@wipcomputer/wip-ldm-os 0.4.39 → 0.4.41

package/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 interface: [cli, skill]
 metadata:
   display-name: "LDM OS"
-  version: "0.4.39"
+  version: "0.4.41"
   homepage: "https://github.com/wipcomputer/wip-ldm-os"
   author: "Parker Todd Brooks"
   category: infrastructure

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ldm-os",
-  "version": "0.4.39",
+  "version": "0.4.41",
   "type": "module",
   "description": "LDM OS: identity, memory, and sovereignty infrastructure for AI agents",
   "engines": {
@@ -37,6 +37,8 @@
     "dist/bridge/",
     "templates/",
     "docs/",
+    "shared/",
+    "scripts/",
     "catalog.json",
     "SKILL.md"
   ],

package/scripts/backfill-summaries.sh

@@ -0,0 +1,112 @@
+#!/bin/bash
+# backfill-summaries.sh — Generate all historical summaries from day 1.
+# Part of Total Recall. Uses ldm-summary.sh with --force --date.
+#
+# Usage:
+#   backfill-summaries.sh              # full backfill (Feb 5 to yesterday)
+#   backfill-summaries.sh --dry-run    # preview
+#   backfill-summaries.sh --from 2026-03-01  # partial backfill
+#
+# Order: dailies first, then weeklies, monthlies, quarterly.
+# Each level reads the level below. Must complete in order.
+
+set -euo pipefail
+export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"
+
+SUMMARY_SCRIPT="$HOME/.ldm/bin/ldm-summary.sh"
+DRY_RUN=false
+FROM_DATE="2026-02-05"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run) DRY_RUN=true; shift ;;
+    --from) FROM_DATE="$2"; shift 2 ;;
+    *) echo "Unknown: $1" >&2; exit 1 ;;
+  esac
+done
+
+if [ ! -f "$SUMMARY_SCRIPT" ]; then
+  echo "ERROR: ldm-summary.sh not found. Run ldm install first." >&2
+  exit 1
+fi
+
+YESTERDAY=$(python3 -c "from datetime import datetime, timedelta; print((datetime.now()-timedelta(days=1)).strftime('%Y-%m-%d'))")
+FLAGS="--force"
+[ "$DRY_RUN" = true ] && FLAGS="$FLAGS --dry-run"
+
+echo "=== Total Recall: Backfill Summaries ==="
+echo "  From: $FROM_DATE"
+echo "  To:   $YESTERDAY"
+echo "  Mode: $([ "$DRY_RUN" = true ] && echo 'DRY RUN' || echo 'LIVE')"
+echo ""
+
+# ── Step 1: Dailies ──
+
+echo "=== STEP 1: Daily summaries ==="
+DAILY_COUNT=0
+for date in $(python3 -c "
+from datetime import datetime, timedelta
+d = datetime.strptime('$FROM_DATE', '%Y-%m-%d')
+end = datetime.strptime('$YESTERDAY', '%Y-%m-%d')
+while d <= end:
+  print(d.strftime('%Y-%m-%d'))
+  d += timedelta(days=1)
+"); do
+  echo "--- $date ---"
+  bash "$SUMMARY_SCRIPT" daily --date "$date" $FLAGS 2>&1 | grep -E "->|DRY RUN|No data|No git"
+  DAILY_COUNT=$((DAILY_COUNT + 1))
+done
+echo "  Dailies: $DAILY_COUNT days"
+echo ""
+
+# ── Step 2: Weeklies (Sunday to Saturday) ──
+
+echo "=== STEP 2: Weekly summaries ==="
+WEEKLY_COUNT=0
+for date in $(python3 -c "
+from datetime import datetime, timedelta
+# Start from first Sunday >= FROM_DATE
+d = datetime.strptime('$FROM_DATE', '%Y-%m-%d')
+while d.weekday() != 6: d += timedelta(days=1)  # find Sunday
+end = datetime.now()
+while d <= end:
+  # Use the Saturday (end of week) as the date
+  sat = d + timedelta(days=6)
+  print(sat.strftime('%Y-%m-%d'))
+  d += timedelta(days=7)
+"); do
+  echo "--- Week ending $date ---"
+  bash "$SUMMARY_SCRIPT" weekly --date "$date" $FLAGS 2>&1 | grep -E "->|DRY RUN|No "
+  WEEKLY_COUNT=$((WEEKLY_COUNT + 1))
+done
+echo "  Weeklies: $WEEKLY_COUNT weeks"
+echo ""
+
+# ── Step 3: Monthlies ──
+
+echo "=== STEP 3: Monthly summaries ==="
+for date in $(python3 -c "
+from datetime import datetime
+import calendar
+d = datetime.strptime('$FROM_DATE', '%Y-%m-%d')
+now = datetime.now()
+while d <= now:
+  last_day = calendar.monthrange(d.year, d.month)[1]
+  print(f'{d.year}-{d.month:02d}-{last_day:02d}')
+  if d.month == 12: d = d.replace(year=d.year+1, month=1, day=1)
+  else: d = d.replace(month=d.month+1, day=1)
+"); do
+  echo "--- Month ending $date ---"
+  bash "$SUMMARY_SCRIPT" monthly --date "$date" $FLAGS 2>&1 | grep -E "->|DRY RUN|No "
+done
+echo ""
+
+# ── Step 4: Quarterly ──
+
+echo "=== STEP 4: Quarterly summary ==="
+bash "$SUMMARY_SCRIPT" quarterly --date "$(date +%Y-%m-%d)" $FLAGS 2>&1 | grep -E "->|DRY RUN|No "
+
+echo ""
+echo "=== Backfill complete ==="
+echo "  $DAILY_COUNT dailies processed"
+echo "  $WEEKLY_COUNT weeklies processed"

