Add reviewable memory learning proposals

[kunaldhongade]

Summary

• add proposal metadata to memory-learn output with source, confidence, timestamp, rationale, and proposed entry
• learn incident/postmortem markdown into reviewable invariant and regression proposals
• infer PR areas from labels such as area: auth and preserve GitHub-style source metadata
• keep memory writes explicit behind --apply and prove learned regressions feed redteam memory-context findings

Validation

• npx --yes pnpm@11.8.0 run lint
• npx --yes pnpm@11.8.0 run typecheck
• npx --yes pnpm@11.8.0 test
• npx --yes pnpm@11.8.0 build
• npx --yes pnpm@11.8.0 eval:pr-safety -- --run-id local-pr-safety-issue-641
• npx --yes pnpm@11.8.0 --filter @submuxhq/codedecay pack --dry-run
• node packages/cli/dist/index.js --help
• node packages/cli/dist/index.js analyze --format markdown
• node packages/cli/dist/index.js config --format markdown
• node packages/cli/dist/index.js redteam --format markdown
• node packages/cli/dist/index.js memory-learn --input docs/memory.md --format markdown

Closes #641

[github-actions]

CodeDecay PR Check

Lead catch: Project invariant may be impacted — packages/cli/src/commands/memory.ts:2

Untrusted memory context: invariant "No hidden cloud or model call" applies to this change. The OSS CLI must remain useful without telemetry, API keys, hosted services, required LLM calls, or CodeDecayCloud.

Risk: High · Merge 100/100 · Decay 54/100 · Security 0/100

Full CodeDecay report

CodeDecay Report

Overall risk: High

Score	Value
Merge risk	100/100
Decay risk	54/100
Security risk	0/100

Findings	Count
High	6
Medium	7
Low	20

Changed Files

• docs/memory.md modified (+21/-5)
• packages/cli/src/commands/memory.ts modified (+59/-2)
• packages/cli/src/docs/command-docs/state.ts modified (+6/-4)
• packages/cli/src/renderers/memory.ts modified (+33/-1)
• packages/cli/test/memory.test.ts modified (+113/-0)
• packages/memory/src/index.ts modified (+5/-0)
• packages/memory/src/learn-memory.ts modified (+9/-4)
• packages/memory/src/learn-memory/ci-pr.ts modified (+71/-7)
• packages/memory/src/learn-memory/codedecay-report.ts modified (+19/-2)
• packages/memory/src/learn-memory/incidents.ts added (+103/-0)
• packages/memory/src/learn-memory/matchers.ts modified (+16/-3)
• packages/memory/src/learn-memory/normalize.ts modified (+30/-7)
• packages/memory/src/learn-memory/product-generated.ts modified (+26/-2)
• packages/memory/src/learn-memory/product-report.ts modified (+14/-4)
• packages/memory/src/learn-memory/product-workflow.ts modified (+19/-2)
• packages/memory/src/learn-memory/proposals.ts added (+168/-0)
• packages/memory/src/types.ts modified (+36/-0)
• packages/memory/test/memory-learn.test.ts modified (+126/-1)
• packages/memory/test/memory-product-learn.test.ts modified (+19/-1)

Likely Impacted Areas

• Low Documentation (docs): docs/memory.md, packages/cli/src/docs/command-docs/state.ts
• Low Source code (source): packages/cli/src/commands/memory.ts, packages/cli/src/renderers/memory.ts, packages/memory/src/index.ts, packages/memory/src/learn-memory.ts, packages/memory/src/learn-memory/ci-pr.ts, packages/memory/src/learn-memory/codedecay-report.ts, packages/memory/src/learn-memory/incidents.ts, packages/memory/src/learn-memory/matchers.ts, packages/memory/src/learn-memory/normalize.ts, packages/memory/src/learn-memory/product-generated.ts, packages/memory/src/learn-memory/product-report.ts, packages/memory/src/learn-memory/product-workflow.ts, packages/memory/src/learn-memory/proposals.ts, packages/memory/src/types.ts
• Low Tests (test): packages/cli/test/memory.test.ts, packages/memory/test/memory-learn.test.ts, packages/memory/test/memory-product-learn.test.ts

