mason-context 0.9.0 → 0.10.1

package/dist/mason-audit.js

@@ -1,50 +1,53 @@
 #!/usr/bin/env node
 
 // src/audit/cli.ts
-import path14 from "path";
+import path16 from "path";
 
 // src/audit/audit.ts
 import fs9 from "fs/promises";
-import path13 from "path";
+import path15 from "path";
 
 // src/drift/drift.ts
 import fs3 from "fs/promises";
-import path4 from "path";
+import path6 from "path";
 import { execFile as execFile3 } from "child_process";
 import { promisify as promisify3 } from "util";
 
 // src/snapshot/snapshot.ts
-import fs2 from "fs/promises";
-import path3 from "path";
+import path5 from "path";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import fg3 from "fast-glob";
 
-// src/mcp/sampler.ts
+// src/utils/files.ts
 import fs from "fs/promises";
-import path from "path";
+import { constants } from "fs";
+import path2 from "path";
 import { execFile } from "child_process";
 import { promisify } from "util";
 import fg from "fast-glob";
-var exec = promisify(execFile);
-
-// src/test-map.ts
-import path2 from "path";
-import fg2 from "fast-glob";
 
-// src/snapshot/snapshot.ts
-var exec2 = promisify2(execFile2);
-async function getCurrentGitHash(rootDir) {
-  try {
-    const { stdout } = await exec2("git", ["rev-parse", "HEAD"], {
-      cwd: rootDir
-    });
-    return stdout.trim();
-  } catch {
-    return "unknown";
-  }
+// src/utils/paths.ts
+import path from "path";
+function normalizeRepoPath(value) {
+  const slash = value.replace(/\\/g, "/");
+  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
+  if (slash.split("/").includes("..")) return null;
+  const normalized = path.posix.normalize(slash).replace(/\/$/, "");
+  return normalized === "." ? null : normalized;
+}
+function anchorMatches(anchor, file) {
+  const a = normalizeRepoPath(anchor);
+  const f = normalizeRepoPath(file);
+  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
 }
-var SOURCE_GLOB = "**/*.{ts,tsx,js,jsx,kt,kts,java,py,go,rs,swift,rb,cs,cpp,c,dart}";
+function matchingPaths(anchors, files) {
+  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
+}
+
+// src/utils/files.ts
+var exec = promisify(execFile);
+var SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+var SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
 var SOURCE_IGNORE = [
   "**/node_modules/**",
   "**/dist/**",
@@ -52,58 +55,171 @@ var SOURCE_IGNORE = [
   "**/.gradle/**",
   "**/target/**",
   "**/.git/**",
+  "**/.mason/**",
   "**/vendor/**",
   "**/__pycache__/**",
   "**/venv/**",
   "**/.venv/**",
   "**/*.min.*",
   "**/*.map",
+  "**/*.lock",
   "**/generated/**",
+  "**/*.generated.*",
   "**/R.java",
-  "**/BuildConfig.java"
+  "**/BuildConfig.java",
+  "**/package-lock.json",
+  "**/yarn.lock",
+  "**/pnpm-lock.yaml"
 ];
+var MAX_SOURCE_BYTES = 1024 * 1024;
+async function readBoundedFile(file, maxBytes) {
+  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size > maxBytes) return null;
+    const buffer = Buffer.alloc(Math.min(maxBytes + 1, stat.size + 1));
+    let bytes = 0;
+    while (bytes < buffer.length) {
+      const result = await handle.read(buffer, bytes, buffer.length - bytes, null);
+      if (result.bytesRead === 0) break;
+      bytes += result.bytesRead;
+    }
+    return bytes === buffer.length ? null : buffer.subarray(0, bytes).toString("utf8");
+  } finally {
+    await handle.close();
+  }
+}
+
+// src/utils/storage.ts
+import fs2 from "fs/promises";
+import path3 from "path";
+import { randomUUID } from "crypto";
+async function storePath(root, relative, createParents = false) {
+  const normalized = normalizeRepoPath(relative);
+  if (!normalized) throw new Error(`Invalid store path: ${relative}`);
+  let current = await fs2.realpath(root);
+  const parts = normalized.split("/");
+  for (let i = 0; i < parts.length; i++) {
+    current = path3.join(current, parts[i]);
+    let stat;
+    try {
+      stat = await fs2.lstat(current);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      if (createParents && i < parts.length - 1) {
+        try {
+          await fs2.mkdir(current);
+        } catch (mkdirError) {
+          if (mkdirError.code !== "EEXIST") throw mkdirError;
+        }
+        stat = await fs2.lstat(current);
+      }
+    }
+    if (stat?.isSymbolicLink()) throw new Error(`Symlink in store path: ${relative}`);
+  }
+  return current;
+}
+async function readStoreJson(root, relative) {
+  try {
+    const file = await storePath(root, relative);
+    const raw = await readBoundedFile(file, 10 * 1024 * 1024);
+    if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
+    const parsed = JSON.parse(raw);
+    if (parsed === null) throw new Error("expected a JSON object, received null");
+    return parsed;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+// src/snapshot/snapshot.ts
+import { z } from "zod";
+
+// src/test-map.ts
+import path4 from "path";
+
+// src/snapshot/snapshot.ts
+var exec2 = promisify2(execFile2);
+var repoPath = z.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+var verificationFields = {
+  refreshedHash: z.string().optional(),
+  verifiedAt: z.string().optional(),
+  verifiedHash: z.string().optional(),
+  verificationFailed: z.boolean().optional(),
+  verificationNote: z.string().optional()
+};
+var featureSchema = z.object({
+  description: z.string(),
+  files: z.array(repoPath),
+  tests: z.array(repoPath).optional(),
+  type: z.enum(["capability", "infrastructure"]).optional(),
+  ...verificationFields
+}).passthrough();
+var flowSchema = z.object({ description: z.string(), chain: z.array(repoPath), ...verificationFields }).passthrough();
+var snapshotSchema = z.object({
+  version: z.literal(2),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+  gitHash: z.string(),
+  features: z.record(featureSchema),
+  flows: z.record(flowSchema)
+}).passthrough();
+async function getCurrentGitHash(rootDir) {
+  try {
+    const { stdout } = await exec2("git", ["rev-parse", "HEAD"], {
+      cwd: rootDir
+    });
+    return stdout.trim();
+  } catch {
+    return "unknown";
+  }
+}
 
