agentera 3.0.0-dev.8 → 3.0.0-dev.80

package/bundle/references/artifacts/glossary-entry-contract.yaml

@@ -0,0 +1,2906 @@
+schema_version: agentera.glossaryEntryContract.v1
+status: active_authority
+purpose: >-
+  Define glossary entry semantics once, specialize evidence ownership for
+  personal and project entries, and declare one consumer-semantics and caveat
+  lifecycle contract with bounded acquisition and shared advice resolution.
+  Build, Discuss, Plan, and prime consumption are active. Build alone owns
+  durable caveat publication; prime projects only bounded review attention.
+
+authority:
+  source: references/artifacts/glossary-entry-contract.yaml
+  confidence: skills/agentera/protocol.yaml#CONFIDENCE_SCALE
+  personal_history: references/analysis/evidence-tier-authority.yaml
+  permanence_decay: packages/cli/src/capabilities/profile/instructions.ts#Profile-format
+  single_source_rule: >-
+    Producers and consumers derive entry shape from shared_primitive and must
+    not restate confidence bands, decay constants, or provenance variants.
+
+shared_primitive:
+  required_fields: [term, meaning, confidence, permanence, temporal, provenance]
+  fields:
+    term:
+      type: non_empty_string
+    meaning:
+      type: non_empty_string
+    confidence:
+      type: integer
+      range_from: skills/agentera/protocol.yaml#CONFIDENCE_SCALE
+    permanence:
+      type: enum
+      values: [stable, durable, situational]
+      classification_rule: >-
+        Classify expected persistence independently from evidence strength.
+        Confidence changes never reclassify permanence.
+    temporal:
+      type: object
+      required_fields: [observed_at, last_confirmed_at]
+      field_type: iso_date
+    provenance:
+      type: discriminated_union
+      discriminator: kind
+      evidence_field: evidence
+      variants_from: provenance_variants
+
+term_occurrence:
+  runtime: packages/cli/src/registries/glossaryTermOccurrence.ts#containsGlossaryTerm
+  consumers: [audit_evidence, project_publication_revalidation, confirmed_variant_guard]
+  comparison: exact_case_sensitive_literal
+  normalization: none
+  identifier_continuation: unicode_ID_Continue_plus_dollar_ZWNJ_ZWJ
+  rule: >-
+    Match one escaped literal without case folding or Unicode normalization.
+    When a term edge is an identifier-continuation character, reject an
+    occurrence adjacent to Unicode ID_Continue, dollar sign, U+200C ZERO WIDTH
+    NON-JOINER, or U+200D ZERO WIDTH JOINER. These are the ECMAScript identifier
+    continuation characters relevant to source-line terminology boundaries.
+     Literal escaping and fixed-width boundary assertions prevent regex syntax,
+     partial identifier matches, and input-dependent backtracking.
+
+personal_mining_authority:
+  status: active_partial
+  design_proposal_reconciliation:
+    proposal: docs/notes/personal-glossary-mining-design.md
+    proposal_authority: non_authoritative_external_note_not_tracked_in_this_checkout
+    implementation_status: shipped_with_inferred_admission_deferred
+    shipped:
+      - consented_refresh_produces_generation_bound_candidate_projection
+      - fixed_key_aggregate_candidate_and_abstention_explanations
+      - profile_full_preserves_existing_glossary_before_authorized_publication
+    deferred:
+      - inferred_automatic_admission
+    canonical_status: this_contract
+  implementation_boundary: >-
+     This section settles personal glossary mining identity, evidence provenance,
+      consent, privacy, lifecycle, bounded explicit-discovery, public receipt construction,
+     and deterministic decision authority. The runtime performs bounded discovery,
+       candidate projection, private candidate retrieval, deterministic CLI
+       validation of host semantic evidence, explicit authorized personal
+       publication, and Profile Full integration. It does not perform host
+       semantic classification, project or public-state candidate reads, or
+       project glossary integration. The consented refresh command is the shipped
+       projection producer. Inferred candidates remain review-required or abstain;
+       they are not automatically admitted.
+  preserved_decisions: [prmnztjytv, mcsmqqitnm, zyvgyvjnsv]
+  replacement:
+    shared_primitive: shared_primitive
+    personal_owner: ownership_contracts.personal
+    project_owner: ownership_contracts.project
+    consumer_precedence: consumer_boundary.primary_selection
+    project_publication: ownership_contracts.project.publication
+    allowed_effects: [personal_profile_output]
+    forbidden_effects:
+      - project_glossary_read
+      - project_glossary_mutation
+      - project_publication_replacement
+      - consumer_precedence_change
+      - personal_project_merge
+    rule: >-
+      Mining may replace only the user-owned personal profile glossary through
+      the existing personal profile output lifecycle. It never reads or writes
+      project glossary state, changes consumer precedence, or changes the
+      Build-owned digest-confirmed project publication operation.
+  explicit_discovery:
+    status: active
+    runtime: packages/cli/src/analytics/personalGlossaryExplicit.ts#discoverExplicitGlossaryCues
+    mining_runtime: packages/cli/src/analytics/personalGlossaryExplicitMining.ts#mineExplicitGlossaryCandidates
+    input: bounded_signal_tier_plus_direct_single_anchor_resolution
+    output: evidence_capsule_plus_exact_source_spans_only
+    scope_window: current_sentence_and_one_adjacent_sentence_each_side
+    scope_binding: explicit_scope_marker_must_contain_the_term_or_be_a_direct_qualifier
+    span_encoding: utf8_byte_offsets
+    strings: preserve_exact_source_bytes_without_unicode_normalization
+    adjacent_direct_reference_exclusion:
+      references:
+        - this_definition
+        - this_term
+        - this_meaning
+        - following_definition
+        - following_term
+        - following_meaning
+      qualifiers: [question, example, future, hypothetical]
+      binding:
+        preceding_sentence: following_reference_only
+        following_sentence: this_reference_only
+        exact_literal_term: either_direction
+    grammar:
+      forms:
+        - id: quoted_means
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: quoted_or_code_delimited_term_means_meaning
+          term: one_balanced_supported_quote_or_backtick_delimited_span
+        - id: definition_list_colon
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: standalone_safe_definition_list_term_colon_meaning
+          prefix: sentence_or_line_start_with_optional_markdown_list_bullet
+          unmarked_terms:
+            - quoted_or_code_delimited_term
+            - uppercase_acronym_with_exact_expansion_initials
+          markers: [definition, term]
+          marked_term: bounded_nonempty_term
+          bare_multiword_term_without_marker: reject
+          meaning_start: nonempty_same_physical_line
+          continuation: after_nonempty_inline_meaning_within_maximum_meaning_bound_only
+          empty_marker_structure: reject_immediately_following_colon_line
+          exclusions: yaml_config_labels_times_urls_headings_citations_and_labels
+        - id: acronym_stands_for
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: bounded_acronym_stands_for_expansion
+          validation: expansion_initials_must_match_acronym_exactly
+        - id: acronym_parenthetical
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: bounded_acronym_parenthesized_expansion_or_reverse
+          validation: expansion_initials_must_match_acronym_exactly
+        - id: by_i_mean
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: by_term_i_mean_meaning
+        - id: use_for
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: use_term_for_meaning
+        - id: use_to_mean
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: use_term_to_mean_meaning
+        - id: refers_to
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: term_refers_to_meaning
+        - id: clarification_prefer_to_mean
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: to_clarify_i_prefer_term_to_mean_meaning
+        - id: correction_means
+          segment_class: explicit_cue_segment
+          entry: outside_approved_cue
+          termination: shared_bounded_termination
+          output: shared_cue_segment_output
+          syntax: approved_correction_prefix_quoted_or_code_term_means_meaning
+          prefixes: [actually, correction, not_quite, instead, rather]
+      bounds:
+        maximum_term_utf8_bytes: 256
+        maximum_meaning_utf8_bytes: 4096
+        maximum_acronym_utf8_bytes: 32
+        maximum_acronym_words: 32
+      segment_grammar:
+         schema_version: agentera.personalGlossarySegmentGrammar.v1
+         segment_class: explicit_cue_segment
+         states: [outside, cue, inline_meaning, continuation, structural_config, terminated, rejected]
+         input_classes:
+           - approved_cue
+           - non_empty_inline_meaning
+           - continuation_line
+           - blank_line
+           - next_cue
+           - structural_fragment
+           - comment
+           - list_boundary
+           - indentation
+           - nested_marker
+           - block_scalar
+           - prose
+           - unsupported
+           - eof
+         initial_state: outside
+         terminal_states: [terminated, rejected]
+         entry:
