@remembrance-ai/opencode-plugin 0.2.0 → 0.2.2

package/opencode.json

@@ -6,7 +6,7 @@
       "command": [
         "npx",
         "-y",
-        "@remembrance-ai/mcp-server@0.2.0"
+        "@remembrance-ai/mcp-server@0.2.2"
       ],
       "enabled": true,
       "environment": {
@@ -16,6 +16,6 @@
     }
   },
   "plugin": [
-    "@remembrance-ai/opencode-plugin@0.2.0"
+    "@remembrance-ai/opencode-plugin@0.2.2"
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remembrance-ai/opencode-plugin",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "license": "Apache-2.0",
   "description": "opencode plugin for Remembrance session hooks, tool observation, and contribution nudges.",
   "type": "module",

package/servers/remembrance-mcp.mjs

@@ -8622,7 +8622,7 @@ var MCP_CORE_INSTRUCTIONS = "Remembrance is shared operational memory for agents
 - Send summaries and hashes, never secrets, credentials, private URLs, raw logs, or proprietary content.
 - If the host blocks a Remembrance action, report it once as not submitted and do not retry it another way.
 ` + LEGACY_CORE_FINISH_RULE;
-var REMEMBRANCE_MCP_SERVER_INSTRUCTIONS = MCP_CORE_INSTRUCTIONS + MCP_DETAILS_HEADING + "Before claiming that Remembrance is anonymous, unconfigured, partially active, or missing an organization key, call run_connection_doctor for the transport you will actually use. It performs a safe catalog read and returns exact bounded remediation without submitting content. Use get_connection_status only when you need the underlying transport and lifecycle fields. An unset REMEMBRANCE_API_KEY does not prove that a local plugin is anonymous because local hooks and bundled MCP may read ~/.config/remembrance/config.json. Conversely, hosted MCP cannot read that local file. Anonymous curl or browser probes describe only those requests, not plugin authentication. Never print or request the raw key. When the user explicitly names an authorized Remembrance skill or supplies a remembrance://skills/{slug} URI, resolve ambiguous names with list_skills using its normalized slug-prefix filter, then call invoke_skill with an exact returned slug. Never guess a slug. list_skills is catalog resolution, not relevance search; use query_skills when the user wants relevant candidates rather than a known selection. invoke_skill rechecks authorization and organization policy, resolves the current reviewed version, and returns the only full instruction body. Catalog listings and MCP resource reads are lightweight handles, not skill use. Do not run query_skills merely to rediscover that explicit selection, and do not submit query-fit feedback for it. After meaningful direct use, follow the returned task-outcome and post-use feedback instructions once. BEFORE non-trivial service/API/tool/library/workflow/UI/review/test/security/deployment work, call query_skills to reuse proven skills and resources instead of rediscovering them. A local repository change still qualifies when it involves a reusable workflow or lesson; skip only genuinely trivial throwaway edits and one-off facts. For short follow-ups such as 'fix these issues', 'continue', or 'try again', infer the concrete task, domain, and constraints from the full conversation and still call query_skills; do not wait for the current prompt to repeat trigger keywords. Treat match_tier as a decision aid, then inspect why_matched and applicability before opening a result. These fields show bounded matched terms/capabilities, constraint text overlap, qualitative lexical/semantic evidence, declared scope, use conditions, and exclusions without exposing unstable raw ranking scores. satisfied_constraints and missed_constraints describe textual overlap only, not verified compliance or proven capability gaps. Discard an unlikely or irrelevant corner-case result and report fit: poor; do not force its use. For a remaining high match, call get_skill or get_resource before custom work and pass the returned query_id/result_id so the surfaced-to-fetch funnel closes; possible and exploratory matches are optional. The response also includes approximate context tokens, verified uses, risk, tags, permissions, dependencies, and contraindications so you can weigh the detour safely. Honor query_skills.skill_access on every response. When policy is org_only, use only returned organization skills and never substitute bundled or live public skill references; if an organization key is configured and the query is unavailable, fail closed because the policy cannot be confirmed. AFTER query_skills, call submit_query_feedback once with one complete set of explicit good/partial/poor judgments using the returned query_id and result_id values; leave unrated results neutral, and remember that a poor query match is not the same as a globally bad skill. Reuse the same organization or anonymous auth scope as the query. AFTER you actually use a skill or resource, close the post-use loop with submit_feedback (useful true/false plus a one-line lesson