wendkeep 0.60.0 → 0.62.0

package/hooks/sensors-core.mjs

@@ -1,102 +1 @@
-// hooks/sensors-core.mjs — native sensor runner + evidence gate (Pilar C).
-// Pure-ish: `spawn` is injectable so runs are testable without a shell. Config lives
-// at the PROJECT ROOT (wendkeep.sensors.json); evidence lives per-change in the vault.
-import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-
-export const SENSOR_VAULT_ENV = 'WENDKEEP_SENSOR_VAULT';
-
-export function sensorProcessEnv(vaultBase, inherited = process.env) {
-  return {
-    ...inherited,
-    OBSIDIAN_VAULT_PATH: vaultBase,
-    [SENSOR_VAULT_ENV]: vaultBase,
-  };
-}
-
-export function loadSensors(projectRoot, file = 'wendkeep.sensors.json') {
-  return loadSensorsDetailed(projectRoot, file).sensors;
-}
-
-// Missing config and broken config are different failures: absent file usually means
-// wrong cwd (subdirectory), broken JSON means the config itself needs fixing. Collapsing
-// both into [] made every sensor report "sensor não definido" — a misleading diagnosis.
-export function loadSensorsDetailed(projectRoot, file = 'wendkeep.sensors.json') {
-  const path = join(projectRoot, file);
-  if (!existsSync(path)) return { sensors: [], missing: true, error: null, path };
-  try {
-    const data = JSON.parse(readFileSync(path, 'utf8'));
-    return { sensors: Array.isArray(data.sensors) ? data.sensors : [], missing: false, error: null, path };
-  } catch (e) {
-    return { sensors: [], missing: false, error: e.message, path };
-  }
-}
-
-// Climb the directory tree looking for a project marker (wendkeep.sensors.json or
-// .wendkeep.json), like git does with .git — shells in agent harnesses keep their cwd
-// across commands, so verify is often run from a subdirectory.
-export function findProjectRoot(startDir) {
-  let dir = resolve(startDir);
-  for (;;) {
-    if (existsSync(join(dir, 'wendkeep.sensors.json')) || existsSync(join(dir, '.wendkeep.json'))) return dir;
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-}
-
-export function requiredSensors(tasks) {
-  return [...new Set((tasks || []).flatMap((task) => (
-    Array.isArray(task.sensors) && task.sensors.length ? task.sensors : [task.sensor]
-  )).filter(Boolean))];
-}
-
-export function runSensors(sensors, ids, { spawn = spawnSync, cwd, env, now } = {}) {
-  const byId = Object.fromEntries((sensors || []).map((s) => [s.id, s]));
-  const ts = now || new Date().toISOString();
-  const evidence = [];
-  for (const id of ids) {
-    const s = byId[id];
-    if (!s) { evidence.push({ id, status: 'red', ts, severity: 'critical', note: 'sensor não definido' }); continue; }
-    const r = spawn(s.command, [], { cwd, shell: true, stdio: 'ignore', ...(env ? { env } : {}) });
-    const entry = { id, status: (r.status ?? 1) === 0 ? 'green' : 'red', ts, severity: s.severity || 'critical' };
-    if (s.type === 'mutation' && s.report) {
-      // Delegated mutation (Wave B): read the tool's mutation-testing-elements report and
-      // attach surviving mutants so verify can turn them into fix tasks.
-      try { entry.survivors = parseMutationReport(JSON.parse(readFileSync(join(cwd || '.', s.report), 'utf8'))); }
-      catch { /* report ausente/ilegível — segue só com o exit code */ }
-    }
-    evidence.push(entry);
-  }
-  return evidence;
-}
-
-// Parse a mutation-testing-elements report (Stryker et al.): return surviving mutants
-// (Survived | NoCoverage) as {file, line, mutator}.
-export function parseMutationReport(json) {
-  const out = [];
-  const files = json && json.files ? json.files : {};
-  for (const [file, data] of Object.entries(files)) {
-    for (const m of (data && data.mutants) || []) {
-      if (m.status === 'Survived' || m.status === 'NoCoverage') {
-        out.push({ file, line: m.location && m.location.start ? m.location.start.line : null, mutator: m.mutatorName || 'unknown' });
-      }
-    }
-  }
-  return out;
-}
-
-// A required sensor blocks the gate when it is missing (never verified) or red at a
-// non-warning severity. Warnings are advisory: a red warning does not block archive.
-// Severity comes from the evidence entry (written by runSensors); absent -> critical.
-export function evaluateGate(evidence, requiredIds) {
-  const byId = Object.fromEntries((evidence || []).map((e) => [e.id, e]));
-  const failing = (requiredIds || []).filter((id) => {
-    const e = byId[id];
-    if (!e) return true; // never verified
-    if (e.status === 'green') return false;
-    return (e.severity || 'critical') !== 'warning';
-  });
-  return { ok: failing.length === 0, failing };
-}
+export * from '../packages/harness/src/sensors-core.mjs';

