string().optional(),
+  memories: z3.array(MemoryImportRecordSchema).default([])
+});
+function contentHash(content) {
+  return createHash("sha256").update(content.trim()).digest("hex");
+}
+function derivePreview(content, max = 80) {
+  const firstLine = content.trim().split("\n", 1)[0].trim();
+  return firstLine.length > max ? firstLine.slice(0, max - 1).trimEnd() + "\u2026" : firstLine;
+}
+function fileNames(files) {
+  return files.map((f) => basename2(f));
+}
+
+// src/memory/veracity.ts
+import { createHash as createHash2 } from "crypto";
+import { readFileSync as readFileSync4 } from "fs";
+import { isAbsolute as isAbsolute2, join as join3 } from "path";
+var SCORE_FRESH = 3;
+var SCORE_MAX = 5;
+var SCORE_STALE_CAP = 2;
+var AUTO_INJECT_MIN = 4;
+var RELEVANCE_MIN = 3;
+function hashFile(root, relPath) {
+  const abs = isAbsolute2(relPath) ? relPath : join3(root, relPath);
+  try {
+    return createHash2("sha256").update(readFileSync4(abs)).digest("hex");
+  } catch {
+    return "missing";
+  }
+}
+function hashFiles(root, files) {
+  const out3 = {};
+  for (const f of files) out3[f] = hashFile(root, f);
+  return out3;
+}
+function anyFileChanged(root, fileHashes) {
+  if (!fileHashes) return false;
+  for (const [path, stored] of Object.entries(fileHashes)) {
+    if (hashFile(root, path) !== stored) return true;
+  }
+  return false;
+}
+function parseFileHashes(json) {
+  if (!json) return null;
+  try {
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+
+// src/memory/store.ts
+function tx(db, fn) {
+  db.exec("BEGIN IMMEDIATE");
+  try {
+    const result = fn();
+    db.exec("COMMIT");
+    return result;
+  } catch (e) {
+    try {
+      db.exec("ROLLBACK");
+    } catch {
+    }
+    throw e;
+  }
+}
+function queryOne(db, sql, ...params) {
+  return db.prepare(sql).get(...params);
+}
+function queryAll(db, sql, ...params) {
+  return db.prepare(sql).all(...params);
+}
+function slug(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
+}
+function shortHash(s) {
+  return createHash3("sha256").update(s).digest("hex").slice(0, 6);
+}
+function ensureCollectionRow(db, id, name2, root) {
+  db.prepare(
+    "INSERT INTO collections (id, name, root_path, created_at) VALUES (?, ?, ?, ?) ON CONFLICT DO NOTHING"
+  ).run(id, name2, root, (/* @__PURE__ */ new Date()).toISOString());
+}
+function provisionCollection(db, root, preferredName) {
+  const name2 = slug(preferredName ?? basename3(root));
+  const id = `${name2}-${shortHash(root)}`;
+  ensureCollectionRow(db, id, name2, root);
+  const row = queryOne(
+    db,
+    "SELECT id, name FROM collections WHERE root_path = ?",
+    root
+  );
+  return row ? { collection: row.id, name: row.name } : { collection: id, name: name2 };
+}
+function resolveCollection(db, cwd = process.cwd()) {
+  const root = findProjectRoot(cwd);
+  const cfg = loadBoardConfig(cwd);
+  if (cfg.memory?.collection) {
+    const name2 = cfg.memory.name ?? cfg.memory.collection;
+    ensureCollectionRow(db, cfg.memory.collection, name2, root);
+    return { collection: cfg.memory.collection, name: name2 };
+  }
+  const provisioned = provisionCollection(db, root);
+  writeMemoryBinding(root, provisioned);
+  return provisioned;
+}
+function lookupCollection(db, cwd = process.cwd()) {
+  const cfg = loadBoardConfig(cwd);
+  if (cfg.memory?.collection) {
+    return { collection: cfg.memory.collection, name: cfg.memory.name ?? cfg.memory.collection };
+  }
+  const row = queryOne(
+    db,
+    "SELECT id, name FROM collections WHERE root_path = ?",
+    findProjectRoot(cwd)
+  );
+  return row ? { collection: row.id, name: row.name } : null;
+}
+function rowToRecord(r) {
+  return {
+    id: r.id,
+    collection: r.collection_id,
+    content: r.content,
+    title: r.title,
+    type: r.type,
+    ticket: r.ticket ?? null,
+    files: JSON.parse(r.files_json || "[]"),
+    createdAt: r.created_at,
+    contentHash: r.content_hash,
+    score: r.score,
+    status: r.status,
+    needsReverify: !!r.needs_reverify,
+    fileHashes: parseFileHashes(r.file_hashes),
+    verifiedAt: r.verified_at ?? null,
+    tombstoneReason: r.tombstone_reason ?? null
+  };
+}
+function rawInsert(db, collectionId, v) {
+  const id = `mem_${randomUUID().slice(0, 8)}`;
+  const fileHashesJson = JSON.stringify(v.fileHashes);
+  tx(db, () => {
+    db.prepare(
+      `INSERT INTO memories
+         (id, collection_id, content, title, type, ticket, files_json, created_at, content_hash,
+          score, status, needs_reverify, file_hashes, verified_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', 0, ?, NULL)`
+    ).run(
+      id,
+      collectionId,
+      v.content,
+      v.title,
+      v.type,
+      v.ticket,
+      JSON.stringify(v.files),
+      v.createdAt,
+      v.hash,
+      SCORE_FRESH,
+      fileHashesJson
+    );
+    db.prepare("INSERT INTO memories_fts (memory_id, content, title) VALUES (?, ?, ?)").run(
+      id,
+      v.content,
+      v.title
+    );
+  });
+  return {
+    id,
+    collection: collectionId,
+    content: v.content,
+    title: v.title,
+    type: v.type,
+    ticket: v.ticket,
+    files: v.files,
+    createdAt: v.createdAt,
+    contentHash: v.hash,
+    score: SCORE_FRESH,
+    status: "active",
+    needsReverify: false,
+    fileHashes: v.fileHashes,
+    verifiedAt: null,
+    tombstoneReason: null
+  };
+}
+function insertMemory(db, collectionId, draft, root) {
+  const hash = contentHash(draft.content);
+  const existing = queryOne(
+    db,
+    "SELECT * FROM memories WHERE collection_id = ? AND content_hash = ?",
+    collectionId,
+    hash
+  );
+  if (existing) {
+    if (existing.status === "tombstoned") {
+      return { record: rowToRecord(existing), deduped: false, blocked: true };
+    }
+    return { record: rowToRecord(existing), deduped: true };
+  }
+  const record = rawInsert(db, collectionId, {
+    content: draft.content,
+    title: draft.title ?? derivePreview(draft.content),
+    type: draft.type,
+    ticket: draft.ticket ?? null,
+    files: draft.files,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    hash,
+    fileHashes: hashFiles(root, draft.files)
+  });
+  return { record, deduped: false };
+}
+function amendMemory(db, id, patch, root) {
+  const cur = queryOne(db, "SELECT * FROM memories WHERE id = ?", id);
+  if (!cur) return null;
+  const prev = rowToRecord(cur);
+  const content = patch.content ?? prev.content;
+  const title = patch.title ?? (patch.content ? derivePreview(patch.content) : prev.title);
+  const type = patch.type ?? prev.type;
+  const ticket = patch.ticket !== void 0 ? patch.ticket : prev.ticket;
+  const files = patch.files ?? prev.files;
+  const hash = contentHash(content);
+  if (hash !== prev.contentHash) {
+    const clash = queryOne(
+      db,
+      "SELECT id FROM memories WHERE collection_id = ? AND content_hash = ? AND id <> ?",
+      prev.collection,
+      hash,
+      id
+    );
+    if (clash) {
+      throw new Error(
+        `another memory (${clash.id}) already has identical content in this project.`
+      );
+    }
+  }
+  const fileHashes = hashFiles(root, files);
+  tx(db, () => {
+    db.prepare(
+      `UPDATE memories SET content=?, title=?, type=?, ticket=?, files_json=?, content_hash=?,
+         score=?, needs_reverify=0, file_hashes=?, verified_at=NULL WHERE id=?`
+    ).run(
+      content,
+      title,
+      type,
+      ticket,
+      JSON.stringify(files),
+      hash,
+      SCORE_FRESH,
+      JSON.stringify(fileHashes),
+      id
+    );
+    db.prepare("UPDATE memories_fts SET content=?, title=? WHERE memory_id=?").run(
+      content,
+      title,
+      id
+    );
+  });
+  return {
+    ...prev,
+    content,
+    title,
+    type,
+    ticket,
+    files,
+    contentHash: hash,
+    score: SCORE_FRESH,
+    needsReverify: false,
+    fileHashes,
+    verifiedAt: null
+  };
+}
+function verifyMemory(db, id, pass, root, reason) {
+  const cur = queryOne(db, "SELECT * FROM memories WHERE id = ?", id);
+  if (!cur) return null;
+  const prev = rowToRecord(cur);
+  if (prev.status === "tombstoned") return prev;
+  if (pass) {
+    const fileHashes = hashFiles(root, prev.files);
+    const score = Math.min(SCORE_MAX, prev.score + 1);
+    const verifiedAt = (/* @__PURE__ */ new Date()).toISOString();
+    tx(db, () => {
+      db.prepare(
+        "UPDATE memories SET score=?, needs_reverify=0, file_hashes=?, verified_at=? WHERE id=?"
+      ).run(score, JSON.stringify(fileHashes), verifiedAt, id);
+    });
+    return { ...prev, score, needsReverify: false, fileHashes, verifiedAt };
+  }
+  const tombstoneReason = reason ?? "refuted on verification";
+  tx(db, () => {
+    db.prepare(
+      "UPDATE memories SET status='tombstoned', score=0, needs_reverify=0, tombstone_reason=? WHERE id=?"
