@staix/agent-mem 0.12.0 → 0.14.0

package/src/commands-table.ts

@@ -24,8 +24,8 @@ const filters = { ...json, "--tier": { description: "Memory tier", value: ["shor
 export const GLOBAL_OPTIONS = { "--help": flag("Show help") };
 export const ROOT_OPTIONS = { "--version": flag("Show version"), ...json };
 export const COMMANDS: Record<string, CommandDefinition> = {
-  consolidate: { description: "Queue deterministic project-local consolidation candidates; curated notes change only after person review", mutates: true, options: { ...json, "--project": text("The current project's key; another project is refused (run from its directory)") } },
-  setup: { description: "Preview reversible MCP setup and supported capture hooks for native coding CLIs; apply and undo are person-only", options: { ...json, "--apply": flag("Apply after terminal confirmation"), "--undo": flag("Restore original configuration after confirmation") }, args: [{ name: "target", values: ["claude", "codex", "kimi", "pi", "qwen", "jcode", "agy", "all"] }] },
+  consolidate: { description: "Queue deterministic project-local consolidation candidates; curated notes change only after explicit acceptance", mutates: true, options: { ...json, "--project": text("The current project's key; another project is refused (run from its directory)") } },
+  setup: { description: "Preview reversible MCP setup and supported capture hooks for native coding CLIs; apply and undo use explicit flags", options: { ...json, "--apply": flag("Apply the previewed setup"), "--undo": flag("Restore the original configuration") }, args: [{ name: "target", values: ["claude", "codex", "kimi", "pi", "qwen", "jcode", "agy", "all"] }] },
   mcp: { description: "Run the project-bound MCP stdio server for this session" },
   hook: { description: "Run a fail-open, context-only Claude Code hook", args: [{ name: "event", values: [...HOOK_EVENTS] }] },
   ingest: { description: "Incrementally capture native session transcripts without a watcher", options: { ...json, "--since": text("ISO date or time") }, args: [{ name: "kind", values: ["codex", "kimi", "pi", "qwen"] }] },
@@ -64,7 +64,7 @@ export const COMMANDS: Record<string, CommandDefinition> = {
   } },
   demote: { description: "Demote a note", options: json, args: [{ name: "id" }], mutates: true },
   forget: { description: "Forget a note", options: json, args: [{ name: "id" }], mutates: true },
-  note: { description: "Write notes as the person (F6)", options: json, commands: {
+  note: { description: "Write curated notes through the configured policy (F6)", options: json, commands: {
     add: { description: "Add one curated note: text as arguments, `-` to type it on the terminal until end of input, or no text to open $EDITOR. A fail note takes --approach, --symptom, --cause, --evidence (repeatable) and --retry-when", mutates: true, options: {
       "--kind": { description: "Note kind (default finding)", value: KINDS }, "--tier": { description: "Memory tier (default long)", value: ["short", "long"] },
       "--scope": { description: "Scope (default project)", value: ["project", "shared"] }, "--title": text("One-line title"),
@@ -101,12 +101,13 @@ export const COMMANDS: Record<string, CommandDefinition> = {
     reject: { description: "Reject one candidate", args: [{ name: "full-candidate-id" }], mutates: true },
     walk: { description: "Walk the pending candidates one by one: accept, edit (as a new note), reject, skip or quit", mutates: true, options: { "--kind": { description: "Candidate kind", value: ["correction", "fail", "decay", "memory", "promotion", "consolidation", "model-answer"] } } },
   } },
-  decay: { description: "Preview old live long-term notes unprotected by open goals; apply only after person review", mutates: "apply", options: {
-    ...json, "--days": text("Age in whole days (default 90)"), "--apply": flag("Show the exact revision preview and ask before applying"), "--forget": flag("Explicitly forget instead of demoting; confirmation names this action") }, args: [{ name: "id", variadic: true }] },
-  migrate: { description: "Select a person-approved generation or deactivate it", mutates: true, options: {
-    ...json, "--dry-run": flag("Read-only migration receipt"), "--generation": text("Explicit 32-hex generation ID"),
+  decay: { description: "Preview old live long-term notes unprotected by open goals; apply only with --apply --confirm", mutates: "apply", options: {
+    ...json, "--days": text("Age in whole days (default 90)"), "--apply": flag("Preview exact revisions; combine with --confirm to apply"), "--confirm": flag("Apply the exact revision preview with --apply"), "--forget": flag("Explicitly forget instead of demoting; confirmation names this action") }, args: [{ name: "id", variadic: true }] },
+  migrate: { description: "Preview a generation migration; apply only with --apply, or deactivate it explicitly", mutates: "apply", options: {
+    ...json, "--apply": flag("Apply the previewed migration"), "--dry-run": flag("Read-only migration receipt (default; kept as an alias)"), "--generation": text("Explicit 32-hex generation ID"),
     "--resume": flag("Resume the recorded migration"), "--deactivate": flag("Select shared v1 without deleting a generation"),
     "--shards": flag("Migrate the curated home into project and user shards"),
+    "--public-prune-view": flag("Enable the forward-only v2 public prune view on an active split"),
   } },
   status: { description: "Report shard migration and pending old-layout appends", options: json },
   doctor: { description: "One read-only report (F15): duplicates and stale notes, pending candidates, capture freshness per CLI, the brief's token cost, index equals rebuild, reader leases, the policy in effect, ingest and sync cadence", options: json },
@@ -120,7 +121,7 @@ export const COMMANDS: Record<string, CommandDefinition> = {
       ...json, "--cap-mb": text("Capture cap in MB"), "--retention-days": text("Capture retention in days"), "--confirm": flag("Write after the preview"),
       "--split": flag("Write the per-shard split of the global budget to each shard's own config") } },
   } },
-  alias: { description: "Person-reviewed project key aliases (#15 D2)", options: json, defaultCommand: "list", commands: {
+  alias: { description: "Explicit project key aliases (#15 D2)", options: json, defaultCommand: "list", commands: {
     list: { description: "List alias ops" },
     add: { description: "Map one key onto its canonical key (append-only op)", args: [{ name: "from-key" }, { name: "to-key" }], mutates: true },
     remove: { description: "Remove an alias so the key resolves to itself again (append-only op, the latest wins)", args: [{ name: "alias-key" }], mutates: true },
@@ -197,5 +198,5 @@ export function commandHelp(): string {
   return ["usage: amem <command> [options]", "  [--help] [--version] [--json]", ...completionDefinitions().filter(row => row.path.length).map(row => {
     const names = [...row.path, ...row.args.map(arg => `<${arg.name}>`)].join(" ");
     return `  ${names}${Object.entries(row.options).map(([name, option]) => ` [${name}${option.value === undefined ? "" : ` <${Array.isArray(option.value) ? option.value.join("|") : option.value}>`}]`).join("")}`;
-  }), "--policy-free: accepted and ignored; the configured privacy policy (amem.config.json in the memory home, narrowed by .amem/config) always applies.", "Mutating commands require a terminal on stdin. Agents use the `amem mcp` server; the person reviews what agents propose with `amem review`."].join("\n");
+  }), "--policy-free: accepted and ignored; the configured privacy policy (amem.config.json in the memory home, narrowed by .amem/config) always applies.", "Agent-marked reads use the MCP privacy ceiling. Explicit apply/confirm flags do not require a terminal; review walk and the note editor remain interactive."].join("\n");
 }