and the originating query_id/result_id; it returns a ready submit_remembrance payload), then submit_remembrance if the lesson is reusable. If nothing fit and you built a new workflow, use propose_private_skill for an organization-private candidate. With an organization key, propose_skill_idea also remains organization-private. Never remove, suppress, or bypass that key to force a public submission; submit privately, then use the reviewed public-propagation flow when the organization chooses to share it. When delegating, pass the selected slug, exact version, query_id, and result_id to the subagent; it should invoke/fetch that result or run its own full-context query. The parent reports the terminal outcome unless the subagent creates its own invocation. Route memory deliberately: host-local memory is for facts about this human, repository, or machine; Remembrance is for generalized lessons another approved organization agent would otherwise rediscover. A local-memory write does not satisfy organization-shared capture. Before finishing any reusable task, self-check for a missed query. If you catch your own mistake, the user catches one, CI/deploy fails, a security issue appears, or you fix a release/versioning miss, submit a failure_report remembrance even if no skill was used; raw MCP clients have no plugin Stop hook to remind you later. After an observed host-policy denial, report only the affected action once: 'The host blocked this Remembrance action. Do not treat it as submitted. Earlier successful actions are unaffected; querying remains available.' Do not retry the blocked content through another transport or claim submission. If submit_query_feedback or submit_feedback was denied before transport and acknowledge_feedback_denial is available, call that local-only tool with the exact tool, query_id, result_id only for submit_feedback, and reason host_policy_denied. It suppresses that blocked reminder without claiming feedback was submitted, changing approvals, or blocking future feedback. When host events are unavailable, use this explicit acknowledgment; do not infer denial from API errors. Do not repeat warnings already reported. Attach evidence (reproduction detail, artifact hashes, or an attestation); evidence-less public reports wait in unverified intake until corroborated. Redact secrets, private URLs, credentials, raw logs, and proprietary content; submit summaries and hashes, not raw traces.";
+var REMEMBRANCE_MCP_SERVER_INSTRUCTIONS = MCP_CORE_INSTRUCTIONS + MCP_DETAILS_HEADING + "Before claiming that Remembrance is anonymous, unconfigured, partially active, or missing an organization key, call run_connection_doctor for the transport you will actually use. It performs a safe catalog read and returns exact bounded remediation without submitting content. Use get_connection_status only when you need the underlying transport and lifecycle fields. An unset REMEMBRANCE_API_KEY does not prove that a local plugin is anonymous because local hooks and bundled MCP may read ~/.config/remembrance/config.json. Conversely, hosted MCP cannot read that local file. Anonymous curl or browser probes describe only those requests, not plugin authentication. Never print or request the raw key. When the user explicitly names an authorized Remembrance skill or supplies a remembrance://skills/{slug} URI, resolve ambiguous names with list_skills using its normalized slug-prefix filter, then call invoke_skill with an exact returned slug. Never guess a slug. list_skills is catalog resolution, not relevance search; use query_skills when the user wants relevant candidates rather than a known selection. invoke_skill rechecks authorization and organization policy, resolves the current reviewed version, and returns the only full instruction body. Catalog listings and MCP resource reads are lightweight handles, not skill use. Do not run query_skills merely to rediscover that explicit selection, and do not submit query-fit feedback for it. After meaningful direct use, follow the returned task-outcome and post-use feedback instructions once. BEFORE non-trivial service/API/tool/library/workflow/UI/review/test/security/deployment work, call query_skills to reuse proven skills and resources instead of rediscovering them. A local repository change still qualifies when it involves a reusable workflow or lesson; skip only genuinely trivial throwaway edits and one-off facts. For short follow-ups such as 'fix these issues', 'continue', or 'try again', infer the concrete task, domain, and constraints from the full conversation and still call query_skills; do not wait for the current prompt to repeat trigger keywords. Treat match_tier as a decision aid, then inspect why_matched and applicability before opening a result. These fields show bounded matched terms/capabilities, constraint text overlap, qualitative lexical/semantic evidence, declared scope, use conditions, and exclusions without exposing unstable raw ranking scores. satisfied_constraints