mason-context 0.19.1 → 0.19.2

package/dist/mason.js

@@ -435,8 +435,229 @@ var init_store_lock = __esm({
   }
 });
 
-// src/automation/store.ts
+// src/audit/findings.ts
+import { createHash } from "crypto";
 import { z } from "zod";
+function findingId(finding) {
+  const e = finding.evidence;
+  let key;
+  switch (e.kind) {
+    case "missing-path":
+      key = e.resolvedPath && e.resolvedPath !== e.claimed ? [e.claimed, e.resolvedPath] : e.claimed;
+      break;
+    case "unmentioned-dir":
+      key = e.dir;
+      break;
+    case "count-mismatch":
+      key = [e.unit.replace(/s$/, ""), e.countedFrom];
+      break;
+    case "missing-script":
+      key = e.scope && e.scope.directory !== "." ? [e.scriptName, e.scope.directory] : e.scriptName;
+      break;
+    case "doc-behind-manifests":
+      key = null;
+      break;
+    case "decision-anchor":
+      key = [e.decisionId, e.provenance?.revision, e.provenance?.approval];
+      break;
+  }
+  return digest([finding.type, finding.anchor.doc, key]);
+}
+var digest, checkSchema, commitSchema, anchorSchema, count, scopeSchema, evidenceSchema, findingSchema, issueSchema, advisorySchema, checkResultSchema;
+var init_findings = __esm({
+  "src/audit/findings.ts"() {
+    "use strict";
+    digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+    checkSchema = z.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
+    commitSchema = z.object({ hash: z.string().regex(/^[a-f0-9]{40,64}$/), date: z.string(), subject: z.string() });
+    anchorSchema = z.object({ doc: z.string(), line: z.number().int().positive().nullable(), excerpt: z.string().nullable() });
+    count = z.number().int().nonnegative();
+    scopeSchema = z.object({
+      basis: z.enum(["repository", "document", "document-link", "explicit"]),
+      directory: z.string(),
+      candidates: z.array(z.string())
+    });
+    evidenceSchema = z.discriminatedUnion("kind", [
+      z.object({
+        kind: z.literal("missing-path"),
+        claimed: z.string(),
+        renamedTo: z.string().nullable(),
+        deletedInCommit: commitSchema.nullable(),
+        everTracked: z.boolean(),
+        parentDirExists: z.boolean(),
+        resolvedPath: z.string().optional(),
+        scope: scopeSchema.optional()
+      }),
+      z.object({
+        kind: z.literal("unmentioned-dir"),
+        dir: z.string(),
+        sourceFileCount: count,
+        firstCommit: commitSchema.nullable(),
+        checkedDocs: z.array(z.string())
+      }),
+      z.object({
+        kind: z.literal("count-mismatch"),
+        claimed: count,
+        actual: count,
+        unit: z.string(),
+        countedFrom: z.string(),
+        members: z.array(z.string())
+      }),
+      z.object({
+        kind: z.literal("missing-script"),
+        scriptName: z.string(),
+        invocation: z.string(),
+        manifestsChecked: z.array(z.string()),
+        availableScripts: z.array(z.string()),
+        scope: scopeSchema.optional()
+      }),
+      z.object({
+        kind: z.literal("doc-behind-manifests"),
+        docLastCommit: commitSchema,
+        manifestCommits: z.array(commitSchema.extend({ files: z.array(z.string()) })),
+        totalCommits: count,
+        matches: z.array(z.object({ dependency: z.string(), manifest: z.string(), before: z.string().nullable(), after: z.string().nullable(), line: z.number().int().positive(), excerpt: z.string() })).optional(),
+        matchingIncomplete: z.boolean().optional()
+      }),
+      z.object({
+        kind: z.literal("decision-anchor"),
+        decisionId: z.string(),
+        title: z.string(),
+        changedFiles: z.array(z.string()),
+        refreshedHash: z.string(),
+        provenance: z.object({}).passthrough().optional()
+      })
+    ]);
+    findingSchema = z.object({ message: z.string(), anchor: anchorSchema, evidence: evidenceSchema });
+    issueSchema = findingSchema.extend({
+      type: z.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
+      confidence: z.enum(["certain", "likely"])
+    });
+    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z.enum(["recheck", "informational"]).optional() });
+    checkResultSchema = z.object({
+      issues: z.array(issueSchema),
+      advisories: z.array(advisorySchema),
+      suppressedAdvisories: z.array(advisorySchema).optional(),
+      skipped: z.array(z.object({ check: z.string(), reason: z.string(), doc: z.string().optional() }))
+    });
+  }
+});
+
+// src/automation/notifications.ts
+import { z as z2 } from "zod";
+function condition(finding) {
+  const source = finding.current ?? finding.original;
+  const e = source.evidence;
+  const id = e.kind === "decision-anchor" ? digest([source.type, source.anchor.doc, e.decisionId]) : finding.id;
+  const result = { level: "confidence" in source ? 2 : 1, facts: [] };
+  switch (e.kind) {
+    case "count-mismatch":
+      result.magnitude = Math.abs(e.actual - e.claimed);
+      break;
+    case "unmentioned-dir":
+      result.magnitude = e.sourceFileCount;
+      break;
+    case "decision-anchor":
+      result.facts = [...e.changedFiles].sort();
+      break;
+    case "doc-behind-manifests":
+      result.facts = (e.matches ?? []).map((m) => JSON.stringify([m.manifest, m.dependency, m.after])).sort();
+      break;
+  }
+  return { id, condition: result };
+}
+function notificationConditions(findings) {
+  const active = findings.filter((f) => f.status !== "resolved");
+  const currentIds = new Set(active.filter((f) => f.current).map((f) => condition(f).id));
+  const result = {};
+  for (const f of active) {
+    const value = condition(f);
+    if (!f.current && currentIds.has(value.id)) continue;
+    const previous = result[value.id];
+    result[value.id] = previous ? {
+      level: Math.max(previous.level, value.condition.level),
+      facts: [.../* @__PURE__ */ new Set([...previous.facts, ...value.condition.facts])].sort(),
+      ...previous.magnitude !== void 0 || value.condition.magnitude !== void 0 ? { magnitude: Math.max(previous.magnitude ?? 0, value.condition.magnitude ?? 0) } : {}
+    } : value.condition;
+  }
+  return result;
+}
+function createNotificationState(findings, head) {
+  return { version: 1, baselineHead: head, baseline: notificationConditions(findings), delivered: {}, cleared: [] };
+}
+function worsened(current, previous) {
+  return !previous || current.level > previous.level || (current.magnitude ?? 0) > (previous.magnitude ?? 0) || current.facts.some((fact) => !previous.facts.includes(fact));
+}
+function completionFindings(state, findings) {
+  const current = notificationConditions(findings);
+  const cleared = new Set(state.cleared);
+  const resolvedIds = new Set(findings.filter((f) => f.status === "resolved").map((f) => condition(f).id));
+  for (const id of Object.keys(state.baseline)) if (resolvedIds.has(id) && !current[id]) cleared.add(id);
+  state.cleared = [...cleared];
+  const selected = [];
+  const selectedIds = /* @__PURE__ */ new Set();
+  const delivered = { ...state.delivered };
+  for (const finding of findings) {
+    const value = condition(finding);
+    const previous = state.delivered[value.id];
+    value.condition = current[value.id] ?? value.condition;
+    if (finding.status === "unverified" || !finding.current && finding.status !== "resolved") {
+      continue;
+    }
+    if (finding.status === "resolved") {
+      if (!current[value.id]) delete delivered[value.id];
+      continue;
+    }
+    const eligible = cleared.has(value.id) || worsened(value.condition, state.baseline[value.id]);
+    if (!eligible) continue;
+    if (!selectedIds.has(value.id) && worsened(value.condition, previous)) {
+      selectedIds.add(value.id);
+      const source = finding.current;
+      selected.push(source.evidence.kind === "decision-anchor" ? { ...finding, current: { ...source, evidence: { ...source.evidence, changedFiles: value.condition.facts } } } : finding);
+      if (selected.length <= MAX_COMPLETION_FINDINGS) delivered[value.id] = value.condition;
+    }
+  }
+  state.delivered = delivered;
+  return selected;
+}
+function completionSummary(findings, reportPath) {
+  if (!findings.length) return null;
+  const safe = (value) => value.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 250);
+  return [
+    `Mason: ${findings.length} new or worsened finding(s) since the retained baseline.`,
+    ...findings.slice(0, MAX_COMPLETION_FINDINGS).map((f) => {
+      const source = f.current ?? f.original;
+      const detail = source.evidence.kind === "decision-anchor" ? `Changes to ${source.evidence.changedFiles.join(", ")} may affect decision "${source.evidence.title}". Inspect the diff if relevant; acceptance is not required.` : source.message;
+      return `[${f.status === "unresolved" ? "issue" : "advisory"}] ${safe(source.anchor.doc)}: ${safe(detail)}`;
+    }),
+    ...findings.length > MAX_COMPLETION_FINDINGS ? [`${findings.length - MAX_COMPLETION_FINDINGS} more in the report; pending later feedback.`] : [],
+    `Evidence: ${reportPath}. Explicit audit: mason_automation(action: "check").`,
+    "Inspect findings within the authorized work. Concurrent changes may also contribute; this summary does not establish who introduced them."
+  ].join("\n");
+}
+var conditionSchema, MAX_COMPLETION_FINDINGS, notificationStateSchema;
+var init_notifications = __esm({
+  "src/automation/notifications.ts"() {
+    "use strict";
+    init_findings();
+    conditionSchema = z2.object({
+      level: z2.number(),
+      facts: z2.array(z2.string()),
+      magnitude: z2.number().optional()
+    });
+    MAX_COMPLETION_FINDINGS = 4;
+    notificationStateSchema = z2.object({
+      version: z2.literal(1),
+      baselineHead: z2.string(),
+      baseline: z2.record(conditionSchema),
+      delivered: z2.record(conditionSchema),
+      cleared: z2.array(z2.string())
+    });
+  }
+});
+
+// src/automation/store.ts
+import { z as z3 } from "zod";
 function parseState(raw) {
   try {
     return stateSchema.parse(raw);
@@ -452,30 +673,29 @@ var init_store = __esm({
   "src/automation/store.ts"() {
     "use strict";
     init_store_lock();
-    hostSchema = z.enum(["claude", "codex"]);
+    init_notifications();
+    hostSchema = z3.enum(["claude", "codex"]);
     events = ["session_start", "turn_start", "before_tool", "after_tool", "task_end"];
-    stateSchema = z.object({
-      version: z.literal(1),
-      root: z.string(),
-      gitDir: z.string(),
-      branch: z.string(),
-      baselines: z.array(z.object({ path: z.string(), at: z.string(), event: z.string(), fingerprint: z.string() })).max(128),
-      sessions: z.record(z.object({
+    stateSchema = z3.object({
+      version: z3.literal(1),
+      root: z3.string(),
+      gitDir: z3.string(),
+      branch: z3.string(),
+      baselines: z3.array(z3.object({ path: z3.string(), at: z3.string(), event: z3.string(), fingerprint: z3.string() })).max(128),
+      sessions: z3.record(z3.object({
         host: hostSchema,
-        seen: z.string().nullable(),
-        continued: z.boolean(),
-        initialIssues: z.array(z.string()),
-        initialDocs: z.record(z.string().nullable()),
-        lastUsed: z.string(),
-        mutationObserved: z.boolean(),
-        pending: z.record(z.string()),
-        coverageGaps: z.array(z.string()),
-        events: z.record(z.object({ at: z.string(), count: z.number().int().positive() }))
+        lastUsed: z3.string(),
+        notifiedDiagnostics: z3.array(z3.string()).default([]),
+        pending: z3.record(z3.string()),
+        coverageGaps: z3.array(z3.string()),
+        events: z3.record(z3.object({ at: z3.string(), count: z3.number().int().positive() }))
       })),
-      updatedAt: z.string(),
-      fingerprint: z.string().nullable(),
-      latest: z.string().nullable(),
-      analysis: z.object({ id: z.string(), fingerprint: z.string(), completedAt: z.number(), path: z.string() }).optional()
+      updatedAt: z3.string(),
+      fingerprint: z3.string().nullable(),
+      latest: z3.string().nullable(),
+      notifications: notificationStateSchema.optional(),
+      agentNotifications: notificationStateSchema.optional(),
+      analysis: z3.object({ id: z3.string(), fingerprint: z3.string(), completedAt: z3.number(), path: z3.string() }).optional()
     });
   }
 });
@@ -1394,7 +1614,7 @@ var init_test_map = __esm({
 