+    ).run(tombstoneReason, id);
+    db.prepare("DELETE FROM memories_fts WHERE memory_id=?").run(id);
+  });
+  return { ...prev, status: "tombstoned", score: 0, needsReverify: false, tombstoneReason };
+}
+function flagStaleForFile(db, root, relPath) {
+  const rows = queryAll(
+    db,
+    "SELECT * FROM memories WHERE status='active' AND EXISTS (SELECT 1 FROM json_each(files_json) WHERE value = ?)",
+    relPath
+  );
+  const current = hashFile(root, relPath);
+  let flagged = 0;
+  for (const r of rows) {
+    const stored = parseFileHashes(r.file_hashes) ?? {};
+    if (stored[relPath] === current) continue;
+    const merged = { ...stored, [relPath]: current };
+    db.prepare("UPDATE memories SET needs_reverify=1, score=?, file_hashes=? WHERE id=?").run(
+      Math.min(r.score, SCORE_STALE_CAP),
+      JSON.stringify(merged),
+      r.id
+    );
+    flagged++;
+  }
+  return flagged;
+}
+function reconcileStale(db, root, collectionId) {
+  const rows = queryAll(
+    db,
+    "SELECT * FROM memories WHERE collection_id=? AND status='active' AND needs_reverify=0",
+    collectionId
+  );
+  let flagged = 0;
+  for (const r of rows) {
+    if (!anyFileChanged(root, parseFileHashes(r.file_hashes))) continue;
+    const files = JSON.parse(r.files_json || "[]");
+    db.prepare("UPDATE memories SET needs_reverify=1, score=?, file_hashes=? WHERE id=?").run(
+      Math.min(r.score, SCORE_STALE_CAP),
+      JSON.stringify(hashFiles(root, files)),
+      r.id
+    );
+    flagged++;
+  }
+  return flagged;
+}
+function removeMemory(db, id) {
+  return tx(db, () => {
+    const info = db.prepare("DELETE FROM memories WHERE id = ?").run(id);
+    db.prepare("DELETE FROM memories_fts WHERE memory_id = ?").run(id);
+    return Number(info.changes) > 0;
+  });
+}
+var STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "is",
+  "are",
+  "was",
+  "were",
+  "be",
+  "been",
+  "to",
+  "of",
+  "in",
+  "on",
+  "and",
+  "or",
+  "for",
+  "with",
+  "this",
+  "that",
+  "it",
+  "as",
+  "at",
+  "by",
+  "we",
+  "you",
+  "do",
+  "does",
+  "how",
+  "why",
+  "what",
+  "when",
+  "from",
+  "our",
+  "its"
+]);
+function splitIdentifier(word) {
+  return word.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").split(/\s+/);
+}
+function toFtsQuery(text) {
+  const tokens = /* @__PURE__ */ new Set();
+  for (const word of text.match(/[A-Za-z0-9]+/g) ?? []) {
+    for (const part of splitIdentifier(word)) {
+      const t = part.toLowerCase();
+      if (t.length < 2 || STOPWORDS.has(t)) continue;
+      tokens.add(t);
+    }
+  }
+  if (tokens.size === 0) return null;
+  return [...tokens].map((t) => t.length >= 3 ? `${t}*` : t).join(" OR ");
+}
+function queryMemories(db, collectionId, opts) {
+  const limit = opts.limit && opts.limit > 0 ? opts.limit : 10;
+  const filters = ["m.collection_id = ?"];
+  const params = [collectionId];
+  const addFilter = (clause, param) => {
+    filters.push(clause);
+    params.push(param);
+  };
+  if (!opts.includeTombstoned) filters.push("m.status = 'active'");
+  if (opts.type) addFilter("m.type = ?", opts.type);
+  if (opts.ticket) addFilter("m.ticket = ?", opts.ticket);
+  if (opts.minScore != null) addFilter("m.score >= ?", opts.minScore);
+  if (opts.file)
+    addFilter(
+      "EXISTS (SELECT 1 FROM json_each(m.files_json) WHERE value LIKE ?)",
+      `%${opts.file}%`
+    );
+  if (opts.since) addFilter("m.created_at >= ?", opts.since);
+  const fts = opts.text ? toFtsQuery(opts.text) : null;
+  if (fts) {
+    const pool = Math.max(limit * 3, 30);
+    const sql2 = `SELECT m.*, bm25(memories_fts, 0.0, 1.0, 2.0) AS bm25
+      FROM memories_fts f JOIN memories m ON m.id = f.memory_id
+      WHERE memories_fts MATCH ? AND ${filters.join(" AND ")}
+      ORDER BY bm25 ASC LIMIT ?`;
+    const rows = queryAll(db, sql2, fts, ...params, pool);
+    const now = Date.now();
+    return rows.map((r) => {
+      const ageDays = Math.max(0, (now - Date.parse(r.created_at)) / 864e5);
+      return { r, blended: (r.bm25 ?? 0) + 0.03 * ageDays };
+    }).sort((a, b) => a.blended - b.blended).slice(0, limit).map(({ r }) => ({ ...rowToRecord(r), bm25: r.bm25 }));
+  }
+  const sql = `SELECT m.* FROM memories m WHERE ${filters.join(" AND ")} ORDER BY m.created_at DESC, m.rowid DESC LIMIT ?`;
+  return queryAll(db, sql, ...params, limit).map(rowToRecord);
+}
+function exportMemories(db, collectionId, type) {
+  const rows = type ? queryAll(
+    db,
+    "SELECT * FROM memories WHERE collection_id = ? AND status='active' AND type = ? ORDER BY created_at ASC",
+    collectionId,
+    type
+  ) : queryAll(
+    db,
+    "SELECT * FROM memories WHERE collection_id = ? AND status='active' ORDER BY created_at ASC",
+    collectionId
+  );
+  return rows.map(rowToRecord);
+}
+function importMemories(db, collectionId, records, root, type) {
+  let added = 0;
+  let skipped = 0;
+  for (const r of records) {
+    if (type && r.type !== type) continue;
+    const hash = contentHash(r.content);
+    const dupe = db.prepare("SELECT id FROM memories WHERE collection_id = ? AND content_hash = ?").get(collectionId, hash);
+    if (dupe) {
+      skipped++;
+      continue;
+    }
+    rawInsert(db, collectionId, {
+      content: r.content,
+      title: r.title ?? derivePreview(r.content),
+      type: r.type,
+      ticket: r.ticket ?? null,
+      files: r.files,
+      createdAt: r.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      hash,
+      fileHashes: hashFiles(root, r.files)
+    });
+    added++;
+  }
+  return { added, skipped };
+}
+
+// src/commands/hook.ts
+function readHookInput() {
+  return new Promise((resolve4) => {
+    if (process.stdin.isTTY) return resolve4({});
+    let data = "";
+    process.stdin.setEncoding("utf-8");
+    process.stdin.on("data", (c) => data += c);
+    process.stdin.on("end", () => {
+      try {
+        resolve4(data.trim() ? JSON.parse(data) : {});
+      } catch {
+        resolve4({});
+      }
+    });
+    process.stdin.on("error", () => resolve4({}));
+  });
+}
+function withReadDb(fallback, fn) {
+  try {
+    if (!existsSync4(ragDbPath())) return fallback;
+    const db = openDb();
+    try {
+      return fn(db);
+    } finally {
+      db.close();
+    }
+  } catch {
+    return fallback;
+  }
+}
+function bullet(m) {
+  return `- ${m.score}\u2605 [${m.type}] ${m.ticket ? m.ticket + " " : ""}${m.title}`;
+}
+function memoryDigest() {
+  return withReadDb("", (db) => {
+    const col = lookupCollection(db);
+    if (!col) return "";
+    try {
+      reconcileStale(db, findProjectRoot(), col.collection);
+    } catch {
+    }
+    const recent = queryMemories(db, col.collection, { minScore: AUTO_INJECT_MIN, limit: 5 });
+    if (recent.length === 0) return "";
+    return `
+
+## Project memory (kodi)
+
+Trusted findings (score \u2265 ${AUTO_INJECT_MIN}) for this project \u2014 query more with \`kodi memory query <text>\`, and \`kodi memory verify <id>\` when a finding is confirmed/refuted:
+
+${recent.map(bullet).join("\n")}
+`;
+  });
+}
+function promptInjection(prompt, cwd) {
+  if (!prompt.trim()) return "";
+  return withReadDb("", (db) => {
+    const col = lookupCollection(db, cwd);
+    if (!col) return "";
+    const hits = queryMemories(db, col.collection, {
+      text: prompt,
+      minScore: RELEVANCE_MIN,
+      limit: 3
+    });
+    const lines = [];
+    let used = 0;
+    for (const m of hits) {
+      const line = bullet(m);
+      if (used + line.length > 1200) break;
+      lines.push(line);
+      used += line.length + 1;
+    }
+    if (lines.length === 0) return "";
+    return `## Possibly relevant project memory (kodi)
+
+Retrieved for your request \u2014 expand with \`kodi memory query "<topic>" --json\`:
+
+${lines.join("\n")}
+`;
+  });
+}
+function parseVulnerabilities(command) {
+  if (!/\bkodi\s+pr\s+create\b/.test(command)) return [];
+  const out3 = [];
+  const re = /--vulnerability(?:=|\s+)(?:"([^"]*)"|'([^']*)'|(\S+))/g;
+  let m;
+  while (m = re.exec(command)) {
+    const v = (m[1] ?? m[2] ?? m[3] ?? "").trim();
+    if (v) out3.push(v);
+  }
+  return out3;
+}
+function parseVulnFile(vuln) {
+  const m = vuln.match(/([A-Za-z0-9_.\-/]+\/[A-Za-z0-9_.\-]+\.[A-Za-z0-9]+)/);
+  return m ? m[1] : null;
+}
+function captureFromCommand(command, cwd, root) {
+  try {
+    const vulns = parseVulnerabilities(command);
+    if (vulns.length === 0) return;
+    const db = openDb();
+    try {
+      const col = resolveCollection(db, cwd);
+      for (const v of vulns) {
+        const file = parseVulnFile(v);
+        if (!file) continue;
+        insertMemory(
+          db,
+          col.collection,
+          MemoryDraftSchema.parse({
+            content: `Security finding: ${v}`,
+            type: "gotcha",
+            files: [file]
+          }),
+          root
+        );
+      }
+    } finally {
+      db.close();
+    }
+  } catch {
+  }
+}
+function flagStaleForEdit(filePath, root) {
+  try {
+    if (!existsSync4(ragDbPath())) return;
+    const rel = isAbsolute3(filePath) ? relative2(root, filePath) : filePath;
+    const db = openDb();
+    try {
+      flagStaleForFile(db, root, rel);
+    } finally {
+      db.close();
+    }
+  } catch {
+  }
+}
+function registerHookCommand(program2) {
+  const hook = program2.command("hook").description("Emit Claude Code hook output (internal)");
+  hook.command("session-start").description("Emit the orchestrator bootstrap as SessionStart additionalContext").action(() => {
+    const payload = {
+      hookSpecificOutput: {
+        hookEventName: "SessionStart",
+        additionalContext: ORCHESTRATOR_BOOTSTRAP + memoryDigest()
+      }
+    };
+    process.stdout.write(JSON.stringify(payload));
+  });
+  hook.command("user-prompt-submit").description("Inject memories relevant to the submitted prompt (UserPromptSubmit)").action(async () => {
+    const input = await readHookInput();
+    const prompt = typeof input.prompt === "string" ? input.prompt : "";
+    const cwd = typeof input.cwd === "string" ? input.cwd : process.cwd();
+    const context = promptInjection(prompt, cwd);
+    if (!context) return;
+    const payload = {
+      hookSpecificOutput: {
+        hookEventName: "UserPromptSubmit",
+        additionalContext: context
+      }
+    };
+    process.stdout.write(JSON.stringify(payload));
+  });
+  hook.command("post-tool-use").description("Capture security findings + flag file-edited memories stale (PostToolUse)").action(async () => {
+    const input = await readHookInput();
+    const toolInput = input.tool_input ?? {};
+    const cwd = typeof input.cwd === "string" ? input.cwd : process.cwd();
+    const root = findProjectRoot(cwd);
+    const command = typeof toolInput.command === "string" ? toolInput.command : "";
+    if (command) captureFromCommand(command, cwd, root);
