@agfpd/iapeer-memory 0.1.7 → 0.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer-memory",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "iapeer-memory — peer memory for the iapeer ecosystem: vault, memoryd (index/search/MCP-http), layer-5 context fragments, role doctrines. The package IS the system; the claude/codex plugins are thin session sockets (docs/10-distribution.md, ADR-009).",
   "license": "MIT",
   "type": "module",
@@ -27,7 +27,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@agfpd/iapeer-memory-core": "0.1.7"
+    "@agfpd/iapeer-memory-core": "0.1.9"
   },
   "devDependencies": {
     "@types/bun": "^1.2.0",

package/src/commands/init.ts

@@ -33,7 +33,7 @@ import { installBinary } from "../binary.js";
 import { memoryPaths } from "../paths.js";
 import { provisionVault, writeDefaultConfig } from "../provision.js";
 import { writeRolesManifest, type RoleEntry } from "../roles.js";
-import { writeSlot } from "../slot.js";
+import { applyMemoryPlugin, writeSlot } from "../slot.js";
 import {
   doctrineOwnership,
   guideText,
@@ -318,7 +318,7 @@ export async function cmdInit(argv: string[]): Promise<number> {
         continue;
       }
       const template = roleTemplatePath(paths.templatesDir, locale, role);
-      const rendered = renderDoctrine({ templatePath: template, peerCwd, version });
+      const rendered = renderDoctrine({ templatePath: template, peerCwd, version, vaultPath: vault });
       if (rendered.action === "missing-template") {
         rolesOk = false;
         console.log(`      roles       ${role}: template missing at ${template}`);
@@ -388,7 +388,8 @@ export async function cmdInit(argv: string[]): Promise<number> {
     );
   }
 
-  // 8. slot declaration (the contract: written by the provider, atomic)
+  // 8. slot declaration (the contract: written by the provider, atomic) —
+  // v1.1: includes the plugin block the core derives installs from.
   const slot = writeSlot({
     slotPath: paths.slotPath,
     version,
@@ -402,6 +403,26 @@ export async function cmdInit(argv: string[]): Promise<number> {
     slot.action !== "refused-foreign",
   );
 
+  // 8b. session plugin across the fleet — the core verb derives the plugin
+  // from the block JUST written (order matters), installs per-peer on claude
+  // and host-globally on codex; new peers get it from the core's birth-hook.
+  // Soft-skip on an older core (verb landed in iapeer 0.2.25).
+  if (flags.skipEcosystem) {
+    step("plugin", "skipped (--skip-ecosystem)");
+  } else if (slot.action === "refused-foreign") {
+    step("plugin", "skipped (slot refused — nothing to derive the plugin from)");
+  } else {
+    const plug = applyMemoryPlugin({ mode: "on", iapeerBin: flags.iapeerBin });
+    step(
+      "plugin",
+      plug.suppressed
+        ? "skipped (test sandbox — core calls suppressed)"
+        : plug.ok
+          ? "session plugin rolled out across the fleet (iapeer memory-plugin on --all)"
+          : `soft-skip: ${plug.detail.slice(0, 160) || "verb failed"} — upgrade the iapeer core (≥0.2.25) or run manually: iapeer memory-plugin on --all`,
+    );
+  }
+
   // 9. native-memory sweep — the core's lever (one home of runtime forms);
   // soft-skip when the verb is unavailable (older core), verify re-runs later.
   if (flags.skipEcosystem) {

package/src/commands/uninstall.ts

@@ -18,7 +18,7 @@
 import fs from "node:fs";
 import { memoryPaths } from "../paths.js";
 import { removeBinary } from "../binary.js";
-import { removeSlot } from "../slot.js";
+import { applyMemoryPlugin, readSlot, removeSlot, SLOT_PROVIDER } from "../slot.js";
 import {
   DREAM_TRIGGER_ID,
   SWEEP_TRIGGER_ID,
@@ -95,6 +95,28 @@ export function cmdUninstall(argv: string[]): number {
   const paths = memoryPaths();
   let failed = false;
 