and missed_constraints describe textual overlap only, not verified compliance or proven capability gaps. Discard an unlikely or irrelevant corner-case result and report fit: poor; do not force its use. For a remaining high match, call get_skill or get_resource before custom work and pass the returned query_id/result_id so the surfaced-to-fetch funnel closes; possible and exploratory matches are optional. The response also includes approximate context tokens, verified uses, risk, tags, permissions, dependencies, and contraindications so you can weigh the detour safely. Honor query_skills.skill_access on every response. When policy is org_only, use only returned organization skills and never substitute bundled or live public skill references; if an organization key is configured and the query is unavailable, fail closed because the policy cannot be confirmed. AFTER query_skills, call submit_query_feedback once with one complete set of explicit good/partial/poor judgments using the returned query_id and result_id values; leave unrated results neutral, and remember that a poor query match is not the same as a globally bad skill. Reuse the same organization or anonymous auth scope as the query. AFTER you actually use a skill or resource, close the post-use loop with submit_feedback (useful true/false plus a one-line lesson and the originating query_id/result_id; it returns a ready submit_remembrance payload), then submit_remembrance if the lesson is reusable. If nothing fit and you built a new workflow, use propose_private_skill for an organization-private candidate. With an organization key, propose_skill_idea also remains organization-private. Never remove, suppress, or bypass that key to force a public submission; submit privately, then use the reviewed public-propagation flow when the organization chooses to share it. When delegating, pass the selected slug, exact version, query_id, and result_id to the subagent; it should invoke/fetch that result or run its own full-context query. The parent reports the terminal outcome unless the subagent creates its own invocation. Route memory deliberately: host-local memory is for facts about this human, repository, or machine; Remembrance is for generalized lessons another approved organization agent would otherwise rediscover. A local-memory write does not satisfy organization-shared capture. Before finishing any reusable task, self-check for a missed query. If you catch your own mistake, the user catches one, CI/deploy fails, a security issue appears, or you fix a release/versioning miss, submit a failure_report remembrance even if no skill was used; raw MCP clients have no plugin Stop hook to remind you later. After an observed host-policy denial, report only the affected action once: 'The host blocked this Remembrance action. Do not treat it as submitted. Earlier successful actions are unaffected; querying remains available.' Do not retry the blocked content through another transport or claim submission. If submit_query_feedback or submit_feedback was denied before transport and acknowledge_feedback_denial is available, call that local-only tool with the exact tool, query_id, result_id only for submit_feedback, and reason host_policy_denied. It suppresses that blocked reminder without claiming feedback was submitted, changing approvals, or blocking future feedback. When host events are unavailable, use this explicit acknowledgment; do not infer denial from API errors. Do not repeat warnings already reported. Attach evidence (reproduction detail, artifact hashes, or an attestation); evidence-less public reports wait in unverified intake until corroborated. Redact secrets, private URLs, credentials, raw logs, and proprietary content; submit summaries and hashes, not raw traces. Keep routine organization query-fit and categorical post-use ratings minimal: use the Remembrance-issued query_id/result_id values, judgments, required reasons, and an idempotency key when needed. Do not automatically attach internal artifact hashes, task text, source snippets, or raw logs to routine ratings. Optional evidence is not required for these ratings; public substantive reports still need evidence. Standing approval for these two feedback tools does not authorize reusable content submission or override host policy, organization scope, or processing consent.";
 var LEGACY_POST_QUERY_GUIDANCE = "AFTER query_skills, call submit_query_feedback once with one complete set of explicit good/partial/poor judgments using the returned query_id and result_id values; leave unrated results neutral, and remember that a poor query match is not the same as a globally bad skill. Reuse the same organization or anonymous auth scope as the query. AFTER you actually use a skill or resource, close the post-use loop with submit_feedback (useful true/false plus a one-line lesson and the originating query_id/result_id; it returns a ready submit_remembrance payload), then submit_remembrance if the lesson is reusable. If nothing fit and you built a new workflow, use propose_private_skill for an organization-private candidate. With an organization key, propose_skill_idea also remains organization-private. Never remove, suppress, or bypass that key to force a public submission; submit privately, then use the reviewed public-propagation flow when the organization chooses to share it. ";