+    const filePath = typeof toolInput.file_path === "string" ? toolInput.file_path : "";
+    if (filePath) flagStaleForEdit(filePath, root);
+  });
+  return hook;
+}
+
+// src/commands/init.ts
+import {
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync4,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync5,
+  statSync as statSync2,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { basename as basename4, dirname as dirname5, join as join4, relative as relative3, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { stringify as stringifyYaml3 } from "yaml";
+
 // src/exec.ts
 import { spawnSync } from "child_process";
 function quote(args) {
@@ -486,11 +1253,11 @@ function inline(s) {
   return escapeHtml(s).replace(/\*\*(.+?)\*\*/g, "<strong>$1</strong>").replace(/`(.+?)`/g, "<code>$1</code>");
 }
 function mdToHtml(md) {
-  const out2 = [];
+  const out3 = [];
   let list = null;
   const closeList = () => {
     if (list) {
-      out2.push("</ul>");
+      out3.push("</ul>");
       list = null;
     }
   };
@@ -498,7 +1265,7 @@ function mdToHtml(md) {
     const line = raw.trimEnd();
     if (/^<!--/.test(line.trim())) {
       closeList();
-      out2.push(line);
+      out3.push(line);
       continue;
     }
     if (line.trim() === "") {
@@ -509,23 +1276,23 @@ function mdToHtml(md) {
     if (heading) {
       closeList();
       const level = heading[1].length;
-      out2.push(`<h${level}>${inline(heading[2])}</h${level}>`);
+      out3.push(`<h${level}>${inline(heading[2])}</h${level}>`);
       continue;
     }
     const item = /^[-*]\s+(.*)$/.exec(line);
     if (item) {
       if (!list) {
-        out2.push("<ul>");
+        out3.push("<ul>");
         list = "ul";
       }
-      out2.push(`<li>${inline(item[1])}</li>`);
+      out3.push(`<li>${inline(item[1])}</li>`);
       continue;
     }
     closeList();
-    out2.push(`<p>${inline(line)}</p>`);
+    out3.push(`<p>${inline(line)}</p>`);
   }
   closeList();
-  return out2.join("\n");
+  return out3.join("\n");
 }
 
 // src/providers/azure.ts
@@ -548,6 +1315,9 @@ function columnForStatus(status, cols) {
       return cols.todo;
   }
 }
+function stateForColumn(column, columnStates) {
+  return columnStates?.[column] ?? column;
+}
 function statusFromColumn(column, cols) {
   if (column === cols.todo) return "Pending";
   if (column === (cols.inProgress ?? DEFAULT_COLUMNS.inProgress)) return "In progress";
@@ -572,7 +1342,7 @@ function parseWorkItem(fields, id, cols = DEFAULT_COLUMNS) {
   }
   const parsed = TicketSchema.safeParse(JSON.parse(json));
   if (!parsed.success) return null;
-  const column = fields["System.State"] ?? fields["System.BoardColumn"] ?? "";
+  const column = fields["System.BoardColumn"] ?? fields["System.State"] ?? "";
   const status = statusFromColumn(column, cols) ?? parsed.data.status;
   return {
     ...parsed.data,
@@ -581,7 +1351,7 @@ function parseWorkItem(fields, id, cols = DEFAULT_COLUMNS) {
     status
   };
 }
-function createArgs(coords, title, html, column) {
+function createArgs(coords, title, html, state) {
   const args = [
     "az",
     "boards",
@@ -592,7 +1362,7 @@ function createArgs(coords, title, html, column) {
     "--type",
     "Issue",
     "--fields",
-    `System.State=${column}`,
+    `System.State=${state}`,
     "--description",
     html,
     "--output",
@@ -606,10 +1376,37 @@ var AzureTicketProvider = class {
   constructor(opts) {
     this.opts = opts;
     this.columns = opts.columns ?? DEFAULT_COLUMNS;
+    this.columnStates = opts.columnStates;
   }
   opts;
   name = "azure";
   columns;
+  columnStates;
+  /**
+   * The writable state for a logical status. The user maps each status to a BOARD
+   * COLUMN in `kodi init`, but `System.BoardColumn` is a read-only computed field
+   * (Azure rejects writes with TF401326), so the only thing kodi can set is
+   * `System.State`. We therefore translate the chosen column → the state it maps
+   * to (via `columnStates`) and set that. When several columns share a state, Azure
+   * places the card in the board's default column for that state.
+   */
+  stateFor(status) {
+    return stateForColumn(columnForStatus(status, this.columns), this.columnStates);
+  }
+  /** Set work-item `id`'s state (the only board-driving field Azure lets us write). */
+  setStateArgs(id, state) {
+    return [
+      "az",
+      "boards",
+      "work-item",
+      "update",
+      "--id",
+      id,
+      "--fields",
+      `System.State=${state}`,
+      ...this.orgArgs()
+    ];
+  }
   coords() {
     return { organization: this.opts.organization, project: this.opts.project };
   }
@@ -627,19 +1424,19 @@ var AzureTicketProvider = class {
     return "(assigned by azure on create)";
   }
   async create(input) {
-    const slug = input.slug ?? slugify(input.title);
-    const draft = { ...input, key: "(pending)", slug };
+    const slug2 = input.slug ?? slugify(input.title);
+    const draft = { ...input, key: "(pending)", slug: slug2 };
     const html = descriptionHtml(draft);
     const res = execMutate(
-      createArgs(this.coords(), input.title, html, columnForStatus(input.status, this.columns)),
+      createArgs(this.coords(), input.title, html, this.stateFor(input.status)),
       this.opts.dryRun
     );
     if (!res.ran) return { ...draft, key: "(dry-run)" };
-    const id = JSON.parse(res.stdout).id;
-    return { ...draft, key: String(id) };
+    const id = String(JSON.parse(res.stdout).id);
+    return { ...draft, key: id };
   }
   async get(key) {
-    const out2 = execRead([
+    const out3 = execRead([
       "az",
       "boards",
       "work-item",
@@ -650,12 +1447,12 @@ var AzureTicketProvider = class {
       "json",
       ...this.orgArgs()
     ]);
-    const wi = JSON.parse(out2);
+    const wi = JSON.parse(out3);
     return parseWorkItem(wi.fields ?? {}, wi.id, this.columns);
   }
   async list() {
     const wiql = "SELECT [System.Id] FROM WorkItems WHERE [System.WorkItemType] = 'Issue' ORDER BY [System.Id]";
-    const out2 = execRead([
+    const out3 = execRead([
       "az",
       "boards",
       "query",
@@ -665,7 +1462,7 @@ var AzureTicketProvider = class {
       "json",
       ...this.scopeArgs()
     ]);
-    const rows = JSON.parse(out2);
+    const rows = JSON.parse(out3);
     const refs = [];
     for (const row of rows) {
       const id = row.id ?? row.fields?.["System.Id"];
@@ -691,20 +1488,7 @@ var AzureTicketProvider = class {
   async setStatus(key, status) {
     const current = await this.get(key);
     if (!current) throw new Error(`work-item ${key} not found`);
-    execMutate(
-      [
-        "az",
-        "boards",
-        "work-item",
-        "update",
-        "--id",
-        key,
-        "--fields",
-        `System.State=${columnForStatus(status, this.columns)}`,
-        ...this.orgArgs()
-      ],
-      this.opts.dryRun
-    );
+    execMutate(this.setStateArgs(key, this.stateFor(status)), this.opts.dryRun);
     return { ...current, status };
   }
   async start(key, _p) {
@@ -753,8 +1537,8 @@ function parseProjects(json) {
   return items.map((p) => p?.name).filter((n) => typeof n === "string");
 }
 function listProjects(org, run = defaultRunner) {
-  const out2 = run(["az", "devops", "project", "list", "--org", org, "--output", "json"]);
-  return parseProjects(out2);
+  const out3 = run(["az", "devops", "project", "list", "--org", org, "--output", "json"]);
+  return parseProjects(out3);
 }
 function parseProjectInfo(json) {
   const d = JSON.parse(json);
@@ -783,34 +1567,74 @@ function getProjectInfo(org, project, run = defaultRunner) {
 function processSupportsIssues(template) {
   return template !== "Agile" && template !== "Scrum";
 }
-function parseStates(json) {
+function parseTeams(json) {
   const d = JSON.parse(json);
   const items = Array.isArray(d) ? d : d.value ?? [];
-  return items.map((s) => ({ name: s?.name, category: s?.category })).filter((s) => typeof s.name === "string");
+  return items.map((t) => t?.name).filter((n) => typeof n === "string");
 }
-function listIssueStates(org, project, run = defaultRunner) {
-  const out2 = run([
-    "az",
-    "devops",
-    "invoke",
-    "--area",
-    "wit",
-    "--resource",
-    "workItemTypeStates",
-    "--route-parameters",
-    `project=${project}`,
-    "type=Issue",
-    "--org",
-    org,
-    "--detect",
-    "false",
-    "--output",
-    "json"
-  ]);
-  return parseStates(out2);
+function listTeams(org, project, run = defaultRunner) {
+  return parseTeams(
+    run(["az", "devops", "team", "list", "--org", org, "--project", project, "--output", "json"])
+  );
 }
-function statesInCategory(states, category) {
-  return states.filter((s) => s.category === category).map((s) => s.name);
+function parseBoards(json) {
+  const d = JSON.parse(json);
+  const items = Array.isArray(d) ? d : d.value ?? [];
+  return items.map((b) => b?.name).filter((n) => typeof n === "string");
+}
+function listBoards(org, project, team, run = defaultRunner) {
+  return parseBoards(
+    run([
+      "az",
+      "devops",
+      "invoke",
+      "--area",
+      "work",
+      "--resource",
+      "boards",
+      "--route-parameters",
+      `project=${project}`,
+      `team=${team}`,
+      "--org",
+      org,
+      "--detect",
+      "false",
+      "--output",
+      "json"
+    ])
+  );
+}
+function parseBoardColumns(json) {
+  const d = JSON.parse(json);
+  const items = Array.isArray(d) ? d : d.value ?? [];
+  return items.map((c) => ({
+    name: c?.name,
+    columnType: c?.columnType ?? "",
+    state: c?.stateMappings?.Issue ?? ""
+  })).filter((c) => typeof c.name === "string");
+}
+function listBoardColumns(org, project, team, board, run = defaultRunner) {
+  return parseBoardColumns(
+    run([
+      "az",
+      "devops",
+      "invoke",
+      "--area",
+      "work",
+      "--resource",
+      "columns",
+      "--route-parameters",
+      `project=${project}`,
+      `team=${team}`,
+      `board=${board}`,
+      "--org",
+      org,
+      "--detect",
+      "false",
+      "--output",
+      "json"
+    ])
+  );
 }
 
 // src/providers/github-discovery.ts
@@ -821,7 +1645,7 @@ function parseProjects2(json) {
   return items.map((p) => ({ number: p?.number, title: p?.title ?? "", id: p?.id ?? "" })).filter((p) => typeof p.number === "number");
 }
 function listProjects2(owner, run = defaultRunner2) {
-  const out2 = run([
+  const out3 = run([
     "gh",
     "project",
     "list",
@@ -832,19 +1656,19 @@ function listProjects2(owner, run = defaultRunner2) {
     "--limit",
     "100"
   ]);
-  return parseProjects2(out2);
+  return parseProjects2(out3);
 }
 function resolveViewerLogin(run = defaultRunner2) {
   return run(["gh", "api", "user", "-q", ".login"]).trim();
 }
 function tokenScopes(run = defaultRunner2) {
-  let out2;
+  let out3;
   try {
-    out2 = run(["gh", "api", "-i", "user"]);
+    out3 = run(["gh", "api", "-i", "user"]);