 // src/drift/drift.ts
 var exec3 = promisify3(execFile3);
-async function getChangesWithStatus(resolvedRoot, fromHash) {
-  if (!fromHash || fromHash === "unknown") return null;
+function parseChanges(output) {
+  const fields = output.split("\0");
+  const changes = [];
+  for (let i = 0; i < fields.length && fields[i]; ) {
+    const code = fields[i++];
+    const first = fields[i++];
+    if (!first) break;
+    const second = /^[RC]/.test(code) ? fields[i++] : void 0;
+    const change = second ? code.startsWith("R") ? { status: "renamed", path: second, previousPath: first } : { status: "added", path: second } : { status: code === "A" ? "added" : code === "D" ? "deleted" : "modified", path: first };
+    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/"))) continue;
+    changes.push(change);
+  }
+  return changes;
+}
+function touchedPaths(changes) {
+  return [...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))].sort();
+}
+async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
+  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
   try {
-    const { stdout } = await exec3(
-      "git",
-      ["diff", "--name-status", "-M", fromHash, "HEAD"],
-      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
-    );
-    const changes = [];
-    for (const line of stdout.split("\n")) {
-      if (!line.trim()) continue;
-      const parts = line.split("	");
-      if (parts.some((p) => p.startsWith(".mason/"))) continue;
-      const code = parts[0];
-      if (code.startsWith("R") && parts.length >= 3) {
-        changes.push({
-          status: "renamed",
-          path: parts[2],
-          previousPath: parts[1]
-        });
-      } else if (code.startsWith("C") && parts.length >= 3) {
-        changes.push({ status: "added", path: parts[2] });
-      } else if (code === "A" && parts.length >= 2) {
-        changes.push({ status: "added", path: parts[1] });
-      } else if (code === "D" && parts.length >= 2) {
-        changes.push({ status: "deleted", path: parts[1] });
-      } else if (parts.length >= 2) {
-        changes.push({ status: "modified", path: parts[1] });
-      }
-    }
-    return changes;
+    const { stdout } = await exec3("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    return parseChanges(stdout);
   } catch {
     return null;
   }
 }
+async function getWorkingTree(resolvedRoot) {
+  try {
+    const [diff, untracked] = await Promise.all([
+      exec3("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
+      exec3("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+    ]);
+    const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
+    return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
+  } catch {
+    return { available: false, changedFiles: [], untrackedFiles: [] };
+  }
+}
 