 var PRIVATE_CAPTURE_POST_QUERY_GUIDANCE = "AFTER query_skills, call submit_query_feedback once with one complete set of explicit good/partial/poor judgments using the returned query_id and result_id values; leave unrated results neutral, and remember that a poor query match is not the same as a globally bad skill. Reuse the same organization scope as the query. AFTER actually using a skill or resource, call submit_feedback with categorical usefulness and the originating query_id/result_id; reusable prose does not belong in that call. Capture each new reusable item once with capture_learning using lesson, private_skill, or preference, then follow its exact next_action or bounded agent_recovery instructions. Reformulation updates the same retained draft after fresh local inspection; it does not authorize submitting held content, inventing missing instructions, or changing destination. A complete workflow must include complete reviewed instructions in private_skill; do not compress it into a lesson. Querying, opening a returned result, bounded feedback, and local encrypted capture are routine actions: perform them silently without asking for separate conversational permission. Only the exact private network submit or retry action may require host approval; when that lane is already approved, continue without another prompt. capture_learning chooses the organization-private lane and never accepts an organization, destination, visibility, credential, or public fallback. Its preference route is routing only: it persists nothing locally (persisted_locally is false) and record_preference is the whole remaining lifecycle, so read that response instead of assuming the preference is live. record_preference does not promise activation, and an organization using customer-held encryption is refused before persistence with HTTP 422 and code customer_held_preference_processing_deferred: do not retry it, do not offer preference compatibility feedback there, and do not report the preference as captured. ";
 var LEGACY_FINISH_GUIDANCE = "Before finishing any reusable task, self-check for a missed query. If you catch your own mistake, the user catches one, CI/deploy fails, a security issue appears, or you fix a release/versioning miss, submit a failure_report remembrance even if no skill was used; raw MCP clients have no plugin Stop hook to remind you later. ";
@@ -23828,7 +23828,7 @@ var seedSkills = [
     summary: "Operational setup and troubleshooting workflow for Remembrance across Claude Code, Codex, OpenClaw, Cursor, Gemini, MCP, REST, skill-only installs, enterprise keys, and local agent identity.",
     status: "active",
     visibility: "public",
-    version: "0.1.37",
+    version: "0.1.38",
     domains: ["agent-skills", "mcp", "resource-discovery"],
     tags: [
       "remembrance",
@@ -23879,7 +23879,7 @@ var seedSkills = [
         "gemini",
         "rest"
       ],
-      version: "0.1.37",
+      version: "0.1.38",
       status: "active",
       visibility: "public",
       providers: ["codex", "claude", "cursor", "openclaw", "generic"],
@@ -24085,6 +24085,51 @@ show the same review screen again; never use the automation-only trust bypass
 for normal installation. Fully restart Codex, submit one prompt, use one
 Remembrance tool, complete one turn, and run \`run_connection_doctor\`.
 
+### Optional unattended routine feedback in Codex
+
+After the user explicitly opts in, add only these two tool overrides to the
+user-level \`~/.codex/config.toml\`. This approval persists across future
+sessions on this installation until removed; installation alone does not grant
+it. Merge with existing tables rather than duplicating them:
+
+~~~toml
+[plugins."remembrance@remembrance".mcp_servers.remembrance.tools.submit_query_feedback]
+approval_mode = "approve"
+
+[plugins."remembrance@remembrance".mcp_servers.remembrance.tools.submit_feedback]
+approval_mode = "approve"
+~~~
+
+Use this opt-in for an organization-authenticated local plugin whose
+\`submit_feedback\` schema is categorical and rejects \`lesson\`. Query-fit
+ratings send Remembrance-issued query/result IDs, categorical verdicts, and
+required reasons; post-use ratings send the skill slug, those correlation IDs, usefulness/rating,
+and stable idempotency. Keep optional notes and evidence out of routine
+ratings: do not automatically attach internal receipt hashes, task prose,
+source content, raw logs, or private URLs. Public substantive reports retain
+their separate evidence requirements; reusable private lessons use
+\`capture_learning\` and its exact returned action.
