feat(memory): verified learning lifecycle (#681)

[kunaldhongade]

Summary

• Close the verified learning-event lifecycle: conflict detection (duplicate/contradiction/rename-scope), analyze/redteam influence from approved learnings only, and CLI memory learning propose/approve/reject/supersede/expire/revoke ops (preview by default, --apply to write).
• Untrusted agent/PR/external proposals stay proposed until explicit human approval; secrets/prompt-injection are redacted.
• Add UAT-LEARN-1..5 deterministic coverage plus CLI/redteam regression tests.

Closes #681

Test plan

• vitest run packages/memory/test/learning-lifecycle-uat.test.ts
• vitest run packages/memory/test/learning-events.test.ts
• vitest run packages/cli/test/memory.test.ts
• vitest run packages/redteam/test/redteam-context-safety.test.ts
• tsc -p tsconfig.base.json --noEmit
• Build memory/redteam/cli via tsup; node packages/cli/dist/index.js help memory
• CI green on this PR

[github-actions]

CodeDecay PR Check

Lead catch: No direct high-signal catch found

CodeDecay did not find a strong direct regression or weak-test signal in this run.

Risk: Medium · Merge 39/100 · Decay 54/100 · Security 0/100

This score is conservative pending stronger direct evidence. Treat structural-only signals as review guidance, not proof of a regression.

Full CodeDecay report

CodeDecay Report

Overall risk: Medium

Score	Value
Merge risk	39/100
Decay risk	54/100
Security risk	0/100

Findings	Count
High	7
Medium	9
Low	20

Changed Files

• docs/memory.md modified (+45/-0)
• packages/cli/src/commands/memory.ts modified (+65/-2)
• packages/cli/src/docs/command-docs/state.ts modified (+20/-5)
• packages/cli/src/parsers/args.ts modified (+1/-1)
• packages/cli/src/parsers/memory.ts modified (+140/-1)
• packages/cli/src/renderers/memory.ts modified (+59/-1)
• packages/cli/src/types/memory.ts modified (+12/-0)
• packages/cli/test/memory.test.ts modified (+82/-0)
• packages/memory/src/apply-context.ts modified (+38/-0)
• packages/memory/src/index.ts modified (+3/-0)
• packages/memory/src/learning-events.ts modified (+155/-3)
• packages/memory/src/schema-clone.ts modified (+18/-1)
• packages/memory/test/learning-lifecycle-uat.test.ts added (+369/-0)
• packages/redteam/src/context.ts modified (+26/-2)
• packages/redteam/src/render/sections/context.ts modified (+10/-1)
• packages/redteam/src/report.ts modified (+4/-1)
• packages/redteam/src/types.ts modified (+3/-0)
• packages/redteam/test/redteam-context-safety.test.ts modified (+55/-0)

Likely Impacted Areas

• Low Documentation (docs): docs/memory.md, packages/cli/src/docs/command-docs/state.ts
• Low Source code (source): packages/cli/src/commands/memory.ts, packages/cli/src/parsers/args.ts, packages/cli/src/parsers/memory.ts, packages/cli/src/renderers/memory.ts, packages/cli/src/types/memory.ts, packages/memory/src/apply-context.ts, packages/memory/src/index.ts, packages/memory/src/learning-events.ts, packages/memory/src/schema-clone.ts, packages/redteam/src/context.ts, packages/redteam/src/render/sections/context.ts, packages/redteam/src/report.ts, packages/redteam/src/types.ts
• Low Tests (test): packages/cli/test/memory.test.ts, packages/memory/test/learning-lifecycle-uat.test.ts, packages/redteam/test/redteam-context-safety.test.ts

Normalized Impact Graph

Graph artifact: .codedecay/local/impact-graph.json (4393 node(s), 8940 edge(s))

• Confidence: Direct: 8940, inferred: 0, heuristic: 0
• codedecay-js-babel-symbols via @babel/parser (available, adapter 1.0.0)
  • Limitation: Call expressions are not connected to target symbols in this adapter version.
  • Limitation: Only JavaScript and TypeScript files parsed by @babel/parser are represented.
  • Limitation: Static import resolution does not resolve runtime dependency injection or dynamic imports.
• codedecay-python-lezer via @lezer/python (available, adapter 1.0.0)
  • Limitation: Dynamic imports, dependency injection, decorators without literal routes, and framework route registries are not resolved.
  • Limitation: Python impact evidence uses the @lezer/python grammar and conservative module-to-file resolution.
  • Limitation: Static test imports do not prove execution or assertion quality.
• Graph limitation: A static test import does not prove the symbol executed or that assertions cover its behavior.

