@dreamforgestudiollc/emet 0.2.4 → 0.2.6

package/.env.example

@@ -36,6 +36,51 @@ EMET_SOURCE_TAGS=laptop,phone,cli
 # EMET Member Access: one-time codes for a new person with read and write
 # access (never the owner). Separate from guest access.
 # EMET_MEMBER_ACCESS=1
+# Strict login tags: a login bound to a tag may write only under that tag; a
+# different declared source is refused. Off by default. Turn it on only once
+# each bot has its own login (for example a Member Access code bound to its tag);
+# on a shared login every other bot's writes would be refused.
+# EMET_STRICT_LOGIN_TAG=1
+# Delegated client sub-keys (EMET-0001). Off unless set to 1: one shared owner
+# login, each bot holding its own key as a local secret. Off is no behavior
+# change. First-use setup asks whether more than one bot or AI will use this
+# memory. Leaving it out, or no, leaves these commented. Yes writes
+# EMET_SUBKEYS=1, a generated pepper, and EMET_SUBKEY_PEPPER_VERSION=1 into
+# this file only when the server reads it. A hosted deploy, where real
+# environment variables are the config source, refuses that yes: set the
+# three variables in the platform, then redeploy. Setup does not write a
+# pepper into a container .env. Copying this example does not turn them on.
+# See docs/SUBKEYS.md.
+# The pepper is a server secret of at least 32 bytes, never stored in
+# the database. EMET_SUBKEY_PEPPER_VERSION defaults to 1. While rotating, set
+# EMET_SUBKEY_PEPPER_PREV and EMET_SUBKEY_PEPPER_PREV_VERSION so seals made
+# with the previous pepper still verify. Keys last EMET_SUBKEY_TTL_DAYS
+# (default 30, at most 90). A replaced key stays valid for
+# EMET_SUBKEY_GRACE_MINUTES (default 10; 0 revokes it at once).
+# EMET_SUBKEYS=1
+# Turning EMET_SUBKEYS off ends every live sub-key session once, in the
+# background at startup, when the sub-key collection already exists. The
+# history event is written before the status change. Each ended session is
+# kept and is not deleted. If that collection does not exist, startup does
+# not create it. The sweep tries once, then a few times with backoff, and
+# does not block the server accepting calls.
+# With the flag off, a write that presents an emh_ handle is refused without
+# opening the store. A write that names a sub-key session is refused the
+# same way only when that session was live at this process's sweep. The
+# refusal lasts until the next restart, by which time those sessions are
+# already ended. The tool list stays the flag-off list either way.
+# A store that ran the first sub-key build (rows inside emet/CLIENT_APPROVALS.md)
+# still has those rows in that document's history. Production did not run it.
+# EMET_SUBKEY_PEPPER=
+# EMET_SUBKEY_PEPPER_VERSION=1
+# EMET_SUBKEY_PEPPER_PREV=
+# EMET_SUBKEY_PEPPER_PREV_VERSION=
+# EMET_SUBKEY_GRACE_MINUTES=10
+# EMET_SUBKEY_TTL_DAYS=30
+# EMET_SUBKEY_FAIL_MAX=5
+# How long a failed presentation counts, in milliseconds. Default 15 minutes.
+# Values below 1000 are ignored.
+# EMET_SUBKEY_FAIL_WINDOW_MS=900000
 
 # The monorail, the server-side check on the order of a session's writes
 # (docs/GUARDRAILS-AND-MONORAILS.md), runs in enforce only and has no setting:
@@ -128,9 +173,17 @@ HOST=127.0.0.1
 # corpus_recall. Leave unset unless you have populated a corpus yourself.
 # EMET_CORPORA=
 
+# Optional. GEM ids this install asked to turn on, comma-separated.
+# Unset means a GEM activates only when its manifest says defaultOn.
+# Neurendipity ships bundled and off. Set this to keep that guidance active:
+# EMET_ACTIVE_GEMS=neurendipity
+
 # Diagnostics.
 LOG_LEVEL=info
 LOG_FORMAT=text
 # DEBUG=true
 # EMET_AUDIT_LOG=
 # EMET_CRASH_LOG=
+
+# Attribution v2: the chief-of-staff bot that reviews new clients. Unset: the owner reviews them.
+# EMET_COS_TAG=hub-bot

package/CHANGELOG.md

@@ -5,6 +5,71 @@ All notable changes to EMET are listed here, newest first. The format follows
 [Semantic Versioning](https://semver.org/). EMET is still 0.x: the stored data shapes may
 change before 1.0.
 