package/package.json

@@ -1,13 +1,15 @@
 {
   "name": "wendkeep",
-  "version": "0.60.0",
+  "version": "0.62.0",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [
     "packages/*"
   ],
   "exports": {
-    "./vault": "./packages/vault/src/index.mjs"
+    "./harness": "./packages/harness/src/index.mjs",
+    "./vault": "./packages/vault/src/index.mjs",
+    "./*": "./*"
   },
   "bin": {
     "wendkeep": "bin/wendkeep.mjs",
@@ -29,7 +31,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "check": "node --check bin/wendkeep.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/project-vault.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs",
+    "check": "node --check bin/wendkeep.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/project-vault.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
     "test": "node --test",
     "release": "node scripts/release.mjs",
     "release:dry": "node scripts/release.mjs --dry-run",
@@ -58,6 +60,7 @@
     "url": "https://github.com/rogersialves/wendkeep/issues"
   },
   "devDependencies": {
+    "acorn": "^8.18.0",
     "wendkeep": "^0.57.2"
   }
 }

package/packages/harness/package.json

@@ -1,5 +1,6 @@
 {
   "name": "@wendkeep/harness",
   "private": true,
-  "type": "module"
+  "type": "module",
+  "exports": "./src/index.mjs"
 }

package/packages/harness/src/index.mjs

@@ -0,0 +1,2 @@
+export * from './operating-profile.mjs';
+export * from './sensors-core.mjs';