+  // Session plugin OFF across the fleet BEFORE removing the declaration —
+  // the core verb DERIVES the plugin identity from the slot's v1.1 block;
+  // once the declaration is gone there is nothing to derive from (agreed
+  // order with the core, auto-removal: a dead provider's plugin must not
+  // keep injecting). Guard: only when the slot is OURS — running `off`
+  // against a foreign declaration would strip the FOREIGN provider's plugin.
+  // codex nuance: the codex plugin is host-global, so `off` there is always
+  // `--all` semantics; per-peer off on codex answers «use --all».
+  const declared = readSlot(paths.slotPath);
+  if (declared && declared.provider === SLOT_PROVIDER) {
+    const off = applyMemoryPlugin({ mode: "off", iapeerBin });
+    console.log(
+      `plugin    : ${
+        off.suppressed
+          ? "skipped (test sandbox — core calls suppressed)"
+          : off.ok
+            ? "session plugin removed across the fleet (memory-plugin off --all; codex side is host-global)"
+            : `off not applied (${off.detail.slice(0, 160)}) — manual fallback (works without the slot): per claude peer \`claude plugin uninstall iapeer-memory@agfpd --scope project\` from its cwd; codex (host-global): \`codex plugin remove iapeer-memory@agfpd\``
+      }`,
+    );
+  }
+
   const slot = removeSlot(paths.slotPath);
   if (slot === "refused-foreign") {
     console.log("slot      : held by a FOREIGN provider — left intact");

package/src/commands/update.ts

@@ -93,14 +93,21 @@ export function cmdUpdate(argv: string[]): number {
   const tmpl = materialiseTemplates({ templatesDir: paths.templatesDir, locale });
   step("templates", `${tmpl.written.length} written, ${tmpl.identical.length} identical`);
 
-  // 3. role doctrines (version marker follows the package — ADR-010)
+  // 3. role doctrines (version marker follows the package — ADR-010).
+  // vaultPath feeds the {{VAULT_PATH}} doctrine substitution (host fact).
+  let vaultPathForDoctrines: string | undefined;
+  try {
+    vaultPathForDoctrines = configFromEnv().vaultPath;
+  } catch {
+    vaultPathForDoctrines = undefined; // unprovisioned env — placeholder fallback
+  }
   const manifest = readRolesManifest(paths.rolesManifestPath);
   if (!manifest || manifest.roles.length === 0) {
     step("doctrines", "no roles manifest — init has not run (nothing to re-render)");
   } else {
     const outcomes = manifest.roles.map((r) => ({
       role: r.role,
-      ...renderDoctrine({ templatePath: r.template, peerCwd: r.peerCwd, version }),
+      ...renderDoctrine({ templatePath: r.template, peerCwd: r.peerCwd, version, vaultPath: vaultPathForDoctrines }),
     }));
     const missing = outcomes.filter((o) => o.action === "missing-template");
     step(

package/src/commands/verify.ts

@@ -74,9 +74,11 @@ export function runVerify(opts: VerifyOptions = {}): CheckResult[] {
 
   // 1. config / env context
   let configOk = false;
+  let vaultPathForDoctrines: string | undefined;
   try {
     const config = configFromEnv();
     configOk = true;
+    vaultPathForDoctrines = config.vaultPath;
     results.push({
       name: "config",
       status: "ok",
@@ -333,6 +335,7 @@ export function runVerify(opts: VerifyOptions = {}): CheckResult[] {
         templatePath: entry.template,
         peerCwd: entry.peerCwd,
         version,
+        vaultPath: vaultPathForDoctrines,
       });
       if (outcome.action === "missing-template") {
         results.push({