 // src/snapshot/snapshot.ts
 import path10 from "path";
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
 async function inspectSnapshot(rootDir) {
   try {
     const raw = await readStoreJson(rootDir, ".mason/snapshot.json");
@@ -1428,30 +1648,30 @@ var init_snapshot = __esm({
     init_lock();
     init_paths();
     init_test_map();
-    repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+    repoPath = z4.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
     verificationFields = {
-      refreshedHash: z2.string().optional(),
-      verifiedAt: z2.string().optional(),
-      verifiedHash: z2.string().optional(),
-      verificationToken: z2.string().optional(),
-      verificationFailed: z2.boolean().optional(),
-      verificationNote: z2.string().optional()
+      refreshedHash: z4.string().optional(),
+      verifiedAt: z4.string().optional(),
+      verifiedHash: z4.string().optional(),
+      verificationToken: z4.string().optional(),
+      verificationFailed: z4.boolean().optional(),
+      verificationNote: z4.string().optional()
     };
-    featureSchema = z2.object({
-      description: z2.string(),
-      files: z2.array(repoPath),
-      tests: z2.array(repoPath).optional(),
-      type: z2.enum(["capability", "infrastructure"]).optional(),
+    featureSchema = z4.object({
+      description: z4.string(),
+      files: z4.array(repoPath),
+      tests: z4.array(repoPath).optional(),
+      type: z4.enum(["capability", "infrastructure"]).optional(),
       ...verificationFields
     }).passthrough();
-    flowSchema = z2.object({ description: z2.string(), chain: z2.array(repoPath), ...verificationFields }).passthrough();
-    snapshotSchema = z2.object({
-      version: z2.literal(2),
-      createdAt: z2.string(),
-      updatedAt: z2.string(),
-      gitHash: z2.string(),
-      features: z2.record(featureSchema),
-      flows: z2.record(flowSchema)
+    flowSchema = z4.object({ description: z4.string(), chain: z4.array(repoPath), ...verificationFields }).passthrough();
+    snapshotSchema = z4.object({
+      version: z4.literal(2),
+      createdAt: z4.string(),
+      updatedAt: z4.string(),
+      gitHash: z4.string(),
+      features: z4.record(featureSchema),
+      flows: z4.record(flowSchema)
     }).passthrough();
   }
 });
@@ -2263,7 +2483,7 @@ var init_trust = __esm({
 });
 
 // src/decisions/provenance.ts
-import { z as z3 } from "zod";
+import { z as z5 } from "zod";
 function decisionContent(record) {
   return {
     title: record.title,
@@ -2327,67 +2547,67 @@ var init_provenance = __esm({
     "use strict";
     init_paths();
     init_trust();
-    text = (max) => z3.string().trim().min(1).max(max);
-    decisionSourceSchema = z3.object({
-      kind: z3.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
+    text = (max) => z5.string().trim().min(1).max(max);
+    decisionSourceSchema = z5.object({
+      kind: z5.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
       reference: text(1e3),
       note: text(500).optional()
     }).strict();
-    attributionSchema = z3.object({
+    attributionSchema = z5.object({
       owner: text(200).nullable().optional(),
-      sources: z3.array(decisionSourceSchema).max(20).optional(),
+      sources: z5.array(decisionSourceSchema).max(20).optional(),
       actor: text(200).optional()
     });
-    contentSchema = z3.object({
-      title: z3.string().min(1),
-      body: z3.string().min(1),
-      category: z3.enum(["decision", "gotcha", "deprecation", "convention"]),
-      files: z3.array(z3.string().refine((f) => normalizeRepoPath(f) !== null)),
+    contentSchema = z5.object({
+      title: z5.string().min(1),
+      body: z5.string().min(1),
+      category: z5.enum(["decision", "gotcha", "deprecation", "convention"]),
+      files: z5.array(z5.string().refine((f) => normalizeRepoPath(f) !== null)),
       owner: text(200).optional(),
-      sources: z3.array(decisionSourceSchema).max(20)
+      sources: z5.array(decisionSourceSchema).max(20)
     });
-    approvalSchema = z3.enum(["unreviewed", "proposed", "accepted"]);
-    statusSchema = z3.enum(["active", "superseded", "retired"]);
-    reviewEvidenceSchema = z3.object({
-      baseHash: z3.string(),
-      headHash: z3.string(),
-      historyAvailable: z3.boolean(),
-      changedFiles: z3.array(z3.string()),
-      localChanges: z3.array(z3.string())
+    approvalSchema = z5.enum(["unreviewed", "proposed", "accepted"]);
+    statusSchema = z5.enum(["active", "superseded", "retired"]);
+    reviewEvidenceSchema = z5.object({
+      baseHash: z5.string(),
+      headHash: z5.string(),
+      historyAvailable: z5.boolean(),
+      changedFiles: z5.array(z5.string()),
+      localChanges: z5.array(z5.string())
     });
-    eventSchema = z3.object({
-      kind: z3.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
-      at: z3.string().datetime(),
+    eventSchema = z5.object({
+      kind: z5.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
+      at: z5.string().datetime(),
       actor: text(200).optional(),
       note: text(1500).optional(),
-      revision: z3.number().int().positive(),
+      revision: z5.number().int().positive(),
       content: contentSchema,
       approval: approvalSchema,
       status: statusSchema,
-      refreshedHash: z3.string(),
+      refreshedHash: z5.string(),
       evidence: reviewEvidenceSchema.optional()
     });
-    legacySchema = z3.object({
-      version: z3.literal(1),
-      id: z3.string().regex(/^[a-zA-Z0-9_-]+$/),
-      title: z3.string().min(1),
-      body: z3.string().min(1),
+    legacySchema = z5.object({
+      version: z5.literal(1),
+      id: z5.string().regex(/^[a-zA-Z0-9_-]+$/),
+      title: z5.string().min(1),
+      body: z5.string().min(1),
       category: contentSchema.shape.category,
       files: contentSchema.shape.files,
-      createdAt: z3.string(),
-      updatedAt: z3.string(),
-      refreshedHash: z3.string(),
-      status: z3.enum(["active", "superseded"]),
-      supersededBy: z3.string().optional()
+      createdAt: z5.string(),
+      updatedAt: z5.string(),
+      refreshedHash: z5.string(),
+      status: z5.enum(["active", "superseded"]),
+      supersededBy: z5.string().optional()
     }).passthrough();
     currentSchema = legacySchema.extend({
-      version: z3.literal(2),
+      version: z5.literal(2),
       status: statusSchema,
       approval: approvalSchema,
-      revision: z3.number().int().positive(),
+      revision: z5.number().int().positive(),
       owner: text(200).optional(),
-      sources: z3.array(decisionSourceSchema).max(20),
-      history: z3.array(eventSchema).min(1)
+      sources: z5.array(decisionSourceSchema).max(20),
+      history: z5.array(eventSchema).min(1)
     }).superRefine((record, ctx) => {
       const invalid = (message2) => ctx.addIssue({ code: "custom", message: message2 });
       const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
@@ -2417,15 +2637,15 @@ var init_provenance = __esm({
       }
       if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash) invalid("Decision does not match the final history event");
     });
-    decisionSchema = z3.union([legacySchema, currentSchema]);
+    decisionSchema = z5.union([legacySchema, currentSchema]);
   }
 });
 
 // src/decisions/decisions.ts
 import fs9 from "fs/promises";
 import path18 from "path";
-import { createHash } from "crypto";
-import { z as z4 } from "zod";
+import { createHash as createHash2 } from "crypto";
+import { z as z6 } from "zod";
 async function loadDecisionStore(rootDir) {
   const records = [];
   const diagnostics = [];
@@ -2461,7 +2681,7 @@ var init_decisions = __esm({
     TITLE_MAX_CHARS = 80;
     BODY_RECOMMENDED_CHARS = 1500;
     BODY_MAX_CHARS = 2500;
-    boundedText = (field, max, hint) => z4.string({
+    boundedText = (field, max, hint) => z6.string({
       errorMap: (issue, ctx) => ({ message: issue.code === "too_big" ? `${field} has ${ctx.data.length} characters; maximum is ${max} (${ctx.data.length - max} over). ${hint}` : ctx.defaultError })
     }).trim().min(1, `${field} must be non-empty`).max(max);
     decisionTitleSchema = boundedText("title", TITLE_MAX_CHARS, "Tighten it to a specific headline.");
@@ -2592,117 +2812,9 @@ var init_checks = __esm({
   }
 });
 