package/packages/harness/src/operating-profile.mjs

@@ -0,0 +1,133 @@
+export const OPERATING_PROFILES = Object.freeze([
+  'OFF',
+  'FLOW',
+  'GUIDE',
+  'GOVERN',
+  'ASSURE',
+]);
+export const DEFAULT_OPERATING_PROFILE = 'GOVERN';
+
+const PROFILE_SET = new Set(OPERATING_PROFILES);
+
+function policy(profile, route, options) {
+  return Object.freeze({
+    profile,
+    route: Object.freeze(route),
+    keepCore: true,
+    ...options,
+  });
+}
+
+export const OPERATING_PROFILE_POLICIES = Object.freeze({
+  OFF: policy('OFF', ['LLM'], {
+    harness: false,
+    contract: 'native',
+    requiresChange: false,
+    requiresReview: false,
+    requiresConfirmation: false,
+  }),
+  FLOW: policy('FLOW', ['E', 'V'], {
+    harness: true,
+    contract: 'flow',
+    requiresChange: false,
+    requiresReview: false,
+    requiresConfirmation: false,
+  }),
+  GUIDE: policy('GUIDE', ['P', 'E', 'V'], {
+    harness: true,
+    contract: 'simple-change',
+    requiresChange: true,
+    requiresReview: false,
+    requiresConfirmation: false,
+  }),
+  GOVERN: policy('GOVERN', ['P', 'R', 'E', 'V'], {
+    harness: true,
+    contract: 'change',
+    requiresChange: true,
+    requiresReview: true,
+    requiresConfirmation: false,
+  }),
+  ASSURE: policy('ASSURE', ['P', 'R', 'E', 'V', 'C'], {
+    harness: true,
+    contract: 'change',
+    requiresChange: true,
+    requiresReview: true,
+    requiresConfirmation: true,
+  }),
+});
+
+function invalidProfileError(value) {
+  const rendered = typeof value === 'string' ? `"${value}"` : String(value);
+  const error = new Error(
+    `Perfil de Operação inválido: ${rendered}. Use ${OPERATING_PROFILES.join(', ')}.`,
+  );
+  error.code = 'WENDKEEP_OPERATING_PROFILE_INVALID';
+  return error;
+}
+
+function canonicalProfile(value) {
+  if (typeof value !== 'string') return '';
+  return value.trim().toUpperCase();
+}
+
+export function normalizeOperatingProfile(value, { strict = false } = {}) {
+  const normalized = canonicalProfile(value);
+  if (PROFILE_SET.has(normalized)) return normalized;
+  if (strict) throw invalidProfileError(value);
+  return DEFAULT_OPERATING_PROFILE;
+}
+
+export function resolveOperatingProfile(config = {}) {
+  const harness = config && typeof config === 'object' && !Array.isArray(config)
+    && config.harness && typeof config.harness === 'object' && !Array.isArray(config.harness)
+    ? config.harness
+    : null;
+  const configured = !!harness && Object.prototype.hasOwnProperty.call(harness, 'profile');
+  if (!configured) {
+    return {
+      profile: DEFAULT_OPERATING_PROFILE,
+      source: 'default',
+      valid: true,
+      configured: false,
+      raw: null,
+    };
+  }
+
+  const raw = harness.profile;
+  const normalized = canonicalProfile(raw);
+  if (PROFILE_SET.has(normalized)) {
+    return {
+      profile: normalized,
+      source: 'project-binding',
+      valid: true,
+      configured: true,
+      raw,
+    };
+  }
+  return {
+    profile: DEFAULT_OPERATING_PROFILE,
+    source: 'default-invalid',
+    valid: false,
+    configured: true,
+    raw,
+  };
+}
+
+export function operatingProfilePolicy(value) {
+  return OPERATING_PROFILE_POLICIES[normalizeOperatingProfile(value)];
+}
+
+export function setOperatingProfile(config = {}, value) {
+  const profile = normalizeOperatingProfile(value, { strict: true });
+  const base = config && typeof config === 'object' && !Array.isArray(config) ? config : {};
+  const harness = base.harness && typeof base.harness === 'object' && !Array.isArray(base.harness)
+    ? base.harness
+    : {};
+  return {
+    ...base,
+    harness: {
+      ...harness,
+      profile,
+    },
+  };
+}