package/src/slot.ts

@@ -11,7 +11,15 @@
  * - `version` = the package version (the same single source as the doctrine
  *   marker, ADR-010); our `update` re-writes it (P4 obligation);
  * - `heartbeat` (optional) = the absolute path whose mtime memoryd touches —
- *   the core may show staleness in `iapeer status`, never acts on it.
+ *   the core may show staleness in `iapeer status`, never acts on it;
+ * - `plugin` (v1.1, agreed 10.06 + live in iapeer 0.2.25) = the marketplace
+ *   identity of the session plugin. The core DERIVES installs from this block:
+ *   birth-hook installs for new peers, `iapeer memory-plugin on|off (--peer|
+ *   --all)` is the operator verb (built-in marketplace ensure + stale-cache
+ *   retry). Reference reader: iapeer src/status/index.ts parsePluginBlock —
+ *   all three fields required non-empty, anything less = treated as a v1
+ *   declaration (no install). marketplaceRef matches iapeer onboard's
+ *   MARKETPLACE_REF for the distribution default.
  */
 
 import fs from "node:fs";
@@ -20,12 +28,29 @@ import path from "node:path";
 export const SLOT_PROVIDER = "iapeer-memory";
 export const SLOT_PACKAGE = "@agfpd/iapeer-memory";
 
+/** Mirror of iapeer's MemoryProviderPlugin (src/status/index.ts). */
+export type MemoryProviderPlugin = {
+  /** Plugin id in the marketplace (forms `<name>@<marketplace>`). */
+  name: string;
+  /** Marketplace NAME the plugin id keys on. */
+  marketplace: string;
+  /** Source ref for `plugin marketplace add` when absent on the host (owner/repo). */
+  marketplaceRef: string;
+};
+
+export const SLOT_PLUGIN: MemoryProviderPlugin = {
+  name: "iapeer-memory",
+  marketplace: "agfpd",
+  marketplaceRef: "agfpd/agfpd-marketplace",
+};
+
 export type MemoryProviderSlot = {
   provider: string;
   package: string;
   version: string;
   registeredAt: string;
   heartbeat?: string;
+  plugin?: MemoryProviderPlugin;
 };
 
 /** Never throws: missing / unreadable / malformed → null (empty slot). */
@@ -59,7 +84,11 @@ export function writeSlot(opts: {
     existing &&
     existing.version === opts.version &&
     existing.heartbeat === opts.heartbeat &&
-    existing.package === SLOT_PACKAGE
+    existing.package === SLOT_PACKAGE &&
+    existing.plugin &&
+    existing.plugin.name === SLOT_PLUGIN.name &&
+    existing.plugin.marketplace === SLOT_PLUGIN.marketplace &&
+    existing.plugin.marketplaceRef === SLOT_PLUGIN.marketplaceRef
   ) {
     return { action: "identical", existing }; // idempotent re-init: no churn
   }
@@ -69,6 +98,7 @@ export function writeSlot(opts: {
     version: opts.version,
     registeredAt: opts.nowIso ?? new Date().toISOString(),
     ...(opts.heartbeat ? { heartbeat: opts.heartbeat } : {}),
+    plugin: SLOT_PLUGIN,
   };
   fs.mkdirSync(path.dirname(opts.slotPath), { recursive: true });
   const tmp = `${opts.slotPath}.tmp`;
@@ -87,3 +117,57 @@ export function removeSlot(slotPath: string): SlotRemoveResult {
   fs.unlinkSync(slotPath);
   return "removed";
 }
+
+export type MemoryPluginApplyResult = {
+  ok: boolean;
+  detail: string;
+  /** True when the test-sandbox fuse blocked the call — callers report a
+   *  SKIP, not a failure (same contract as watcher.ts iapSend). */
+  suppressed?: boolean;
+};
+
+/**
+ * Fleet-wide install/remove of the slot-declared session plugin via the core
+ * verb `iapeer memory-plugin <on|off> --all` (iapeer ≥0.2.25; marketplace
+ * ensure + stale-cache retry live INSIDE the verb). The verb derives the
+ * plugin identity from the slot declaration — so `on` runs AFTER writeSlot
+ * and `off` runs BEFORE removeSlot (agreed order, auto-removal: a dead
+ * provider's plugin must not keep injecting).
+ *
+ * Hard fuse first (same class as iapSend, incident 10.06): `on --all`
+ * mutates the HOST fleet — no sandbox env contains it, tests must never
+ * reach the live core. Both belts honoured.
+ */
+export function applyMemoryPlugin(opts: {
+  mode: "on" | "off";
+  iapeerBin?: string;
+}): MemoryPluginApplyResult {
+  if (
+    process.env.IAPEER_MEMORY_SUPPRESS_IAP_SEND === "1" ||
+    process.env.IAPEER_TEST_SANDBOX === "1"
+  ) {
+    return {
+      ok: false,
+      suppressed: true,
+      detail: "memory-plugin call suppressed (test sandbox)",
+    };
+  }
+  const bin = opts.iapeerBin ?? "iapeer";
+  try {
+    const proc = Bun.spawnSync([bin, "memory-plugin", opts.mode, "--all"], {
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    if (proc.exitCode !== 0) {
+      return {
+        ok: false,
+        detail:
+          (proc.stderr.toString().trim() || proc.stdout.toString().trim() || "").slice(0, 200) ||
+          `iapeer memory-plugin exited ${proc.exitCode}`,
+      };
+    }
+    return { ok: true, detail: proc.stdout.toString().trim() };
+  } catch (err) {
+    return { ok: false, detail: `${bin} unavailable: ${String(err)}` };
+  }
+}