Symbol Impact Evidence

Graph artifact: .codedecay/local/symbol-impact-graph.json (786 file(s), 4307 edge(s))

• packages/cli/src/commands/memory.ts#runMemoryLearnCommand -> packages/cli/src/commands/registry.ts
• packages/cli/src/docs/command-docs/state.ts#STATE_COMMAND_DOCS -> packages/cli/src/docs/commands.ts
• packages/cli/src/renderers/memory.ts#renderMemoryLearnResult -> packages/cli/src/commands/memory.ts
• packages/memory/src/index.ts#CodeDecayMemory -> packages/cli/src/commands/redteam-investigation.ts, packages/cli/src/memory/configured-providers.ts, packages/cli/src/product/runtime/dependencies.ts, packages/cli/test/redteam-memory-providers.test.ts, packages/redteam/src/context.ts, packages/redteam/src/fix-tasks.ts, packages/redteam/src/types.ts, packages/redteam/test/helpers/redteam.ts
  • Likely tests: packages/cli/test/redteam-memory-providers.test.ts, packages/redteam/test/helpers/redteam.ts
• packages/memory/src/index.ts#LoadedCodeDecayMemory -> packages/cli/src/memory/configured-providers.ts, packages/cli/src/renderers/memory.ts, packages/cli/src/types/analyze.ts, packages/mcp/src/handlers/analysis/context.ts
• packages/memory/src/index.ts#MemoryImportCounts -> packages/cli/src/types/revalidate.ts
• packages/memory/src/index.ts#MemoryImportResult -> packages/cli/src/renderers/memory.ts
• packages/memory/src/index.ts#MemoryLearningProposal -> packages/cli/src/renderers/memory.ts
• packages/memory/src/index.ts#MemoryLearnResult -> packages/cli/src/renderers/memory.ts
• packages/memory/src/index.ts#MemoryMatcher -> packages/cli/src/product/runtime/dependencies.ts, packages/mcp/src/handlers/analysis/pair-tools.ts
• packages/memory/src/index.ts#MemoryProvider -> packages/cli/src/memory/configured-providers.ts, packages/cli/test/redteam-memory-providers.test.ts, packages/memory/test/helpers/memory.ts, packages/memory/test/memory-context.test.ts, packages/memory/test/memory-loading.test.ts, packages/memory/test/memory-providers.test.ts
  • Likely tests: packages/cli/test/redteam-memory-providers.test.ts, packages/memory/test/helpers/memory.ts, packages/memory/test/memory-context.test.ts, packages/memory/test/memory-loading.test.ts, packages/memory/test/memory-providers.test.ts
• packages/memory/src/learn-memory.ts#learnCodeDecayMemory -> packages/cli/src/commands/memory.ts, packages/memory/src/index.ts, packages/memory/test/memory-context.test.ts, packages/memory/test/memory-learn.test.ts, packages/memory/test/memory-loading.test.ts, packages/memory/test/memory-product-learn.test.ts, packages/memory/test/memory-providers.test.ts
  • Likely tests: packages/memory/test/memory-context.test.ts, packages/memory/test/memory-learn.test.ts, packages/memory/test/memory-loading.test.ts, packages/memory/test/memory-product-learn.test.ts, packages/memory/test/memory-providers.test.ts
• ...and 20 more symbol impact(s)

Language And Parser Coverage

• Source files classified: 18
• Fully supported parser files: 18
• Limited files: 0
• Unsupported files: 0

Merge Risk Breakdown

• Score: 100/100
• Raw score before dampeners: 100/100
• Adjusted score before severity cap: 100/100
• Highest contributing severity: High