package/packages/harness/src/sensors-core.mjs

@@ -0,0 +1,102 @@
+// hooks/sensors-core.mjs — native sensor runner + evidence gate (Pilar C).
+// Pure-ish: `spawn` is injectable so runs are testable without a shell. Config lives
+// at the PROJECT ROOT (wendkeep.sensors.json); evidence lives per-change in the vault.
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+
+export const SENSOR_VAULT_ENV = 'WENDKEEP_SENSOR_VAULT';
+
+export function sensorProcessEnv(vaultBase, inherited = process.env) {
+  return {
+    ...inherited,
+    OBSIDIAN_VAULT_PATH: vaultBase,
+    [SENSOR_VAULT_ENV]: vaultBase,
+  };
+}
+
+export function loadSensors(projectRoot, file = 'wendkeep.sensors.json') {
+  return loadSensorsDetailed(projectRoot, file).sensors;
+}
+
+// Missing config and broken config are different failures: absent file usually means
+// wrong cwd (subdirectory), broken JSON means the config itself needs fixing. Collapsing
+// both into [] made every sensor report "sensor não definido" — a misleading diagnosis.
+export function loadSensorsDetailed(projectRoot, file = 'wendkeep.sensors.json') {
+  const path = join(projectRoot, file);
+  if (!existsSync(path)) return { sensors: [], missing: true, error: null, path };
+  try {
+    const data = JSON.parse(readFileSync(path, 'utf8'));
+    return { sensors: Array.isArray(data.sensors) ? data.sensors : [], missing: false, error: null, path };
+  } catch (e) {
+    return { sensors: [], missing: false, error: e.message, path };
+  }
+}
+
+// Climb the directory tree looking for a project marker (wendkeep.sensors.json or
+// .wendkeep.json), like git does with .git — shells in agent harnesses keep their cwd
+// across commands, so verify is often run from a subdirectory.
+export function findProjectRoot(startDir) {
+  let dir = resolve(startDir);
+  for (;;) {
+    if (existsSync(join(dir, 'wendkeep.sensors.json')) || existsSync(join(dir, '.wendkeep.json'))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+export function requiredSensors(tasks) {
+  return [...new Set((tasks || []).flatMap((task) => (
+    Array.isArray(task.sensors) && task.sensors.length ? task.sensors : [task.sensor]
+  )).filter(Boolean))];
+}
+
+export function runSensors(sensors, ids, { spawn = spawnSync, cwd, env, now } = {}) {
+  const byId = Object.fromEntries((sensors || []).map((s) => [s.id, s]));
+  const ts = now || new Date().toISOString();
+  const evidence = [];
+  for (const id of ids) {
+    const s = byId[id];
+    if (!s) { evidence.push({ id, status: 'red', ts, severity: 'critical', note: 'sensor não definido' }); continue; }
+    const r = spawn(s.command, [], { cwd, shell: true, stdio: 'ignore', ...(env ? { env } : {}) });
+    const entry = { id, status: (r.status ?? 1) === 0 ? 'green' : 'red', ts, severity: s.severity || 'critical' };
+    if (s.type === 'mutation' && s.report) {
+      // Delegated mutation (Wave B): read the tool's mutation-testing-elements report and
+      // attach surviving mutants so verify can turn them into fix tasks.
+      try { entry.survivors = parseMutationReport(JSON.parse(readFileSync(join(cwd || '.', s.report), 'utf8'))); }
+      catch { /* report ausente/ilegível — segue só com o exit code */ }
+    }
+    evidence.push(entry);
+  }
+  return evidence;
+}
+
+// Parse a mutation-testing-elements report (Stryker et al.): return surviving mutants
+// (Survived | NoCoverage) as {file, line, mutator}.
+export function parseMutationReport(json) {
+  const out = [];
+  const files = json && json.files ? json.files : {};
+  for (const [file, data] of Object.entries(files)) {
+    for (const m of (data && data.mutants) || []) {
+      if (m.status === 'Survived' || m.status === 'NoCoverage') {
+        out.push({ file, line: m.location && m.location.start ? m.location.start.line : null, mutator: m.mutatorName || 'unknown' });
+      }
+    }
+  }
+  return out;
+}
+
+// A required sensor blocks the gate when it is missing (never verified) or red at a
+// non-warning severity. Warnings are advisory: a red warning does not block archive.
+// Severity comes from the evidence entry (written by runSensors); absent -> critical.
+export function evaluateGate(evidence, requiredIds) {
+  const byId = Object.fromEntries((evidence || []).map((e) => [e.id, e]));
+  const failing = (requiredIds || []).filter((id) => {
+    const e = byId[id];
+    if (!e) return true; // never verified
+    if (e.status === 'green') return false;
+    return (e.severity || 'critical') !== 'warning';
+  });
+  return { ok: failing.length === 0, failing };
+}

package/packages/vault/src/index.mjs

@@ -1,2 +1,8 @@
 export * from './project-vault.mjs';
 export * from './vault-path-safety.mjs';
+export * from './memory-schema.mjs';
+export * from './memory-mode.mjs';
+export * from './memory-handoff.mjs';
+export * from './memory-store.mjs';
+export * from './validate-core.mjs';
+export * from './validate-memory.mjs';