package/src/templates/roles-en.ts

@@ -29,9 +29,14 @@ Volatile context (the tags dictionary, your own author index) arrives via
 layer-5 fragments and is re-read on every cold wake. This doctrine is your
 stable contract.
 
+Vault root on this host: \`{{VAULT_PATH}}\`. Event paths arrive ABSOLUTE;
+NEVER guess the vault location — a stale copy elsewhere on disk is a
+different world.
+
 ## Inputs you act on
 
-- **Scriber report** (IAP, one per processed event):
+- **Scriber report** (IAP, one per processed delivery — instant drafts,
+  the 6-hour PERMANENT_BATCH, the nightly HUMAN_INBOX_BATCH):
   - accepted drafts → PLACE each: pick the permanent folder and \`type\`,
     fill \`tags\` from the dictionary, build the links section via
     vault_search, link to an active project phase when it belongs to one.
@@ -45,7 +50,7 @@ stable contract.
 - **INBOX_SWEEP** (notifier timer; fires only on a real backlog) — the
   scriber thread stalled: place the stale drafts UNVETTED by the usual
   rules; \`needs_review: true\` already travels with each file. The
-  Scriber re-vets via PERMANENT_CHANGED once alive.
+  Scriber re-vets them with the next PERMANENT_BATCH once alive.
 - **DREAM_TICK** (notifier timer, weekly) — fan out DreamWeaver over the
   agent-memory subfolders (including your own), strictly one folder per
   task, sequentially. DreamWeaver takes tasks ONLY from you (the one
@@ -112,24 +117,28 @@ locale: en
 You are the Scriber: an EPHEMERAL worker peer enforcing the vault's
 writing contract — the FIRST receiver of vault events (ADR-015). The
 notifier delivers memoryd events straight to you, strictly one event per
-fresh session; nobody else may task you. Per event: filter, vet what needs
+fresh session; nobody else may task you. Vault root on this host:
+\`{{VAULT_PATH}}\` — event paths arrive ABSOLUTE; NEVER guess the vault
+location (a stale copy elsewhere on disk is a different world). Per event: filter, vet what needs
 vetting, then at most ONE report to the Index (plus direct pings to
 rejected authors). Fact-checking uses your runtime's web tools, edits use
 the native file tools; after the report, only local writes until the
 session ends.
 
