@north-light/crouter 0.3.220 → 0.3.222

package/dist/core/scope.js

@@ -6,6 +6,9 @@ import { assetRoot } from './asset-root.js';
 import { usage } from './errors.js';
 import { loadProfileManifest } from './profiles/manifest.js';
 import { realpathOrSelf } from './fs-utils.js';
+/** The ceiling a project root carries when no profile relationship contributes
+ *  it — the top rung, i.e. no cap at all. */
+export const NEUTRAL_PROJECT_MEMORY = 'content';
 // Cache of resolved project-scope-root STACKS, keyed by (resolved cwd, profile
 // id). A profile widens the pointer set beyond the bare cwd (see
 // findProjectScopeRoots below), so the cache key must carry both — the same
@@ -13,7 +16,8 @@ import { realpathOrSelf } from './fs-utils.js';
 // `resetScopeCache()` (called by every profile mutation in
 // src/core/profiles/manifest.ts) clears the whole cache; there is no
 // per-entry invalidation because a profile edit can change which pointer set
-// any cached cwd belongs to.
+// any cached cwd belongs to. Path-only callers read `roots`, which is the same
+// array in the same order as `annotated`.
 const scopeRootsCache = new Map();
 function scopeRootsCacheKey(resolvedStartDir, profileId) {
     return `${resolvedStartDir}\u0000${profileId ?? ''}`;
@@ -94,19 +98,40 @@ function collectAncestorScopeRoots(startDir, userRoot) {
  *  selected profile (`CRTR_PROFILE_ID`); a null/unresolvable profile collapses
  *  to the single `[startDir]` pointer, reproducing today's behavior exactly.
  *  Results are cached per (resolved startDir, profileId) — `resetScopeCache()`
- *  invalidates on any profile mutation that can change project dirs or names. */
+ *  invalidates on any profile mutation that can change project dirs or names.
+ *
+ *  Each root also carries the selected profile relationship's memory ceiling
+ *  (`findProjectScopeRootsWithMemory`), a projection layered onto this order
+ *  rather than part of it: discovery provenance decides precedence, the
+ *  relationship decides the ceiling, and the two never influence each other. */
 export function findProjectScopeRoots(startDir = process.cwd(), profileId = process.env['CRTR_PROFILE_ID'] || null) {
+    return resolveProjectScopeRoots(startDir, profileId).roots;
+}
+/** `findProjectScopeRoots` with each root's profile memory ceiling attached —
+ *  same roots, same order. A root contributed by a profile entry's ancestor
+ *  walk takes that entry's `memory` (first entry in manifest order wins, even
+ *  when cwd also reaches the root); every other root takes the neutral
+ *  `content` ceiling. */
+export function findProjectScopeRootsWithMemory(startDir = process.cwd(), profileId = process.env['CRTR_PROFILE_ID'] || null) {
+    return resolveProjectScopeRoots(startDir, profileId).annotated;
+}
+function resolveProjectScopeRoots(startDir, profileId) {
     const resolvedStart = resolve(startDir);
     const key = scopeRootsCacheKey(resolvedStart, profileId);
     const cached = scopeRootsCache.get(key);
     if (cached !== undefined)
         return cached;
     const userRoot = userScopeRoot();
-    const pointers = [resolvedStart];
+    // A null `memory` marks the cwd pointer: it decides precedence like any
+    // other pointer but contributes no ceiling.
+    const pointers = [
+        { dir: resolvedStart, memory: null },
+    ];
     if (profileId !== null && profileId !== '') {
         try {
             const { manifest } = loadProfileManifest(profileId);
-            pointers.push(...manifest.projects);
+            for (const project of manifest.projects)
+                pointers.push({ dir: project.path, memory: project.memory });
         }
         catch {
             // Missing/deleted/invalid profile: this is a hot path every memory and
@@ -116,16 +141,23 @@ export function findProjectScopeRoots(startDir = process.cwd(), profileId = proc
     }
     const seen = new Set();
     const roots = [];
+    const caps = new Map();
     for (const pointer of pointers) {
-        for (const root of collectAncestorScopeRoots(pointer, userRoot)) {
-            if (seen.has(root))
-                continue;
-            seen.add(root);
-            roots.push(root);
+        for (const root of collectAncestorScopeRoots(pointer.dir, userRoot)) {
+            if (!seen.has(root)) {
+                seen.add(root);
+                roots.push(root);
+            }
+            // Independent of the order dedupe above: a root already discovered from
+            // cwd still takes the first profile entry's ceiling.
+            if (pointer.memory !== null && !caps.has(root))
+                caps.set(root, pointer.memory);
         }
     }
-    scopeRootsCache.set(key, roots);
-    return roots;
+    const annotated = roots.map((root) => ({ root, memory: caps.get(root) ?? NEUTRAL_PROJECT_MEMORY }));
+    const entry = { roots, annotated };
+    scopeRootsCache.set(key, entry);
+    return entry;
 }
 export function projectScopeRoot(startDir) {
     return findProjectScopeRoot(startDir);
@@ -133,6 +165,9 @@ export function projectScopeRoot(startDir) {
 export function projectScopeRoots(startDir, profileId) {
     return findProjectScopeRoots(startDir, profileId);
 }
+export function projectScopeRootsWithMemory(startDir, profileId) {
+    return findProjectScopeRootsWithMemory(startDir, profileId);
+}
 export function scopeRoot(scope) {
     // The builtin scope has no scope-root dir; its content lives in dedicated
     // package directories such as builtinMemoryRoot().
@@ -160,7 +195,12 @@ export function ensureProjectScopeRoot(startDir = process.cwd()) {
     const resolvedStart = resolve(startDir);
     const root = join(resolvedStart, CRTR_DIR_NAME);
     const profileId = process.env['CRTR_PROFILE_ID'] || null;
-    scopeRootsCache.set(scopeRootsCacheKey(resolvedStart, profileId), [root]);
+    // Neutral ceiling: the empty cached stack proves no profile entry's ancestor
+    // walk reached this root, since it did not exist to be walked into.
+    scopeRootsCache.set(scopeRootsCacheKey(resolvedStart, profileId), {
+        roots: [root],
+        annotated: [{ root, memory: NEUTRAL_PROJECT_MEMORY }],
+    });
     return root;
 }
 export function pluginsDir(scope) {

