wendkeep 0.72.0 → 0.73.0

package/packages/cli/src/index.mjs

@@ -48,9 +48,9 @@ Usage:
                            package first (npm i -D wendkeep@latest); a running process
                            cannot replace itself. · --vault P · --profile <name> · --yes.
 
-  wendkeep doctor [--vault P]  Run a vault health check.
+  wendkeep doctor [--vault P]  Health check. --scope core|runtime · --strict for CI/release.
   wendkeep observer <sub>     Local multi-project Observer: serve | register | publish | status.
-  wendkeep change <sub>        Change lifecycle: new [--simple] | use | bind <slug> --session <id> | continue | list | show |
+  wendkeep change <sub>        Change lifecycle: new [--simple|--guide] | use | bind <slug> --session <id> | continue | list | show |
                            status | done <id> | undone <id> | diff | archive [--force] | abandon | relink | backlink.
                            archive exige verdict (rode verify --deep); abandon descarta sem ADR.
                            backlink [--apply]: injeta o backlink pro proposta em design/tarefas/spec órfãos (open + _arquivo).
@@ -62,6 +62,8 @@ Usage:
                            the project default. The Vault/session/memory core is always active.
   wendkeep flow <sub>          Low-ceremony E -> V contract: start | status | show | finish | promote.
                            FLOW records scope, sensors and a receipt without creating a change.
+  wendkeep delivery <sub>      Operational delivery: start | status | finish | abandon.
+                           Records authorization and an append-only receipt; never creates a change/spec/ADR.
   wendkeep spec <sub>          Specs: list | show | effective [--change] [--json] | migrate | rebase.
   wendkeep sensors <sub>       list | add <id> "<command>" [--severity --type --report].
   wendkeep cost [opts]         Aggregate AI-coding spend across the vault's sessions.
@@ -184,6 +186,9 @@ async function main(argv) {
     if (cmd === 'flow') {
       const { FLOW_HELP } = await import('../../../src/flow.mjs');
       process.stdout.write(FLOW_HELP);
+    } else if (cmd === 'delivery') {
+      const { DELIVERY_HELP } = await import('../../../src/delivery.mjs');
+      process.stdout.write(DELIVERY_HELP);
     } else if (cmd === 'profile') {
       const { PROFILE_HELP } = await import('../../../src/profile.mjs');
       process.stdout.write(PROFILE_HELP);
@@ -273,6 +278,11 @@ async function main(argv) {
       process.exit(await runFlow(rest));
       break;
     }
+    case 'delivery': {
+      const { runDelivery } = await import('../../../src/delivery.mjs');
+      process.exit(runDelivery(rest));
+      break;
+    }
     case 'theme': {
       const { runTheme } = await import('../../../src/theme.mjs');
       runTheme(rest);

package/packages/integrations/src/host-hooks.mjs

@@ -32,7 +32,7 @@ export const SESSION_HOOKS = [
 ];
 
 export function hookCommand(name) {
-  return `npx wendkeep hook ${name}`;
+  return `npx --no-install wendkeep hook ${name}`;
 }
 
 // Forma node-direta do comando de hook: 1 processo (~100-250ms) em vez dos 3 do npx (cold-start

package/packages/vault/src/memory-store.mjs

@@ -112,12 +112,25 @@ function readCheckedMemoryFile(vaultBase, path, encoding, label, { allowMissing
   return readFileSync(checked.target, encoding);
 }
 
+export function memoryFileIdentityMatches(descriptor, target, {
+  platform = process.platform,
+} = {}) {
+  if (descriptor.ino !== target.ino) return false;
+  // libuv before 1.51 can report an inconsistent Windows volume serial number
+  // between stat(path) and fstat(fd). The inode is still the file index; path
+  // containment/reparse checks and nlink validation remain independent guards.
+  return platform === 'win32' || descriptor.dev === target.dev;
+}
+
 function assertOpenedMemoryFile(vaultBase, path, fd, label) {
   const checked = checkedMemoryFile(vaultBase, path, label, { allowMissing: false });
-  const descriptor = fstatSync(fd);
-  const target = statSync(checked.target);
-  if (!descriptor.isFile() || descriptor.nlink > 1 || target.nlink > 1
-      || descriptor.dev !== target.dev || descriptor.ino !== target.ino) {
+  // Windows file identities can exceed Number's safe integer range. Node 22.13 may
+  // round stat(path) and fstat(fd) differently for the same file, so compare the
+  // exact bigint values and keep nlink as the independent hardlink guard.
+  const descriptor = fstatSync(fd, { bigint: true });
+  const target = statSync(checked.target, { bigint: true });
+  if (!descriptor.isFile() || descriptor.nlink > 1n || target.nlink > 1n
+      || !memoryFileIdentityMatches(descriptor, target)) {
     throw unsafeMemoryPath(`${label} mudou de inode ou possui hardlink antes da mutação: ${checked.target}`);
   }
   return checked.target;