package/packages/vault/src/memory-handoff.mjs

@@ -0,0 +1,199 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { basename, join, relative } from 'node:path';
+
+import { sanitizeMemoryText } from './memory-schema.mjs';
+
+function canonicalValue(value) {
+  if (Array.isArray(value)) return value.map(canonicalValue);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonicalValue(value[key])]));
+}
+
+function eventId(context, memoryKey, value) {
+  const digest = createHash('sha256')
+    .update(JSON.stringify([
+      context.projectId,
+      context.identity?.canonicalConversationId,
+      context.activation?.id,
+      context.turn?.id,
+      memoryKey,
+      canonicalValue(value),
+    ]))
+    .digest('hex')
+    .slice(0, 24);
+  return `mem-${digest}`;
+}
+
+function makeEvent(context, { memoryKey, value, authority, evidence }) {
+  const cleanValue = typeof value === 'string' ? sanitizeMemoryText(value) : canonicalValue(value);
+  return {
+    v: 1,
+    event_id: eventId(context, memoryKey, cleanValue),
+    project_id: String(context.projectId || ''),
+    memory_key: memoryKey,
+    operation: 'assert',
+    value: cleanValue,
+    authority,
+    canonical_session_id: String(context.identity?.canonicalConversationId || ''),
+    activation_id: String(context.activation?.id || ''),
+    activation_epoch: Number(context.activation?.epoch || 0),
+    turn_sequence: Number(context.turn?.sequence || 0),
+    source_turn_id: String(context.turn?.id || ''),
+    observed_at: context.observedAt,
+    evidence: (evidence || []).filter(Boolean).map((item) => sanitizeMemoryText(item)),
+  };
+}
+
+function readJson(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; }
+}
+
+function filesBelow(dir, accept, found = []) {
+  let entries = [];
+  try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return found; }
+  for (const entry of entries) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) filesBelow(path, accept, found);
+    else if (accept(entry.name)) found.push(path);
+  }
+  return found;
+}
+
+function vaultRel(vaultBase, path) {
+  return relative(vaultBase, path).replaceAll('\\', '/');
+}
+
+function nextActionFrom(summary) {
+  const match = String(summary || '').match(/(?:a\s+)?pr[oó]xima\s+(?:change\s+)?(?:ser[aá]|[ée]|:)\s+(?:a\s+)?([^.!?\n]+)/i);
+  if (!match) return null;
+  const text = sanitizeMemoryText(match[1].trim());
+  const id = text.normalize('NFD').replace(/[\u0300-\u036f]/g, '').toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '').slice(0, 64);
+  return id && text ? { id, summary: text } : null;
+}
+
+export function collectLifecycleEvidence(vaultBase, { changeSlug = '', summary = '', noteRel = '' } = {}) {
+  const evidence = {};
+  const slug = String(changeSlug || '').trim();
+  if (slug) {
+    const changeRoots = ['08-Mudanças', '08-Changes'];
+    let archivedDir = '';
+    for (const root of changeRoots) {
+      const archive = join(vaultBase, root, '_arquivo');
+      let names = [];
+      try { names = readdirSync(archive, { withFileTypes: true }); } catch { /* absent locale */ }
+      const match = names.find((entry) => entry.isDirectory() && (entry.name === slug || entry.name.endsWith(`-${slug}`)));
+      if (match) { archivedDir = join(archive, match.name); break; }
+    }
+
+    const adrPattern = new RegExp(`^ADR-(\\d{4})-${slug.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\.md$`, 'i');
+    const adrPath = filesBelow(vaultBase, (name) => adrPattern.test(name))[0];
+    if (archivedDir && adrPath) {
+      const adr = (basename(adrPath).match(/^ADR-\d{4}/i) || [''])[0].toUpperCase();