+## Unreleased
+
+## 0.2.6 - 2026-10-20
+
+### Added
+- First-use setup can turn on delegated client sub-keys (EMET-0001). `more_than_one_bot` is optional and defaults to no. Yes writes the flag, a generated pepper and version 1 into `.env` only when that file is the config source, after the store writes succeed, and does not turn the flag on in the running process. A hosted server refuses and tells the owner to set `EMET_SUBKEYS=1`, an owner-generated `EMET_SUBKEY_PEPPER` and `EMET_SUBKEY_PEPPER_VERSION=1`, then redeploy. See `docs/SUBKEYS.md`.
+- Delegated client sub-keys (EMET-0001, accepted 2026-10-15). Behind `EMET_SUBKEYS=1` (off registers nothing new): `emet_subkey_request`, `emet_subkey_claim`, `emet_subkey_revoke`, and `emet_subkey_end_session`, plus the `subkey` and `session_handle` arguments and the `declared_attribution` gap. A bot on the shared owner login presents an `emk_` key at `emet_session_open` and the one-time `emh_` session handle on later writes. The server stamps the key's tag. Keys expire after 30 days and can be reissued. Approve and revoke stay on the owner's own login. Each bot holds its key as a local secret. HMAC seals store a pepper version so the previous pepper still verifies during rotation. Records live in the subkeys collection and its history, readable by the owner and the chief of staff. Each change is a compare-and-set on that document's revision and writes only the documents it changed. History events have their own ids and a duplicate-key error is not dropped. A correct handle is never locked out; only failed presentations count, per key, per client, and per session. Each open keeps its own record. Closing a session releases it only when the caller holds that session's key and handle, checked against `receipts.transcript_session_id`. A transcript row written in that session carries `key_id`. With the flag off the tool list is unchanged. Startup ends any live sub-key session once, in the background, when that collection already exists, and a write does not open the sub-key store. A write that presents an `emh_` handle, or names a sub-key session this process has seen, is refused. An empty `EMET_SOURCE_TAGS` refuses every sub-key tag. A store that ran the first build still has sub-key rows in the `emet/CLIENT_APPROVALS.md` history; production did not run that build.
+- `emet_status` reports each GEM's byte cost (`gems`): installed and active counts, active floor bytes against `MAX_ACTIVE_FLOOR_BYTES`, headroom, the enforced caps, and per-GEM id, version, kind, bytes and refusal reason. Read-only and carries no floor text; a socket failure is reported in the field and never fails the status (GEM socket PR 4).
+- Optional bot-team backup, off unless the first-run interview records yes. Yes is the recommended choice. The answer is stored on `bootstrap/USER.md`. The recipe and the recovery template ship as the bundled bot-team-backup GEM. EMET does not copy prompts or settings itself. Secret values are never stored. The recorded answer accepts yes or no in the user's words. Yes and Yes. count as yes. A non-string and any other text are refused before a write.
+- Lean Six Sigma 0.9.0, a bundled runed GEM, off unless `EMET_ACTIVE_GEMS=lean-six-sigma`. Its `requires.emet` is `>=0.2.6` and `released` is true. Rune file digests are unchanged. `guides/BELTS.md` is `sha256:e9e591af0e2d89a27cddf73da48e4f4acacd1785e22473d42dd3b56366d008d0`. `gem.json` is `sha256:5f9da0caf7719a73f19bfbff211002eb66dbd0f988fd094131b56c4ecf438b31` and `CHANGELOG.md` is `sha256:d07810bd35e71952cea36212b878d8762a43b4f7b8e5f710b41a4190308d86fc`, the shipped 0.9.0 copy. `gems/artifact-index.json` is unchanged.
+
+### Security
+- `EMET_SUBKEY_PEPPER` is masked on the write path. Setup does not return it or write it into a hosted container's `.env`. A leaked active key is revoked with `emet_subkey_revoke` from the owner's login. Deny applies only to a pending request. ISO 9001 7.5.3 / ISO 13485 4.2.5 document-control wording, the Charter and the floor are unchanged.
+
+### Fixed
+- The bot-team backup answer accepts yes or no in the user's words, the same way as the multi-bot question. Yes and Yes. record the flag. A non-string and any other text are still refused before a write.
+- The socket refuses a GEM whose `gem.json` `released` is not the boolean `true` (SR-08) on every boot. `false`, the string `"true"`, `1`, and `null` fail, and the socket logs the value. A missing field is allowed only for `neurendipity` 1.2.3 and `fieldnote` 1.0.1 when the id, the version, and every file digest match the pin. A shorter file list does not match. The pin covers the id, the version, and the file digests. It does not cover every other manifest field, including `defaultOn`, `priority`, `requires`, `description`, `name`, `authors`, `license`, rune `description`, schemas, the guides list, `distribution`, `coverage`, and rune metadata other than the version. `overrides` still needs SR-05 consent. A rune `execution` of `server` and `distribution` `library` are refused by GC-02. `gem.json` is not hashed: anyone who can edit it can already add `released: true`, so hashing it would grant nothing extra. A missing field on `neurendipity` or `fieldnote` that missed the pin says `(legacy pin mismatch: version/digests)`. An unpinned GEM does not get that hint. Any other GEM missing the field is refused, including a bumped version of those two. A read error refuses and does not turn the check off. Deleting or corrupting `fieldnote` does not disable the check. Two candidates that share an id log their own refusal.
+- A RUNE may import only a file under the same GEM's `runes/`. A relative import that normalizes outside `runes/`, such as `../lib/h.js`, is refused even when that file is listed. A resolved real path outside `runes/` is refused, so a symlink that leaves `runes/` cannot be imported. A symlinked GEM directory fails GC-01 (`symlink`), and that refusal is not reused for the real directory. A symlinked file under `runes/` fails GC-04 (`symlink`) and is not followed. The socket records that refusal instead of omitting the entry. A `.JS` file under `runes/` is scanned. `.cjs` is not treated as a JavaScript module.
+- The deploy image and the npm package include `verification/`. `src/host-reach.js` imports the RUNE load gate from there. A release that omitted the directory crashed at startup with `ERR_MODULE_NOT_FOUND`.
+- RUNE import specifiers are checked in the vendored load gate (`runeSpecifierReason`). A bare package, `node:`, a URL, `emet/rune`, a path that normalizes outside the GEM, `../` with no file list, and a relative import that is not in the passed file list are refused. gem-check calls the same function. GC-16 still allows `emet/rune`; GC-19 still names that failure. A file under `runes/` that is not `.js` or `.mjs` fails GC-16 (`rune extension`) instead of being skipped.
+- The GC-19 load gate is an allowlist (`verification/load-gate/load-gate.mjs`, the file EMET-GEMs vendors with `corpus.json`). acorn 8.19.0, fail closed, no second scan. Only listed AST nodes are admitted. No `var`, and no binding may reuse a top-level name. `Math` is only a direct read or call of a listed member, never `random`, and the Math object is never stored, passed, or returned. A computed key is a literal, a `const` bound directly to a primitive literal, or a read of a top-level `Object.freeze({ __proto__: null, … })` table inside a recognized `Object.hasOwn` guard. The guarded key is one `const` that is a primitive before the guard (`const n = String(input.n)` or `Number(...)`, or a recognized `typeof` check for `'string'` or `'number'`). A const object is refused: `toString` or `Symbol.toPrimitive` can return one own key at the check and another at the read. A member, a `let`, or a parameter does not qualify. The guard's non-own-key safety rests on the table being frozen with a null prototype. `.freeze` counts only on the unbound `Object` identifier. There is no loop-index exception. Tables are not passed, spread, or returned. A member write is admitted only on an object or array born in that function. `prototype`, `Array.prototype`, `Error.prepareStackTrace`, and `RegExp.$1` fail. `toLocaleString`, `localeCompare`, `toLocaleDateString`, and `toLocaleTimeString` fail (`intl`). `Buffer`, including `Buffer.allocUnsafe`, fails (`memory`). A `for (const k of …)` key still needs `String`/`Number` or a `typeof` check. `toLocaleUpperCase`, `toLocaleLowerCase`, and a destructured locale name fail (`intl`). A computed key in a binding or assignment pattern must be a string or number literal, including nested patterns, parameters, defaults, `catch`, and `for-of`. Concatenation, a member, and a const used as that key fail. `m['call']` fails with `.call`. The checker accepts spec `2026-10-12` and optional `changelog`, `update`, `knowledge`, and `coverage`. A `coverage` list holds at most 256 entries.
+- The per-RUNE description and served response wrap the `metadata.gem` value in backticks, so the sentence period is not copied with the value.
+- A per-RUNE tool states the exact `metadata.gem` value (`<gem>@<version>`, for example `fieldnote@1.0.1`) in its description and in the served response. A save that does not use that form says `metadata.gem` must be `'<gem>@<version>'`.
+- The serve log file `logs/gem-serves.json` keeps the latest `SERVE_CAP` (200) rows for each principal, so one caller cannot evict another. This release creates the new collection `<prefix>gem_serves` (`SERVE_COLLECTION`). Alex approved it as an append-only write site on the write-path allow-list. The collection keeps every row. Nothing is deleted. A redeploy that drops the file can still seal a result. Concurrent serves write distinct temp files, and one process records one serve at a time. Tests point the file at a temp path. The guard and the GC-19 load gate reject `vm`, `new Function`, and a computed `import()` path. When the store is not connected, the file is the only copy and a redeploy drops it. Fieldnote is off by default. See SPEC.md §10.