package/src/change.mjs

@@ -16,6 +16,7 @@ import {
   relinkChanges,
   backfillArtifactLinks,
   scaffoldPlaceholders,
+  isGuideCompactChange,
 } from '../hooks/change-core.mjs';
 import { evaluateGate, requiredSensors } from '../hooks/sensors-core.mjs';
 import { buildEffectiveRequirementPackage, evaluateVerdict, formatOrphanReqs, tasksHashOf, parseSpecsList, parseDelta, parseRequirements, applyDelta, validateSpecImpact } from '../hooks/spec-core.mjs';
@@ -61,7 +62,9 @@ export function runChange(argv) {
     // G2: link the active session into the proposta's source: (graph edge proposta->sessão).
     let sessionRel = '';
     try { sessionRel = readControl(vaultBase).session_file || ''; } catch { /* sem control */ }
-    const r = newChange(vaultBase, slug, { dateStr: today(), simple: rest.includes('--simple'), sessionRel });
+    const r = newChange(vaultBase, slug, {
+      dateStr: today(), simple: rest.includes('--simple'), guide: rest.includes('--guide'), sessionRel,
+    });
     process.stdout.write(`change ${r.created ? 'created' : 'exists'}: ${r.rel} (active)\n`);
     process.exit(0);
   }
@@ -97,7 +100,7 @@ export function runChange(argv) {
     let sessionRel = '';
     try { sessionRel = readControl(vaultBase).session_file || ''; } catch { /* no control */ }
     const r = continueChange(vaultBase, archivedSlug, newSlug, {
-      dateStr: today(), simple: rest.includes('--simple'), sessionRel,
+      dateStr: today(), simple: rest.includes('--simple'), guide: rest.includes('--guide'), sessionRel,
     });
     if (!r.ok) { process.stderr.write(`wendkeep change continue: ${r.error}\n`); process.exit(2); }
     process.stdout.write(`change created: ${r.rel} (continues ${r.archived}; active)\n`);
@@ -287,13 +290,16 @@ export function runChange(argv) {
     try { tasks = parseTasks(readFileSync(join(vaultBase, getLocale(vaultBase).folders.changes, slug, 'tarefas.md'), 'utf8')); } catch { /* sem tarefas */ }
     const forced = rest.includes('--force') && tasks.some((t) => !t.done);
     const trivial = !tasks.some((t) => t.req) && !tasks.some((t) => t.sensor);
-    if (trivial) process.stderr.write('aviso: change trivial (sem [req:]/[sensor:]) — ADR marcado trivial: true\n');
+    const compactGuide = isGuideCompactChange(join(vaultBase, getLocale(vaultBase).folders.changes, slug));
+    if (trivial) process.stderr.write(compactGuide
+      ? 'aviso: GUIDE compacta sem [req:]/[sensor:] — resultado permanece auditável no archive, sem ADR automático\n'
+      : 'aviso: change trivial (sem [req:]/[sensor:]) — ADR marcado trivial: true\n');
     const r = archiveChange(vaultBase, slug, { dateStr: today(), adrNum: getNextAdrNumber(vaultBase), gate, adrFlags: { forced, trivial } });
     if (!r.ok) {
       process.stderr.write(`change archive BLOCKED (gate): ${r.failing.join('; ')}\n`);
       process.exit(1);
     }
-    process.stdout.write(`archived: ${r.archivedRel}; ADR: ${r.adrRel}\n`);
+    process.stdout.write(`archived: ${r.archivedRel}${r.adrRel ? `; ADR: ${r.adrRel}` : '; GUIDE compacta: sem ADR'}\n`);
     if (r.promoted && r.promoted.length) process.stdout.write(`specs promovidas: ${r.promoted.join(', ')}\n`);
     if (r.specWarnings && r.specWarnings.length) for (const w of r.specWarnings) process.stderr.write(`  aviso spec: ${w}\n`);
     process.exit(0);