 // src/audit/docs.ts
 import fs4 from "fs/promises";
-import path5 from "path";
+import path7 from "path";
 import { execFile as execFile5 } from "child_process";
 import { promisify as promisify5 } from "util";
 
@@ -486,7 +602,7 @@ async function discoverDocs(resolvedRoot) {
   for (const candidate of DOC_CANDIDATES) {
     let content;
     try {
-      content = await fs4.readFile(path5.join(resolvedRoot, candidate), "utf-8");
+      content = await fs4.readFile(path7.join(resolvedRoot, candidate), "utf-8");
     } catch {
       continue;
     }
@@ -514,7 +630,7 @@ var ALL_CHECKS = [
 
 // src/audit/checks/deleted-reference.ts
 import fs5 from "fs/promises";
-import path6 from "path";
+import path8 from "path";
 async function exists(absPath) {
   try {
     await fs5.access(absPath);
@@ -537,7 +653,7 @@ async function checkDeletedReferences(ctx) {
       if (claim.path === ".mason" || claim.path.startsWith(".mason/")) {
         continue;
       }
-      if (await exists(path6.join(ctx.root, claim.path))) continue;
+      if (await exists(path8.join(ctx.root, claim.path))) continue;
       const anchor = { doc: doc.path, line: claim.line, excerpt: claim.excerpt };
       const renamedTo = renames.get(claim.path) ?? null;
       if (renamedTo) {
@@ -573,14 +689,14 @@ async function checkDeletedReferences(ctx) {
             deletedInCommit: deleted,
             everTracked: true,
             parentDirExists: await exists(
-              path6.join(ctx.root, path6.dirname(claim.path))
+              path8.join(ctx.root, path8.dirname(claim.path))
             )
           }
         });
         continue;
       }
       const parentDirExists = await exists(
-        path6.join(ctx.root, path6.dirname(claim.path))
+        path8.join(ctx.root, path8.dirname(claim.path))
       );
       if (!parentDirExists) continue;
       const issue = {
@@ -604,8 +720,8 @@ async function checkDeletedReferences(ctx) {
 }
 
 // src/audit/checks/new-module.ts
-import fg4 from "fast-glob";
-import path7 from "path";
+import fg2 from "fast-glob";
+import path9 from "path";
 var DIR_DENYLIST = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -627,8 +743,8 @@ var DIR_DENYLIST = /* @__PURE__ */ new Set([
 ]);
 var SECOND_LEVEL_MIN_SOURCE_FILES = 2;
 var ENUMERATION_THRESHOLD = 2;
-function escapeRegExp(text) {
-  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function escapeRegExp(text2) {
+  return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function isMentioned(combinedDocs, name) {
   const re = new RegExp(
@@ -638,7 +754,7 @@ function isMentioned(combinedDocs, name) {
   return re.test(combinedDocs);
 }
 async function listSubdirs(absDir) {
-  const dirs = await fg4("*", {
+  const dirs = await fg2("*", {
     cwd: absDir,
     onlyDirectories: true,
     suppressErrors: true
@@ -646,7 +762,7 @@ async function listSubdirs(absDir) {
   return dirs.filter((d) => !DIR_DENYLIST.has(d)).sort();
 }
 async function countSourceFiles(absDir) {
-  const files = await fg4(SOURCE_GLOB, {
+  const files = await fg2(SOURCE_GLOB, {
     cwd: absDir,
     ignore: SOURCE_IGNORE,
     suppressErrors: true
@@ -675,7 +791,7 @@ async function checkNewModules(ctx) {
     });
   };
   for (const topDir of await listSubdirs(ctx.root)) {
-    const absTop = path7.join(ctx.root, topDir);
+    const absTop = path9.join(ctx.root, topDir);
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
       const count = await countSourceFiles(absTop);
@@ -687,7 +803,7 @@ async function checkNewModules(ctx) {
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
       if (isMentioned(combinedDocs, sub)) continue;
-      const count = await countSourceFiles(path7.join(absTop, sub));
+      const count = await countSourceFiles(path9.join(absTop, sub));
       if (count >= SECOND_LEVEL_MIN_SOURCE_FILES) {
         await flag(`${topDir}/${sub}`, count);
       }
@@ -698,8 +814,8 @@ async function checkNewModules(ctx) {
 