package/src/index.ts

@@ -29,6 +29,7 @@ export * from "./memory/shard-migration.ts";
 export * from "./mcp.ts";
 export * from "./mcp-memory.ts";
 export * from "./memory/policy.ts";
+export { configuredPolicy } from "./memory/config.ts";
 export * from "./memory/work-lists.ts";
 export * from "./memory/vault.ts";
 

package/src/ingest.ts

@@ -20,7 +20,9 @@ export interface IngestOptions {
 }
 export interface IngestReceipt {
   files: number; read: number; imported: number; skipped: number; spooled: number; remaining: boolean; errors: number;
-  reason?: "source_bound" | "source_unavailable" | "schema_or_time" | "cursor_busy" | "scope_changed";
+  reason?: "source_bound" | "source_unavailable" | "schema_or_time" | "cursor_busy" | "scope_changed" | "unsupported_version";
+  /** With `unsupported_version` (#136): the first native writer version seen that this decoder does not support. A validated version token, never transcript text. */
+  version?: string;
 }
 
 type Scope = "own" | "foreign" | "unknown";
@@ -30,6 +32,10 @@ const MAX_BYTES = 16 * 1024 * 1024, DEFAULT_BYTES = 4 * 1024 * 1024, MAX_FILES =
 const MAX_CURSOR_BYTES = 128 * 1024;
 // Bump after extending the verified Qwen decoder: replay skipped versions with existing capture receipts deduplicating accepted rows.
 const QWEN_CONTRACT = "qwen-0.26.1-v1";
+/** A native writer version as reported in a receipt: a short token only, so no transcript content can pass through it (#136). */
+const VERSION_TOKEN = /^[0-9]{1,6}(\.[0-9]{1,6}){1,3}([-+][0-9A-Za-z.]{1,16})?$/;   // a dotted version shape: a bare dashed number (000-00-0000) never qualifies
+const versionToken = (value: unknown): string | undefined => typeof value === "string" && value.length <= 32 && VERSION_TOKEN.test(value) ? value : undefined;
+const KIMI_PROTOCOLS = ["1.0", "1.1", "1.2", "1.3", "1.4", "1.5"];
 const utf8 = new TextDecoder("utf-8", { fatal: true });
 const MAX_RECORD = 256 * 1024, MAX_RECORDS = 4096, MAX_DISCOVERY = 4096, MAX_DEPTH = 8, ANCHOR_BYTES = 1024;
 const hash = (value: string | Uint8Array) => createHash("sha256").update(value).digest("hex");
@@ -270,6 +276,12 @@ function extract(kind: IngestKind, raw: Record<string, any>, project: string): C
 export async function ingestTranscript(kind: IngestKind, options: IngestOptions): Promise<IngestReceipt> {
   const result: IngestReceipt = { files: 0, read: 0, imported: 0, skipped: 0, spooled: 0, remaining: false, errors: 0 };
   const fail = (reason: NonNullable<IngestReceipt["reason"]>, remaining = false) => { result.errors++; result.reason ??= reason; result.remaining ||= remaining; };
+  // An unsupported writer version explains its records better than the generic schema reason, so it replaces only that one; cursors and replay are untouched.
+  // The version is screened by the current policy every time it would be reported, including one restored from a cursor written under an older policy.
+  const unsupported = async (version: string, screen: (value: unknown) => Promise<boolean>) => {
+    if (!await screen({ version })) { fail("schema_or_time"); return; }
+    result.errors++; if (result.reason === undefined || result.reason === "schema_or_time") { result.reason = "unsupported_version"; result.version = version; }
+  };
   const bytes = options.maxBytes ?? DEFAULT_BYTES, count = options.maxFiles ?? DEFAULT_FILES;
   if (!["codex", "kimi", "pi", "qwen"].includes(kind) || !Number.isSafeInteger(bytes) || bytes < 1 || bytes > MAX_BYTES || !Number.isSafeInteger(count) || count < 1 || count > MAX_FILES
     || options.files !== undefined && (!Array.isArray(options.files) || options.files.length > MAX_FILES || options.files.some(file => typeof file !== "string" || !isAbsolute(file) || file.includes("\0")))
@@ -392,13 +404,18 @@ export async function ingestTranscript(kind: IngestKind, options: IngestOptions)
             else if (context !== undefined) position.scope = permitted && object(context) ? scopeOf(context.cwd) : "unknown";
             else if (raw.cwd !== undefined) position.scope = permitted ? scopeOf(raw.cwd) : "unknown";
             if (kind === "kimi" && raw.type === "metadata") {
-              position.protocol = typeof raw.protocol_version === "string" && ["1.0", "1.1", "1.2", "1.3", "1.4", "1.5"].includes(raw.protocol_version) ? raw.protocol_version : "unknown";
+              // A validated unsupported version is kept (not "unknown") so later records can name it; the gate below still refuses it.
+              // Supported literals carry no content and are kept as before; only an unsupported token is gated on the policy, so a declined record never lends it to the cursor or receipt.
+              position.protocol = typeof raw.protocol_version === "string" && KIMI_PROTOCOLS.includes(raw.protocol_version) ? raw.protocol_version
+                : permitted ? versionToken(raw.protocol_version) ?? "unknown" : "unknown";
             }
-            if (!known) fail("schema_or_time");
+            const qwenVersion = kind === "qwen" && !known && permitted ? versionToken(raw.version) : undefined;
+            if (!known) { if (qwenVersion !== undefined && qwenVersion !== "0.26.1") await unsupported(qwenVersion, value => policy.screen(value)); else fail("schema_or_time"); }
             const input = known ? extract(kind, raw, project) : undefined;
             if (input) {
               const at = timeOf(raw, kind);
-              if (!at || position.scope === "unknown" || kind === "kimi" && !/^1\.[0-5]$/.test(position.protocol)) { fail("schema_or_time"); result.skipped++; }
+              if (kind === "kimi" && permitted && at && position.scope !== "unknown" && position.protocol !== "unknown" && versionToken(position.protocol) !== undefined && !KIMI_PROTOCOLS.includes(position.protocol)) { await unsupported(position.protocol, value => policy.screen(value)); result.skipped++; }
+              else if (!at || position.scope === "unknown" || kind === "kimi" && !KIMI_PROTOCOLS.includes(position.protocol)) { fail("schema_or_time"); result.skipped++; }
               else if (!permitted || position.scope !== "own" || since !== undefined && at < since) result.skipped++;
               else {
                 input.at = at;

package/src/mcp.ts

@@ -7,7 +7,7 @@ const object = (properties: Record<string, unknown>, required: string[] = []) =>
 const tool = <Name extends string>(name: Name, description: string, inputSchema: ReturnType<typeof object>, readOnlyHint = true) => ({ name, description, inputSchema,
   annotations: { readOnlyHint, destructiveHint: false, openWorldHint: false } });
 