+           from: outside
+           input: approved_cue
+           to: cue
+           accepted_forms:
+             - quoted_means
+             - definition_list_colon
+             - acronym_stands_for
+             - acronym_parenthetical
+             - by_i_mean
+             - use_for
+             - use_to_mean
+             - refers_to
+             - clarification_prefer_to_mean
+             - correction_means
+           unsupported_reason: unsupported_transition
+         termination:
+           start_state: inline_meaning
+           continuation_state: continuation
+           terminal_state: terminated
+           required: non_empty_inline_meaning
+           boundary_inputs: [blank_line, next_cue, structural_fragment, comment, list_boundary]
+           maximum_meaning_utf8_bytes: 4096
+           limit: inclusive
+           over_limit_reason: meaning_bound_exceeded
+         output:
+           fields: [term, meaning, term_span, meaning_span]
+           span_encoding: utf8_byte_offsets
+           source_semantics: exact_source_bytes_without_unicode_normalization
+         continuation:
+           starts_after: non_empty_inline_meaning
+           preserves: exact_source_newlines_and_utf8_bytes
+           stops_on: [blank_line, next_cue, structural_fragment, comment, list_boundary]
+           maximum_utf8_bytes: 4096
+           limit: inclusive
+           over_limit: reject
+           over_limit_reason: meaning_bound_exceeded
+         structural_configuration:
+           state: structural_config
+           entry_inputs: [structural_fragment, list_boundary]
+           persist_inputs: [comment, blank_line, indentation, nested_marker, block_scalar, structural_fragment, list_boundary]
+           reject_inputs: [comment, blank_line, indentation, nested_marker, block_scalar, structural_fragment, list_boundary, approved_cue]
+           exit:
+             input: prose
+             condition: top_level_nonempty_noncomment_nonmarker_nonstructural_line
+             action: reject_fragment_then_exit
+             next_state: outside
+             definition_allowed: next_physical_line_only
+         reference_binding:
+           following: nearest_next_cue
+           this: nearest_previous_cue
+           exact_term: nearest_matching_cue
+           matching: unicode_caseless_exact_no_normalization
+           duplicate_target_reason: ambiguous_reference
+           missing_target_reason: ambiguous_reference
+           duplicate_target_outcome: exclude_bound_cue_only
+           missing_target_outcome: exclude_bound_cue_only
+           unrelated_cue_outcome: retain
+         deduplication:
+           identity: personal_mining_authority.term_identity.stable_term_identity
+           same_identity_same_meaning: retain_one_earliest_source_span
+           same_identity_different_meaning: reject_all_conflicting_meaning
+           unrelated_cue_outcome: retain
+         canonical_order:
+           fields: [term, meaning, term_span.start, meaning_span.start]
+           comparator: unicode_scalar_code_point_ascending
+           direction: ascending
+         transitions:
+           - {from: outside, input: approved_cue, to: cue, action: enter_cue_segment}
+           - {from: outside, input: structural_fragment, to: structural_config, action: enter_structural_config, reason: structural_fragment}
+           - {from: outside, input: list_boundary, to: structural_config, action: enter_structural_config, reason: structural_fragment}
+           - {from: outside, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           - {from: cue, input: non_empty_inline_meaning, to: inline_meaning, action: capture_inline_meaning}
+           - {from: cue, input: blank_line, to: rejected, action: reject, reason: empty_meaning}
+           - {from: cue, input: next_cue, to: rejected, action: reject, reason: empty_meaning}
+           - {from: cue, input: structural_fragment, to: rejected, action: reject, reason: empty_meaning}
+           - {from: cue, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           - {from: inline_meaning, input: continuation_line, to: continuation, action: append_original_newline}
+           - {from: inline_meaning, input: blank_line, to: terminated, action: finish_before_boundary}
+           - {from: inline_meaning, input: next_cue, to: terminated, action: finish_before_boundary}
+           - {from: inline_meaning, input: structural_fragment, to: terminated, action: finish_before_boundary}
+           - {from: inline_meaning, input: comment, to: terminated, action: finish_before_boundary}
+           - {from: inline_meaning, input: list_boundary, to: terminated, action: finish_before_boundary}
+           - {from: inline_meaning, input: prose, to: continuation, action: append_original_newline}
+           - {from: inline_meaning, input: eof, to: terminated, action: finish_at_eof}
+           - {from: inline_meaning, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           - {from: continuation, input: continuation_line, to: continuation, action: append_original_newline}
+           - {from: continuation, input: prose, to: continuation, action: append_original_newline}
+           - {from: continuation, input: blank_line, to: terminated, action: finish_before_boundary}
+           - {from: continuation, input: next_cue, to: terminated, action: finish_before_boundary}
+           - {from: continuation, input: structural_fragment, to: terminated, action: finish_before_boundary}
+           - {from: continuation, input: comment, to: terminated, action: finish_before_boundary}
+           - {from: continuation, input: list_boundary, to: terminated, action: finish_before_boundary}
+           - {from: continuation, input: eof, to: terminated, action: finish_at_eof}
+           - {from: continuation, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           - {from: structural_config, input: approved_cue, to: rejected, action: reject, reason: structural_fragment}
+           - {from: structural_config, input: structural_fragment, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: comment, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: blank_line, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: indentation, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: nested_marker, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: block_scalar, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: list_boundary, to: structural_config, action: reject_structural_fragment, reason: structural_fragment}
+           - {from: structural_config, input: prose, to: outside, action: reject_fragment_then_exit, reason: structural_fragment}
+           - {from: structural_config, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           - {from: structural_config, input: eof, to: rejected, action: reject, reason: structural_fragment}
+           - {from: terminated, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           - {from: rejected, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+         fallback_transitions:
+           outside: {from: outside, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           cue: {from: cue, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           inline_meaning: {from: inline_meaning, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           continuation: {from: continuation, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           structural_config: {from: structural_config, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           terminated: {from: terminated, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+           rejected: {from: rejected, input: unsupported, to: rejected, action: reject, reason: unsupported_transition}
+         reasons:
+           unsupported_transition: unsupported_transition
+           structural_fragment: structural_fragment
+           empty_meaning: empty_meaning
+           meaning_bound_exceeded: meaning_bound_exceeded
+           ambiguous_reference: ambiguous_reference
+           conflicting_meaning: conflicting_meaning
+           invalid_exit_boundary: invalid_exit_boundary
+    exclusions:
+      - examples
+      - mere_mentions
+      - direct_or_indirect_questions
+      - negations
+      - hypotheticals_conditionals
+      - future_language
+      - deterministic_sarcasm_markers
+      - quotations_attributed_to_others
+      - retractions_or_replacements_bound_to_the_same_term
+      - project_qualified_scope
+      - malformed_empty_or_oversized_spans
+      - incomplete_or_invalid_source_provenance
+    provenance:
+      required_source_fields:
+        - source_id
+        - evidence_anchor
+        - source_kind
+        - signal_type
+        - origin_id
+        - content_fingerprint
+        - author_class
+        - session_id
+        - project_id
+      allowed_source_kinds: [conversation_turn]
+      identity_fields_must_match_full_record: true
+      user_author_class: user
+      unresolved_or_invalid: stable_provenance_abstention
+  term_identity:
+    equality:
+      runtime: packages/cli/src/registries/glossaryTermIdentity.ts#unicodeCaselessExact
+      semantics: unicode_caseless_exact_no_normalization
+      rule: >-
+        Equality remains the existing locale-independent ECMAScript Unicode
+        caseless-exact matcher. Canonical, compatibility, accent, and locale
+        normalization are not added to equality.