-// src/audit/findings.ts
-import { createHash as createHash2 } from "crypto";
-import { z as z5 } from "zod";
-function findingId(finding) {
-  const e = finding.evidence;
-  let key;
-  switch (e.kind) {
-    case "missing-path":
-      key = e.resolvedPath && e.resolvedPath !== e.claimed ? [e.claimed, e.resolvedPath] : e.claimed;
-      break;
-    case "unmentioned-dir":
-      key = e.dir;
-      break;
-    case "count-mismatch":
-      key = [e.unit.replace(/s$/, ""), e.countedFrom];
-      break;
-    case "missing-script":
-      key = e.scope && e.scope.directory !== "." ? [e.scriptName, e.scope.directory] : e.scriptName;
-      break;
-    case "doc-behind-manifests":
-      key = null;
-      break;
-    case "decision-anchor":
-      key = [e.decisionId, e.provenance?.revision, e.provenance?.approval];
-      break;
-  }
-  return digest([finding.type, finding.anchor.doc, key]);
-}
-var digest, checkSchema, commitSchema, anchorSchema, count, scopeSchema, evidenceSchema, findingSchema, issueSchema, advisorySchema, checkResultSchema;
-var init_findings = __esm({
-  "src/audit/findings.ts"() {
-    "use strict";
-    digest = (value) => createHash2("sha256").update(JSON.stringify(value)).digest("hex");
-    checkSchema = z5.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
-    commitSchema = z5.object({ hash: z5.string().regex(/^[a-f0-9]{40,64}$/), date: z5.string(), subject: z5.string() });
-    anchorSchema = z5.object({ doc: z5.string(), line: z5.number().int().positive().nullable(), excerpt: z5.string().nullable() });
-    count = z5.number().int().nonnegative();
-    scopeSchema = z5.object({
-      basis: z5.enum(["repository", "document", "document-link", "explicit"]),
-      directory: z5.string(),
-      candidates: z5.array(z5.string())
-    });
-    evidenceSchema = z5.discriminatedUnion("kind", [
-      z5.object({
-        kind: z5.literal("missing-path"),
-        claimed: z5.string(),
-        renamedTo: z5.string().nullable(),
-        deletedInCommit: commitSchema.nullable(),
-        everTracked: z5.boolean(),
-        parentDirExists: z5.boolean(),
-        resolvedPath: z5.string().optional(),
-        scope: scopeSchema.optional()
-      }),
-      z5.object({
-        kind: z5.literal("unmentioned-dir"),
-        dir: z5.string(),
-        sourceFileCount: count,
-        firstCommit: commitSchema.nullable(),
-        checkedDocs: z5.array(z5.string())
-      }),
-      z5.object({
-        kind: z5.literal("count-mismatch"),
-        claimed: count,
-        actual: count,
-        unit: z5.string(),
-        countedFrom: z5.string(),
-        members: z5.array(z5.string())
-      }),
-      z5.object({
-        kind: z5.literal("missing-script"),
-        scriptName: z5.string(),
-        invocation: z5.string(),
-        manifestsChecked: z5.array(z5.string()),
-        availableScripts: z5.array(z5.string()),
-        scope: scopeSchema.optional()
-      }),
-      z5.object({
-        kind: z5.literal("doc-behind-manifests"),
-        docLastCommit: commitSchema,
-        manifestCommits: z5.array(commitSchema.extend({ files: z5.array(z5.string()) })),
-        totalCommits: count,
-        matches: z5.array(z5.object({ dependency: z5.string(), manifest: z5.string(), before: z5.string().nullable(), after: z5.string().nullable(), line: z5.number().int().positive(), excerpt: z5.string() })).optional(),
-        matchingIncomplete: z5.boolean().optional()
-      }),
-      z5.object({
-        kind: z5.literal("decision-anchor"),
-        decisionId: z5.string(),
-        title: z5.string(),
-        changedFiles: z5.array(z5.string()),
-        refreshedHash: z5.string(),
-        provenance: z5.object({}).passthrough().optional()
-      })
-    ]);
-    findingSchema = z5.object({ message: z5.string(), anchor: anchorSchema, evidence: evidenceSchema });
-    issueSchema = findingSchema.extend({
-      type: z5.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
-      confidence: z5.enum(["certain", "likely"])
-    });
-    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z5.enum(["recheck", "informational"]).optional() });
-    checkResultSchema = z5.object({
-      issues: z5.array(issueSchema),
-      advisories: z5.array(advisorySchema),
-      suppressedAdvisories: z5.array(advisorySchema).optional(),
-      skipped: z5.array(z5.object({ check: z5.string(), reason: z5.string(), doc: z5.string().optional() }))
-    });
-  }
-});
-
 // src/audit/advisory-review.ts
 import fs10 from "fs/promises";
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 async function readRecord(root, id) {
   const raw = await readStoreJson(root, recordPath(id));
   if (raw === null) return null;
@@ -2848,41 +2960,41 @@ var init_advisory_review = __esm({
     init_decisions();
     init_drift2();
     git2 = async (root, ...args2) => (await (["log", "ls-tree", "ls-files", "merge-base"].includes(args2[0]) ? inspectionGit : execGit)(args2, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
-    hashSchema = z6.string().regex(/^[a-f0-9]{64}$/);
-    commitSchema2 = z6.string().regex(/^[a-f0-9]{40,64}$/);
-    evidenceSchema2 = z6.object({
+    hashSchema = z7.string().regex(/^[a-f0-9]{64}$/);
+    commitSchema2 = z7.string().regex(/^[a-f0-9]{40,64}$/);
+    evidenceSchema2 = z7.object({
       head: commitSchema2,
       fingerprint: hashSchema,
-      scope: z6.array(z6.string()).min(1).max(1e3),
-      tree: z6.string().max(2 * 1024 * 1024),
+      scope: z7.array(z7.string()).min(1).max(1e3),
+      tree: z7.string().max(2 * 1024 * 1024),
       lastScopeCommit: commitSchema2,
-      paths: z6.array(z6.object({ path: z6.string(), exists: z6.boolean() })).max(1e3)
+      paths: z7.array(z7.object({ path: z7.string(), exists: z7.boolean() })).max(1e3)
     });
-    dismissalReasonSchema = z6.enum(["no-dependency-claims", "unrelated-manifest-change"]);
-    eventSchema2 = z6.object({
-      at: z6.string().datetime(),
-      reviewer: z6.string().trim().min(1).max(200).optional(),
-      note: z6.string().trim().min(1).max(2500),
-      outcome: z6.enum(["addressed", "inapplicable", "deferred", "dismissed"]),
+    dismissalReasonSchema = z7.enum(["no-dependency-claims", "unrelated-manifest-change"]);
+    eventSchema2 = z7.object({
+      at: z7.string().datetime(),
+      reviewer: z7.string().trim().min(1).max(200).optional(),
+      note: z7.string().trim().min(1).max(2500),
+      outcome: z7.enum(["addressed", "inapplicable", "deferred", "dismissed"]),
       reasonCode: dismissalReasonSchema.optional(),
       finding: advisorySchema.refine((finding) => finding.evidence.kind !== "decision-anchor", "Decision findings use decision reviews"),
       evidence: evidenceSchema2
     });
-    recordSchema = z6.object({ version: z6.literal(1), id: hashSchema, events: z6.array(eventSchema2).min(1).max(200), digest: hashSchema });
-    reviewSummarySchema = z6.object({
+    recordSchema = z7.object({ version: z7.literal(1), id: hashSchema, events: z7.array(eventSchema2).min(1).max(200), digest: hashSchema });
+    reviewSummarySchema = z7.object({
       id: hashSchema,
-      status: z6.enum(["current", "reopened", "deferred", "unverified"]),
-      reason: z6.string(),
-      recordPath: z6.string().optional(),
-      reviewer: z6.string().optional(),
-      note: z6.string().optional(),
-      outcome: z6.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired", "dismissed"]).optional(),
-      reviewedHead: z6.string().optional()
+      status: z7.enum(["current", "reopened", "deferred", "unverified"]),
+      reason: z7.string(),
+      recordPath: z7.string().optional(),
+      reviewer: z7.string().optional(),
+      note: z7.string().optional(),
+      outcome: z7.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired", "dismissed"]).optional(),
+      reviewedHead: z7.string().optional()
     });
-    advisoryReviewRequest = z6.object({
-      baselinePath: z6.string().min(1),
+    advisoryReviewRequest = z7.object({
+      baselinePath: z7.string().min(1),
       findingId: hashSchema,
-      action: z6.enum(["prepare", "addressed", "inapplicable", "deferred", "dismiss"]).default("prepare"),
+      action: z7.enum(["prepare", "addressed", "inapplicable", "deferred", "dismiss"]).default("prepare"),
       reasonCode: dismissalReasonSchema.optional(),
       reviewer: eventSchema2.shape.reviewer.optional(),
       note: eventSchema2.shape.note.optional(),
@@ -2987,7 +3099,7 @@ var init_audit = __esm({
 import fs12 from "fs/promises";
 import path21 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 function recheckable(finding) {
   return !("confidence" in finding) && finding.resolution === "recheck" && ["deleted-reference", "dead-command", "new-module"].includes(finding.type) && ["missing-path", "missing-script", "unmentioned-dir"].includes(finding.evidence.kind);
 }
@@ -3055,7 +3167,7 @@ async function withRepairSession(root, options, run, validate, cachedAudit) {
 }
 async function prepareOriginal(rootDir, checks, options, session) {
   const root = await fs12.realpath(rootDir);
-  const selected = z7.array(checkSchema).nonempty().parse(checks);
+  const selected = z8.array(checkSchema).nonempty().parse(checks);
   const report = await (session ? session.audit(selected) : stableAudit(root, selected, options));
   if (!report) throw new Error("No context files found to prepare a repair.");
   if (!report.gitAvailable) throw new Error("Readable Git history is required to prepare a repair.");
@@ -3196,42 +3308,42 @@ var init_repair = __esm({
     init_findings();
     init_advisory_review();
     init_findings();
-    count2 = z7.number().int().nonnegative();
-    reportSchema = z7.object({
-      version: z7.literal(1),
-      root: z7.string(),
-      gitAvailable: z7.literal(true),
+    count2 = z8.number().int().nonnegative();
+    reportSchema = z8.object({
+      version: z8.literal(1),
+      root: z8.string(),
+      gitAvailable: z8.literal(true),
       headHash: commitSchema.shape.hash,
-      checksRun: z7.array(checkSchema).nonempty(),
-      docs: z7.array(z7.object({
-        path: z7.string().refine((value) => normalizeRepoPath(value) === value),
-        scope: z7.string().optional(),
-        kind: z7.enum(["instructions", "readme", "guide"]).optional(),
+      checksRun: z8.array(checkSchema).nonempty(),
+      docs: z8.array(z8.object({
+        path: z8.string().refine((value) => normalizeRepoPath(value) === value),
+        scope: z8.string().optional(),
+        kind: z8.enum(["instructions", "readme", "guide"]).optional(),
         lastCommit: commitSchema.nullable(),
-        dirty: z7.boolean(),
+        dirty: z8.boolean(),
         lineCount: count2
       })).nonempty(),
-      decisionsChecked: z7.boolean(),
-      clean: z7.boolean(),
-      excludedChecks: z7.array(z7.object({ check: checkSchema, doc: z7.string() })).optional(),
-      issues: z7.array(issueSchema),
-      advisories: z7.array(advisorySchema),
-      suppressedAdvisories: z7.array(advisorySchema).optional(),
-      skippedChecks: z7.array(z7.object({ check: z7.string(), reason: z7.string(), doc: z7.string().optional() }))
+      decisionsChecked: z8.boolean(),
+      clean: z8.boolean(),
+      excludedChecks: z8.array(z8.object({ check: checkSchema, doc: z8.string() })).optional(),
+      issues: z8.array(issueSchema),
+      advisories: z8.array(advisorySchema),
+      suppressedAdvisories: z8.array(advisorySchema).optional(),
+      skippedChecks: z8.array(z8.object({ check: z8.string(), reason: z8.string(), doc: z8.string().optional() }))
     });
-    baselineSchema = z7.object({
-      kind: z7.literal("mason-audit-repair"),
-      version: z7.literal(1),
-      createdAt: z7.string().datetime(),
+    baselineSchema = z8.object({
+      kind: z8.literal("mason-audit-repair"),
+      version: z8.literal(1),
+      createdAt: z8.string().datetime(),
       report: reportSchema,
-      digest: z7.string().regex(/^[a-f0-9]{64}$/)
+      digest: z8.string().regex(/^[a-f0-9]{64}$/)
     });
-    repairFindingSchema = z7.object({
-      id: z7.string(),
-      original: z7.union([issueSchema, advisorySchema]),
-      status: z7.enum(["resolved", "unresolved", "review-required", "unverified"]),
-      reason: z7.string(),
-      current: z7.union([issueSchema, advisorySchema]).optional(),
+    repairFindingSchema = z8.object({
+      id: z8.string(),
+      original: z8.union([issueSchema, advisorySchema]),
+      status: z8.enum(["resolved", "unresolved", "review-required", "unverified"]),
+      reason: z8.string(),
+      current: z8.union([issueSchema, advisorySchema]).optional(),
       review: reviewSummarySchema.optional()
     });
   }
@@ -3242,7 +3354,7 @@ import fs13 from "fs/promises";
 import path22 from "path";
 import { createHash as createHash3 } from "crypto";
 import fg7 from "fast-glob";
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 async function git3(root, ...args2) {
   return profilePhase("automation.git", async () => (await execGit(args2, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout);
 }
@@ -3385,10 +3497,10 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    engineVersion = true ? "0.19.1" : "development";
+    engineVersion = true ? "0.19.2" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
-    cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
+    cacheSchema = z9.object({ version: z9.literal(1), entries: z9.record(z9.object({ key: z9.string(), result: checkResultSchema })), digest: z9.string() });
   }
 });
 