+- Error text again replaces a stack frame with `[stack-frame]`. The publish workflow runs only on a published release. Public text no longer carries a private path, a private branch name, or an install-specific display name.
+- Bot-team backup references name `gems/bot-team-backup/guides/BOT_TEAM_BACKUP.md`, the file on disk.
+
+### Changed
+- Lean Six Sigma is 0.9.0, `released` true, `requires.emet` `>=0.2.6`. The GEM version pattern is `MAJOR.MINOR.PATCH` with no suffix. A version suffix fails GC-02. `gem.json` (`sha256:5f9da0caf7719a73f19bfbff211002eb66dbd0f988fd094131b56c4ecf438b31`) and `CHANGELOG.md` (`sha256:d07810bd35e71952cea36212b878d8762a43b4f7b8e5f710b41a4190308d86fc`) are the shipped 0.9.0 copy. The same digests are recorded in `tests/fixtures/lss-source/DIGESTS.json`.
+- The socket serves RUNED code and does not run it (GEP-0003). One read-only tool per RUNE, named `gem_<gem>__<rune>`, returns the code, description, inputs, outputs, runtime, and served sha256. The server sandbox is removed. GC-19 checks the artifact hash and a static load gate: no network, no dynamic `import()`, no `eval`. A kept result is sealed on the existing write path. The principal comes from authentication. The served hash is the pin. The client-reported hash and the input hash are stored for traceability. Those attestation fields do not change on a later write. Superseded artifacts stay in `gems/artifact-index.json` by sha256. Charter commitment 1, the Extension-socket carve-out: "EMET verifies the record, not the computation. Client-executed RUNE results are recorded as attested by the client; they are replayable from recorded inputs, not re-executed by EMET." Fieldnote is off by default. ISO 9001 7.5.3 / ISO 13485 4.2.5 document-control wording is unchanged.
+- Version 0.2.6. Charter commitment 1 again states the client-executed RUNE carve-out: EMET verifies the record, not the computation. ISO 9001 7.5.3 / ISO 13485 4.2.5 document-control wording is unchanged.
+
+### Docs
+- Client-side execution of RUNED directives (GEP-0003, accepted by Alex 2026-10-16). Supersedes GEP-0002, which is kept. The socket must not run RUNE code. One read-only tool per RUNE serves that RUNE's code, inputs, outputs, description, and served hash. SPEC.md §10–12, CONFORMANCE.md GC-19, the charter commitment 1 carve-out (EMET verifies the record, not the computation) and the Extension-socket row, and `docs/gem/README.md`. ISO 9001 7.5.3 / ISO 13485 4.2.5 document-control wording is unchanged. No code change in this revision.
+
+## 0.2.5 - 2026-10-14
+
+Per-session attribution with client approval, the GEM socket with the bundled Neurendipity GEM (off unless the user asks), and two new core floor lines: `goal_check` and `no_rapport_mirroring`. ISO 9001 7.5.3 / ISO 13485 4.2.5 document-control wording is unchanged. No stored data shapes change; deploy over 0.2.4.
+
+### Fixed
+
+- Neurendipity 1.2.3 (the reviewer's non-blocking nit on #40). `NEURODIVERGENT_SUPPORT.md` §8 prose now reads "A meta-analysis (2026, online 2025)" to match the Vann-Adibe tag. In-text tags for Bougoure et al. and Pagán et al. now carry "(online 2025)" in both guides, matching their Sources entries. gem.json digests updated. Guides only; floor unchanged.
+
+- Review fixes from the reviewer for #38 and #39. Floor: `no_rapport_mirroring` now reads "agree as a way to build rapport or seem attuned", allows quoting the person for accuracy, and limits the no-praise rule to "praise or rapport-building language used for effect"; `acknowledge` now acknowledges good thinking "when it is earned by substance, stated as a specific reason, not as praise", which removes the conflict between the two lines. New tests cover the protected and modifiable override paths, the wording, and the reassertion line. Neurendipity 1.2.2: the 'poor at telling current from past burnout' finding is now attributed to the prepublication AASPIRE measure, not the ABSI (AUTISTIC_BURNOUT.md); the year convention is applied to Cai 2026 (online 2025, *Autism Research* 19(2)), Vann-Adibe 2026 (online 2025, *Appl Psychophysiol Biofeedback* 51(3)), and Bougoure (online 2025); Pagán values now "were associated with" camouflaging; Ferrie comma fixed. ISO 9001 / ISO 13485 document-control wording is unchanged.
+
+### Added
+
+- Core floor, engagement: `goal_check` (before multi-step work, on an ambiguous request, or when the conversation turns, state the person's goal and underlying problem in one sentence in your own words, marked as your read, and confirm; distinct from `their_own_plan`, it checks the goal underneath and never re-narrates a stated plan) and `no_rapport_mirroring` (no echoing, flattery, or agreement to build rapport or seem attuned; that is manipulation; agreement is earned by substance; state the obvious only when it adds information; default register is plain facts, with no emotional padding, praise, or rapport-building language). One matching reassertion line. `no_rapport_mirroring` is a protected override path; `goal_check` joins the modifiable list (a GEM or modifier may tune when it fires, never remove the anti-mirroring line). Targets the next public release, which must update the repo, website, README, npm package, MCP Registry entry, and description together.
+- Neurendipity 1.2.1 (accuracy fixes from the reviewer's review of #37, under the owner's 2026-10-12 10:17 AM approval). Guides only; floor unchanged. Bougoure line in `NEURODIVERGENT_SUPPORT.md` rewritten (AUC 0.92 vs PHQ-9 0.78; correlates with depression and anxiety, so it does not on its own tell burnout from depression). Arnold 2023 sample limits; Osborne described as 14 studies with qualitative data synthesised; Pagán 'was associated with' and therapy-programme recruitment; van Asselt scope and no intervention studies; Vann-Adibe effect label, heterogeneity and moderator scope; Comerford UK-only and 'a sense of community'; Ferrie & Hafetz sample limits, service line tagged as a suggestion; Clarey author initials. One year convention stated (issue year, online year in brackets); Pagán cited as 2026 (online 2025).
+- Neurendipity 1.2.0 (the owner's approval 2026-10-12 10:17 AM). Guides only; floor unchanged. `AUTISTIC_BURNOUT.md`: measurement (Arnold 2023 ABSI, Bougoure 2026), shame and dual masking (Clarey 2026), camouflaging as energy cost and unmasking as a balancing act (Osborne 2026), culture (Pagán 2025). `NEURODIVERGENT_SUPPORT.md`: RSD scoping review findings (van Asselt 2026) and self-compassion validity (Cai 2025) in §3; Osborne and Pagán in §6; interoception meta-analysis (Klein 2025) and remote HRV biofeedback meta-analysis (Vann-Adibe 2025) in §8; Comerford 2026 and Ferrie & Hafetz 2026 in §9. Support only, not counseling or treatment.
+- Attribution per session, v2 (replaces the reverted #32). Agents sharing one OAuth login are stamped with the tag they declare (`source_basis: declared`, `source_login` kept), but a declared tag never gains rights beyond the login's tag: every guard runs for both. Every write naming a session is checked against the tag that owns the session, rebuilt after a restart from the session's stored rows. New clients: the first write by an unknown tag is refused and queued in `emet/CLIENT_APPROVALS.md` with who connected, the declared name, client_id and what it tried to write, routed to the chief-of-staff bot (`EMET_COS_TAG`) or, with none set, to the owner. A first, solo client on a fresh store is approved at once as the owner's primary. New tool `emet_client_approve`. `emet_initialize` and `emet_status` report the caller's real tag and, to the owner or COS, the pending clients.
+
+- The GEM socket (`src/socket.js`) and `gem-check` (`src/gem-check.js`). This release seats bundled prompt GEMs only. A refused GEM is listed with its check id and does not stop startup. An empty mount logs nothing. A seating summary is logged only when a GEM is installed. RUNE execution is not implemented and is refused. No new runtime dependency.
+- Neurendipity, the bundled GEM at `gems/neurendipity` (reading people, the neurodivergent engagement lines, the wellbeing corpus lines, the matching reassertion lines, and the guide). It is off unless the install sets `EMET_ACTIVE_GEMS=neurendipity`. `emet_floor` takes a `gem` argument to read an installed GEM's floor without turning it on. The guide id `guides/NEURODIVERGENT_SUPPORT.md` still resolves to that GEM's copy for one release.
+
+### Changed
+
+- The core floor keeps persistence (named items, including what was set aside on purpose), a general epistemic-honesty line (established, emerging, or anecdote), the epistemic corpus lines, and the honesty protections. An active GEM ranks below the floor and below the user's current word. Neurodivergent engagement is no longer on every install.
+
+### Docs
+
+- README and website: version 0.2.5; a GEM socket fact; the website gains a Document control (ISO 9001 7.5.3 / ISO 13485 4.2.5) fact in the README's words; the tool count is 30 with `emet_client_approve` (docs/PERMISSIONS.md lists it with the tools that can replace or hand out access).
+- GEM standard, Draft revision 2026-10-11, in `gem-library/` (canonical home: the private repository EMET-GEMs). The charter's extension socket, commitment 8, and the core-floor row are revised: EMET is a memory resource, core floor protections stay non-removable, and neurodivergent engagement is the bundled Neurendipity GEM, off unless the user asks.
+- Registering a bot (`docs/BOTS.md` §4, with a pointer in `docs/DEPLOY.md`): every bot writes under its own source tag, `<prefix>-<bot>`. When a bot joins the roster, append its tag to the end of `EMET_SOURCE_TAGS`, keep every existing tag in order, and add `bots/<tag>/HANDOFF.md` to `EMET_RECORD_DOCS` before its first write. Setting either variable redeploys the server; afterwards, check `/health` and `emet_status`.
+
 ## 0.2.4 - 2026-10-08
 
