scriptonia 0.8.0 → 0.9.0-rc.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Scriptonia
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -10,9 +10,10 @@ your agent (Claude Code, Codex, OpenClaw, Hermes) executes it into a PR.
 npx scriptonia login
 ```
 
-A browser opens, you sign in, and you're wired: project created, key stored (you
-never see one), and your agent's `AGENTS.md` / skill now know about `scriptonia
-plan`. Then, in your project:
+A browser opens, you sign in, and the project is created, credentials are stored
+locally (you never see a key), and the Claude skill is installed. Run
+`npx scriptonia init` inside each repository to add its `AGENTS.md` contract.
+Then, in your project:
 
 ```sh
 npx scriptonia add feedback.txt call.vtt notes.md   # feed customer signal
@@ -33,10 +34,27 @@ npx scriptonia comment plan/<slug> "default to all actors, and gate behind the a
 | step | command | what happens |
 |---|---|---|
 | **SIGNAL** | `npx scriptonia add <files>` | Ingest text · md · vtt as customer signal (deduped, auto-sourced). |
-| **PLAN** | `npx scriptonia plan "<issue>"` | Retrieve the relevant signal, check prior decisions, and write **PLAN.md** — every claim cites a signal id; contradictions are gated **UNRESOLVED** until a human approves. |
+| **PLAN** | `npx scriptonia plan "<issue>"` | Retrieve cited brain evidence, prove full-census file presence/absence, check prior decisions, and write **PLAN.md**; contradictions stay **UNRESOLVED** until a human approves. |
 | **BUILD** | `claude "execute PLAN.md"` | Your agent implements against the plan's cited criteria and Non-goals fence. |
 | **REFINE** | `npx scriptonia comment plan/<slug> "…"` | A note regenerates the plan (v+1). A comment approving an override flips a contradiction to **RESOLVED**. |
-| **VERIFY** | `npx scriptonia verify` | Check the git diff, unresolved constraints, repo checks, and test coverage. Writes `.scriptonia/evals/<plan>.yaml`; exits 1 on BLOCK. |
+| **VERIFY** | `npx scriptonia verify` | Freeze the Git/product-memory snapshot and consume declared CI/JUnit/static evidence. It never executes repository commands. |
+
+## Build the codebase brain
+
+Run the credential-free structural build once in each repository. It performs
+a full census and real Tree-sitter analysis, stores the evidence in an
+immutable SQLite generation, and activates projections only if coverage and
+reference-integrity gates pass.
+
+```sh
+npx scriptonia brain build --fast --offline
+npx scriptonia brain status --check
+npx scriptonia why source/path/to/file.ts
+```
+
+After the first build, `npx scriptonia brain build --offline` is incremental.
+For cited model enrichment, use `npx scriptonia brain build --deep` after login
+and repository binding; the API credential remains on the Scriptonia server.
 
 ## Commands
 
@@ -46,7 +64,15 @@ signal    add <files>               (--source, --segment, or  cat x | npx script
 plan      plan "<issue>"            (--out <file>, --refresh <slug>)
           plans                     list plans + their slugs
           comment plan/<slug> "…"   refine → regenerates PLAN.md
-verify    verify [--base <ref>]       PLAN.md + git diff → PASS / WARN / BLOCK
+capture   run -- <agent-command>      capture exactly the command supplied
+          runs | run show <id>        inspect captured agent sessions
+verify    diff-check [--base <ref>]   sub-second deterministic policy pass
+          verify [--base <ref>]       complete evidence report
+          gate [--base <ref>]         CI-compatible aggregate exit status
+learn     learn <finding-id>          confirmed finding → draft eval
+          eval run [id] | eval doctor run and maintain regression cases
+memory    decide | pulse | why | recall local-first product/codebase memory
+brain     brain build | brain status    build/inspect immutable codebase generations
 inspect   scriptonia                the loop + what's next
           contexts | query "<topic>" | link "<id>" | sync
 account   status | logout | skill | mcp
@@ -55,12 +81,15 @@ account   status | logout | skill | mcp
 ## One brain per repo (for people juggling projects)
 
 `npx scriptonia init` in a repo gives it its own brain at
-`~/.scriptonia/projects/<slug>/`, scans the code into a repo map (so plan steps
-name real files), and writes an `AGENTS.md` section. Customer signal you submit
-is stored and embedded on Scriptonia's servers; it is not written into the
-repository. The local brain is a human-readable working surface. Initialization
-does not upload the full codebase. When you explicitly run `verify`, the selected
-PLAN.md and git diff are sent for analysis; the YAML regression case stays local.
+`~/.scriptonia/projects/<slug>/`, builds the credential-free Deep Brain, and
+writes an `AGENTS.md` section. The compatibility `REPO.md` in that project is an
+exact copy of the activated full-census, Tree-sitter-backed projection at
+`.scriptonia/REPO.md`; `init` does not create a second shallow repo map.
+Customer signal you submit is stored and embedded on Scriptonia's servers; it
+is not written into the repository. V2 policies, eval definitions, and
+operational brain data are local-first. Deterministic verification does not
+upload the codebase. When semantic evaluation is explicitly enabled, only the
+bounded evidence bundle is sent through the authenticated Scriptonia gateway.
 
