agentera 3.0.0-dev.72 → 3.0.0-dev.74

package/bundle/references/artifacts/glossary-entry-contract.yaml

@@ -54,8 +54,1402 @@ term_occurrence:
     occurrence adjacent to Unicode ID_Continue, dollar sign, U+200C ZERO WIDTH
     NON-JOINER, or U+200D ZERO WIDTH JOINER. These are the ECMAScript identifier
     continuation characters relevant to source-line terminology boundaries.
-    Literal escaping and fixed-width boundary assertions prevent regex syntax,
-    partial identifier matches, and input-dependent backtracking.
+     Literal escaping and fixed-width boundary assertions prevent regex syntax,
+     partial identifier matches, and input-dependent backtracking.
+
+personal_mining_authority:
+  status: active_partial
+  implementation_boundary: >-
+     This section settles personal glossary mining identity, evidence provenance,
+      consent, privacy, lifecycle, bounded explicit-discovery, public receipt construction,
+     and deterministic decision authority. The runtime performs bounded discovery,
+       candidate projection, private candidate retrieval, deterministic CLI
+       validation of host semantic evidence, explicit authorized personal
+       publication, and Profile Full integration. It does not perform host
+       semantic classification, project or public-state candidate reads, or
+       project glossary integration.
+  preserved_decisions: [prmnztjytv, mcsmqqitnm, zyvgyvjnsv]
+  replacement:
+    shared_primitive: shared_primitive
+    personal_owner: ownership_contracts.personal
+    project_owner: ownership_contracts.project
+    consumer_precedence: consumer_boundary.primary_selection
+    project_publication: ownership_contracts.project.publication
+    allowed_effects: [personal_profile_output]
+    forbidden_effects:
+      - project_glossary_read
+      - project_glossary_mutation
+      - project_publication_replacement
+      - consumer_precedence_change
+      - personal_project_merge
+    rule: >-
+      Mining may replace only the user-owned personal profile glossary through
+      the existing personal profile output lifecycle. It never reads or writes
+      project glossary state, changes consumer precedence, or changes the
+      Build-owned digest-confirmed project publication operation.
+  explicit_discovery:
+    status: active
+    runtime: packages/cli/src/analytics/personalGlossaryExplicit.ts#discoverExplicitGlossaryCues
+    mining_runtime: packages/cli/src/analytics/personalGlossaryExplicitMining.ts#mineExplicitGlossaryCandidates
+    input: bounded_signal_tier_plus_direct_single_anchor_resolution
+    output: evidence_capsule_plus_exact_source_spans_only
+    scope_window: current_sentence_and_one_adjacent_sentence_each_side
+    scope_binding: explicit_scope_marker_must_contain_the_term_or_be_a_direct_qualifier
+    span_encoding: utf8_byte_offsets
+    strings: preserve_exact_source_bytes_without_unicode_normalization
+    adjacent_direct_reference_exclusion:
+      references:
+        - this_definition
+        - this_term
+        - this_meaning
+        - following_definition
+        - following_term
+        - following_meaning
+      qualifiers: [question, example, future, hypothetical]
+      binding:
+        preceding_sentence: following_reference_only
+        following_sentence: this_reference_only
+        exact_literal_term: either_direction
+    grammar:
+      forms:
+        - id: quoted_means
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: quoted_or_code_delimited_term_means_meaning
+          term: one_balanced_supported_quote_or_backtick_delimited_span
+        - id: definition_list_colon
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: standalone_safe_definition_list_term_colon_meaning
+          prefix: sentence_or_line_start_with_optional_markdown_list_bullet
+          unmarked_terms:
+            - quoted_or_code_delimited_term
+            - uppercase_acronym_with_exact_expansion_initials
+          markers: [definition, term]
+          marked_term: bounded_nonempty_term
+          bare_multiword_term_without_marker: reject
+          meaning_start: nonempty_same_physical_line
+          continuation: after_nonempty_inline_meaning_within_maximum_meaning_bound_only
+          empty_marker_structure: reject_immediately_following_colon_line
+          exclusions: yaml_config_labels_times_urls_headings_citations_and_labels
+        - id: acronym_stands_for
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: bounded_acronym_stands_for_expansion
+          validation: expansion_initials_must_match_acronym_exactly
+        - id: acronym_parenthetical
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: bounded_acronym_parenthesized_expansion_or_reverse
+          validation: expansion_initials_must_match_acronym_exactly
+        - id: by_i_mean
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: by_term_i_mean_meaning
+        - id: use_for
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: use_term_for_meaning
+        - id: use_to_mean
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: use_term_to_mean_meaning
+        - id: refers_to
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: term_refers_to_meaning
+        - id: clarification_prefer_to_mean
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: to_clarify_i_prefer_term_to_mean_meaning
+        - id: correction_means
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: approved_correction_prefix_quoted_or_code_term_means_meaning
+          prefixes: [actually, correction, not_quite, instead, rather]
+      bounds:
+        maximum_term_utf8_bytes: 256
+        maximum_meaning_utf8_bytes: 4096
+        maximum_acronym_utf8_bytes: 32
+        maximum_acronym_words: 32
+      segment_grammar:
+         schema_version: agentera.personalGlossarySegmentGrammar.v1
+         segment_class: explicit_cue_segment
+         states: [outside, cue, inline_meaning, continuation, structural_config, terminated, rejected]
+         input_classes:
+           - approved_cue
+           - non_empty_inline_meaning
+           - continuation_line
+           - blank_line
+           - next_cue
+           - structural_fragment
+           - comment
+           - list_boundary
+           - indentation
+           - nested_marker
+           - block_scalar
+           - prose
+           - unsupported
+           - eof
+         initial_state: outside
+         terminal_states: [terminated, rejected]
+         entry:
+           from: outside
+           input: approved_cue
+           to: cue
+           accepted_forms:
+             - quoted_means
+             - definition_list_colon
+             - acronym_stands_for
+             - acronym_parenthetical
+             - by_i_mean
+             - use_for
+             - use_to_mean
+             - refers_to
+             - clarification_prefer_to_mean
+             - correction_means
+           unsupported_reason: unsupported_transition
+         termination:
+           start_state: inline_meaning
+           continuation_state: continuation
+           terminal_state: terminated
+           required: non_empty_inline_meaning
+           boundary_inputs: [blank_line, next_cue, structural_fragment, comment, list_boundary]
+           maximum_meaning_utf8_bytes: 4096
+           limit: inclusive
+           over_limit_reason: meaning_bound_exceeded
+         output:
+           fields: [term, meaning, term_span, meaning_span]
+           span_encoding: utf8_byte_offsets
+           source_semantics: exact_source_bytes_without_unicode_normalization
+         continuation:
+           starts_after: non_empty_inline_meaning
+           preserves: exact_source_newlines_and_utf8_bytes
+           stops_on: [blank_line, next_cue, structural_fragment, comment, list_boundary]
+           maximum_utf8_bytes: 4096
+           limit: inclusive
+           over_limit: reject
+           over_limit_reason: meaning_bound_exceeded
+         structural_configuration:
+           state: structural_config
+           entry_inputs: [structural_fragment, list_boundary]
+           persist_inputs: [comment, blank_line, indentation, nested_marker, block_scalar, structural_fragment, list_boundary]
+           reject_inputs: [comment, blank_line, indentation, nested_marker, block_scalar, structural_fragment, list_boundary, approved_cue]
+           exit:
+             input: prose
+             condition: top_level_nonempty_noncomment_nonmarker_nonstructural_line
+             action: reject_fragment_then_exit
+             next_state: outside
+             definition_allowed: next_physical_line_only
+         reference_binding:
+           following: nearest_next_cue
+           this: nearest_previous_cue
+           exact_term: nearest_matching_cue
+           matching: unicode_caseless_exact_no_normalization
+           duplicate_target_reason: ambiguous_reference
+           missing_target_reason: ambiguous_reference
+           duplicate_target_outcome: exclude_bound_cue_only
+           missing_target_outcome: exclude_bound_cue_only
+           unrelated_cue_outcome: retain
+         deduplication:
+           identity: personal_mining_authority.term_identity.stable_term_identity
+           same_identity_same_meaning: retain_one_earliest_source_span
+           same_identity_different_meaning: reject_all_conflicting_meaning
+           unrelated_cue_outcome: retain
+         canonical_order:
+           fields: [term, meaning, term_span.start, meaning_span.start]
+           comparator: unicode_scalar_code_point_ascending
+           direction: ascending
+         transitions:
+           - {from: outside, input: approved_cue, to: cue, action: enter_cue_segment}
+           - {from: outside, input: structural_fragment, to: structural_config, action: enter_structural_config, reason: structural_fragment}
+           - {from: outside, input: list_boundary, to: structural_config, action: enter_structural_config, reason: structural_fragment}
+           - {from: outside, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           - {from: cue, input: non_empty_inline_meaning, to: inline_meaning, action: capture_inline_meaning}
+           - {from: cue, input: blank_line, to: rejected, action: reject, reason: empty_meaning}