package/src/delivery.mjs

@@ -0,0 +1,303 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { basename, join, resolve } from 'node:path';
+import {
+  assertVaultPathSafe, mkdirVaultPath, writeVaultFileSync,
+} from '../hooks/vault-path-safety.mjs';
+import { resolveProjectVault } from './project-vault.mjs';
+import { createWorkRoute } from './work-kind.mjs';
+
+export const DELIVERY_HELP = `wendkeep delivery <subcommand>
+
+  start [id] --allow <capability> [--source-change <slug>] [--source-commit <sha>]
+  status [id]
+  finish [id] [--target <ref>] [--ci-url <url>] [--version <x.y.z>]
+              [--npm-integrity <sha512-...>] [--release-url <url>]
+  abandon [id] --reason <text>
+
+Common options: --project <path> --vault <path> --json
+Delivery authorizes operational risk and creates an append-only receipt. It never creates a change,
+spec, or ADR. If code/config must change, abandon or pause delivery and resume an implementation.
+`;
+
+export const DELIVERY_CAPABILITIES = Object.freeze([
+  'git:merge', 'git:pull', 'git:push', 'git:tag', 'publish',
+]);
+
+const VALUE_OPTIONS = new Set([
+  '--project', '--vault', '--allow', '--source-change', '--source-commit', '--target',
+  '--ci-url', '--version', '--npm-integrity', '--release-url', '--reason',
+]);
+
+function parseArgv(argv) {
+  const values = new Map();
+  const positionals = [];
+  let json = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const item = argv[index];
+    if (item === '--json') { json = true; continue; }
+    if (item.startsWith('--')) {
+      const eq = item.indexOf('=');
+      const name = eq > 0 ? item.slice(0, eq) : item;
+      if (!VALUE_OPTIONS.has(name)) throw new Error(`opção desconhecida: ${name}`);
+      const value = eq > 0 ? item.slice(eq + 1) : argv[++index];
+      if (!value || value.startsWith('--')) throw new Error(`${name} requer um valor`);
+      const list = values.get(name) || [];
+      list.push(value);
+      values.set(name, list);
+      continue;
+    }
+    positionals.push(item);
+  }
+  return {
+    json,
+    positionals,
+    value: (name) => values.get(name)?.at(-1) || '',
+    all: (name) => values.get(name) || [],
+  };
+}
+
+function git(projectRoot, args, optional = false) {
+  try {
+    return execFileSync('git', args, {
+      cwd: projectRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+    }).trim();
+  } catch (error) {
+    if (optional) return '';
+    throw new Error(`git ${args.join(' ')} falhou: ${String(error.stderr || error.message).trim()}`);
+  }
+}
+
+function deliveryPaths(vaultBase, id = '') {
+  const runtime = join(vaultBase, '.brain', 'runtime');
+  const deliveries = join(runtime, 'deliveries');
+  return {
+    runtime,
+    deliveries,
+    pointer: join(runtime, 'CURRENT_DELIVERY'),
+    receipts: join(runtime, 'delivery-receipts.jsonl'),
+    state: id ? join(deliveries, `${id}.json`) : '',
+  };
+}
+
+function safeId(value) {
+  const id = String(value || '').trim();
+  if (!/^[a-z0-9][a-z0-9._-]{1,100}$/i.test(id)) throw new Error('id de delivery inválido');
+  return id;
+}
+
+function generatedId(now = new Date()) {
+  return `delivery-${now.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}Z$/, 'Z').toLowerCase()}`;
+}
+
+function readPointer(vaultBase) {
+  const { pointer } = deliveryPaths(vaultBase);
+  try { return safeId(readFileSync(pointer, 'utf8').trim()); } catch { return ''; }
+}
+
+export function activeDelivery(vaultBase) {
+  const id = readPointer(vaultBase);
+  if (!id) return null;
+  try {
+    const state = readState(vaultBase, id);
+    return state.state === 'active' ? state : null;
+  } catch {
+    return null;
+  }
+}
+
+function readState(vaultBase, id) {
+  const path = deliveryPaths(vaultBase, id).state;
+  const checked = assertVaultPathSafe(vaultBase, path, {
+    allowMissing: false, expectedType: 'file', label: `delivery ${id}`,
+  });
+  return JSON.parse(readFileSync(checked.target, 'utf8'));
+}
+
+function writeState(vaultBase, state) {