Top contributors:

• +30 Project invariant may be impacted (direct): Untrusted memory context: invariant "No hidden cloud or model call" applies to this change. The OSS CLI must remain useful without telemetry, API keys, hosted services, required LLM calls, or CodeDecayCloud.
• +30 Project invariant may be impacted (direct): Untrusted memory context: invariant "Commands are explicit" applies to this change. CodeDecay must not run project commands unless they are configured and safety.allowCommands is true.
• +30 Project invariant may be impacted (direct): Untrusted memory context: invariant "Tool evidence is separate from AI suggestions" applies to this change. Reports must not present agent/model suggestions as verified evidence unless backed by deterministic checks or command output.
• +18 Change size (structural): Changed lines amplify review cost across 19 file(s).
• +16 Project invariant may be impacted (direct): Untrusted memory context: invariant "Output must be actionable" applies to this change. Redteam reports and agent bundles should say what behavior to verify, which test proof is weak or missing, and what task a coding agent should perform.

Decay Risk Breakdown

• Score: 54/100
• Raw score before dampeners: 100/100
• Adjusted score before severity cap: 84/100
• Highest contributing severity: High
• Evidence mode: heuristic-only

Top contributors:

• +18 Duplicated added logic (heuristic): A similar block of added logic appears 5 times across 4 file(s).
• +18 Duplicated added logic (heuristic): A similar block of added logic appears 5 times across 4 file(s).
• +18 Duplicated added logic (heuristic): A similar block of added logic appears 5 times across 4 file(s).
• +10 Broad unrelated change set (heuristic): This PR changes 17 files across 1 top-level areas and 2 risk categories.
• +10 Duplicated added logic (heuristic): A similar block of added logic appears 3 times across 2 file(s).

Dampeners:

• -16 Heuristic-only dampener: Decay stays conservative until direct evidence exists.

Notes:

• Heuristic-only decay is capped at 54/100 until direct evidence exists.

Security Risk Breakdown

• Score: 0/100
• Raw score before dampeners: 0/100
• Adjusted score before severity cap: 0/100

Security Matcher Coverage

• Changed source files scanned: 15
• Security candidates found: 0
• Skipped files: 0

Test Evidence

• Mode: heuristic-only
• Sources: none
• Changed source coverage:
• packages/cli/src/commands/memory.ts: not measured (no measurable changed lines)
• packages/cli/src/docs/command-docs/state.ts: not measured (no measurable changed lines)
• packages/cli/src/renderers/memory.ts: not measured (no measurable changed lines)
• packages/memory/src/index.ts: not measured (no measurable changed lines)
• packages/memory/src/learn-memory.ts: not measured (no measurable changed lines)
• packages/memory/src/learn-memory/ci-pr.ts: not measured (no measurable changed lines)
• packages/memory/src/learn-memory/codedecay-report.ts: not measured (no measurable changed lines)
• packages/memory/src/learn-memory/incidents.ts: not measured (no measurable changed lines)
• Notes:
• No runtime coverage artifact was found. Test audit remains heuristic-only.