package/dist/core/substrate/on-read.d.ts

@@ -15,7 +15,13 @@ export declare function renderOnReadDocsForSubject(subject: NodeConfigSubject, r
 /** Workspace boot docs using the snapshot's cwd/profile instead of a canvas
  * lookup. `seen` is the transcript-scoped dedup set shared with the on-read
  * hook, so a front door delivered here never re-delivers on a later read
- * beneath its store. */
+ * beneath its store.
+ *
+ * Each candidate's authored rung is clamped to its project's profile
+ * relationship cap BEFORE the `none` filter, the ordering, the render, and the
+ * seen-map recording — so a capped doc never renders above its cap, a `none`
+ * project contributes nothing, and a later explicit `crtr memory read` can
+ * still upgrade what workspace-open disclosed at a lower rung. */
 export declare function renderWorkspaceOpenDocsForSubject(subject: NodeConfigSubject, cwd: string, profileId: string | null, seen?: InjectedDocs): string;
 /** Inner `<memory>` blocks for the memory-read event: docs whose
  * `memory-read` entries match the doc a `crtr memory read` just resolved

package/dist/core/substrate/on-read.js

@@ -33,11 +33,11 @@ import { CRTR_DIR_NAME } from '../../types.js';
 import { pathExists, readText, walkFiles } from '../fs-utils.js';
 import { parseFrontmatterGeneric } from '../frontmatter.js';
 import { listAllMemoryDocs, listProjectMemoryDocs } from '../memory-resolver.js';
-import { userScopeRoot } from '../scope.js';
+import { NEUTRAL_PROJECT_MEMORY, userScopeRoot } from '../scope.js';
 import { gatePasses } from './gate.js';
 import { commandDeliveryRung, memoryReadDeliveryRung, owningRootOf, readDeliveryRung, workspaceOpenRung } from './surface-match.js';
 import { deliveredAtOrAbove, recordDelivery } from './injected-store.js';
-import { normalizeDocName, parseSubstrateDoc, parseSubstrateFrontmatter, previewLine, resolveDocName } from './schema.js';
+import { minRung, normalizeDocName, parseSubstrateDoc, parseSubstrateFrontmatter, previewLine, resolveDocName } from './schema.js';
 import { cachedSubstrateDocsInclusive } from './session-cache.js';
 import { realpathOrSelf } from '../fs-utils.js';
 const JUNK_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '.next', '.cache', '.yalc']);
@@ -48,27 +48,6 @@ function attr(s) {
         .replace(/</g, '&lt;')
         .replace(/>/g, '&gt;');
 }
-function gitRootOf(p) {
-    let d = p;
-    const root = parse(d).root;
-    while (true) {
-        if (pathExists(`${d}${sep}.git`))
-            return d;
-        if (d === root)
-            return null;
-        const parent = dirname(d);
-        if (parent === d)
-            return null;
-        d = parent;
-    }
-}
-function disp(p) {
-    const root = gitRootOf(p);
-    if (!root)
-        return p;
-    const rel = relative(root, p);
-    return rel === '' ? '.' : rel;
-}
 function isJunkAncestor(dir) {
     return dir.split(sep).some((segment) => JUNK_DIRS.has(segment));
 }
@@ -91,6 +70,9 @@ function loadProjectDoc(file, memoryDir) {
             scope: 'project',
             path: file,
             body,