+  const paths = deliveryPaths(vaultBase, state.id);
+  mkdirVaultPath(vaultBase, paths.runtime, { label: 'runtime de delivery' });
+  mkdirVaultPath(vaultBase, paths.deliveries, { label: 'estados de delivery' });
+  writeVaultFileSync(vaultBase, paths.state, `${JSON.stringify(state, null, 2)}\n`, 'utf8', {
+    label: `delivery ${state.id}`,
+  });
+}
+
+function setPointer(vaultBase, id = '') {
+  const paths = deliveryPaths(vaultBase);
+  mkdirVaultPath(vaultBase, paths.runtime, { label: 'runtime de delivery' });
+  writeVaultFileSync(vaultBase, paths.pointer, id ? `${id}\n` : '', 'utf8', {
+    label: 'ponteiro de delivery',
+  });
+}
+
+function appendReceipt(vaultBase, receipt) {
+  const paths = deliveryPaths(vaultBase);
+  mkdirVaultPath(vaultBase, paths.runtime, { label: 'runtime de delivery' });
+  let previous = '';
+  if (existsSync(paths.receipts)) {
+    const checked = assertVaultPathSafe(vaultBase, paths.receipts, {
+      allowMissing: false, expectedType: 'file', label: 'ledger de receipts de delivery',
+    });
+    previous = readFileSync(checked.target, 'utf8');
+  }
+  writeVaultFileSync(vaultBase, paths.receipts, `${previous}${JSON.stringify(receipt)}\n`, 'utf8', {
+    label: 'ledger de receipts de delivery',
+  });
+}
+
+function context(parsed) {
+  const projectRoot = resolve(parsed.value('--project') || process.cwd());
+  const resolved = resolveProjectVault({
+    startDir: projectRoot,
+    explicitVault: parsed.value('--vault'),
+  });
+  const repoRoot = git(projectRoot, ['rev-parse', '--show-toplevel']);
+  return { projectRoot, repoRoot, vaultBase: resolved.base };
+}
+
+function currentId(parsed, vaultBase) {
+  return safeId(parsed.positionals[1] || readPointer(vaultBase));
+}
+
+function ensureClean(repoRoot) {
+  const dirty = git(repoRoot, ['status', '--porcelain']);
+  if (dirty) {
+    const error = new Error('delivery requer working tree limpa; alterações de código/config exigem implementation.');
+    error.code = 'WENDKEEP_DELIVERY_IMPLEMENTATION_REQUIRED';
+    throw error;
+  }
+}
+
+export function startDelivery({ vaultBase, repoRoot, id, capabilities, sourceChange = '', sourceCommit = '', now = new Date() }) {
+  ensureClean(repoRoot);
+  const deliveryId = safeId(id || generatedId(now));
+  const paths = deliveryPaths(vaultBase, deliveryId);
+  if (existsSync(paths.state)) throw new Error(`delivery já existe: ${deliveryId}`);
+  const commit = sourceCommit || git(repoRoot, ['rev-parse', 'HEAD']);
+  git(repoRoot, ['cat-file', '-e', `${commit}^{commit}`]);
+  const requestedCapabilities = [...new Set((capabilities || []).map((item) => String(item).trim()).filter(Boolean))];
+  const invalidCapabilities = requestedCapabilities.filter((item) => !DELIVERY_CAPABILITIES.includes(item));
+  if (invalidCapabilities.length) {
+    throw new Error(`capability inválida: ${invalidCapabilities.join(', ')}. Use ${DELIVERY_CAPABILITIES.join(', ')}.`);
+  }
+  const route = createWorkRoute({
+    workKind: 'delivery', profile: 'ASSURE', contractImpact: 'none',
+    operationRisk: requestedCapabilities, sourceChange, sourceCommit: commit,
+  });
+  if (!route.operation_risk.length) throw new Error('delivery start requer ao menos um --allow <capability>');
+  const state = {
+    schema_version: 1,
+    id: deliveryId,
+    state: 'active',
+    route,
+    repository: repoRoot,
+    worktree: repoRoot,
+    branch: git(repoRoot, ['branch', '--show-current'], true),
+    source_commit: commit,
+    started_at: now.toISOString(),
+  };
+  writeState(vaultBase, state);
+  setPointer(vaultBase, deliveryId);
+  return state;
+}
+
+export function finishDelivery({ vaultBase, repoRoot, id, target = 'HEAD', evidence = {}, now = new Date() }) {
+  ensureClean(repoRoot);
+  const state = readState(vaultBase, safeId(id));
+  if (state.state !== 'active') throw new Error(`delivery ${id} não está ativa`);
+  const targetCommit = git(repoRoot, ['rev-parse', `${target}^{commit}`]);
+  git(repoRoot, ['merge-base', '--is-ancestor', state.source_commit, targetCommit]);