+
+These are real writes, not read-only diagnostics. Post-use feedback can enter
+verification and incur processing cost under the existing organization policy.
+The two overrides do not approve private lesson/skill submission, publishing,
+deletion, reset, preference changes, or other tools. They do not widen the
+server's enabled tool set or override managed policy, guardian decisions,
+network restrictions, or organization processing grants. Do not set the whole
+server's approval default to \`approve\` for this purpose.
+
+Tool overrides persist when authentication or schemas change. Remove or
+re-review both approvals before switching to anonymous or hosted transport,
+enabling legacy broad writes, or changing the organization or destination.
+
+To revoke this opt-in, remove only these two tool-level approval entries;
+the inherited approval policy applies again. Reconnect the plugin or start a
+fresh Codex session if the current host does not reload config, then verify
+with a minimal eligible rating. A healthy connection doctor verifies the
+connection, not that host approval policy permits feedback. A denial means
+that rating was not submitted; acknowledge it locally and do not retry through
+another transport. See the [official installed-server policy guide](https://developers.openai.com/plugins/build/plugins#configure-installed-server-policy).
+
 OpenClaw:
 
 ~~~bash
@@ -28044,6 +28089,13 @@ var categoricalSubmitFeedbackMaxSerializedBytes = boundedWritePayloadCeilingWith
 categoricalSubmitFeedbackInputSchema[BOUNDED_JSON_BYTES_EXTENSION] = categoricalSubmitFeedbackMaxSerializedBytes;
 var categoricalSubmitFeedbackRuntime = freezeToolRuntime({
   ...canonicalSubmitFeedbackRuntime.definition,
+  description: `${canonicalSubmitFeedbackRuntime.definition.description} Routine organization feedback needs only the skill identity, categorical rating, and Remembrance-issued correlation IDs. Do not automatically attach internal artifact hashes or task prose; include optional richer evidence only when the current task authorizes it.`,
+  // This profile exists only for a configured organization's private feedback.
+  // It remains a networked write; only the public/legacy profile is open-world.
+  annotations: {
+    ...canonicalSubmitFeedbackRuntime.definition.annotations,
+    openWorldHint: false
+  },
   schemaProfile: toolSchemaProfileId(
     "submit_feedback",
     "input",
@@ -28436,18 +28488,32 @@ function inputSchemaFor(schema, name, maxSerializedBytes) {
   const resolved = definitions?.[name] ?? converted;
   normalizeBoundedWriteJsonSchema(resolved, name);
   if (name === "acknowledge_feedback_denial") {
+    const properties = resolved.properties;
     return {
       type: "object",
-      properties: resolved.properties,
+      properties,
       additionalProperties: false,
       oneOf: [
         {
-          properties: { tool: { const: "submit_query_feedback" } },
+          type: "object",
+          properties: {
+            tool: { const: "submit_query_feedback" },
+            query_id: properties.query_id,
+            reason: properties.reason
+          },
+          additionalProperties: false,
           required: ["tool", "query_id", "reason"],
           not: { required: ["result_id"] }
         },
         {
-          properties: { tool: { const: "submit_feedback" } },
+          type: "object",
+          properties: {
+            tool: { const: "submit_feedback" },
+            query_id: properties.query_id,
+            result_id: properties.result_id,
+            reason: properties.reason
+          },
+          additionalProperties: false,
           required: ["tool", "query_id", "result_id", "reason"]
         }
       ]
@@ -67273,7 +67339,7 @@ function inspectPrivateLearningOutbox2(input, dependencies = {}) {
 }
 var MAX_REMOTE_RESPONSE_BYTES = 4 * 1024 * 1024;
 var DOCTOR_PROBE_TIMEOUT_MS = 7500;
-var SERVER_VERSION = true ? "0.2.0" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.2.2" : "0.0.0-dev";
 var tools = toolDefinitions;
 var doctorCliRequested = process.argv[2] === "doctor";