 // src/audit/checks/stale-count.ts
 import fs6 from "fs/promises";
-import path8 from "path";
-import fg5 from "fast-glob";
+import path10 from "path";
+import fg3 from "fast-glob";
 var MEMBERS_CAP = 50;
 async function readIfExists(absPath) {
   try {
@@ -710,7 +826,7 @@ async function readIfExists(absPath) {
 }
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
-    const content = await readIfExists(path8.join(root, name));
+    const content = await readIfExists(path10.join(root, name));
     if (content === null) continue;
     const members = [];
     for (const call of content.matchAll(/include\s*\(([^)]*)\)/g)) {
@@ -724,26 +840,26 @@ async function countGradleModules(root) {
   return null;
 }
 async function countNpmWorkspaces(root) {
-  const pkgRaw = await readIfExists(path8.join(root, "package.json"));
+  const pkgRaw = await readIfExists(path10.join(root, "package.json"));
   if (pkgRaw !== null) {
     try {
       const pkg = JSON.parse(pkgRaw);
       const globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
       if (globs.length > 0) {
-        const matched = await fg5(
+        const matched = await fg3(
           globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
           { cwd: root, ignore: ["**/node_modules/**"] }
         );
         return {
           actual: matched.length,
           countedFrom: "package.json workspaces",
-          members: matched.map((m) => path8.dirname(m)).sort()
+          members: matched.map((m) => path10.dirname(m)).sort()
         };
       }
     } catch {
     }
   }
-  const pnpmRaw = await readIfExists(path8.join(root, "pnpm-workspace.yaml"));
+  const pnpmRaw = await readIfExists(path10.join(root, "pnpm-workspace.yaml"));
   if (pnpmRaw !== null) {
     const globs = [];
     let inPackages = false;
@@ -762,21 +878,21 @@ async function countNpmWorkspaces(root) {
       }
     }
     if (globs.length > 0) {
-      const matched = await fg5(
+      const matched = await fg3(
         globs.map((g) => `${g.replace(/\/+$/, "")}/package.json`),
         { cwd: root, ignore: ["**/node_modules/**"] }
       );
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path8.dirname(m)).sort()
+        members: matched.map((m) => path10.dirname(m)).sort()
       };
     }
   }
   return null;
 }
 async function countCargoCrates(root) {
-  const content = await readIfExists(path8.join(root, "Cargo.toml"));
+  const content = await readIfExists(path10.join(root, "Cargo.toml"));
   if (content === null) return null;
   const membersBlock = content.match(/members\s*=\s*\[([\s\S]*?)\]/);
   if (!membersBlock) return null;
@@ -787,12 +903,12 @@ async function countCargoCrates(root) {
   const members = /* @__PURE__ */ new Set();
   for (const entry of entries) {
     if (/[*?[\]{}]/.test(entry)) {
-      const matched = await fg5(`${entry.replace(/\/+$/, "")}/Cargo.toml`, {
+      const matched = await fg3(`${entry.replace(/\/+$/, "")}/Cargo.toml`, {
         cwd: root,
         ignore: ["**/target/**"]
       });
-      for (const m of matched) members.add(path8.dirname(m));
-    } else if (await readIfExists(path8.join(root, entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path10.dirname(m));
+    } else if (await readIfExists(path10.join(root, entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -837,8 +953,8 @@ async function checkStaleCounts(ctx) {
 