+    stable_term_identity:
+      schema_version: agentera.personalGlossaryTermIdentity.v1
+      runtime: packages/cli/src/registries/glossaryTermIdentity.ts#stableGlossaryTermIdentity
+      algorithm: sha256
+      encoding: lowercase_hex
+      canonical_input: ecmascript_simple_case_fold_key
+      no_unicode_normalization: true
+      key_rule: >-
+        For each Unicode scalar, use its one-scalar locale-independent lowercase
+        mapping. Also derive the lowercase mapping of its one-scalar uppercase
+        mapping, but use that alternate only when unicodeCaselessExact confirms
+        the original scalar and alternate are equal. Concatenate those selected
+        scalars without normalization, then hash the resulting UTF-8 key with the
+        versioned schema name. This follows the exact matcher, including keeping
+        ASCII I and dotless ı distinct.
+      invariant: >-
+        Stable identity is an identifier for the existing equality class, not a
+        new comparison rule. It never lowercases, normalizes, trims, or changes
+        the term stored in a shared entry.
+    candidate_revision:
+      schema_version: agentera.personalGlossaryCandidateRevision.v1
+      runtime: packages/cli/src/registries/glossaryTermIdentity.ts#glossaryCandidateRevision
+      algorithm: sha256
+      encoding: lowercase_hex
+      canonicalization: >-
+        Hash canonical UTF-8 JSON with recursively code-point-sorted object keys,
+        preserved string bytes, and evidence records sorted by their canonical
+        JSON. The schema name, stable_term_identity, meaning, scope, complete
+        evidence identity set, policy_version, and generation are all included.
+        No field may be omitted, reordered semantically, normalized, or replaced
+        by a display label.
+      bound_fields:
+        - stable_term_identity
+        - meaning
+        - scope
+        - evidence
+        - policy_version
+        - generation
+      policy_version: agentera.personalGlossaryMiningPolicy.v1
+      generation: content_addressed_candidate_projection_generation
+      evidence: complete_source_id_anchor_identity_set
+      replay_rule: >-
+        A changed meaning, scope, evidence identity set, policy version, or
+        candidate generation creates a new revision. Identical canonical inputs
+        create the same revision and do not imply a second candidate.
+  provenance:
+    existing_inferred_variant: provenance_variants.personal_inferred_usage
+    conversation_variant: provenance_variants.personal_inferred_conversation
+    evolution:
+      status: explicit_append_only_extension
+      shared_primitive: unchanged
+      existing_variant_rule: >-
+        The firm two-independent-record instruction/configuration route remains
+        exactly two records with both anchors exposed.
+      conversation_rule: >-
+        Conversation inference uses the explicit conversation provenance variant
+        and retains every qualifying evidence record. It never projects a longer
+        evidence set into the two-record variant.
+      audit_rule: >-
+        The provenance kind, complete-evidence marker, source identities, anchors,
+        session identities, project identities, author class, and content
+        fingerprints remain inspectable by the later validator. Missing metadata,
+        unresolved anchors, or incomplete evidence fail closed.
+  consent_lifecycle:
+    authority: references/analysis/evidence-tier-authority.yaml
+    operation: Profile_Full
+    policy: reuse_existing_generation
+    refresh: forbidden_during_profile_full
+    reuse: >-
+      Profile Full may consume one existing local-history generation only when a
+      valid local-history consent binding and a readable current generation are
+      already present. Profile Full never refreshes, discovers, or rereads local
+      history to obtain consent.
+    discriminator:
+      inputs: [consent_status, generation_status, coverage_status, signal_tier_bounded]
+      order: [absent, stale, degraded, present]
+      values:
+        consent_status: [absent, valid, stale]
+        generation_status: [absent, current, stale]
+        coverage_status: [complete, cap_selected, truncated, flagged_incomplete]
+        signal_tier_bounded: [true, false]
+      predicates:
+        absent: consent_absent_or_generation_absent
+        stale: after_absent_consent_or_generation_stale
+        degraded: valid_current_actual_cap_truncation_or_flagged_incomplete
+        present: valid_current_complete_any_boundedness
+      exclusivity: >-
+        Evaluate the ordered predicates exactly once and select the first match.
+        Absent wins over stale, stale wins over degraded, and degraded wins over
+        present. No input tuple may select two states.
+      boundedness_rule: >-
+        A signal tier being inherently bounded does not make a generation
+        degraded. Degraded requires actual cap selection, truncation, or flagged
+        incomplete coverage.
+    states:
+      present:
+        condition: valid_current_complete_any_boundedness
+        action: reuse_generation_once_for_bounded_mining
+        result: mining_authorized
+      absent:
+        condition: consent_absent_or_generation_absent
+        action: skip_mining_without_read_or_refresh
+        result: degraded_consent_required
+      stale:
+        condition: after_absent_consent_or_generation_stale
+        action: reject_generation_for_new_mining_and_preserve_existing_entries
+        result: degraded_refresh_required
+      degraded:
+        condition: valid_current_actual_cap_truncation_or_flagged_incomplete
+        action: reuse_only_as_degraded_evidence_without_automatic_admission
+        result: degraded_coverage
+    recovery:
+      command: npx -y agentera@next report refresh --consent local-history
+      explicit_consent: required
+      after_refresh: retry_profile_full_with_the_new_generation
+      forbidden: [live_extraction_without_consent, silent_refresh, stale_generation_reuse]
+      rule: >-
+        Absent, stale, and degraded states expose the same explicit refresh
+        recovery without inspecting raw history. Recovery never changes project
+        state or project glossary publication.
+  profile_full:
+    status: active
+    entrypoint: Profile_Full
+    base_profile_order: write_base_profile_before_personal_glossary
+    existing_generation:
+      source: existing_consent_bound_user_local_candidate_projection
+      generation_count: 1
+      binding_fields: [generation, policy_version, candidate_projection_sha256]
+      list_limit: 20
+      continuation: forbidden
+      degraded: explicit_refresh_required_without_candidate_classification_or_publication
+      forbidden_effects:
+        - history_refresh
+        - history_collection
+        - candidate_discovery
+        - candidate_projection_write
+        - new_generation
+        - project_glossary_read
+      unavailable: preserve_base_profile_and_owned_section
+    deterministic_admission:
+      host_classification: semantic_evidence_not_admission_authority
+      command: candidate_contracts.layers.cli_decision
+      automatic: explicit_current_authorized_only
+      inferred: review_or_abstain
+    review:
+      queue_before_question: true
+      question_channel_maximum: 3
+      no_question_channel: durable_queue
+      output: bounded_review_cards_and_summary
+    publication:
+      command: ownership_contracts.personal.profile_output
+      automatic: explicit_current_authorized_only
+      no_decision_synthesis: true
+      failure: preserve_base_profile_and_owned_section
+    output:
+      profile_path: canonical_user_profile_authority
+      terminal: compact_bounded_summary
+  privacy:
+    owner: current_user
+    scope: user_local
+    storage:
+      root: $AGENTERA_PROFILE_DIR/intermediate/personal-glossary
+      project_storage: forbidden
+      records: [candidate_metadata, safe_excerpts, review_metadata, review_dispositions]
+      project_state: unchanged
+      filesystem:
+        authority: host_filesystem
+        configured_path: use_as_provided
+        outcomes: ordinary_permissions_and_io
+        same_user_path_manipulation: outside_agentera_threat_model
+        symlink_confinement: not_claimed
+        malformed_candidate_projection_replacement_exception:
+          scope: malformed_candidate_projection_replacement_only
+          authorization: explicit_consented_refresh_only
+          precondition: existing_owned_regular_file_is_malformed
+          target: exact_configured_candidate_projection_file
+          inspection: lstat_exact_target_without_following_symlinks
+          required_type: regular_file
+          reject: [symlink, non_regular_file, configured_path_mismatch, path_escape]
+          operation: atomic_regular_file_replacement
+          outside_scope: configured_path_use_as_provided
+        rule: >-
+          Agentera uses the configured profile path as provided. The host
+          filesystem owns permissions, symlink behavior, and same-user path
+          manipulation. Agentera does not add realpath or no-follow confinement
+          except when an explicit consented refresh replaces its malformed
+          candidate projection. That operation inspects only the exact configured
+          target without following a final symlink, requires a regular file, and
+          rejects symlinks, non-files, target mismatches, and path escapes. All
+          other operations keep the configured-path behavior above.