+            // The read event is uncapped by design: this walk is reached only by an
+            // explicit file read, never by automatic boot/workspace-open delivery.
+            projectMemory: NEUTRAL_PROJECT_MEMORY,
         };
     }
     catch {
@@ -181,16 +163,26 @@ function docContentKey(doc) {
         return null;
     return `content-sha256:${createHash('sha256').update(body).digest('hex')}`;
 }
+// Two shapes: element-with-body means the content is here; self-closing means
+// it is not — a preview carries its routing line as `readWhen` metadata so the
+// one-liner can never be mistaken for the document's content. No disk path:
+// agents address memory by name through the command surface, and the explicit
+// read leaf already returns `path`.
 function renderDocEnvelope(doc, rung) {
     if (rung === 'none')
         return null;
-    let body = '';
-    if (rung === 'content')
-        body = doc.body.trim();
-    else if (rung === 'preview')
-        body = previewLine(doc);
-    const attrs = `kind="${attr(doc.kind)}" name="${attr(doc.name)}" src="${attr(disp(doc.path))}"`;
-    return body === '' ? `<memory ${attrs} />` : `<memory ${attrs}>\n${body}\n</memory>`;
+    let attrs = `kind="${attr(doc.kind)}" name="${attr(doc.name)}"`;
+    if (rung === 'content') {
+        const body = doc.body.trim();
+        if (body !== '')
+            return `<memory ${attrs}>\n${body}\n</memory>`;
+    }
+    else if (rung === 'preview') {
+        const pl = previewLine(doc);
+        if (pl !== '')
+            attrs += ` readWhen="${attr(pl)}"`;
+    }
+    return `<memory ${attrs} />`;
 }
 /** Render candidates at their matched rungs, gate-checked and deduped against
  *  the transcript set (higher rungs pierce lower; a delivery records at its
@@ -244,7 +236,13 @@ export function renderOnReadDocsForSubject(subject, readFilePath, seen = new Map
 /** Workspace boot docs using the snapshot's cwd/profile instead of a canvas
  * lookup. `seen` is the transcript-scoped dedup set shared with the on-read
  * hook, so a front door delivered here never re-delivers on a later read
- * beneath its store. */
+ * beneath its store.
+ *
+ * Each candidate's authored rung is clamped to its project's profile
+ * relationship cap BEFORE the `none` filter, the ordering, the render, and the
+ * seen-map recording — so a capped doc never renders above its cap, a `none`
+ * project contributes nothing, and a later explicit `crtr memory read` can
+ * still upgrade what workspace-open disclosed at a lower rung. */
 export function renderWorkspaceOpenDocsForSubject(subject, cwd, profileId, seen = new Map()) {
     let docs;
     try {
@@ -256,7 +254,7 @@ export function renderWorkspaceOpenDocsForSubject(subject, cwd, profileId, seen
         return '';
     }
     const candidates = dedupeByPhysicalPath(docs)
-        .map((doc) => ({ doc, rung: workspaceOpenRung(doc) }))
+        .map((doc) => ({ doc, rung: minRung(workspaceOpenRung(doc), doc.projectMemory) }))
         .filter(({ rung }) => rung !== 'none')
         .sort((a, b) => {
         const aRoot = owningRootOf(a.doc) ?? '';