 A board fix, a public website, and the first npm package, `@dreamforgestudiollc/emet`. A session that boots with no unhandled drops can edit the board again. No data shapes or settings change; deploy over 0.2.3 as is.
@@ -74,6 +139,8 @@ The security fixes from the October audit, recall that ranks by how well an entr
 - An HTTP caller with no OAuth client id is stored as http:visitor, never in a stdio bucket.
 - The test suite sets the boot-list store timeout short so a missing store does not stall the run.
 - The HTTP visitor check calls the HTTP tool path with no OAuth client id, and the baseline prune check leaves a document with only live or fresh baselines unwritten.
+- Reviewers now have a checklist (`REVIEW.md`), and pull requests and pushes to main run the test suite with coverage (`.github/workflows/ci.yml`).
+
 ## 0.2.2 - 2026-10-04
 
 The board is guarded, and the test store is shared.
@@ -93,9 +160,6 @@ are read in byte-sized pages, and the session-order check now refuses every skip
 the way to pass in the same reply. After upgrading, each host reconnects once to see the new
 arguments, then reads its startup again before opening a session.
 
-There is no 0.2.0 release: 0.2.1 follows 0.1.0 directly, so this entry lists every change
-since 0.1.0.
-
 ### Added
 
 - **Startup in pages.** `emet_initialize` now sends the startup in pages of about 18 KB

package/CHARTER.md

@@ -1,6 +1,6 @@
 # EMET ARCHITECTURE CHARTER
 
-**Record control:** id `CHARTER.md` · revision: the store's version governs · status: IN FORCE · approved: user · 2026-09-11 · a decision record · revised with the user's approval 2026-09-15 (the consolidated revision, a decision record) · revised at the user's word 2026-09-23 (parked items named at startup; §3 commitment 8, §6 item 3; a decision record) · revised with the user's approval 2026-09-27 (pending lessons named at startup; blocked-close cap and scope at close; §6 items 3 and close; a recorded lesson) · revised with the user's approval 2026-09-29 (the aleph named as the integrity verifier; Guardrails & Monorails, with switches; the database boundary; the per-exchange transcript; the user as final authority; §1, §3 commitments 1, 2 and 9, §4, §6, §8, §10; a decision record) · revised with the user's approval 2026-09-30 (the admission test: four questions before anything is built, DMADV while in design, DMAIC once stable; §3 commitment 6; a decision record) · Tier 1 · owner: the user · decision record: the owner's
+**Record control:** id `CHARTER.md` · revision: the store's version governs · status: IN FORCE · approved: user · 2026-09-11 · a decision record · revised with the user's approval 2026-09-15 (the consolidated revision, a decision record) · revised at the user's word 2026-09-23 (parked items named at startup; §3 commitment 8, §6 item 3; a decision record) · revised with the user's approval 2026-09-27 (pending lessons named at startup; blocked-close cap and scope at close; §6 items 3 and close; a recorded lesson) · revised with the user's approval 2026-09-29 (the aleph named as the integrity verifier; Guardrails & Monorails, with switches; the database boundary; the per-exchange transcript; the user as final authority; §1, §3 commitments 1, 2 and 9, §4, §6, §8, §10; a decision record) · revised with the user's approval 2026-09-30 (the admission test: four questions before anything is built, DMADV while in design, DMAIC once stable; §3 commitment 6; a decision record) · Tier 1 · owner: the user · decision record: a decision record · revised with the user's approval 2026-10-11 (GEM standard: the core floor is the memory minimum; the Neurendipity GEM is bundled and off unless the user asks; commitment 8, §4, §5, §6) · revised with the user's approval 2026-10-11 (the ISO document-control positioning and the repository description made standing; §7) · revised with the user's approval 2026-10-16 (client-executed RUNEs are a carve-out from commitment 1: EMET verifies the record, not the computation; §3 commitment 1, §4 Extension socket)
 **Written:** 2026-09-10, session `2026-09-10_morning-mobile-init`, source `mobile`
 ⚠ **Public document once the repository is public.** The disclosure line (a decision record) must be drawn before publication. This document states structure and intent only — no implementation specifics.
 ⚠ **§1 is in the user's words (2026-09-11); attorney review pending** (claim language is on that agenda).
@@ -19,6 +19,8 @@
 
 **It is designed first for neurodivergent users** (ADHD, autism, AuDHD), for whom lost context and re-explaining carry a higher cost. It works for anyone.
 
+**Revision 2026-10-11, with the user's approval.** EMET is a memory resource. Its core floor stays the minimum that keeps that memory honest: integrity, honesty, no sycophancy, truth over speculation, fact-checking, and persistence. Behavioral guidance lives in GEMs. Neurendipity is the reference GEM for neurodivergent engagement. It ships with EMET and is off unless the user asks for it. The sentence above stands: EMET was designed first for neurodivergent users, and that support stays available as an opt-in.
+
 **Intended user:** one user working with an AI assistant through hosts that support the Model Context Protocol.
 
 **Not intended:** EMET is not a medical device. It does not diagnose, treat or monitor any condition and is not a substitute for clinical care. It does not control what an assistant says; it records what is written to it.
@@ -30,21 +32,21 @@
 
 ## §3 DESIGN COMMITMENTS
 
-1. **Verification over assertion.** Every write is read back by the aleph and verified before a receipt is returned, and every later read is checked against what was recorded. A claim of completion needs evidence.
+1. **Verification over assertion.** Every write is read back by the aleph and verified before a receipt is returned, and every later read is checked against what was recorded. A claim of completion needs evidence. A client-executed RUNE is the carve-out stated on the Extension socket (§4): EMET verifies the record, not the computation.
 2. **Nothing is deleted.** Entries are superseded, documents are revised or retired, events are never rewritten. Prior versions are retained. **This holds below the server too:** the database login EMET runs under has no permission to remove the record, so a fault in the server cannot delete it either.
 3. **Provenance is part of the memory.** Every write names the host that produced it, and assertions point to their source.
 4. **State a rule once.** Rules held in code are pointed to, never copied into documents.
 5. **Controls, not reminders.** Where a rule matters, a mechanism enforces it; an instruction to be careful is not a control.
 6. **Over-engineering is a defect — the check comes before the build.** Anything may be considered; nothing is built until it answers four questions. **What failure does it fix, and where is it in the record?** An observed failure, not an anticipated one. **What does it replace or retire?** An addition that replaces nothing clears a higher bar. **How will we know it worked?** One measure, checked in a pilot. **What holds it once it works?** A control, not a reminder (commitment 5). What cannot answer all four stays a seed. Additions are gated before they ship, not trimmed after (the user, 2026-09-30: *"I dont want us to become an oreborous eating its tail with proposed additions to then reduce afterwards"*). **The method follows the product's stage** (the user, 2026-09-30: *"The variant works for now, dmaic for once stable"*): while EMET is still being designed, work runs DMADV — Define, Measure, Analyze, Design, Verify. Once it is stable, work runs DMAIC — Define, Measure, Analyze, Improve, Control.
 7. **No implied conformity.** EMET puts recognised quality-management practice into operation. It claims no certification.
-8. **Out of sight is out of mind.** For users with time blindness or object impermanence, an item not named does not exist. At every session start the server lists the half-finished, dated, open, undecided, and parked rows it can read (`named_items` on `emet_initialize`), and the session says those names. A section that is not a table is marked unread, and an empty list is not a reason to skip the document. A count is the assistant's check, never a substitute for the names. **Parked items are named too, in a list of their own** — what the user deliberately set aside drops out of mind as fast as what they forgot, so parked means out of the way, never out of sight; each is named with what brings it back, and nothing is asked of it (the user, 2026-09-23: *"for ND it's out of sight out of mind"*). Naming the user's own items is external working memory, not unrequested instruction. This commitment is part of the floor.
+8. **Out of sight is out of mind.** An item the session does not name is missing from working memory. At every session start the server lists the half-finished, dated, open, undecided, and parked rows it can read (`named_items` on `emet_initialize`), and the session says those names. A section that is not a table is marked unread, and an empty list is not a reason to skip the document. A count is the assistant's check, never a substitute for the names. **Parked items are named too, in a list of their own.** What the user deliberately set aside drops out of mind as fast as what they forgot, so parked means out of the way, and it stays in sight. Each is named with what brings it back, and nothing is asked of it (the user, 2026-09-23: *"for ND it's out of sight out of mind"*). Naming the user's own items is external working memory, not unrequested instruction. **This behavior is a core floor protection.** It stays in force whether or not a GEM is on. The neurodivergent framing of why it matters lives in the Neurendipity GEM (§4), which ships with EMET and is off unless the user asks for it.
 9. **Guardrails & Monorails.** Judgment and process are kept apart (the user, 2026-09-29). **Guardrails** — the floor, the character, the served instructions — bound a field in which the assistant uses its judgment freely. **The monorail** — the session's order of work — carries it from one field to the next on a track the server checks, which it cannot leave. Where the flow must fork, a **switch** at the junction routes it to the guardrail space that fits: a small logic unit in EMET, tripped only by its condition, like a transistor, with no hosted model and no outside service (the user, 2026-09-29). The track throws the switch; the assistant does not choose whether to follow the protocol or which branch to take. Each switch is designed for its junction, from the function it serves and the flow of information and tasking through it. This is commitment 5 applied to the order of a session.
 