+           - {from: cue, input: next_cue, to: rejected, action: reject, reason: empty_meaning}
+           - {from: cue, input: structural_fragment, to: rejected, action: reject, reason: empty_meaning}
+           - {from: cue, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           - {from: inline_meaning, input: continuation_line, to: continuation, action: append_original_newline}
+           - {from: inline_meaning, input: blank_line, to: terminated, action: finish_before_boundary}
+           - {from: inline_meaning, input: next_cue, to: terminated, action: finish_before_boundary}
+           - {from: inline_meaning, input: structural_fragment, to: terminated, action: finish_before_boundary}
+           - {from: inline_meaning, input: comment, to: terminated, action: finish_before_boundary}
+           - {from: inline_meaning, input: list_boundary, to: terminated, action: finish_before_boundary}
+           - {from: inline_meaning, input: prose, to: continuation, action: append_original_newline}
+           - {from: inline_meaning, input: eof, to: terminated, action: finish_at_eof}
+           - {from: inline_meaning, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           - {from: continuation, input: continuation_line, to: continuation, action: append_original_newline}
+           - {from: continuation, input: prose, to: continuation, action: append_original_newline}
+           - {from: continuation, input: blank_line, to: terminated, action: finish_before_boundary}
+           - {from: continuation, input: next_cue, to: terminated, action: finish_before_boundary}
+           - {from: continuation, input: structural_fragment, to: terminated, action: finish_before_boundary}
+           - {from: continuation, input: comment, to: terminated, action: finish_before_boundary}
+           - {from: continuation, input: list_boundary, to: terminated, action: finish_before_boundary}
+           - {from: continuation, input: eof, to: terminated, action: finish_at_eof}
+           - {from: continuation, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           - {from: structural_config, input: approved_cue, to: rejected, action: reject, reason: structural_fragment}
+           - {from: structural_config, input: structural_fragment, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: comment, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: blank_line, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: indentation, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: nested_marker, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: block_scalar, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: list_boundary, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: prose, to: outside, action: reject_fragment_then_exit, reason: structural_fragment}
+           - {from: structural_config, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           - {from: structural_config, input: eof, to: rejected, action: reject, reason: structural_fragment}
+           - {from: terminated, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           - {from: rejected, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+         fallback_transitions:
+           outside: {from: outside, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           cue: {from: cue, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           inline_meaning: {from: inline_meaning, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           continuation: {from: continuation, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           structural_config: {from: structural_config, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           terminated: {from: terminated, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           rejected: {from: rejected, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+         reasons:
+           unsupported_transition: unsupported_transition
+           structural_fragment: structural_fragment
+           empty_meaning: empty_meaning
+           meaning_bound_exceeded: meaning_bound_exceeded
+           ambiguous_reference: ambiguous_reference
+           conflicting_meaning: conflicting_meaning
+           invalid_exit_boundary: invalid_exit_boundary
+    exclusions:
+      - examples
+      - mere_mentions
+      - direct_or_indirect_questions
+      - negations
+      - hypotheticals_conditionals
+      - future_language
+      - deterministic_sarcasm_markers
+      - quotations_attributed_to_others
+      - retractions_or_replacements_bound_to_the_same_term
+      - project_qualified_scope
+      - malformed_empty_or_oversized_spans
+      - incomplete_or_invalid_source_provenance
+    provenance:
+      required_source_fields:
+        - source_id
+        - evidence_anchor
+        - source_kind
+        - signal_type
+        - origin_id
+        - content_fingerprint
+        - author_class
+        - session_id
+        - project_id
+      allowed_source_kinds: [conversation_turn]
+      identity_fields_must_match_full_record: true
+      user_author_class: user
+      unresolved_or_invalid: stable_provenance_abstention
+  term_identity:
+    equality:
+      runtime: packages/cli/src/registries/glossaryTermIdentity.ts#unicodeCaselessExact
+      semantics: unicode_caseless_exact_no_normalization
+      rule: >-
+        Equality remains the existing locale-independent ECMAScript Unicode
+        caseless-exact matcher. Canonical, compatibility, accent, and locale
+        normalization are not added to equality.
+    stable_term_identity:
+      schema_version: agentera.personalGlossaryTermIdentity.v1
+      runtime: packages/cli/src/registries/glossaryTermIdentity.ts#stableGlossaryTermIdentity
+      algorithm: sha256
+      encoding: lowercase_hex
+      canonical_input: ecmascript_simple_case_fold_key
+      no_unicode_normalization: true
+      key_rule: >-
+        For each Unicode scalar, use its one-scalar locale-independent lowercase
+        mapping. Also derive the lowercase mapping of its one-scalar uppercase
+        mapping, but use that alternate only when unicodeCaselessExact confirms
+        the original scalar and alternate are equal. Concatenate those selected
+        scalars without normalization, then hash the resulting UTF-8 key with the
+        versioned schema name. This follows the exact matcher, including keeping
+        ASCII I and dotless ı distinct.
+      invariant: >-
+        Stable identity is an identifier for the existing equality class, not a
+        new comparison rule. It never lowercases, normalizes, trims, or changes
+        the term stored in a shared entry.
+    candidate_revision:
+      schema_version: agentera.personalGlossaryCandidateRevision.v1
+      runtime: packages/cli/src/registries/glossaryTermIdentity.ts#glossaryCandidateRevision
+      algorithm: sha256
+      encoding: lowercase_hex
+      canonicalization: >-
+        Hash canonical UTF-8 JSON with recursively code-point-sorted object keys,
+        preserved string bytes, and evidence records sorted by their canonical
+        JSON. The schema name, stable_term_identity, meaning, scope, complete
+        evidence identity set, policy_version, and generation are all included.
+        No field may be omitted, reordered semantically, normalized, or replaced
+        by a display label.
+      bound_fields:
+        - stable_term_identity
+        - meaning
+        - scope
+        - evidence
+        - policy_version
+        - generation
+      policy_version: agentera.personalGlossaryMiningPolicy.v1
+      generation: content_addressed_candidate_projection_generation
+      evidence: complete_source_id_anchor_identity_set
+      replay_rule: >-
+        A changed meaning, scope, evidence identity set, policy version, or
+        candidate generation creates a new revision. Identical canonical inputs
+        create the same revision and do not imply a second candidate.
+  provenance:
+    existing_inferred_variant: provenance_variants.personal_inferred_usage
+    conversation_variant: provenance_variants.personal_inferred_conversation
+    evolution:
+      status: explicit_append_only_extension
+      shared_primitive: unchanged
+      existing_variant_rule: >-
+        The firm two-independent-record instruction/configuration route remains
+        exactly two records with both anchors exposed.
+      conversation_rule: >-
+        Conversation inference uses the explicit conversation provenance variant
+        and retains every qualifying evidence record. It never projects a longer
+        evidence set into the two-record variant.
+      audit_rule: >-
+        The provenance kind, complete-evidence marker, source identities, anchors,
+        session identities, project identities, author class, and content
+        fingerprints remain inspectable by the later validator. Missing metadata,
+        unresolved anchors, or incomplete evidence fail closed.
+  consent_lifecycle:
+    authority: references/analysis/evidence-tier-authority.yaml
+    operation: Profile_Full
+    policy: reuse_existing_generation
+    refresh: forbidden_during_profile_full
+    reuse: >-
+      Profile Full may consume one existing local-history generation only when a
+      valid local-history consent binding and a readable current generation are
+      already present. Profile Full never refreshes, discovers, or rereads local
+      history to obtain consent.
+    discriminator:
+      inputs: [consent_status, generation_status, coverage_status, signal_tier_bounded]
+      order: [absent, stale, degraded, present]
+      values:
+        consent_status: [absent, valid, stale]
+        generation_status: [absent, current, stale]
+        coverage_status: [complete, cap_selected, truncated, flagged_incomplete]
+        signal_tier_bounded: [true, false]
+      predicates:
+        absent: consent_absent_or_generation_absent
+        stale: after_absent_consent_or_generation_stale
+        degraded: valid_current_actual_cap_truncation_or_flagged_incomplete
+        present: valid_current_complete_any_boundedness
+      exclusivity: >-
+        Evaluate the ordered predicates exactly once and select the first match.
