@bluenotelogic/harness 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,114 @@
+# Changelog
+
+Notable changes to `@bluenotelogic/harness`. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/). While the version is 0.x, a minor
+release may contain breaking changes; they are listed first.
+
+## [0.2.0] - 2026-10-31
+
+Everything since 0.1.0 (the npm release, built from `7b48279`). The product is now ProofMEM, and
+the defaults follow it.
+
+### Breaking
+
+- **Default server** `https://mem.bnlgit.com` is now `https://proofmem.com`. Use `--url` to point
+  at another deployment.
+- **OAuth client** `blue-note-mem-mcp` is now `proofmem-mcp`. Use `--client-id` if your server
+  still registers the old client.
+- **Codex token variable** `BNL_MEMORY_MCP_TOKEN` is now `PROOFMEM_TOKEN`, and the Codex config
+  references the new name. Existing `BNL_MEMORY_MCP_TOKEN` and `CAVEAU_MCP_TOKEN` lines in
+  `~/.codex/.env` are left in place, with a one-line notice naming them (never their values).
+- **MCP server key** `mem` is now `proofmem`. The key comes from the server's bundle; `proofmem`
+  is also the fallback. `--server-name` still overrides it.
+- **No token in the repo, ever.** `--mint-token` and `--codex` no longer write the token into
+  the target repo's `.claude/settings.local.json`. `~/.codex/.env` is its only home; Claude Code
+  and VS Code use OAuth and need no token.
+- **Codex config is one managed block.** The installer now owns a marked
+  `# BEGIN/END @bluenotelogic/harness managed MCP` block in `~/.codex/config.toml`, with
+  `default_tools_approval_mode = "prompt"` and approvals for the memory and harness-run tools.
+  The 0.1.0 block, and the exact table `codex mcp add` writes, are adopted into it. Any other
+  table with the same name is left untouched and reported, never overwritten.
+
+### Added
+
+- `--antigravity`: installs the ProofMEM plugin for Google Antigravity. It has a
+  tokenless native OAuth MCP config, plus Caveau Harness v2 lifecycle hooks that use their own
+  owner-only 90-day key. Needs `--harness-home <caveau-harness-v2>` (or `HARNESS_HOME`), and bash
+  plus jq for the hooks. `--antigravity-home` overrides `~/.gemini/config`.
+  - Only the memory hooks get the hook key, and they are then pinned to ProofMEM
+    (`HARNESS_MEMORY_PROVIDER` and `HARNESS_COORDINATION_STORE` = `caveaumem`). The key and its
+    API URL always come as a pair from one source.
+  - The guard, checkpoint, lint and verify hooks get no credential-shaped environment variable:
+    a name part that is `KEY`, `PAT`, `PWD`, `PASS` or `AUTH` (`AUTH` except in `HARNESS_*`
+    names), or that ends in `TOKEN`, `SECRET`, `PASSWORD`, `PASSWD`, `PASSPHRASE`, `CREDENTIAL`,
+    `BEARER`, `APIKEY` or `JWT`. Nor do they get the editor's Git and SSH credential bridges,
+    which hold no secret but hand a child process your credentials anyway: `GIT_ASKPASS`,
+    `SSH_ASKPASS`, `SSH_ASKPASS_REQUIRE`, `SSH_AUTH_SOCK`, `GIT_SSH_COMMAND`, `GIT_SSH`, every
+    `VSCODE_GIT_*`, and `GIT_CONFIG_PARAMETERS`, `GIT_CONFIG_COUNT`, `GIT_CONFIG_KEY_<n>` and
+    `GIT_CONFIG_VALUE_<n>`. A trusted project's verify build that needs your SSH agent or Git
+    sign-in has to be run by hand. Other names, a credential helper your own Git config names, and
+    credential files such as `~/.npmrc`, are not hidden.
+  - With `--codex` as well, Codex and the hooks get separate keys, so revoking one leaves the
+    other working.
+- `--verify-gate`: opt in to the Antigravity Stop hook running the open project's own
+  build/test/lint. Off by default, because it runs that project's code. An empty exported
+  `HARNESS_VERIFY_GATE` counts as unset, so it cannot switch the gate on.
+- Sign-in through the proofmem.com OAuth gateway. Its `/oauth/token` already returns a ProofMEM