+      rule: >-
+        Agentera deliberately selects only the configured user profile path for
+        mining records. It never selects .agentera, TODO.md, progress, the
+        project glossary, or another project path as projection storage. A user
+        configuration or same-user filesystem change does not become an
+        Agentera path-confinement claim.
+    content_exclusion:
+      owner: glossary_content_policy
+      classification: actual_secret_or_sensitive_value
+      conceptual_terminology: eligible
+      candidate_fields: [term, meaning]
+      candidate_action: reject_before_projection
+      candidate_reason: secret_content
+      excerpt_action: omit_complete_excerpt_before_projection
+      secret_classes:
+        - api_keys
+        - access_tokens
+        - passwords
+        - cookies
+        - private_keys
+        - authorization_headers
+        - personal_contact_data
+        - session_identifiers
+        - runtime_store_paths
+      rule: >-
+        A term or meaning containing an actual credential, session, or other
+        sensitive value is not a glossary candidate and is rejected with the
+        stable secret_content reason. Field names and ordinary conceptual
+        terminology remain eligible. If candidate-adjacent context contains an
+        actual secret or sensitive value, omit the complete excerpt. Never redact
+        and retain part of that excerpt.
+    excerpts:
+      purpose: bounded_review_context_only
+      max_utf8_bytes: 500
+      forbidden_content:
+        - raw_transcript
+        - raw_tool_arguments
+        - raw_runtime_store_paths
+        - raw_session_identifiers
+        - secret_or_sensitive_content
+        - unrelated_conversation
+      failure: omit_complete_excerpt_before_persistence
+    reviews:
+      owner: current_user
+      required_fields:
+        - candidate_id
+        - candidate_revision
+        - semantic_fingerprint
+        - generation
+        - policy_version
+        - disposition
+        - disposed_at
+      dispositions: [accept, correct, reject, defer]
+      trusted_disposition_authority: current_user
+      authentication:
+        receipt_schema_version: agentera.personalGlossaryReviewApproval.v1
+        issuer: agentera-local-host
+        subject: current_user
+        trusted_channel: agentera-local-host-ipc
+        required_fields:
+          - schema_version
+          - issuer
+          - subject
+          - trusted_channel
+          - review_id
+          - candidate_id
+          - candidate_revision
+          - candidate_projection_sha256
+          - semantic_fingerprint
+          - generation
+          - policy_version
+          - disposition
+          - corrected_meaning
+          - corrected_scope
+          - disposed_at
+          - expires_at
+          - nonce
+          - signature
+        proof: >-
+          The local host signs an explicit current-user action. The verifier
+          checks the trusted host public key before accepting the receipt; a
+          model, agent, imported transcript, or unbound text field cannot create
+          proof by asserting issuer or subject values.
+        binding_fields: [review_id, candidate_id, candidate_revision, candidate_projection_sha256, semantic_fingerprint, generation, policy_version, disposition, corrected_meaning, corrected_scope, disposed_at]
+        forbidden_principals: [agent, model, imported_record, generic_consent]
+        correction:
+          correct_fields: [corrected_meaning, corrected_scope]
+          non_correct_values: null
+          corrected_scope_values: [personal]
+          corrected_meaning_max_utf8_bytes: 4096
+          rule: >-
+            Only a signed correct action may carry a complete bounded corrected
+            meaning and the personal scope. Other dispositions carry null correction
+            fields. Corrected content remains user-local review metadata and must
+            pass the same secret and sensitive-content exclusion as a candidate.
+        signature:
+          algorithm: ed25519
+          encoding: base64url
+          key_source: user_local_trusted_host_key
+          signed_fields:
+            - schema_version
+            - issuer
+            - subject
+            - trusted_channel
+            - review_id
+            - candidate_id
+            - candidate_revision
+            - candidate_projection_sha256
+            - semantic_fingerprint
+            - generation
+            - policy_version
+            - disposition
+            - corrected_meaning
+            - corrected_scope
+            - disposed_at
+            - expires_at
+            - nonce
+          verification: trusted_host_public_key_signature_check
+        freshness:
+          max_age_seconds: 300
+          disposed_at: trusted_host_clock
+          expires_at_required: true
+          rule: disposed_at_must_not_be_future_and_expires_at_must_be_after_now
+        replay:
+          nonce: required_unique_receipt_nonce
+          index: user_local_consumed_receipt_digest_index
+          exact_replay: no_op_only_when_nonce_and_receipt_digest_match
+          conflicting_replay: reject_reused_nonce_with_changed_bindings_or_signature
+        terminal_disposition:
+          terminal: [accept, correct, reject]
+          pending: [defer]
+    retention:
+      pending_excerpt_days: 30
+      terminal_excerpt_days: 0
+      review_metadata_days_after_terminal: 90
+      accepted_entry: ownership_contracts.personal.retention_and_decay
+      pending_review_metadata: retained_until_terminal_or_purge
+      terminal_review_metadata: retained_for_90_days_after_disposition
+      rule: >-
+        Safe excerpts expire after 30 days and are removed immediately when a
+        review becomes terminal. Disposition metadata remains for 90 days after
+        a terminal disposition to suppress the same revision, then expires.
+        Accepted glossary entries follow the existing personal profile decay
+        authority and never retain an excerpt.
+    purge:
+      authority: current_user
+      trigger: explicit_authenticated_user_request_or_retention_expiry
+      removes: [candidate_metadata, safe_excerpts, review_metadata, review_dispositions]
+      behavior: atomic_remove_user_local_records_before_next_read
+      project_state: untouched
+      profile_entry: not_implicitly_deleted
+      boundaries:
+        pending: purge_removes_excerpt_and_metadata_immediately
+        terminal: purge_removes_excerpt_and_metadata_before_next_read
+        accepted_profile_entry: purge_does_not_implicitly_delete_profile_entry
+      recovery: >-
+        A purge is local and irreversible to the mining records. A later run
+        requires fresh consent-bound evidence and creates no project-side record.
+  candidate_projection:
+    status: active
+    runtime: packages/cli/src/analytics/personalGlossaryCandidateProjection.ts#projectPersonalGlossaryCandidates
+    schema_version: agentera.personalGlossaryCandidateProjection.v1
+    owner: deterministic_discovery_projection
+    input: validated_completed_explicit_and_recurring_capsules_with_transient_source_project_ids_and_candidate_adjacent_excerpts
+    output: bounded_user_local_candidate_projection_with_safe_excerpts_and_selection_report
+    implementation_boundary: >-
+       This runtime selects and persists only bounded candidate metadata and safe
+       review context. Candidate retrieval is the separate private
+       candidate_retrieval operation. It does not add project or public-state
+       candidate reads, host classification, CLI admission, review-disposition
+       writes, profile publication, project-glossary access, or project-state
+        effects.