 ## §4 ARCHITECTURE — components and their roles
 
 | Component | Role | Where its rules live |
 |---|---|---|
-| **The floor** | How the assistant engages the user, regardless of configuration. Cannot be edited by setup or by the user. The guardrails' base. | Server code |
+| **The core floor** | The minimum a memory server owes on every install: integrity, honesty, no sycophancy, truth over speculation, fact-checking, and persistence. Cannot be edited by setup or by the user, and cannot be switched off. Behavioral guidance lives in GEMs. The guardrails' base. | Server code |
 | **Bootstrap documents** | The assistant's standing definition: identity, character, the user, available tools. Without them the assistant is a hollow golem — it functions, but only as a transcriber. | Document store, built at the first-run interview |
 | **SHEM** | The name the user inscribes — who the assistant is, held in the identity document. In the golem lore the inscription and the Name are separate: EMET is the truth written on the substance; the SHEM is what animates it. EMET supplies the substance and the record; the user supplies the SHEM. Its spoken form is the user's identity phrase (§6). | Identity document, written at the first-run interview |
 | **Tier 1 — memory layers** | Curated meaning, in six layers: identity, semantic, episodic, procedural, meta, working. Queried first. | Layer charter, server code |
@@ -56,7 +58,7 @@
 | **The database boundary** | The login EMET runs under may add and update, never remove the record (2026-09-29). Commitment 2 is enforced by the database as well as by the server. | Database role, defined once in server code |
 | **The read path** | Returns entries with their integrity status, verified by the aleph. A superseded entry surfaces marked, naming what replaced it and the date it ended (decided 2026-09-13); a lookup by any id in a supersession chain also returns the live end of the chain, so a cross-reference keeps resolving after every later revision (2026-09-15). An expired entry surfaces the same way, marked with its end date. Current entries come first in every order, including time order. Retired documents stay in the document list and the startup scan, after the current documents, marked with the date and what replaced them. Recall ranks by relevance and importance. Time order is `order: 'latest'`, or a standalone latest, newest, or most recent together with other words. Retained document revisions are readable in full. | Server code |
 | **Supplementary corpus** | Optional reference material loaded by the user, separate from memory. | Server code |
-| **Extension socket** | **Planned, not built.** Where a GEM (Guided Engagement Module) seats; a RUNE (Registered Utility Node Extension) is a tool etched into a GEM. All GEMs are built to a standard. **Precedence (decided 2026-09-11):** a GEM the user adds takes precedence over the floor's modifiable defaults — voice, pace, how much is explained — and any conflict is resolved with the user when the GEM is added. **No GEM reaches the floor's protections:** it may add depth that complements them, never remove or weaken them. No GEM, whatever its authorship or intent, may compromise the user — and that is enforced by the socket, not left to a GEM author's good faith (commitment 5). | To be written |
+| **Extension socket** | **Standard specified, socket not built.** The seat for a GEM (Golem Expertise Module). A RUNED directive (Registered Utility Node Executable Directive) is a declared, registered tool built into a GEM. A RUNED GEM carries at least one. The 2026-09-08 names (Guided Engagement Module, Registered Utility Node Extension) are superseded. The standard lives in the GEM library: private repository EMET-GEMs (`https://github.com/dreamforgestudiollc/EMET-GEMs`). In this repository the text under review is `gem-library/` until that folder is moved. **Precedence:** core floor protections outrank the user's current word, which outranks active GEMs by priority. A GEM may change a modifiable default (voice, pace, how much is explained) only with the user's consent when it is activated (the 2026-09-11 decision, kept for those defaults). **Floor protection:** core floor protections are non-removable. No GEM may weaken them. A GEM may add depth that complements them. Neurodivergent engagement lives in the bundled Neurendipity GEM (`neurendipity`), which is off unless the user asks for it. The list of GEMs installed on this server, active or not, is part of `emet_initialize` and of what a bot is shown at startup. Only the user and the user's bots change the GEM standard. Anyone may author a GEM that follows it. A GEM that does not ship inside an EMET release loads only after the library's security gate and the user's acceptance. The socket enforces that (commitment 5). **Client execution, a carve-out from commitment 1 (2026-10-16):** EMET verifies the record, not the computation. Client-executed RUNE results are recorded as attested by the client; they are replayable from recorded inputs, not re-executed by EMET. The socket does not run RUNE code. | `gem-library/SPEC.md` |
 
 ## §5 HIERARCHY
 
@@ -72,7 +74,7 @@
 3. **The current controlled document** (board, thread) — on where things stand.
 4. **Tier 1 entries** — on what happened and what it meant.
 5. **Tier 2 transcripts** — on exactly what was said.
-A disagreement between sources is recorded, not silently resolved.
+A disagreement between sources is recorded, not silently resolved. Core floor protections outrank a request to remove them. The user's current word outranks an active GEM. An active GEM outranks a character modifier only on a modifiable default the user consented to when the GEM was activated.
 
 ## §6 FLOW
 
@@ -82,7 +84,7 @@ A disagreement between sources is recorded, not silently resolved.
 2. **The user's identity phrase**, if one is set — the SHEM spoken, confirming the assistant's identity loaded.
 3. **The named items** — every half-state row, every dated item in the next seven days, every open item the user owns with its next action, and anything left undecided last session; drawn from the board, the user's calendar and any active schedule. **Then, under its own heading, every parked item** — one line each with what brings it back; named, never pressed (commitment 8). **Then, under its own heading, every pending lesson** — a correction the record holds three or more times with no disposition; one line each, named, never pressed. A lesson is settled by a check in code, a rule landed in a controlled document, or a written ruling that it cannot be checked; the server computes the list (`lessons_pending`, 2026-09-27) so the next conversion of advice into a control (commitment 5) is a standing decision, not a count.
 4. **The board's counts as the check, never in place of the names.**
-5. **What is actually available in this session**, confirmed before any capability is claimed.
+5. **What is actually available in this session**, confirmed before any capability is claimed. The GEMs installed on this server are part of that account, each with its name and whether it is active. An installed GEM that is off is not a capability of the session.
 6. Then any question. **Never open with a question alone.**
 **During work:** append each exchange to the transcript after every reply, as it happens · every write names its session and exchange, and is told the next stop · search the record before answering anything with prior context · write decisions when they are made, with the user's words · write with provenance · verify each write by its receipt.
 **Session close — this is the one place the order is stated:** update working documents → session record in memory → board → verbatim transcript, confirmed complete (it was appended as the session ran) → **handoff last, in one write** → confirm every artifact landed. The handoff is last because its close verification attests to the other artifacts; written earlier, it attests to things that do not yet exist and needs a patch afterwards. If a session ends mid-close, the prior handoff stands and the board and session record already carry the session. **A close that fails its check is returned with a scope per missing item — what may be touched to clear it and nothing else — and the third blocked close on one session escalates: the assistant stops, hands the user the list, and waits for their word. The counter resets only with a new session (rule in code, 2026-09-27).** **The server checks this order on every write (the monorail, §4):** a skipped step is refused. Enforce only since 2026-10-03; there is no report mode.
@@ -92,6 +94,12 @@ A disagreement between sources is recorded, not silently resolved.
 