   } catch {
     return null;
   }
-  const m = /^x-oauth-scopes:\s*(.*)$/im.exec(out2);
+  const m = /^x-oauth-scopes:\s*(.*)$/im.exec(out3);
   if (!m) return null;
   return m[1].split(",").map((s) => s.trim()).filter(Boolean);
 }
@@ -862,8 +1686,8 @@ function parseRepos(json) {
   return items.map((r) => r?.nameWithOwner).filter((n) => typeof n === "string");
 }
 function listRepos(owner, run = defaultRunner2) {
-  const out2 = run(["gh", "repo", "list", owner, "--json", "nameWithOwner", "--limit", "200"]);
-  return parseRepos(out2);
+  const out3 = run(["gh", "repo", "list", owner, "--json", "nameWithOwner", "--limit", "200"]);
+  return parseRepos(out3);
 }
 function parseStatusField(json) {
   const data = JSON.parse(json);
@@ -878,7 +1702,7 @@ function parseStatusField(json) {
   return { id: status.id, options };
 }
 function listStatusField(owner, number, run = defaultRunner2) {
-  const out2 = run([
+  const out3 = run([
     "gh",
     "project",
     "field-list",
@@ -890,7 +1714,7 @@ function listStatusField(owner, number, run = defaultRunner2) {
     "--limit",
     "100"
   ]);
-  return parseStatusField(out2);
+  return parseStatusField(out3);
 }
 function parseProjectId(json) {
   return JSON.parse(json)?.id ?? "";
@@ -942,30 +1766,90 @@ function readlinePrompter() {
 // src/commands/init.ts
 var HOOK_COMMAND = "kodi hook session-start";
 var SESSION_MATCHER = "startup|resume|clear|compact";
-function mergeSessionStartHook(settings) {
-  settings.hooks ??= {};
-  const arr = settings.hooks.SessionStart ??= [];
-  const already = arr.some((e) => e.hooks?.some((h) => h.command === HOOK_COMMAND));
-  if (already) return false;
-  arr.push({ matcher: SESSION_MATCHER, hooks: [{ type: "command", command: HOOK_COMMAND }] });
+var UPS_COMMAND = "kodi hook user-prompt-submit";
+var PTU_COMMAND = "kodi hook post-tool-use";
+function addHookOnce(settings, event, command, matcher) {
+  const hooks = settings.hooks ??= {};
+  const arr = hooks[event] ??= [];
+  if (arr.some((e) => e.hooks?.some((h) => h.command === command))) return false;
+  const entry = { hooks: [{ type: "command", command }] };
+  if (matcher) entry.matcher = matcher;
+  arr.push(entry);
   return true;
 }
+function mergeSessionStartHook(settings) {
+  return addHookOnce(settings, "SessionStart", HOOK_COMMAND, SESSION_MATCHER);
+}
+function mergeUserPromptSubmitHook(settings) {
+  return addHookOnce(settings, "UserPromptSubmit", UPS_COMMAND);
+}
+function mergePostToolUseHook(settings) {
+  return addHookOnce(settings, "PostToolUse", PTU_COMMAND, "Bash|Write|Edit");
+}
+var BOARD_CLI_COMMANDS = [
+  "gh pr",
+  // GitHub pull requests
+  "gh issue",
+  // GitHub issues (board tasks)
+  "gh project",
+  // GitHub Projects (boards)
+  "az repos pr",
+  // Azure DevOps pull requests
+  "az boards"
+  // Azure DevOps boards (work items / tasks)
+];
+function denyDirectAndRtk(cmd) {
+  return [`Bash(${cmd}:*)`, `Bash(rtk ${cmd}:*)`];
+}
+var PERMISSION_DENY = [
+  ...BOARD_CLI_COMMANDS.flatMap(denyDirectAndRtk),
+  ...denyDirectAndRtk("kodi init")
+  // the one-time human setup command, direct and via rtk
+];
+var PERMISSION_ALLOW = [
+  "Read(.claude/agents/**)",
+  // read the installed agents
+  "Read(.claude/skills/**)",
+  // read the installed skills
+  // kodi is the sanctioned board proxy — allow all of it. `kodi init` stays in the
+  // deny list, and deny rules override allow, so every kodi command runs without a
+  // prompt EXCEPT init. The rtk-proxied form is allowed for the same reason.
+  "Bash(kodi:*)",
+  "Bash(rtk kodi:*)"
+];
+function mergePermissions(settings) {
+  const perms = settings.permissions ??= {};
+  const deny = perms.deny ??= [];
+  const allow = perms.allow ??= [];
+  let changed = false;
+  for (const rule of PERMISSION_DENY)
+    if (!deny.includes(rule)) {
+      deny.push(rule);
+      changed = true;
+    }
+  for (const rule of PERMISSION_ALLOW)
+    if (!allow.includes(rule)) {
+      allow.push(rule);
+      changed = true;
+    }
+  return changed;
+}
 function defaultAssetsDir() {
   return fileURLToPath2(new URL("../assets/", import.meta.url));
 }
 function copyTree2(srcRoot, destRoot, force, reportBase) {
   const written = [];
-  if (!existsSync4(srcRoot)) return written;
+  if (!existsSync5(srcRoot)) return written;
   const walk = (src, dest) => {
     for (const entry of readdirSync2(src)) {
-      const s = join3(src, entry);
-      const d = join3(dest, entry);
+      const s = join4(src, entry);
+      const d = join4(dest, entry);
       if (statSync2(s).isDirectory()) walk(s, d);
       else {
-        if (existsSync4(d) && !force) continue;
-        mkdirSync3(dirname4(d), { recursive: true });
+        if (existsSync5(d) && !force) continue;
+        mkdirSync4(dirname5(d), { recursive: true });
         copyFileSync2(s, d);
-        written.push(join3(reportBase, relative2(destRoot, d)));
+        written.push(join4(reportBase, relative3(destRoot, d)));
       }
     }
   };
@@ -974,17 +1858,17 @@ function copyTree2(srcRoot, destRoot, force, reportBase) {
 }
 function copyMarkdownFlat(srcRoot, destDir, force, reportBase) {
   const written = [];
-  if (!existsSync4(srcRoot)) return written;
+  if (!existsSync5(srcRoot)) return written;
   const walk = (dir) => {
     for (const entry of readdirSync2(dir)) {
-      const s = join3(dir, entry);
+      const s = join4(dir, entry);
       if (statSync2(s).isDirectory()) walk(s);
       else if (entry.endsWith(".md") && entry !== "README.md") {
-        const d = join3(destDir, entry);
-        if (existsSync4(d) && !force) continue;
-        mkdirSync3(destDir, { recursive: true });
+        const d = join4(destDir, entry);
+        if (existsSync5(d) && !force) continue;
+        mkdirSync4(destDir, { recursive: true });
         copyFileSync2(s, d);
-        written.push(join3(reportBase, entry));
+        written.push(join4(reportBase, entry));
       }
     }
   };
@@ -994,25 +1878,35 @@ function copyMarkdownFlat(srcRoot, destDir, force, reportBase) {
 function installHarness(root, opts = {}) {
   const force = opts.force ?? false;
   const assetsDir = opts.assetsDir ?? defaultAssetsDir();
-  const claude = join3(root, ".claude");
+  const claude = join4(root, ".claude");
   const changed = [];
-  mkdirSync3(claude, { recursive: true });
-  const settingsPath = join3(claude, "settings.json");
-  const settings = existsSync4(settingsPath) ? JSON.parse(readFileSync4(settingsPath, "utf-8")) : {};
-  if (mergeSessionStartHook(settings)) {
-    writeFileSync3(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
-    changed.push(".claude/settings.json (SessionStart hook)");
+  mkdirSync4(claude, { recursive: true });
+  const settingsPath = join4(claude, "settings.json");
+  const settings = existsSync5(settingsPath) ? JSON.parse(readFileSync5(settingsPath, "utf-8")) : {};
+  const hookChanged = mergeSessionStartHook(settings);
+  const upsChanged = mergeUserPromptSubmitHook(settings);
+  const ptuChanged = mergePostToolUseHook(settings);
+  const permsChanged = mergePermissions(settings);
+  if (hookChanged || upsChanged || ptuChanged || permsChanged) {
+    writeFileSync4(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
+    const parts = [
+      hookChanged ? "SessionStart hook" : null,
+      upsChanged ? "UserPromptSubmit hook" : null,
+      ptuChanged ? "PostToolUse hook" : null,
+      permsChanged ? "permissions" : null
+    ].filter(Boolean).join(" + ");
+    changed.push(`.claude/settings.json (${parts})`);
   }
   changed.push(
-    ...copyTree2(join3(assetsDir, "skills"), join3(claude, "skills"), force, ".claude/skills"),
-    ...copyMarkdownFlat(join3(assetsDir, "agents"), join3(claude, "agents"), force, ".claude/agents"),
-    ...copyTree2(join3(assetsDir, "rules"), join3(claude, "rules"), force, ".claude/rules")
+    ...copyTree2(join4(assetsDir, "skills"), join4(claude, "skills"), force, ".claude/skills"),
+    ...copyMarkdownFlat(join4(assetsDir, "agents"), join4(claude, "agents"), force, ".claude/agents"),
+    ...copyTree2(join4(assetsDir, "rules"), join4(claude, "rules"), force, ".claude/rules")
   );
   const provider = opts.provider ?? "local";
   const docsSubs = ["prd", "adr", "diagrams", "plan", "security"];
   if (provider === "local") docsSubs.push("tickets");
   for (const sub of docsSubs) {
-    mkdirSync3(join3(root, "docs", sub), { recursive: true });
+    mkdirSync4(join4(root, "docs", sub), { recursive: true });
   }
   return changed;
 }
@@ -1056,54 +1950,65 @@ async function configureBoard(prompter, opts = {}) {
       `project "${project}" uses the ${info.processTemplate} process, which has no "Issue" work-item type. kodi creates tickets as Issues \u2014 use a Basic-process project (or add the Issue type), then re-run \`kodi init\`.`
     );
   }
-  let states = [];
+  let team = opts.team;
+  if (!team) {
+    let teams = [];
+    try {
+      teams = listTeams(org, project, opts.runner);
+    } catch {
+    }
+    team = teams.length === 1 ? teams[0] : teams.length > 1 ? await prompter.select("Select the team that owns the board", teams) : await prompter.input("Team that owns the board", `${project} Team`);
+  }
+  if (!team) throw new InitAbort("missing: team.");
+  let board = opts.board;
+  if (!board) {
+    let boards = [];
+    try {
+      boards = listBoards(org, project, team, opts.runner);
+    } catch {
+    }
+    const issuesBoard = boards.find((b) => b.toLowerCase() === "issues");
+    board = boards.length === 1 ? boards[0] : issuesBoard ? issuesBoard : boards.length > 1 ? await prompter.select("Select the board", boards) : await prompter.input("Board name", "Issues");
+  }
+  if (!board) throw new InitAbort("missing: board.");
+  let boardColumns = [];
   try {
-    states = listIssueStates(org, project, opts.runner);
+    boardColumns = listBoardColumns(org, project, team, board, opts.runner);
   } catch {
   }
-  const proposed = statesInCategory(states, "Proposed");
-  const inProg = statesInCategory(states, "InProgress");
-  const completed = statesInCategory(states, "Completed");
-  const pick = async (flag, message, candidates, def) => {
+  const columnNames = boardColumns.map((c) => c.name);
+  const pick = async (flag, message, def) => {
     if (flag) return flag;
-    if (candidates.length === 1) return candidates[0];
-    if (candidates.length > 1) return prompter.select(message, candidates);
+    if (columnNames.length > 0) return prompter.select(message, columnNames);
     return await prompter.input(message, def) || def;
   };
-  let todo;
-  if (opts.todoColumn) {
-    todo = opts.todoColumn;
-  } else if (states.length > 0 && proposed.length === 0) {
-    throw new InitAbort(
-      'no To Do-type column: the Issue type on this board has no "Proposed" state where new issues can land. Add a To Do column/state to the board, then re-run `kodi init`.'