 // src/audit/checks/dead-command.ts
 import fs7 from "fs/promises";
-import path9 from "path";
-import fg6 from "fast-glob";
+import path11 from "path";
+import fg4 from "fast-glob";
 var AVAILABLE_SCRIPTS_CAP = 30;
 async function scriptsOf(absManifest) {
   try {
@@ -854,7 +970,7 @@ async function checkDeadCommands(ctx) {
     (doc) => doc.claims.commands.map((claim) => ({ doc, claim }))
   );
   if (commandClaims.length === 0) return result;
-  const rootScripts = await scriptsOf(path9.join(ctx.root, "package.json"));
+  const rootScripts = await scriptsOf(path11.join(ctx.root, "package.json"));
   if (rootScripts === null) {
     result.skipped.push({
       check: "dead-command",
@@ -868,7 +984,7 @@ async function checkDeadCommands(ctx) {
   const loadWorkspaceScripts = async () => {
     if (workspaceScripts !== null) return workspaceScripts;
     workspaceScripts = /* @__PURE__ */ new Set();
-    const manifests = await fg6("**/package.json", {
+    const manifests = await fg4("**/package.json", {
       cwd: ctx.root,
       ignore: [
         "**/node_modules/**",
@@ -879,7 +995,7 @@ async function checkDeadCommands(ctx) {
     });
     manifestsChecked = ["package.json", ...manifests.sort()];
     for (const manifest of manifests) {
-      const scripts = await scriptsOf(path9.join(ctx.root, manifest));
+      const scripts = await scriptsOf(path11.join(ctx.root, manifest));
       for (const name of scripts ?? []) workspaceScripts.add(name);
     }
     return workspaceScripts;
@@ -968,86 +1084,205 @@ async function checkDepsChanged(ctx) {
 }
 
 // src/decisions/drift.ts
-import path12 from "path";
+import path14 from "path";
 
 // src/decisions/decisions.ts
 import fs8 from "fs/promises";
-import path11 from "path";
+import path13 from "path";
 import { createHash } from "crypto";
 
 // src/context/lexical.ts
-import path10 from "path";
+import path12 from "path";
 