package/dist/core/substrate/render-node.d.ts

@@ -1,6 +1,7 @@
 import type { InjectedDocs } from './injected-store.js';
-/** The system-prompt `<memory kind="preference">` block for `nodeId`: assemble
- *  the node's subject from the canvas-db, render the pure block, then swap the
+/** The system-prompt substrate splice for `nodeId` — shipped-layer protocol
+ *  prose followed by the `<memory kind="preference">` block: assemble
+ *  the node's subject from the canvas-db, render the pure splice, then swap the
  *  literal `$CRTR_CONTEXT_DIR` env-var token for the node's real absolute path
  *  so agents don't paste it into the non-expanding Write tool (see
  *  interpolateNodePaths). A null subject (unknown id) still renders the

package/dist/core/substrate/render-node.js

@@ -8,8 +8,9 @@
 import { interpolateNodePaths } from '../canvas/paths.js';
 import { assembleNodeSubject } from './subject.js';
 import { renderPreferencesForSubject, renderKnowledgeForSubject } from './render.js';
-/** The system-prompt `<memory kind="preference">` block for `nodeId`: assemble
- *  the node's subject from the canvas-db, render the pure block, then swap the
+/** The system-prompt substrate splice for `nodeId` — shipped-layer protocol
+ *  prose followed by the `<memory kind="preference">` block: assemble
+ *  the node's subject from the canvas-db, render the pure splice, then swap the
  *  literal `$CRTR_CONTEXT_DIR` env-var token for the node's real absolute path
  *  so agents don't paste it into the non-expanding Write tool (see
  *  interpolateNodePaths). A null subject (unknown id) still renders the