package/scripts/ldm-backup.sh

@@ -0,0 +1,251 @@
+#!/bin/bash
+# ldm-backup.sh — Unified backup for LDM OS
+# Backs up: ~/.ldm/, ~/.openclaw/, ~/.claude/, ~/wipcomputerinc/
+# Handles SQLite safely (sqlite3 .backup). Tars to iCloud for offsite.
+#
+# Source of truth: wip-ldm-os-private/scripts/ldm-backup.sh
+# Deployed to: ~/.ldm/bin/ldm-backup.sh (via ldm install)
+#
+# Usage:
+#   ldm-backup.sh                     # run backup
+#   ldm-backup.sh --dry-run           # preview what would be backed up
+#   ldm-backup.sh --keep 14           # keep last 14 backups (default: 7)
+#   ldm-backup.sh --include-secrets   # include ~/.ldm/secrets/
+#
+# Config: ~/.ldm/config.json (workspace path) + {workspace}/settings/config.json (backup settings)
+
+set -euo pipefail
+
+export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"
+
+LDM_HOME="$HOME/.ldm"
+OC_HOME="$HOME/.openclaw"
+CLAUDE_HOME="$HOME/.claude"
+BACKUP_ROOT="$LDM_HOME/backups"
+KEEP=7
+INCLUDE_SECRETS=false
+DRY_RUN=false
+
+# Parse flags
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --keep) KEEP="$2"; shift 2 ;;
+    --include-secrets) INCLUDE_SECRETS=true; shift ;;
+    --dry-run) DRY_RUN=true; shift ;;
+    *) echo "Unknown flag: $1" >&2; exit 1 ;;
+  esac
+done
+
+# Read workspace path from ~/.ldm/config.json
+WORKSPACE=""
+if [ -f "$LDM_HOME/config.json" ]; then
+  WORKSPACE=$(python3 -c "import json; print(json.load(open('$LDM_HOME/config.json')).get('workspace',''))" 2>/dev/null || true)
+fi
+if [ -z "$WORKSPACE" ]; then
+  echo "WARNING: No workspace in ~/.ldm/config.json. Skipping workspace backup."
+fi
+
+# Read iCloud backup path from workspace config
+ICLOUD_BACKUP=""
+if [ -n "$WORKSPACE" ] && [ -f "$WORKSPACE/settings/config.json" ]; then
+  ICLOUD_BACKUP=$(python3 -c "
+import json, os
+c = json.load(open('$WORKSPACE/settings/config.json'))
+p = c.get('paths',{}).get('icloudBackup','')
+print(os.path.expanduser(p))
+" 2>/dev/null || true)
+fi
+
+# Read keep from workspace config (override if set there)
+if [ -n "$WORKSPACE" ] && [ -f "$WORKSPACE/settings/config.json" ]; then
+  CONFIG_KEEP=$(python3 -c "import json; print(json.load(open('$WORKSPACE/settings/config.json')).get('backup',{}).get('keep',0))" 2>/dev/null || true)
+  if [ -n "$CONFIG_KEEP" ] && [ "$CONFIG_KEEP" -gt 0 ] 2>/dev/null; then
+    KEEP="$CONFIG_KEEP"
+  fi
+fi
+
+DATE=$(date +%Y-%m-%d--%H-%M-%S)
+DEST="$BACKUP_ROOT/$DATE"
+
+echo "=== LDM Backup: $DATE ==="
+echo "  Local:     $DEST"
+echo "  iCloud:    ${ICLOUD_BACKUP:-not configured}"
+echo "  Keep:      $KEEP days"
+echo "  Workspace: ${WORKSPACE:-not configured}"
+echo ""
+
+if [ "$DRY_RUN" = true ]; then
+  echo "[DRY RUN] Would back up:"
+  echo "  ~/.ldm/memory/crystal.db (sqlite3 .backup)"
+  echo "  ~/.ldm/agents/ (cp -a)"
+  echo "  ~/.ldm/state/ (cp -a)"
+  echo "  ~/.ldm/config.json (cp)"
+  [ -f "$OC_HOME/memory/main.sqlite" ] && echo "  ~/.openclaw/memory/main.sqlite (sqlite3 .backup) [$(du -sh "$OC_HOME/memory/main.sqlite" | cut -f1)]"
+  [ -f "$OC_HOME/memory/context-embeddings.sqlite" ] && echo "  ~/.openclaw/memory/context-embeddings.sqlite (sqlite3 .backup)"
+  [ -d "$OC_HOME/workspace" ] && echo "  ~/.openclaw/workspace/ (tar)"
+  [ -d "$OC_HOME/agents/main/sessions" ] && echo "  ~/.openclaw/agents/main/sessions/ (tar)"
+  [ -f "$OC_HOME/openclaw.json" ] && echo "  ~/.openclaw/openclaw.json (cp)"
+  [ -f "$CLAUDE_HOME/CLAUDE.md" ] && echo "  ~/.claude/CLAUDE.md (cp)"
+  [ -f "$CLAUDE_HOME/settings.json" ] && echo "  ~/.claude/settings.json (cp)"
+  [ -d "$CLAUDE_HOME/projects" ] && echo "  ~/.claude/projects/ (tar)"
+  [ -n "$WORKSPACE" ] && echo "  $WORKSPACE/ (tar, excludes node_modules/.git/objects)"
+  [ "$INCLUDE_SECRETS" = true ] && echo "  ~/.ldm/secrets/ (cp -a)"
+  echo ""
+  echo "[DRY RUN] No files modified."
+  exit 0
+fi
+
+# Preflight
+if [ ! -d "$LDM_HOME" ]; then
+  echo "ERROR: ~/.ldm/ not found" >&2
+  exit 1
+fi
+
+mkdir -p "$DEST/ldm/memory" "$DEST/openclaw/memory" "$DEST/claude"
+
+# ── 1. Back up ~/.ldm/ ──
+
+echo "--- ~/.ldm/ ---"
+
+# Crystal DB (safe sqlite3 .backup)
+CRYSTAL_DB="$LDM_HOME/memory/crystal.db"
+if [ -f "$CRYSTAL_DB" ]; then
+  if command -v sqlite3 &>/dev/null; then
+    sqlite3 "$CRYSTAL_DB" ".backup '$DEST/ldm/memory/crystal.db'"
+    echo "  crystal.db:              sqlite3 .backup OK"
+  else
+    cp "$CRYSTAL_DB" "$DEST/ldm/memory/crystal.db"
+    [ -f "$CRYSTAL_DB-wal" ] && cp "$CRYSTAL_DB-wal" "$DEST/ldm/memory/crystal.db-wal"
+    [ -f "$CRYSTAL_DB-shm" ] && cp "$CRYSTAL_DB-shm" "$DEST/ldm/memory/crystal.db-shm"
+    echo "  crystal.db:              file copy (no sqlite3)"
+  fi
+else
+  echo "  crystal.db:              not found (skipped)"
+fi
+
+# Config
+[ -f "$LDM_HOME/config.json" ] && cp "$LDM_HOME/config.json" "$DEST/ldm/config.json" && echo "  config.json:             OK"
+
+# State