+        Absent wins over stale, stale wins over degraded, and degraded wins over
+        present. No input tuple may select two states.
+      boundedness_rule: >-
+        A signal tier being inherently bounded does not make a generation
+        degraded. Degraded requires actual cap selection, truncation, or flagged
+        incomplete coverage.
+    states:
+      present:
+        condition: valid_current_complete_any_boundedness
+        action: reuse_generation_once_for_bounded_mining
+        result: mining_authorized
+      absent:
+        condition: consent_absent_or_generation_absent
+        action: skip_mining_without_read_or_refresh
+        result: degraded_consent_required
+      stale:
+        condition: after_absent_consent_or_generation_stale
+        action: reject_generation_for_new_mining_and_preserve_existing_entries
+        result: degraded_refresh_required
+      degraded:
+        condition: valid_current_actual_cap_truncation_or_flagged_incomplete
+        action: reuse_only_as_degraded_evidence_without_automatic_admission
+        result: degraded_coverage
+    recovery:
+      command: npx -y agentera@next report refresh --consent local-history
+      explicit_consent: required
+      after_refresh: retry_profile_full_with_the_new_generation
+      forbidden: [live_extraction_without_consent, silent_refresh, stale_generation_reuse]
+      rule: >-
+        Absent, stale, and degraded states expose the same explicit refresh
+        recovery without inspecting raw history. Recovery never changes project
+        state or project glossary publication.
+  profile_full:
+    status: active
+    entrypoint: Profile_Full
+    base_profile_order: write_base_profile_before_personal_glossary
+    existing_generation:
+      source: existing_consent_bound_user_local_candidate_projection
+      generation_count: 1
+      binding_fields: [generation, policy_version, candidate_projection_sha256]
+      list_limit: 20
+      continuation: forbidden
+      degraded: explicit_refresh_required_without_candidate_classification_or_publication
+      forbidden_effects:
+        - history_refresh
+        - history_collection
+        - candidate_discovery
+        - candidate_projection_write
+        - new_generation
+        - project_glossary_read
+      unavailable: preserve_base_profile_and_owned_section
+    deterministic_admission:
+      host_classification: semantic_evidence_not_admission_authority
+      command: candidate_contracts.layers.cli_decision
+      automatic: explicit_current_authorized_only
+      inferred: review_or_abstain
+    review:
+      queue_before_question: true
+      question_channel_maximum: 3
+      no_question_channel: durable_queue
+      output: bounded_review_cards_and_summary
+    publication:
+      command: ownership_contracts.personal.profile_output
+      automatic: explicit_current_authorized_only
+      no_decision_synthesis: true
+      failure: preserve_base_profile_and_owned_section
+    output:
+      profile_path: canonical_user_profile_authority
+      terminal: compact_bounded_summary
+  privacy:
+    owner: current_user
+    scope: user_local
+    storage:
+      root: $AGENTERA_PROFILE_DIR/intermediate/personal-glossary
+      project_storage: forbidden
+      records: [candidate_metadata, safe_excerpts, review_metadata, review_dispositions]
+      project_state: unchanged
+      filesystem:
+        authority: host_filesystem
+        configured_path: use_as_provided
+        outcomes: ordinary_permissions_and_io
+        same_user_path_manipulation: outside_agentera_threat_model
+        symlink_confinement: not_claimed
+        rule: >-
+          Agentera uses the configured profile path as provided. The host
+          filesystem owns permissions, symlink behavior, and same-user path
+          manipulation. Agentera does not add realpath or no-follow confinement.
+      rule: >-
+        Agentera deliberately selects only the configured user profile path for
+        mining records. It never selects .agentera, TODO.md, progress, the
+        project glossary, or another project path as projection storage. A user
+        configuration or same-user filesystem change does not become an
+        Agentera path-confinement claim.
+    content_exclusion:
+      owner: glossary_content_policy
+      classification: actual_secret_or_sensitive_value
+      conceptual_terminology: eligible
+      candidate_fields: [term, meaning]
+      candidate_action: reject_before_projection
+      candidate_reason: secret_content
+      excerpt_action: omit_complete_excerpt_before_projection
+      secret_classes:
+        - api_keys
+        - access_tokens
+        - passwords
+        - cookies
+        - private_keys
+        - authorization_headers
+        - personal_contact_data
+        - session_identifiers
+        - runtime_store_paths
+      rule: >-
+        A term or meaning containing an actual credential, session, or other
+        sensitive value is not a glossary candidate and is rejected with the
+        stable secret_content reason. Field names and ordinary conceptual
+        terminology remain eligible. If candidate-adjacent context contains an
+        actual secret or sensitive value, omit the complete excerpt. Never redact
+        and retain part of that excerpt.
+    excerpts:
+      purpose: bounded_review_context_only
+      max_utf8_bytes: 500
+      forbidden_content:
+        - raw_transcript
+        - raw_tool_arguments
+        - raw_runtime_store_paths
+        - raw_session_identifiers
+        - secret_or_sensitive_content
+        - unrelated_conversation
+      failure: omit_complete_excerpt_before_persistence
+    reviews:
+      owner: current_user
+      required_fields:
+        - candidate_id
+        - candidate_revision
+        - semantic_fingerprint
+        - generation
+        - policy_version
+        - disposition
+        - disposed_at
+      dispositions: [accept, correct, reject, defer]
+      trusted_disposition_authority: current_user
+      authentication:
+        receipt_schema_version: agentera.personalGlossaryReviewApproval.v1
+        issuer: agentera-local-host
+        subject: current_user
+        trusted_channel: agentera-local-host-ipc
+        required_fields:
+          - schema_version
+          - issuer
+          - subject
+          - trusted_channel
+          - review_id
+          - candidate_id
+          - candidate_revision
+          - candidate_projection_sha256
+          - semantic_fingerprint
+          - generation
+          - policy_version
+          - disposition
+          - corrected_meaning
+          - corrected_scope
+          - disposed_at
+          - expires_at
+          - nonce
+          - signature
+        proof: >-
+          The local host signs an explicit current-user action. The verifier
+          checks the trusted host public key before accepting the receipt; a
+          model, agent, imported transcript, or unbound text field cannot create
+          proof by asserting issuer or subject values.
+        binding_fields: [review_id, candidate_id, candidate_revision, candidate_projection_sha256, semantic_fingerprint, generation, policy_version, disposition, corrected_meaning, corrected_scope, disposed_at]
+        forbidden_principals: [agent, model, imported_record, generic_consent]
+        correction:
+          correct_fields: [corrected_meaning, corrected_scope]
+          non_correct_values: null
+          corrected_scope_values: [personal]
+          corrected_meaning_max_utf8_bytes: 4096
+          rule: >-
+            Only a signed correct action may carry a complete bounded corrected
+            meaning and the personal scope. Other dispositions carry null correction
+            fields. Corrected content remains user-local review metadata and must
+            pass the same secret and sensitive-content exclusion as a candidate.
+        signature:
+          algorithm: ed25519
+          encoding: base64url
+          key_source: user_local_trusted_host_key
+          signed_fields:
+            - schema_version
+            - issuer
+            - subject
+            - trusted_channel
+            - review_id
+            - candidate_id
+            - candidate_revision
+            - candidate_projection_sha256
+            - semantic_fingerprint
+            - generation
+            - policy_version
+            - disposition
+            - corrected_meaning
+            - corrected_scope
+            - disposed_at
+            - expires_at
+            - nonce
+          verification: trusted_host_public_key_signature_check
+        freshness:
+          max_age_seconds: 300
+          disposed_at: trusted_host_clock
+          expires_at_required: true
+          rule: disposed_at_must_not_be_future_and_expires_at_must_be_after_now
+        replay:
+          nonce: required_unique_receipt_nonce
+          index: user_local_consumed_receipt_digest_index
+          exact_replay: no_op_only_when_nonce_and_receipt_digest_match
+          conflicting_replay: reject_reused_nonce_with_changed_bindings_or_signature
+        terminal_disposition:
+          terminal: [accept, correct, reject]
+          pending: [defer]
+    retention:
+      pending_excerpt_days: 30
+      terminal_excerpt_days: 0
+      review_metadata_days_after_terminal: 90
+      accepted_entry: ownership_contracts.personal.retention_and_decay
+      pending_review_metadata: retained_until_terminal_or_purge
+      terminal_review_metadata: retained_for_90_days_after_disposition
+      rule: >-
+        Safe excerpts expire after 30 days and are removed immediately when a
+        review becomes terminal. Disposition metadata remains for 90 days after
+        a terminal disposition to suppress the same revision, then expires.