-/** Storage scope comes from startup, never tool arguments; candidate proposals remain person-reviewed. */
+/** Storage scope comes from startup, never tool arguments. MCP proposes candidates only; the CLI accepts or rejects them under the current policy and records actor/peer. */
 export const MCP_TOOLS = [
   tool("amem_search", "Search screened memory in this project. Capture results are recall, not curated evidence.", object({ query: string(1000), limit, since: string(40), includeCapture: { type: "boolean" }, explain: { type: "boolean" } }, ["query"])),
   tool("amem_evidence", "Return a bounded bundle of cited, live curated entries for a question. Untrusted memory data only: no answer or model call. Capture, repo-only notes, pending candidates and model answers are not evidence.", object({ question: string(1000), limit: { type: "integer", minimum: 1, maximum: 20 }, maxBytes: { type: "integer", minimum: 256, maximum: 8192 } }, ["question"])),
@@ -18,11 +18,11 @@ export const MCP_TOOLS = [
   tool("amem_work_state_read", "Read project work lists; closed lists/items can be included explicitly.", object({ list: string(200), includeClosed: { type: "boolean" } })),
   tool("amem_work_state_write", "Append scalar project work-list fields; null clears, task selects an item, list status done closes.", object({ list: string(200), fields: { type: "object", minProperties: 1, maxProperties: 64,
     additionalProperties: { type: ["string", "number", "boolean", "null"], maxLength: 4000 } } }, ["list", "fields"]), false),
-  tool("amem_remember", "Propose a memory candidate (text, optional kind/title), or kind=fail with approach, symptom, cause, evidenceRefs and retryWhen. Person acceptance only; never writes curated notes.", object({ text: string(3000), title: string(200), kind: { type: "string", enum: ["decision", "finding", "contract", "fail"] },
+  tool("amem_remember", "Propose a memory candidate (text, optional kind/title), or kind=fail with approach, symptom, cause, evidenceRefs and retryWhen. Review and accept or reject through the CLI under current policy; this tool never writes curated notes.", object({ text: string(3000), title: string(200), kind: { type: "string", enum: ["decision", "finding", "contract", "fail"] },
     approach: string(4000), symptom: string(4000), cause: string(4000), evidenceRefs: { type: "array", minItems: 1, maxItems: 16, items: string(400) }, retryWhen: string(4000) }), false),
-  tool("amem_correct", "Propose a correction to an exact curated entry id visible in this project. The host binds its current revision; the full accepted body including reason and provenance headers must fit 4000 characters. A person must accept before any note or supersession is written.", object({ id: string(80), proposedText: string(4000), reason: string(4000), kind: { type: "string", enum: ["decision", "contract", "fail"] } }, ["id", "proposedText", "reason"]), false),
-  tool("amem_vault_candidates", "List screened durable curated notes eligible for a person to move to the vault. Read only.", object({ limit })),
-  tool("amem_capacity", "Read this machine's bounded capture capacity proposal; applying it is person-only.", object({})),
+  tool("amem_correct", "Propose a correction to an exact curated entry id visible in this project. The host binds its current revision; the full accepted body including reason and provenance headers must fit 4000 characters. Review and accept or reject through the CLI under current policy before any note or supersession is written.", object({ id: string(80), proposedText: string(4000), reason: string(4000), kind: { type: "string", enum: ["decision", "contract", "fail"] } }, ["id", "proposedText", "reason"]), false),
+  tool("amem_vault_candidates", "List screened durable curated notes for review before moving them to a vault. Read only.", object({ limit })),
+  tool("amem_capacity", "Read this machine's bounded capture capacity proposal; applying it requires the matching CLI preview and `--confirm`. This tool has no apply operation.", object({})),
 ] as const;
 export type McpToolName = typeof MCP_TOOLS[number]["name"];
 export type McpHandlers = Record<McpToolName, (args: Record<string, unknown>) => unknown | Promise<unknown>>;
@@ -123,10 +123,10 @@ export async function serveMcp(options: McpOptions): Promise<void> {
       if (text === undefined || Buffer.byteLength(text) > RESULT_BYTES) throw new Error("result unavailable");
       result = { content: [{ type: "text", text }] }; observedValue = value; succeeded = true;
     } catch (failure) {
-      // Every failure is opaque to the model except one named, fixed, text-free condition: the person's review queue is full. It carries no stored content, so it is safe to say, and it
-      // tells the agent what to do (stop proposing, ask the person) instead of leaving it to retry blindly.
+      // Every failure is opaque to the model except one named, fixed, text-free condition: the candidate queue is full. It carries no stored content, so it is safe to say, and it
+      // tells the caller to stop proposing and use `amem review` instead of retrying blindly.
       const full = typeof failure === "object" && failure !== null && (failure as { code?: unknown }).code === "candidate_queue_full";
-      result = { isError: true, content: [{ type: "text", text: full ? "The person's review queue is full: no more candidates are accepted until the person runs `amem review`. Do not retry; ask the person to review the pending candidates." : "Memory operation unavailable or refused; no partial result is shown." }] };
+      result = { isError: true, content: [{ type: "text", text: full ? "The review queue is full: no more candidates are accepted. Do not retry; review pending candidates through the screened CLI." : "Memory operation unavailable or refused; no partial result is shown." }] };
     }
     if (succeeded && options.onEmitted) {
       await writeConfirmed(output, JSON.stringify({ jsonrpc: "2.0", id, result }) + "\n");

package/src/memory/candidates.ts

@@ -4,6 +4,7 @@ import { chmodSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { CANDIDATE_SHOWN_GRACE_MS, hasShownColumn } from "./candidate-pending.ts";
 import { oneLine } from "./note-add.ts";
+import { cliAttribution } from "./cli-attribution.ts";
 import { memoryHome } from "./home.ts";
 import { realPath } from "./platform.ts";
 import { stripPrivateDeep } from "./private-spans.ts";
@@ -43,7 +44,7 @@ export interface CounterValues { rendered?: number | null; delivered?: number |
 export interface Counter extends CounterValues { id: string; key: CounterKey; createdAt: string; rendered: number | null; delivered: number | null; cited: number | null }
 export interface CandidateAcceptance {
   project: string;
-  /** The host binds this to authenticated person intent; it is not an authentication token. */
+  /** The host binds this to CLI attribution; it is not an authentication token. */
   actor: "person" | "agent";
   verdict: CandidateVerdict;
   store: MemoryStore;
@@ -63,7 +64,8 @@ const text = (value: unknown, max = 4000): value is string => typeof value === "
 const entryId = (value: unknown): value is string => typeof value === "string" && /^[a-f0-9]{32}$/.test(value);
 const candidateId = (value: unknown): value is string => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
 const publicOnly = (verdict: CandidateVerdict) => { if (verdict !== "public") throw new Error("candidate data refused by host privacy verdict"); };
-const personOnly = (actor: string) => { if (actor !== "person") throw new Error("candidate acceptance and rejection require a person"); };
+const validActor = (actor: string) => { if (actor !== "person" && actor !== "agent") throw new Error("candidate actor must be person or agent"); };
+const attributionPeer = (actor: "person" | "agent") => cliAttribution()?.peer ?? actor;
 const validTarget = (value: CandidateTarget | undefined) => value !== undefined && entryId(value.id) && candidateId(value.revision);
 function validate(input: CandidateInput): void {
   if (!input || !text(input.project, 400)) throw new Error("invalid candidate project");
@@ -126,10 +128,10 @@ function retryLocked(work: () => void): void {
   }
 }
 