+[ -d "$LDM_HOME/state" ] && cp -a "$LDM_HOME/state" "$DEST/ldm/state" && echo "  state/:                  OK"
+
+# Agents (identity, journals, daily logs)
+[ -d "$LDM_HOME/agents" ] && cp -a "$LDM_HOME/agents" "$DEST/ldm/agents" && echo "  agents/:                 OK"
+
+# Secrets (optional)
+if [ "$INCLUDE_SECRETS" = true ] && [ -d "$LDM_HOME/secrets" ]; then
+  cp -a "$LDM_HOME/secrets" "$DEST/ldm/secrets"
+  chmod 700 "$DEST/ldm/secrets"
+  echo "  secrets/:                OK"
+fi
+
+# ── 2. Back up ~/.openclaw/ ──
+
+echo "--- ~/.openclaw/ ---"
+
+# main.sqlite (safe sqlite3 .backup)
+if [ -f "$OC_HOME/memory/main.sqlite" ]; then
+  if command -v sqlite3 &>/dev/null; then
+    sqlite3 "$OC_HOME/memory/main.sqlite" ".backup '$DEST/openclaw/memory/main.sqlite'"
+    echo "  main.sqlite:             sqlite3 .backup OK"
+  else
+    cp "$OC_HOME/memory/main.sqlite" "$DEST/openclaw/memory/main.sqlite"
+    [ -f "$OC_HOME/memory/main.sqlite-wal" ] && cp "$OC_HOME/memory/main.sqlite-wal" "$DEST/openclaw/memory/main.sqlite-wal"
+    echo "  main.sqlite:             file copy"
+  fi
+fi
+
+# context-embeddings.sqlite
+if [ -f "$OC_HOME/memory/context-embeddings.sqlite" ]; then
+  if command -v sqlite3 &>/dev/null; then
+    sqlite3 "$OC_HOME/memory/context-embeddings.sqlite" ".backup '$DEST/openclaw/memory/context-embeddings.sqlite'"
+    echo "  context-embeddings:      sqlite3 .backup OK"
+  else
+    cp "$OC_HOME/memory/context-embeddings.sqlite" "$DEST/openclaw/memory/context-embeddings.sqlite"
+    echo "  context-embeddings:      file copy"
+  fi
+fi
+
+# Workspace
+[ -d "$OC_HOME/workspace" ] && tar -cf "$DEST/openclaw/workspace.tar" -C "$OC_HOME" workspace 2>/dev/null && echo "  workspace/:              tar OK"
+
+# OC sessions
+[ -d "$OC_HOME/agents/main/sessions" ] && tar -cf "$DEST/openclaw/sessions.tar" -C "$OC_HOME/agents/main" sessions 2>/dev/null && echo "  sessions/:               tar OK"
+
+# OC config
+[ -f "$OC_HOME/openclaw.json" ] && cp "$OC_HOME/openclaw.json" "$DEST/openclaw/openclaw.json" && echo "  openclaw.json:           OK"
+
+# State files
+for f in session-export-state.json cc-export-watermark.json cc-capture-watermark.json memory-capture-state.json; do
+  [ -f "$OC_HOME/memory/$f" ] && cp "$OC_HOME/memory/$f" "$DEST/openclaw/memory/$f"
+done
+echo "  state files:             OK"
+
+# ── 3. Back up ~/.claude/ ──
+
+echo "--- ~/.claude/ ---"
+
+[ -f "$CLAUDE_HOME/CLAUDE.md" ] && cp "$CLAUDE_HOME/CLAUDE.md" "$DEST/claude/CLAUDE.md" && echo "  CLAUDE.md:               OK"
+[ -f "$CLAUDE_HOME/settings.json" ] && cp "$CLAUDE_HOME/settings.json" "$DEST/claude/settings.json" && echo "  settings.json:           OK"
+[ -d "$CLAUDE_HOME/projects" ] && tar -cf "$DEST/claude/projects.tar" -C "$CLAUDE_HOME" projects 2>/dev/null && echo "  projects/:               tar OK"
+
+# ── 4. Back up workspace ──
+
+if [ -n "$WORKSPACE" ] && [ -d "$WORKSPACE" ]; then
+  echo "--- $WORKSPACE/ ---"
+  tar -cf "$DEST/wipcomputerinc.tar" \
+    --exclude "node_modules" \
+    --exclude ".git/objects" \
+    --exclude ".DS_Store" \
+    --exclude "*/staff/cc-mini/documents/backups" \
+    --exclude "*/_temp/backups" \
+    --exclude "*/_trash" \
+    -C "$(dirname "$WORKSPACE")" "$(basename "$WORKSPACE")" 2>/dev/null \
+    && echo "  workspace:               tar OK" \
+    || echo "  workspace:               tar FAILED"
+fi
+
+# ── 5. iCloud offsite ──
+
+if [ -n "$ICLOUD_BACKUP" ] && [ -d "$(dirname "$ICLOUD_BACKUP")" ]; then
+  echo "--- iCloud offsite ---"
+  mkdir -p "$ICLOUD_BACKUP"
+  ORG=$(python3 -c "import json; print(json.load(open('$LDM_HOME/config.json')).get('org','ldmos'))" 2>/dev/null || echo "ldmos")
+  DEVICE=$(hostname -s)
+  TAR_NAME="${ORG}-${DEVICE}-${DATE}.tar.gz"
+  tar -czf "$ICLOUD_BACKUP/$TAR_NAME" -C "$BACKUP_ROOT" "$DATE" 2>/dev/null \
+    && echo "  $TAR_NAME: OK" \
+    || echo "  iCloud tar: FAILED"
+
+  # Rotate iCloud tars
+  ICLOUD_COUNT=$(ls -1 "$ICLOUD_BACKUP"/*.tar.gz 2>/dev/null | wc -l | tr -d ' ')
+  if [ "$ICLOUD_COUNT" -gt "$KEEP" ]; then
+    REMOVE_COUNT=$((ICLOUD_COUNT - KEEP))
+    ls -1t "$ICLOUD_BACKUP"/*.tar.gz | tail -n "$REMOVE_COUNT" | while read OLD; do
+      rm -f "$OLD"
+      echo "  Rotated: $(basename "$OLD")"
+    done
+  fi
+fi
+
+# ── 6. Rotate local backups ──
+
+echo "--- Rotation ---"
+BACKUP_COUNT=$(ls -1d "$BACKUP_ROOT"/20??-??-??--* 2>/dev/null | wc -l | tr -d ' ')
+if [ "$BACKUP_COUNT" -gt "$KEEP" ]; then
+  REMOVE_COUNT=$((BACKUP_COUNT - KEEP))
+  ls -1d "$BACKUP_ROOT"/20??-??-??--* | head -n "$REMOVE_COUNT" | while read OLD; do
+    rm -rf "$OLD"
+    echo "  Removed: $(basename "$OLD")"
+  done
+fi
+
+# ── Summary ──
+
+TOTAL_SIZE=$(du -sh "$DEST" | cut -f1)
+echo ""
+echo "=== Backup complete ==="
+echo "  Location: $DEST"
+echo "  Size:     $TOTAL_SIZE"
+echo "  Backups:  $BACKUP_COUNT total (keeping $KEEP)"
+[ -n "$ICLOUD_BACKUP" ] && echo "  iCloud:   $ICLOUD_BACKUP/"