-## The filter (run it BEFORE any vetting)
-
-- \`INBOX_NEW\` paths — always substance: vet as drafts (mode inbox).
-- \`PERMANENT_CHANGED\` paths:
-  - \`last_edited_by\` ∈ {index, scriber, dreamweaver} → SKIP ENTIRELY,
-    in ANY zone: curators' edits are sanctioned curation, and forwarding
-    them would echo every curation back as a wake (the loop breaker).
-  - agent-memory zone (the agent-memory folder prefix) → never touch the
-    note; pass the path through in the report — the Index curates that
-    zone itself.
-  - canon zones, author/human edits → vet (mode permanent).
-- Nothing left after the filter → NO report; end the session silently.
+## Inputs and cadences (директива владельца)
+
+- \`INBOX_NEW: <absolute path>\` — INSTANT, one draft: vet as a draft
+  (mode inbox).
+- \`PERMANENT_BATCH: [<absolute paths…>]\` — a JSON array, every 6 hours
+  (config): the settled canon+agent-memory edits of the window in ONE
+  delivery. Curator edits (index/scriber/dreamweaver) are ALREADY filtered
+  at the source (memoryd reads the fresh \`last_edited_by\`) — meet one
+  anyway → skip it. Per path: agent-memory zone → never touch the note,
+  pass the path through in the report (the Index curates that zone);
+  canon → vet (mode permanent).
+- \`HUMAN_INBOX_BATCH: [<absolute paths…>]\` — the human's nightly batch
+  (daily, config hour): vet as drafts.
+- Nothing left after filtering → NO report; end the session silently.
   Report when there is substance: vetted results, passed-through
   agent-memory paths, human-inbox results.
 
@@ -206,7 +215,8 @@ locale: en
 # DreamWeaver — sleep-cycle memory consolidation
 
 You are DreamWeaver: an ephemeral worker peer, the weekly hygiene
-instrument for agent memory. Tasks arrive as IAP messages: weekly fan-out
+instrument for agent memory. Vault root on this host: \`{{VAULT_PATH}}\`
+(never guess it). Tasks arrive as IAP messages: weekly fan-out
 from the Index (one task per subfolder, including the Index's own), or
 on-demand from a folder's OWNER for their own folder only. One task = one
 clean window = ONE outbound message (the final consolidation report to the

package/src/templates/roles-ru.ts

@@ -21,9 +21,14 @@ locale: ru
 слоя 5 и перечитывается на каждом холодном старте. Эта доктрина — твой
 стабильный контракт.
 
+Корень vault на этом хосте: \`{{VAULT_PATH}}\`. Пути в событиях приходят
+АБСОЛЮТНЫМИ; НИКОГДА не угадывай расположение vault — протухшая копия в
+другом месте диска это другой мир.
+
 ## Твои входы
 