-/** The queue holds the cap's worth of candidates nobody has seen. Named so a caller (the MCP tool) can map it; the message is worded for an agent, which cannot run the person-only commands itself. */
+/** The queue holds the cap's worth of candidates nobody has seen. Named so a caller (the MCP tool) can map it. */
 export class CandidateQueueFull extends Error {
   readonly code = "candidate_queue_full";
-  constructor(readonly waiting: number) { super(`${waiting} unshown candidates await the person's review; no more are accepted until they have run \`amem review\`. Ask the person to review them`); this.name = "CandidateQueueFull"; }
+  constructor(readonly waiting: number) { super(`${waiting} unshown candidates await review; no more are accepted until the queue is reviewed. Run \`amem review\``); this.name = "CandidateQueueFull"; }
 }
 export class CandidateStore {
   readonly dir: string;
@@ -253,7 +255,7 @@ export class CandidateStore {
     return rows.map(row => ({ id: row.id, key: JSON.parse(row.payload) as CounterKey, createdAt: new Date(row.at).toISOString(), rendered: row.rendered, delivered: row.delivered, cited: row.cited })).filter(row => !entry || row.key.entryId === entry);
   }
   reject(id: string, context: { project: string; actor: "person" | "agent"; verdict: CandidateVerdict }): void {
-    personOnly(context.actor); publicOnly(context.verdict);
+    validActor(context.actor); publicOnly(context.verdict);
     this.db.transaction(() => {
       const candidate = this.get(id, context.project);
       if (!candidate) throw new Error("candidate unavailable");
@@ -263,7 +265,7 @@ export class CandidateStore {
     }).immediate();
   }
   accept(id: string, context: CandidateAcceptance): CandidateAcceptanceResult {
-    personOnly(context.actor); publicOnly(context.verdict);
+    validActor(context.actor); publicOnly(context.verdict);
     if (realPath(context.store.profile.home) !== realPath(this.dir) || typeof context.policy !== "function") throw new Error("candidate acceptance requires its memory store and a current host policy");
     return context.store.withDeferredPromotions(() => this.acceptDeferred(id, context));
   }
@@ -292,7 +294,7 @@ export class CandidateStore {
         scope: data.kind === "correction" ? target!.scope : "project",
         // A demoted synced target is logically short, but replacing it locally would narrow its reach (X04).
         tier: data.kind === "correction" && target!.local ? "short" : "long",
-        kind: data.kind === "fail" ? "fail" : data.noteKind ?? (target?.kind === "contract" || target?.kind === "fail" ? target.kind : "decision"), peer: "person", source: "person", about: [...target?.about ?? []],
+        kind: data.kind === "fail" ? "fail" : data.noteKind ?? (target?.kind === "contract" || target?.kind === "fail" ? target.kind : "decision"), peer: attributionPeer(context.actor), source: "person", about: [...target?.about ?? []],
         text: data.kind === "correction" ? acceptedCorrectionText(data, id) : `Accepted candidate: ${id}\nTarget revision: ${(data.kind === "memory" ? undefined : data.target)?.revision ?? "none"}\nTarget entry: ${(data.kind === "memory" ? undefined : data.target)?.id ?? "none"}\n\n${body}` };
       if (note.text.length > 4000) throw new Error("accepted candidate text exceeds the v1 note limit");
       if (context.policy(structuredClone(candidate), target && structuredClone(target), structuredClone(note)) !== true) throw new Error("candidate refused by current host policy");
@@ -303,7 +305,7 @@ export class CandidateStore {
         // ponytail: the sidecar receipt and v1 append are not one transaction. An interrupted 'accepting' row refuses
         // automatic replay; add explicit person-audited recovery before offering background acceptance retries.
         const noteId = append();
-        if (data.kind === "correction" && !context.store.supersede(target!.id, noteId, "person", context.project)) throw new Error("candidate replacement refused; inspect the accepted note before recovery");
+        if (data.kind === "correction" && !context.store.supersede(target!.id, noteId, context.actor, context.project)) throw new Error("candidate replacement refused; inspect the accepted note before recovery");
         this.db.query("UPDATE candidates SET status = 'accepted', note_id = ? WHERE id = ? AND project IN (SELECT value FROM json_each(?))").run(noteId, id, this.scope(context.project));