Changed Path Test Proof

Status	Count
Runtime-proven	0
Static-only	13
Weakened by mocks	0
Unproven	19

• Static-only packages/cli/src/commands/memory.ts#runMemoryLearnCommand (static-reference, deterministic)
  • Evidence: Referenced by packages/cli/test/memory.test.ts, packages/memory/test/memory-learn.test.ts, packages/memory/test/memory-product-learn.test.ts, but no runtime coverage artifact proves changed lines executed.
  • Static references: packages/cli/test/memory.test.ts, packages/memory/test/memory-learn.test.ts, packages/memory/test/memory-product-learn.test.ts
  • Repair task: Strengthen packages/cli/test/memory.test.ts so it executes packages/cli/src/commands/memory.ts#runMemoryLearnCommand with assertions; static import alone is not proof.
• Unproven packages/cli/src/docs/command-docs/state.ts#STATE_COMMAND_DOCS (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/cli/src/docs/command-docs/state.ts#STATE_COMMAND_DOCS without mocking the changed boundary.
• Static-only packages/cli/src/renderers/memory.ts#renderMemoryLearnResult (static-reference, deterministic)
  • Evidence: Referenced by packages/cli/test/memory.test.ts, packages/memory/test/memory-learn.test.ts, packages/memory/test/memory-product-learn.test.ts, but no runtime coverage artifact proves changed lines executed.
  • Static references: packages/cli/test/memory.test.ts, packages/memory/test/memory-learn.test.ts, packages/memory/test/memory-product-learn.test.ts
  • Repair task: Strengthen packages/cli/test/memory.test.ts so it executes packages/cli/src/renderers/memory.ts#renderMemoryLearnResult with assertions; static import alone is not proof.
• Static-only packages/memory/src/index.ts#CodeDecayMemory (static-reference, deterministic)
  • Evidence: Referenced by packages/cli/test/redteam-memory-providers.test.ts, packages/redteam/test/helpers/redteam.ts, but no runtime coverage artifact proves changed lines executed.
  • Static references: packages/cli/test/redteam-memory-providers.test.ts, packages/redteam/test/helpers/redteam.ts
  • Repair task: Strengthen packages/cli/test/redteam-memory-providers.test.ts so it executes packages/memory/src/index.ts#CodeDecayMemory with assertions; static import alone is not proof.
• Unproven packages/memory/src/index.ts#LoadedCodeDecayMemory (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/memory/src/index.ts#LoadedCodeDecayMemory without mocking the changed boundary.
• Unproven packages/memory/src/index.ts#MemoryImportCounts (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/memory/src/index.ts#MemoryImportCounts without mocking the changed boundary.
• Unproven packages/memory/src/index.ts#MemoryImportResult (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/memory/src/index.ts#MemoryImportResult without mocking the changed boundary.
• Unproven packages/memory/src/index.ts#MemoryLearningProposal (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/memory/src/index.ts#MemoryLearningProposal without mocking the changed boundary.
• ...and 24 more changed path proof entries

High Risk Findings

• Duplicated added logic (packages/memory/src/learn-memory/ci-pr.ts:32): A similar block of added logic appears 5 times across 4 file(s).
• Duplicated added logic (packages/memory/src/learn-memory/ci-pr.ts:38): A similar block of added logic appears 5 times across 4 file(s).
• Duplicated added logic (packages/memory/src/learn-memory/ci-pr.ts:39): A similar block of added logic appears 5 times across 4 file(s).
• Project invariant may be impacted (packages/cli/src/commands/memory.ts:2): Untrusted memory context: invariant "No hidden cloud or model call" applies to this change. The OSS CLI must remain useful without telemetry, API keys, hosted services, required LLM calls, or CodeDecayCloud.
• Project invariant may be impacted (packages/cli/src/commands/memory.ts:2): Untrusted memory context: invariant "Commands are explicit" applies to this change. CodeDecay must not run project commands unless they are configured and safety.allowCommands is true.
• Project invariant may be impacted (docs/memory.md:75): Untrusted memory context: invariant "Tool evidence is separate from AI suggestions" applies to this change. Reports must not present agent/model suggestions as verified evidence unless backed by deterministic checks or command output.