@@ -3396,7 +3508,7 @@ var init_evidence = __esm({
 import os2 from "os";
 import fs14 from "fs/promises";
 import { randomUUID as randomUUID3 } from "crypto";
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function parseExecution(raw) {
   try {
     return executionSchema.parse(raw);
@@ -3414,7 +3526,7 @@ function automationFailure(error) {
     codes.add(String(cause.code));
     cause = cause.cause;
   }
-  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z9.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
+  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z10.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
   return { code, message: message2, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
 }
 function failureMessage(error) {
@@ -3543,41 +3655,103 @@ var init_execution = __esm({
     init_store();
     init_evidence();
     init_storage();
-    failureSchema = z9.object({
-      code: z9.enum(["inputs-changed", "storage-full", "busy", "invalid-input", "history-unavailable", "invalid-evidence", "io-error", "internal"]),
-      message: z9.string(),
-      retryable: z9.boolean(),
-      receiptRecorded: z9.boolean()
+    failureSchema = z10.object({
+      code: z10.enum(["inputs-changed", "storage-full", "busy", "invalid-input", "history-unavailable", "invalid-evidence", "io-error", "internal"]),
+      message: z10.string(),
+      retryable: z10.boolean(),
+      receiptRecorded: z10.boolean()
     });
-    attemptSchema = z9.object({
-      id: z9.string().regex(/^[a-zA-Z0-9_-]+$/),
-      lease: z9.literal(true).optional(),
-      event: z9.string(),
-      startedAt: z9.string(),
-      finishedAt: z9.string().optional(),
-      durationMs: z9.number().nonnegative().optional(),
-      pid: z9.number().int().positive(),
-      host: z9.string(),
-      status: z9.enum(["running", "completed", "failed", "unknown"]),
-      verificationStatus: z9.string().optional(),
-      reportPath: z9.string().optional(),
+    attemptSchema = z10.object({
+      id: z10.string().regex(/^[a-zA-Z0-9_-]+$/),
+      lease: z10.literal(true).optional(),
+      event: z10.string(),
+      startedAt: z10.string(),
+      finishedAt: z10.string().optional(),
+      durationMs: z10.number().nonnegative().optional(),
+      pid: z10.number().int().positive(),
+      host: z10.string(),
+      status: z10.enum(["running", "completed", "failed", "unknown"]),
+      verificationStatus: z10.string().optional(),
+      reportPath: z10.string().optional(),
       failure: failureSchema.optional()
     });
-    executionSchema = z9.object({ version: z9.literal(1), attempts: z9.array(attemptSchema).max(160), discardedAttempts: z9.number().int().nonnegative().default(0) });
-    notificationsSchema = z9.object({ version: z9.literal(1), sessions: z9.record(z9.object({
-      signature: z9.string(),
+    executionSchema = z10.object({ version: z10.literal(1), attempts: z10.array(attemptSchema).max(160), discardedAttempts: z10.number().int().nonnegative().default(0) });
+    notificationsSchema = z10.object({ version: z10.literal(1), sessions: z10.record(z10.object({
+      signature: z10.string(),
       code: failureSchema.shape.code,
-      message: z9.string(),
-      count: z9.number().int().positive(),
-      lastAt: z9.string()
+      message: z10.string(),
+      count: z10.number().int().positive(),
+      lastAt: z10.string()
     })) });
     leasePath = (directory, id) => `${directory}/executions/${id}.json`;
   }
 });
 