         return { candidateId: id, noteId, alreadyAccepted: false };
       });
@@ -316,13 +318,13 @@ export class CandidateStore {
   }
   private acceptConsolidation(candidate: Candidate, data: Extract<CandidateInput, { kind: "consolidation" }>, context: CandidateAcceptance): CandidateAcceptanceResult {
     if (typeof context.policyVersion !== "function") throw Error("consolidation requires a policy revision guard");
-    const boundStore = context.store, boundProject = context.project, boundPolicy = context.policy;
+    const boundStore = context.store, boundProject = context.project, boundActor = context.actor, boundPolicy = context.policy;
     const policyVersion = context.policyVersion(); if (typeof policyVersion !== "string") throw Error("consolidation policy revision unavailable");
     return context.store.withCurrentEntries(data.targets.map(target => target.id), context.project, () => {
       const sourcePlacements = context.store.entryPlacements(data.targets.map(target => target.id), context.project);
       if (data.targets.some(target => sourcePlacements.get(target.id) !== "synced")) throw Error("consolidation requires verified synced source placement");
       const policyCurrent = () => {
-        if (context.actor !== "person" || context.store !== boundStore || context.project !== boundProject || context.policy !== boundPolicy) throw Error("consolidation acceptance context changed");
+        if (context.actor !== boundActor || context.store !== boundStore || context.project !== boundProject || context.policy !== boundPolicy) throw Error("consolidation acceptance context changed");
         if (context.policyVersion!() !== policyVersion) throw Error("consolidation policy changed");
       };
       // One placement proof per locked section: `sourcePlacements` (read once inside withCurrentEntries, whose fences stay held) serves every check before the append section;
@@ -341,7 +343,7 @@ export class CandidateStore {
         return current;
       };
       const sources = check(), first = sources[0]!;
-      const note: NoteInput = { op: "note", project: context.project, scope: first.scope, tier: "long", kind: data.noteKind, peer: "person", source: "person", about: [...data.about],
+      const note: NoteInput = { op: "note", project: context.project, scope: first.scope, tier: "long", kind: data.noteKind, peer: attributionPeer(context.actor), source: "person", about: [...data.about],
         text: `${ACCEPTED_CONSOLIDATION_PREFIX}${candidate.id}\nAction: ${data.action}\nSources: ${data.targets.map(target => `mem:${target.id}`).join(", ")}\n\n${data.text}` };
       if (note.text.length > 4000) throw Error("accepted consolidation exceeds the v1 note limit");
       for (const source of sources) if (context.policy(structuredClone(candidate), structuredClone(source), structuredClone(note)) !== true) throw Error("consolidation refused by current host policy");
@@ -352,7 +354,7 @@ export class CandidateStore {
         const noteId = append(), applied: string[] = [];
         try {
           if (data.action !== "recurring-fix") for (const target of data.targets) {
-            if (!context.store.supersede(target.id, noteId, "person", context.project)) throw Error("supersession refused");
+            if (!context.store.supersede(target.id, noteId, context.actor, context.project)) throw Error("supersession refused");
             applied.push(target.id);
           }
         } catch {
@@ -385,7 +387,7 @@ export class CandidateStore {
       resolve();
       const replay = this.beginAcceptance(candidate.id, context.project); if (replay) return { candidateId: candidate.id, noteId: replay, alreadyAccepted: true };
       // A thrown append remains accepting: its authored-row outcome needs person-audited recovery.
-      const noteId = context.store.promote(target.id, "person", context.project);
+      const noteId = context.store.promote(target.id, context.actor, context.project);
       if (noteId === undefined) {
         this.db.query("UPDATE candidates SET status = 'pending' WHERE id = ? AND project IN (SELECT value FROM json_each(?)) AND status = 'accepting'").run(candidate.id, this.scope(context.project));
         throw Error("promotion unavailable or declined; candidate remains pending");