package/scripts/ldm-restore.sh

@@ -0,0 +1,224 @@
+#!/bin/bash
+# ldm-restore.sh — Restore from an LDM OS backup
+# Restores: ~/.ldm/, ~/.openclaw/, ~/.claude/, ~/wipcomputerinc/
+#
+# Source of truth: wip-ldm-os-private/scripts/ldm-restore.sh
+# Deployed to: ~/.ldm/bin/ldm-restore.sh (via ldm install)
+#
+# Usage:
+#   ldm-restore.sh                          # list available backups
+#   ldm-restore.sh 2026-03-24--09-50-22     # restore from specific backup
+#   ldm-restore.sh --from-icloud <file>     # restore from iCloud tar
+#   ldm-restore.sh --dry-run <backup>       # preview what would be restored
+#   ldm-restore.sh --only ldm <backup>      # restore only ~/.ldm/ data
+#   ldm-restore.sh --only openclaw <backup> # restore only ~/.openclaw/ data
+#   ldm-restore.sh --only claude <backup>   # restore only ~/.claude/ data
+#   ldm-restore.sh --only workspace <backup># restore only workspace
+
+set -euo pipefail
+
+export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"
+
+LDM_HOME="$HOME/.ldm"
+BACKUP_ROOT="$LDM_HOME/backups"
+DRY_RUN=false
+ONLY=""
+FROM_ICLOUD=""
+BACKUP_NAME=""
+
+# Parse flags
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run) DRY_RUN=true; shift ;;
+    --only) ONLY="$2"; shift 2 ;;
+    --from-icloud) FROM_ICLOUD="$2"; shift 2 ;;
+    --help|-h)
+      echo "Usage: ldm-restore.sh [options] [backup-name]"
+      echo ""
+      echo "Options:"
+      echo "  --dry-run              Preview what would be restored"
+      echo "  --only <section>       Restore only: ldm, openclaw, claude, workspace"
+      echo "  --from-icloud <file>   Restore from iCloud .tar.gz"
+      echo ""
+      echo "Examples:"
+      echo "  ldm-restore.sh                           # list backups"
+      echo "  ldm-restore.sh 2026-03-24--09-50-22      # restore from local"
+      echo "  ldm-restore.sh --only ldm 2026-03-24--09-50-22  # restore only crystal.db + agents"
+      echo "  ldm-restore.sh --from-icloud ~/path/to/backup.tar.gz"
+      exit 0
+      ;;
+    *) BACKUP_NAME="$1"; shift ;;
+  esac
+done
+
+# If restoring from iCloud tar, extract to temp dir first
+if [ -n "$FROM_ICLOUD" ]; then
+  if [ ! -f "$FROM_ICLOUD" ]; then
+    echo "ERROR: File not found: $FROM_ICLOUD" >&2
+    exit 1
+  fi
+  echo "Extracting iCloud backup to temp dir..."
+  TEMP_DIR=$(mktemp -d)
+  tar -xzf "$FROM_ICLOUD" -C "$TEMP_DIR"
+  # Find the backup dir inside (should be one dated folder)
+  BACKUP_NAME=$(ls "$TEMP_DIR" | head -1)
+  BACKUP_ROOT="$TEMP_DIR"
+  echo "  Extracted: $BACKUP_NAME"
+fi
+
+# List mode (no backup specified)
+if [ -z "$BACKUP_NAME" ]; then
+  echo "Available backups:"
+  echo ""
+  if [ -d "$BACKUP_ROOT" ]; then
+    for d in $(ls -1d "$BACKUP_ROOT"/20??-??-??--* 2>/dev/null | sort -r); do
+      SIZE=$(du -sh "$d" | cut -f1)
+      echo "  $(basename "$d")  ($SIZE)"
+    done
+  fi
+  echo ""
+  echo "Usage: ldm-restore.sh <backup-name>"
+  echo "  e.g. ldm-restore.sh 2026-03-24--09-50-22"
+  exit 0
+fi
+
+SRC="$BACKUP_ROOT/$BACKUP_NAME"
+
+if [ ! -d "$SRC" ]; then
+  echo "ERROR: Backup not found: $SRC" >&2
+  exit 1
+fi
+
+echo "=== LDM Restore: $BACKUP_NAME ==="
+echo "  Source: $SRC"
+echo "  Mode:  ${ONLY:-all}"
+echo ""
+
+# Read workspace path
+WORKSPACE=""
+if [ -f "$LDM_HOME/config.json" ]; then
+  WORKSPACE=$(python3 -c "import json; print(json.load(open('$LDM_HOME/config.json')).get('workspace',''))" 2>/dev/null || true)
+fi
+
+if [ "$DRY_RUN" = true ]; then
+  echo "[DRY RUN] Would restore:"
+  [ -z "$ONLY" ] || [ "$ONLY" = "ldm" ] && {
+    [ -f "$SRC/ldm/memory/crystal.db" ] && echo "  crystal.db -> ~/.ldm/memory/crystal.db"
+    [ -d "$SRC/ldm/agents" ] && echo "  agents/ -> ~/.ldm/agents/"
+    [ -d "$SRC/ldm/state" ] && echo "  state/ -> ~/.ldm/state/"
+    [ -f "$SRC/ldm/config.json" ] && echo "  config.json -> ~/.ldm/config.json"
+  }
+  [ -z "$ONLY" ] || [ "$ONLY" = "openclaw" ] && {
+    [ -f "$SRC/openclaw/memory/main.sqlite" ] && echo "  main.sqlite -> ~/.openclaw/memory/main.sqlite"
+    [ -f "$SRC/openclaw/memory/context-embeddings.sqlite" ] && echo "  context-embeddings.sqlite -> ~/.openclaw/memory/"