+  const capabilities = state.route?.operation_risk || [];
+  if (capabilities.includes('git:tag') || capabilities.includes('publish')) {
+    if (!evidence.version) throw new Error('delivery com tag/publicação requer --version');
+    const pkg = JSON.parse(readFileSync(join(repoRoot, 'package.json'), 'utf8'));
+    if (pkg.version !== evidence.version) throw new Error(`package.json ${pkg.version} diverge de ${evidence.version}`);
+    const tagCommit = git(repoRoot, ['rev-list', '-n', '1', `refs/tags/v${evidence.version}`]);
+    if (tagCommit !== targetCommit) throw new Error(`v${evidence.version} não aponta para o target comprovado`);
+  }
+  if (capabilities.includes('publish')) {
+    for (const [key, label] of [
+      ['ci_url', '--ci-url'], ['npm_integrity', '--npm-integrity'], ['release_url', '--release-url'],
+    ]) if (!evidence[key]) throw new Error(`delivery com publish requer ${label}`);
+  }
+  const receipt = {
+    schema_version: 1,
+    delivery_id: state.id,
+    outcome: 'completed',
+    work_kind: 'delivery',
+    source_change: state.route.source_change || '',
+    source_commit: state.source_commit,
+    target,
+    target_commit: targetCommit,
+    capabilities,
+    evidence,
+    finished_at: now.toISOString(),
+  };
+  appendReceipt(vaultBase, receipt);
+  writeState(vaultBase, { ...state, state: 'completed', target, target_commit: targetCommit, finished_at: receipt.finished_at, receipt });
+  if (readPointer(vaultBase) === state.id) setPointer(vaultBase);
+  return receipt;
+}
+
+export function abandonDelivery({ vaultBase, id, reason, now = new Date() }) {
+  const state = readState(vaultBase, safeId(id));
+  if (state.state !== 'active') throw new Error(`delivery ${id} não está ativa`);
+  if (!String(reason || '').trim()) throw new Error('delivery abandon requer --reason <text>');
+  const receipt = {
+    schema_version: 1, delivery_id: state.id, outcome: 'abandoned',
+    reason: String(reason).trim(), abandoned_at: now.toISOString(),
+  };
+  appendReceipt(vaultBase, receipt);
+  writeState(vaultBase, { ...state, state: 'abandoned', reason: receipt.reason, abandoned_at: receipt.abandoned_at });
+  if (readPointer(vaultBase) === state.id) setPointer(vaultBase);
+  return receipt;
+}
+
+function emit(payload, json) {
+  if (json) process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+  else process.stdout.write(`${payload.id || payload.delivery_id}: ${payload.state || payload.outcome}\n`);
+}
+
+export function runDelivery(argv = []) {
+  try {
+    const parsed = parseArgv(argv);
+    const sub = parsed.positionals[0] || 'status';
+    const { repoRoot, vaultBase } = context(parsed);
+    if (sub === 'start') {
+      const state = startDelivery({
+        vaultBase, repoRoot, id: parsed.positionals[1], capabilities: parsed.all('--allow'),
+        sourceChange: parsed.value('--source-change'), sourceCommit: parsed.value('--source-commit'),
+      });
+      emit(state, parsed.json);
+      return 0;
+    }
+    if (sub === 'status') {
+      const state = readState(vaultBase, currentId(parsed, vaultBase));
+      emit(state, parsed.json);
+      return 0;
+    }
+    if (sub === 'finish') {
+      const receipt = finishDelivery({
+        vaultBase, repoRoot, id: currentId(parsed, vaultBase), target: parsed.value('--target') || 'HEAD',
+        evidence: {
+          ci_url: parsed.value('--ci-url'), version: parsed.value('--version'),
+          npm_integrity: parsed.value('--npm-integrity'), release_url: parsed.value('--release-url'),
+        },
+      });
+      emit(receipt, parsed.json);
+      return 0;
+    }
+    if (sub === 'abandon') {
+      const receipt = abandonDelivery({
+        vaultBase, id: currentId(parsed, vaultBase), reason: parsed.value('--reason'),
+      });
+      emit(receipt, parsed.json);
+      return 0;
+    }
+    throw new Error(`subcomando desconhecido: ${sub}`);
+  } catch (error) {
+    process.stderr.write(`wendkeep delivery: ${error.message}\n`);
+    return 2;
+  }
+}