+  key (`cmem_…`), which the CLI now uses directly; sending it to `/api/oidc_exchange.php` again
+  was a 401 that made sign-in impossible. A Blue Note ID token, from a server without the
+  gateway, is still exchanged.
+- `doctor`: read-only installation checks for the Codex block, the credential store,
+  `HARNESS_HOME` and a tokenless repo config. With `--antigravity` it also checks the plugin,
+  hook-key expiry and that bash resolves. It never prints a credential.
+- A minted token's expiry (90 days, set by the server) is printed after a real run. The value
+  never is.
+- Distinct messages for an identity the server cannot use (422) and for Blue Note ID being
+  down (503), so neither reads as a failed login.
+- A sign-in the proofmem.com gateway refuses with `access_denied` (no ProofMEM subscription, or a
+  Blue Note ID without a verified email) now says so and where to fix each: `/pricing.php` on
+  the server, or `https://id.bluenotelogic.com`. It used to print
+  `token exchange failed: 400 {"error":"access_denied"}`, which read as a failed login. With
+  `--device` it also lists a declined approval.
+- `NOTICE` and this `CHANGELOG.md` ship in the package.
+
+### Fixed
+
+- On Windows the browser opens the whole sign-in URL. It used to go through `cmd /c start`,
+  which ends a command at every `&`, so the browser opened `/oauth/authorize?response_type=code`
+  only and the server refused it; pasting the printed URL was the only way in. The CLI now
+  starts `rundll32 url.dll,FileProtocolHandler` directly, with no shell, and opens only http(s)
+  URLs.
+- `--dry-run` no longer mints. It used to create a real, non-expiring token server-side and print
+  it in the preview. Credential files are now shown redacted. Signing in still creates one
+  short-lived (1 h) session key.
+- A sign-in no longer leaves its refresh grant behind. The CLI asks for `offline_access` but
+  never uses the refresh token, and through proofmem.com that token stands for a Blue Note ID
+  refresh token the gateway keeps, encrypted, for up to 35 days. Every run, `--dry-run` included,
+  now revokes it (RFC 7009) once the configuration is fetched, and says so if the server does not
+  confirm.
+- The token no longer lands in the repo (see Breaking): `.claude/settings.local.json` is never
+  written.
+- Credential files are owner-only: `chmod 0600` on Linux and macOS, and on Windows an access list
+  with exactly one entry for the current user's SID (verified in any language; sandbox entries
+  such as `CodexSandboxUsers` are removed). A credential file is recreated rather than rewritten,
+  so an old grant cannot survive. If the protection cannot be proved, the file is deleted and the
+  install fails.
+
+### Migrating from 0.1.0
+
+1. Re-run `npx @bluenotelogic/harness init` in each configured repo. It adds the `proofmem`
+   server to `.mcp.json` and never deletes keys it does not own, so remove the old `mem` entry by
+   hand.
+2. If you used `--mint-token` or `--codex` with 0.1.0, delete the `BNL_MEMORY_MCP_TOKEN` entry
+   from that repo's `.claude/settings.local.json`. Tokens from that era may have no expiry, so
+   revoke the ones you no longer use at `https://proofmem.com/app/keys.php`.
+3. Codex: re-run `init --codex`. The managed block switches to `PROOFMEM_TOKEN`. Remove
+   `BNL_MEMORY_MCP_TOKEN` / `CAVEAU_MCP_TOKEN` from `~/.codex/.env` once nothing else on the
+   machine reads them; `doctor` warns while they are there.
+4. For a deployment other than proofmem.com, pass `--url`, and `--client-id` if it still uses the
+   old OAuth client.
+
+## [0.1.0]
+
+First npm release: `init` with browser (PKCE) and `--device` sign-in, a tokenless `.mcp.json`,
+optional `--mint-token` / `--codex`, `--harness-home` routing, and `--timeout`.