+      evidence.change = { slug, status: 'archived', adr, path: vaultRel(vaultBase, adrPath) };
+      const verdictPath = join(archivedDir, 'verdict.json');
+      const verdict = readJson(verdictPath);
+      if (verdict && typeof verdict.ok === 'boolean' && Array.isArray(verdict.coverage)) {
+        evidence.verdict = {
+          ok: verdict.ok,
+          covered: verdict.coverage.filter((item) => item?.covered === true).length,
+          total: verdict.coverage.length,
+          path: vaultRel(vaultBase, verdictPath),
+        };
+      }
+      const sensorPath = join(archivedDir, 'evidencia.json');
+      const sensors = readJson(sensorPath);
+      if (Array.isArray(sensors) && sensors.length && sensors.every((item) => item?.status === 'green')) {
+        evidence.sensors = [...new Set(sensors.map((item) => String(item.id || '')).filter(Boolean))].sort();
+      }
+    }
+  }
+
+  const nextAction = nextActionFrom(summary);
+  if (nextAction) evidence.nextAction = nextAction;
+  const commit = String(summary || '').match(/\b[0-9a-f]{40}\b/i)?.[0];
+  if (commit) {
+    evidence.git = {
+      commit: commit.toLowerCase(),
+      pushed: !/(?:nenhum|sem)\s+push/i.test(String(summary || '')),
+      verified: false,
+      path: noteRel,
+    };
+  }
+  return evidence;
+}
+
+export function buildSessionMemoryEvents({
+  projectId,
+  identity,
+  activation,
+  turn,
+  noteRel,
+  observedAt,
+  summary,
+  evidence = {},
+}) {
+  const context = { projectId, identity, activation, turn, observedAt };
+  const events = [makeEvent(context, {
+    memoryKey: 'handoff.latest',
+    value: sanitizeMemoryText(summary),
+    authority: 'reported',
+    evidence: [noteRel],
+  })];
+
+  if (evidence.change?.slug && evidence.change?.status && evidence.change?.adr) {
+    events.push(makeEvent(context, {
+      memoryKey: `change.${evidence.change.slug}.status`,
+      value: { status: evidence.change.status, adr: evidence.change.adr },
+      authority: 'verified',
+      evidence: [evidence.change.path || evidence.change.adr],
+    }));
+  }
+
+  if (evidence.verdict?.path && typeof evidence.verdict.ok === 'boolean') {
+    events.push(makeEvent(context, {
+      memoryKey: 'quality.latest-verdict',
+      value: {
+        ok: evidence.verdict.ok,
+        covered: Number(evidence.verdict.covered || 0),
+        total: Number(evidence.verdict.total || 0),
+      },
+      authority: 'verified',
+      evidence: [evidence.verdict.path],
+    }));
+  }
+
+  if (Array.isArray(evidence.sensors) && evidence.sensors.length) {
+    events.push(makeEvent(context, {
+      memoryKey: 'quality.latest-sensors',
+      value: [...new Set(evidence.sensors.map(String))].sort(),
+      authority: 'verified',
+      evidence: evidence.sensors,
+    }));
+  }
+
+  if (evidence.git?.commit) {
+    events.push(makeEvent(context, {
+      memoryKey: 'git.local-head',
+      value: {
+        commit: evidence.git.commit,
+        pushed: Boolean(evidence.git.pushed),
+        push_status: evidence.git.pushed ? 'pushed' : 'nenhum push',
+      },
+      authority: evidence.git.verified === false ? 'reported' : 'verified',
+      evidence: [evidence.git.path || evidence.git.commit],
+    }));
+  }
+
+  if (evidence.nextAction?.id && evidence.nextAction?.summary) {
+    events.push(makeEvent(context, {
+      memoryKey: `next.${evidence.nextAction.id}`,
+      value: sanitizeMemoryText(evidence.nextAction.summary),
+      authority: 'verified',
+      evidence: [noteRel],
+    }));
+  }
+
+  return events;
+}