-// src/decisions/decisions.ts
-function decisionsDir(rootDir) {
-  return path11.join(rootDir, ".mason", "decisions");
+// src/decisions/provenance.ts
+import { z as z2 } from "zod";
+var text = (max) => z2.string().trim().min(1).max(max);
+var decisionSourceSchema = z2.object({
+  kind: z2.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
+  reference: text(1e3),
+  note: text(500).optional()
+}).strict();
+var attributionSchema = z2.object({
+  owner: text(200).nullable().optional(),
+  sources: z2.array(decisionSourceSchema).max(20).optional(),
+  actor: text(200).optional()
+});
+var contentSchema = z2.object({
+  title: z2.string().min(1),
+  body: z2.string().min(1),
+  category: z2.enum(["decision", "gotcha", "deprecation", "convention"]),
+  files: z2.array(z2.string().refine((f) => normalizeRepoPath(f) !== null)),
+  owner: text(200).optional(),
+  sources: z2.array(decisionSourceSchema).max(20)
+});
+var approvalSchema = z2.enum(["unreviewed", "proposed", "accepted"]);
+var statusSchema = z2.enum(["active", "superseded", "retired"]);
+var reviewEvidenceSchema = z2.object({
+  baseHash: z2.string(),
+  headHash: z2.string(),
+  historyAvailable: z2.boolean(),
+  changedFiles: z2.array(z2.string()),
+  localChanges: z2.array(z2.string())
+});
+var eventSchema = z2.object({
+  kind: z2.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
+  at: z2.string().datetime(),
+  actor: text(200).optional(),
+  note: text(1500).optional(),
+  revision: z2.number().int().positive(),
+  content: contentSchema,
+  approval: approvalSchema,
+  status: statusSchema,
+  refreshedHash: z2.string(),
+  evidence: reviewEvidenceSchema.optional()
+});
+var legacySchema = z2.object({
+  version: z2.literal(1),
+  id: z2.string().regex(/^[a-zA-Z0-9_-]+$/),
+  title: z2.string().min(1),
+  body: z2.string().min(1),
+  category: contentSchema.shape.category,
+  files: contentSchema.shape.files,
+  createdAt: z2.string(),
+  updatedAt: z2.string(),
+  refreshedHash: z2.string(),
+  status: z2.enum(["active", "superseded"]),
+  supersededBy: z2.string().optional()
+}).passthrough();
+var currentSchema = legacySchema.extend({
+  version: z2.literal(2),
+  status: statusSchema,
+  approval: approvalSchema,
+  revision: z2.number().int().positive(),
+  owner: text(200).optional(),
+  sources: z2.array(decisionSourceSchema).max(20),
+  history: z2.array(eventSchema).min(1)
+}).superRefine((record, ctx) => {
+  const invalid = (message) => ctx.addIssue({ code: "custom", message });
+  const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+  let previous;
+  for (const event of record.history) {
+    if (!previous) {
+      if (!["created", "imported"].includes(event.kind) || event.revision !== 1) invalid("History must begin with creation or legacy import at revision 1");
+      if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed")) invalid("Initial records cannot claim acceptance");
+    } else {
+      if (["created", "imported"].includes(event.kind)) invalid("History cannot restart");
+      if (previous.status !== "active") invalid("Archived decisions cannot be changed");
+      if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0)) invalid("Invalid revision sequence");
+      if (event.kind !== "revised" && !same(event.content, previous.content)) invalid("A review cannot silently revise decision content");
+      if (event.kind === "reaffirmed" && previous.approval !== "accepted") invalid("Only accepted decisions can be reaffirmed");
+      if (event.kind === "accepted" && previous.approval === "accepted") invalid("Use reaffirmation for an accepted decision");
+      const approval = event.kind === "revised" ? "proposed" : ["accepted", "reaffirmed"].includes(event.kind) ? "accepted" : previous.approval;
+      if (event.approval !== approval) invalid("Approval disagrees with review history");
+      if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash) invalid("Only a review can refresh the evidence baseline");
+    }
+    if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active")) invalid("Lifecycle disagrees with history");