 Governed by `templates/STANDARD.md`. Base templates must be followed and may be expanded, never loosened. Every templated write is validated; a nonconforming write is **marked for audit and review**, never silently accepted and never discarded.
 
+**The ISO positioning is a standing standard, like this charter** (the user, 2026-10-11). EMET is described as built for ISO 9001 / ISO 13485 document control, and that wording is not dropped or diluted by any documentation, site or listing pass. It lives in two places: the README's "Document control (ISO 9001 7.5.3 / ISO 13485 4.2.5)" section, and the repository description, which is exactly:
+
+> EMET is an MCP memory server built for ISO 9001 / ISO 13485 document control: persistent, shared memory for AI agents and bot teams. Nothing is deleted; records are superseded, retired and retained. Controlled templates, verified writes, a word-for-word transcript tier, stdio and remote HTTP with OAuth, on MongoDB.
+
+Both change only by a revision of this charter, with the user's approval. `tests/iso-positioning.test.js` fails if either drifts from this text.
+
 ## §8 ROLES
 
 - **User** — owns the intended use, makes decisions, sets standards for how the assistant works. **The final authority** (the user, 2026-09-29: *"AI assistants are subordinate to the user. While it is a collaborative relationship without a sycophantic role by the AI, the user is the final authority"*).
@@ -105,6 +113,10 @@ This charter changes by revision, with the user's approval. Rules held in code c
 
 **This charter is locked the same way as the base templates** (`templates/STANDARD.md` §9a, L1 — decided 2026-09-11). It ships with the release and the server reads it from there; any copy in an install's store is for reading, not authority, and a store copy that differs from the shipped copy is marked nonconforming. `emet_initialize` points to it in every state, **including a new store before the first-run interview**, so the floor, this charter and the startup instructions are present before any SHEM is placed.
 
+**Per-client attribution is a standing requirement, like the ISO positioning** (the user, 2026-10-12):
+
+> Every write names the client that made it (its own declared tag, never borrowed from another login), and that tag never carries more rights than the login it arrived on. A client EMET has not seen before is read-limited and flagged on its first write, with who connected, its declared name, its client_id and what it wrote, to the install's chief-of-staff bot or, where there is none, to the owner. The first solo client on a new store is approved automatically as the owner's primary.
+
 ## §10 LIMITS, STATED PLAINLY
 
 - Retrieval is not guaranteed complete, and an assistant's behaviour is not reproducible run to run. **EMET's record is deterministic and verifiable even where the assistant is not** — that is the claim, and its limit.

package/README.md

@@ -2,12 +2,16 @@
 
 EMET is an MCP (Model Context Protocol) memory server, persistent shared memory for AI agents, bot teams and chats.
 
+[![M8ven Score](https://m8ven.ai/badge/mcp/dreamforgestudiollc-emet-z9o7e8?v=4d037e6ca2c2131c77968f135f4681da)](https://m8ven.ai/mcp/dreamforgestudiollc-emet-z9o7e8?s=readme)
+
 <img src="site/assets/portrait-560.webp" width="120" height="120" alt="Close view of a sepia sculpture’s face and shoulders. The Hebrew word אמת is set across her headband.">
 
 אמת — Hebrew for truth. Also **Enduring Memory & Epistemic Tiers.**
 
 **Website:** <https://dreamforgestudiollc.github.io/EMET/>
 
+See also: [CHANGELOG](CHANGELOG.md) · [CONTRIBUTING](CONTRIBUTING.md) · [SECURITY](SECURITY.md) · [Charter](CHARTER.md)
+
 ## What it does
 
 - **Layered memory.** Six layers — identity, semantic, episodic, procedural, meta, and working — hold curated claims, split by what kind of thing an entry is.
@@ -15,13 +19,34 @@ EMET is an MCP (Model Context Protocol) memory server, persistent shared memory
 - **Word-for-word transcript tier.** A separate tier stores the conversation as it was written, so a summary cannot overwrite the record it came from.
 - **stdio and remote HTTP with OAuth.** The same server runs locally over stdio, and remotely over HTTP with OAuth. The transport changes. The store does not.
 - **MongoDB.** Atlas, or MongoDB you run yourself. A one-machine trial can use MongoDB 6 or newer. Only `semantic_recall` needs Atlas.
-- **MIT.** Version 0.2.3. EMET is still 0.x: stored document shapes may change before 1.0. Pin a version if you depend on them.
+- **Golem Expertise Module (GEM) socket.** Add-on behavior ships as GEMs, seated at startup and checked by `gem-check` against the GEM standard in `gem-library/`. A GEM ranks below the core floor and below the user's current word, and cannot remove a protected floor line. Two work-in-progress examples ship bundled and stay off unless you ask: Neurendipity (neurodivergent engagement and autistic burnout support; support only, not counseling or treatment; `EMET_ACTIVE_GEMS=neurendipity`) and Lean Six Sigma (DMAIC and DMADV guidance, templates, and client-side calculators; `EMET_ACTIVE_GEMS=lean-six-sigma`). Fieldnote stays in the tree as a developer case-study of a runed GEM. It is not a user-facing third GEM, and it is off by default.
+- **Bot-team backup (optional).** Off unless the first-run interview records yes. Yes is the recommended choice. The recipe and the recovery template ship as the bundled bot-team-backup GEM. EMET does not copy prompts or settings itself, and secret values are never stored.
+- **Client-side GEM execution.** A GEM may declare a tool. EMET does not run that computation. EMET verifies the record, not the computation. The client runs the tool, and what is written back is checked the same way as any other write.
+- **Released flag.** A GEM is seated only when its released flag is the boolean true. Any other value is refused. A missing flag is refused except for a legacy manifest pinned by id, version, and file digests.
+- **Per-client attribution and approvals.** Every write is attributed to the client that made it. A new client is read-limited until it is approved. The approval is recorded.
+- **MIT.** Version 0.2.6. EMET is still 0.x: stored document shapes may change before 1.0. Pin a version if you depend on them.
 
 The store has one owner, and other people can join only through the optional Guest
 (read-only) and Member (read and write) access, both off by default.
 
+## Document control (ISO 9001 7.5.3 / ISO 13485 4.2.5)
+
+EMET is built for document control in environments that work under ISO 9001 and ISO 13485. It supports that work; it holds no certification and claims no conformity. An organization that uses it stays responsible for its own quality system, including validating EMET for its intended use.
+
+- **No delete, on any store, by design.** No tool removes a memory entry, a document or a transcript. The database role EMET runs under is not granted remove on the record either.
+- **Corrections are made by adding.** A memory entry is superseded by a revision that stands alone. A document is revised or retired. A transcript part is revised. Events are never rewritten.
+- **Retired means obsolete, not gone.** `retire_doc` marks a document obsolete and keeps its id, content, version and digest. `read_doc` still returns it, flagged retired, with the reason.
+- **Prior versions are retained.** Every document write archives the copy it replaces, and `read_doc_history` reads any retained revision back, checked against its stored digest.
+- **Records are superseded whole, never patched.** The handoff and any other record document cannot be patched. A new revision is written in full and names the version it supersedes.
+- **Templates are controlled documents.** Base templates ship with the release, and the shipped copy governs. Every templated write is checked against its template, and a write that fails is kept and marked for review, never silently accepted or discarded.
+- **A test holds the line.** `write-path.test.js` fails if anything in `src/` removes from a layer, document or transcript collection, and `atlas-role.test.js` fails if the database role grants remove.
+
 ## 30-second start
 
+> **npm lags the repo.** `npx -y @dreamforgestudiollc/emet` installs 0.2.4 until 0.2.6 is
+> published. For 0.2.6, clone this repo and run `npm ci && npm start`, or deploy the
+> `Dockerfile`. See [docs/SETUP.md](docs/SETUP.md).
+
 - **Guided setup:** [docs/GUIDED-SETUP.md](docs/GUIDED-SETUP.md) — never deployed anything. Your assistant installs, configures, deploys, and verifies. You sign in when asked and paste the connector URL.
 - **Setup:** [docs/SETUP.md](docs/SETUP.md) — the manual walkthrough: MongoDB, both transports, and the first-run interview.
 - **Deploy:** [docs/DEPLOY.md](docs/DEPLOY.md) — remote HTTP with OAuth, so a phone, a browser, or another vendor's agent reaches the same store.
@@ -34,6 +59,22 @@ The store has one owner, and other people can join only through the optional Gue
 > are **off unless `EMET_SOURCE_TAGS` is set**. With it unset, any caller can write under any
 > tag. See `.env.example` and [docs/DEPLOY.md](docs/DEPLOY.md).
 