-    );
-  } else if (proposed.length > 0) {
-    todo = proposed.length === 1 ? proposed[0] : await prompter.select("To Do column (where new issues are created)", proposed);
-  } else {
-    todo = await prompter.input(
+  const columns = {
+    todo: await pick(
+      opts.todoColumn,
       "To Do column (where new issues are created)",
       DEFAULT_COLUMNS.todo
-    );
-    if (!todo) throw new InitAbort("missing: the To Do column.");
-  }
-  const columns = {
-    todo,
-    inProgress: await pick(
-      opts.inProgressColumn,
-      "In Progress column",
-      inProg,
-      DEFAULT_COLUMNS.inProgress
-    ),
-    toReview: await pick(
-      opts.toReviewColumn,
-      "To Review column",
-      inProg,
-      DEFAULT_COLUMNS.toReview
     ),
-    done: await pick(opts.doneColumn, "Done column", completed, DEFAULT_COLUMNS.done)
+    inProgress: await pick(opts.inProgressColumn, "In Progress column", DEFAULT_COLUMNS.inProgress),
+    toReview: await pick(opts.toReviewColumn, "To Review column", DEFAULT_COLUMNS.toReview),
+    done: await pick(opts.doneColumn, "Done column", DEFAULT_COLUMNS.done)
   };
+  const stateByColumn = new Map(boardColumns.map((c) => [c.name, c.state]));
+  const columnStates = {};
+  for (const col of [columns.todo, columns.inProgress, columns.toReview, columns.done]) {
+    columnStates[col] = stateByColumn.get(col) ?? col;
+  }
   const repository = opts.repository ?? (await prompter.input("Repository name for pull requests", project) || project);
-  return { provider: "azure", prefix: "KODI", organization: org, project, repository, columns };
+  return {
+    provider: "azure",
+    prefix: "KODI",
+    organization: org,
+    project,
+    team,
+    board,
+    repository,
+    columns,
+    columnStates
+  };
 }
 async function configureGithub(prompter, opts) {
   if (hasProjectWriteScope(opts.runner) === false) {
@@ -1203,12 +2108,12 @@ async function configureGithub(prompter, opts) {
 }
 function writeState(root, config) {
   const path = stateFilePath(root);
-  mkdirSync3(dirname4(path), { recursive: true });
-  writeFileSync3(path, stringifyYaml2(config), "utf-8");
+  mkdirSync4(dirname5(path), { recursive: true });
+  writeFileSync4(path, stringifyYaml3(config), "utf-8");
   return path;
 }
 function registerInitCommand(program2) {
-  program2.command("init").description("Install the kodi harness and configure the board (interactive)").option("-d, --dir <path>", "target project directory", process.cwd()).option("--force", "overwrite existing agents/skills", false).option("--provider <local|github|azure>", "skip the provider prompt").option("--prefix <prefix>", "local ticket key prefix (default KODI)").option("--org <url>", "azure org URL (non-interactive)").option("--project <name>", "azure project (non-interactive)").option("--owner-type <org|user>", "github board owner type (non-interactive)").option("--project-owner <login>", "github Projects owner login (org or user)").option("--project-number <n>", "github Projects board number", (v) => Number(v)).option("--todo-column <name>", "To Do column (non-interactive)").option("--in-progress-column <name>", "In Progress column").option("--to-review-column <name>", "To Review column").option("--done-column <name>", "Done column").option("--repository <name>", "repository for PRs (azure: name; github: owner/repo)").action(async (o) => {
+  program2.command("init").description("Install the kodi harness and configure the board (interactive)").option("-d, --dir <path>", "target project directory", process.cwd()).option("--force", "overwrite existing agents/skills", false).option("--provider <local|github|azure>", "skip the provider prompt").option("--prefix <prefix>", "local ticket key prefix (default KODI)").option("--org <url>", "azure org URL (non-interactive)").option("--project <name>", "azure project (non-interactive)").option("--team <name>", "azure team that owns the board (non-interactive)").option("--board <name>", "azure board name (non-interactive, default Issues)").option("--owner-type <org|user>", "github board owner type (non-interactive)").option("--project-owner <login>", "github Projects owner login (org or user)").option("--project-number <n>", "github Projects board number", (v) => Number(v)).option("--todo-column <name>", "To Do column (non-interactive)").option("--in-progress-column <name>", "In Progress column").option("--to-review-column <name>", "To Review column").option("--done-column <name>", "Done column").option("--repository <name>", "repository for PRs (azure: name; github: owner/repo)").action(async (o) => {
     const root = String(o.dir);
     let provider = o.provider;
     if (!provider && !process.stdin.isTTY) provider = "local";
@@ -1220,6 +2125,8 @@ function registerInitCommand(program2) {
         prefix: o.prefix,
         org: o.org,
         project: o.project,
+        team: o.team,
+        board: o.board,
         ownerType: o.ownerType,
         projectOwner: o.projectOwner,
         projectNumber: o.projectNumber,
@@ -1242,12 +2149,19 @@ kodi init aborted \u2014 ${e.message}
       prompter.close();
     }
     const changed = installHarness(root, { force: o.force, provider: config.provider });
+    try {
+      const db = openDb();
+      const displayName = config.project ?? (config.repository ? basename4(config.repository) : basename4(resolve2(root)));
+      config.memory = provisionCollection(db, resolve2(root), displayName);
+      db.close();
+    } catch {
+    }
     const statePath = writeState(root, config);
     process.stdout.write(
       `
 kodi init: installed
 ${changed.map((c) => `  + ${c}`).join("\n")}
-  + ${relative2(root, statePath)} (provider: ${config.provider})
+  + ${relative3(root, statePath)} (provider: ${config.provider})
 
 SessionStart wired to \`${HOOK_COMMAND}\` (matchers: ${SESSION_MATCHER}).
 `
@@ -1255,36 +2169,233 @@ SessionStart wired to \`${HOOK_COMMAND}\` (matchers: ${SESSION_MATCHER}).
   });
 }
 
+// src/commands/memory.ts
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { parse as parseYaml4, stringify as stringifyYaml4 } from "yaml";
+function out(data, json, human) {
+  if (json) process.stdout.write(JSON.stringify(data) + "\n");
+  else process.stdout.write(human() + "\n");
+}
+function collect(value, previous) {
+  return previous.concat([value]);
+}
+function asType(v) {
+  if (v == null) return void 0;
+  if (!MEMORY_TYPES.includes(v)) {
+    throw new Error(`invalid --type "${v}". One of: ${MEMORY_TYPES.join(", ")}.`);
+  }
+  return v;
+}
+function renderLine(m) {
+  const files = m.files.length ? `  {${fileNames(m.files).join(", ")}}` : "";
+  const ticket = m.ticket ? `  ${m.ticket}` : "";
+  const flag = m.needsReverify ? " \u26A0reverify" : "";
+  return `${m.id}  ${m.score}\u2605  [${m.type}]${ticket}${flag}  ${m.title}${files}`;
+}
+function renderList(hits) {
+  return hits.length ? hits.map(renderLine).join("\n") : "no memories";
+}
+function withDb(fn) {
+  const db = openDb();
+  try {
+    return fn(db);
+  } finally {
+    db.close();
+  }
+}
+function withCollection(fn) {
+  return withDb((db) => fn(db, resolveCollection(db), findProjectRoot()));
+}
+function registerMemoryCommand(program2) {
+  const memory = program2.command("memory").description("Cross-session knowledge store (lexical FTS) \u2014 store/query project findings");
+  memory.command("store").description("Store a finding (deduped by content \u2014 idempotent)").option("-d, --draft <path>", "YAML draft file (validated against the memory template)").option("-c, --content <text>", "the finding to remember").option("-t, --type <type>", `one of: ${MEMORY_TYPES.join(", ")}`).option("--ticket <key>", "ticket/task in flight (optional)").option(
+    "--file <path>",
+    "repo-relative file the finding touches (repeatable, \u22651 required)",
+    collect,
+    []
+  ).option("--title <text>", "optional display title (else derived from content)").option("--json", "machine-readable output", false).action((o) => {
+    const draft = o.draft ? MemoryDraftSchema.parse(parseYaml4(readFileSync6(String(o.draft), "utf-8"))) : MemoryDraftSchema.parse({
+      content: o.content,
+      type: o.type,
+      ticket: o.ticket,
+      files: o.file ?? [],
+      title: o.title
+    });
+    withCollection((db, col, root) => {
+      const { record, deduped, blocked } = insertMemory(db, col.collection, draft, root);
+      if (blocked) {
+        out(
+          { ...record, blocked: true },
+          o.json,
+          () => `Blocked (re-learn guard): ${record.id} was disproven \u2014 ${record.tombstoneReason ?? "refuted"}`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      out(
+        { ...record, deduped },
+        o.json,
+        () => deduped ? `Already stored (dedup): ${record.id} \u2014 ${record.title}` : `Stored ${record.id} [${record.type}] (score ${record.score}) \u2014 ${record.title}`
+      );
+    });
+  });
+  memory.command("query [text...]").description("Search memories (BM25 text + filters), scoped to this project").option("-t, --type <type>", "filter by type").option("--ticket <key>", "filter by ticket").option("--file <path>", "filter by a referenced file path (substring)").option("--since <iso>", "only memories created on/after this ISO timestamp").option("-n, --limit <n>", "max results (default 10)", (v) => Number(v)).option("--json", "machine-readable output", false).action((text, o) => {
+    withCollection((db, col) => {
+      const hits = queryMemories(db, col.collection, {
+        text: text?.length ? text.join(" ") : void 0,
+        type: asType(o.type),
+        ticket: o.ticket,
+        file: o.file,
+        since: o.since,
+        limit: o.limit
+      });
+      out(hits, o.json, () => renderList(hits));
+    });
+  });
+  memory.command("list").description("Browse recent memories in this project (newest first)").option("-t, --type <type>", "filter by type").option("--ticket <key>", "filter by ticket").option("-n, --limit <n>", "max results (default 10)", (v) => Number(v)).option("--json", "machine-readable output", false).action((o) => {
+    withCollection((db, col) => {
+      const hits = queryMemories(db, col.collection, {
+        type: asType(o.type),
+        ticket: o.ticket,
+        limit: o.limit
+      });
+      out(hits, o.json, () => renderList(hits));
+    });
+  });
+  memory.command("amend <id>").description("Edit a memory in place").option("-c, --content <text>").option("-t, --type <type>").option("--ticket <key>").option("--file <path>", "replace referenced files (repeatable)", collect).option("--title <text>").option("--json", "machine-readable output", false).action((id, o) => {