 var nativeContextCliRequested = process.argv[2] === "--native-context";

package/skills/remembrancer/SKILL.md

@@ -339,7 +339,8 @@ Remembrance independently classifies the evidence after static safety,
 duplicate search, target existence, risk, verifier, and organization-policy
 checks:
 
-- a universal correction or reusable detail can **amend** the target;
+- a universal correction or reusable detail can **amend** the target when an
+  explicit authored instruction body or catalog change is supplied;
 - a stable runtime, version, platform, framework, scale, or task-stage
   condition can become a scoped **specialization**;
 - a genuinely different approach can become a **strategy fork**;
@@ -547,6 +548,22 @@ clients that do not advertise the capability retain the optional lesson and
 `next_step.submit_remembrance_payload` contract; REST-only agents can sign that
 payload by following `references/attestation-rest.md`.
 
+Keep routine organization feedback minimal: use Remembrance-issued query/result
+IDs, the skill slug, categorical usefulness/rating, and stable idempotency.
+Query-fit feedback likewise needs its correlation IDs, verdicts, and required
+reasons. Omit optional notes and evidence unless the user separately requested that richer
+submission. Do not automatically attach internal receipt hashes, task prose,
+source content, raw logs, or private URLs to a routine rating. Feedback is a
+real write and can enter verification with processing cost; it is not a
+read-only diagnostic. User opt-in for unattended ratings approves only those
+two feedback tools, not private capture submission or other writes, and cannot
+override host or organization policy. See the setup reference for the narrow
+Codex approval and revocation steps.
+
+Tool overrides persist when authentication or schemas change. Remove or
+re-review both approvals before switching to anonymous or hosted transport,
+enabling legacy broad writes, or changing the organization or destination.
+
 Always attach evidence to public submissions: concrete reproduction detail in
 `outcome.failure_modes`, `evidence.artifact_hashes` (sha256 of redacted logs,
 diffs, or screenshots), or an attestation. Evidence-less public reports are not
@@ -560,14 +577,22 @@ Repeated substantive feedback for the same skill may also return
 evidence candidate from the recent pattern and queued it for topology routing,
 normal verification, quality gates, versioning, and admin/enterprise review.
 Treat it as a receipt; it does not mean the live skill changed or predetermine
-whether the result will amend, specialize, fork, create, or remain evidence.
-
-`suggested_update` on a remembrance is honored: when the remembrance itself is
-accepted, Remembrance promotes it into a reviewed suggestion (`amend_skill`,
-`metadata_update`, `deprecate_skill`) or a new skill idea (`new_skill`) riding
-the normal verification and review pipeline. The promotion is a receipt too —
-the live skill changes only after review. `score_adjustment` is ignored:
-Remembrance computes all scoring deterministically.
+the selected route. Synthesized review prose is not an authored parent
+instruction or catalog patch; reviewed distinct-child routes stay separate.
+
+On a remembrance, `suggested_update` hints of `amend_skill` or
+`metadata_update` stay with the accepted evidence; they do not create an empty
+publication suggestion. Explicit `deprecate_skill` and `new_skill` requests
+still enter their existing reviewed lifecycles. A receipt never means the live
+skill changed. `score_adjustment` is ignored: scoring is deterministic.
+
+When you intend to change a parent's instructions or catalog, read
+[the authored amendment examples](references/remembrance-payloads.md#authored-parent-amendments).
+Submit the explicit change through the existing suggestion/idea review lane;
+summary, diff and verifier prose are review context, not parent edits. A
+missing authored parent change stays recoverable for review, and an identical
+complete-body/catalog result creates no new skill version or semantic refresh.