package/NOTICE

@@ -0,0 +1,5 @@
+BNL Harness (client)
+Copyright 2026 Blue Note Logic Inc.
+
+This product includes software developed at Blue Note Logic Inc.
+(https://bluenotelogic.com/).

package/README.md

@@ -1,6 +1,6 @@
 # @bluenotelogic/harness
 
-Point a machine at [Blue Note Memory](https://mem.bnlgit.com) in one command.
+Point a machine at [ProofMEM](https://proofmem.com) in one command.
 
 ```bash
 npx @bluenotelogic/harness init
@@ -12,7 +12,7 @@ working MCP config into the current repo.
 ## What it writes — and what it deliberately does not
 
 ```json
-{ "mcpServers": { "mem": { "type": "http", "url": "https://mem.bnlgit.com/mcp" } } }
+{ "mcpServers": { "proofmem": { "type": "http", "url": "https://proofmem.com/mcp" } } }
 ```
 
 **There is no token in that file.** Claude Code and VS Code discover authentication from the
@@ -24,25 +24,63 @@ That is the entire point of this tool. The setup it replaces meant pasting a bea
 hand into `.mcp.json`, `~/.claude.json`, `~/.codex/config.toml` and a VS Code roaming
 profile — and rotating anything meant editing every one of them again.
 
-## Codex and CI
+## Codex
 
-Those hosts cannot do OAuth yet, so they need a real credential:
+Codex can sign in with OAuth on its own. Codex CLI 0.163.0 runs the OAuth flow for an MCP
+server with `codex mcp login <name>` and keeps that credential itself; this was verified with
+proofmem.com on 2026-10-27. That path needs no token from this CLI. A plain `init` writes no
+Codex config, so add the server to Codex first, then sign in:
+
+```bash
+codex mcp add proofmem --url https://proofmem.com/mcp
+codex mcp login proofmem
+```
+
+The same two steps are in the [ProofMEM docs](https://proofmem.com/docs.php).
+
+This CLI does not run Codex's sign-in for you. `--codex` configures Codex with a minted token
+instead (`--codex` implies `--mint-token`):
 
 ```bash
 npx @bluenotelogic/harness init --codex
 ```
 
-The minted token goes to `~/.codex/.env` and is referenced from `config.toml` by name
-(`bearer_token_env_var`), so the config file stays safe to read over someone's shoulder — and
-the token still never touches the repo. Minting is opt-in: without `--codex` or
-`--mint-token`, this CLI creates no credential and no database row.
+The minted token goes to `~/.codex/.env` as `PROOFMEM_TOKEN` and is referenced from
+`config.toml` by name (`bearer_token_env_var`), so the config file stays safe to read over someone's shoulder — and
+the token still never touches the repo, not even the target repo's own `.claude/settings.local.json`.
+Minting is opt-in: without `--codex` or `--mint-token`, this CLI creates no credential and no
+database row.
+
+`BNL_MEMORY_MCP_TOKEN` and `CAVEAU_MCP_TOKEN` are earlier names for that token. If the Codex env
+file still has them, the installer leaves those lines exactly as they are, because other tools
+on the machine may still read them, and prints a one-line notice naming them (never their
+values). Remove them by hand once nothing uses them. The Codex TOML
+writer owns one explicitly marked block; it preserves unrelated servers and settings, updates
+its own block idempotently, and refuses an unowned table whose ownership is ambiguous.
+
+Two more things a minted token gets, that a hand-pasted one never did: an expiry — 90 days,
+printed to you (never the value) after a real run — and the file is locked to your own account
+only (`chmod 0600` on Linux/macOS, an owner-only ACL on Windows) immediately after it is
+written. If that protection can't be verified, the file is deleted rather than left in an
+unknown state.
 
-For CI, skip the browser entirely with a token you already hold:
+## CI
+
+A CI runner has no browser and nobody there to sign in, so it needs a real credential. Pass
+a ProofMEM key you already hold (a `cmem_` token) and the CLI skips sign-in entirely:
 