package/src/doctor.mjs

@@ -7,7 +7,7 @@ import { checkSyncDefs } from './sync-defs.mjs';
 import { resolveProjectVault } from './project-vault.mjs';
 
 const healthStatusLabel = (status) => ({
-  healthy: 'saudável', warning: 'atenção', blocked: 'bloqueada', legacy: 'legado',
+  healthy: 'saudável', warning: 'atenção', degraded: 'degradada', blocked: 'bloqueada', legacy: 'legado',
 }[status] || status || 'desconhecido');
 
 const metricValue = (value) => value === null || value === undefined || value === '' ? 'n/a' : value;
@@ -55,6 +55,8 @@ export function runDoctor(argv) {
   let vault;
   let project;
   let session = '';
+  let scope = 'all';
+  let strict = false;
   for (let i = 0; i < argv.length; i += 1) {
     const a = argv[i];
     if (a === '--vault') vault = argv[++i];
@@ -63,6 +65,13 @@ export function runDoctor(argv) {
     else if (a.startsWith('--project=')) project = a.slice(10);
     else if (a === '--session') session = argv[++i] || '';
     else if (a.startsWith('--session=')) session = a.slice(10);
+    else if (a === '--scope') scope = argv[++i] || '';
+    else if (a.startsWith('--scope=')) scope = a.slice(8);
+    else if (a === '--strict') strict = true;
+  }
+  if (!['all', 'core', 'runtime'].includes(scope)) {
+    process.stderr.write('wendkeep doctor: --scope deve ser all, core ou runtime\n');
+    return 2;
   }
 
   const projectRoot = resolve(project || process.cwd());
@@ -97,18 +106,29 @@ export function runDoctor(argv) {
       memoryStatus: 'blocked',
     };
   }
-  process.stdout.write(`${renderVaultHealthLines(health).join('\n')}\n`);
+  if (scope !== 'runtime') process.stdout.write(`${renderVaultHealthLines(health).join('\n')}\n`);
   const healthStatus = health.ok ? 0 : 1;
 
+  if (scope === 'core') {
+    const strictDebt = strict && (
+      (health.warnings || []).length > 0
+      || !['healthy'].includes(health.memoryStatus)
+    );
+    process.stdout.write(`\n[core] ${healthStatus ? 'erro estrutural' : health.memoryStatus === 'degraded' ? 'saudável com memória degradada' : 'saudável'}\n`);
+    return healthStatus || strictDebt ? 1 : 0;
+  }
+
   // 2. Harness integrity (Wave B).
-  const { errors, warnings } = checkHarness(vaultBase, projectRoot);
+  const { errors, warnings, attention, repairable } = checkHarness(vaultBase, projectRoot);
   const defs = checkSyncDefs(vaultBase, projectRoot);
   if (!defs.ok) {
-    warnings.push(...defs.issues.map((issue) => `defs: ${issue}`));
-    warnings.push('defs stale — rode `wendkeep sync-defs --reseed` e reinicie Claude Code/Codex');
+    repairable.push(...defs.issues.map((issue) => `defs: ${issue}`));
+    repairable.push('defs stale — rode `wendkeep sync-defs --reseed` e reinicie Claude Code/Codex');
   }
-  process.stdout.write(`\n[harness] ${errors.length} erro(s), ${warnings.length} aviso(s)\n`);
+  process.stdout.write(`\n[runtime] ${errors.length} erro(s) estrutural(is), ${attention.length} atenção(ões), ${repairable.length} reparável(is), ${warnings.length} aviso(s)\n`);
   for (const e of errors) process.stdout.write(`  ✗ ${e}\n`);
+  for (const item of attention) process.stdout.write(`  ! ${item}\n`);
+  for (const item of repairable) process.stdout.write(`  → ${item}\n`);
   for (const w of warnings) process.stdout.write(`  ! ${w}\n`);
 
   // 3. Link/graph health — órfãos que o grafo do Obsidian mostraria, com o comando de reparo.
@@ -125,13 +145,16 @@ export function runDoctor(argv) {
   process.stdout.write(`\n${renderStackedFrontmatterLines(vaultBase, stacked).join('\n')}\n`);
 
   // 3c. Modelo fora de pricing.json fecha a sessão com custo zero, sem erro — só aparece aqui.
-  process.stdout.write(`\n${renderUnpricedModelLines(checkUnpricedModels(vaultBase)).join('\n')}\n`);
+  const unpriced = checkUnpricedModels(vaultBase);
+  process.stdout.write(`\n${renderUnpricedModelLines(unpriced).join('\n')}\n`);
 
   // 3d. Seções derivadas do corpo que ficaram para trás do Encerramento (notas pré-0.53.0).
-  process.stdout.write(`\n${renderStaleDerivedSectionLines(checkStaleDerivedSections(vaultBase)).join('\n')}\n`);
+  const staleDerived = checkStaleDerivedSections(vaultBase);
+  process.stdout.write(`\n${renderStaleDerivedSectionLines(staleDerived).join('\n')}\n`);
 