+## Install as a Cursor / Grok Bot plugin
+
+EMET ships a plugin for Cursor and Grok Bot (this repo's `.cursor-plugin/plugin.json` and
+`mcp.json`). The Cursor Marketplace listing is submitted and pending review. The plugin does **not** host memory for you: it connects to **your own** EMET
+server, so your records stay in your MongoDB.
+
+1. Deploy EMET remotely: [docs/DEPLOY.md](docs/DEPLOY.md). Set `PUBLIC_URL` and a strong
+   `EMET_OAUTH_PASSPHRASE`. Check `https://<your-host>/health` returns `{"ok":true,...}`.
+2. Install the **EMET** plugin and set the variable `EMET_URL` to `https://<host>/mcp`.
+3. Connect. The OAuth sign-in opens EMET's passphrase page; enter your passphrase once per device.
+4. Verify: call `emet_status` with `{"probe": true}` (it writes, reads back and removes a row
+   from `_emet_verify` only), then save with `save_to_layer` and `recall` it from another client.
+
+The plugin also ships an `emet-memory` skill that tells the agent when to recall, save and close
+a session.
+
 ## Shared memory across hosts
 
 EMET stores agent memory in MongoDB (Atlas or self-hosted) across six layers, keeps a separate word-for-word
@@ -303,19 +344,26 @@ Desktop gets one from an MCP server such as Desktop Commander (one command, in t
 first-run interview. **Deploying remotely: [docs/DEPLOY.md](docs/DEPLOY.md)**.
 **Making your assistant actually use it: [docs/BOOTSTRAP.md](docs/BOOTSTRAP.md)**.
 **Running bots alongside your assistant** — registering their tags, their own handoffs, the
-session loop: [docs/BOTS.md](docs/BOTS.md).
+session loop: [docs/BOTS.md](docs/BOTS.md). For designing a bot team, see
+[docs/SUBKEYS.md](docs/SUBKEYS.md).
+
+**Continuous chats.** A bot in a long-running chat saves its transcripts to EMET
+word for word at least nightly (a checkpoint), under the open session or a daily
+`YYYY-MM-DD_chat-daily` session. Prefer event triggers over time-based polling.
+When polling is unavoidable, use the longest interval the job allows. Never
+reconstruct turns. Mark gaps as gaps. Session close cites those saved parts.
+Context compression erases older turns, so a close days later cannot invent the
+transcript.
 
 Short version:
 
 ```
 npm install
 cp .env.example .env      # fill in MONGODB_URI and MONGODB_DB
-npm start                 # then waits for an MCP client on stdin; Ctrl-C to stop
+npm start
 ```
 
-Requires Node 20+ and a MongoDB connection: Atlas, or a local MongoDB 6+ for a one-machine
-trial (only `semantic_recall` needs Atlas). `.env` is gitignored — never commit it. List each
-host's source tag in `EMET_SOURCE_TAGS` before its first write (see the note at the top).
+Requires Node 22+ and a MongoDB connection. `.env` is gitignored — never commit it.
 
 **Local (stdio)** — as an MCP server entry:
 
@@ -342,8 +390,9 @@ Say **"initialize"**. That is the whole interface.
 
 `emet_initialize` is the front door and the only thing anyone needs to know about. On a new
 store it returns a short interview — what the assistant should be called, how it should carry
-itself, your name, what you are using this for — which your assistant runs conversationally,
-then records with `emet_setup_complete`, which also creates the owner person. On an established store the same call returns the
+itself, your name, what you are using this for, and whether more than one bot or AI will use
+this memory — which your assistant runs conversationally,
+then records with `emet_setup_complete`, which also creates the owner person. Whether more than one bot or AI will use this memory is optional; leaving it out leaves delegated client sub-keys off. A yes writes them only when this server reads `.env`, and they take effect on restart. A hosted server refuses and tells you the three variables to set, then redeploy. See [docs/SUBKEYS.md](docs/SUBKEYS.md). On an established store the same call returns the
 assistant's identity, your profile, and where things were left, so the session opens already
 knowing you. A read-scoped `emet_initialize` writes nothing; a write-scoped one may provision a missing board. First-time setup is the owner's:
 `emet_setup_complete` is refused under a bot tag, and on a store that is already set up it is
@@ -505,8 +554,8 @@ parent is refused before anything is written), and the parent is marked: its `co
 gains the new id, its content, digest and liveness are untouched, and its metadata digest is
 re-attested in the same write. Reads return `corrected_by`, so a reader of the parent sees that a
 correction exists. `corrected_by` is a door marker; a caller cannot set it. Entries corrected
-before this existed (e.g. an incident record correcting an earlier one) carry no link; the fix is a new correction
-entry naming the earlier entry in corrects, not an edit or a backfill.
+before this existed (e.g. episodic ref 604 correcting ref 603) carry no link; the fix is a new correction
+entry naming corrects: 603, not an edit or a backfill.
 
 **Verified writes - `src/aleph.js`.** Every write is read back and compared before it is
 reported as saved. Document writes archive the prior version, then confirm both the sha256 and
@@ -544,7 +593,7 @@ removed a second document door in `setup.js`.
 Inside the door, in order:
 
 - **Secrets are masked before anything is stored or hashed** (`src/redact.js`): the literal
-  values of secret-bearing environment variables, credentials inside URIs, bearer tokens, JWTs,
+  values of secret-bearing environment variables (including `EMET_SUBKEY_PEPPER`), credentials inside URIs, bearer tokens, JWTs,
   and `key: value` pairs whose key names a secret become `*****`. The mask is visible on
   purpose, the receipt's `redacted` reports the number of spans **this write changed** (text
   already carrying the mask is left alone and not counted, so a read-modify-write of a document
@@ -609,12 +658,46 @@ are in [`docs/GUARDRAILS-AND-MONORAILS.md`](docs/GUARDRAILS-AND-MONORAILS.md).
 