package/dist/core/substrate/render.js

@@ -57,14 +57,14 @@ import { subKindsAvailableTo } from '../config.js';
 import { parseFrontmatterGeneric } from '../frontmatter.js';
 import { pathExists, readText, realpathOrSelf, walkFiles } from '../fs-utils.js';
 import { memoryDir } from '../runtime/memory.js';
-import { projectScopeRoots } from '../scope.js';
+import { NEUTRAL_PROJECT_MEMORY, projectScopeRoots } from '../scope.js';
 import { gatePasses } from './gate.js';
 // De-barreled to LEAF modules on purpose: importing from './index.js' would
 // pull subject.js (canvas-db) transitively, re-tainting every CLI consumer of
 // the pure render fns. The canvas-db wrappers (renderPreferencesSection /
 // renderKnowledgeBlock) live in render-node.js instead.
 import { recordDelivery } from './injected-store.js';
-import { bootRung, normalizeDocName, parseSubstrateDoc, parseSubstrateFrontmatter, previewLine, resolveDocName, rungRank, } from './schema.js';
+import { bootRung, minRung, normalizeDocName, parseSubstrateDoc, parseSubstrateFrontmatter, previewLine, resolveDocName, rungRank, } from './schema.js';
 import { cachedSubstrateDocs } from './session-cache.js';
 /** First-wins dedup by (already-normalized) name, preserving the input's
  *  precedence order. The array's ORDER is the precedence signal — callers must
@@ -89,7 +89,13 @@ function dedupeFirstWins(docs) {
  *  selection ONLY; display ordering is a separate, later step (see
  *  renderGrouped) so a builtin doc can never mask a project/user override by
  *  virtue of sorting first. Uses the per-session cache so the full corpus is
- *  scanned + parsed at most once per session across the boot-render calls. */
+ *  scanned + parsed at most once per session across the boot-render calls.
+ *
+ *  The profile relationship's cap applies HERE, before dedup: a `none` project
+ *  leaves the corpus entirely (it contributes nothing, not even a `[+N more]`
+ *  count, and so cannot shadow a wider-scope automatic winner), and every
+ *  surviving doc's authored boot rung is clamped to its cap before dedup, the
+ *  session cache, and delivery seeding see it. */
 function selectWinners(subject, kind) {
     let docs;
     try {
@@ -100,8 +106,9 @@ function selectWinners(subject, kind) {
     }
     const eligible = docs
         .filter((d) => d.kind === kind)
+        .filter((d) => d.projectMemory !== 'none')
         .filter((d) => gatePasses(d, subject))
-        .map((d) => ({ ...d, bootRung: bootRung(d) }));
+        .map((d) => ({ ...d, bootRung: minRung(bootRung(d), d.projectMemory) }));
     return dedupeFirstWins(eligible);
 }
 // ---------------------------------------------------------------------------
@@ -176,9 +183,16 @@ function compareTreePosition(a, b) {
     }
     return as.length - bs.length;
 }
+/** A doc the running agent can revise through `crtr memory edit`: any native
+ *  scope-store doc (user/profile/project/node). Shipped docs — builtin and
+ *  plugin-mounted — are not editable from a node; the preference render treats
+ *  them as operating protocol, not memory (see buildPreferencesBlock). */
+function isAgentEditable(doc) {
+    return doc.scope !== 'builtin' && doc.plugin === undefined;
+}
 /** STEP 2 — split deduped `winners` by rung and render each group in its
  *  display order: `content` docs first, as clean prose (general→specific,
- *  then tree position, then filename — no tree chrome, no name label); every
+ *  then tree position, then filename — no tree chrome); every
  *  other winner (preview/name/hidden-bootless) folds into ONE catalog tree
  *  exactly as before. `nodeLocalSet` marks which winners came from the
  *  node-local store (ranked most-specific in content ordering); omit it for a
@@ -238,7 +252,9 @@ function nodeLocalDocs(nodeId, subject) {
             // node-local is NOT a resolver scope; `scope` is a placeholder never read
             // by gate eval (keyed off the NODE subject, not the doc) nor by the
             // renderers (keyed off name / body / rung).
-            out.push({ ...schema, name, scope: 'user', path: file, body });
+            // Node-local is not a project store: no profile relationship names it,
+            // so it carries the neutral ceiling.
+            out.push({ ...schema, name, scope: 'user', path: file, body, projectMemory: NEUTRAL_PROJECT_MEMORY });
         }
         catch {
             // A single malformed file is skipped, never fatal to the render.