+// src/decisions/pending.ts
+var pending_exports = {};
+__export(pending_exports, {
+  pendingKnowledge: () => pendingKnowledge
+});
+async function pendingKnowledge(root, now = Date.now()) {
+  try {
+    const [store, status] = await Promise.all([
+      loadDecisionStore(root),
+      execGit(
+        ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".mason/decisions"],
+        { cwd: root, timeout: 1e4, maxBuffer: 1024 * 1024 }
+      )
+    ]);
+    const changed = /* @__PURE__ */ new Set();
+    const entries = status.stdout.split("\0");
+    for (let i = 0; i < entries.length; i++) {
+      const entry = entries[i];
+      if (!entry) continue;
+      const file = entry.slice(3);
+      if (/^\.mason\/decisions\/[^/]+\.json$/.test(file)) changed.add(file);
+      if (/[RC]/.test(entry.slice(0, 2))) i++;
+    }
+    const records = new Map(store.records.map((record) => [`.mason/decisions/${record.id}.json`, record]));
+    const age = (at) => {
+      const time = at ? Date.parse(at) : NaN;
+      return Number.isFinite(time) ? `${Math.max(0, Math.floor((now - time) / 864e5))} days` : "unknown age";
+    };
+    const safe = (value) => value.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ");
+    const list = (items) => items.slice(0, 5).map(safe).join("; ") + (items.length > 5 ? `; ${items.length - 5} more` : "");
+    const proposals = store.records.filter((record) => record.status === "active" && decisionApproval(record) === "proposed").map((record) => {
+      const history = record.version === 2 ? record.history : [];
+      let lastReview = -1;
+      history.forEach((event, index2) => {
+        if (event.kind === "accepted" || event.kind === "reaffirmed") lastReview = index2;
+      });
+      const since = history.slice(lastReview + 1).find((event) => event.kind === "created" || event.kind === "revised")?.at ?? record.createdAt;
+      return { record, since };
+    }).sort((a, b) => {
+      const timestamp = (value) => Number.isFinite(Date.parse(value)) ? Date.parse(value) : Infinity;
+      return timestamp(a.since) - timestamp(b.since) || a.record.id.localeCompare(b.record.id);
+    });
+    const lines = [];
+    if (changed.size) lines.push(`${changed.size} uncommitted decision record(s): ${list([...changed].sort().map((file) => `${file} (saved-record age: ${age(records.get(file)?.updatedAt)})`))}.`);
+    if (proposals.length) lines.push(`${proposals.length} proposal(s) awaiting review (oldest first): ${list(proposals.map(({ record, since }) => `.mason/decisions/${record.id}.json (${age(since)})`))}.`);
+    if (store.diagnostics.length) lines.push(`${store.diagnostics.length} decision record(s) could not be read; pending knowledge summary is incomplete.`);
+    return lines.length ? `Mason pending knowledge:
+${lines.join("\n")}
+Informational only; review and commit through the normal project workflow. No approval is implied.` : null;
+  } catch {
+    return "Mason pending knowledge: unavailable; decision records or Git status could not be read.";
+  }
+}
+var init_pending = __esm({
+  "src/decisions/pending.ts"() {
+    "use strict";
+    init_git_read();
+    init_decisions();
+    init_provenance();
+  }
+});
+
 // src/automation/runtime.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 async function observeReadOnlyTool(dir, event) {
   const ws = await profilePhase("automation.workspace", () => workspace(dir));
   await withLock(ws.root, ws.directory, async () => {
@@ -3799,6 +3973,19 @@ async function automate(dir, event) {
       const state = await loadState(ws);
       if (state.analysis?.id !== result.analysis.id) throw new Error("Automation evidence changed during publication; retry against the current inputs.");
       const report = structuredClone(result.analysis.report);
+      if (!state.notifications) {
+        let baseline = { findings: report.findings, head: report.head };
+        if (state.latest) {
+          try {
+            const previous = z11.object({ findings: z11.array(repairFindingSchema), head: z11.string() }).safeParse(await readStoreJson(ws.root, state.latest));
+            if (!previous.success) throw new Error("Unsupported saved report");
+            baseline = previous.data;
+          } catch {
+            report.diagnostics.push("The saved notification baseline could not be read; initialized from the current audit. Original repair evidence is retained. Run an explicit check for all outstanding findings.");
+          }
+        }
+        state.notifications = createNotificationState(baseline.findings, baseline.head);
+      }
       if (result.shared) report.checks = { ...report.checks, ran: [], reused: [.../* @__PURE__ */ new Set([...report.checks.ran, ...report.checks.reused])], shared: true };
       report.reportPath = ws.directory + "/checks/" + randomUUID4() + ".json";
       const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -3811,12 +3998,8 @@ async function automate(dir, event) {
         if (Object.keys(state.sessions).length >= 128) throw new Error("Too many sessions with unfinished tool calls; original evidence was retained.");
         state.sessions[key] = {
           host: event.host,
-          seen: null,
-          continued: false,
-          initialIssues: report.findings.filter((f) => f.status === "unresolved").map((f) => f.id),
-          initialDocs: inputs.docs,
+          notifiedDiagnostics: [],
           lastUsed: now,
-          mutationObserved: false,
           pending: {},
           coverageGaps: [],
           events: {}
@@ -3831,7 +4014,6 @@ async function automate(dir, event) {
           session.pending[event.toolId] = inputs.fingerprint;
         }
         if (event.event === "after_tool" && event.mutating) {
-          session.mutationObserved = true;
           if (!event.toolId || !session.pending[event.toolId]) {
             const gap = "A tool completed without an observed matching pre-tool capture in this checkout; pre-edit coverage is unknown. The tool may have changed checkouts; captures are kept separately for each worktree.";
             if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
@@ -3842,31 +4024,39 @@ async function automate(dir, event) {
         if (session.coverageGaps.length && report.status !== "unavailable") report.status = "incomplete";
         report.capture = report.status !== "unavailable" && !session.coverageGaps.length && (session.events.session_start || session.events.before_tool) ? "observed" : "unknown";
       }
-      const signature = hash([report.status, report.findings, report.diagnostics, report.checks.skipped]);
-      const relevant = report.findings.some((f) => f.status === "unresolved" && session && (!session.initialIssues.includes(f.id) || session.initialDocs[f.original.anchor.doc] !== inputs.docs[f.original.anchor.doc]));
-      const continueOnce = event.event === "task_end" && !!session?.mutationObserved && relevant && !session.continued && !event.stopHookActive;
-      const notify = !session || newSession || signature !== session.seen || continueOnce;
-      if (session) {
-        session.seen = signature;
-        if (continueOnce) session.continued = true;
-      }
-      const persistReport = !state.latest || state.fingerprint !== inputs.fingerprint || notify || event.event === "task_end";
+      const selected = session && event.event === "task_end" ? completionFindings(state.notifications, report.findings) : [];
+      state.agentNotifications ??= { ...structuredClone(state.notifications), delivered: {} };
+      const feedback = session && ["turn_start", "after_tool"].includes(event.event) ? completionFindings(state.agentNotifications, report.findings) : [];
+      const diagnostics = session ? report.diagnostics.filter((d) => !session.notifiedDiagnostics.includes(d)).slice(0, 2) : [];
+      if (session) session.notifiedDiagnostics = [.../* @__PURE__ */ new Set([
+        ...session.notifiedDiagnostics.filter((d) => report.diagnostics.includes(d)),
+        ...diagnostics
+      ])];
+      const message2 = !session ? summarize(report) : [
+        completionSummary(selected, report.reportPath),
+        completionSummary(feedback, report.reportPath),
+        ...diagnostics.length ? [`Mason: verification limited. ${diagnostics.slice(0, 2).map(cleanText).join(" ")} Evidence: ${report.reportPath}.`] : []
+      ].filter(Boolean).join("\n") || null;
+      const notify = message2 !== null;
+      const persistReport = !state.latest || state.fingerprint !== inputs.fingerprint || notify || newSession || event.event === "task_end";
       if (!persistReport) report.reportPath = state.latest;
       state.updatedAt = now;
       state.fingerprint = inputs.fingerprint;
       state.latest = report.reportPath;
       if (persistReport) await writeStoreJson(ws.root, report.reportPath, report);
       await writeStoreJson(ws.root, ws.directory + "/state.json", state);
-      return { report, message: notify ? summarize(report) : null, continueOnce };
+      return { report, message: message2 };
     }));
   }));
 }
 async function automationStatus(dir) {
+  const { pendingKnowledge: pendingKnowledge2 } = await Promise.resolve().then(() => (init_pending(), pending_exports));
   const ws = await profilePhase("automation.workspace", () => workspace(dir));
+  const knowledge = await pendingKnowledge2(ws.root);
   const execution = await executionStatus(ws.root, ws.directory);
   const notifications = await failureNotifications(ws.root, ws.directory);
   const raw = await readStoreJson(ws.root, ws.directory + "/state.json");
-  if (raw === null) return { version: 1, status: execution.status === "not-observed" ? "not-observed" : "unavailable", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {}, execution, notifications };
+  if (raw === null) return { version: 1, status: execution.status === "not-observed" ? "not-observed" : "unavailable", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {}, execution, notifications, knowledge };
   const state = parseState(raw);
   if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) throw new Error("Automation state belongs to another workspace.");
   const inputs = await readInputs(ws.root);
@@ -3889,6 +4079,8 @@ async function automationStatus(dir) {
     hosts: hosts2,
     execution,
     notifications,
+    knowledge,
+    notificationBaselineHead: state.notifications?.baselineHead ?? null,
     note: "Observed events do not prove all tool paths are intercepted. Run check to verify the retained evidence."
   };
 }
@@ -3896,6 +4088,7 @@ var SCOPE, priority, cleanText, analysisSchema, sharedSchema, baselineDigest;
 var init_runtime = __esm({
   "src/automation/runtime.ts"() {
     "use strict";
+    init_notifications();
     init_profile();
     init_inspection();
     init_execution();
@@ -3907,34 +4100,34 @@ var init_runtime = __esm({
     SCOPE = "Documentation audit evidence only. Hook receipts show observed events, not complete interception. Resolved findings no longer fail their checks or have a recorded assessment covering current evidence. Repair and review only within the user's task authorization.";
     priority = { resolved: 0, "review-required": 1, unresolved: 2, unverified: 3 };
     cleanText = (text2) => text2.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 250);
-    analysisSchema = z10.object({
-      id: z10.string(),
-      fingerprint: z10.string(),
-      completedAt: z10.number(),
-      baselineDigest: z10.string(),
+    analysisSchema = z11.object({
+      id: z11.string(),
+      fingerprint: z11.string(),
+      completedAt: z11.number(),
+      baselineDigest: z11.string(),
       currentAudit: reportSchema.nullable().optional(),
-      report: z10.object({
-        version: z10.literal(1),
-        status: z10.enum(["verified", "issues-remain", "incomplete", "unavailable"]),
-        root: z10.string(),
-        branch: z10.string(),
-        head: z10.string(),
-        baselinePaths: z10.array(z10.string()),
-        reportPath: z10.string(),
-        findings: z10.array(repairFindingSchema),
-        diagnostics: z10.array(z10.string()),
-        checks: z10.object({
-          ran: z10.array(z10.string()),
-          reused: z10.array(z10.string()),
-          skipped: z10.array(z10.object({ check: z10.string(), reason: z10.string(), doc: z10.string().optional() })),
-          auditReused: z10.boolean().optional()
+      report: z11.object({
+        version: z11.literal(1),
+        status: z11.enum(["verified", "issues-remain", "incomplete", "unavailable"]),
+        root: z11.string(),
+        branch: z11.string(),
+        head: z11.string(),
+        baselinePaths: z11.array(z11.string()),
+        reportPath: z11.string(),
+        findings: z11.array(repairFindingSchema),
+        diagnostics: z11.array(z11.string()),
+        checks: z11.object({
+          ran: z11.array(z11.string()),
+          reused: z11.array(z11.string()),
+          skipped: z11.array(z11.object({ check: z11.string(), reason: z11.string(), doc: z11.string().optional() })),
+          auditReused: z11.boolean().optional()
         }),
-        counts: z10.object({ resolved: z10.number(), unresolved: z10.number(), "review-required": z10.number(), unverified: z10.number() }),
-        capture: z10.enum(["observed", "unknown"]),
-        scope: z10.string()
+        counts: z11.object({ resolved: z11.number(), unresolved: z11.number(), "review-required": z11.number(), unverified: z11.number() }),
+        capture: z11.enum(["observed", "unknown"]),
+        scope: z11.string()
       })
     });
-    sharedSchema = z10.object({ analysis: analysisSchema, digest: z10.string() });
+    sharedSchema = z11.object({ analysis: analysisSchema, digest: z11.string() });
     baselineDigest = async (ws, state) => profilePhase("automation.baselines", async () => hash(await Promise.all(
       state.baselines.map(async (b) => [b.path, await readStoreJson(ws.root, b.path)])
     )));
@@ -3975,7 +4168,7 @@ var init_hook_root = __esm({
 });
 
 // src/setup/model.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 import fs16 from "fs/promises";
 import path24 from "path";
 async function loadSetup(root) {
@@ -4022,29 +4215,29 @@ var init_model = __esm({
     "use strict";
     init_evidence();
     init_storage();
-    setupHostSchema = z11.object({
-      configuredVersion: z11.string(),
-      revision: z11.string().uuid(),
-      fingerprint: z11.string(),
-      mcpFingerprint: z11.string(),
-      instructions: z11.array(z11.string())
+    setupHostSchema = z12.object({
+      configuredVersion: z12.string(),
+      revision: z12.string().uuid(),
+      fingerprint: z12.string(),
+      mcpFingerprint: z12.string(),
+      instructions: z12.array(z12.string())
     });
-    setupSchema = z11.object({ version: z11.literal(2), hosts: z11.object({
+    setupSchema = z12.object({ version: z12.literal(2), hosts: z12.object({
       codex: setupHostSchema.optional(),
       claude: setupHostSchema.optional()
     }) });
     SETUP_PATH = ".mason/local/setup.json";
     INACTIVE_HOSTS_PATH = ".mason/local/inactive-hosts.json";
-    inactiveHostsSchema = z11.object({ version: z11.literal(1), hosts: z11.array(z11.enum(["claude", "codex"])) });
-    receiptSchema = z11.object({
-      version: z11.literal(1),
-      host: z11.enum(["codex", "claude"]),
-      status: z11.enum(["installing", "configured"]),
-      initialReportPath: z11.string(),
-      initialBaselinePaths: z11.array(z11.string()),
-      root: z11.string(),
-      revision: z11.string().uuid(),
-      configuredAt: z11.string().optional()
+    inactiveHostsSchema = z12.object({ version: z12.literal(1), hosts: z12.array(z12.enum(["claude", "codex"])) });
+    receiptSchema = z12.object({
+      version: z12.literal(1),
+      host: z12.enum(["codex", "claude"]),
+      status: z12.enum(["installing", "configured"]),
+      initialReportPath: z12.string(),
+      initialBaselinePaths: z12.array(z12.string()),
+      root: z12.string(),
+      revision: z12.string().uuid(),
+      configuredAt: z12.string().optional()
     });
   }
 });
@@ -4105,7 +4298,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.19.1" : "development";
+    executingVersion = () => true ? "0.19.2" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -4119,7 +4312,7 @@ __export(observations_exports, {
   readObservation: () => readObservation
 });
 import fs18 from "fs/promises";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function observationPath(directory, host, revision, version = executingVersion()) {
   return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
 }
@@ -4190,26 +4383,26 @@ var init_observations = __esm({
     init_storage();
     init_model();
     init_launcher();
-    observationSchema = z12.object({
-      version: z12.literal(1),
-      masonVersion: z12.string(),
-      root: z12.string(),
-      revision: z12.string(),
-      host: z12.enum(["codex", "claude"]),
-      contextCalls: z12.number().int().nonnegative(),
-      lastContextAt: z12.string().optional(),
-      sessions: z12.record(z12.object({
-        events: z12.array(z12.enum(events)),
-        at: z12.string(),
-        verificationStatus: z12.string().optional(),
-        reportPath: z12.string().optional()
+    observationSchema = z13.object({
+      version: z13.literal(1),
+      masonVersion: z13.string(),
+      root: z13.string(),
+      revision: z13.string(),
+      host: z13.enum(["codex", "claude"]),
+      contextCalls: z13.number().int().nonnegative(),
+      lastContextAt: z13.string().optional(),
+      sessions: z13.record(z13.object({
+        events: z13.array(z13.enum(events)),
+        at: z13.string(),
+        verificationStatus: z13.string().optional(),
+        reportPath: z13.string().optional()
       }))
     });
   }
 });
 