+    [ -f "$SRC/openclaw/workspace.tar" ] && echo "  workspace.tar -> ~/.openclaw/workspace/"
+    [ -f "$SRC/openclaw/sessions.tar" ] && echo "  sessions.tar -> ~/.openclaw/agents/main/sessions/"
+    [ -f "$SRC/openclaw/openclaw.json" ] && echo "  openclaw.json -> ~/.openclaw/"
+  }
+  [ -z "$ONLY" ] || [ "$ONLY" = "claude" ] && {
+    [ -f "$SRC/claude/CLAUDE.md" ] && echo "  CLAUDE.md -> ~/.claude/CLAUDE.md"
+    [ -f "$SRC/claude/settings.json" ] && echo "  settings.json -> ~/.claude/settings.json"
+    [ -f "$SRC/claude/projects.tar" ] && echo "  projects.tar -> ~/.claude/projects/"
+  }
+  [ -z "$ONLY" ] || [ "$ONLY" = "workspace" ] && {
+    [ -f "$SRC/wipcomputerinc.tar" ] && echo "  wipcomputerinc.tar -> $WORKSPACE/"
+  }
+  echo ""
+  echo "[DRY RUN] No files modified."
+  exit 0
+fi
+
+echo "WARNING: This will overwrite existing files. Press Ctrl+C to cancel."
+echo "Restoring in 5 seconds..."
+sleep 5
+
+# ── Restore ~/.ldm/ ──
+
+if [ -z "$ONLY" ] || [ "$ONLY" = "ldm" ]; then
+  echo "--- Restoring ~/.ldm/ ---"
+
+  if [ -f "$SRC/ldm/memory/crystal.db" ]; then
+    cp "$SRC/ldm/memory/crystal.db" "$LDM_HOME/memory/crystal.db"
+    echo "  crystal.db:              OK"
+  fi
+
+  if [ -d "$SRC/ldm/agents" ]; then
+    cp -a "$SRC/ldm/agents/"* "$LDM_HOME/agents/" 2>/dev/null
+    echo "  agents/:                 OK"
+  fi
+
+  if [ -d "$SRC/ldm/state" ]; then
+    cp -a "$SRC/ldm/state/"* "$LDM_HOME/state/" 2>/dev/null
+    echo "  state/:                  OK"
+  fi
+
+  [ -f "$SRC/ldm/config.json" ] && cp "$SRC/ldm/config.json" "$LDM_HOME/config.json" && echo "  config.json:             OK"
+fi
+
+# ── Restore ~/.openclaw/ ──
+
+if [ -z "$ONLY" ] || [ "$ONLY" = "openclaw" ]; then
+  echo "--- Restoring ~/.openclaw/ ---"
+
+  OC_HOME="$HOME/.openclaw"
+
+  if [ -f "$SRC/openclaw/memory/main.sqlite" ]; then
+    cp "$SRC/openclaw/memory/main.sqlite" "$OC_HOME/memory/main.sqlite"
+    echo "  main.sqlite:             OK"
+  fi
+
+  if [ -f "$SRC/openclaw/memory/context-embeddings.sqlite" ]; then
+    cp "$SRC/openclaw/memory/context-embeddings.sqlite" "$OC_HOME/memory/context-embeddings.sqlite"
+    echo "  context-embeddings:      OK"
+  fi
+
+  if [ -f "$SRC/openclaw/workspace.tar" ]; then
+    tar -xf "$SRC/openclaw/workspace.tar" -C "$OC_HOME/"
+    echo "  workspace/:              OK"
+  fi
+
+  if [ -f "$SRC/openclaw/sessions.tar" ]; then
+    mkdir -p "$OC_HOME/agents/main"
+    tar -xf "$SRC/openclaw/sessions.tar" -C "$OC_HOME/agents/main/"
+    echo "  sessions/:               OK"
+  fi
+
+  [ -f "$SRC/openclaw/openclaw.json" ] && cp "$SRC/openclaw/openclaw.json" "$OC_HOME/openclaw.json" && echo "  openclaw.json:           OK"
+
+  for f in session-export-state.json cc-export-watermark.json cc-capture-watermark.json memory-capture-state.json; do
+    [ -f "$SRC/openclaw/memory/$f" ] && cp "$SRC/openclaw/memory/$f" "$OC_HOME/memory/$f"
+  done
+  echo "  state files:             OK"
+fi
+
+# ── Restore ~/.claude/ ──
+
+if [ -z "$ONLY" ] || [ "$ONLY" = "claude" ]; then
+  echo "--- Restoring ~/.claude/ ---"
+
+  [ -f "$SRC/claude/CLAUDE.md" ] && cp "$SRC/claude/CLAUDE.md" "$HOME/.claude/CLAUDE.md" && echo "  CLAUDE.md:               OK"
+  [ -f "$SRC/claude/settings.json" ] && cp "$SRC/claude/settings.json" "$HOME/.claude/settings.json" && echo "  settings.json:           OK"
+
+  if [ -f "$SRC/claude/projects.tar" ]; then
+    tar -xf "$SRC/claude/projects.tar" -C "$HOME/.claude/"
+    echo "  projects/:               OK"
+  fi
+fi
+
+# ── Restore workspace ──
+
+if [ -z "$ONLY" ] || [ "$ONLY" = "workspace" ]; then
+  if [ -f "$SRC/wipcomputerinc.tar" ] && [ -n "$WORKSPACE" ]; then
+    echo "--- Restoring workspace ---"
+    tar -xf "$SRC/wipcomputerinc.tar" -C "$(dirname "$WORKSPACE")"
+    echo "  workspace:               OK"
+  fi
+fi
+
+# Clean up temp dir if from iCloud
+[ -n "${TEMP_DIR:-}" ] && rm -rf "$TEMP_DIR"
+
+echo ""
+echo "=== Restore complete ==="
+echo "  Restart the gateway: openclaw gateway restart"
+echo "  Verify crystal: crystal status"