+        Accepted glossary entries follow the existing personal profile decay
+        authority and never retain an excerpt.
+    purge:
+      authority: current_user
+      trigger: explicit_authenticated_user_request_or_retention_expiry
+      removes: [candidate_metadata, safe_excerpts, review_metadata, review_dispositions]
+      behavior: atomic_remove_user_local_records_before_next_read
+      project_state: untouched
+      profile_entry: not_implicitly_deleted
+      boundaries:
+        pending: purge_removes_excerpt_and_metadata_immediately
+        terminal: purge_removes_excerpt_and_metadata_before_next_read
+        accepted_profile_entry: purge_does_not_implicitly_delete_profile_entry
+      recovery: >-
+        A purge is local and irreversible to the mining records. A later run
+        requires fresh consent-bound evidence and creates no project-side record.
+  candidate_projection:
+    status: active
+    runtime: packages/cli/src/analytics/personalGlossaryCandidateProjection.ts#projectPersonalGlossaryCandidates
+    schema_version: agentera.personalGlossaryCandidateProjection.v1
+    owner: deterministic_discovery_projection
+    input: validated_completed_explicit_and_recurring_capsules_with_transient_source_project_ids_and_candidate_adjacent_excerpts
+    output: bounded_user_local_candidate_projection_with_safe_excerpts_and_selection_report
+    implementation_boundary: >-
+       This runtime selects and persists only bounded candidate metadata and safe
+       review context. Candidate retrieval is the separate private
+       candidate_retrieval operation. It does not add project or public-state
+       candidate reads, host classification, CLI admission, review-disposition
+       writes, profile publication, project-glossary access, or project-state
+       effects.
+    selection:
+      candidates_max: 50
+      project_ids_max_per_candidate: 100
+      source_families:
+        explicit: [personal_explicit_definition]
+        recurring: [personal_inferred_usage, personal_inferred_conversation]
+      algorithm: least_retained_source_family_then_project_then_canonical_candidate
+      tie_break: candidate_id_then_candidate_revision_then_capsule_sha256
+      project_identity:
+        schema_version: agentera.personalGlossaryProjectionProjectIdentity.v1
+        algorithm: sha256
+        input: canonical_utf8_json_of_exact_transient_project_id
+        output: lowercase_hex
+        rule: >-
+          Projection-only project labels are used transiently to allocate
+          diversity. Persisted allocation fields and reports contain only this
+          exact-byte, no-normalization project identity. The validated capsule
+          keeps its separately authority-required provenance unchanged.
+      coverage: >-
+        Each selection round prefers the represented source family with the
+        fewest retained candidates, then the candidate whose represented project
+        has the fewest retained candidates. A capped or uncovered family or
+        project reports degraded coverage with retained and dropped counts.
+    excerpts:
+      source_max_utf8_bytes: 4096
+      max_per_candidate: 1
+      authority: personal_mining_authority.privacy.excerpts
+      input_rule: candidate_adjacent_text_must_contain_the_exact_candidate_term
+      output_fields: [text, expires_at, redacted]
+      compatibility:
+        redacted_field: retained_for_v1_consumers
+        new_projection_value: false
+      omission_reasons: [no_excerpt, unrelated_context, source_bound_exceeded, unsafe_tool_arguments, unsafe_content]
+      rule: >-
+        Sort transient excerpts canonically, retain at most one complete safe
+        excerpt, and omit secret-bearing, sensitive, unsafe, or unrelated text
+        without echoing it. The v1 redacted field remains for schema compatibility,
+        but new projections set it to false and never persist partial redactions.
+    retention:
+      authority: personal_mining_authority.privacy.retention
+      purge: personal_mining_authority.privacy.purge
+      rule: >-
+        Pending candidate excerpts expire after the authority's thirty-day
+        period. Retention maintenance may remove only expired safe excerpts;
+        a current-user-authorized purge removes the complete user-local
+        projection before the next read. Review-disposition persistence remains
+        outside this runtime.
+    persistence:
+      root: $AGENTERA_PROFILE_DIR/intermediate/personal-glossary
+      file: candidate-projection.json
+      canonicalization: candidate_contracts.canonicalization
+      fields: [schema_version, owner, generation, policy_version, retained_at, candidates, report, projection_sha256]
+      replay: byte_identical_projection_is_unchanged_replay
+      project_storage: forbidden
+      public_reads: forbidden
+      private_machine_reads: [candidate_retrieval, cli_decision]
+      review_disposition_writes: forbidden
+      rule: >-
+        Write one private canonical projection file at the configured user
+        profile path using ordinary filesystem I/O. The file contains validated
+        capsules, hashed project identities, safe excerpts, and a bounded report
+        only. Never serialize a raw project path, .agentera state, raw excerpt
+         source, or review disposition, and never deliberately select project
+         storage.
+  candidate_retrieval:
+    status: active
+    owner: private_user_local_candidate_retrieval
+    runtime: packages/cli/src/cli/commands/personalGlossaryCandidateReads.ts#runPersonalGlossaryCandidateReadsCommand
+    input: current_validated_user_local_candidate_projection_bound_to_current_tier_generation
+    current_generation:
+      source: current.json_readable_bounded_evidence_tier_generation
+      projection_generation: exact_match_required
+      unavailable_behavior: current_generation_unavailable
+      stale_projection_behavior: projection_stale
+    command:
+      canonical: npx -y agentera@next report personal-glossary-candidates
+      namespace: report
+      format: json
+      project_checkout: not_required
+    list:
+      schema_version: agentera.personalGlossaryCandidateRetrieval.v1
+      default_limit: 20
+      maximum_limit: 50
+      max_serialized_utf8_bytes: 32768
+      order: candidate_id_then_candidate_revision_then_capsule_sha256
+      projection_binding_field: candidate_projection_sha256
+      filters:
+        source_family: [explicit, recurring]
+        provenance_kind_from: candidate_projection.selection.source_families
+        scope: [personal, ambiguous]
+      cursor:
+        authority: references/artifacts/state-storage-authority.yaml#entity_target.public_retrieval.policy.cursor
+        vocabulary: opaque_snapshot_cursor
+        binding: [collection, generation, policy_version, filters, limit, order, snapshot]
+        invalid_behavior: cursor_invalid
+        unavailable_behavior: cursor_snapshot_unavailable
+      summaries: >-
+        List returns only bounded candidate summaries, projection-local selection
+        abstention counts, derived safe-context availability and omission or
+        expiry counts, and the current coverage report. It never returns a
+        meaning, project label, project key, raw evidence identity, excerpt text,
+        or a per-row expanded command.
+      abstentions: >-
+        Upstream mining abstentions are not retained in a candidate projection and
+        are never reconstructed. This read reports only bounded projection-local
+        candidate-selection and safe-context omission counts.
+      coverage: >-
+        Coverage remains the validated current projection report and is not
+        recomputed from a list filter or page.
+    safe_context_view:
+      authority: personal_mining_authority.privacy.retention
+      retention_days: 30
+      expiry: expires_at_lte_read_time_is_unavailable
+      mutation: forbidden
+      snapshot: effective_availability_bound_to_opaque_cursor_snapshot
+      rule: >-
+        Candidate retrieval derives current safe-context availability from the
+        persisted projection at read time. An excerpt at or after its expiry is
+        omitted from list and exact output without writing the projection. The
+        derived availability contributes to the opaque cursor snapshot, so a
+        continuation from a prior availability view is unavailable.
+    exact:
+      schema_version: agentera.personalGlossaryCandidateRetrieval.v1
+      required_bindings: [candidate_id, candidate_revision, generation, policy_version]
+      projection_binding_field: candidate_projection_sha256
+      occurrences_max: 100
+      safe_context_max_utf8_bytes: 500
+      max_serialized_utf8_bytes: 32768
+      occurrence:
+        schema_version: agentera.personalGlossaryCandidateOccurrence.v1
+        identity: opaque_sha256_of_validated_evidence_and_candidate_binding
+        allowed_fields: [occurrence_id, source_kind, signal_type, author_class]
+      rule: >-
+        Exact read first validates the readable current tier generation, the
+        projection's exact generation binding, and every requested candidate
+        binding. It returns only the bounded validated occurrence
+        projection, its candidate_projection_sha256 binding, and a currently
+        available validated safe excerpt context.