 // src/automation/adapters.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 function normalizeHook(host, raw) {
   hostSchema.parse(host);
   const input = inputSchema.parse(raw);
@@ -4219,8 +4412,7 @@ function normalizeHook(host, raw) {
     host,
     sessionId: input.session_id,
     toolId: input.tool_use_id,
-    mutating: !!input.tool_name && !readOnly,
-    stopHookActive: input.stop_hook_active || input.permission_mode === "plan"
+    mutating: !!input.tool_name && !readOnly
   } };
 }
 async function runAutomationHook(host, stdin, options = {}) {
@@ -4258,7 +4450,7 @@ async function runAutomationHook(host, stdin, options = {}) {
     if (warning) result.message = [result.message, warning].filter(Boolean).join("\n");
     if (!result.message) return null;
     if (name === "Stop") {
-      return result.continueOnce ? { decision: "block", reason: result.message } : { systemMessage: result.message };
+      return { systemMessage: result.message };
     }
     return { hookSpecificOutput: { hookEventName: name, additionalContext: result.message } };
   } catch (error) {
@@ -4292,15 +4484,15 @@ var init_adapters = __esm({
     init_runtime();
     init_store();
     init_hook_root();
-    inputSchema = z13.object({
-      cwd: z13.string().min(1),
-      session_id: z13.string().min(1).max(500),
-      hook_event_name: z13.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
-      tool_name: z13.string().optional(),
-      tool_use_id: z13.string().max(500).optional(),
-      tool_input: z13.unknown().optional(),
-      stop_hook_active: z13.boolean().optional(),
-      permission_mode: z13.string().optional()
+    inputSchema = z14.object({
+      cwd: z14.string().min(1),
+      session_id: z14.string().min(1).max(500),
+      hook_event_name: z14.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
+      tool_name: z14.string().optional(),
+      tool_use_id: z14.string().max(500).optional(),
+      tool_input: z14.unknown().optional(),
+      stop_hook_active: z14.boolean().optional(),
+      permission_mode: z14.string().optional()
     });
     lifecycle = {
       SessionStart: "session_start",
@@ -4389,7 +4581,7 @@ __export(ownership_exports, {
   ownershipEdit: () => ownershipEdit,
   ownershipSchema: () => ownershipSchema
 });
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 import { parse } from "smol-toml";
 function blockSpan(text2, start, end) {
   const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
@@ -4440,30 +4632,30 @@ var init_ownership = __esm({
       ["<!-- mason:agents:start -->", "<!-- mason:agents:end -->"],
       ["# mason:mcp:start", "# mason:mcp:end"]
     ];
-    fileSchema = z14.object({
-      created: z14.boolean(),
-      initialHash: z14.string(),
-      blocks: z14.record(z14.string()),
-      mcpHash: z14.string().optional(),
-      hookCommands: z14.array(z14.string()).optional(),
-      hooks: z14.record(z14.array(z14.string())).optional()
+    fileSchema = z15.object({
+      created: z15.boolean(),
+      initialHash: z15.string(),
+      blocks: z15.record(z15.string()),
+      mcpHash: z15.string().optional(),
+      hookCommands: z15.array(z15.string()).optional(),
+      hooks: z15.record(z15.array(z15.string())).optional()
     });
-    ownershipSchema = z14.object({ version: z14.literal(1), files: z14.record(fileSchema) });
+    ownershipSchema = z15.object({ version: z15.literal(1), files: z15.record(fileSchema) });
   }
 });
 
 // src/mcp/init.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var markerSchema, CLAUDE_MD_SECTION, ASSISTANT_SETUP, QUICKSTART_PLAYBOOK, MAP_PLAYBOOK;
 var init_init = __esm({
   "src/mcp/init.ts"() {
     "use strict";
     init_storage();
     init_files2();
-    markerSchema = z15.object({
-      version: z15.literal(1),
-      initializedAt: z15.string(),
-      features: z15.object({ confluence: z15.boolean().optional() }).passthrough().optional()
+    markerSchema = z16.object({
+      version: z16.literal(1),
+      initializedAt: z16.string(),
+      features: z16.object({ confluence: z16.boolean().optional() }).passthrough().optional()
     }).passthrough();
     CLAUDE_MD_SECTION = `<!-- mason:start -->
 ## Mason project knowledge
@@ -4472,9 +4664,10 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 
 - Task, bug, change request, or investigation of why the project works this way \u2192 \`get_context\` with the task text and known files: matching decisions, related tests, impact, and any available map entries.
 - Before editing a file \u2192 \`get_impact\` to check references, tests, and historical change partners.
-- Investigation or correction reveals a reusable project lesson \u2192 \`save_decision\` before finishing. Capture only the lasting constraint and reason, with anchors and known sources, owner, and recorder. This creates a proposal; never infer approval. Preserve uncertain causes and unknown attribution. Route project lessons here; keep personal preferences in agent memory. Skip code summaries, current checkout status, temporary task permissions, session trivia, and secrets. No qualifying lesson means no record.
+- Investigation or correction reveals a reusable project lesson \u2192 \`save_decision\` as soon as the lesson is supported by evidence; do not wait for implementation, task completion, or merge. Record the established observation now and identify unimplemented remedies as tentative. Capture only the lasting constraint and reason, with anchors and known sources, owner, and recorder. This creates a proposal; never infer approval. Preserve uncertain causes and unknown attribution. Route project lessons here; keep personal preferences in agent memory. Skip code summaries, current checkout status, temporary task permissions, session trivia, and secrets. No qualifying lesson means no record.
 - Before saving, compare the lesson with matching \`get_context\` records and any pending proposal. If new evidence changes the same lesson's assumptions, scope, or recommended action, revise it with \`save_decision(id: existingId)\`, including when it is accepted. Preserve supported rationale and sources, replace obsolete instructions, and add the new evidence. Create a separate record for a genuinely distinct lesson; skip unchanged restatements. Revision preserves history and leaves the accepted version operative until authorized review.
 - Consult trust metadata before relying on entries: unknown or changed freshness requires inspection, stale or unknown map verification requires a fresh evidence review, and a recorded failed verdict means the description must be corrected. Check approval too: proposals are suggestions, legacy records are unreviewed, and accepted decisions are recorded constraints subject to freshness checks. An accepted revision remains operative while a pending proposal is reviewed; keep both versions and their freshness distinct.
+- Asked to review pending project knowledge \u2192 \`mason_automation(action: "status")\` lists pending proposals and uncommitted records. For ordinary tasks, inspect matching proposals through \`get_context\`; do not request acceptance merely because a proposal exists.
 - Asked to review or re-verify a decision \u2192 \`review_decision\` first to inspect content, sources, history, and code changes. Record acceptance, reaffirmation, or retirement only when authorized by the user or a cited team review, with the actual reviewer and reason. Never infer approval from unchanged code. Review and commit the local record through the normal project workflow.
 - For an architectural overview, use \`get_snapshot\` if a map is available. If \`map.status\` is missing or invalid, use available decisions and source evidence; do not start building a map unless requested.
 - \`mason_init\` returns documentation audit and committed-diff review results, plus a short setup guide. Pass \`evidence\` with local CI manifest paths to include test and analysis results; the CLI equivalent is \`mason-review --evidence <manifest>\`. State skipped, unavailable, stale, or unknown checks explicitly. Related accepted decisions identify review context, not proven violations.
@@ -4498,7 +4691,7 @@ ${CLAUDE_MD_SECTION}`;
 
 1. Explain the actionable findings with their source evidence. Separate audit issues, advisories, and skipped checks. The review covers committed changes from the merge base to HEAD; workingTree paths are not included in that review. An unavailable or empty check is not proof that the project is correct. Use the CLI for full output if a summary is truncated.
 2. Address findings within the user's requested scope. Setup alone authorizes Mason host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
-3. When the task reveals a real lesson or constraint, compare matching \`get_context\` records first. If its assumptions, scope, or recommended action changed, revise that record using \`save_decision(id: existingId)\`; create a separate record for a genuinely distinct lesson and skip unchanged restatements. Include title, body, category, anchors, and known owner/source/actor information. Preserve supported rationale and sources, replace obsolete instructions, and add new evidence. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
+3. Capture a supported lesson as soon as it is established; do not wait for implementation, task completion, or merge. Keep unimplemented remedies tentative. When the task reveals a real lesson or constraint, compare matching \`get_context\` records first. If its assumptions, scope, or recommended action changed, revise that record using \`save_decision(id: existingId)\`; create a separate record for a genuinely distinct lesson and skip unchanged restatements. Include title, body, category, anchors, and known owner/source/actor information. Preserve supported rationale and sources, replace obsolete instructions, and add new evidence. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
 
 ${ASSISTANT_SETUP}
 
@@ -4551,7 +4744,7 @@ __export(config_exports, {
 });
 import { isDeepStrictEqual } from "util";
 import { parse as parse2, stringify } from "smol-toml";
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 async function instructionEdits(root, host) {
   const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
   const existing = found.find((f) => f.text !== null);
@@ -4662,7 +4855,7 @@ var init_config = __esm({
     init_install();
     init_files2();
     init_launcher();
-    object = z16.record(z16.unknown());
+    object = z17.record(z17.unknown());
     mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
     TOML_START = "# mason:mcp:start";
     TOML_END = "# mason:mcp:end";
@@ -4682,7 +4875,7 @@ __export(install_exports, {
   planAutomationInstall: () => planAutomationInstall,
   recordSchema: () => recordSchema2
 });
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 async function installationRecord(root) {
   return recordSchema2.parse(await readStoreJson(root, AUTOMATION_PATH) ?? { version: 1, hosts: {} });
 }
@@ -4763,9 +4956,9 @@ var init_install = __esm({
     init_store();
     init_files2();
     init_ownership();
-    groupSchema = z17.object({ hooks: z17.array(z17.object({ type: z17.string(), command: z17.string().optional() }).passthrough()) }).passthrough();
-    automationConfigSchema = z17.object({ hooks: z17.record(z17.array(groupSchema)).optional() }).passthrough();
-    recordSchema2 = z17.object({ version: z17.literal(1), hosts: z17.record(z17.object({ command: z17.string() })) });
+    groupSchema = z18.object({ hooks: z18.array(z18.object({ type: z18.string(), command: z18.string().optional() }).passthrough()) }).passthrough();
+    automationConfigSchema = z18.object({ hooks: z18.record(z18.array(groupSchema)).optional() }).passthrough();
+    recordSchema2 = z18.object({ version: z18.literal(1), hosts: z18.record(z18.object({ command: z18.string() })) });
     AUTOMATION_PATH = ".mason/local/automation.json";
     configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
   }
@@ -4782,7 +4975,7 @@ import fs20 from "fs/promises";
 import path26 from "path";
 import { parse as parse3, stringify as stringify2 } from "smol-toml";
 import fg8 from "fast-glob";
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 async function planTeardown(root, selected) {
   const edits = [], diagnostics = [];
   const inputs = /* @__PURE__ */ new Map();
@@ -4938,7 +5131,7 @@ async function planTeardown(root, selected) {
     if (!remainingHost) await attempt(".mason/local/project.json", async () => {
       const before = await read(".mason/local/project.json");
       if (before === null) return;
-      z18.object({ version: z18.literal(1), initializedAt: z18.string() }).strict().parse(JSON.parse(before));
+      z19.object({ version: z19.literal(1), initializedAt: z19.string() }).strict().parse(JSON.parse(before));
       cleanup.push({ path: ".mason/local/project.json", before, after: null });
     });
     if (!diagnostics.length) {
@@ -5019,7 +5212,7 @@ var init_teardown = __esm({
     init_model();
     init_ownership();
     hosts = ["codex", "claude"];
-    object2 = z18.record(z18.unknown());
+    object2 = z19.record(z19.unknown());
     json = (value) => JSON.stringify(value, null, 2) + "\n";
   }
 });
@@ -5146,7 +5339,7 @@ var init_types2 = __esm({
 });
 