+    refresh_production:
+      status: active
+      runtime: packages/cli/src/analytics/personalGlossaryRefreshProjection.ts#produceCurrentPersonalGlossaryProjection
+      trigger: explicit_consented_evidence_refresh_success
+      projection:
+        count: exactly_one
+        generation_binding: exact_published_evidence_generation
+        policy_binding: exact_personal_mining_policy_version
+      concurrency:
+        serialization: profile_local_exclusive_refresh_commit
+        lock_lifetime: before_evidence_publication_through_projection_binding_verification
+        ownership:
+          record: exact_regular_file_with_pid_random_token_and_creation_time
+          publication: prewritten_record_hard_linked_to_exclusive_canonical_path
+          inspection: no_follow_regular_file_with_stable_filesystem_identity
+          liveness: only_esrch_proves_owner_death
+          pid_reuse: live_or_indeterminate_pid_fails_closed
+          reclaim: one_exclusive_identity_checked_claim_replaces_only_a_proven_dead_owner
+          release: matching_token_record_and_filesystem_identity_only
+          unsafe: [malformed, foreign, symlink, non_file, changed_identity, indeterminate_owner]
+          recovery: inspect_exact_profile_local_lock_and_remove_only_after_verifying_no_refresh_owns_it_then_rerun_consented_refresh
+        contender:
+          refresh_outcome: failure
+          process_exit: nonzero
+          local_history_read: false
+          tier_write: false
+          projection_status: failed
+          projection_write: false
+          evidence_status: current_generation_remains_readable
+          recovery: npx -y agentera@next report refresh --consent local-history
+      partial_failure:
+        refresh_outcome: failure
+        process_exit: nonzero
+        evidence_status: published
+        projection_status: failed
+        tier_write_reporting: evidence_published_projection_not_written
+        current_generation: published_evidence_remains_current
+      safe_replacement:
+        authorization: explicit_consented_refresh_only
+        target: exact_configured_candidate_projection_file
+        precondition: existing_owned_regular_file_is_malformed
+        operation: atomic_regular_file_replacement
+        reject: [symlink, non_regular_file, configured_path_mismatch, path_escape]
+        filesystem_exception: personal_mining_authority.privacy.storage.filesystem.malformed_candidate_projection_replacement_exception
+        replaceable_state: [candidate_projection]
+        preserved_state:
+          - current_evidence_generation
+          - review_records
+          - personal_profile
+          - project_state
+          - project_glossary
+      rule: >-
+        A successful consented evidence refresh requires one projection bound to
+        that exact published generation and mining policy. Projection failure is
+        a nonzero refresh result but does not roll back the published evidence.
+        Authorized refreshes serialize evidence and projection commit; a
+        contender fails without reading history or writing evidence or projection.
+        The documented consented refresh reclaims a valid orphan only after owner
+        death is proven. Unknown ownership fails closed, and release removes only
+        the caller's unchanged token and filesystem identity.
+        A retry may replace only the exact configured owned regular projection
+        file; it rejects symlinks, non-files, path mismatches, and path escapes.
+        The refresh runtime mines and publishes this projection after evidence
+        publication succeeds.
+    selection:
+      candidates_max: 50
+      project_ids_max_per_candidate: 100
+      source_families:
+        explicit: [personal_explicit_definition]
+        recurring: [personal_inferred_usage, personal_inferred_conversation]
+      algorithm: least_retained_source_family_then_project_then_canonical_candidate
+      tie_break: candidate_id_then_candidate_revision_then_capsule_sha256
+      project_identity:
+        schema_version: agentera.personalGlossaryProjectionProjectIdentity.v1
+        algorithm: sha256
+        input: canonical_utf8_json_of_exact_transient_project_id
+        output: lowercase_hex
+        rule: >-
+          Projection-only project labels are used transiently to allocate
+          diversity. Persisted allocation fields and reports contain only this
+          exact-byte, no-normalization project identity. The validated capsule
+          keeps its separately authority-required provenance unchanged.
+      coverage: >-
+        Each selection round prefers the represented source family with the
+        fewest retained candidates, then the candidate whose represented project
+        has the fewest retained candidates. A capped or uncovered family or
+         project reports degraded coverage with retained and dropped counts.
+    mining_summary:
+      schema_version: agentera.personalGlossaryMiningSummary.v1
+      location: report.mining_summary
+      family_fields: [candidate_count, abstention_count, abstentions_by_reason]
+      explicit_abstention_keys:
+        - attributed_quotation
+        - ambiguous_reference
+        - conflicting_meaning
+        - empty_meaning
+        - empty_term
+        - example_context
+        - hypothetical_definition
+        - malformed_span
+        - meaning_bound_exceeded
+        - negated_definition
+        - indirect_question
+        - future_definition
+        - project_only_scope
+        - question_definition
+        - retracted_definition
+        - sarcasm_marker
+        - stale_anchor
+        - structural_fragment
+        - term_bound_exceeded
+        - unsafe_syntax
+        - uncertain_scope
+        - unresolved_anchor
+        - provenance_incomplete
+        - user_authorship_required
+      recurring_abstention_keys:
+        - agent_only_evidence
+        - copied_content
+        - provenance_missing
+        - insufficient_independent_origins
+        - insufficient_projects
+        - insufficient_sessions
+        - conversation_evidence_incomplete
+        - conversation_evidence_bound_exceeded
+        - project_only_scope
+        - noise_term
+        - too_many_qualifying_origins
+        - user_authorship_required
+      reconciliation:
+        fixed_keys: all_keys_present_as_nonnegative_integers
+        family_abstentions: abstention_count_equals_sum_of_reason_counts
+        total_candidates: total_equals_explicit_plus_recurring_candidate_counts
+        total_abstentions: total_equals_explicit_plus_recurring_abstention_counts
+        projection_input: report_input_count_equals_total_candidate_count
+      forbidden_content:
+        - terms
+        - source_ids
+        - evidence_anchors
+        - project_ids
+        - project_keys
+        - paths
+        - excerpts
+      rule: >-
+        Persist the fixed explicit and recurring keys even when their count is
+        zero. Reconcile family and total counts before publication. This summary
+        contains counts only and never retains candidate, source, project, path,
+        anchor, or content identity.
+    excerpts:
+      source_max_utf8_bytes: 4096
+      max_per_candidate: 1
+      authority: personal_mining_authority.privacy.excerpts
+      input_rule: candidate_adjacent_text_must_contain_the_exact_candidate_term
+      output_fields: [text, expires_at, redacted]
+      compatibility:
+        redacted_field: retained_for_v1_consumers
+        new_projection_value: false
+      omission_reasons: [no_excerpt, unrelated_context, source_bound_exceeded, unsafe_tool_arguments, unsafe_content]
+      rule: >-
+        Sort transient excerpts canonically, retain at most one complete safe
+        excerpt, and omit secret-bearing, sensitive, unsafe, or unrelated text
+        without echoing it. The v1 redacted field remains for schema compatibility,
+        but new projections set it to false and never persist partial redactions.
+    retention:
+      authority: personal_mining_authority.privacy.retention
+      purge: personal_mining_authority.privacy.purge
+      rule: >-
+        Pending candidate excerpts expire after the authority's thirty-day
+        period. Retention maintenance may remove only expired safe excerpts;
+        a current-user-authorized purge removes the complete user-local
+        projection before the next read. Review-disposition persistence remains
+        outside this runtime.
+    persistence:
+      root: $AGENTERA_PROFILE_DIR/intermediate/personal-glossary
+      file: candidate-projection.json
+      canonicalization: candidate_contracts.canonicalization
+      fields: [schema_version, owner, generation, policy_version, retained_at, candidates, report, projection_sha256]
+      replay: byte_identical_projection_is_unchanged_replay
+      project_storage: forbidden
+      public_reads: forbidden
+      private_machine_reads: [candidate_retrieval, cli_decision]
+      review_disposition_writes: forbidden
+      rule: >-
+        Write one private canonical projection file at the configured user
+        profile path using ordinary filesystem I/O. The file contains validated
+        capsules, hashed project identities, safe excerpts, and a bounded report
+        only. Never serialize a raw project path, .agentera state, raw excerpt
+         source, or review disposition, and never deliberately select project
+         storage.