package/src/memory/capacity-split.ts

@@ -1,3 +1,4 @@
+import { assertCliPolicy } from "./cli-attribution.ts";
 import { lstatSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { basename, join } from "node:path";
 import { capacityReport, type ShardSplit } from "./capacity.ts";
@@ -8,7 +9,7 @@ import { machineId } from "./store.ts";
 
 /**
  * #15 T5 / D7: `amem capacity apply --split`. Writes each shard's own capture config (`machine/<id>/config.json`, which overrides the home default) with its
- * share of the global budget. Person-only like the other apply (the CLI refuses an agent marker and a missing terminal before this runs), and in two steps:
+ * share of the global budget. Like the other apply, it uses two steps:
  * a preview that records which shards, which current configs and which target values the person is shown, and a `--confirm` that writes exactly those
  * target values and nothing recomputed. It refuses unless the set of shards and every shard's current config are unchanged, and unless the preview is younger
  * than `PREVIEW_MAX_AGE_MS`: a week-old preview cannot write a cap the person never saw, and free disk drifting a little between the two steps changes nothing
@@ -46,6 +47,7 @@ export function previewSplit(base: string, opts: { diskShare?: number; now?: ()
   if (report.splitRefused) throw new Error(`capacity apply --split: ${report.splitRefused}`);
   const found = targets(base, report.split);
   const preview: SplitPreview = { at: (opts.now ?? Date.now)(), split: found.targets, skipped: found.skipped };
+  assertCliPolicy(preview);
   writeFileSync(previewPath(base), JSON.stringify(preview) + "\n", { mode: 0o600 });
   return { ...preview, confirm: "re-run with --confirm to write each shard's share" };
 }
@@ -66,6 +68,7 @@ export function applySplit(base: string, opts: { diskShare?: number; now?: () =>
   // What was previewed is what is written: the same shards, each with the config the person saw replaced by the target the person saw.
   const identity = (rows: SplitTarget[]) => JSON.stringify(rows.map(({ key, dir, current }) => ({ key, dir, current })));
   if (!Array.isArray(approved.split) || identity(approved.split) !== identity(live)) throw new Error("capacity preview changed (a shard appeared or went, or a shard's config moved); re-run without --confirm");
+  assertCliPolicy({ approved, live });
   const written = approved.split.map(row => {
     const next = writeCaptureConfigFile(join(row.dir, "config.json"), row.target);
     return { key: row.key, cap_mb: next.capMb ?? row.target.capMb, retention_days: next.retentionDays ?? row.target.retentionDays };

package/src/memory/capacity.ts

@@ -8,17 +8,18 @@ export { appendMetrics, readMetrics, metricsPath, type MetricSample } from "./me
 import { walkShards } from "./catalog.ts";
 import { lifecycleResolver } from "./lifecycle.ts";
 import { captureShardGrowth, captureShardStats, readCaptureConfigFile, CAPTURE_DEFAULT_CAP_MB, CAPTURE_DEFAULT_RETENTION_DAYS, type CaptureConfig } from "./capture.ts";
+import { facts, label, PLAIN, singleLine, type Style } from "./style.ts";
 