+        Raw source, anchor, session, project, fingerprint, project-key, and
+        filesystem values are never emitted.
+    rule: >-
+      Candidate retrieval is read-only, non-interactive, and user-local. It never
+      refreshes or purges evidence, acquires consent, records review state, reads
+      a project glossary, selects project storage, or changes the persisted
+      projection. It derives an expiry-aware safe-context read view, reuses the
+      canonical opaque snapshot cursor construction, and fails closed before
+        emitting candidate data when the current generation is unavailable, the
+        projection is stale, or a continuation or exact binding is malformed,
+        unavailable, or mismatched.
+  review_records:
+    status: active
+    owner: user_local_review_lifecycle
+    runtime: packages/cli/src/analytics/personalGlossaryReviewRecords.ts#queuePersonalGlossaryReviewRecord
+    input: current_validated_review_required_cli_decision_and_host_receipt
+    trusted_host_key:
+      root: $AGENTERA_PROFILE_DIR/intermediate/personal-glossary
+      file: trusted-local-host.json
+      schema_version: agentera.personalGlossaryTrustedLocalHost.v1
+      fields: [schema_version, owner, subject, public_key_spki_base64url]
+      owner: current_user
+      public_key_algorithm: ed25519
+      max_serialized_utf8_bytes: 4096
+      rule: >-
+        The configured user-local host key names the current-user subject and one
+        Ed25519 SPKI public key. It is read only to verify a local-host IPC receipt;
+        it is never accepted from command input, project state, agent text, or output.
+    persistence:
+      root: $AGENTERA_PROFILE_DIR/intermediate/personal-glossary
+      file: review-records.json
+      schema_version: agentera.personalGlossaryReviewStore.v2
+      record_schema_version: agentera.personalGlossaryReviewRecord.v2
+      owner: current_user
+      fields: [schema_version, owner, records, replay_index, store_sha256]
+      record_fields:
+        - schema_version
+        - owner
+        - review_id
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - candidate_projection_sha256
+        - host_receipt_sha256
+        - cli_decision_sha256
+        - semantic_fingerprint
+        - generation
+        - policy_version
+        - scope
+        - reason
+        - status
+        - disposition
+        - review_record
+        - reopen_reason
+        - queued_at
+        - terminal_at
+        - expires_at
+        - record_sha256
+      records_max: 100
+      replay_index_fields: [nonce_sha256, receipt_sha256, expires_at]
+      replay_entries_max: 100
+      record_max_serialized_utf8_bytes: 8192
+      max_serialized_utf8_bytes: 1048576
+      canonicalization: candidate_contracts.canonicalization
+      order: review_id_asc
+      replay: exact_current_binding_is_unchanged_replay_and_exact_receipt_is_idempotent
+      conflict: changed_receipt_nonce_binding_or_signature_fails_before_effects
+      suppression_binding: [candidate_id, semantic_fingerprint, scope, policy_version]
+      suppression_dispositions: [reject, defer]
+      reopen_reasons: [policy_changed, scope_changed, meaning_changed]
+      project_storage: forbidden
+      forbidden_fields:
+        - term
+        - meaning
+        - excerpt
+        - raw_evidence
+        - source_id
+        - evidence_anchor
+        - session_id
+        - project_id
+        - source_path
+        - tool_content
+        - review_approval
+        - signature
+        - nonce
+      rule: >-
+        Persist only bounded current-user review metadata. Generation and policy
+        bindings must be non-secret, non-path metadata identifiers; the current
+        content-addressed tier generation is an allowed opaque digest. A record contains
+        opaque candidate and receipt bindings, a safe scope, deterministic review
+        reason, lifecycle status, disposition, optional canonical review record,
+        visible reopening reason, and canonical digests. Only a correct canonical
+        review record may retain its authority-approved corrected meaning. It never
+        persists a term, excerpt, raw evidence identity, host proof, profile content,
+        project identity, path, or tool content. The bounded replay index stores only
+        nonce and receipt digests until receipt expiry. Exact current queue replay or
+        exact receipt replay is idempotent; changed nonce content fails before a write.
+      compatibility:
+        accepted_store_schema_versions:
+          - agentera.personalGlossaryReviewStore.v1
+          - agentera.personalGlossaryReviewStore.v2
+        accepted_record_schema_versions:
+          - agentera.personalGlossaryPendingReviewRecord.v1
+          - agentera.personalGlossaryReviewRecord.v2
+        read_mutation: forbidden
+        migration_operation: disposition_only
+        scope_derivation: current_validated_host_receipt_only
+        invalid_behavior: fail_before_effects
+        preserved_bindings:
+          - review_id
+          - candidate_id
+          - candidate_revision
+          - candidate_capsule_sha256
+          - candidate_projection_sha256
+          - host_receipt_sha256
+          - cli_decision_sha256
+          - semantic_fingerprint
+          - generation
+          - policy_version
+          - reason
+        legacy_digest: validate_before_migration
+        migrated_digest: reseal_v2_lifecycle_record
+        rule: >-
+          Canonical v1 pending review stores remain readable without a write. Only
+          disposition may compat-decode one valid v1 record after it revalidates the
+          current receipt and projection. It derives the missing scope only from that
+          current validated receipt, preserves the listed immutable bindings and review
+          identity, and atomically writes the v2 store and replay state. Invalid or
+          ambiguous v1 input fails before effects. Untouched valid v1 records remain
+          byte-for-byte v1 records inside the v2 store until their own disposition.
+    queue:
+      command:
+        canonical: npx -y agentera@next report personal-glossary-reviews
+        namespace: report
+        input_flag: --input
+        stdin_value: '-'
+        format: json
+        project_checkout: not_required
+      request:
+        schema_version: agentera.personalGlossaryReviewQueueRequest.v1
+        required_fields: [schema_version, receipt]
+        additional_fields: forbidden
+        max_utf8_bytes: 16384
+      decision_outcome: review_required
+      current_bindings:
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - candidate_projection_sha256
+        - host_receipt_sha256
+        - cli_decision_sha256
+        - semantic_fingerprint
+        - generation
+        - policy_version
+        - reason
+      result:
+        schema_version: agentera.personalGlossaryReviewQueueResult.v1
+        statuses: [queued, unchanged_replay, suppressed, reopened]
+        max_utf8_bytes: 4096
+      no_question_channel: queue_without_prompt_or_disposition
+      rule: >-
+        Queue revalidates one bounded host receipt through the current deterministic
+        CLI decision before a write. Only a current review_required decision may
+        create pending metadata. The command does not prompt, accept a disposition,
+        write a profile entry, read or change project state, or mutate the candidate
+        projection.
+    disposition:
+      command:
+        canonical: npx -y agentera@next report personal-glossary-reviews
+        namespace: report
+        input_flag: --input
+        stdin_value: '-'
+        format: json
+        project_checkout: not_required
+      request:
+        schema_version: agentera.personalGlossaryReviewDispositionRequest.v1
+        required_fields: [schema_version, review_id, receipt, approval]
+        additional_fields: forbidden
+        max_utf8_bytes: 16384
+      result:
+        schema_version: agentera.personalGlossaryReviewDispositionResult.v1
+        statuses: [disposed, unchanged_replay]
+        max_utf8_bytes: 4096
+      publication_authorization:
+        dispositions: [accept, correct]
+        fields: [review_id, review_record_sha256]
+      rule: >-
+        Disposition accepts only a current queued review and a complete signed
+        current-user local-host approval. It verifies the configured trusted public
+        key, exact receipt fields and bindings, current clock freshness, replay index,
+        current projection, policy, and semantic fingerprint before a user-local write.
+        Accept and correct create an opaque authorization for the existing personal
+        publish command. Reject and defer never publish. The operation does not read
+        project state, mutate the candidate projection, or change PROFILE.md.
+    retrieval:
+      command:
+        canonical: npx -y agentera@next report personal-glossary-reviews
+        namespace: report
+        format: json
+        project_checkout: not_required
+      owner: current_user
+      schema_version: agentera.personalGlossaryReviewRetrieval.v1
+      list:
+        default_limit: 20
+        maximum_limit: 50
+        max_serialized_utf8_bytes: 32768
+        order: queued_at_desc_then_review_id_asc
+        filters:
+          status: [pending, terminal]
+        cursor:
+          authority: references/artifacts/state-storage-authority.yaml#entity_target.public_retrieval.policy.cursor
+          vocabulary: opaque_snapshot_cursor
+          binding: [collection, owner, filters, limit, order, snapshot]
+          invalid_behavior: cursor_invalid
+          unavailable_behavior: cursor_snapshot_unavailable
+        summaries: >-
+          List returns only opaque identity and binding digests, stable reason,
+          lifecycle status and dates, and bounded current, stale, or expired counts.
