@remembrance-ai/opencode-plugin 0.1.73 → 0.1.76

package/skills/remembrancer/SKILL.md

@@ -22,8 +22,8 @@ background and register a privacy-bounded runtime profile. They never transmit
 the hostname, username, config path, or repository path. Follow the returned
 machine-readable `next_action` rather than asking the user to invent an
 identity. Tool-observer and completion timestamps appear after those events
-become eligible; their absence during the first prompt is not, by itself, a
-failure.
+become eligible. A fresh doctor reports them as informational; only a later
+missed lifecycle opportunity raises an attention warning.
 
 If this skill is visible but `run_connection_doctor` is absent, explicitly tell
 the user that Remembrance is only partially active. Do not silently fall back
@@ -97,6 +97,20 @@ Also use this skill when:
 
 Do not directly mutate shared skills. Submit structured remembrances, suggestions, or candidate skills for verification.
 
+Route memory by audience, not by which write tool is most convenient:
+
+- Host-local memory is for facts about this human, repository, installation, or machine.
+- Remembrance is for a generalized lesson another approved organization agent would otherwise rediscover the hard way.
+- A local-memory write does not satisfy organization-shared capture. Generalize reusable feedback and use the private lesson lane; never mirror raw local memory automatically.
+
+`get_connection_status` exposes content-free recent contribution outcomes for
+the current installation principal, or for the current API key when an older
+client has no principal. Use it when the user asks whether prior contributions
+were accepted, recognized as duplicates, remain pending, need review, or were
+rejected. It covers remembrances, private skill ideas, skill suggestions,
+resource submissions, and resource reviews. It never returns lesson text,
+titles, rejection prose, actor identity, or private payload data.
+
 Do not use this skill when:
 
 - The user asks for general web search, research, or current facts.
@@ -176,8 +190,10 @@ nothing was sent and the encrypted draft remains local in
 `awaiting_authorization`; do not retry it through REST or another transport.
 Transient timeouts, 429s, and 5xx responses remain queued for bounded retry on a
 later lifecycle. Authentication, policy, or validation failures remain held.
-Queued lessons never expire or auto-delete; deleting one requires an explicit
-confirmed local action.
+Unresolved and terminal lessons never expire or auto-delete; deleting one
+requires an explicit confirmed local action. After a signed submission receipt
+is verified, the encrypted lesson content is removed immediately and its
+content-free completion marker is automatically deleted after 14 days.
 
 The signed policy pins `private-lesson-redaction-v2` and the exact digest of its
 current rules. An unsupported version or digest moves the encrypted draft to
@@ -188,14 +204,18 @@ terminal count, retained bytes, reason, and explicit deletion guidance without
 returning draft content or a local path.
 
 The private lesson endpoint derives its organization and private visibility
-from the authenticated key. It cannot create public content and never falls
-back to public submission. Accepted candidates enter the existing verifier,
-topology, review-policy, encrypted-storage, and audit pipelines. Rich content,
-raw traces, URLs, code blocks, attachments, secrets, paths, identifiers, or
-ambiguous material stays local and must not be forced through by confirmation.
-Use `inspect_private_lesson_outbox` to inspect content-free state, retry a
-selected draft with `retry_private_lesson_candidate`, and delete only with
-`delete_private_lesson_candidate` plus explicit confirmation.
+from the authenticated key. The action always submits privately and never
+falls back to anonymous or public submission. Accepted candidates enter the
+existing verifier, topology, review-policy, encrypted-storage, and audit
+pipelines. After an accepted private outcome, a separate server-owned process
+may create a freshly redacted public candidate only when the organization admin
+enabled **Contribution propagation**; the agent neither chooses nor sees that
+process, and the derivative must pass the complete public pipeline. Rich
+content, raw traces, URLs, code blocks, attachments, secrets, paths,
+identifiers, or ambiguous material stays local and must not be forced through
+by confirmation. Use `inspect_private_lesson_outbox` to inspect content-free
+state, retry a selected draft with `retry_private_lesson_candidate`, and delete
+only with `delete_private_lesson_candidate` plus explicit confirmation.
 
 When health reporting is enabled, a held draft may use the same exact submit
 action to send only a `held_safety_event`: event type, held category counts,

package/skills/remembrancer/references/remembrance-setup.md

@@ -284,16 +284,23 @@ This is the only host-visible network action in the flow. Approve or persist
 approval for this exact action, not every Remembrance write. The server derives
 the organization and private visibility from the authenticated key, verifies a
 signed organization policy plus purpose-bound attestation, and returns a signed
-content-free receipt. The endpoint can never create or automatically propagate
-public content.
+content-free receipt. The action always submits privately and never falls back
+to anonymous or public submission. After an accepted private outcome, a
+separate server-owned process may create a freshly redacted public candidate
+only when the organization admin enabled the **Contribution propagation**
+setting; the submitting agent neither chooses nor sees that process, and the
+derivative must pass the complete public pipeline.
 
