Learn repo risk memory from merged PRs, CI failures, and incidents

[kunaldhongade]

Problem

CodeDecay memory is useful but mostly manual. The critique is correct: a real Engineering OS needs to learn from historical PRs, regressions, CI failures, ADRs, and incidents without requiring users to hand-maintain every invariant.

Why This Matters

The strongest Staff Engineers remember where the repo has broken before. CodeDecay should turn local/project history into inspectable memory and use it during PR safety analysis.

First Slice Scope

Extend local memory learning so CodeDecay can ingest structured local artifacts and GitHub metadata into reviewable memory proposals.

Initial sources:

• merged PR titles/bodies/labels
• CodeDecay prior reports
• CI failure summaries
• incident or postmortem markdown files provided by config
• existing .codedecay/memory.json

Acceptance Criteria

• A command can generate memory proposals without applying them by default.
• Users can review and apply proposed memory updates explicitly.
• Proposed entries include source, confidence, timestamp, and why they matter.
• Redteam can match learned past-regression entries to changed files/areas.
• No telemetry, hidden upload, or hidden model call is introduced.

Tests

Add fixtures covering:

• PR metadata input creates a past-regression proposal
• CI failure input creates a command/test memory proposal
• incident markdown creates an invariant proposal
• duplicate memory entries are de-duplicated
• malformed input is reported without crashing

Validation

• pnpm run lint
• pnpm typecheck
• pnpm test
• pnpm build