+    withDb((db) => {
+      const updated = amendMemory(
+        db,
+        id,
+        {
+          content: o.content,
+          type: asType(o.type),
+          ticket: o.ticket,
+          files: o.file,
+          title: o.title
+        },
+        findProjectRoot()
+      );
+      if (!updated) {
+        out({ error: "not found", id }, o.json, () => `no memory ${id}`);
+        process.exitCode = 1;
+        return;
+      }
+      out(
+        updated,
+        o.json,
+        () => `Amended ${updated.id} (score reset to ${updated.score}) \u2014 ${updated.title}`
+      );
+    });
+  });
+  memory.command("verify <id>").description("Record a veracity judgment: --pass raises the score, --fail tombstones").option("--pass", "the memory still holds against its files (score +1)", false).option("--fail", "the memory is disproven (tombstone + re-learn guard)", false).option("--reason <text>", "why it failed (stored on the tombstone)").option("--json", "machine-readable output", false).action((id, o) => {
+    if (o.pass === o.fail) throw new Error("pass exactly one of --pass or --fail.");
+    withDb((db) => {
+      const updated = verifyMemory(db, id, !!o.pass, findProjectRoot(), o.reason);
+      if (!updated) {
+        out({ error: "not found", id }, o.json, () => `no memory ${id}`);
+        process.exitCode = 1;
+        return;
+      }
+      out(
+        updated,
+        o.json,
+        () => updated.status === "tombstoned" ? `Tombstoned ${updated.id} \u2014 ${updated.tombstoneReason}` : `Verified ${updated.id} \u2014 score now ${updated.score}`
+      );
+    });
+  });
+  memory.command("rm <id>").description("Delete a memory").option("--json", "machine-readable output", false).action((id, o) => {
+    withDb((db) => {
+      const removed = removeMemory(db, id);
+      out({ removed, id }, o.json, () => removed ? `Removed ${id}` : `no memory ${id}`);
+      if (!removed) process.exitCode = 1;
+    });
+  });
+  memory.command("export").description("Export this project\u2019s memories as YAML (all, or one --type)").option("-t, --type <type>", "export only this type").option("-f, --file <path>", "write to a file (default: stdout)").action((o) => {
+    withCollection((db, col) => {
+      const records = exportMemories(db, col.collection, asType(o.type));
+      const doc = {
+        collection: col.name,
+        exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        memories: records.map((m) => ({
+          content: m.content,
+          type: m.type,
+          ticket: m.ticket,
+          files: m.files,
+          title: m.title,
+          createdAt: m.createdAt
+        }))
+      };
+      const yaml = stringifyYaml4(doc);
+      if (o.file) {
+        writeFileSync5(String(o.file), yaml, "utf-8");
+        process.stderr.write(`Exported ${records.length} memories -> ${o.file}
+`);
+      } else {
+        process.stdout.write(yaml);
+      }
+    });
+  });
+  memory.command("import <path>").description("Import memories from a YAML file into this project (deduped)").option("-t, --type <type>", "import only this type").option("--json", "machine-readable output", false).action((path, o) => {
+    const doc = MemoryExportDocSchema.parse(parseYaml4(readFileSync6(path, "utf-8")));
+    withCollection((db, col, root) => {
+      const res = importMemories(db, col.collection, doc.memories, root, asType(o.type));
+      out(res, o.json, () => `Imported: +${res.added} added, ${res.skipped} skipped`);
+    });
+  });
+  return memory;
+}
+
 // src/commands/pr.ts
-import { mkdtempSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
 import { tmpdir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // src/templates/pr.ts
-import { z as z3 } from "zod";
-var PrSchema = z3.object({
-  title: z3.string().min(3, "title must be at least 3 characters"),
-  summary: z3.string().min(1, "summary is required"),
-  includedChanges: z3.array(z3.string().min(1)).default([]),
-  features: z3.array(z3.string().min(1)).default([]),
-  fixes: z3.array(z3.string().min(1)).default([]),
-  improvements: z3.array(z3.string().min(1)).default([]),
-  relatedIssues: z3.array(z3.string().min(1)).default([]),
-  notes: z3.string().optional(),
-  reviewers: z3.array(z3.string().min(1)).default([])
+import { z as z4 } from "zod";
+var PrSchema = z4.object({
+  title: z4.string().min(3, "title must be at least 3 characters"),
+  summary: z4.string().min(1, "summary is required"),
+  includedChanges: z4.array(z4.string().min(1)).default([]),
+  features: z4.array(z4.string().min(1)).default([]),
+  fixes: z4.array(z4.string().min(1)).default([]),
+  improvements: z4.array(z4.string().min(1)).default([]),
+  /**
+   * Security vulnerabilities the slice surfaced, each referencing its report
+   * (e.g. "CRITICAL — SQLi in login (docs/security/KODI-014-sqli-login.md)").
+   * Rendered as a prominent section so reviewers see findings that still need
+   * follow-up tickets. Empty when the slice produced no security reports.
+   */
+  vulnerabilities: z4.array(z4.string().min(1)).default([]),
+  relatedIssues: z4.array(z4.string().min(1)).default([]),
+  notes: z4.string().optional(),
+  reviewers: z4.array(z4.string().min(1)).default([])
 });
+function neutralizeAutolinks(text) {
+  return text.replace(/#(?=\d)/g, "#\u200B");
+}
+var MAX_PR_BODY = 4e3;
+function assertWithinBodyLimit(body) {
+  if (body.length > MAX_PR_BODY) {
+    throw new Error(
+      `PR body is ${body.length} chars; the limit is ${MAX_PR_BODY}. Shorten the summary/notes or trim bullets, then retry.`
+    );
+  }
+}
 function bulletSection(title, items) {
   if (!items.length) return [];
   return ["", `## ${title}`, "", ...items.map((i) => `- ${i}`)];
 }
 function renderPrMarkdown(pr) {
-  const lines = ["## Summary", "", pr.summary];
-  lines.push(...bulletSection("Included changes", pr.includedChanges));
-  lines.push(...bulletSection("Features", pr.features));
-  lines.push(...bulletSection("Fixes", pr.fixes));
-  lines.push(...bulletSection("Improvements", pr.improvements));
+  const s = neutralizeAutolinks;
+  const lines = ["## Summary", "", s(pr.summary)];
+  lines.push(...bulletSection("Security vulnerabilities", pr.vulnerabilities.map(s)));
+  lines.push(...bulletSection("Included changes", pr.includedChanges.map(s)));
+  lines.push(...bulletSection("Features", pr.features.map(s)));
+  lines.push(...bulletSection("Fixes", pr.fixes.map(s)));
+  lines.push(...bulletSection("Improvements", pr.improvements.map(s)));
   lines.push(...bulletSection("Related issues", pr.relatedIssues));
-  if (pr.notes) lines.push("", "## Notes", "", pr.notes);
+  if (pr.notes) lines.push("", "## Notes", "", s(pr.notes));
   return lines.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd() + "\n";
 }
 function renderPrHtml(pr) {
@@ -1301,7 +2412,7 @@ function resolveTarget(explicit) {
   );
 }
 function draftFromOptions(o) {
-  if (o.file) return PrSchema.parse(JSON.parse(readFileSync5(String(o.file), "utf-8")));
+  if (o.file) return PrSchema.parse(JSON.parse(readFileSync7(String(o.file), "utf-8")));
   return PrSchema.parse({
     title: o.title,
     summary: o.summary,
@@ -1309,6 +2420,7 @@ function draftFromOptions(o) {
     fixes: o.fix ?? [],
     improvements: o.improvement ?? [],
     includedChanges: o.change ?? [],
+    vulnerabilities: o.vulnerability ?? [],
     relatedIssues: o.issue ?? [],
     notes: o.notes,
     reviewers: o.reviewer ?? []
@@ -1352,14 +2464,21 @@ function azureCreateArgs(pr, html, source, target, repo) {
 }
 function registerPrCommand(program2) {
   const pr = program2.command("pr").description("Manage pull requests (proxy gh/az) with a validated template");
-  pr.command("create").description("Create a PR from a validated template draft").option("-f, --file <path>", "JSON PR draft (validated against the template)").option("-t, --title <title>").option("-s, --summary <summary>").option("--feature <text>", "feature (repeatable)", collect, []).option("--fix <text>", "fix (repeatable)", collect, []).option("--improvement <text>", "improvement (repeatable)", collect, []).option("--change <text>", "included change (repeatable)", collect, []).option("--issue <ref>", "related issue (repeatable)", collect, []).option("--reviewer <name>", "reviewer (repeatable)", collect, []).option("--notes <text>").requiredOption("--source <branch>", "branch the PR is opened from").requiredOption("--target <branch>", "branch the PR merges into").option("--provider <github|azure>", "override the PR provider").option("--repository <repo>", "repository (gh: OWNER/REPO; az: name)").option("--yes", "execute (default: dry-run)", false).action((o) => {
+  pr.command("create").description("Create a PR from a validated template draft").option("-f, --file <path>", "JSON PR draft (validated against the template)").option("-t, --title <title>").option("-s, --summary <summary>").option("--feature <text>", "feature (repeatable)", collect2, []).option("--fix <text>", "fix (repeatable)", collect2, []).option("--improvement <text>", "improvement (repeatable)", collect2, []).option("--change <text>", "included change (repeatable)", collect2, []).option(
+    "--vulnerability <ref>",
+    "security vulnerability the slice surfaced, referencing its report (repeatable)",
+    collect2,
+    []
+  ).option("--issue <ref>", "related issue (repeatable)", collect2, []).option("--reviewer <name>", "reviewer (repeatable)", collect2, []).option("--notes <text>").requiredOption("--source <branch>", "branch the PR is opened from").requiredOption("--target <branch>", "branch the PR merges into").option("--provider <github|azure>", "override the PR provider").option("--repository <repo>", "repository (gh: OWNER/REPO; az: name)").option("--yes", "execute (default: dry-run)", false).action((o) => {
     const draft = draftFromOptions(o);
     const target = resolveTarget(o.provider);
     const repo = o.repository ?? loadBoardConfig().repository;
+    const body = renderPrMarkdown(draft);
+    assertWithinBodyLimit(body);
     let args;
     if (target === "github") {
-      const bodyFile = join4(mkdtempSync(join4(tmpdir(), "kodi-pr-")), "body.md");
-      writeFileSync4(bodyFile, renderPrMarkdown(draft), "utf-8");
+      const bodyFile = join5(mkdtempSync(join5(tmpdir(), "kodi-pr-")), "body.md");
+      writeFileSync6(bodyFile, body, "utf-8");