 ```bash
-npx @bluenotelogic/harness init --token "$BNL_MEMORY_MCP_TOKEN"
+npx @bluenotelogic/harness init --token "$PROOFMEM_TOKEN"
 ```
 
+The CLI uses that key only for this run. It writes the same tokenless `.mcp.json` and stores
+no credential, so an agent on the runner gets no key from it. If an agent there needs a key of
+its own, add `--mint-token`: the CLI mints one and writes it to `~/.codex/.env` as
+`PROOFMEM_TOKEN`, outside the repo.
+
+`--device` (below) also works without a browser on the machine, but someone has to approve the
+code on another device, so it suits headless machines and SSH sessions, not unattended CI.
+
 ## Headless machines
 
 ```bash
@@ -51,29 +89,133 @@ npx @bluenotelogic/harness init --device
 
 Prints a short code and a URL to open on any other device. Standard RFC 8628 device flow.
 
+## Google Antigravity
+
+Google Antigravity signs in to ProofMEM with OAuth, and its Caveau Harness hooks are available now.
+The hooks need a Caveau Harness v2 checkout, which is not publicly distributed: our team sets it up
+with you in a guided Caveau Harness session (contact ProofMEM to book one). With the checkout in
+place, install the ProofMEM plugin and its Caveau Harness v2 lifecycle adapter with:
+
+```bash
+npx @bluenotelogic/harness init --antigravity --harness-home /path/to/caveau-harness-v2
+```
+
+On Windows, `--harness-home C:\\path\\to\\caveau-harness-v2` is accepted. If `HARNESS_HOME`
+already names a v2 checkout, the flag may be omitted.
+
+The installed `mcp_config.json` points directly at `https://proofmem.com/mcp` and carries no
+token, header, environment variable, or stdio bridge. Antigravity completes native OAuth/DCR and
+keeps that session in its own protected store. Lifecycle hook processes cannot read that OAuth
+store, so the installer mints a second bounded token solely for hooks and locks it to the current
+OS account under `~/.gemini/config/proofmem/hook-token`. Its value is not copied into the plugin,
+repo, logs, or Codex environment.
+
+On Windows the file's access list is replaced with a single entry for the current user (by SID,
+so it holds in every Windows language) and then verified; sandbox groups such as
+`CodexSandboxUsers` are removed rather than tolerated. If that cannot be proved, the file is
+deleted and the install fails. With `--codex` as well, Codex and the hooks get separate tokens.
+
+The hook token is never handed to the guard, checkpoint, lint, or verify scripts, so a project's
+own build or test scripts do not inherit it from Antigravity. Nor do they get any environment
+variable whose name, split at every character that is not a letter or digit, has a part that is
+`KEY`, `PAT`, `PWD`, `PASS` or `AUTH`, or that ends in `TOKEN`, `SECRET`, `PASSWORD`, `PASSWD`,
+`PASSPHRASE`, `CREDENTIAL`, `BEARER`, `APIKEY` or `JWT` (case-insensitive, plural or a trailing
+`KEY` allowed): `GITHUB_TOKEN`, `AWS_SECRET_ACCESS_KEY`, `OPENAI_API_KEY`, `NPM_CONFIG__AUTH`,
+`GITEA_PAT`, `DB_PWD`, `SSH_AUTH_SOCK`, `CI_JOB_JWT`, and so on. `PATH`, `HOME`, `PWD` and the
+other process basics are always kept, and an `AUTH` part does not count in the Harness's own
+`HARNESS_*` names, where it is a mode switch (`HARNESS_MEMORY_AUTH`).
+They also lose the editor's credential bridges, variables that hold no secret but let a child
+process use your Git or SSH credentials anyway: `GIT_ASKPASS`, `SSH_ASKPASS`,
+`SSH_ASKPASS_REQUIRE`, `SSH_AUTH_SOCK`, `GIT_SSH_COMMAND`, `GIT_SSH`, every `VSCODE_GIT_*` (the
+editor's askpass helper and its IPC handle, which can answer with your Git account's token), and
+`GIT_CONFIG_PARAMETERS`, `GIT_CONFIG_COUNT`, `GIT_CONFIG_KEY_<n>` and `GIT_CONFIG_VALUE_<n>`
+(which can inject a credential helper). The memory hooks keep them for SessionStart's Git refresh.
+So if a trusted project's opt-in verify build needs your SSH agent or Git sign-in, run that build
+yourself. A credential under any other name, a credential helper your own Git config already
+names (such as Git Credential Manager), and credential files such as `~/.npmrc` or
+`~/.aws/credentials` are not hidden, which is one more reason the verify gate below is opt-in.
+The memory hooks that do receive the hook token are pinned to ProofMEM
+(`HARNESS_MEMORY_PROVIDER=caveaumem`, `HARNESS_COORDINATION_STORE=caveaumem`), so an exported
+value cannot send that session's memory to another store.
+
+The plugin adapts SessionStart bootstrap, focused per-prompt context, destructive-command checks,
+edit checkpoints/lint, and memory capture. Restart Antigravity after install, enable the ProofMEM
+plugin, and authenticate its MCP server when prompted.
+
+**Prerequisites for the hooks: bash and jq.** On Windows that is Git for Windows' bash, plus jq
+installed so that it runs from that bash (Git for Windows does not include jq); WSL bash is
+deliberately not used. On Linux and macOS, bash and jq on the `PATH`. Without bash no hook runs,
+and without jq the memory hooks cannot work; either way they fail open rather than block you.
+
+The Stop verification gate is **off by default**. When on, it runs the open project's own
+`npm run build`, `npm test` or `npm run lint` each time the agent stops, outside Antigravity's
+command approval, so opening an untrusted repository would run its code. Turn it on with
+`--verify-gate` only for projects you trust. An exported `HARNESS_VERIFY_GATE=0` or `=1` overrides
+that choice; an empty value counts as unset.
+
+The hook token is bounded (90 days). `doctor --antigravity` warns 14 days before it expires, and
+SessionStart says so too. Renew it by running the same `init --antigravity` command again; do not
+export a token in the environment instead. The MCP server's `enabledTools` list hides skill/tool
+authoring and vault tools from the agent. It is a convenience, not a security boundary: the
+server enforces each token's scopes, and no ProofMEM token can read the vault.
+
 ## Options
 