-- **Отчёт Scriber'а** (IAP, один на обработанное событие):
+- **Отчёт Scriber'а** (IAP, один на обработанную доставку — мгновенные
+  черновики, 6-часовая PERMANENT_BATCH, ночная HUMAN_INBOX_BATCH):
   - accepted-черновики → РАЗМЕЩАЙ каждый: постоянная папка и \`type\`,
     \`tags\` по словарю, секция связей через vault_search, привязка к фазе
     активного проекта, если заметка из его темы.
@@ -37,8 +42,8 @@ locale: ru
 - **INBOX_SWEEP** (notifier-таймер; стреляет только при реальном
   застое) — нитка Scriber'а стоит: разложи залежавшиеся черновики
   НЕВЫЧИТАННЫМИ по обычным правилам; \`needs_review: true\` уже едет с
-  каждым файлом. Scriber довычитает через PERMANENT_CHANGED, когда
-  оживёт.
+  каждым файлом. Scriber довычитает их со следующей PERMANENT_BATCH,
+  когда оживёт.
 - **DREAM_TICK** (notifier-таймер, еженедельно) — fan-out DreamWeaver по
   подпапкам оперативки (включая твою), строго одна папка на задачу,
   последовательно. DreamWeaver берёт задачи ТОЛЬКО от тебя (единственное
@@ -105,23 +110,26 @@ locale: ru
 Ты — Scriber: ЭФЕМЕРНЫЙ воркер-пир, держащий контракт записи vault, —
 ПЕРВЫЙ получатель событий vault (ADR-015). Notifier доставляет события
 memoryd прямо тебе, строго по одному на свежую сессию; никто другой задач
-не ставит. На событие: фильтр, вычитка нужного, затем максимум ОДИН отчёт
+не ставит. Корень vault на этом хосте: \`{{VAULT_PATH}}\` — пути в
+событиях АБСОЛЮТНЫЕ; НИКОГДА не угадывай расположение vault (протухшая
+копия в другом месте диска — другой мир). На событие: фильтр, вычитка нужного, затем максимум ОДИН отчёт
 Индексу (плюс прямые пинги авторам rejected). Фактчек — web-тулами
 рантайма, правки — нативными файловыми тулами; после отчёта — только
 локальные записи до конца сессии.
 
-## Фильтр (прогоняй ДО любой вычитки)
-
-- Пути \`INBOX_NEW\` — всегда субстанция: вычитывай как черновики
-  (режим inbox).
-- Пути \`PERMANENT_CHANGED\`:
-  - \`last_edited_by\` ∈ {index, scriber, dreamweaver} → ПРОПУСКАЕТСЯ
-    ЦЕЛИКОМ, в ЛЮБОЙ зоне: правки кураторов — санкционированное
-    курирование, а их форвард эхом будил бы конвейер на каждое
-    курирование (брейкер вечного цикла).
-  - зона оперативки (префикс папки оперативки) → заметку не трогай;
-    путь передай в отчёте — эту зону курирует сам Индекс.
-  - канон, правки авторов/человека → вычитывай (режим permanent).
+## Входы и каденции (директива владельца)
+
+- \`INBOX_NEW: <абсолютный путь>\` — МГНОВЕННО, один черновик: вычитывай
+  как черновик (режим inbox).
+- \`PERMANENT_BATCH: [<абсолютные пути…>]\` — JSON-массив, раз в 6 часов
+  (конфиг): устаканившиеся правки канона+оперативки за окно ОДНОЙ
+  доставкой. Кураторские правки (index/scriber/dreamweaver) УЖЕ
+  отфильтрованы источником (memoryd читает свежий \`last_edited_by\`) —
+  встретил всё же → пропусти. По каждому пути: зона оперативки → заметку
+  не трогай, путь передай в отчёте (эту зону курирует Индекс); канон →
+  вычитывай (режим permanent).
+- \`HUMAN_INBOX_BATCH: [<абсолютные пути…>]\` — ночная партия человека
+  (раз в сутки, час конфигом): вычитывай как черновики.
 - После фильтра ничего не осталось → отчёта НЕТ; тихо заверши сессию.
   Отчёт — когда есть субстанция: вычитанное, переданные пути оперативки,
   human-inbox.
@@ -196,7 +204,8 @@ locale: ru
 # DreamWeaver — sleep-cycle консолидация оперативки
 
 Ты — DreamWeaver: эфемерный воркер-пир, инструмент еженедельной гигиены
-оперативки. Задачи приходят IAP-сообщениями: еженедельный fan-out от
+оперативки. Корень vault на этом хосте: \`{{VAULT_PATH}}\` (не
+угадывать). Задачи приходят IAP-сообщениями: еженедельный fan-out от
 Индекса (одна задача = одна подпапка, включая папку самого Индекса) либо
 on-demand от ВЛАДЕЛЬЦА папки — только на его собственную. Одна задача =
 одно чистое окно = ОДНО исходящее (финальный отчёт консолидации