       args = githubCreateArgs(draft, bodyFile, o.source, o.target, repo);
     } else {
       args = azureCreateArgs(draft, renderPrHtml(draft), o.source, o.target, repo);
@@ -1381,27 +2500,27 @@ function registerPrCommand(program2) {
   });
   return pr;
 }
-function collect(value, previous) {
+function collect2(value, previous) {
   return previous.concat([value]);
 }
 
 // src/commands/serve.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import net from "net";
-import { dirname as dirname5, resolve as resolve2 } from "path";
+import { dirname as dirname6, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var LISTEN_TIMEOUT_MS = 15e3;
 var PROBE_INTERVAL_MS = 200;
 var KILL_GRACE_MS = 2500;
 function resolveBoardServer() {
-  const moduleDir = dirname5(fileURLToPath3(import.meta.url));
+  const moduleDir = dirname6(fileURLToPath3(import.meta.url));
   const candidates = [
-    resolve2(moduleDir, "..", "board-dist", "server.js"),
-    resolve2(moduleDir, "..", "..", "board-dist", "server.js")
+    resolve3(moduleDir, "..", "board-dist", "server.js"),
+    resolve3(moduleDir, "..", "..", "board-dist", "server.js")
   ];
   for (const candidate of candidates) {
-    if (existsSync5(candidate)) return candidate;
+    if (existsSync6(candidate)) return candidate;
   }
   throw new Error("board not built \u2014 run `pnpm build` before `kodi tickets serve`");
 }
@@ -1496,7 +2615,7 @@ function registerServeCommand(program2) {
     throw new Error("internal: `tickets` command must be registered before `serve`");
   }
   tickets.command("serve").alias("open").description("Launch the local board UI in the browser (read-only view of docs/tickets)").option("--port <n>", "bind the board to a specific port (default: an OS-picked free port)").action(async (o) => {
-    const ticketsDir = resolve2(localPaths(process.cwd()).root);
+    const ticketsDir = resolve3(localPaths(process.cwd()).root);
     let serverJs;
     try {
       serverJs = resolveBoardServer();
@@ -1580,22 +2699,22 @@ function registerServeCommand(program2) {
 }
 
 // src/commands/tickets.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 
 // src/providers/local.ts
 import { randomBytes as randomBytes2 } from "crypto";
 import {
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   lstatSync,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync5,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync8,
   renameSync as renameSync2,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync7
 } from "fs";
-import { basename as basename2, join as join5 } from "path";
-import { parse as parseYaml4, stringify as stringifyYaml3 } from "yaml";
+import { basename as basename5, join as join6 } from "path";
+import { parse as parseYaml5, stringify as stringifyYaml5 } from "yaml";
 var FRONTMATTER = /^---\n([\s\S]*?)\n---\n?/;
 var LEGACY_FOLDERS = ["backlog", "done"];
 var LEGACY_FILENAME_RE = /^[A-Z][A-Z0-9]*-\d+-.*\.md$/;
@@ -1626,11 +2745,11 @@ var LocalTicketProvider = class {
    */
   scaffold() {
     this.detectLegacyData();
-    if (!existsSync6(this.paths.statusYaml)) {
+    if (!existsSync7(this.paths.statusYaml)) {
       save(this.paths.statusYaml, emptyDocument());
     }
     for (const status of TICKET_STATUSES) {
-      mkdirSync4(this.paths.folderFor(status), { recursive: true });
+      mkdirSync5(this.paths.folderFor(status), { recursive: true });
     }
   }
   /**
@@ -1648,7 +2767,7 @@ var LocalTicketProvider = class {
    * the first confirmed ticket-shaped file (SR-H).
    */
   detectLegacyData() {
-    if (existsSync6(this.paths.statusYaml)) return;
+    if (existsSync7(this.paths.statusYaml)) return;
     const states = LEGACY_FOLDERS.map((name2) => ({ name: name2, state: this.legacyDirState(name2) }));
     const present = states.filter((s) => s.state !== "absent");
     if (present.length === 0) return;
@@ -1658,7 +2777,7 @@ var LocalTicketProvider = class {
     }
     for (const { name: name2, state } of states) {
       if (state !== "dir") continue;
-      const dir = join5(this.paths.root, name2);
+      const dir = join6(this.paths.root, name2);
       let entries;
       try {
         entries = readdirSync3(dir, { withFileTypes: true });
@@ -1668,7 +2787,7 @@ var LocalTicketProvider = class {
       for (const dirent of entries) {
         if (!dirent.isFile()) continue;
         if (!LEGACY_FILENAME_RE.test(dirent.name)) continue;
-        if (legacyFileHasKey(join5(dir, dirent.name))) {
+        if (legacyFileHasKey(join6(dir, dirent.name))) {
           throw new LegacyDataError(folders, 1);
         }
       }
@@ -1681,7 +2800,7 @@ var LocalTicketProvider = class {
    * `unsafe` (SR-B fail-safe); a real directory is `dir`.
    */
   legacyDirState(name2) {
-    const dir = join5(this.paths.root, name2);
+    const dir = join6(this.paths.root, name2);
     let st;
     try {
       st = lstatSync(dir);
@@ -1696,13 +2815,13 @@ var LocalTicketProvider = class {
   parseFile(path) {
     let raw;
     try {
-      raw = readFileSync6(path, "utf-8");
+      raw = readFileSync8(path, "utf-8");
     } catch {
       return null;
     }
     const m = FRONTMATTER.exec(raw);
     if (!m) return null;
-    const meta = parseYaml4(m[1]) ?? {};
+    const meta = parseYaml5(m[1]) ?? {};
     const parsed = TicketSchema.safeParse(meta);
     if (!parsed.success || !parsed.data.key || !parsed.data.slug) return null;
     return parsed.data;
@@ -1736,21 +2855,21 @@ var LocalTicketProvider = class {
    */
   writeTicketFile(ticket) {
     const dir = this.paths.folderFor(ticket.status);
-    mkdirSync4(dir, { recursive: true });
-    const finalName = basename2(composeFile(ticket.status, ticket.key, ticket.slug));
-    const finalPath = join5(dir, finalName);
+    mkdirSync5(dir, { recursive: true });
+    const finalName = basename5(composeFile(ticket.status, ticket.key, ticket.slug));
+    const finalPath = join6(dir, finalName);
     const body = `---
-${stringifyYaml3(sortTicket(ticket)).trimEnd()}
+${stringifyYaml5(sortTicket(ticket)).trimEnd()}
 ---
 
 ` + renderTicketMarkdown(ticket);
-    const tmp = join5(dir, `.${finalName}.${randomBytes2(6).toString("hex")}.tmp`);
+    const tmp = join6(dir, `.${finalName}.${randomBytes2(6).toString("hex")}.tmp`);
     try {
-      writeFileSync5(tmp, body, { encoding: "utf-8", flag: "wx", mode: 384 });
+      writeFileSync7(tmp, body, { encoding: "utf-8", flag: "wx", mode: 384 });
       renameSync2(tmp, finalPath);
     } catch (err) {
       try {
-        if (existsSync6(tmp)) unlinkSync2(tmp);
+        if (existsSync7(tmp)) unlinkSync2(tmp);
       } catch {
       }
       throw err;
@@ -1788,11 +2907,11 @@ ${stringifyYaml3(sortTicket(ticket)).trimEnd()}
     if (load(this.paths.statusYaml).tickets[key]) {
       throw new Error(`ticket ${key} already exists`);
     }
-    const slug = input.slug ?? slugify(input.title);
-    const ticket = { ...input, key, slug };
+    const slug2 = input.slug ?? slugify(input.title);
+    const ticket = { ...input, key, slug: slug2 };
     this.writeTicketFile(ticket);
     const doc = load(this.paths.statusYaml);
-    upsert(doc, { key, column: ticket.status, slug });
+    upsert(doc, { key, column: ticket.status, slug: slug2 });
     save(this.paths.statusYaml, doc);
     return ticket;
   }
@@ -1861,7 +2980,7 @@ ${stringifyYaml3(sortTicket(ticket)).trimEnd()}
 function legacyFileHasKey(path) {
   let raw;
   try {
-    raw = readFileSync6(path, "utf-8");
+    raw = readFileSync8(path, "utf-8");
   } catch {
     return false;
   }
@@ -1869,7 +2988,7 @@ function legacyFileHasKey(path) {
   if (!m) return false;
   let meta;
   try {
-    meta = parseYaml4(m[1]);
+    meta = parseYaml5(m[1]);
   } catch {
     return false;
   }
@@ -1903,9 +3022,9 @@ function sortTicket(t) {
 }
 
 // src/providers/github.ts
-import { mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync6 } from "fs";
+import { mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var MARKER_RE2 = /<!--\s*kodi:ticket\s+(\{[\s\S]*?\})\s*-->/;
 var DEFAULT_COLUMNS2 = {
   todo: "Todo",
@@ -1947,19 +3066,19 @@ function parseMarker(body) {
 function parseItems(json) {
   const data = JSON.parse(json);
   const items = Array.isArray(data) ? data : data.items ?? [];
-  const out2 = [];
+  const out3 = [];
   for (const it of items) {
     const content = it?.content ?? {};
     if (content.type !== "Issue" || typeof content.number !== "number" || typeof it?.id !== "string")
       continue;
-    out2.push({
+    out3.push({
       itemId: it.id,
       issueNumber: content.number,
       statusName: typeof it?.status === "string" ? it.status : void 0,
       body: typeof content.body === "string" ? content.body : void 0
     });
   }
-  return out2;
+  return out3;
 }
 function createIssueArgs(repo, title, bodyFile) {
   const args = ["gh", "issue", "create", "--title", title, "--body-file", bodyFile];
@@ -2015,7 +3134,7 @@ var GithubTicketProvider = class {
   /** Read (and cache) all board items in one call. */
   items() {
     if (this.itemsCache) return this.itemsCache;
-    const out2 = execRead([
+    const out3 = execRead([
       "gh",
       "project",
       "item-list",
@@ -2027,7 +3146,7 @@ var GithubTicketProvider = class {
       "--limit",
       "500"
     ]);
-    return this.itemsCache = parseItems(out2);
+    return this.itemsCache = parseItems(out3);
   }
   /** Body for an item — from item-list when present, else a per-issue fallback fetch. */
   bodyFor(item) {
@@ -2055,8 +3174,8 @@ var GithubTicketProvider = class {
     return "(assigned by github on create)";
   }
   async create(input) {
-    const slug = input.slug ?? slugify(input.title);
-    const draft = { ...input, key: "(pending)", slug };
+    const slug2 = input.slug ?? slugify(input.title);
+    const draft = { ...input, key: "(pending)", slug: slug2 };
     const bodyFile = writeTempBody(serializeBody(draft));
     const r1 = execMutate(createIssueArgs(this.opts.repo, input.title, bodyFile), this.opts.dryRun);
     if (!r1.ran) {
@@ -2147,8 +3266,8 @@ function toRef3(t) {
   };
 }
 function writeTempBody(body) {
-  const file = join6(mkdtempSync2(join6(tmpdir2(), "kodi-gh-")), "body.md");
-  writeFileSync6(file, body, "utf-8");
+  const file = join7(mkdtempSync2(join7(tmpdir2(), "kodi-gh-")), "body.md");
+  writeFileSync8(file, body, "utf-8");
   return file;
 }
 
@@ -2172,6 +3291,7 @@ function resolveProvider(cwd = process.cwd(), opts = {}) {
         organization: cfg.organization,
         project: cfg.project,
         columns: cfg.columns,