 | Flag | Effect |
 |---|---|
-| `--dry-run` | Show every file that would change, write nothing |
-| `--url <base>` | Point at a self-hosted deployment (default `https://mem.bnlgit.com`) |
+| `--dry-run` | Show every file that would change and write nothing. Mints no long-lived token, but signing in still creates one short-lived (1 h) session key on the server; the sign-in's refresh grant is revoked at once (see below) |
+| `--url <base>` | Point at a self-hosted deployment (default `https://proofmem.com`) |
 | `--dir <path>` | Repo to configure (default: current directory) |
 | `--device` | Device-code login for headless boxes and SSH sessions |
 | `--token <token>` | Use an existing token instead of logging in |
 | `--mint-token` | Also mint a token for hosts that cannot do OAuth |
 | `--codex` | Configure Codex too (implies `--mint-token`) |
+| `--antigravity` | Install the ProofMEM Antigravity plugin (implies one hook-token mint) |
+| `--antigravity-home <dir>` | Override Antigravity config home (default `~/.gemini/config`) |
+| `--verify-gate` | Antigravity: run the open project's build/test/lint when the agent stops (off by default) |
 | `--harness-home <dir>` | Materialize hosted model routing into `<dir>/state/routing/` |
 | `--server-name <name>` | Override the MCP server key written into `.mcp.json` |
 | `--no-browser` | Print the login URL instead of opening a browser |
 