 Skip `init` if you have one product — `login → add → plan` uses your default
 brain and scans whatever repo you run `plan` in.
@@ -76,4 +105,5 @@ Exposes `get_context`, `link_back`, `flag_contradiction` from your stored login.
 ## Self-hosting
 
 Defaults to `https://scriptonia.dev`. Point elsewhere with
-`SCRIPTONIA_URL=https://your.host npx scriptonia login` (or `--url`). Node 18+.
+`SCRIPTONIA_URL=https://your.host npx scriptonia login` (or `--url`). Node 24 LTS
+is the V2 release baseline; Node 22 remains in the compatibility matrix.

package/assets/grammar-manifest.json

@@ -0,0 +1,32 @@
+{
+  "schema_version": 1,
+  "runtime": {
+    "package": "web-tree-sitter",
+    "version": "0.25.10",
+    "license": "MIT",
+    "abi_min": 13,
+    "abi_max": 15
+  },
+  "source_package": {
+    "name": "tree-sitter-wasms",
+    "version": "0.1.13",
+    "license": "Unlicense",
+    "repository": "https://github.com/Gregoor/tree-sitter-wasms"
+  },
+  "grammars": [
+    { "id": "bash", "languages": ["shell"], "file": "grammars/tree-sitter-bash.wasm", "package_subpath": "out/tree-sitter-bash.wasm", "sha256": "807dcdb1380a59befb112ed8fbd3d3872c7fadaf5903a769282b50973b30696d", "abi": 14 },
+    { "id": "c", "languages": ["c"], "file": "grammars/tree-sitter-c.wasm", "package_subpath": "out/tree-sitter-c.wasm", "sha256": "056b25072382f72deee2c64ec238ffc4bb8cf42844ef21502c0e70f03a8a0d66", "abi": 14 },
+    { "id": "cpp", "languages": ["cpp"], "file": "grammars/tree-sitter-cpp.wasm", "package_subpath": "out/tree-sitter-cpp.wasm", "sha256": "f6afdf53bfd6de76557bb7edb624a3a3869e14d9a83b78433f93617ecee42527", "abi": 14 },
+    { "id": "dart", "languages": ["dart"], "file": "grammars/tree-sitter-dart.wasm", "package_subpath": "out/tree-sitter-dart.wasm", "sha256": "7f5364e4256cf7e55efd01dd52421ef2663caa8061b82659b7e4bf61064545ec", "abi": 15 },
+    { "id": "go", "languages": ["go"], "file": "grammars/tree-sitter-go.wasm", "package_subpath": "out/tree-sitter-go.wasm", "sha256": "9963ca89b616eaf04b08a43bc1fb0f07b85395bec313330851f1f1ead2f755b6", "abi": 14 },
+    { "id": "java", "languages": ["java"], "file": "grammars/tree-sitter-java.wasm", "package_subpath": "out/tree-sitter-java.wasm", "sha256": "637aac4415fb39a211a4f4292d63c66b5ce9c32fa2cd35464af4f681d91b9a1f", "abi": 14 },
+    { "id": "javascript", "languages": ["javascript"], "file": "grammars/tree-sitter-javascript.wasm", "package_subpath": "out/tree-sitter-javascript.wasm", "sha256": "63812b9e275d26851264734868d27a1656bd44a2ef6eb3e85e6b03728c595ab5", "abi": 14 },
+    { "id": "kotlin", "languages": ["kotlin"], "file": "grammars/tree-sitter-kotlin.wasm", "package_subpath": "out/tree-sitter-kotlin.wasm", "sha256": "b5cb00c8d06ed0f10f1dbe497205b437809d7e87db1f638721a8cfb30e044449", "abi": 14 },
+    { "id": "objective-c", "languages": ["objective-c"], "file": "grammars/tree-sitter-objc.wasm", "package_subpath": "out/tree-sitter-objc.wasm", "sha256": "7c1b5bfdca7e64b6c63b6040bb7ba0afc347df116f9030ca32f8535d7377f6ff", "abi": 14 },
+    { "id": "python", "languages": ["python"], "file": "grammars/tree-sitter-python.wasm", "package_subpath": "out/tree-sitter-python.wasm", "sha256": "9056d0fb0c337810d019fae350e8167786119da98f0f282aceae7ab89ee8253b", "abi": 14 },
+    { "id": "rust", "languages": ["rust"], "file": "grammars/tree-sitter-rust.wasm", "package_subpath": "out/tree-sitter-rust.wasm", "sha256": "4409921a70d0aa5bec7d1d7ce809a557a8ee1cf6ace901e3ac6a76e62cfea903", "abi": 14 },
+    { "id": "swift", "languages": ["swift"], "file": "grammars/tree-sitter-swift.wasm", "package_subpath": "out/tree-sitter-swift.wasm", "sha256": "41c4fdb2249a3aa6d87eed0d383081ff09725c2248b4977043a43825980ffcc7", "abi": 13 },
+    { "id": "tsx", "languages": ["typescript"], "extensions": [".tsx", ".jsx"], "file": "grammars/tree-sitter-tsx.wasm", "package_subpath": "out/tree-sitter-tsx.wasm", "sha256": "6aa3b2c70e76f5d48eafef1093e9c4de383e13f2fdde2f4e9b98a378f6a8f1b6", "abi": 14 },
+    { "id": "typescript", "languages": ["typescript"], "extensions": [".ts", ".mts", ".cts"], "file": "grammars/tree-sitter-typescript.wasm", "package_subpath": "out/tree-sitter-typescript.wasm", "sha256": "8515404dceed38e1ed86aa34b09fcf3379fff1b4ff9dd3967bcd6d1eb5ac3d8f", "abi": 14 }
+  ]
+}