+    if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence)) invalid("Reviews require a named reviewer, reason, and code evidence");
+    if (["accepted", "reaffirmed"].includes(event.kind)) {
+      if (!event.content.owner || !event.content.sources.length) invalid("Accepted decisions require an owner and source");
+      if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length) invalid("Acceptance requires a committed evidence baseline");
+    }
+    previous = event;
+  }
+  if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash) invalid("Decision does not match the final history event");
+});
+var decisionSchema = z2.union([legacySchema, currentSchema]);
+function decisionContent(record) {
+  return {
+    title: record.title,
+    body: record.body,
+    category: record.category,
+    files: record.files,
+    ...typeof record.owner === "string" ? { owner: record.owner } : {},
+    sources: Array.isArray(record.sources) ? record.sources : []
+  };
+}
+function decisionApproval(record) {
+  return record.version === 1 ? "unreviewed" : record.approval;
 }
-async function loadDecisions(rootDir) {
+function effectiveDecision(record) {
+  if (record.version !== 2 || record.status !== "active" || record.approval !== "proposed") return record;
+  let index = record.history.length - 1;
+  while (index >= 0 && !["accepted", "reaffirmed"].includes(record.history[index].kind)) index--;
+  if (index < 0) return record;
+  const event = record.history[index];
+  return {
+    ...record,
+    ...event.content,
+    owner: event.content.owner,
+    approval: "accepted",
+    revision: event.revision,
+    refreshedHash: event.refreshedHash,
+    updatedAt: event.at,
+    history: record.history.slice(0, index + 1)
+  };
+}
+function decisionProvenance(record, freshness = "unknown") {
+  const approval = decisionApproval(record);
+  const review = record.version === 2 ? [...record.history].reverse().find((e) => ["accepted", "reaffirmed"].includes(e.kind) && e.revision === record.revision) : void 0;
+  return {
+    approval,
+    revision: record.version === 2 ? record.revision : 0,
+    owner: record.version === 2 ? record.owner ?? null : null,
+    sources: record.version === 2 ? record.sources : [],
+    guidance: record.status !== "active" ? "historical" : approval === "accepted" ? "constraint" : approval === "proposed" ? "proposal" : "unreviewed",
+    reviewRequired: record.status === "active" && (approval !== "accepted" || freshness !== "current"),
+    lastReview: review ? { reviewer: review.actor, at: review.at, note: review.note, gitHash: review.refreshedHash } : null
+  };
+}
+
+// src/decisions/decisions.ts
+async function loadDecisionStore(rootDir) {
+  const records = [];
+  const diagnostics = [];
   let entries;
   try {
-    entries = await fs8.readdir(decisionsDir(rootDir));
-  } catch {
-    return [];
+    entries = await fs8.readdir(await storePath(rootDir, ".mason/decisions"));
+  } catch (error) {
+    if (error.code !== "ENOENT") diagnostics.push({ path: ".mason/decisions", message: String(error) });
+    return { records, diagnostics };
   }
-  const records = [];
-  for (const entry of entries) {
+  for (const entry of entries.sort()) {
     if (!entry.endsWith(".json")) continue;
+    const relative = `.mason/decisions/${entry}`;
     try {
-      const raw = await fs8.readFile(
-        path11.join(decisionsDir(rootDir), entry),
-        "utf-8"
-      );
-      const parsed = JSON.parse(raw);
-      if (parsed.version !== 1 || !parsed.id || !parsed.title || !parsed.body) {
-        continue;
-      }
-      records.push(parsed);
-    } catch {
-      continue;
+      const record = decisionSchema.parse(await readStoreJson(rootDir, relative));
+      if (entry !== `${record.id}.json`) throw new Error("Record id does not match its filename");
+      records.push(record);
+    } catch (error) {
+      diagnostics.push({ path: relative, message: error instanceof Error ? error.message : String(error) });
     }
   }
-  return records.sort((a, b) => a.id.localeCompare(b.id));
+  return { records, diagnostics };
 }
 