 /**
  * #13 R7: the capacity advisor. `capacityReport()` reads this machine's load and proposes capture bounds; the
  * `amem capacity` CLI renders it and `amem capacity apply` writes the home default config after a preview. An
- * agent may read the proposal through this library function; applying stays person-only at the CLI.
+ * marked CLI calls may read the proposal; the CLI applies only after a matching preview and `--confirm`.
  *
  * Proposal rule (owner decision, 2026-10-17, item 2): the proposed cap and retention are the largest values whose projection stays within the
  * disk-share bound (default 2% of free space, configurable) and whose measured search and hook readings stay within R2/R3, and they may be above
  * the current ones. The cap is the disk-share bound itself; retention is the share over the daily growth, up to a 365-day ceiling. R2 halves the cap
  * and R3 halves the retention. The reason names every binding constraint: `disk-share retention` or `retention ceiling`, `disk-share cap`,
- * `R3 search RSS`, `R2 hook cost`. The advisor never writes: applying stays person-only, preview first.
+ * `R3 search RSS`, `R2 hook cost`. The advisor never writes: the CLI applies only after a preview and matching `--confirm`.
  *
  * Metrics: a small rolling `metrics.jsonl` in the memory home (not a memory log: it is trimmed, never synced).
  * `scripts/measure-budget.ts` writes only to its synthetic home; the P3 hooks will append real samples per invocation.
@@ -60,7 +61,7 @@ export interface CapacityReport {
   current: CaptureConfig;
   diskShare: number;
   proposal: { capMb: number; retentionDays: number; reason: string };
-  /** #15 D7: the per-shard split of the global capture budget (the disk share, less what forgotten shards still hold), one row per non-forgotten shard. A proposal: applying it is person-only. */
+  /** #15 D7: the per-shard split of the global capture budget (the disk share, less what forgotten shards still hold), one row per non-forgotten shard. A proposal; applying it requires a matching preview and `--confirm`. */
   split: ShardSplit[];
   /** Why `split` is empty although shards exist: the budget cannot give each shard its 1 MB minimum. Absent when the split was made. */
   splitRefused?: string;
@@ -222,7 +223,7 @@ export function capacityReport(opts: {
   };
   const diskShare = opts.diskShare ?? 0.02;
   // The single proposal below is one shard's bounds (the home default). #15 T5 (D7): `split` shares the machine-wide budget across the shards, so a
-  // home with N shards no longer holds N x cap once the person applies it (`amem capacity apply --split`).
+  // home with N shards no longer holds N x cap once `amem capacity apply --split --confirm` writes it.
   const budgetBytes = diskShare * disk.freeBytes;
   // Growth (owner decision 2026-10-17, item 2): propose the largest cap and retention that fit the disk share, above the current values when there is room.
   // The cap's ceiling is the disk-share bound itself. A person's own setting above the retention ceiling is never proposed down for the ceiling alone.
@@ -280,3 +281,46 @@ export function capacityText(report: CapacityReport): string {
     ...(report.split.length ? ["split of the global budget per shard (a proposal: amem capacity apply --split):", ...report.split.map(row => `  ${row.key}: cap ${row.capMb} MB, retention ${row.retentionDays} days (${row.reason})`)] : []),
   ].join("\n");
 }
+
+/** Human-readable `capacity apply` result. JSON output remains the caller's responsibility. */
+export function capacityApplyText(result: {
+  preview: { file: string; current: Partial<CaptureConfig>; target: CaptureConfig; reason: string };
+  confirm?: string;
+  written?: { cap_mb?: number; retention_days?: number };
+}, s: Style = PLAIN): string {
+  const applied = result.written !== undefined;
+  return [
+    `amem capacity apply: ${applied ? s.ok("complete") : s.attention("preview")}`,
+    `${label(s, applied ? "ok" : "attention")} target: ${singleLine(result.preview.file)}`,
+    `${label(s, "ok")} current: ${facts({ cap_mb: result.preview.current.capMb, retention_days: result.preview.current.retentionDays }) || "defaults"}`,
+    `${label(s, "attention")} proposed: ${facts({ cap_mb: result.preview.target.capMb, retention_days: result.preview.target.retentionDays })}`,
+    `${label(s, "ok")} reason: ${singleLine(result.preview.reason)}`,
+    ...(applied ? [`${label(s, "ok")} written: ${facts(result.written!) || "no settings reported"}`] : []),
+    `Next action: ${applied ? "none" : "re-run the same capacity apply command with --confirm, keeping all other arguments"}`,
+  ].join("\n");
+}
+
+/** Human-readable `capacity apply --split` result, retaining skipped shard identities. */
+export function capacitySplitText(result:
+  | { at: number; split: { key: string; dir: string; current: Partial<CaptureConfig>; target: CaptureConfig; reason: string }[]; skipped: string[]; confirm: string }
+  | { split: { key: string; dir: string; current: Partial<CaptureConfig>; target: CaptureConfig; reason: string }[]; written: { key: string; cap_mb: number; retention_days: number }[] },
+  s: Style = PLAIN,
+): string {
+  const applied = "written" in result;
+  const rows = result.split.map(row => [
+    `${label(s, applied ? "ok" : "attention")} shard: ${singleLine(row.key)}`,
+    `${label(s, applied ? "ok" : "attention")} target: ${singleLine(row.dir)}`,
+    `${label(s, "ok")} current: ${facts({ cap_mb: row.current.capMb, retention_days: row.current.retentionDays }) || "defaults"}`,
+    `${label(s, applied ? "ok" : "attention")} proposed: ${facts({ cap_mb: row.target.capMb, retention_days: row.target.retentionDays })}`,
+    `${label(s, "ok")} reason: ${singleLine(row.reason)}`,
+  ].join("\n"));
+  const skipped = "skipped" in result ? result.skipped : [];
+  return [
+    `amem capacity apply --split: ${applied ? s.ok("complete") : s.attention("preview")}`,
+    ...(result.split.length ? [] : [`${label(s, "skipped")} targets: none`]),
+    ...rows,
+    ...skipped.map(key => `${label(s, "skipped")} skipped shard: ${singleLine(key)} (no local shard config to write)`),
+    ...(applied ? result.written.map(row => `${label(s, "ok")} written ${singleLine(row.key)}: ${facts({ cap_mb: row.cap_mb, retention_days: row.retention_days })}`) : []),
+    `Next action: ${applied || !result.split.length ? "none" : "re-run the same capacity apply --split command with --confirm, keeping all other arguments"}`,
+  ].join("\n");
+}