package/assets/licenses/tree-sitter-wasms-LICENSE

@@ -0,0 +1,24 @@
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>

package/assets/licenses/web-tree-sitter-LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2018-2024 Max Brunsfeld
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/queries/manifest.json

@@ -0,0 +1,12 @@
+{
+  "schema_version": 1,
+  "query_version": "1",
+  "queries": [
+    { "id": "dart", "languages": ["dart"], "file": "v1/dart.scm", "sample_path": "lib/app.dart" },
+    { "id": "go", "languages": ["go"], "file": "v1/go.scm", "sample_path": "main.go" },
+    { "id": "javascript", "languages": ["javascript"], "file": "v1/javascript.scm", "sample_path": "src/index.js" },
+    { "id": "python", "languages": ["python"], "file": "v1/python.scm", "sample_path": "app.py" },
+    { "id": "typescript", "languages": ["typescript"], "extensions": [".ts", ".mts", ".cts"], "file": "v1/typescript.scm", "sample_path": "src/index.ts" },
+    { "id": "tsx", "languages": ["typescript"], "extensions": [".tsx", ".jsx"], "file": "v1/typescript.scm", "sample_path": "src/view.tsx" }
+  ]
+}

package/assets/queries/v1/dart.scm

@@ -0,0 +1,7 @@
+; Deep Brain AST queries v1 — Dart
+(class_definition) @symbol
+(function_signature) @symbol
+(method_signature) @symbol
+(getter_signature) @symbol
+(setter_signature) @symbol
+(import_or_export) @import

package/assets/queries/v1/go.scm

@@ -0,0 +1,5 @@
+; Deep Brain AST queries v1 — Go
+(function_declaration) @symbol
+(method_declaration) @symbol
+(type_declaration) @symbol
+(import_declaration) @import

package/assets/queries/v1/javascript.scm

@@ -0,0 +1,15 @@
+; Deep Brain AST queries v1 — JavaScript/JSX
+(function_declaration) @symbol
+(class_declaration) @symbol
+(method_definition) @symbol
+(lexical_declaration
+  (variable_declarator
+    value: [(arrow_function) (function_expression)])) @symbol
+(import_statement) @import
+(export_statement
+  source: (string)) @import
+((call_expression
+  function: (import)) @dynamic_import)
+((call_expression
+  function: (identifier) @require_callee) @dynamic_import
+  (#eq? @require_callee "require"))

package/assets/queries/v1/python.scm

@@ -0,0 +1,5 @@
+; Deep Brain AST queries v1 — Python
+(class_definition) @symbol
+(function_definition) @symbol
+(import_statement) @import
+(import_from_statement) @import

package/assets/queries/v1/typescript.scm

@@ -0,0 +1,17 @@
+; Deep Brain AST queries v1 — TypeScript/TSX
+(function_declaration) @symbol
+(class_declaration) @symbol
+(method_definition) @symbol
+(interface_declaration) @symbol
+(type_alias_declaration) @symbol
+(lexical_declaration
+  (variable_declarator
+    value: [(arrow_function) (function_expression)])) @symbol
+(import_statement) @import
+(export_statement
+  source: (string)) @import
+((call_expression
+  function: (import)) @dynamic_import)
+((call_expression
+  function: (identifier) @require_callee) @dynamic_import
+  (#eq? @require_callee "require"))