@@ -480,37 +496,62 @@ function buildSubPersonaMenu(kind) {
         lines.join('\n'));
 }
 // ---------------------------------------------------------------------------
-// 1. Preferences — `<memory kind="preference">` (system prompt).
+// 1. Preferences — protocol prose + `<memory kind="preference">` (system prompt).
 // ---------------------------------------------------------------------------
-/** The system-prompt memory block: the always-present memory-usage guidance,
- *  then (when any are eligible) the `kind: preference` docs GROUPED by rung —
- *  content-rung docs first as clean prose (general→specific), then the
- *  preview/name catalog tree. ALWAYS returns a non-empty `<memory
- *  kind="preference">` block — the guidance frame is unconditional, so the
- *  system-prompt splice is never empty even when no preference is eligible. */
+/** The system-prompt substrate splice, TWO parts in one string.
+ *
+ *  1. The operating protocol: shipped (builtin/plugin) content-rung bodies as
+ *     bare prose, plus the sub-persona menu. No memory envelope — the protocol
+ *     is the rules of the node's world, and wrapping it as recalled "memory:
+ *     preference" content gave it softer epistemic status than the
+ *     instructions it is; the intro/outro sentences ("how the user wants you
+ *     to behave", "update the preference") were also false of it.
+ *  2. The `<memory kind="preference">` block: the always-present memory-usage
+ *     guidance, then (when any are eligible) each agent-editable doc wrapped
+ *     `<preference name="…">…</preference>` — the name is the edit handle the
+ *     outro's update directive needs — then the preview/name catalog tree.
+ *     Every frame sentence is true of everything inside it.
+ *
+ *  Ordering across the two parts is unchanged from the single-block render
+ *  (shipped→editable was already the scope sort), so the shared cache prefix
+ *  across nodes is preserved. ALWAYS returns a non-empty splice — the guidance
+ *  frame is unconditional, so it is never empty even when no preference is
+ *  eligible. */
 function buildPreferencesBlock(subject, seen) {
-    let body = MEMORY_USAGE_GUIDANCE;
     let contentDocs = [];
     let tree = '';
+    let protocol = '';
+    let memBody = MEMORY_USAGE_GUIDANCE;
     if (subject !== null) {
         const winners = selectWinners(subject, 'preference');
         seedBootDelivery(seen, winners);
         const grouped = renderGrouped(winners, 'preferences');
         contentDocs = grouped.contentDocs;
         tree = grouped.tree;
+        const shipped = contentDocs
+            .filter((d) => !isAgentEditable(d))
+            .map((d) => d.body.trim())
+            .filter((b) => b !== '');
+        const editable = contentDocs
+            .filter((d) => isAgentEditable(d))
+            .map((d) => {
+            const b = d.body.trim();
+            return b === '' ? '' : `<preference name="${d.name}">\n${b}\n</preference>`;
+        })
+            .filter((b) => b !== '');
         const subPersonaMenu = buildSubPersonaMenu(subject.kind);
-        if (grouped.contentProse !== '' || grouped.tree !== '' || subPersonaMenu !== '') {
-            body += `\n\n${PREFERENCES_INTRO}`;
-            if (grouped.contentProse !== '')
-                body += `\n\n${grouped.contentProse}`;
-            if (subPersonaMenu !== '')
-                body += `\n\n${subPersonaMenu}`;
-            if (grouped.tree !== '')
-                body += `\n\n${grouped.tree}`;
-            body += `\n\n${PREFERENCES_OUTRO}`;
+        protocol = [...shipped, ...(subPersonaMenu === '' ? [] : [subPersonaMenu])].join('\n\n');
+        if (editable.length > 0 || tree !== '') {
+            memBody += `\n\n${PREFERENCES_INTRO}`;
+            if (editable.length > 0)
+                memBody += `\n\n${editable.join('\n\n')}`;
+            if (tree !== '')
+                memBody += `\n\n${tree}`;
+            memBody += `\n\n${PREFERENCES_OUTRO}`;
         }
     }
-    return { block: `<memory kind="preference">\n${body}\n</memory>`, contentDocs, tree };
+    const memoryBlock = `<memory kind="preference">\n${memBody}\n</memory>`;
+    return { block: protocol === '' ? memoryBlock : `${protocol}\n\n${memoryBlock}`, contentDocs, tree };
 }
 export function renderPreferencesForSubject(subject, seen) {
     return buildPreferencesBlock(subject, seen);