Symbol Impact Evidence

Graph artifact: .codedecay/local/symbol-impact-graph.json (932 file(s), 5558 edge(s))

• packages/cli/src/commands/memory.ts#runMemoryCommand -> packages/cli/src/commands/registry.ts
• packages/cli/src/docs/command-docs/state.ts#STATE_COMMAND_DOCS -> packages/cli/src/docs/commands.ts
• packages/cli/src/parsers/args.ts#parseMemoryArgs -> packages/cli/src/commands/memory.ts
• packages/cli/src/parsers/args.ts#parseMemoryImportArgs -> packages/cli/src/commands/memory.ts
• packages/cli/src/parsers/args.ts#parseMemoryLearnArgs -> packages/cli/src/commands/memory.ts
• packages/cli/src/parsers/args.ts#parseMemoryLearningArgs -> packages/cli/src/commands/memory.ts
• packages/cli/src/parsers/args.ts#parseMemorySetupArgs -> packages/cli/src/commands/memory.ts
• packages/cli/src/parsers/memory.ts#parseMemoryLearningArgs -> packages/cli/src/commands/memory.ts, packages/cli/src/parsers/args.ts
• packages/cli/src/renderers/memory.ts#renderMemory -> packages/cli/src/commands/memory.ts
• packages/cli/src/renderers/memory.ts#renderMemoryLearningResult -> packages/cli/src/commands/memory.ts
• packages/cli/src/types/memory.ts#MemoryLearningOptions -> packages/cli/src/parsers/memory.ts, packages/cli/src/types.ts, packages/cli/src/types/index.ts
• packages/memory/src/apply-context.ts#applyMemoryContext -> packages/cli/src/runtime/analysis.ts, packages/mcp/src/handlers/analysis/context.ts, packages/memory/src/index.ts, packages/memory/test/learning-lifecycle-uat.test.ts, packages/memory/test/memory-context.test.ts, packages/memory/test/memory-loading.test.ts, packages/memory/test/memory-providers.test.ts
  • Likely tests: packages/memory/test/learning-lifecycle-uat.test.ts, packages/memory/test/memory-context.test.ts, packages/memory/test/memory-loading.test.ts, packages/memory/test/memory-providers.test.ts
• ...and 17 more symbol impact(s)

Language And Parser Coverage

• Source files classified: 17
• Fully supported parser files: 17
• Limited files: 0
• Unsupported files: 0

Merge Risk Breakdown

• Score: 39/100
• Raw score before dampeners: 87/100
• Adjusted score before severity cap: 71/100
• Highest contributing severity: Low
• Evidence mode: heuristic-only

Top contributors:

• +9 Change size (structural): Changed lines amplify review cost across 18 file(s).
• +6 File spread (structural): Change breadth spans 18 file(s).
• +4 Docs area changed (heuristic): docs/memory.md touches a docs area and should be reviewed for regression impact.
• +4 Docs area changed (heuristic): packages/cli/src/docs/command-docs/state.ts touches a docs area and should be reviewed for regression impact.
• +4 Source area changed (heuristic): packages/cli/src/commands/memory.ts touches a source area and should be reviewed for regression impact.

Dampeners:

• -16 Heuristic-only dampener: Merge risk stays conservative until direct evidence exists.

Notes:

• Heuristic-only merge risk is capped at 54/100 until direct evidence exists.
• Untrusted memory context is visible but contributes 0 score until trusted evidence corroborates it.

Decay Risk Breakdown

• Score: 54/100
• Raw score before dampeners: 100/100
• Adjusted score before severity cap: 84/100
• Highest contributing severity: High
• Evidence mode: heuristic-only

Top contributors:

• +18 High complexity in changed function (heuristic): parseMemoryLearningArgs has estimated cyclomatic complexity 26.
• +18 High complexity in changed function (heuristic): applyMemoryContext has estimated cyclomatic complexity 21.
• +18 High complexity in changed function (heuristic): cloneMemory has estimated cyclomatic complexity 23.
• +10 Broad unrelated change set (heuristic): This PR changes 16 files across 1 top-level areas and 2 risk categories.
• +10 Duplicated added logic (heuristic): A similar block of added logic appears 4 times across 1 file(s).

Dampeners:

• -16 Heuristic-only dampener: Decay stays conservative until direct evidence exists.

Notes:

• Heuristic-only decay is capped at 54/100 until direct evidence exists.

Security Risk Breakdown

• Score: 0/100
• Raw score before dampeners: 0/100
• Adjusted score before severity cap: 0/100

Security Matcher Coverage

• Changed source files scanned: 14
• Security candidates found: 0
• Skipped files: 0

Test Evidence

• Mode: heuristic-only
• Sources: none
• Changed source coverage:
• packages/cli/src/commands/memory.ts: not measured (no measurable changed lines)
• packages/cli/src/docs/command-docs/state.ts: not measured (no measurable changed lines)
• packages/cli/src/parsers/args.ts: not measured (no measurable changed lines)
• packages/cli/src/parsers/memory.ts: not measured (no measurable changed lines)
• packages/cli/src/renderers/memory.ts: not measured (no measurable changed lines)
• packages/cli/src/types/memory.ts: not measured (no measurable changed lines)
• packages/memory/src/apply-context.ts: not measured (no measurable changed lines)
• packages/memory/src/index.ts: not measured (no measurable changed lines)
• Notes:
• No runtime coverage artifact was found. Test audit remains heuristic-only.