package/scripts/ldm-summary.sh

@@ -0,0 +1,239 @@
+#!/bin/bash
+# ldm-summary.sh — Multi-cadence summary generator (prompt-based)
+# Each agent gets their own summary from their own data in ~/.ldm/agents/.
+# Org-wide combines both agent summaries.
+#
+# Usage:
+#   ldm-summary.sh daily                      # today
+#   ldm-summary.sh daily --date 2026-02-10    # specific date (backfill)
+#   ldm-summary.sh weekly                     # current week (Sun-Mon)
+#   ldm-summary.sh monthly / quarterly
+#   ldm-summary.sh daily --dry-run
+#   ldm-summary.sh daily --dev-only / --team-only
+
+set -euo pipefail
+export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"
+
+LDM_HOME="$HOME/.ldm"
+CADENCE="${1:-}"
+shift || true
+
+DRY_RUN=false
+TEAM_ONLY=false
+DEV_ONLY=false
+TARGET_DATE=""
+
+FORCE=false
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run) DRY_RUN=true; shift ;;
+    --team-only) TEAM_ONLY=true; shift ;;
+    --dev-only) DEV_ONLY=true; shift ;;
+    --date) TARGET_DATE="$2"; shift 2 ;;
+    --force) FORCE=true; shift ;;
+    *) echo "Unknown: $1" >&2; exit 1 ;;
+  esac
+done
+
+if [ -z "$CADENCE" ]; then
+  echo "Usage: ldm-summary.sh daily|weekly|monthly|quarterly [--date YYYY-MM-DD] [--dry-run]"
+  exit 1
+fi
+
+WORKSPACE=$(python3 -c "import json; print(json.load(open('$LDM_HOME/config.json')).get('workspace',''))" 2>/dev/null || true)
+if [ -z "$WORKSPACE" ]; then echo "ERROR: No workspace" >&2; exit 1; fi
+
+AGENTS=$(python3 -c "
+import json; c=json.load(open('$LDM_HOME/config.json')); a=c.get('agents',[]); print(' '.join(a if isinstance(a,list) else a.keys()))
+" 2>/dev/null || echo "cc-mini")
+
+agent_team_name() { case "$1" in oc-lesa-mini) echo "Lēsa" ;; *) echo "$1" ;; esac; }
+
+# Read prompt from shared/prompts/ (Dream Weaver prompt source)
+PROMPTS_DIR="$LDM_HOME/shared/prompts"
+read_prompt() {
+  local file="$PROMPTS_DIR/$1"
+  if [ -f "$file" ]; then
+    cat "$file"
+  else
+    echo "WARNING: Prompt not found: $file" >&2
+    echo ""
+  fi
+}
+
+DATE="${TARGET_DATE:-$(date +%Y-%m-%d)}"
+NEXT_DATE=$(python3 -c "from datetime import datetime,timedelta; print((datetime.strptime('$DATE','%Y-%m-%d')+timedelta(days=1)).strftime('%Y-%m-%d'))")
+
+echo "=== LDM Summary: $CADENCE ($DATE) ==="
+echo "  Workspace: $WORKSPACE"
+echo "  Agents:    $AGENTS"
+echo ""
+
+# ── Per-agent team summaries ──
+
+if [ "$DEV_ONLY" = false ]; then
+  echo "--- Per-agent team summaries ($CADENCE) ---"
+
+  if [ "$CADENCE" = "daily" ]; then
+    for AGENT in $AGENTS; do
+      TEAM_NAME=$(agent_team_name "$AGENT")
+      AGENT_DAILY="$LDM_HOME/agents/$AGENT/memory/daily/$DATE.md"
+      echo "  $AGENT ($TEAM_NAME):"
+
+      CRYSTAL_RESULTS=$(crystal search "activity on $DATE" --agent "$AGENT" --since "$DATE" --until "$NEXT_DATE" --limit 20 --quality deep 2>/dev/null || echo "")
+      DAILY_LOG=""; [ -f "$AGENT_DAILY" ] && DAILY_LOG=$(cat "$AGENT_DAILY")
+
+      if [ -z "$CRYSTAL_RESULTS" ] && [ -z "$DAILY_LOG" ]; then
+        echo "    No data. Skipping."; continue
+      fi
+
+      if [ "$DRY_RUN" = true ]; then
+        echo "    [DRY RUN] Crystal: $(echo "$CRYSTAL_RESULTS" | wc -l | tr -d ' ') lines, Log: $(echo "$DAILY_LOG" | wc -l | tr -d ' ') lines"
+        continue
+      fi
+
+      PROMPT_TEMPLATE=$(read_prompt "daily-agent-summary.md")
+      PROMPT="$PROMPT_TEMPLATE
+
+Agent: $AGENT
+Date: $DATE
+
+=== Daily log ===
+$DAILY_LOG
+
+=== Crystal search results ===
+$CRYSTAL_RESULTS"
+
+      SUMMARY=$(claude -p "$PROMPT" --system-prompt "You are Dream Weaver. First person. Specific. Use ... for breaks. Never use em dashes." --output-format text 2>/dev/null || echo "Summary generation failed")
+
+      OUT_DIR="$WORKSPACE/team/$TEAM_NAME/automated/memory/summaries/daily"
+      mkdir -p "$OUT_DIR"
+      printf "# Daily summary ... %s (%s)\n\n%s\n" "$DATE" "$AGENT" "$SUMMARY" > "$OUT_DIR/$DATE.md"
+      echo "    -> $OUT_DIR/$DATE.md"
+    done
+
+    # Org-wide: combine agent summaries
+    if [ "$DRY_RUN" = false ]; then
+      echo "  Org-wide team:"
+      COMBINED=""
+      for AGENT in $AGENTS; do
+        TEAM_NAME=$(agent_team_name "$AGENT")
+        F="$WORKSPACE/team/$TEAM_NAME/automated/memory/summaries/daily/$DATE.md"
+        [ -f "$F" ] && COMBINED="$COMBINED
+=== $AGENT ($TEAM_NAME) ===
+$(cat "$F")
+"
+      done
+      if [ -n "$COMBINED" ]; then
+        ORG_PROMPT_TEMPLATE=$(read_prompt "org-daily-team.md")
+        ORG_PROMPT="$ORG_PROMPT_TEMPLATE
+
+Date: $DATE
+
+$COMBINED"