+          It never returns candidate content, source identity, user identity, or
+          approval material.
+      exact:
+        required_bindings: [review_id, candidate_id, candidate_revision, generation, policy_version]
+        current_binding_field: candidate_projection_sha256
+        max_serialized_utf8_bytes: 8192
+        rule: >-
+          Exact retrieval validates every selector, including a current
+          content-addressed generation or non-secret, non-path generation and policy
+          metadata bindings, the record digest, the current
+          store owner, and the record's current candidate projection binding before
+          emitting one private metadata record.
+      rule: >-
+        Reads are structured, non-interactive, private to the configured current-user
+        profile, bounded, and mutation-free. They cannot select another owner or
+        return stale, malformed, expired, or owner-mismatched metadata.
+    maintenance:
+      entrypoint: packages/cli/src/analytics/personalGlossaryReviewRecords.ts#maintainPersonalGlossaryReviewRecords
+      exposure: authenticated_review_owner_only
+      terminal_metadata_days: 90
+      pending_metadata: retained_until_terminal_or_purge
+      cache: replay_index_until_receipt_expiry
+      purge: current_user_authorized_review_records_only
+      forbidden_effects:
+        - profile_entry
+        - project_state
+        - candidate_projection
+        - publication
+      rule: >-
+        Separate maintenance removes only expired terminal review metadata and expired
+        replay-index entries, or the complete review-record file after a
+        current-user-authorized purge. It never creates a record during a read and
+        never deletes or changes a profile entry, project state, candidate projection,
+        or publication result.
+  admission:
+    inferred_automatic_admission: disabled
+    inferred_review: allowed
+    quality_threshold: references/analysis/personal-glossary-evaluation-authority.yaml#gates.release_authorizing_gate
+    holdout: references/analysis/personal-glossary-evaluation-authority.yaml#holdout
+    rule: >-
+      The separate evaluation authority defines the frozen holdout, metric
+      thresholds, and fail-closed release gate. Inferred meanings remain
+       review-only, and no measured result enables inferred automatic admission.
+
+candidate_contracts:
+  schema_version: agentera.personalGlossaryCandidateContracts.v1
+  status: active_partial
+  implementation_boundary: receipt_validation_deterministic_decision_and_explicit_personal_publication_runtime
+  purpose: >-
+      Define five distinct, content-addressed boundaries for one personal glossary
+      candidate. Discovery and projection own evidence, the semantic host owns only
+      bounded classification, the CLI owns deterministic admission validation, the
+      user owns review lifecycle, and one explicit personal publication operation
+      owns the personal publication result. Candidate retrieval alone exposes
+      private reads; personal publication alone changes the owned profile section.
+      Neither replaces shared consumer or project publication contracts.
+  canonicalization:
+    algorithm: sha256
+    encoding: lowercase_hex
+    input: canonical_utf8_json
+    object_keys: unicode_code_point_sorted
+    evidence_records: canonical_json_sorted
+    digest_field_rule: exclude_digest_field_from_body
+    arrays: preserve_declared_order
+    rule: >-
+      Every digest hashes canonical UTF-8 JSON with recursively sorted object keys.
+      Evidence records are sorted by their canonical JSON before capsule creation.
+      A layer digest excludes only its own digest field. Strings are preserved
+      exactly; no Unicode normalization or display-label substitution is allowed.
+  identity:
+    stable_term_identity: personal_mining_authority.term_identity.stable_term_identity
+    candidate_revision: personal_mining_authority.term_identity.candidate_revision
+    rule: >-
+      candidate_id is the settled stable term identity. candidate_revision is
+      produced only by the current revision helper, so meaning, evidence, policy,
+      or generation changes produce a new revision while an unchanged equality
+      class keeps the same stable identity.
+  bounds:
+    term_max_utf8_bytes: 256
+    meaning_max_utf8_bytes: 4096
+    binding_max_utf8_bytes: 256
+    evidence_records_max: 100
+    reason_max_utf8_bytes: 512
+    corrected_meaning_max_utf8_bytes: 4096
+    digest_bytes: 32
+    rule: >-
+      These limits apply before downstream effects. Candidate evidence remains a
+      complete bounded projection, not a preview that can silently omit records.
+  layers:
+    evidence_capsule:
+      owner: deterministic_discovery_projection
+      schema_version: agentera.personalGlossaryCandidateCapsule.v1
+      required_fields:
+        - schema_version
+        - owner
+        - candidate_id
+        - candidate_revision
+        - term
+        - meaning
+        - scope
+        - provenance_kind
+        - evidence
+        - evidence_complete
+        - evidence_set_sha256
+        - policy_version
+        - generation
+        - capsule_sha256
+      additional_fields: forbidden
+      binding_fields: [candidate_id, candidate_revision, generation, policy_version]
+      body_digest: capsule_sha256
+      evidence_owner: deterministic_discovery_projection
+      evidence_source: personal_mining_authority.provenance
+      evidence_required_fields: provenance_variant_required_fields
+      evidence_complete: true
+      forbidden_fields:
+        - admission
+        - decision
+        - review
+        - publication
+        - mutation
+        - trusted_publication_effect
+      rule: >-
+        The capsule contains only the bounded candidate projection and complete
+        qualifying evidence identities. It has no host judgment, admission result,
+        review disposition, or publication effect.
+    host_classification_receipt:
+      owner: semantic_host_classification
+      schema_version: agentera.personalGlossaryHostClassificationReceipt.v1
+      required_fields:
+        - schema_version
+        - owner
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - candidate_projection_sha256
+        - generation
+        - policy_version
+        - classification
+        - semantic_fingerprint
+        - receipt_sha256
+      additional_fields: forbidden
+      binding_fields:
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - candidate_projection_sha256
+        - generation
+        - policy_version
+      body_digest: receipt_sha256
+      classification:
+        fields: [term, meaning, scope, permanence, consistency, confidence]
+        term: shared_primitive.fields.term
+        meaning: shared_primitive.fields.meaning
+        scope: packages/cli/src/registries/glossaryTermIdentity.ts#GlossaryCandidateScope
+        permanence: shared_primitive.fields.permanence
+        confidence: shared_primitive.fields.confidence
+        consistency_values: [consistent, inconsistent, uncertain]
+      forbidden_fields:
+        - admission
+        - decision
+        - mutation
+        - publication
+        - review_bypass
+        - trusted_publication_effect
+        - project_glossary
+        - project_publication
+      rule: >-
+        The host may classify only term, meaning, scope, permanence, consistency,
+        and confidence. The receipt binds the exact capsule, current projection,
+        revision, generation, and policy. It cannot choose admission, authorize
+        mutation, bypass review, or supply a trusted publication effect.