 // src/review/evidence/vitest.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 function parseVitest(raw, sourceRoot) {
   const report = schema.parse(raw);
   const findings = [], diagnostics = [];
@@ -5195,24 +5388,24 @@ var init_vitest = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    count3 = z19.number().int().nonnegative();
-    schema = z19.object({
-      success: z19.boolean(),
+    count3 = z20.number().int().nonnegative();
+    schema = z20.object({
+      success: z20.boolean(),
       numTotalTests: count3,
       numPassedTests: count3,
       numFailedTests: count3,
       numPendingTests: count3,
       numTodoTests: count3,
       numFailedTestSuites: count3,
-      testResults: z19.array(z19.object({
-        name: z19.string().min(1),
-        status: z19.enum(["passed", "failed"]),
-        message: z19.string().optional(),
-        assertionResults: z19.array(z19.object({
-          fullName: z19.string(),
-          status: z19.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
-          failureMessages: z19.array(z19.string()).nullable().optional(),
-          location: z19.object({ line: count3, column: count3 }).nullable().optional()
+      testResults: z20.array(z20.object({
+        name: z20.string().min(1),
+        status: z20.enum(["passed", "failed"]),
+        message: z20.string().optional(),
+        assertionResults: z20.array(z20.object({
+          fullName: z20.string(),
+          status: z20.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
+          failureMessages: z20.array(z20.string()).nullable().optional(),
+          location: z20.object({ line: count3, column: count3 }).nullable().optional()
         }))
       }))
     });
@@ -5220,7 +5413,7 @@ var init_vitest = __esm({
 });
 
 // src/review/evidence/sarif.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 function parseSarif(raw, sourceRoot) {
   const report = schema2.parse(raw), findings = [], diagnostics = [];
   let active = 0, suppressed = 0, absent = 0, unresolved = 0;
@@ -5311,29 +5504,29 @@ var init_sarif = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    index = z20.number().int().nonnegative();
-    artifact = z20.object({ uri: z20.string().optional(), uriBaseId: z20.string().optional(), index: index.optional() });
-    message = z20.object({ text: z20.string().optional(), markdown: z20.string().optional(), id: z20.string().optional(), arguments: z20.array(z20.string()).optional() });
-    level = z20.enum(["error", "warning", "note", "none"]);
-    location = z20.object({ physicalLocation: z20.object({ artifactLocation: artifact.optional(), region: z20.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
-    schema2 = z20.object({
-      version: z20.literal("2.1.0"),
-      runs: z20.array(z20.object({
-        tool: z20.object({ driver: z20.object({ name: z20.string().min(1), rules: z20.array(z20.object({ id: z20.string(), defaultConfiguration: z20.object({ level: level.optional() }).optional(), messageStrings: z20.record(message).optional() })).optional(), globalMessageStrings: z20.record(message).optional() }) }),
-        invocations: z20.array(z20.object({ executionSuccessful: z20.boolean(), commandLine: z20.string().optional(), toolExecutionNotifications: z20.array(z20.object({ level: level.optional(), message })).optional() })).optional(),
-        versionControlProvenance: z20.array(z20.object({ revisionId: z20.string().optional() })).optional(),
-        originalUriBaseIds: z20.record(artifact).optional(),
-        artifacts: z20.array(z20.object({ location: artifact.optional() })).optional(),
-        results: z20.array(z20.object({
-          ruleId: z20.string().optional(),
+    index = z21.number().int().nonnegative();
+    artifact = z21.object({ uri: z21.string().optional(), uriBaseId: z21.string().optional(), index: index.optional() });
+    message = z21.object({ text: z21.string().optional(), markdown: z21.string().optional(), id: z21.string().optional(), arguments: z21.array(z21.string()).optional() });
+    level = z21.enum(["error", "warning", "note", "none"]);
+    location = z21.object({ physicalLocation: z21.object({ artifactLocation: artifact.optional(), region: z21.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
+    schema2 = z21.object({
+      version: z21.literal("2.1.0"),
+      runs: z21.array(z21.object({
+        tool: z21.object({ driver: z21.object({ name: z21.string().min(1), rules: z21.array(z21.object({ id: z21.string(), defaultConfiguration: z21.object({ level: level.optional() }).optional(), messageStrings: z21.record(message).optional() })).optional(), globalMessageStrings: z21.record(message).optional() }) }),
+        invocations: z21.array(z21.object({ executionSuccessful: z21.boolean(), commandLine: z21.string().optional(), toolExecutionNotifications: z21.array(z21.object({ level: level.optional(), message })).optional() })).optional(),
+        versionControlProvenance: z21.array(z21.object({ revisionId: z21.string().optional() })).optional(),
+        originalUriBaseIds: z21.record(artifact).optional(),
+        artifacts: z21.array(z21.object({ location: artifact.optional() })).optional(),
+        results: z21.array(z21.object({
+          ruleId: z21.string().optional(),
           ruleIndex: index.optional(),
           message,
           level: level.optional(),
-          kind: z20.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
-          baselineState: z20.enum(["new", "unchanged", "updated", "absent"]).optional(),
-          suppressions: z20.array(z20.object({ kind: z20.enum(["inSource", "external"]), status: z20.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
-          locations: z20.array(location).optional(),
-          relatedLocations: z20.array(location).optional()
+          kind: z21.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
+          baselineState: z21.enum(["new", "unchanged", "updated", "absent"]).optional(),
+          suppressions: z21.array(z21.object({ kind: z21.enum(["inSource", "external"]), status: z21.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
+          locations: z21.array(location).optional(),
+          relatedLocations: z21.array(location).optional()
         })).optional()
       }))
     });
@@ -5341,7 +5534,7 @@ var init_sarif = __esm({
 });
 
 // src/review/evidence/check.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 function parseCheck(raw, sourceRoot) {
   const report = schema3.parse(raw);
   const diagnostics = [], findings = [];
@@ -5381,17 +5574,17 @@ var init_check = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    schema3 = z21.object({
-      version: z21.literal(1),
-      commit: z21.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).optional(),
-      results: z21.array(z21.object({
-        name: z21.string().min(1).max(1e3),
-        status: z21.enum(["passed", "failed", "skipped"]),
-        message: z21.string().max(1e5).optional(),
-        locations: z21.array(z21.object({
-          file: z21.string().min(1).max(4e3),
-          line: z21.number().int().positive().optional(),
-          column: z21.number().int().positive().optional()
+    schema3 = z22.object({
+      version: z22.literal(1),
+      commit: z22.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).optional(),
+      results: z22.array(z22.object({
+        name: z22.string().min(1).max(1e3),
+        status: z22.enum(["passed", "failed", "skipped"]),
+        message: z22.string().max(1e5).optional(),
+        locations: z22.array(z22.object({
+          file: z22.string().min(1).max(4e3),
+          line: z22.number().int().positive().optional(),
+          column: z22.number().int().positive().optional()
         })).max(100).default([])
       })).max(1e5)
     });
@@ -5400,7 +5593,7 @@ var init_check = __esm({
 