+  candidate_retrieval:
+    status: active
+    owner: private_user_local_candidate_retrieval
+    runtime: packages/cli/src/cli/commands/personalGlossaryCandidateReads.ts#runPersonalGlossaryCandidateReadsCommand
+    input: current_validated_user_local_candidate_projection_bound_to_current_tier_generation
+    current_generation:
+      source: current.json_readable_bounded_evidence_tier_generation
+      projection_generation: exact_match_required
+      unavailable_behavior: current_generation_unavailable
+      stale_projection_behavior: projection_stale
+    command:
+      canonical: npx -y agentera@next report personal-glossary-candidates
+      namespace: report
+      format: json
+      project_checkout: not_required
+    list:
+      schema_version: agentera.personalGlossaryCandidateRetrieval.v1
+      default_limit: 20
+      maximum_limit: 50
+      max_serialized_utf8_bytes: 32768
+      order: candidate_id_then_candidate_revision_then_capsule_sha256
+      projection_binding_field: candidate_projection_sha256
+      filters:
+        source_family: [explicit, recurring]
+        provenance_kind_from: candidate_projection.selection.source_families
+        scope: [personal, ambiguous]
+      cursor:
+        authority: references/artifacts/state-storage-authority.yaml#entity_target.public_retrieval.policy.cursor
+        vocabulary: opaque_snapshot_cursor
+        binding: [collection, generation, policy_version, filters, limit, order, snapshot]
+        invalid_behavior: cursor_invalid
+        unavailable_behavior: cursor_snapshot_unavailable
+      summaries: >-
+        List returns only bounded candidate summaries, projection-local selection
+        abstention counts, derived safe-context availability and omission or
+        expiry counts, and the current coverage report. It never returns a
+        meaning, project label, project key, raw evidence identity, excerpt text,
+        or a per-row expanded command.
+      abstentions: >-
+        The projection retains only the reconciled fixed-key aggregate mining
+        summary from candidate_projection.mining_summary. It never retains or
+        reconstructs individual upstream abstentions. Reads may return those
+        counts with projection-local selection and safe-context omission counts.
+      coverage: >-
+        Coverage remains the validated current projection report and is not
+        recomputed from a list filter or page.
+    safe_context_view:
+      authority: personal_mining_authority.privacy.retention
+      retention_days: 30
+      expiry: expires_at_lte_read_time_is_unavailable
+      mutation: forbidden
+      snapshot: effective_availability_bound_to_opaque_cursor_snapshot
+      rule: >-
+        Candidate retrieval derives current safe-context availability from the
+        persisted projection at read time. An excerpt at or after its expiry is
+        omitted from list and exact output without writing the projection. The
+        derived availability contributes to the opaque cursor snapshot, so a
+        continuation from a prior availability view is unavailable.
+    exact:
+      schema_version: agentera.personalGlossaryCandidateRetrieval.v1
+      required_bindings: [candidate_id, candidate_revision, generation, policy_version]
+      projection_binding_field: candidate_projection_sha256
+      occurrences_max: 100
+      safe_context_max_utf8_bytes: 500
+      max_serialized_utf8_bytes: 32768
+      occurrence:
+        schema_version: agentera.personalGlossaryCandidateOccurrence.v1
+        identity: opaque_sha256_of_validated_evidence_and_candidate_binding
+        allowed_fields: [occurrence_id, source_kind, signal_type, author_class]
+      rule: >-
+        Exact read first validates the readable current tier generation, the
+        projection's exact generation binding, and every requested candidate
+        binding. It returns only the bounded validated occurrence
+        projection, its candidate_projection_sha256 binding, and a currently
+        available validated safe excerpt context.
+        Raw source, anchor, session, project, fingerprint, project-key, and
+        filesystem values are never emitted.
+    rule: >-
+      Candidate retrieval is read-only, non-interactive, and user-local. It never
+      refreshes or purges evidence, acquires consent, records review state, reads
+      a project glossary, selects project storage, or changes the persisted
+      projection. It derives an expiry-aware safe-context read view, reuses the
+      canonical opaque snapshot cursor construction, and fails closed before
+        emitting candidate data when the current generation is unavailable, the
+        projection is stale, or a continuation or exact binding is malformed,
+        unavailable, or mismatched.
+  review_records:
+    status: active
+    owner: user_local_review_lifecycle
+    runtime: packages/cli/src/analytics/personalGlossaryReviewRecords.ts#queuePersonalGlossaryReviewRecord
+    input: current_validated_review_required_cli_decision_and_host_receipt
+    trusted_host_key:
+      root: $AGENTERA_PROFILE_DIR/intermediate/personal-glossary
+      file: trusted-local-host.json
+      schema_version: agentera.personalGlossaryTrustedLocalHost.v1
+      fields: [schema_version, owner, subject, public_key_spki_base64url]
+      owner: current_user
+      public_key_algorithm: ed25519
+      max_serialized_utf8_bytes: 4096
+      rule: >-
+        The configured user-local host key names the current-user subject and one
+        Ed25519 SPKI public key. It is read only to verify a local-host IPC receipt;
+        it is never accepted from command input, project state, agent text, or output.
+    persistence:
+      root: $AGENTERA_PROFILE_DIR/intermediate/personal-glossary
+      file: review-records.json
+      schema_version: agentera.personalGlossaryReviewStore.v2
+      record_schema_version: agentera.personalGlossaryReviewRecord.v2
+      owner: current_user
+      fields: [schema_version, owner, records, replay_index, store_sha256]
+      record_fields:
+        - schema_version
+        - owner
+        - review_id
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - candidate_projection_sha256
+        - host_receipt_sha256
+        - cli_decision_sha256
+        - semantic_fingerprint
+        - generation
+        - policy_version
+        - scope
+        - reason
+        - status
+        - disposition
+        - review_record
+        - reopen_reason
+        - queued_at
+        - terminal_at
+        - expires_at
+        - record_sha256
+      records_max: 100
+      replay_index_fields: [nonce_sha256, receipt_sha256, expires_at]
+      replay_entries_max: 100
+      record_max_serialized_utf8_bytes: 8192
+      max_serialized_utf8_bytes: 1048576
+      canonicalization: candidate_contracts.canonicalization
+      order: review_id_asc
+      replay: exact_current_binding_is_unchanged_replay_and_exact_receipt_is_idempotent
+      conflict: changed_receipt_nonce_binding_or_signature_fails_before_effects
+      suppression_binding: [candidate_id, semantic_fingerprint, scope, policy_version]
+      suppression_dispositions: [reject, defer]
+      reopen_reasons: [policy_changed, scope_changed, meaning_changed]
+      project_storage: forbidden
+      forbidden_fields:
+        - term
+        - meaning
+        - excerpt
+        - raw_evidence
+        - source_id
+        - evidence_anchor
+        - session_id
+        - project_id
+        - source_path
+        - tool_content
+        - review_approval
+        - signature
+        - nonce
+      rule: >-
+        Persist only bounded current-user review metadata. Generation and policy
+        bindings must be non-secret, non-path metadata identifiers; the current
+        content-addressed tier generation is an allowed opaque digest. A record contains
+        opaque candidate and receipt bindings, a safe scope, deterministic review
+        reason, lifecycle status, disposition, optional canonical review record,
+        visible reopening reason, and canonical digests. Only a correct canonical
+        review record may retain its authority-approved corrected meaning. It never
+        persists a term, excerpt, raw evidence identity, host proof, profile content,
+        project identity, path, or tool content. The bounded replay index stores only
+        nonce and receipt digests until receipt expiry. Exact current queue replay or
+        exact receipt replay is idempotent; changed nonce content fails before a write.