+    cli_decision:
+      owner: deterministic_cli_admission_validation
+      schema_version: agentera.personalGlossaryAdmissionDecision.v1
+      required_fields:
+        - schema_version
+        - owner
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - candidate_projection_sha256
+        - host_receipt_sha256
+        - classification_contract_version
+        - semantic_fingerprint
+        - generation
+        - policy_version
+        - outcome
+        - reason
+        - decision_sha256
+      additional_fields: forbidden
+      binding_fields:
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - candidate_projection_sha256
+        - host_receipt_sha256
+        - classification_contract_version
+        - semantic_fingerprint
+        - generation
+        - policy_version
+      body_digest: decision_sha256
+      outcomes: [automatic_admission, review_required, abstain]
+      reason_codes:
+        - explicit_current_authorized
+        - inferred_requires_review
+        - scope_ambiguous
+        - classification_inconsistent
+        - classification_changed
+        - entry_conflict
+        - evidence_retracted_or_conflicted
+        - quality_gate_not_authorizing
+        - scope_project
+        - evidence_unavailable
+        - evidence_changed
+      reason_codes_by_outcome:
+        automatic_admission: [explicit_current_authorized]
+        review_required:
+          - inferred_requires_review
+          - scope_ambiguous
+          - classification_inconsistent
+          - classification_changed
+          - entry_conflict
+          - evidence_retracted_or_conflicted
+          - quality_gate_not_authorizing
+        abstain: [scope_project, evidence_unavailable, evidence_changed]
+      automatic_admission:
+        owner: deterministic_cli_admission_validation
+        allowed_provenance: provenance_variants.personal_explicit_definition
+        inferred_automatic_admission: disabled
+        required_classification:
+          scope: personal
+          consistency: consistent
+          term: exact_capsule_term
+          meaning: exact_capsule_meaning
+        current_evidence: required
+        quality_gate: personal_mining_authority.admission.quality_threshold
+      command:
+        canonical: npx -y agentera@next report personal-glossary-decision
+        namespace: report
+        input_flag: --input
+        stdin_value: '-'
+        format: json
+        project_checkout: not_required
+        request:
+          schema_version: agentera.personalGlossaryAdmissionRequest.v1
+          required_fields: [schema_version, receipt]
+          additional_fields: forbidden
+          max_utf8_bytes: 16384
+        result:
+          schema_version: agentera.personalGlossaryAdmissionResult.v1
+          fields: [schemaVersion, command, status, decision, reason, effects]
+          statuses: [automatic_admission, review_required, abstain]
+          max_utf8_bytes: 4096
+          effects: []
+        receipt_construction:
+          schema_version: agentera.personalGlossaryAdmissionRequest.v2
+          required_fields: [schema_version, candidate_id, candidate_revision, candidate_capsule_sha256, candidate_projection_sha256, generation, policy_version, classification]
+          additional_fields: forbidden
+          max_utf8_bytes: 16384
+          result:
+            schema_version: agentera.personalGlossaryAdmissionResult.v2
+            fields: [schemaVersion, command, status, receipt, decision, reason, effects]
+            statuses: [automatic_admission, review_required, abstain]
+            max_utf8_bytes: 16384
+            effects: []
+        rule: >-
+          The command accepts either one existing host receipt or one bounded host
+          classification with every exact candidate binding through a structured
+          file or stdin request. For the classification request, the CLI reads the
+          current private projection, constructs the receipt including its semantic
+          fingerprint and receipt digest, computes one deterministic outcome, and
+          returns both receipt and decision. It emits JSON without changing a
+          projection, review record, profile, project glossary, or project state.
+      forbidden_fields: [host_authority, host_override, mutation, publication]
+      rule: >-
+        Only the deterministic CLI validator may emit an admission outcome. It
+        validates the capsule and host receipt bindings before any later workflow;
+        it does not itself write a profile, project glossary, or review record.
+    review_record:
+      owner: user_local_review_lifecycle
+      schema_version: agentera.personalGlossaryReviewRecord.v1
+      required_fields:
+        - schema_version
+        - owner
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - host_receipt_sha256
+        - cli_decision_sha256
+        - semantic_fingerprint
+        - generation
+        - policy_version
+        - disposition
+        - corrected_meaning
+        - corrected_scope
+        - disposed_at
+        - expires_at
+        - record_sha256
+      additional_fields: forbidden
+      binding_fields:
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - host_receipt_sha256
+        - cli_decision_sha256
+        - semantic_fingerprint
+        - generation
+        - policy_version
+      body_digest: record_sha256
+      storage: $AGENTERA_PROFILE_DIR/intermediate/personal-glossary
+      dispositions_from: [personal_mining_authority.privacy.reviews.dispositions]
+      authentication: personal_mining_authority.privacy.reviews.authentication
+      forbidden_fields:
+        - project_glossary
+        - project_publication
+        - profile_entry_mutation
+        - trusted_host_authority
+      rule: >-
+        A review record is user-local lifecycle state bound to the exact candidate,
+        semantic classification, generation, policy, and CLI decision. It is not a
+        host classification receipt and cannot mutate project or profile state by
+        itself.
+    publication_result:
+      owner: personal_profile_publication
+      schema_version: agentera.personalGlossaryPublicationResult.v1
+      required_fields:
+        - schema_version
+        - owner
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - decision_sha256
+        - review_record_sha256
+        - generation
+        - policy_version
+        - status
+        - profile_section_sha256
+        - published_at
+        - result_sha256
+      additional_fields: forbidden
+      binding_fields:
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - decision_sha256
+        - generation
+        - policy_version
+      body_digest: result_sha256
+      command: ownership_contracts.personal.profile_output.command.canonical
+      status_values_from: [ownership_contracts.personal.profile_output.command.output_statuses]
+      forbidden_fields:
+        - project_glossary
+        - project_publication
+        - consumer_precedence
+        - review_authorization
+      rule: >-
+        This is the bounded result of explicit personal-profile publication only. It binds
+        the validated decision and optional review record, reports the existing
+        personal output status, and never changes Build-owned project publication.
+  shared_invariance:
+    shared_primitive: shared_primitive
+    consumer_precedence: consumer_boundary.primary_selection
+    project_publication: ownership_contracts.project.publication
+    personal_project_isolation: ownership_contracts.personal.admission.isolation_rule
+    rule: >-
+      Candidate contracts add evidence and identity bindings without adding fields
+      to the shared glossary entry. Consumers keep project precedence and Build
+      publication unchanged; personal mining has no project glossary input.
+  recovery:
+    stale_or_mismatch: fail_closed_no_effects
+    retry: >-
+      Reject the layer before effects, reread the current bounded source contract,
+      recompute the capsule and settled identities, and retry the downstream
+      operation with all exact bindings. Never repair a stale receipt in place.
 
 provenance_variants:
   personal_explicit_definition:
@@ -63,6 +1457,10 @@ provenance_variants:
     evidence_count: 1
     required_evidence_fields: [source_id, evidence_anchor, signal_type]
     additional_evidence_fields: forbidden
+    source_provenance:
+      required_fields: [source_id, evidence_anchor, source_kind, signal_type, origin_id, content_fingerprint, author_class, session_id, project_id]
+      allowed_source_kinds: [conversation_turn]
+      identity_fields_must_match_full_record: true
     allowed_signal_types: [correction, decision, instruction]
     resolution_rule: >-
       evidence_anchor resolves to source_id of exactly one retained
@@ -73,12 +1471,63 @@ provenance_variants:
     evidence_count: 2
     required_evidence_fields: [source_id, evidence_anchor, source_kind]
     additional_evidence_fields: forbidden
+    distinctness:
+      source_ids: 2
+      evidence_anchors: 2
     allowed_source_kinds: [instruction_document, project_config_signal]
     resolution_rule: >-
       Each evidence_anchor resolves to its source_id in retained full evidence.
       Both source_id and evidence_anchor must be pairwise distinct, so two
-      signals or anchors resolving to one retained record fail. Both anchors
-      remain exposed on the entry.
+       signals or anchors resolving to one retained record fail. Both anchors
+       remain exposed on the entry.
+  personal_inferred_conversation:
+    owner: personal
+    evidence_count: variable
+    minimum_evidence_count: 3
+    required_evidence_fields:
+      - source_id
+      - evidence_anchor
+      - source_kind
+      - signal_type
+      - session_id
+      - project_id
+      - content_fingerprint
+      - author_class
+    additional_evidence_fields: forbidden
+    allowed_signal_types: [correction, decision, question, instruction, configuration]
+    allowed_source_kinds: [conversation_turn]
+    allowed_author_classes: [user]
+    distinctness:
+      source_ids: 3
+      evidence_anchors: 3
+      session_ids: 2
+      project_ids: 2
+      content_fingerprints: 3
+    completeness_field: provenance.evidence_complete
+    completeness_value: true
+    completeness_authority: expected_qualifying_anchor_set_exact_match
+    expected_evidence:
+      binding: generation_bound
+      context_fields: [generation, qualifying_evidence_anchors, qualifying_evidence_set_sha256]
+      exact_set: required
+      set_digest:
+        algorithm: sha256
+        encoding: lowercase_hex
+        canonicalization: >-
+          Hash canonical UTF-8 JSON containing the schema name, generation, and
+          lexicographically code-point-sorted qualifying evidence anchors. The
+          expected set digest is authoritative; list order is not.
+      duplicate_rule: >-
+        Reject duplicate source_id, evidence_anchor, or content_fingerprint at
+        every list length, even when the list still meets the minimum count.