+Existing audience, consent, protection, target and review policy still apply.
 
 Legacy/raw MCP equivalent: `submit_remembrance`. Organization-capable local
 clients use `capture_learning.lesson`; broad remembrance submission is hidden
@@ -612,8 +637,8 @@ Good triggers include: the agent admits it missed a required step, the user
 catches a mistake, CI/deploy fails, a smoke/probe exposes a regression, or a
 release/versioning miss is fixed. Put the reusable lesson in `lesson`, the
 concrete failure class in `outcome.failure_modes`, and use
-`suggested_update.kind` only when an existing skill or a new skill should change
-after review.
+`suggested_update.kind` only to describe an intended reviewed operation, not as
+a substitute for an authored parent change.
 
 Use `agent.provider: "claude"` for a skill-only Claude install. Use
 `evidence.attestation.provider: "other"` for independent REST TOFU

package/skills/remembrancer/references/remembrance-payloads.md

@@ -44,16 +44,77 @@ use categorical `submit_feedback` independently.
 
 Legacy `attestation_token_hash` is no longer accepted. Verified trust uses `POST /api/v1/agent/attest/challenge` followed by a plugin-signed `evidence.attestation` object.
 
-`suggested_update` describes a requested content operation; it does not decide
-the final skill topology. When the remembrance itself is accepted, Remembrance
-creates reviewable evidence through the normal verification pipeline. The
-topology router may amend the target, create a scoped specialization, create a
-strategy fork or independent skill, record a typed preference, retain evidence
-without mutation, or hold for review. The live skill changes only after the
+`suggested_update` describes an intended operation; it does not decide the
+final topology or supply a parent edit. An accepted remembrance retains
+`amend_skill` and `metadata_update` hints as evidence without creating an empty
+publication suggestion. Explicit `deprecate_skill` and `new_skill` requests
+still enter their existing reviewed lifecycles. For an authored parent change,
+use the suggestion/idea lane below. The live skill changes only after the
 selected route clears its safety, quality, target, policy, and version guards.
 `score_adjustment` is ignored (scoring is deterministic); use `kind: "none"`
 when no content operation is proposed.
 
+## Authored parent amendments
+
+For `submit_suggestion` / `POST /api/v1/agent/suggestions`, send the complete
+intended instruction body in `payload.skill_md`, `payload.proposed_skill_md`
+or `payload.full_skill_md`. Start from the current authorized skill body and
+preserve instructions you are not changing; do not send only a diff or an
+isolated addition as the replacement body. For a parent amendment, `summary`,
+`diff_text` and a verifier's `proposed_patch` explain the review, but are never
+appended as instructions or implicitly saved as catalog guidance.
+
+This synthetic example replaces the complete body of a small public skill:
+
+```json
+{
+  "skill_slug": "synthetic-state-check",
+  "suggestion_type": "amend_skill",
+  "summary": "Check the response status before interpreting the result.",
+  "diff_text": "Review context: add the response-status check.",
+  "payload": {
+    "skill_md": "# State check\n\nRead the current state. Check the response status before interpreting the result. Compare it with the expected state and report any difference.\n"
+  }
+}
+```
+
+For a catalog-only change, submit the existing structured catalog fields
+explicitly. For example:
+
+```json
+{
+  "skill_slug": "synthetic-state-check",
+  "suggestion_type": "metadata_update",
+  "summary": "Describe the skill's existing response-status check.",
+  "payload": {
+    "summary": "Compare the current and expected state after checking the response status."
+  }
+}
+```
+
+These are payload-shape examples, not permission to submit public content.
+Keep organization authentication and private protection on organization
+requests; never remove a key to make a private amendment public. Current
+organization-capable clients still use their authorized local capture/router
+and only its returned actions. These examples do not add a direct mutation
+tool or bypass that contract. Preserve the existing organization array
+replacement/merge rules for catalog updates.