Medium Risk Findings

• Broad unrelated change set: This PR changes 17 files across 1 top-level areas and 2 risk categories.
• Duplicated added logic (packages/memory/src/learn-memory/ci-pr.ts:8): A similar block of added logic appears 3 times across 2 file(s).
• Duplicated added logic (packages/memory/src/learn-memory/ci-pr.ts:9): A similar block of added logic appears 3 times across 2 file(s).
• High complexity in changed function (packages/memory/src/learn-memory/codedecay-report.ts:8): appendLearnedCodeDecayReport has estimated cyclomatic complexity 12.
• High complexity in changed function (packages/memory/src/learn-memory/product-generated.ts:23): appendLearnedProductGeneratedChecks has estimated cyclomatic complexity 19.
• Project invariant may be impacted (docs/memory.md:75): Untrusted memory context: invariant "Output must be actionable" applies to this change. Redteam reports and agent bundles should say what behavior to verify, which test proof is weak or missing, and what task a coding agent should perform.
• Large test change relative to source change (packages/memory/test/memory-learn.test.ts:26): packages/memory/test/memory-learn.test.ts adds 126 lines of tests for 614 source additions.

Low Risk Findings

• Architecture note applies (packages/cli/src/commands/memory.ts:2): Untrusted architecture context: CLI is the published surface: The public npm package is @submuxhq/codedecay and the binary is codedecay. Internal workspace packages are implementation details.
• Docs area changed (docs/memory.md:75): docs/memory.md touches a docs area and should be reviewed for regression impact.
• Docs area changed (packages/cli/src/docs/command-docs/state.ts:61): packages/cli/src/docs/command-docs/state.ts touches a docs area and should be reviewed for regression impact.
• Source area changed (packages/cli/src/commands/memory.ts:2): packages/cli/src/commands/memory.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/cli/src/renderers/memory.ts:2): packages/cli/src/renderers/memory.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/index.ts:27): packages/memory/src/index.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/learn-memory.ts:5): packages/memory/src/learn-memory.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/learn-memory/ci-pr.ts:4): packages/memory/src/learn-memory/ci-pr.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/learn-memory/codedecay-report.ts:5): packages/memory/src/learn-memory/codedecay-report.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/learn-memory/incidents.ts:1): packages/memory/src/learn-memory/incidents.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/learn-memory/matchers.ts:6): packages/memory/src/learn-memory/matchers.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/learn-memory/normalize.ts:13): packages/memory/src/learn-memory/normalize.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/learn-memory/product-generated.ts:3): packages/memory/src/learn-memory/product-generated.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/learn-memory/product-report.ts:2): packages/memory/src/learn-memory/product-report.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/learn-memory/product-workflow.ts:2): packages/memory/src/learn-memory/product-workflow.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/learn-memory/proposals.ts:1): packages/memory/src/learn-memory/proposals.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/types.ts:74): packages/memory/src/types.ts touches a source area and should be reviewed for regression impact.
• Test area changed (packages/cli/test/memory.test.ts:261): packages/cli/test/memory.test.ts touches a test area and should be reviewed for regression impact.
• Test area changed (packages/memory/test/memory-learn.test.ts:26): packages/memory/test/memory-learn.test.ts touches a test area and should be reviewed for regression impact.
• Test area changed (packages/memory/test/memory-product-learn.test.ts:82): packages/memory/test/memory-product-learn.test.ts touches a test area and should be reviewed for regression impact.

Recommended Checks

• Add an integration test that reaches packages/cli/src/docs/command-docs/state.ts#STATE_COMMAND_DOCS without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/index.ts#LoadedCodeDecayMemory without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/index.ts#MemoryImportCounts without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/index.ts#MemoryImportResult without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/index.ts#MemoryLearningProposal without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/index.ts#MemoryLearnResult without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/index.ts#MemoryMatcher without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/learn-memory/ci-pr.ts#appendLearnedCiFailure without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/learn-memory/ci-pr.ts#appendLearnedPullRequest without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/learn-memory/matchers.ts#normalizeAreaKind without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/learn-memory/normalize.ts#normalizeLearnedMemoryWithProposals without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/learn-memory/product-generated.ts#appendLearnedProductGeneratedChecks without mocking the changed boundary.

Notes

CodeDecay is deterministic and local-first. This report was generated without telemetry, API keys, LLMs, or model calls.

---

Found by CodeDecay - deterministic, local-first, no telemetry.