package/dist/core/substrate/schema.d.ts

@@ -1,16 +1,20 @@
+import { type ProfileProjectMemory } from '../../api/dto/profiles.js';
 import type { MemoryDoc, MemoryScope } from '../memory-resolver.js';
 export declare const KINDS: readonly ["knowledge", "preference"];
 export type DocKind = (typeof KINDS)[number];
 /** Is `v` one of the two valid document kinds? */
 export declare function isDocKind(v: unknown): v is DocKind;
 export declare const RUNGS: readonly ["none", "name", "preview", "content"];
-export type Rung = (typeof RUNGS)[number];
+export type Rung = ProfileProjectMemory;
 /** Ordinal of a rung on the ladder (none=0 … content=3). */
 export declare function rungRank(r: Rung): number;
 /** Does rung `r` disclose at least as much as `min`? */
 export declare function rungAtLeast(r: Rung, min: Rung): boolean;
+/** The lower of two rungs — the clamp automatic delivery applies to an
+ *  authored rung against its project relationship's cap. */
+export declare function minRung(a: Rung, b: Rung): Rung;
 /** Strip an optional `NN-` ordering prefix from ONE path segment (file or
- *  directory display name). `00-runtime-base` -> `runtime-base`; `spine` (no
+ *  directory display name). `00-runtime-base/00-authoring` -> `runtime-base/authoring`; `spine` (no
  *  prefix) is unchanged. */
 export declare function normalizeNameSegment(segment: string): string;
 /** Normalize a full slash-separated path-derived doc name by stripping the
@@ -107,10 +111,20 @@ export interface SubstrateDoc extends SubstrateSchema {
     name: string;
     /** The scope this doc resolved from. */
     scope: MemoryScope;
+    /** Owning plugin name when the doc is mounted from an installed plugin;
+     *  undefined for a native scope doc. Shipped (builtin/plugin) docs and
+     *  agent-editable scope docs render differently at boot (see renderGrouped). */
+    plugin?: string;
     /** Absolute path to the source .md. */
     path: string;
     /** Document body, frontmatter stripped. */
     body: string;
+    /** The selected profile relationship's cap on the project store this doc
+     *  resolved from — the maximum rung automatic boot and workspace-open
+     *  delivery may disclose it at. `content` is the neutral ceiling every
+     *  non-project doc and every uncapped project root carries. Targeted reads,
+     *  command routing, and directory listings ignore it. */
+    projectMemory: ProfileProjectMemory;
 }
 /** Parse a raw frontmatter record (from `parseFrontmatterGeneric`, via the
  *  resolver) into a typed schema with defaults applied. Returns `null` when the