package/src/memory/catalog.ts

@@ -2,7 +2,7 @@ import { Database } from "bun:sqlite";
 import { chmodSync, existsSync, lstatSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { memoryBase } from "./home.ts";
-import { effectiveAliases, readShardDescriptor, SHARDED_SCHEMA } from "./shard.ts";
+import { effectiveAliases, readShardDescriptor, SHARDED_SCHEMA, SHARDED_V2_SCHEMA } from "./shard.ts";
 import { readProfileJSON, validGeneration } from "./generation.ts";
 import { captureShardStats, readCaptureConfig } from "./capture.ts";
 import { openShardStore } from "./store.ts";
@@ -36,7 +36,7 @@ const fromRow = (r: CatalogRow): CatalogProject => ({ hash: r.hash, key: r.key,
 function capturedSelection(base: string): boolean {
   const value = readProfileJSON(join(base, "shards.json")) as { schema?: unknown; generation?: unknown; phase?: unknown; selectorRevision?: unknown } | undefined;
   if (value === undefined) return false;
-  if (!value || value.schema !== SHARDED_SCHEMA || !validGeneration(value.generation) || (value.phase !== "captured" && value.phase !== "active") || typeof value.selectorRevision !== "string") throw new Error("curated shard selection is unavailable or invalid");
+  if (!value || (value.schema !== SHARDED_SCHEMA && value.schema !== SHARDED_V2_SCHEMA) || !validGeneration(value.generation) || (value.phase !== "captured" && value.phase !== "active") || typeof value.selectorRevision !== "string") throw new Error("curated shard selection is unavailable or invalid");
   return value.phase === "captured";
 }
 
@@ -48,10 +48,10 @@ function curatedStats(base: string, hash: string, key: string, captured: boolean
   if (!existsSync(join(dir, "generation.json")) && !existsSync(join(dir, "generation-seal.json"))) return { entries: 0, lastAt: null };
   const store = openShardStore({ memoryDir: base, project: key, deferPromotions: true, lifecycle: "ignore" });
   try {
-    const db = new Database(join(dir, "index.db"), { readonly: true });
+    const db = new Database(join(dir, store.profile.foreignPruneFormat ? "index-v2.db" : "index.db"), { readonly: true });
     try {
       db.run("PRAGMA busy_timeout = 0");
-      const row = db.query("SELECT COUNT(*) AS n, MAX(at) AS last FROM entries WHERE scope = 'project' AND project = ?").get(key) as { n: number; last: string | null };
+      const row = db.query("SELECT COUNT(*) AS n, MAX(at) AS last FROM entries WHERE scope = 'project' AND project = ?" + (store.profile.foreignPruneFormat ? " AND id NOT IN (SELECT id FROM generation_targets)" : "")).get(key) as { n: number; last: string | null };
       return { entries: row.n, lastAt: row.last };
     } finally { db.close(); }
   } finally { store.close(); }

package/src/memory/cli-attribution.ts

@@ -0,0 +1,23 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+/** CLI labels are attribution, never authentication or permission to bypass policy. */
+export interface CliAttribution { actor: "person" | "agent"; peer: string; policy?: () => { screenStandalone(value: unknown): boolean } }
+const scope = new AsyncLocalStorage<Readonly<CliAttribution>>();
+
+/** Preserve library defaults outside an ordinary CLI invocation, including concurrent calls. */
+export function cliAttribution(): Readonly<CliAttribution> | undefined { return scope.getStore(); }
+export function withCliAttribution<T>(identity: CliAttribution, work: () => T): T { return scope.run(Object.freeze({ ...identity, peer: identity.actor === "agent" && identity.peer === "person" ? "agent" : identity.peer }), work); }
+
+/** Display metadata derived from the existing peer field; never a claim of authentication. */
+export const noteDisplayActor = (peer: string): "person" | "agent" => peer === "person" ? "person" : "agent";
+
+/** Internal CLI-only guard: library callers outside a CLI scope retain their existing contract. */
+export function assertCliPolicy(value: unknown): void {
+  const identity = scope.getStore();
+  if (identity?.actor !== "agent") return;
+  try {
+    const plain: unknown = JSON.parse(JSON.stringify(value));
+    if (identity.policy?.().screenStandalone(plain) === true) return;
+  } catch { /* Withhold the complete value, including configuration errors. */ }
+  throw Error("Memory operation unavailable or refused; no partial result is shown.");
+}