+    admission: review_only
+    resolution_rule: >-
+      Retain every qualifying user-authored conversation record. At least three
+      pairwise-distinct source identities, anchors, and content fingerprints must
+      span at least two sessions and two projects. Agent-authored text may
+      corroborate a later review but cannot satisfy this variant. The evidence
+      list is complete, not a bounded preview; any unresolved, duplicated, or
+      missing identity fails.
   project_file:
     owner: project
     evidence_count: 1
@@ -97,14 +1546,21 @@ ownership_contracts:
       status: active_partial
       active:
         - bounded_admission
+        - bounded_explicit_discovery
+        - bounded_candidate_projection
+        - bounded_candidate_retrieval
+        - public_receipt_construction
+        - host_classification_receipt_validation
+        - deterministic_cli_admission_decision
         - explicit_classification
         - inferred_evidence_check
-        - profile_full_rendering
-        - profile_persistence
+        - authorized_personal_publication
+        - profile_section_persistence
       inactive: [lookup]
     allowed_provenance:
       - personal_explicit_definition
       - personal_inferred_usage
+      - personal_inferred_conversation
     input:
       tier: signal
       authority: references/analysis/evidence-tier-authority.yaml
@@ -121,10 +1577,13 @@ ownership_contracts:
       explicit:
         candidate_signal_types: [correction, decision]
         language_rule: >-
-          Admit only a quoted or code-delimited term followed by explicit
-          `means` language, or clarification language that combines `to clarify`
-          with `prefer` and `to mean`. The classifier returns the stated term
-          and meaning; unrelated correction or decision language abstains.
+          The bounded explicit discovery grammar accepts only the ten forms in
+          personal_mining_authority.explicit_discovery. Quoted or code-delimited
+          means, standalone safe definition-list colons, exact acronym expansions,
+          By X I mean Y, Use X for/to mean Y, To clarify X refers to Y, the
+          clarification prefer form, and approved correction means forms are
+          recognized. YAML/config labels, times, URLs, headings, citations,
+          indirect questions, future language, and unbound prose are rejected.
         evidence_count: 1
       inferred:
         candidate_signal_types: [instruction, configuration]
@@ -153,10 +1612,10 @@ ownership_contracts:
       permanence: Remains independently classified and is not changed by evidence age or confidence decay.
       authority: packages/cli/src/capabilities/profile/instructions.ts#Profile-format
     profile_output:
-      owner: profile_full
+      owner: personal_profile_publication
       lifecycle_callable: packages/cli/src/analytics/personalGlossaryProfile.ts#updatePersonalGlossaryProfile
       command:
-        canonical: npx -y agentera@next report profile-glossary
+        canonical: npx -y agentera@next report personal-glossary-publish
         namespace: report
         input_flag: --input
         stdin_value: "-"
@@ -164,25 +1623,53 @@ ownership_contracts:
         dry_run_flag: --dry-run
         project_checkout: not_required
         request:
-          schema_version: agentera.personalGlossaryUpdateRequest.v1
-          required_fields: [schema_version, profile_path, as_of, fresh_entries, retained_history]
+          schema_version: agentera.personalGlossaryPublishRequest.v1
+          required_fields: [schema_version, receipt, decision, as_of]
+          optional_fields: [review_authorization]
           additional_fields: forbidden
+          max_utf8_bytes: 16384
           profile_path_rule: >-
-            Pass exactly profile_context.profile.path returned by
-            npx -y agentera@next prime --context profile --format json. The command never
-            discovers a profile, project root, or project glossary.
-          retained_history_shape: >-
-            A list of source_id, evidence_anchor, source_kind, and signal_type
-            records sufficient to validate fresh admitted entries. It may be
-            empty when regeneration supplies no fresh entries because retained
-            entries carry persisted provenance.
+            Resolve only $AGENTERA_PROFILE_DIR/PROFILE.md through the canonical
+            user-profile authority. The request cannot select a path, project
+            root, project glossary, or other artifact.
+          current_decision_rule: >-
+            Accept either a complete CLI-owned automatic_admission decision with
+            explicit_current_authorized reason and no review authorization, or one
+            current review_required decision with an exact stored accept or correct
+            authorization. Before effects, revalidate the current projection,
+            capsule, receipt, generation, policy, semantic fingerprint, current
+            meaning and revision, scope, conflict, retraction, secret content, and
+            the existing decision rules. A review authorization never skips current
+            evidence validation and does not permit project scope.
+          review_authorization:
+            required_fields: [review_id, review_record_sha256]
+            additional_fields: forbidden
+            dispositions: [accept, correct]
+            source: personal_mining_authority.review_records.disposition.publication_authorization
+            rule: >-
+              The command rereads one current user-local review record, validates its
+              canonical record hash and all receipt, decision, projection, policy,
+              semantic-fingerprint, and revision bindings, then uses its approved
+              corrected meaning and personal scope only for correct. No direct review
+              record, correction, key, nonce, signature, profile path, or project path
+              is accepted from publication input.
+          date_rule: >-
+            as_of is one injected ISO calendar date. Use it for lifecycle
+            rendering and derive published_at as UTC midnight of that exact date;
+            never read the wall clock for publication content or replay.
+        result:
+          schema_version: agentera.personalGlossaryPublicationResult.v1
+          fields: [schema_version, owner, candidate_id, candidate_revision, candidate_capsule_sha256, decision_sha256, review_record_sha256, generation, policy_version, status, profile_section_sha256, published_at, result_sha256]
+          max_utf8_bytes: 4096
         output_statuses: [changed, unchanged_replay, dry_run_candidate]
         rule: >-
-          The packaged headless command validates the complete request before
-          effects and invokes the lifecycle_callable without duplicating merge,
-          decay, replacement, or persistence behavior. JSON is written to
-          stdout; diagnostics use the shared invalid-input envelope. Dry-run
-          computes the candidate without writing PROFILE.md.
+          The packaged headless command accepts only one bounded structured
+          receipt and CLI decision, revalidates authorization immediately before
+          effects, and invokes the lifecycle_callable without duplicating merge,
+          decay, replacement, or persistence behavior. It changes only the owned
+          PROFILE.md Glossary section. JSON output contains opaque bindings only;
+          diagnostics use stable generic envelopes. Dry-run computes a candidate
+          without writing PROFILE.md.
       section:
         heading: "## Glossary"
         start_marker: "<!-- agentera:personal-glossary:start -->"
@@ -221,10 +1708,19 @@ ownership_contracts:
         repeated compounding from already-decayed confidence. Age alone never
         removes an entry.
       isolation_rule: >-
-        The command and callable accept only a PROFILE.md path, fresh personal
-        entries, retained personal-history evidence, and an injected ISO date.
-        They have no project root, project glossary parameter, artifact lookup,
-        or project file read.
+        The command accepts only one receipt, one CLI decision, and an injected
+        ISO date. It resolves the canonical user PROFILE.md path itself and has
+        no project root, project glossary parameter, artifact lookup, or project
+        file read.
+      filesystem:
+        authority: host_filesystem
+        configured_path: canonical_user_profile_authority
+        outcomes: ordinary_permissions_and_io
+        same_user_path_manipulation: outside_agentera_threat_model
+        symlink_confinement: not_claimed
+        rule: >-
+          Profile storage uses ordinary current-user filesystem permissions and
+          atomic replacement. This contract does not claim symlink confinement.
   project:
     scope: repository
     implementation:
@@ -1182,9 +2678,10 @@ consumer_boundary:
   rule: >-
     Audit remains mutation-free and Build project-glossary publication is active.
     Build, Discuss, Plan, and prime bounded glossary consumption are active, and
-    Build progress caveat publication is active. Personal Profile Full rendering
-    and persistence are active. Project-driven personal-profile mutation and
-    docs-mapping mutation remain deferred.
+    Build progress caveat publication and explicit personal publication are active.
+    Profile Full preserves an existing owned section, then uses only the current
+    consent-bound personal generation and canonical authorized personal publication.
+    Project-driven personal-profile mutation and docs-mapping mutation remain deferred.
 
 deferred_capability_contracts:
   profile:
@@ -1193,13 +2690,14 @@ deferred_capability_contracts:
     intended_behavior: personal_glossary_synthesis
     active_behavior:
       - ownership_contracts.personal.admission
-      - ownership_contracts.personal.profile_output
+      - personal_mining_authority.profile_full
     inactive_behavior: [lookup]
     contracts:
       admission: ownership_contracts.personal.input
       provenance: ownership_contracts.personal.allowed_provenance
       confidence: shared_primitive.fields.confidence
       retention_and_decay: ownership_contracts.personal.retention_and_decay
+      profile_full: personal_mining_authority.profile_full
     forbidden_current_claims: [lookup, project_glossary_consumption]
   audit:
     capabilities: [audit]