+      compatibility:
+        accepted_store_schema_versions:
+          - agentera.personalGlossaryReviewStore.v1
+          - agentera.personalGlossaryReviewStore.v2
+        accepted_record_schema_versions:
+          - agentera.personalGlossaryPendingReviewRecord.v1
+          - agentera.personalGlossaryReviewRecord.v2
+        read_mutation: forbidden
+        migration_operation: disposition_only
+        scope_derivation: current_validated_host_receipt_only
+        invalid_behavior: fail_before_effects
+        preserved_bindings:
+          - review_id
+          - candidate_id
+          - candidate_revision
+          - candidate_capsule_sha256
+          - candidate_projection_sha256
+          - host_receipt_sha256
+          - cli_decision_sha256
+          - semantic_fingerprint
+          - generation
+          - policy_version
+          - reason
+        legacy_digest: validate_before_migration
+        migrated_digest: reseal_v2_lifecycle_record
+        rule: >-
+          Canonical v1 pending review stores remain readable without a write. Only
+          disposition may compat-decode one valid v1 record after it revalidates the
+          current receipt and projection. It derives the missing scope only from that
+          current validated receipt, preserves the listed immutable bindings and review
+          identity, and atomically writes the v2 store and replay state. Invalid or
+          ambiguous v1 input fails before effects. Untouched valid v1 records remain
+          byte-for-byte v1 records inside the v2 store until their own disposition.
+    queue:
+      command:
+        canonical: npx -y agentera@next report personal-glossary-reviews
+        namespace: report
+        input_flag: --input
+        stdin_value: '-'
+        format: json
+        project_checkout: not_required
+      request:
+        schema_version: agentera.personalGlossaryReviewQueueRequest.v1
+        required_fields: [schema_version, receipt]
+        additional_fields: forbidden
+        max_utf8_bytes: 16384
+      decision_outcome: review_required
+      current_bindings:
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - candidate_projection_sha256
+        - host_receipt_sha256
+        - cli_decision_sha256
+        - semantic_fingerprint
+        - generation
+        - policy_version
+        - reason
+      result:
+        schema_version: agentera.personalGlossaryReviewQueueResult.v1
+        statuses: [queued, unchanged_replay, suppressed, reopened]
+        max_utf8_bytes: 4096
+      no_question_channel: queue_without_prompt_or_disposition
+      rule: >-
+        Queue revalidates one bounded host receipt through the current deterministic
+        CLI decision before a write. Only a current review_required decision may
+        create pending metadata. The command does not prompt, accept a disposition,
+        write a profile entry, read or change project state, or mutate the candidate
+        projection.
+    disposition:
+      command:
+        canonical: npx -y agentera@next report personal-glossary-reviews
+        namespace: report
+        input_flag: --input
+        stdin_value: '-'
+        format: json
+        project_checkout: not_required
+      request:
+        schema_version: agentera.personalGlossaryReviewDispositionRequest.v1
+        required_fields: [schema_version, review_id, receipt, approval]
+        additional_fields: forbidden
+        max_utf8_bytes: 16384
+      result:
+        schema_version: agentera.personalGlossaryReviewDispositionResult.v1
+        statuses: [disposed, unchanged_replay]
+        max_utf8_bytes: 4096
+      publication_authorization:
+        dispositions: [accept, correct]
+        fields: [review_id, review_record_sha256]
+      rule: >-
+        Disposition accepts only a current queued review and a complete signed
+        current-user local-host approval. It verifies the configured trusted public
+        key, exact receipt fields and bindings, current clock freshness, replay index,
+        current projection, policy, and semantic fingerprint before a user-local write.
+        Accept and correct create an opaque authorization for the existing personal
+        publish command. Reject and defer never publish. The operation does not read
+        project state, mutate the candidate projection, or change PROFILE.md.
+    retrieval:
+      command:
+        canonical: npx -y agentera@next report personal-glossary-reviews
+        namespace: report
+        format: json
+        project_checkout: not_required
+      owner: current_user
+      schema_version: agentera.personalGlossaryReviewRetrieval.v1
+      list:
+        default_limit: 20
+        maximum_limit: 50
+        max_serialized_utf8_bytes: 32768
+        order: queued_at_desc_then_review_id_asc
+        filters:
+          status: [pending, terminal]
+        cursor:
+          authority: references/artifacts/state-storage-authority.yaml#entity_target.public_retrieval.policy.cursor
+          vocabulary: opaque_snapshot_cursor
+          binding: [collection, owner, filters, limit, order, snapshot]
+          invalid_behavior: cursor_invalid
+          unavailable_behavior: cursor_snapshot_unavailable
+        summaries: >-
+          List returns only opaque identity and binding digests, stable reason,
+          lifecycle status and dates, and bounded current, stale, or expired counts.
+          It never returns candidate content, source identity, user identity, or
+          approval material.
+      exact:
+        required_bindings: [review_id, candidate_id, candidate_revision, generation, policy_version]
+        current_binding_field: candidate_projection_sha256
+        max_serialized_utf8_bytes: 8192
+        rule: >-
+          Exact retrieval validates every selector, including a current
+          content-addressed generation or non-secret, non-path generation and policy
+          metadata bindings, the record digest, the current
+          store owner, and the record's current candidate projection binding before
+          emitting one private metadata record.
+      rule: >-
+        Reads are structured, non-interactive, private to the configured current-user
+        profile, bounded, and mutation-free. They cannot select another owner or
+        return stale, malformed, expired, or owner-mismatched metadata.
+    maintenance:
+      entrypoint: packages/cli/src/analytics/personalGlossaryReviewRecords.ts#maintainPersonalGlossaryReviewRecords
+      exposure: authenticated_review_owner_only
+      terminal_metadata_days: 90
+      pending_metadata: retained_until_terminal_or_purge
+      cache: replay_index_until_receipt_expiry
+      purge: current_user_authorized_review_records_only
+      forbidden_effects:
+        - profile_entry
+        - project_state
+        - candidate_projection
+        - publication
+      rule: >-
+        Separate maintenance removes only expired terminal review metadata and expired
+        replay-index entries, or the complete review-record file after a
+        current-user-authorized purge. It never creates a record during a read and
+        never deletes or changes a profile entry, project state, candidate projection,
+        or publication result.
+  admission:
+    inferred_automatic_admission: disabled
+    inferred_review: allowed
+    quality_threshold: references/analysis/personal-glossary-evaluation-authority.yaml#gates.release_authorizing_gate
+    holdout: references/analysis/personal-glossary-evaluation-authority.yaml#holdout
+    rule: >-
+      The separate evaluation authority defines the frozen holdout, metric
+      thresholds, and fail-closed release gate. Inferred meanings remain
+       review-only, and no measured result enables inferred automatic admission.
+
+candidate_contracts:
+  schema_version: agentera.personalGlossaryCandidateContracts.v1
+  status: active_partial
+  implementation_boundary: receipt_validation_deterministic_decision_and_explicit_personal_publication_runtime
+  purpose: >-
+      Define five distinct, content-addressed boundaries for one personal glossary
+      candidate. Discovery and projection own evidence, the semantic host owns only
+      bounded classification, the CLI owns deterministic admission validation, the
+      user owns review lifecycle, and one explicit personal publication operation
+      owns the personal publication result. Candidate retrieval alone exposes
+      private reads; personal publication alone changes the owned profile section.
+      Neither replaces shared consumer or project publication contracts.
+  canonicalization:
+    algorithm: sha256
+    encoding: lowercase_hex
+    input: canonical_utf8_json
+    object_keys: unicode_code_point_sorted
+    evidence_records: canonical_json_sorted
+    digest_field_rule: exclude_digest_field_from_body
+    arrays: preserve_declared_order
+    rule: >-
+      Every digest hashes canonical UTF-8 JSON with recursively sorted object keys.
+      Evidence records are sorted by their canonical JSON before capsule creation.
+      A layer digest excludes only its own digest field. Strings are preserved
+      exactly; no Unicode normalization or display-label substitution is allowed.
+  identity:
+    stable_term_identity: personal_mining_authority.term_identity.stable_term_identity
+    candidate_revision: personal_mining_authority.term_identity.candidate_revision
+    rule: >-
+      candidate_id is the settled stable term identity. candidate_revision is
+      produced only by the current revision helper, so meaning, evidence, policy,
+      or generation changes produce a new revision while an unchanged equality
+      class keeps the same stable identity.