+Validate the result without contacting the service or printing secrets:
+
+```bash
+npx @bluenotelogic/harness doctor --dir /path/to/repo
+```
+
+For the Antigravity installation only:
+
+```bash
+npx @bluenotelogic/harness doctor --antigravity --dir /path/to/repo
+```
+
+The doctor requires the canonical token reference, one installer-managed Codex block, a
+tokenless repo MCP config, and a `HARNESS_HOME` whose `.harness-generation` marker is exactly
+`caveau-harness-v2`. Routing will not be written into an archived or unidentified harness.
+
 Run `--dry-run` first if you like seeing before you commit. It prints the full contents of
-every file it would touch.
+every file it would touch — except a credential file (`~/.codex/.env`), which is shown as
+`create`/`update` with its content redacted, whether or not `--dry-run` actually minted
+anything. `--dry-run` writes nothing and never mints a long-lived token: no Codex or hook key is
+created. Signing in still creates one short-lived (1 h) session key on the server, because that
+key is how the CLI reads your configuration; with `--token`, not even that.
+
+Signing in also returns a refresh token, which the CLI never uses. Through proofmem.com it stands
+for a sign-in record the gateway keeps (your Blue Note ID refresh token, encrypted, for up to 35
+days). So once the CLI has your configuration, on every run including `--dry-run`, it revokes that
+refresh token at the server's revocation endpoint, and the record is gone. If the server does not
+confirm, the CLI prints a one-line note, and the record lapses on its own when it expires.
+
+Revoking: every ProofMEM key, including that session key and the 90-day Codex and hook keys, is
+listed in the ProofMEM console at `https://proofmem.com/app/keys.php`, and revoking it there cuts
+it off. Signing out of Blue Note ID does not: a key already handed to a client stays valid until
+it expires.
 
 ## It will not clobber your config
 
-Every write reads what is already on disk and replaces **only** the keys it owns. An
-unrelated MCP server in your `.mcp.json` survives untouched; so do unrelated top-level keys,
-your Codex settings, and any hooks in `.claude/settings.local.json`.
+Every write reads what is already on disk and replaces **only** the keys or marked blocks it
+owns. An unrelated MCP server in your `.mcp.json` or Codex TOML survives untouched, and so do
+unrelated top-level keys.
 
 If a file is not valid JSON, the CLI reports it and **leaves it exactly as it found it** —
 "it looked broken" is precisely when someone's half-finished hand edit is sitting in it.
@@ -97,16 +239,29 @@ not. `test/writers.test.js` pins that behaviour so it cannot happen again.
   .mcp.json, routing YAML, optional Codex config
 ```
 
+On proofmem.com the OAuth endpoints belong to the ProofMEM gateway, which runs the
+`oidc_exchange.php` step itself and returns the short-lived ProofMEM key (`cmem_…`) as the
+access token. The CLI recognises that key and goes straight to `harness_bootstrap.php`; it only
+calls `oidc_exchange.php` itself when the sign-in returned a Blue Note ID token, as a server
+without the gateway does.
+
 Identity and entitlement are separate on purpose. A Blue Note Account authenticates a person;
 it does not by itself grant memory access. If you sign in successfully but hold no
-subscription you get a clear message saying exactly that, rather than a login error that
-sends you looking in the wrong place.
+subscription, the exchange says exactly that, rather than giving a login error that sends you
+looking in the wrong place. Through the gateway that refusal, and an identity the server cannot
+use (no verified email on the Blue Note Account), both end the sign-in with `access_denied`, so
+the CLI names both causes: start a subscription at `https://proofmem.com/pricing.php`, or verify
+the account's email at `https://id.bluenotelogic.com`, then run the command again. Signing in
+again without either change does not help.
 
 ## Requirements
 
 Node 20 or newer. **No runtime dependencies** — PKCE, the loopback listener and the HTTP
 client are all Node built-ins, so `npx` is fast and there is no dependency tree to audit.
 
+The Antigravity hooks also need bash and jq: Git for Windows' bash plus jq on
+Windows, bash plus jq elsewhere. See [Google Antigravity](#google-antigravity).
+
 ## Development
 
 ```bash
@@ -119,5 +274,5 @@ npm run lint      # tsc --noEmit
 
 Apache-2.0 — © 2026 Blue Note Logic Inc. See [LICENSE](LICENSE).
 