   // 3e. Observabilidade materializada: schema vigente não basta sem frontier + manifest frescos.
-  process.stdout.write(`\n${renderSessionObservabilityLines(checkSessionObservability(vaultBase)).join('\n')}\n`);
+  const observability = checkSessionObservability(vaultBase);
+  process.stdout.write(`\n${renderSessionObservabilityLines(observability).join('\n')}\n`);
 
   // 4. Sessão: não mente "inativa" quando há atividade recente (workflow/subagente em background).
   const act = checkSessionActivity(vaultBase);
@@ -146,5 +169,19 @@ export function runDoctor(argv) {
 
   // Devolve o código em vez de sair: `wendkeep sync` encadeia este comando, e um
   // process.exit aqui mataria a cadeia. Quem faz o exit é o bin.
-  return healthStatus !== 0 || errors.length ? 1 : 0;
+  const strictDebt = strict && (
+    (scope !== 'runtime' && (health.warnings || []).length)
+    || (scope !== 'runtime' && health.memoryStatus !== 'healthy')
+    || attention.length
+    || repairable.length
+    || warnings.length
+    || links.derivedOrphans
+    || links.artifactOrphans
+    || links.graphColors === false
+    || stacked.count
+    || (unpriced.models || unpriced.items || []).length
+    || (staleDerived.notes || staleDerived.items || []).length
+    || !observability.ok
+  );
+  return (scope !== 'runtime' && healthStatus !== 0) || errors.length || strictDebt ? 1 : 0;
 }

package/src/init.mjs

@@ -323,7 +323,7 @@ const MESSAGES = {
     mcpSkipped: '  [4/5] .mcp.json ignorado (--no-mcp, sem companions MCP)',
     colorsSkipped: '  [5/5] cores ignoradas (--no-colors)',
     colors: (r) => `  [5/5] cores: ${r}`,
-    runtimeIgnore: '  [!] ignore runtimes locais do wendkeep no Git quando o vault for versionado: .brain/.change-* .brain/runtime/flows/',
+    runtimeIgnore: '  [!] ignore runtimes locais do wendkeep no Git quando o vault for versionado: .brain/.change-* .brain/runtime/flows/ .brain/observer-sql-state.json .brain/observer-sql-outbox/',
     merged: 'mesclado', created: 'criado', bakSaved: ', .bak salvo',
     nextSteps: '\nPróximos passos:',
     step1: (v) => `  1. Abra o vault no Obsidian: "Abrir pasta como cofre" -> ${v}`,
@@ -352,7 +352,7 @@ const MESSAGES = {
     mcpSkipped: '  [4/5] .mcp.json skipped (--no-mcp, no MCP companions)',
     colorsSkipped: '  [5/5] colors skipped (--no-colors)',
     colors: (r) => `  [5/5] colors: ${r}`,
-    runtimeIgnore: '  [!] keep local wendkeep runtimes out of Git when the vault is versioned: .brain/.change-* .brain/runtime/flows/',
+    runtimeIgnore: '  [!] keep local wendkeep runtimes out of Git when the vault is versioned: .brain/.change-* .brain/runtime/flows/ .brain/observer-sql-state.json .brain/observer-sql-outbox/',
     merged: 'merged', created: 'created', bakSaved: ', .bak saved',
     nextSteps: '\nNext steps:',
     step1: (v) => `  1. Open the vault in Obsidian: "Open folder as vault" -> ${v}`,

package/src/observer-auth.mjs

@@ -0,0 +1,10 @@
+export function resolveObserverToken(value = '') {
+  return String(value || process.env.WENDKEEP_OBSERVER_TOKEN || '').trim();
+}
+
+export function observerAuthHeaders(token, headers = {}) {
+  const resolved = resolveObserverToken(token);
+  return resolved
+    ? { ...headers, authorization: `Bearer ${resolved}` }
+    : { ...headers };
+}

package/src/observer-memory-publish.mjs

@@ -12,6 +12,8 @@ import {
 } from 'node:fs';
 import { join } from 'node:path';
 import { MAX_MEMORY_CONTENT_BYTES } from './observer-memory.mjs';
+import { observerAuthHeaders } from './observer-auth.mjs';
+import { sanitizeObserverContent } from './observer-privacy.mjs';
 
 export const MEMORY_OUTBOX_REL = '.brain/observer-memory-outbox';
 export const MEMORY_STATE_FILE = '.brain/observer-memory-state.json';
@@ -103,7 +105,7 @@ function memoryFiles(vaultBase) {
 