 // src/decisions/drift.ts
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path12.resolve(rootDir);
-  const records = decisions ?? await loadDecisions(resolvedRoot);
-  const report = {
-    historyAvailable: true,
-    totalDecisions: records.length,
-    staleDecisions: {}
-  };
-  const head = await getCurrentGitHash(resolvedRoot);
+  const resolvedRoot = path14.resolve(rootDir);
+  const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
+  const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
+  const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
   const changesByHash = /* @__PURE__ */ new Map();
-  for (const record of records) {
-    if (record.status !== "active" || record.files.length === 0) continue;
-    if (record.refreshedHash === head) continue;
+  const inspect = async (record) => {
+    if (record.files.length === 0) return { freshness: "unknown", changedFiles: [] };
     let touched = changesByHash.get(record.refreshedHash);
     if (touched === void 0) {
-      const changes = await getChangesWithStatus(
-        resolvedRoot,
-        record.refreshedHash
-      );
-      if (changes === null) {
-        touched = null;
-      } else {
-        touched = /* @__PURE__ */ new Set();
-        for (const change of changes) {
-          touched.add(change.path);
-          if (change.previousPath) touched.add(change.previousPath);
-        }
-      }
+      const changes = record.refreshedHash === head && head !== "unknown" ? [] : await getChangesWithStatus(resolvedRoot, record.refreshedHash);
+      touched = changes === null ? null : touchedPaths(changes);
       changesByHash.set(record.refreshedHash, touched);
     }
-    if (touched === null) {
-      report.historyAvailable = false;
-      continue;
-    }
-    const hits = record.files.filter((f) => touched.has(f));
-    if (hits.length > 0) {
-      report.staleDecisions[record.id] = hits;
-    }
+    if (touched === null) report.historyAvailable = false;
+    const hits = touched ? matchingPaths(record.files, touched) : [];
+    const localHits = matchingPaths(record.files, workingTree.changedFiles);
+    return { freshness: touched === null || !workingTree.available ? "unknown" : hits.length || localHits.length ? "changed" : "current", changedFiles: hits };
+  };
+  for (const record of store.records) {
+    if (record.status !== "active") continue;
+    const effective = effectiveDecision(record);
+    const state = await inspect(effective);
+    report.freshness[record.id] = state.freshness;
+    if (state.changedFiles.length) report.staleDecisions[record.id] = state.changedFiles;
+    if (effective !== record) (report.pendingProposals ??= {})[record.id] = await inspect(record);
   }
   return report;
 }
@@ -1056,7 +1291,9 @@ async function computeDecisionDrift(rootDir, decisions) {
 async function checkDecisionAnchors(ctx) {
   const result = emptyResult();
   if (!ctx.decisionsPresent) return result;
-  const records = await loadDecisions(ctx.root);
+  const store = await loadDecisionStore(ctx.root);
+  const records = store.records;
+  for (const diagnostic of store.diagnostics) result.skipped.push({ check: "decision-anchor-drift", reason: `${diagnostic.path}: ${diagnostic.message}` });
   const drift = await computeDecisionDrift(ctx.root, records);
   if (!drift.historyAvailable) {
     result.skipped.push({
@@ -1064,13 +1301,17 @@ async function checkDecisionAnchors(ctx) {
       reason: "some decision base commits are unreachable (shallow clone?)"
     });
   }
-  const byId = new Map(records.map((r) => [r.id, r]));
-  for (const [id, changedFiles] of Object.entries(drift.staleDecisions)) {
-    const record = byId.get(id);
-    if (!record) continue;
+  const changed = records.flatMap((record) => [
+    { record: effectiveDecision(record), changedFiles: drift.staleDecisions[record.id] ?? [], freshness: drift.freshness?.[record.id] ?? "unknown" },
+    { record, changedFiles: drift.pendingProposals?.[record.id]?.changedFiles ?? [], freshness: drift.pendingProposals?.[record.id]?.freshness ?? "unknown" }
+  ]);
+  for (const { record, changedFiles, freshness } of changed) {
+    if (!changedFiles.length) continue;
+    const id = record.id;
+    const provenance = decisionProvenance(record, freshness);
     result.advisories.push({
       type: "decision-anchor-drift",
-      message: `decision "${record.title}" has anchor files that changed since it was verified \u2013 needs human re-verification`,
+      message: `decision "${record.title}" (${provenance.approval}) has anchor files that changed since its evidence baseline \u2013 needs human review`,
       anchor: {
         doc: `.mason/decisions/${id}.json`,
         line: null,
@@ -1078,6 +1319,7 @@ async function checkDecisionAnchors(ctx) {
       },
       evidence: {
         kind: "decision-anchor",
+        provenance,
         decisionId: id,
         title: record.title,
         changedFiles,
@@ -1103,7 +1345,7 @@ function emptyResult() {
 
 // src/audit/audit.ts
 async function computeAudit(rootDir, options = {}) {
-  const resolvedRoot = path13.resolve(rootDir);
+  const resolvedRoot = path15.resolve(rootDir);
   const docs = await discoverDocs(resolvedRoot);
   if (docs.length === 0) return null;
   const headHash = await getCurrentGitHash(resolvedRoot);
@@ -1133,7 +1375,7 @@ async function computeAudit(rootDir, options = {}) {
   }
   let decisionsPresent = false;
   try {
-    await fs9.access(path13.join(resolvedRoot, ".mason", "decisions"));
+    await fs9.access(path15.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -1327,7 +1569,7 @@ async function runAuditCli(argv, io = {
     io.out(USAGE);
     return 0;
   }
-  const rootDir = path14.resolve(args.dir);
+  const rootDir = path16.resolve(args.dir);
   const report = await computeAudit(rootDir, { checks: args.checks });
   if (!report) {
     io.err(