 // src/review/evidence.ts
 import path27 from "path";
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 function relativeArtifact(root, file) {
   const relative = path27.isAbsolute(file) ? path27.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
@@ -5441,7 +5634,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
     let manifest, raw;
     try {
       manifest = relativeArtifact(root, supplied);
-      raw = z22.object({ version: z22.literal(1), checks: z22.array(z22.unknown()) }).parse(await readStoreJson(root, manifest));
+      raw = z23.object({ version: z23.literal(1), checks: z23.array(z23.unknown()) }).parse(await readStoreJson(root, manifest));
     } catch (error) {
       output.diagnostics.push(`${supplied}: ${String(error)}`);
       continue;
@@ -5596,25 +5789,25 @@ var init_evidence2 = __esm({
     init_sarif();
     init_check();
     init_types2();
-    checkSchema2 = z22.object({
-      id: z22.string().min(1).max(100),
-      kind: z22.enum(["tests", "static-analysis", "security", "complexity", "duplication", "documentation"]),
-      tool: z22.string().min(1).max(200),
-      command: z22.string().min(1).max(2e3),
-      commit: z22.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
-      workingTreeClean: z22.boolean().optional(),
-      source: z22.string().max(2e3).optional(),
-      sourceRoot: z22.string().min(1).max(4e3).optional(),
-      status: z22.enum(["completed", "skipped", "unavailable"]).default("completed"),
-      reason: z22.string().min(1).max(2e3).optional(),
-      exitCode: z22.number().int().nullable().optional(),
-      environment: z22.object({
-        toolVersion: z22.string().min(1).max(200),
-        runtime: z22.string().min(1).max(200).optional(),
-        platform: z22.string().min(1).max(200).optional(),
-        configuration: z22.array(z22.string().min(1).max(4e3)).max(100).optional()
+    checkSchema2 = z23.object({
+      id: z23.string().min(1).max(100),
+      kind: z23.enum(["tests", "static-analysis", "security", "complexity", "duplication", "documentation"]),
+      tool: z23.string().min(1).max(200),
+      command: z23.string().min(1).max(2e3),
+      commit: z23.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
+      workingTreeClean: z23.boolean().optional(),
+      source: z23.string().max(2e3).optional(),
+      sourceRoot: z23.string().min(1).max(4e3).optional(),
+      status: z23.enum(["completed", "skipped", "unavailable"]).default("completed"),
+      reason: z23.string().min(1).max(2e3).optional(),
+      exitCode: z23.number().int().nullable().optional(),
+      environment: z23.object({
+        toolVersion: z23.string().min(1).max(200),
+        runtime: z23.string().min(1).max(200).optional(),
+        platform: z23.string().min(1).max(200).optional(),
+        configuration: z23.array(z23.string().min(1).max(4e3)).max(100).optional()
       }).optional(),
-      report: z22.object({ format: z22.enum(["vitest-json", "sarif", "mason-check-json"]), path: z22.string().min(1).max(4e3) }).optional()
+      report: z23.object({ format: z23.enum(["vitest-json", "sarif", "mason-check-json"]), path: z23.string().min(1).max(4e3) }).optional()
     });
   }
 });
@@ -6090,7 +6283,7 @@ import path29 from "path";
 import { execFile as execFile5 } from "child_process";
 import { promisify as promisify5 } from "util";
 import { createHash as createHash4, randomUUID as randomUUID7 } from "crypto";
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 async function configurePath(bin, previous, save, options = {}) {
   const env = options.env ?? process.env, platform = options.platform ?? process.platform;
   const changes = [...previous];
@@ -6252,9 +6445,9 @@ var init_path = __esm({
   "src/distribution/path.ts"() {
     "use strict";
     execute2 = promisify5(execFile5);
-    pathChangeSchema = z23.discriminatedUnion("kind", [
-      z23.object({ kind: z23.literal("profile"), file: z23.string(), block: z23.string(), created: z23.boolean() }),
-      z23.object({ kind: z23.literal("windows"), entry: z23.string(), created: z23.boolean() })
+    pathChangeSchema = z24.discriminatedUnion("kind", [
+      z24.object({ kind: z24.literal("profile"), file: z24.string(), block: z24.string(), created: z24.boolean() }),
+      z24.object({ kind: z24.literal("windows"), entry: z24.string(), created: z24.boolean() })
     ]);
     quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
     normalizeWindowsEntry = (value) => path29.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
@@ -6283,7 +6476,7 @@ import os4 from "os";
 import path30 from "path";
 import { fileURLToPath } from "url";
 import fs23 from "fs/promises";
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 async function readInstallation(home) {
   const raw = await readStoreJson(home, "install.json");
   if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
@@ -6323,26 +6516,26 @@ var init_state = __esm({
     "use strict";
     init_storage();
     init_path();
-    releaseVersion = z24.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
-    bundleId = z24.string().regex(/^[a-f0-9]{24}$/);
-    updatePolicySchema = z24.object({
-      enabled: z24.boolean(),
-      revision: z24.string(),
+    releaseVersion = z25.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
+    bundleId = z25.string().regex(/^[a-f0-9]{24}$/);
+    updatePolicySchema = z25.object({
+      enabled: z25.boolean(),
+      revision: z25.string(),
       pinnedVersion: releaseVersion.optional(),
-      mirror: z24.string().optional()
+      mirror: z25.string().optional()
     });
-    recordSchema3 = z24.object({
-      format: z24.literal(1),
-      home: z24.string(),
-      bin: z24.string(),
+    recordSchema3 = z25.object({
+      format: z25.literal(1),
+      home: z25.string(),
+      bin: z25.string(),
       current: bundleId,
       version: releaseVersion,
-      launchers: z24.record(z24.string()),
-      previousLaunchers: z24.record(z24.string()).optional(),
-      pathChanges: z24.array(pathChangeSchema).optional(),
+      launchers: z25.record(z25.string()),
+      previousLaunchers: z25.record(z25.string()).optional(),
+      pathChanges: z25.array(pathChangeSchema).optional(),
       updates: updatePolicySchema.optional(),
-      previous: z24.object({ id: bundleId, version: releaseVersion }).optional(),
-      pending: z24.object({ id: bundleId, version: releaseVersion, policyRevision: z24.string() }).optional()
+      previous: z25.object({ id: bundleId, version: releaseVersion }).optional(),
+      pending: z25.object({ id: bundleId, version: releaseVersion, policyRevision: z25.string() }).optional()
     });
     defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path30.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path30.join(os4.homedir(), ".local/share/mason"));
   }
@@ -6352,7 +6545,7 @@ var init_state = __esm({
 import fs24 from "fs/promises";
 import path31 from "path";
 import { createHash as createHash5 } from "crypto";
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 async function readBundle(root) {
   const bytes = await fs24.readFile(await storePath(root, "bundle.json"));
   const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
@@ -6383,25 +6576,41 @@ var init_bundle = __esm({
     "use strict";
     init_storage();
     targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
-    digest2 = z25.string().regex(/^[a-f0-9]{64}$/);
-    bundleSchema = z25.object({
-      format: z25.literal(1),
-      version: z25.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      target: z25.enum(targets),
-      nodeVersion: z25.string(),
-      files: z25.record(digest2)
+    digest2 = z26.string().regex(/^[a-f0-9]{64}$/);
+    bundleSchema = z26.object({
+      format: z26.literal(1),
+      version: z26.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+      target: z26.enum(targets),
+      nodeVersion: z26.string(),
+      files: z26.record(digest2)
     }).strict();
     sha256 = (bytes) => createHash5("sha256").update(bytes).digest("hex");
   }
 });
 
+// src/distribution/trust.ts
+import tls from "tls";
+function releaseRequestError(error) {
+  const cause = error instanceof Error ? error.cause : void 0;
+  const code = cause && typeof cause === "object" && "code" in cause ? String(cause.code) : void 0;
+  const detail = code ?? (error instanceof Error ? error.message : String(error));
+  const certificateError = code && /CERT|SELF_SIGNED|UNABLE_TO_VERIFY_LEAF_SIGNATURE/.test(code);
+  const hint = certificateError ? " Check that your company's CA certificate is trusted by your operating system, or provide its PEM file with NODE_EXTRA_CA_CERTS." : " Check network and proxy access to GitHub.";
+  return new Error(`Could not check the latest Mason release on GitHub (${detail}).${hint}`, { cause: error });
+}
+var init_trust2 = __esm({
+  "src/distribution/trust.ts"() {
+    "use strict";
+  }
+});
+
 // src/distribution/runtime.ts
 import fs25 from "fs/promises";
 import { unlinkSync } from "fs";
 import os5 from "os";
 import path32 from "path";
 import { randomUUID as randomUUID8 } from "crypto";
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 async function pruneUnusedVersions(home) {
   const versions = await storePath(home, "versions");
   const candidates = [];
@@ -6469,7 +6678,8 @@ var init_runtime2 = __esm({
     init_storage();
     init_state();
     init_bundle();
-    leaseSchema = z26.object({ pid: z26.number().int().positive(), host: z26.string(), bundle: z26.string().regex(/^[a-f0-9]{24}$/) });
+    init_trust2();
+    leaseSchema = z27.object({ pid: z27.number().int().positive(), host: z27.string(), bundle: z27.string().regex(/^[a-f0-9]{24}$/) });
   }
 });
 
@@ -6477,7 +6687,7 @@ var init_runtime2 = __esm({
 import fs26 from "fs/promises";
 import os6 from "os";
 import { randomUUID as randomUUID9 } from "crypto";
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 async function hasRunningMcp(home) {
   const directory = await storePath(home, "sessions");
   const files = await fs26.readdir(directory).catch((error) => {
@@ -6518,7 +6728,7 @@ var init_sessions = __esm({
   "src/distribution/sessions.ts"() {
     "use strict";
     init_storage();
-    leaseSchema2 = z27.object({ pid: z27.number().int().positive(), host: z27.string() });
+    leaseSchema2 = z28.object({ pid: z28.number().int().positive(), host: z28.string() });
   }
 });
 
@@ -6768,6 +6978,8 @@ async function upgradeStandalone(version, progress2) {
       method: "HEAD",
       redirect: "follow",
       signal: AbortSignal.timeout(3e4)
+    }).catch((error) => {
+      throw releaseRequestError(error);
     });
     if (!response.ok) throw new Error(`Latest release request failed (HTTP ${response.status}).`);
     selected = new URL(response.url).pathname.split("/").pop()?.replace(/^v/, "");
@@ -6848,6 +7060,7 @@ var init_install2 = __esm({
     init_path();
     init_state();
     init_sessions();
+    init_trust2();
     init_state();
     shQuote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
     psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
@@ -6873,7 +7086,7 @@ import fs28 from "fs/promises";
 import path34 from "path";
 import { spawn as spawn2 } from "child_process";
 import { randomUUID as randomUUID11 } from "crypto";
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 async function boundedDownload(url) {
   const response = await fetch(url, { signal: AbortSignal.timeout(15e3), redirect: "follow" });
   if (!response.ok || !response.body) throw new Error(`Update metadata request failed (HTTP ${response.status}).`);
@@ -7086,14 +7299,14 @@ var init_updates = __esm({
     CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
     RELEASE_AGE_MS = 24 * 60 * 60 * 1e3;
     releaseBase = "https://github.com/adrianczuczka/mason/releases";
-    releaseListSchema = z28.array(z28.object({ tag_name: z28.string(), draft: z28.boolean(), prerelease: z28.boolean(), published_at: z28.string().nullable() }));
-    updateManifestSchema = z28.object({
-      format: z28.literal(1),
-      version: z28.string().regex(/^\d+\.\d+\.\d+$/),
-      publishedAt: z28.string().datetime(),
-      assets: z28.record(z28.string().regex(/^[a-f0-9]{64}$/))
+    releaseListSchema = z29.array(z29.object({ tag_name: z29.string(), draft: z29.boolean(), prerelease: z29.boolean(), published_at: z29.string().nullable() }));
+    updateManifestSchema = z29.object({
+      format: z29.literal(1),
+      version: z29.string().regex(/^\d+\.\d+\.\d+$/),
+      publishedAt: z29.string().datetime(),
+      assets: z29.record(z29.string().regex(/^[a-f0-9]{64}$/))
     }).strict();
-    statusSchema2 = z28.object({ lastAttempt: z28.number(), availableVersion: z28.string().optional(), error: z28.string().optional() });
+    statusSchema2 = z29.object({ lastAttempt: z29.number(), availableVersion: z29.string().optional(), error: z29.string().optional() });
   }
 });
 
@@ -7265,7 +7478,7 @@ async function runAutomationCli(argv, stdin = "", io = defaultIo, options = {})
       const { setupStatus: setupStatus2, summarizeActivation: summarizeActivation2 } = await Promise.resolve().then(() => (init_status(), status_exports));
       const setup = await setupStatus2(dir);
       const result = { ...await automationStatus(dir), configured: await installedAutomation(dir), setup };
-      io.out(values.json || !process.stdout.isTTY ? JSON.stringify(result, null, 2) : summarizeActivation2(setup));
+      io.out(values.json || !process.stdout.isTTY ? JSON.stringify(result, null, 2) : [summarizeActivation2(setup), result.knowledge].filter(Boolean).join("\n\n"));
       return 0;
     }
     if (action !== "check") throw new Error("Unknown automation command: " + action);
@@ -7290,7 +7503,7 @@ var inputArgs = process.argv.slice(2);
 var managedLaunch = inputArgs[0] === "--setup-host";
 var setupHost = managedLaunch ? inputArgs.splice(0, 2)[1] : void 0;
 var [command, ...args] = inputArgs;
-var usage = `Mason ${"0.19.1"}
+var usage = `Mason ${"0.19.2"}
 
 Usage: mason <command> [options]
 
@@ -7319,9 +7532,9 @@ try {
       await prepareLaunch2(setupHost, { allowInactive: command === "mcp" });
     }
   }
-  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.19.1" }));
+  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.19.2" }));
   else if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
-  else if (["--version", "-v"].includes(command)) console.log("0.19.1");
+  else if (["--version", "-v"].includes(command)) console.log("0.19.2");
   else if (command === "internal-update") {
     if (args.length) throw new Error("internal-update takes no arguments.");
     const { currentInstallation: currentInstallation2 } = await Promise.resolve().then(() => (init_state(), state_exports));