Changed Path Test Proof

Status	Count
Runtime-proven	0
Static-only	18
Weakened by mocks	0
Unproven	11

• Static-only packages/cli/src/commands/memory.ts#runMemoryCommand (static-reference, deterministic)
  • Evidence: Referenced by packages/cli/test/memory.test.ts, packages/memory/test/learning-lifecycle-uat.test.ts, packages/redteam/test/redteam-context-safety.test.ts, but no runtime coverage artifact proves changed lines executed.
  • Static references: packages/cli/test/memory.test.ts, packages/memory/test/learning-lifecycle-uat.test.ts, packages/redteam/test/redteam-context-safety.test.ts
  • Repair task: Strengthen packages/cli/test/memory.test.ts so it executes packages/cli/src/commands/memory.ts#runMemoryCommand with assertions; static import alone is not proof.
• Unproven packages/cli/src/docs/command-docs/state.ts#STATE_COMMAND_DOCS (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/cli/src/docs/command-docs/state.ts#STATE_COMMAND_DOCS without mocking the changed boundary.
• Unproven packages/cli/src/parsers/args.ts#parseMemoryArgs (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/cli/src/parsers/args.ts#parseMemoryArgs without mocking the changed boundary.
• Unproven packages/cli/src/parsers/args.ts#parseMemoryImportArgs (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/cli/src/parsers/args.ts#parseMemoryImportArgs without mocking the changed boundary.
• Unproven packages/cli/src/parsers/args.ts#parseMemoryLearnArgs (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/cli/src/parsers/args.ts#parseMemoryLearnArgs without mocking the changed boundary.
• Unproven packages/cli/src/parsers/args.ts#parseMemoryLearningArgs (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/cli/src/parsers/args.ts#parseMemoryLearningArgs without mocking the changed boundary.
• Unproven packages/cli/src/parsers/args.ts#parseMemorySetupArgs (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/cli/src/parsers/args.ts#parseMemorySetupArgs without mocking the changed boundary.
• Static-only packages/cli/src/parsers/memory.ts#parseMemoryLearningArgs (static-reference, deterministic)
  • Evidence: Referenced by packages/cli/test/memory.test.ts, packages/memory/test/learning-lifecycle-uat.test.ts, packages/redteam/test/redteam-context-safety.test.ts, but no runtime coverage artifact proves changed lines executed.
  • Static references: packages/cli/test/memory.test.ts, packages/memory/test/learning-lifecycle-uat.test.ts, packages/redteam/test/redteam-context-safety.test.ts
  • Repair task: Strengthen packages/cli/test/memory.test.ts so it executes packages/cli/src/parsers/memory.ts#parseMemoryLearningArgs with assertions; static import alone is not proof.
• ...and 21 more changed path proof entries

Untrusted Memory Context

• Project invariant may be impacted (packages/cli/src/commands/memory.ts:4): Untrusted memory context: invariant "No hidden cloud or model call" applies to this change. The OSS CLI must remain useful without telemetry, API keys, hosted services, required LLM calls, or CodeDecayCloud.
• Project invariant may be impacted (packages/cli/src/commands/memory.ts:4): Untrusted memory context: invariant "Commands are explicit" applies to this change. CodeDecay must not run project commands unless they are configured and safety.allowCommands is true.
• Project invariant may be impacted (docs/memory.md:237): Untrusted memory context: invariant "Tool evidence is separate from AI suggestions" applies to this change. Reports must not present agent/model suggestions as verified evidence unless backed by deterministic checks or command output.
• Past regression area changed (packages/redteam/src/context.ts:1): Untrusted memory context: past regression "Redteam output had non-actionable edge cases" may be relevant. Edge-case output previously included bare file paths and repeated generic fix-task titles, which made agent handoff less useful.
• Project invariant may be impacted (docs/memory.md:237): Untrusted memory context: invariant "Output must be actionable" applies to this change. Redteam reports and agent bundles should say what behavior to verify, which test proof is weak or missing, and what task a coding agent should perform.
• Architecture note applies (packages/cli/src/commands/memory.ts:4): Untrusted architecture context: CLI is the published surface: The public npm package is @submuxhq/codedecay and the binary is codedecay. Internal workspace packages are implementation details.
• Architecture note applies (packages/redteam/src/context.ts:1): Untrusted architecture context: Local-first redteam workflow: codedecay redteam is deterministic and report-only by default. Command execution and LLM/provider use require explicit user configuration.