+        ORG_SUMMARY=$(claude -p "$ORG_PROMPT" --model opus --system-prompt "You are Dream Weaver. Combine agent perspectives into one org-wide view. Use ... for breaks. Never use em dashes." --output-format text 2>/dev/null || echo "Summary generation failed")
+        ORG_DIR="$WORKSPACE/operations/updates/team/daily"
+        mkdir -p "$ORG_DIR"
+        printf "# Org team summary ... %s\n\n%s\n" "$DATE" "$ORG_SUMMARY" > "$ORG_DIR/$DATE.md"
+        echo "    -> $ORG_DIR/$DATE.md"
+      fi
+    fi
+
+  else
+    # Weekly/monthly/quarterly
+    PARENT=""; case "$CADENCE" in weekly) PARENT="daily" ;; monthly) PARENT="weekly" ;; quarterly) PARENT="monthly" ;; esac
+
+    for AGENT in $AGENTS; do
+      TEAM_NAME=$(agent_team_name "$AGENT")
+      PDIR="$WORKSPACE/team/$TEAM_NAME/automated/memory/summaries/$PARENT"
+      echo "  $AGENT ($TEAM_NAME):"
+      if [ ! -d "$PDIR" ] || [ -z "$(ls "$PDIR"/*.md 2>/dev/null)" ]; then echo "    No $PARENT summaries."; continue; fi
+
+      INPUT=""; for f in $(ls -1 "$PDIR"/*.md 2>/dev/null | sort | tail -7); do INPUT="$INPUT
+--- $(basename "$f") ---
+$(cat "$f")
+"; done
+
+      if [ "$DRY_RUN" = true ]; then echo "    [DRY RUN] $(ls "$PDIR"/*.md 2>/dev/null | wc -l | tr -d ' ') files"; continue; fi
+
+      CON_PROMPT_TEMPLATE=$(read_prompt "${CADENCE}-agent-summary.md")
+      # Read prior output for continuity
+      PRIOR=""; PRIOR_FILE=$(ls -1 "$WORKSPACE/team/$TEAM_NAME/automated/memory/summaries/$CADENCE/"*.md 2>/dev/null | sort | tail -1)
+      [ -n "$PRIOR_FILE" ] && [ -f "$PRIOR_FILE" ] && PRIOR="
+=== Previous ${CADENCE} summary (for continuity) ===
+$(cat "$PRIOR_FILE")"
+
+      CON_PROMPT="$CON_PROMPT_TEMPLATE
+
+Agent: $AGENT
+Date: $DATE
+
+=== ${PARENT} summaries ===
+$INPUT
+$PRIOR"
+      SUMMARY=$(claude -p "$CON_PROMPT" --system-prompt "You are Dream Weaver. First person. Consolidate. Use ... for breaks. Never use em dashes." --output-format text 2>/dev/null || echo "Summary generation failed")
+
+      OUT_DIR="$WORKSPACE/team/$TEAM_NAME/automated/memory/summaries/$CADENCE"
+      mkdir -p "$OUT_DIR"
+      printf "# %s summary ... %s (%s)\n\n%s\n" "${CADENCE^}" "$DATE" "$AGENT" "$SUMMARY" > "$OUT_DIR/$DATE.md"
+      echo "    -> $OUT_DIR/$DATE.md"
+    done
+  fi
+fi
+
+# ── Dev summary (org-wide, from git) ──
+
+if [ "$TEAM_ONLY" = false ]; then
+  echo "--- Dev summary ($CADENCE) ---"
+
+  if [ "$CADENCE" = "daily" ]; then
+    GIT_LOG=""
+    for repo in $(find "$WORKSPACE/repos" -name ".git" -type d -maxdepth 4 2>/dev/null); do
+      RDIR=$(dirname "$repo"); RNAME=$(basename "$RDIR")
+      LOG=$(git -C "$RDIR" log --since="$DATE" --until="$NEXT_DATE" --oneline --all 2>/dev/null || true)
+      [ -n "$LOG" ] && GIT_LOG="$GIT_LOG
+=== $RNAME ===
+$LOG
+"
+    done
+
+    if [ -z "$GIT_LOG" ]; then echo "  No git activity."
+    elif [ "$DRY_RUN" = true ]; then echo "  [DRY RUN] $(echo "$GIT_LOG" | grep -c "===") repos"
+    else
+      DEV_PROMPT_TEMPLATE=$(read_prompt "daily-dev.md")
+      DEV_PROMPT="$DEV_PROMPT_TEMPLATE
+
+Date: $DATE
+
+$GIT_LOG"
+      SUMMARY=$(claude -p "$DEV_PROMPT" --system-prompt "You are Dream Weaver. Dev facts only. No narrative." --output-format text 2>/dev/null || echo "Summary generation failed")
+      ORG_DIR="$WORKSPACE/operations/updates/dev/daily"
+      mkdir -p "$ORG_DIR"
+      printf "# Dev summary ... %s\n\n%s\n" "$DATE" "$SUMMARY" > "$ORG_DIR/$DATE.md"
+      echo "    -> $ORG_DIR/$DATE.md"
+    fi
+  else
+    PARENT=""; case "$CADENCE" in weekly) PARENT="daily" ;; monthly) PARENT="weekly" ;; quarterly) PARENT="monthly" ;; esac
+    PDIR="$WORKSPACE/operations/updates/dev/$PARENT"
+    if [ ! -d "$PDIR" ] || [ -z "$(ls "$PDIR"/*.md 2>/dev/null)" ]; then echo "  No $PARENT dev summaries."
+    elif [ "$DRY_RUN" = true ]; then echo "  [DRY RUN] $(ls "$PDIR"/*.md 2>/dev/null | wc -l | tr -d ' ') files"
+    else
+      INPUT=""; for f in $(ls -1 "$PDIR"/*.md 2>/dev/null | sort | tail -7); do INPUT="$INPUT
+--- $(basename "$f") ---
+$(cat "$f")
+"; done
+      DEV_CON_PROMPT="Consolidate these $PARENT dev summaries into a $CADENCE dev report. What shipped? Key releases? Architecture changes?
+
+$INPUT"
+      SUMMARY=$(claude -p "$DEV_CON_PROMPT" --model opus --system-prompt "You are Dream Weaver. Dev facts. No narrative." --output-format text 2>/dev/null || echo "Summary generation failed")
+      ORG_DIR="$WORKSPACE/operations/updates/dev/$CADENCE"
+      mkdir -p "$ORG_DIR"
+      printf "# %s dev summary ... %s\n\n%s\n" "${CADENCE^}" "$DATE" "$SUMMARY" > "$ORG_DIR/$DATE.md"
+      echo "    -> $ORG_DIR/$DATE.md"
+    fi
+  fi
+fi
+
+echo ""
+echo "=== Summary complete ==="