 ## Tools
 
-Twenty-nine tools. `recall` · `semantic_recall` · `query_layer` · `save_to_layer` · `revise_memory` ·
-`read_doc` · `read_doc_history` · `write_doc` · `list_docs` · `patch_doc` ·
-`retire_doc` · `rename_doc` · `restore_doc` · `save_transcript` · `revise_transcript` · `query_transcripts` ·
-`corpus_recall` · `emet_gaps` · `emet_floor` · `validate_doc` · `accept_nonconformance` ·
-`emet_initialize` · `emet_status` · `emet_setup_complete` · `emet_session_open` ·
-`emet_transcript_append` · `emet_session_close` · `emet_invite_create` · `emet_member_access_create`
+Thirty tools are registered with sub-keys off. With `EMET_SUBKEYS=1`, four more (`emet_subkey_request`, `emet_subkey_claim`, `emet_subkey_revoke`, `emet_subkey_end_session`) and the `subkey` and `session_handle` arguments. The names below are every tool the registry registers, both sets together.
+
+<!-- emet-tools -->
+```
+accept_nonconformance
+corpus_recall
+emet_client_approve
+emet_floor
+emet_gaps
+emet_initialize
+emet_invite_create
+emet_member_access_create
+emet_session_close
+emet_session_open
+emet_setup_complete
+emet_status
+emet_subkey_claim
+emet_subkey_end_session
+emet_subkey_request
+emet_subkey_revoke
+emet_transcript_append
+list_docs
+patch_doc
+query_layer
+query_transcripts
+read_doc
+read_doc_history
+recall
+rename_doc
+restore_doc
+retire_doc
+revise_memory
+revise_transcript
+save_to_layer
+save_transcript
+semantic_recall
+validate_doc
+write_doc
+```
+<!-- /emet-tools -->
 
 **Retained revisions** — every document write archives the prior copy; `read_doc_history` lists
 what is retained for a document and returns any retained revision in full, re-hashed against its
@@ -660,7 +743,7 @@ at session *start*, which is the only moment early enough to matter.
 
 Every tool declares MCP annotations — `readOnlyHint`, `destructiveHint`, `idempotentHint`,
 `openWorldHint` — in one table in `src/annotations.js`, which is also the complete statement of
-what EMET does to a store. **11 of the 29 tools cannot modify anything**; four can replace the
+what EMET does to a store. **11 of the 30 tools cannot modify anything**; four can replace the
 visible content of a document; `openWorldHint` is false everywhere. The tools reach this
 server's own database and nothing else: no filesystem and no shell. The sign-in server fetches
 a client's metadata document, and only from a public address it has already checked.
@@ -730,8 +813,7 @@ alone — run it before and after any change to `src/redact.js`.
 
 ## Known gaps
 
-Honest list, because the point of this project is that it behaves predictably. What is planned
-next is in [docs/ROADMAP.md](docs/ROADMAP.md).
+Honest list, because the point of this project is that it behaves predictably:
 
 - Rows written before 2026-09-05 carry no content digest and rows written before 2026-09-07
   carry no metadata digest; reads report them as `'unattested'`, and they are not backfilled —
@@ -764,6 +846,7 @@ next is in [docs/ROADMAP.md](docs/ROADMAP.md).
 - Dynamic Client Registration is still served beside Client ID Metadata Documents; the MCP
   specification's deprecation window closes around 2027-07. It is scheduled to come off on
   2027-06-01.
+- Delegated client sub-keys stay off unless setup is told that more than one bot or AI will use the memory. A hosted server does not write a pepper into its container. A stamp shows that an approved key was presented, not which program held it. See [docs/SUBKEYS.md](docs/SUBKEYS.md).
 
 ---
 
@@ -775,7 +858,9 @@ It is designed first for neurodivergent users, and it works for anyone.
 
 ---
 
-## License
+## License and access
+
+EMET is free and open source under the MIT License (see LICENSE). No account, key or payment is required to run it.
 
 Authorship of the commit history, including a correction recorded as an addition
 rather than a rewrite: `docs/AUTHORSHIP.md`.

package/docs/AUTHORSHIP.md

@@ -1,11 +1,11 @@
 # Authorship
 
-Early commits in this project's private development history recorded the
-user's git identity in the author field. Those changes were machine-authored — written by assistant
+Commits in this repository through `commit-40d8d2d` record the user's git identity in
+the author field. Those changes were machine-authored — written by assistant
 instances under the user's direction. No git user was configured in any scope,
 so that identity was supplied per command.
 
-Later commits in that history name the assistant in the author field, and an `Approved-by` trailer
+From `commit-e3cad45` the author field names the assistant and an `Approved-by` trailer
 names the user, so what made a change and who accepted it are two separate
 recorded facts rather than one conflated one.
 

package/docs/BOTS.md

@@ -27,6 +27,10 @@ If one agent talks to you on behalf of the others — relays their reports up an
 
 Do these in order. Each step names what to read back. Steps 2 and 3 are **one change**: set `EMET_SOURCE_TAGS` and `EMET_RECORD_DOCS` together, in one deployment. A tag registered as a source but not yet listed as a bot is treated as a host in between.
 
+**Standing rule.** Every bot on the roster writes under its own source tag, `<prefix>-<bot>` (e.g. `bot-reviewer`). When a new bot joins the roster, register its tag in `EMET_SOURCE_TAGS` at the same time, before its first write. Append it to the end of the comma-separated list and keep every existing tag in order. Also add `bots/<tag>/HANDOFF.md` to `EMET_RECORD_DOCS` so the server treats it as a bot. Setting either variable redeploys the server; afterwards, check `/health` and `emet_status`.
+
+When `EMET_SUBKEYS=1`, bots that share the owner's login each hold a sub-key as a local secret. First use, in plain language, is [SUBKEYS.md](SUBKEYS.md). The key is never stored in an EMET document. The bot presents it at `emet_session_open` and passes the returned session handle on later writes in that session. The server stamps the key's tag. The owner approves a pending sub-key at `/owner/approvals` on this host (the same host as `/mcp`). The page is served only when `EMET_SUBKEYS=1`. It asks for the existing owner passphrase (`EMET_OAUTH_PASSPHRASE`, the same check as the OAuth consent page). A wrong passphrase on this page counts toward the same per-address lockout as `/oauth/approve`. A correct passphrase opens a session that lasts 15 minutes. The page lists each pending request by tag, key id prefix and requested time. Approve or Deny may include a reason; the decision is recorded as the owner and marked as coming from this page. Revoke stays on the owner's own login. A key expires after 30 days; the owner can reissue it. Sub-key records live in their own collection; `read_doc` cannot return them, and only the owner and the chief of staff can read the list or its history. Turning `EMET_SUBKEYS` off ends every live sub-key session once, in the background at startup, when that collection already exists. The history event is written before the status change, and the row is kept. If the collection does not exist, startup does not create it. The sweep tries once, then a few times with backoff. With the flag off, a write that presents an `emh_` handle is refused without opening the store. A write that names a sub-key session is refused the same way only when that session was live at this process's sweep. That refusal lasts until the next restart, by which time those sessions are already ended. A store that ran the first build, which kept these rows in `emet/CLIENT_APPROVALS.md`, still has them in that document's history. Production did not run that build. See `docs/proposals/EMET-0001-delegated-client-sub-keys.md`.
+
 1. **Roster row.** Add the bot to `bots/ROSTER.md`, filled from `templates/ROSTER.md`: tag, name, role, host, machine, handoff doc, tool profile, owner, status. The hub keeps the roster. Read back: `read_doc bots/ROSTER.md`.
 2. **Register the tag as a source.** Append the tag to `EMET_SOURCE_TAGS` (comma list) on the deployment. Without it, the bot's transcript appends are refused (`src/dispatch.js` `requireRegisteredSource`). The operator reads the variable back from the deployment (a bot cannot read deployment settings from a session).
 3. **Make the tag a bot tag.** Append `bots/<tag>/HANDOFF.md` to `EMET_RECORD_DOCS` (comma list). This one id is the only switch: nothing else — not the tag's prefix, not `EMET_SOURCE_TAGS`, not the roster — tells the server a tag is a bot (`src/session-graph.js` `isBotTag`; `docs/DEPLOY.md`).

package/docs/COVERAGE.md

@@ -1,8 +1,8 @@
 # Code coverage
 
-Measured 2026-10-07 22:44 UTC at a pre-release commit, Node v22.14.0. Regenerate with `npm run coverage`.
+Measured 2026-10-07 22:44 UTC at commit `commit-08aba62`, Node v22.14.0. Regenerate with `npm run coverage`.
 
-**An input to review, not a gate** (owner's ruling 2026-09-29). No threshold fails the build; the number is here so a reviewer or auditor can see what the suite exercises and what it does not.
+**An input to review, not a gate** (owner's ruling 2026-09-29, procedural ref 398). No threshold fails the build; the number is here so a reviewer or auditor can see what the suite exercises and what it does not.
 
 ## Totals