High Risk Findings

• High complexity in changed function (packages/cli/src/parsers/memory.ts:258): parseMemoryLearningArgs has estimated cyclomatic complexity 26.
• High complexity in changed function (packages/memory/src/apply-context.ts:8): applyMemoryContext has estimated cyclomatic complexity 21.
• High complexity in changed function (packages/memory/src/schema-clone.ts:3): cloneMemory has estimated cyclomatic complexity 23.

Medium Risk Findings

• Broad unrelated change set: This PR changes 16 files across 1 top-level areas and 2 risk categories.
• Duplicated added logic (packages/cli/src/docs/command-docs/state.ts:34): A similar block of added logic appears 4 times across 1 file(s).
• Duplicated added logic (packages/memory/src/learning-events.ts:201): A similar block of added logic appears 3 times across 1 file(s).
• Duplicated added logic (packages/memory/src/learning-events.ts:202): A similar block of added logic appears 3 times across 1 file(s).
• High complexity in changed function (packages/memory/src/learning-events.ts:180): detectLearningConflicts has estimated cyclomatic complexity 18.
• High complexity in changed function (packages/memory/src/learning-events.ts:344): scopesOverlap has estimated cyclomatic complexity 13.
• Large changed function (packages/memory/src/apply-context.ts:8): applyMemoryContext spans 121 lines, which increases review and regression risk.
• Large changed function (packages/redteam/src/report.ts:16): createRedteamReport spans 131 lines, which increases review and regression risk.

Low Risk Findings

• Docs area changed (docs/memory.md:237): docs/memory.md touches a docs area and should be reviewed for regression impact.
• Docs area changed (packages/cli/src/docs/command-docs/state.ts:20): packages/cli/src/docs/command-docs/state.ts touches a docs area and should be reviewed for regression impact.
• Source area changed (packages/cli/src/commands/memory.ts:4): packages/cli/src/commands/memory.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/cli/src/parsers/args.ts:14): packages/cli/src/parsers/args.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/cli/src/parsers/memory.ts:1): packages/cli/src/parsers/memory.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/cli/src/renderers/memory.ts:2): packages/cli/src/renderers/memory.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/cli/src/types/memory.ts:30): packages/cli/src/types/memory.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/apply-context.ts:4): packages/memory/src/apply-context.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/index.ts:6): packages/memory/src/index.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/learning-events.ts:162): packages/memory/src/learning-events.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/memory/src/schema-clone.ts:36): packages/memory/src/schema-clone.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/redteam/src/context.ts:1): packages/redteam/src/context.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/redteam/src/render/sections/context.ts:11): packages/redteam/src/render/sections/context.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/redteam/src/report.ts:43): packages/redteam/src/report.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/redteam/src/types.ts:293): packages/redteam/src/types.ts touches a source area and should be reviewed for regression impact.
• Test area changed (packages/cli/test/memory.test.ts:435): packages/cli/test/memory.test.ts touches a test area and should be reviewed for regression impact.
• Test area changed (packages/memory/test/learning-lifecycle-uat.test.ts:1): packages/memory/test/learning-lifecycle-uat.test.ts touches a test area and should be reviewed for regression impact.
• Test area changed (packages/redteam/test/redteam-context-safety.test.ts:42): packages/redteam/test/redteam-context-safety.test.ts touches a test area and should be reviewed for regression impact.

Recommended Checks

• Add an integration test that reaches packages/cli/src/docs/command-docs/state.ts#STATE_COMMAND_DOCS without mocking the changed boundary.
• Add an integration test that reaches packages/cli/src/parsers/args.ts#parseMemoryArgs without mocking the changed boundary.
• Add an integration test that reaches packages/cli/src/parsers/args.ts#parseMemoryImportArgs without mocking the changed boundary.
• Add an integration test that reaches packages/cli/src/parsers/args.ts#parseMemoryLearnArgs without mocking the changed boundary.
• Add an integration test that reaches packages/cli/src/parsers/args.ts#parseMemoryLearningArgs without mocking the changed boundary.
• Add an integration test that reaches packages/cli/src/parsers/args.ts#parseMemorySetupArgs without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/index.ts#MemoryLearningConflict without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/learning-events.ts#MemoryLearningConflict without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/schema-clone.ts#cloneMemory without mocking the changed boundary.
• Add an integration test that reaches packages/memory/src/schema-clone.ts#isEmptyMemory without mocking the changed boundary.
• Add an integration test that reaches packages/redteam/src/types.ts#RedteamMemorySummary without mocking the changed boundary.
• Add or run tests covering packages/cli/src/docs/command-docs/state.ts

Notes

CodeDecay is deterministic and local-first. This report was generated without telemetry, API keys, LLMs, or model calls.

---

Found by CodeDecay - deterministic, local-first, no telemetry.