package/dist/core/substrate/schema.js

@@ -7,6 +7,7 @@
 // The runtime parser is tolerant by contract (it maps over many docs and must
 // never throw): invalid `surfaces` entries are dropped rather than crashing a
 // render, and `crtr memory lint` owns strict authoring-time enforcement.
+import { PROFILE_PROJECT_MEMORY_VALUES } from '../../api/dto/profiles.js';
 // ---------------------------------------------------------------------------
 // Kinds — the two semantic kinds (design §3): `knowledge` (consult — procedural
 // playbooks + factual references merged) vs `preference` (behave — standing
@@ -22,7 +23,10 @@ export function isDocKind(v) {
 // each rung is a superset of disclosure over the one before:
 //   none < name < preview < content
 // ---------------------------------------------------------------------------
-export const RUNGS = ['none', 'name', 'preview', 'content'];
+// The ladder is ONE union, owned by the public API DTO (`ProfileProjectMemory`)
+// so a profile relationship's cap and a doc's authored rung are the same values
+// and clamp against each other without a conversion.
+export const RUNGS = PROFILE_PROJECT_MEMORY_VALUES;
 /** Ordinal of a rung on the ladder (none=0 … content=3). */
 export function rungRank(r) {
     return RUNGS.indexOf(r);
@@ -31,21 +35,26 @@ export function rungRank(r) {
 export function rungAtLeast(r, min) {
     return rungRank(r) >= rungRank(min);
 }
+/** The lower of two rungs — the clamp automatic delivery applies to an
+ *  authored rung against its project relationship's cap. */
+export function minRung(a, b) {
+    return rungRank(a) <= rungRank(b) ? a : b;
+}
 // ---------------------------------------------------------------------------
 // Display-name normalization — the optional `NN-` ordering pin. A doc's
 // physical path may carry a two-digit numeric prefix on a file or directory
-// segment (`00-runtime-base.md`, `01-spine/`) purely to pin structural order
+// segment (`00-runtime-base/`, `01-spine/`) purely to pin structural order
 // against natural sort (design: builtin prompt corpus, used sparingly). The
 // prefix is NEVER part of the doc's identity: every identity-facing surface —
 // MemoryDoc.name, direct lookup, leaf fallback, `crtr memory read`/`list`,
 // prompt render, on-read display — derives from the NORMALIZED segments, so
-// `00-runtime-base` displays/dedups/resolves as `runtime-base`. When a doc
+// `00-runtime-base/00-authoring` displays/dedups/resolves as `runtime-base/authoring`. When a doc
 // sets an explicit frontmatter `name`, that normalized name wins instead of
 // the path-derived fallback. Only the physical path keeps the prefix.
 // ---------------------------------------------------------------------------
 const NUMERIC_PREFIX_RE = /^\d{2}-/;
 /** Strip an optional `NN-` ordering prefix from ONE path segment (file or
- *  directory display name). `00-runtime-base` -> `runtime-base`; `spine` (no
+ *  directory display name). `00-runtime-base/00-authoring` -> `runtime-base/authoring`; `spine` (no
  *  prefix) is unchanged. */
 export function normalizeNameSegment(segment) {
     return segment.replace(NUMERIC_PREFIX_RE, '');
@@ -133,7 +142,7 @@ export function parseSubstrateDoc(doc) {
     const schema = parseSubstrateFrontmatter(doc.frontmatter);
     if (schema === null)
         return null;
-    return { ...schema, name: doc.name, scope: doc.scope, path: doc.path, body: doc.body };
+    return { ...schema, name: doc.name, scope: doc.scope, plugin: doc.plugin, path: doc.path, body: doc.body, projectMemory: doc.projectMemory };
 }
 /** The kind a doc resolves to for `--kind` filtering/matching: the substrate
  *  kind when the frontmatter parses as a valid substrate doc, else the raw

package/dist/core/user-settings.d.ts

@@ -326,6 +326,10 @@ export declare const CONFIG_SETTINGS_COVERAGE: {
         surface: "specialized";
         owner: string;
     };
+    humanActions: {
+        surface: "specialized";
+        owner: string;
+    };
 };
 /** The exhaustive top-level key list used by config persistence and help. */
 export declare const SCOPE_CONFIG_KEYS: (keyof ScopeConfig)[];

package/dist/core/user-settings.js

@@ -389,6 +389,7 @@ export const CONFIG_SETTINGS_COVERAGE = {
     remoteCanvas: { surface: 'specialized', owner: 'canvas config commands' },
     spawnEnv: { surface: 'specialized', owner: 'spawn environment allow-list' },
     bin: { surface: 'specialized', owner: 'bare-binary contributions on every node PATH' },
+    humanActions: { surface: 'specialized', owner: 'scope-configured human completion actions' },
 };
 /** The exhaustive top-level key list used by config persistence and help. */
 export const SCOPE_CONFIG_KEYS = Object.keys(CONFIG_SETTINGS_COVERAGE);