-This CLI is free and open source. It configures a machine to talk to Blue Note
-Memory; a Blue Note Memory subscription is a separate commercial product.
+This CLI is free and open source. It configures a machine to talk to ProofMEM;
+a ProofMEM subscription is a separate commercial product.

package/assets/antigravity-plugin/README.md

@@ -0,0 +1,69 @@
+# ProofMEM for Google Antigravity
+
+Installed and updated by `npx @bluenotelogic/harness init --antigravity`.
+
+The MCP server uses Antigravity's native Streamable HTTP OAuth/DCR support. Its
+`mcp_config.json` deliberately contains no bearer header, environment variable, token, or
+stdio bridge. Antigravity owns and refreshes that OAuth session in its protected store.
+
+Lifecycle hooks run through Caveau Harness v2. Because Antigravity does not expose its OAuth
+credential to hook subprocesses, the installer mints a separate bounded ProofMEM token for
+those hooks and protects it in the user's Antigravity config directory. `harness-home.json`
+contains paths and the ProofMEM API URL only; it never contains the credential value.
+
+If the MCP server first appears as `Unauthorized`, open Antigravity's Customizations / MCP
+Servers panel and authenticate the ProofMEM server. Do not add headers or tokens to the plugin.
+
+The hooks need bash and jq. On Windows that means Git for Windows' bash, plus jq installed so
+that it runs from that bash (Git for Windows does not include jq); WSL bash is not used.
+Elsewhere, any bash with jq on its PATH.
+
+Only the memory hooks receive the hook credential. When they do, they are also pinned to
+ProofMEM (`HARNESS_MEMORY_PROVIDER` and `HARNESS_COORDINATION_STORE` = `caveaumem`), so an
+exported value cannot send that session's memory to another store. The command guard, edit
+checkpoint, lint and verify scripts run without the credential, and without any environment
+variable whose name has a part (split at every non-letter, non-digit) that is `KEY`, `PAT`, `PWD`,
+`PASS` or `AUTH`, or that ends in `TOKEN`, `SECRET`, `PASSWORD`, `PASSWD`, `PASSPHRASE`,
+`CREDENTIAL`, `BEARER`, `APIKEY` or `JWT`: `GITHUB_TOKEN`, `AWS_SECRET_ACCESS_KEY`,
+`NPM_CONFIG__AUTH`, `GITEA_PAT`, `SSH_AUTH_SOCK`, and so on. `PATH`, `HOME`, `PWD` and the other
+process basics are always kept, and an `AUTH` part does not count in the Harness's own `HARNESS_*`
+names, where it is a mode switch (`HARNESS_MEMORY_AUTH`).
+
+Those four scripts also run without the editor's credential bridges, which hold no secret but let
+a child process use your Git or SSH credentials anyway: `GIT_ASKPASS`, `SSH_ASKPASS`,
+`SSH_ASKPASS_REQUIRE`, `SSH_AUTH_SOCK`, `GIT_SSH_COMMAND`, `GIT_SSH`, every `VSCODE_GIT_*` (the
+askpass helper and its IPC handle back into the editor), and `GIT_CONFIG_PARAMETERS`,
+`GIT_CONFIG_COUNT`, `GIT_CONFIG_KEY_<n>` and `GIT_CONFIG_VALUE_<n>` (which can inject a credential
+helper). The memory hooks keep them for SessionStart's Git refresh. If a trusted project's opt-in
+verify build needs your SSH agent or Git sign-in, run that build yourself. A credential under any
+other name, a credential helper your own Git config already names (such as Git Credential
+Manager), and files such as `~/.npmrc` or `~/.aws/credentials` are not hidden from them.
+
+The hook credential lasts 90 days; SessionStart and `doctor --antigravity` warn 14 days ahead.
+Renew it by re-running the same `npx @bluenotelogic/harness init --antigravity ...` command,
+never by exporting a token. To cut it off sooner, revoke it in the ProofMEM console at
+`https://proofmem.com/app/keys.php`. Signing out of Blue Note ID does not cancel a key a client
+already holds: it stays valid until it expires or is revoked there.
+
+The installer's own sign-in leaves only the keys it creates on the server (the hook key, and a
+1-hour session key it reads your configuration with). Once it has your configuration it revokes
+that sign-in's refresh grant, which through proofmem.com is an encrypted Blue Note ID refresh
+token the gateway would otherwise keep for up to 35 days; if the server does not confirm, the
+installer says so and the record lapses on its own. Antigravity's MCP sign-in is different: the
+gateway keeps its refresh token, encrypted, so that Antigravity can stay signed in without asking
+you again.
+
+The Stop verification gate is off unless you installed with `--verify-gate`. When on, it runs the
+open project's own build/test/lint whenever the agent stops, outside Antigravity's command
+approval, so enable it only for projects you trust. An exported `HARNESS_VERIFY_GATE=0` or `=1`
+overrides the install choice; an empty value counts as unset.
+
+`enabledTools` in `mcp_config.json` controls which tools Antigravity offers. It is a convenience,
+not a security boundary: ProofMEM enforces each token's scopes server-side. The hooks fail open:
+a guard or memory error never blocks your work, so treat their warnings as diagnostics.
+
+Run a read-only installation check with:
+
+```text
+npx @bluenotelogic/harness doctor --antigravity --harness-home /path/to/caveau-harness-v2
+```