 export function localMemoryManifest(vaultBase) {
   return Object.fromEntries(memoryFiles(vaultBase).map((file) => {
-    const content = readFileSync(file.absolute, 'utf8');
+    const content = sanitizeObserverContent(readFileSync(file.absolute, 'utf8'));
     return [file.logicalPath, {
       logical_path: file.logicalPath,
       content_hash: hash(content),
@@ -159,7 +161,7 @@ export function buildMemoryEventBatch({
   const events = [];
 
   for (const file of currentFiles) {
-    const content = readFileSync(file.absolute, 'utf8');
+    const content = sanitizeObserverContent(readFileSync(file.absolute, 'utf8'));
     if (Buffer.byteLength(content, 'utf8') > MAX_MEMORY_CONTENT_BYTES) {
       throw new Error('arquivo excede o limite de memória: ' + file.logicalPath);
     }
@@ -231,12 +233,12 @@ export function listMemoryOutbox(vaultBase) {
     .map((name) => join(dir, name));
 }
 
-async function postBatch(url, projectId, events, fetchImpl = globalThis.fetch) {
+async function postBatch(url, projectId, events, fetchImpl = globalThis.fetch, token = '') {
   const response = await fetchImpl(
     String(url).replace(/\/$/, '') + '/v1/projects/' + encodeURIComponent(projectId) + '/memory/events',
     {
       method: 'POST',
-      headers: { 'content-type': 'application/json', accept: 'application/json' },
+      headers: observerAuthHeaders(token, { 'content-type': 'application/json', accept: 'application/json' }),
       body: JSON.stringify({ events }),
     },
   );
@@ -249,6 +251,7 @@ export async function retryObserverMemoryOutbox({
   projectId = projectIdFromVault(vaultBase),
   url,
   fetchImpl = globalThis.fetch,
+  token = process.env.WENDKEEP_OBSERVER_TOKEN || '',
 } = {}) {
   const files = listMemoryOutbox(vaultBase);
   if (!url) return { attempted: 0, confirmed: 0, pending: files.length };
@@ -262,7 +265,7 @@ export async function retryObserverMemoryOutbox({
         unlinkSync(path);
         continue;
       }
-      await postBatch(url, projectId, batch.events, fetchImpl);
+      await postBatch(url, projectId, batch.events, fetchImpl, token);
       unlinkSync(path);
       confirmed += 1;
     } catch {
@@ -277,10 +280,11 @@ export async function compareMemoryParity({
   projectId = projectIdFromVault(vaultBase),
   url,
   fetchImpl = globalThis.fetch,
+  token = process.env.WENDKEEP_OBSERVER_TOKEN || '',
 } = {}) {
   const response = await fetchImpl(
     String(url).replace(/\/$/, '') + '/v1/projects/' + encodeURIComponent(projectId) + '/memory/tree',
-    { headers: { accept: 'application/json' } },
+    { headers: observerAuthHeaders(token, { accept: 'application/json' }) },
   );
   if (!response.ok) throw new Error('Observer respondeu HTTP ' + response.status + '.');
   const body = await response.json();
@@ -309,9 +313,10 @@ export async function publishObserverMemory({
   sourceTurnId = '',
   now = new Date(),
   fetchImpl = globalThis.fetch,
+  token = process.env.WENDKEEP_OBSERVER_TOKEN || '',
 } = {}) {
   if (!vaultBase || !projectId) throw new Error('vaultBase e projectId são obrigatórios.');
-  await retryObserverMemoryOutbox({ vaultBase, projectId, url, fetchImpl });
+  await retryObserverMemoryOutbox({ vaultBase, projectId, url, fetchImpl, token });
   const state = readState(vaultBase);
   const batch = buildMemoryEventBatch({ vaultBase, projectId, sourceSessionId, sourceTurnId, now, state });
   if (batch.events.length === 0) {
@@ -324,7 +329,7 @@ export async function publishObserverMemory({
     return { ok: false, queued: true, scanned: batch.scanned, changed: batch.changed, pending: listMemoryOutbox(vaultBase).length, hookExitCode: 0 };
   }
   try {
-    await postBatch(url, projectId, batch.events, fetchImpl);
+    await postBatch(url, projectId, batch.events, fetchImpl, token);
     commitMemoryPublishState(vaultBase, batch.nextState);
     return { ok: true, queued: false, scanned: batch.scanned, changed: batch.changed, pending: listMemoryOutbox(vaultBase).length };
   } catch (error) {