+        columnStates: cfg.columnStates,
         dryRun: !opts.yes,
         cwd
       });
@@ -2181,13 +3301,13 @@ function resolveProvider(cwd = process.cwd(), opts = {}) {
 }
 
 // src/commands/tickets.ts
-function out(data, json, human) {
+function out2(data, json, human) {
   if (json) process.stdout.write(JSON.stringify(data) + "\n");
   else process.stdout.write(human() + "\n");
 }
 function draftFromOptions2(o) {
   if (o.file) {
-    const raw = JSON.parse(readFileSync7(String(o.file), "utf-8"));
+    const raw = JSON.parse(readFileSync9(String(o.file), "utf-8"));
     return TicketSchema.parse(raw);
   }
   return TicketSchema.parse({
@@ -2206,14 +3326,14 @@ function draftFromOptions2(o) {
 }
 function registerTicketsCommand(program2) {
   const tickets = program2.command("tickets").description("Manage tickets across the active provider (local / github / azure)");
-  tickets.command("create").description("Create a ticket (validates the template)").option("-f, --file <path>", "JSON draft file (validated against the ticket template)").option("-t, --title <title>").option("-s, --summary <summary>").option("--ac <criterion>", "acceptance criterion (repeatable)", collect2, []).option("--non-goal <text>", "non-goal (repeatable)", collect2, []).option("--dep <key>", "dependency ticket key (repeatable)", collect2, []).option("--prd <ref>", "PRD driver").option("--adr <ref>", "ADR driver (repeatable)", collect2, []).option("--security <ref>", "security driver").option("--notes <text>").option("--yes", "execute remote mutations (default: dry-run)", false).option("--json", "machine-readable output", false).action(async (o) => {
+  tickets.command("create").description("Create a ticket (validates the template)").option("-f, --file <path>", "JSON draft file (validated against the ticket template)").option("-t, --title <title>").option("-s, --summary <summary>").option("--ac <criterion>", "acceptance criterion (repeatable)", collect3, []).option("--non-goal <text>", "non-goal (repeatable)", collect3, []).option("--dep <key>", "dependency ticket key (repeatable)", collect3, []).option("--prd <ref>", "PRD driver").option("--adr <ref>", "ADR driver (repeatable)", collect3, []).option("--security <ref>", "security driver").option("--notes <text>").option("--yes", "execute remote mutations (default: dry-run)", false).option("--json", "machine-readable output", false).action(async (o) => {
     const draft = draftFromOptions2(o);
     try {
       const created = await resolveProvider(process.cwd(), { yes: o.yes }).create(draft);
-      out(created, o.json, () => `Created ${created.key} (${created.status}) \u2014 ${created.title}`);
+      out2(created, o.json, () => `Created ${created.key} (${created.status}) \u2014 ${created.title}`);
     } catch (err) {
       if (err instanceof LegacyDataError) {
-        out(err.report, o.json, () => renderLegacyRefusal(err.report));
+        out2(err.report, o.json, () => renderLegacyRefusal(err.report));
         process.exitCode = 1;
         return;
       }
@@ -2222,7 +3342,7 @@ function registerTicketsCommand(program2) {
   });
   tickets.command("list").description("List all tickets").option("--json", "machine-readable output", false).action(async (o) => {
     const refs = await resolveProvider().list();
-    out(
+    out2(
       refs,
       o.json,
       () => refs.length ? refs.map((t) => `${t.key}  ${t.status.padEnd(12)}  ${t.title}`).join("\n") : "No tickets."
@@ -2230,7 +3350,7 @@ function registerTicketsCommand(program2) {
   });
   tickets.command("list-ready").description("List tickets ready to start (no unmet dependency) + the blocked set").option("--json", "machine-readable output", false).action(async (o) => {
     const res = await resolveProvider().listReady();
-    out(res, o.json, () => {
+    out2(res, o.json, () => {
       const ready = res.ready.map((t) => `  ${t.key}  ${t.title}`).join("\n") || "  (none)";
       const blocked = res.blocked.map((b) => `  ${b.ticket.key}  ${b.ticket.title}  \u2190 ${b.blockedBy.join(", ")}`).join("\n") || "  (none)";
       return `Ready:
@@ -2248,7 +3368,7 @@ ${blocked}`;
       process.exitCode = 1;
       return;
     }
-    out(t, o.json, () => JSON.stringify(t, null, 2));
+    out2(t, o.json, () => JSON.stringify(t, null, 2));
   });
   tickets.command("set-status <key> <status>").description(`Transition a ticket (${TICKET_STATUSES.join(" | ")})`).option("--yes", "execute remote mutations (default: dry-run)", false).option("--json", "machine-readable output", false).action(async (key, status, o) => {
     if (!TICKET_STATUSES.includes(status)) {
@@ -2261,32 +3381,32 @@ ${blocked}`;
       key,
       status
     );
-    out(t, o.json, () => `${t.key} \u2192 ${t.status}`);
+    out2(t, o.json, () => `${t.key} \u2192 ${t.status}`);
   });
   tickets.command("start <key>").description("Mark a ticket started (In progress)").option("--branch <name>").option("--yes", "execute remote mutations (default: dry-run)", false).option("--json", "machine-readable output", false).action(async (key, o) => {
     const t = await resolveProvider(process.cwd(), { yes: o.yes }).start(key, {
       branch: o.branch
     });
-    out(t, o.json, () => `${t.key} \u2192 ${t.status}`);
+    out2(t, o.json, () => `${t.key} \u2192 ${t.status}`);
   });
   tickets.command("delete <key>").description("Delete a ticket").option("--yes", "execute remote mutations (default: dry-run)", false).option("--json", "machine-readable output", false).action(async (key, o) => {
     await resolveProvider(process.cwd(), { yes: o.yes }).delete(key);
-    out({ deleted: key }, o.json, () => `Deleted ${key}`);
+    out2({ deleted: key }, o.json, () => `Deleted ${key}`);
   });
   tickets.command("next-id").description("Compute the next ticket key").option("--json", "machine-readable output", false).action(async (o) => {
     const id = await resolveProvider().nextId();
-    out({ nextId: id }, o.json, () => id);
+    out2({ nextId: id }, o.json, () => id);
   });
-  tickets.command("amend <key>").description("Edit a ticket (from --file patch or flags)").option("-f, --file <path>", "JSON patch (validated against the template)").option("-s, --summary <text>").option("--notes <text>").option("--ac <criterion>", "replace acceptance criteria (repeatable)", collect2, []).option("--dep <key>", "replace dependencies (repeatable)", collect2, []).option("--pr <ref>", "link a PR").option("--yes", "execute remote mutations (default: dry-run)", false).option("--json", "machine-readable output", false).action(async (key, o) => {
-    const patch = o.file ? TicketSchema.partial().parse(JSON.parse(readFileSync7(String(o.file), "utf-8"))) : buildPatch(o);
+  tickets.command("amend <key>").description("Edit a ticket (from --file patch or flags)").option("-f, --file <path>", "JSON patch (validated against the template)").option("-s, --summary <text>").option("--notes <text>").option("--ac <criterion>", "replace acceptance criteria (repeatable)", collect3, []).option("--dep <key>", "replace dependencies (repeatable)", collect3, []).option("--pr <ref>", "link a PR").option("--yes", "execute remote mutations (default: dry-run)", false).option("--json", "machine-readable output", false).action(async (key, o) => {
+    const patch = o.file ? TicketSchema.partial().parse(JSON.parse(readFileSync9(String(o.file), "utf-8"))) : buildPatch(o);
     const t = await resolveProvider(process.cwd(), { yes: o.yes }).amend(key, patch);
-    out(t, o.json, () => `Amended ${t.key}`);
+    out2(t, o.json, () => `Amended ${t.key}`);
   });
   tickets.command("link-pr <key> <pr>").description("Bind a pull request to a ticket").option("--yes", "execute remote mutations (default: dry-run)", false).option("--json", "machine-readable output", false).action(async (key, pr, o) => {
     const t = await resolveProvider(process.cwd(), { yes: o.yes }).amend(key, { prUrl: pr });
-    out(t, o.json, () => `${t.key} \u2194 ${pr}`);
+    out2(t, o.json, () => `${t.key} \u2194 ${pr}`);
   });
-  tickets.command("deps <key>").description("Read a ticket's dependencies, or declare new ones with --add").option("--add <key>", "declare a dependency (repeatable)", collect2, []).option("--yes", "execute remote mutations (default: dry-run)", false).option("--json", "machine-readable output", false).action(async (key, o) => {
+  tickets.command("deps <key>").description("Read a ticket's dependencies, or declare new ones with --add").option("--add <key>", "declare a dependency (repeatable)", collect3, []).option("--yes", "execute remote mutations (default: dry-run)", false).option("--json", "machine-readable output", false).action(async (key, o) => {
     const provider = resolveProvider(process.cwd(), { yes: o.yes });
     const current = await provider.get(key);
     if (!current) {
@@ -2298,9 +3418,9 @@ ${blocked}`;
     if (o.add.length) {
       const deps = Array.from(/* @__PURE__ */ new Set([...current.dependencies, ...o.add]));
       const t = await provider.amend(key, { dependencies: deps });
-      out(t.dependencies, o.json, () => `${key} deps: ${t.dependencies.join(", ") || "(none)"}`);
+      out2(t.dependencies, o.json, () => `${key} deps: ${t.dependencies.join(", ") || "(none)"}`);
     } else {
-      out(
+      out2(
         current.dependencies,
         o.json,
         () => `${key} deps: ${current.dependencies.join(", ") || "(none)"}`
@@ -2311,11 +3431,11 @@ ${blocked}`;
     const provider = resolveProvider(process.cwd(), { yes: o.yes });
     if (o.pr) await provider.amend(key, { prUrl: o.pr });
     const t = await provider.setStatus(key, "To review");
-    out(t, o.json, () => `${t.key} \u2192 ${t.status}${o.pr ? ` (PR ${o.pr})` : ""}`);
+    out2(t, o.json, () => `${t.key} \u2192 ${t.status}${o.pr ? ` (PR ${o.pr})` : ""}`);
   });
   return tickets;
 }
-function collect2(value, previous) {
+function collect3(value, previous) {
   return previous.concat([value]);
 }
 function renderLegacyRefusal(report) {
@@ -2337,7 +3457,7 @@ function buildPatch(o) {
 
 // package.json
 var name = "kodi-dev";
-var version = "1.0.1";
+var version = "1.2.0";
 var description = "kodi.dev \u2014 Claude Code-native agent orchestrator CLI";
 
 // src/index.ts
@@ -2349,6 +3469,7 @@ registerPrCommand(program);
 registerHookCommand(program);
 registerInitCommand(program);
 registerAddCommand(program);
+registerMemoryCommand(program);
 program.parseAsync(process.argv).catch((err) => {
   process.stderr.write(`${err instanceof Error ? err.message : String(err)}
 `);