package/assets/antigravity-plugin/hooks.json

@@ -0,0 +1,77 @@
+{
+  "proofmem-session-bootstrap": {
+    "enabled": true,
+    "SessionStart": [
+      {
+        "type": "command",
+        "command": "node ./scripts/antigravity-hook.mjs session-start",
+        "timeout": 40
+      }
+    ]
+  },
+  "proofmem-focused-memory": {
+    "enabled": true,
+    "PreInvocation": [
+      {
+        "type": "command",
+        "command": "node ./scripts/antigravity-hook.mjs prompt-context",
+        "timeout": 30
+      }
+    ]
+  },
+  "proofmem-command-guard": {
+    "enabled": true,
+    "PreToolUse": [
+      {
+        "matcher": "run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ./scripts/antigravity-hook.mjs pre-tool",
+            "timeout": 15
+          }
+        ]
+      }
+    ]
+  },
+  "proofmem-edit-checkpoint": {
+    "enabled": true,
+    "PreToolUse": [
+      {
+        "matcher": "write_file|edit_file|write_to_file|replace_file_content|multi_replace_file_content",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ./scripts/antigravity-hook.mjs pre-edit",
+            "timeout": 15
+          }
+        ]
+      }
+    ]
+  },
+  "proofmem-post-edit": {
+    "enabled": true,
+    "PostToolUse": [
+      {
+        "matcher": "write_file|edit_file|write_to_file|replace_file_content|multi_replace_file_content",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ./scripts/antigravity-hook.mjs post-edit",
+            "timeout": 60
+          }
+        ]
+      }
+    ]
+  },
+  "proofmem-stop-gate": {
+    "enabled": true,
+    "Stop": [
+      {
+        "type": "command",
+        "command": "node ./scripts/antigravity-hook.mjs stop",
+        "timeout": 220
+      }
+    ]
+  }
+}

package/assets/antigravity-plugin/plugin.json

@@ -0,0 +1,5 @@
+{
+  "$schema": "https://antigravity.google/schemas/v1/plugin.json",
+  "name": "proofmem",
+  "description": "ProofMEM OAuth MCP plus Caveau Harness v2 lifecycle, memory, safety, and verification adapters for Google Antigravity."
+}

package/assets/antigravity-plugin/rules/proofmem.md

@@ -0,0 +1,9 @@
+# ProofMEM and Caveau Harness
+
+- ProofMEM is the durable memory home shared by Antigravity, Claude Code, and Codex. Do not create a second persistent memory system in local markdown files.
+- The SessionStart hook runs `bootstrap`. Do not run it again in the same conversation; use `context` or `persistent_recall` for later retrieval.
+- Use `proposal_create` and `feedback_file` for governed learning. Do not bypass review controls with direct rewrites unless the user explicitly authorizes the change.
+- Use scratch memory only for short-lived coordination and episodic memory for session events.
+- Never put raw credentials in prompts, notes, scratch records, episodic events, committed files, or logs.
+- If the ProofMEM MCP server returns `Unauthorized`, preserve its tokenless `serverUrl` configuration and start Antigravity's native OAuth/DCR flow. Never repair authentication by adding a bearer header, token, environment variable, or stdio bridge to `mcp_config.json`.
+- Treat Harness hook warnings as actionable diagnostics. A fail-open memory warning does not waive repository tests or safety rules.