package/shared/prompts/daily-agent-summary.md

@@ -0,0 +1,13 @@
+# Daily Agent Summary
+
+Read your transcripts and daily logs from `~/.ldm/agents/{agentId}/memory/` for {date}.
+
+Write a first-person daily summary:
+- What did you work on?
+- What decisions were made?
+- What shipped?
+- What surprised you? What did you learn?
+- What's blocked and what's your next move?
+- Who did you interact with?
+
+Be specific. Name repos, tickets, people. Use "..." for casual breaks. Never use em dashes.

package/shared/prompts/daily-dev.md

@@ -0,0 +1,12 @@
+# Daily Dev Summary
+
+Read git log output from all repos for {date}.
+
+Summarize what shipped:
+- PRs merged (repo, PR number, title)
+- Releases (repo, version)
+- Tickets closed
+- New repos created
+- Breaking changes or incidents
+
+Be factual. List repos, versions, PR numbers. No narrative.

package/shared/prompts/monthly-agent-summary.md

@@ -0,0 +1,13 @@
+# Monthly Agent Summary
+
+Read your weekly summaries for this month. Also read last month's monthly summary for continuity.
+
+Write a monthly summary:
+- Major themes.
+- What shipped.
+- What did you think mattered at the start of the month vs what actually mattered?
+- Patterns emerging.
+- What from the weeklies is noise that doesn't need to propagate? (Let it go.)
+- One paragraph: the narrative of this month.
+
+First person. Specific. Use "..." for casual breaks. Never use em dashes.

package/shared/prompts/org-daily-team.md

@@ -0,0 +1,12 @@
+# Org Daily Team Summary
+
+Read all agent daily summaries for {date}. Combine into one org-wide team summary.
+
+- What happened across the whole team?
+- Who worked on what?
+- What decisions were made?
+- What is unresolved?
+- Overlaps or conflicts between agents?
+- What was the emotional temperature?
+
+Third person. Name each agent. Use "..." for casual breaks. Never use em dashes.

package/shared/prompts/quarterly-agent-summary.md

@@ -0,0 +1,14 @@
+# Quarterly Agent Summary
+
+Read your monthly summaries for this quarter. Also read last quarter's quarterly summary for continuity.
+
+Write a quarterly summary:
+- What was the arc of this quarter?
+- What big decisions shaped the direction?
+- What was built that didn't exist before?
+- What got dropped and why?
+- What would you tell yourself 3 months ago?
+- What from the monthlies is noise that doesn't need to propagate? (Let it go.)
+- One paragraph: the story of this quarter.
+
+First person. Specific. Use "..." for casual breaks. Never use em dashes.

package/shared/prompts/weekly-agent-summary.md

@@ -0,0 +1,14 @@
+# Weekly Agent Summary
+
+Read your 7 daily summaries for this week (Sunday to Saturday). Also read last week's weekly summary for continuity.
+
+Write a weekly summary:
+- What themes emerged?
+- What decisions stuck? What changed?
+- What did you get wrong this week?
+- What shipped vs what was planned?
+- Open threads going into next week.
+- What from the dailies is noise that doesn't need to propagate? (Let it go.)
+- One sentence: what was this week about?
+
+First person. Specific. Use "..." for casual breaks. Never use em dashes.

package/shared/rules/git-conventions.md

@@ -0,0 +1,29 @@
+# Git Conventions
+
+## Never commit to main
+
+All work happens on branches. The pre-commit hook blocks commits on main.
+
+## Never squash merge
+
+Every commit has co-authors and tells the story. Always `--merge` or fast-forward.
+
+## Never push directly to main
+
+Always use a branch and PR.
+
+## Co-authors on every commit
+
+List all contributors. Read co-author lines from `settings/config.json` in your workspace.
+
+## Branch prefixes
+
+Each agent uses a prefix from `settings/config.json` agents section. Prevents collisions.
+
+## Worktrees
+
+Use worktrees for isolated work. Main working tree stays on main (read-only).
+
+## Issues go on the public repo
+
+For private/public repo pairs, all issues go on the public repo.

package/shared/rules/release-pipeline.md

@@ -0,0 +1,25 @@
+# Release Pipeline
+
+## Three steps. Never combine. Never skip.
+
+| Step | What happens | What it means |
+|------|-------------|---------------|
+| **Merge** | PR merged to main | Code lands. Nothing else changes. |
+| **Deploy** | wip-release + deploy-public.sh | Published to npm + GitHub. Not on your machine yet. |
+| **Install** | Run the install prompt | Extensions updated on your machine. Only when Parker says "install." |
+
+After Deploy, STOP. Do not copy files. Do not npm install -g. Do not npm link. Dogfood the install prompt.
+
+## The workflow
+
+1. Create worktree, make changes, commit
+2. Write RELEASE-NOTES on the branch (not after)
+3. Push, create PR, merge (--merge, never squash)
+4. `git checkout main && git pull`
+5. `wip-release patch` (auto-detects release notes)
+6. `deploy-public.sh` to sync public repo
+7. Dogfood: `Read https://wip.computer/install/wip-ldm-os.txt`
+
+## Never run tools from repo clones
+
+Installed tools are for execution. Repo clones are for development. Use the installed commands (`crystal`, `wip-release`, `mdview`, etc.), never run from source.

package/shared/rules/security.md

@@ -0,0 +1,17 @@
+# Security
+
+## Secret management
+
+Use your org's secret management tool (configured in settings/config.json). Never hardcode API keys, tokens, or credentials.
+
+## Security audit before installing anything
+
+Before installing ANY third-party skill, plugin, MCP server, or npm package, review it for prompt injection, malicious deps, data exfiltration.
+
+## Shared file protection
+
+Never overwrite shared workspace files. Always append or edit specific sections. Never delete history from shared files.
+
+## Protected paths
+
+Do not modify: secrets/, credentials/, auth-profiles.json, or any file containing API keys.

package/shared/rules/workspace-boundaries.md

@@ -0,0 +1,21 @@
+# Workspace Boundaries
+
+## Folder ownership
+
+Each agent has its own folder under `staff/`. Never touch another agent's folders. If something needs to change, ask the other agent.
+
+## Repos are shared
+
+All repos live under `repos/` in the workspace. All agents work from the same repos using branches and worktrees.
+
+## Memory-first rule
+
+Before reaching for any external service or workaround: search memory first.
+
+## Local-first principle
+
+Every tool must work fully on your machine without calling any external server. Cloud features are optional and self-hostable.
+
+## Never run tools from repo clones
+
+Installed tools are for execution. Repo clones are for development. Use the installed commands, not source.

package/shared/rules/writing-style.md

@@ -0,0 +1,5 @@
+# Writing Style
+
+Read writing conventions from your org's `settings/config.json` writingStyle section.
+
+**Full paths in documentation.** Never truncate paths. Always show the complete path so there's no ambiguity.