 If the host denies the action, no candidate content was sent. The encrypted
 draft remains on the device in `awaiting_authorization`; do not retry it
 through REST, hosted MCP, or another transport. Timeouts, 429s, and 5xx
 responses retry with bounded backoff during later plugin lifecycles. A 401,
 403, policy change, or validation failure remains held for explicit repair.
-Drafts never expire or auto-delete. Inspect, retry, or explicitly delete one
-with the local private-lesson tools; deletion requires confirmation.
+Unresolved and terminal drafts never expire or auto-delete. Inspect, retry, or
+explicitly delete one with the local private-lesson tools; deletion requires
+confirmation. After a signed submission receipt is verified, the encrypted
+lesson content is removed immediately and its content-free completion marker
+is automatically deleted after 14 days.
 
 The signed organization policy pins `private-lesson-redaction-v2` and its exact
 supported redactor digest. If either is unsupported, the finalized

package/src/index.mjs

@@ -45,21 +45,21 @@ import {
   decideStop,
   directSelectionFromResponse,
   highMatchFromResponse,
-  markCurrentEngagementHandled,
   markHostPolicyAlertDelivered,
+  observeSuccessfulCompletionTool,
   recordDirectiveFollowThroughForTool,
   recordDirectSelectionSurface,
   recordDirectiveSurface,
   recordHighMatchSurface,
   recordPluginLifecycleHealth,
   recordHostPolicyDenial,
+  recordQueryFeedbackObligation,
   recordRegistryUse,
   recordTaskEligibility,
   recordValueEpisodeSurface,
   queryResponseHasMatches,
   reportDirectiveEvent,
   reportTaskOutcomesOnStop,
-  responseRequestsRemembranceFollowup,
   resolveApiCredential,
   runPromptHook,
   toolResponseIndicatesFailure,
@@ -76,6 +76,8 @@ const CONTRIBUTION_TOOLS = [
   "submit_remembrance",
   "propose_skill_idea",
   "propose_private_skill",
+  "submit_private_lesson_candidate",
+  "retry_private_lesson_candidate",
   "submit_suggestion",
   "submit_resource",
   "submit_resource_review",
@@ -371,6 +373,7 @@ export const Remembrance = async (context = {}) => {
         highMatch: result?.highMatch ?? null,
         text: guidance.trim(),
         countsAsUse: Boolean(result?.consumed && result?.matched),
+        queryFeedback: result?.queryFeedback ?? null,
         valueEpisode: result?.valueEpisode ?? null,
       });
     }
@@ -412,6 +415,11 @@ export const Remembrance = async (context = {}) => {
         recordHighMatchSurface(sessionId, guidance.highMatch, env);
         recordValueEpisodeSurface(sessionId, guidance.valueEpisode, env);
       }
+      recordQueryFeedbackObligation(
+        sessionId,
+        guidance.queryFeedback,
+        env,
+      );
       recordDirectiveSurface(sessionId, guidance.directive, env);
       if (guidance.directive) {
         await reportDirectiveEvent(
@@ -487,7 +495,6 @@ export const Remembrance = async (context = {}) => {
       });
       const decision = decideStop({ session_id: sessionId }, { env });
       if (decision?.allow !== false || !decision?.reason) return;
-      markCurrentEngagementHandled(sessionId, env);
       writePromptedCount(sessionId, decision.useCount ?? 1, env);
       await notify(client, decision.reason);
     } catch (error) {
@@ -555,6 +562,7 @@ export const Remembrance = async (context = {}) => {
         const tool = toolNameFromEvent(input, output);
         if (!tool) return;
         const normalizedTool = tool.toLowerCase();
+        const toolArguments = toolArgumentsFromEvent(input);
         if (toolResponseIndicatesFailure(output)) {
           await observeHostPolicyDenial({
             eventType: "tool.execute.after",
@@ -575,6 +583,13 @@ export const Remembrance = async (context = {}) => {
             valueEpisodeFromResponse(output),
             env,
           );
+          observeSuccessfulCompletionTool(
+            sessionId,
+            tool,
+            toolArguments,
+            output,
+            env,
+          );
           await recordDirectiveFollowThroughForTool(sessionId, tool, output, {
             env,
           });
@@ -599,6 +614,23 @@ export const Remembrance = async (context = {}) => {
             selection.slug,
             env,
           );
+          observeSuccessfulCompletionTool(
+            sessionId,
+            tool,
+            toolArguments,
+            output,
+            env,
+          );
+          return;
+        }
+        if (normalizedTool.endsWith("prepare_private_lesson_candidate")) {
+          observeSuccessfulCompletionTool(
+            sessionId,
+            tool,
+            toolArguments,
+            output,
+            env,
+          );
           return;
         }
         if (
@@ -613,19 +645,26 @@ export const Remembrance = async (context = {}) => {
             normalizedTool.endsWith(candidate),
           )
         ) {
-          if (
-            normalizedTool.endsWith("submit_feedback") &&
-            responseRequestsRemembranceFollowup(output)
-          ) {
-            return;
-          }
-          markCurrentEngagementHandled(sessionId, env);
+          observeSuccessfulCompletionTool(
+            sessionId,
+            tool,
+            toolArguments,
+            output,
+            env,
+          );
           return;
         }
         clearHighMatchSurfaceIfOpened(
           sessionId,
           tool,
-          toolArgumentsFromEvent(input),
+          toolArguments,
+          env,
+        );
+        observeSuccessfulCompletionTool(
+          sessionId,
+          tool,
+          toolArguments,
+          output,
           env,
         );
       } catch (error) {