+
+For an idea routed to amend a parent, use its existing `proposed_skill_md` or
+explicit `proposed_metadata` fields. Authored input does not remove an existing
+target-resolution or protection hold. A parent amendment without authored input
+is retained in a recoverable review hold: resubmit the complete intended body
+or structured catalog change through the same authorized review lane. A changed
+payload is a new logical submission and needs its own idempotency key; retries
+of that submission reuse its key. A reviewer may instead select `evidence_only`
+to retain the comment without publishing. Do not report a replacement as
+submitted or a skill as changed until the corresponding receipt proves it.
+
+An accepted identical body/catalog result is an audited no-op: it preserves
+the live version and does not enqueue semantic refresh. Explicit deprecation,
+new-skill proposals and reviewed distinct-child routes retain their existing
+contracts; they are not universally held by the parent-amendment rule.
+
 Provider fields are intentionally split:
 
 - `agent.provider` describes the calling runtime: `codex`, `cursor`, `claude`,
@@ -213,9 +274,11 @@ predetermined metadata update or a live mutation:
 }
 ```
 
-Do not submit a duplicate suggestion for the same pattern. Wait for the
-topology, verification, review, and versioning result before assuming the
-active skill changed.
+Do not submit a duplicate suggestion for the same pattern. Its review prose
+does not supply an authored parent catalog patch or instruction body. If you
+separately intend a parent change, use the authored amendment lane above and
+the existing review policy; do not assume the evidence receipt changed the
+active skill.
 
 Local identity recovery: the persisted key file
 `~/.config/remembrance/agent-key.json` is a private key. Back it up like an

package/skills/remembrancer/references/remembrance-setup.md

@@ -135,6 +135,51 @@ show the same review screen again; never use the automation-only trust bypass
 for normal installation. Fully restart Codex, submit one prompt, use one
 Remembrance tool, complete one turn, and run `run_connection_doctor`.
 
+### Optional unattended routine feedback in Codex
+
+After the user explicitly opts in, add only these two tool overrides to the
+user-level `~/.codex/config.toml`. This approval persists across future
+sessions on this installation until removed; installation alone does not grant
+it. Merge with existing tables rather than duplicating them:
+
+~~~toml
+[plugins."remembrance@remembrance".mcp_servers.remembrance.tools.submit_query_feedback]
+approval_mode = "approve"
+
+[plugins."remembrance@remembrance".mcp_servers.remembrance.tools.submit_feedback]
+approval_mode = "approve"
+~~~
+
+Use this opt-in for an organization-authenticated local plugin whose
+`submit_feedback` schema is categorical and rejects `lesson`. Query-fit
+ratings send Remembrance-issued query/result IDs, categorical verdicts, and
+required reasons; post-use ratings send the skill slug, those correlation IDs, usefulness/rating,
+and stable idempotency. Keep optional notes and evidence out of routine
+ratings: do not automatically attach internal receipt hashes, task prose,
+source content, raw logs, or private URLs. Public substantive reports retain
+their separate evidence requirements; reusable private lessons use
+`capture_learning` and its exact returned action.
+
+These are real writes, not read-only diagnostics. Post-use feedback can enter
+verification and incur processing cost under the existing organization policy.
+The two overrides do not approve private lesson/skill submission, publishing,
+deletion, reset, preference changes, or other tools. They do not widen the
+server's enabled tool set or override managed policy, guardian decisions,
+network restrictions, or organization processing grants. Do not set the whole
+server's approval default to `approve` for this purpose.
+
+Tool overrides persist when authentication or schemas change. Remove or
+re-review both approvals before switching to anonymous or hosted transport,
+enabling legacy broad writes, or changing the organization or destination.
+
+To revoke this opt-in, remove only these two tool-level approval entries;
+the inherited approval policy applies again. Reconnect the plugin or start a
+fresh Codex session if the current host does not reload config, then verify
+with a minimal eligible rating. A healthy connection doctor verifies the
+connection, not that host approval policy permits feedback. A denial means
+that rating was not submitted; acknowledge it locally and do not retry through
+another transport. See the [official installed-server policy guide](https://developers.openai.com/plugins/build/plugins#configure-installed-server-policy).
+
 OpenClaw:
 
 ~~~bash