+  bounds:
+    term_max_utf8_bytes: 256
+    meaning_max_utf8_bytes: 4096
+    binding_max_utf8_bytes: 256
+    evidence_records_max: 100
+    reason_max_utf8_bytes: 512
+    corrected_meaning_max_utf8_bytes: 4096
+    digest_bytes: 32
+    rule: >-
+      These limits apply before downstream effects. Candidate evidence remains a
+      complete bounded projection, not a preview that can silently omit records.
+  layers:
+    evidence_capsule:
+      owner: deterministic_discovery_projection
+      schema_version: agentera.personalGlossaryCandidateCapsule.v1
+      required_fields:
+        - schema_version
+        - owner
+        - candidate_id
+        - candidate_revision
+        - term
+        - meaning
+        - scope
+        - provenance_kind
+        - evidence
+        - evidence_complete
+        - evidence_set_sha256
+        - policy_version
+        - generation
+        - capsule_sha256
+      additional_fields: forbidden
+      binding_fields: [candidate_id, candidate_revision, generation, policy_version]
+      body_digest: capsule_sha256
+      evidence_owner: deterministic_discovery_projection
+      evidence_source: personal_mining_authority.provenance
+      evidence_required_fields: provenance_variant_required_fields
+      evidence_complete: true
+      forbidden_fields:
+        - admission
+        - decision
+        - review
+        - publication
+        - mutation
+        - trusted_publication_effect
+      rule: >-
+        The capsule contains only the bounded candidate projection and complete
+        qualifying evidence identities. It has no host judgment, admission result,
+        review disposition, or publication effect.
+    host_classification_receipt:
+      owner: semantic_host_classification
+      schema_version: agentera.personalGlossaryHostClassificationReceipt.v1
+      required_fields:
+        - schema_version
+        - owner
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - candidate_projection_sha256
+        - generation
+        - policy_version
+        - classification
+        - semantic_fingerprint
+        - receipt_sha256
+      additional_fields: forbidden
+      binding_fields:
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - candidate_projection_sha256
+        - generation
+        - policy_version
+      body_digest: receipt_sha256
+      classification:
+        fields: [term, meaning, scope, permanence, consistency, confidence]
+        term: shared_primitive.fields.term
+        meaning: shared_primitive.fields.meaning
+        scope: packages/cli/src/registries/glossaryTermIdentity.ts#GlossaryCandidateScope
+        permanence: shared_primitive.fields.permanence
+        confidence: shared_primitive.fields.confidence
+        consistency_values: [consistent, inconsistent, uncertain]
+      forbidden_fields:
+        - admission
+        - decision
+        - mutation
+        - publication
+        - review_bypass
+        - trusted_publication_effect
+        - project_glossary
+        - project_publication
+      rule: >-
+        The host may classify only term, meaning, scope, permanence, consistency,
+        and confidence. The receipt binds the exact capsule, current projection,
+        revision, generation, and policy. It cannot choose admission, authorize
+        mutation, bypass review, or supply a trusted publication effect.
+    cli_decision:
+      owner: deterministic_cli_admission_validation
+      schema_version: agentera.personalGlossaryAdmissionDecision.v1
+      required_fields:
+        - schema_version
+        - owner
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - candidate_projection_sha256
+        - host_receipt_sha256
+        - classification_contract_version
+        - semantic_fingerprint
+        - generation
+        - policy_version
+        - outcome
+        - reason
+        - decision_sha256
+      additional_fields: forbidden
+      binding_fields:
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - candidate_projection_sha256
+        - host_receipt_sha256
+        - classification_contract_version
+        - semantic_fingerprint
+        - generation
+        - policy_version
+      body_digest: decision_sha256
+      outcomes: [automatic_admission, review_required, abstain]
+      reason_codes:
+        - explicit_current_authorized
+        - inferred_requires_review
+        - scope_ambiguous
+        - classification_inconsistent
+        - classification_changed
+        - entry_conflict
+        - evidence_retracted_or_conflicted
+        - quality_gate_not_authorizing
+        - scope_project
+        - evidence_unavailable
+        - evidence_changed
+      reason_codes_by_outcome:
+        automatic_admission: [explicit_current_authorized]
+        review_required:
+          - inferred_requires_review
+          - scope_ambiguous
+          - classification_inconsistent
+          - classification_changed
+          - entry_conflict
+          - evidence_retracted_or_conflicted
+          - quality_gate_not_authorizing
+        abstain: [scope_project, evidence_unavailable, evidence_changed]
+      automatic_admission:
+        owner: deterministic_cli_admission_validation
+        allowed_provenance: provenance_variants.personal_explicit_definition
+        inferred_automatic_admission: disabled
+        required_classification:
+          scope: personal
+          consistency: consistent
+          term: exact_capsule_term
+          meaning: exact_capsule_meaning
+        current_evidence: required
+        quality_gate: personal_mining_authority.admission.quality_threshold
+      command:
+        canonical: npx -y agentera@next report personal-glossary-decision
+        namespace: report
+        input_flag: --input
+        stdin_value: '-'
+        format: json
+        project_checkout: not_required
+        request:
+          schema_version: agentera.personalGlossaryAdmissionRequest.v1
+          required_fields: [schema_version, receipt]
+          additional_fields: forbidden
+          max_utf8_bytes: 16384
+        result:
+          schema_version: agentera.personalGlossaryAdmissionResult.v1
+          fields: [schemaVersion, command, status, decision, reason, effects]
+          statuses: [automatic_admission, review_required, abstain]
+          max_utf8_bytes: 4096
+          effects: []
+        receipt_construction:
+          schema_version: agentera.personalGlossaryAdmissionRequest.v2
+          required_fields: [schema_version, candidate_id, candidate_revision, candidate_capsule_sha256, candidate_projection_sha256, generation, policy_version, classification]
+          additional_fields: forbidden
+          max_utf8_bytes: 16384
+          result:
+            schema_version: agentera.personalGlossaryAdmissionResult.v2
+            fields: [schemaVersion, command, status, receipt, decision, reason, effects]
+            statuses: [automatic_admission, review_required, abstain]
+            max_utf8_bytes: 16384
+            effects: []
+        rule: >-
+          The command accepts either one existing host receipt or one bounded host
+          classification with every exact candidate binding through a structured
+          file or stdin request. For the classification request, the CLI reads the
+          current private projection, constructs the receipt including its semantic
+          fingerprint and receipt digest, computes one deterministic outcome, and
+          returns both receipt and decision. It emits JSON without changing a
+          projection, review record, profile, project glossary, or project state.
+      forbidden_fields: [host_authority, host_override, mutation, publication]
+      rule: >-
+        Only the deterministic CLI validator may emit an admission outcome. It
+        validates the capsule and host receipt bindings before any later workflow;
+        it does not itself write a profile, project glossary, or review record.
+    review_record:
+      owner: user_local_review_lifecycle
+      schema_version: agentera.personalGlossaryReviewRecord.v1
+      required_fields:
+        - schema_version
+        - owner
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - host_receipt_sha256
+        - cli_decision_sha256
+        - semantic_fingerprint
+        - generation
+        - policy_version
+        - disposition
+        - corrected_meaning
+        - corrected_scope
+        - disposed_at
+        - expires_at
+        - record_sha256
+      additional_fields: forbidden
+      binding_fields:
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - host_receipt_sha256
+        - cli_decision_sha256
+        - semantic_fingerprint
+        - generation
+        - policy_version
+      body_digest: record_sha256
+      storage: $AGENTERA_PROFILE_DIR/intermediate/personal-glossary
+      dispositions_from: [personal_mining_authority.privacy.reviews.dispositions]
+      authentication: personal_mining_authority.privacy.reviews.authentication
+      forbidden_fields:
+        - project_glossary
+        - project_publication
+        - profile_entry_mutation
+        - trusted_host_authority
+      rule: >-
+        A review record is user-local lifecycle state bound to the exact candidate,
+        semantic classification, generation, policy, and CLI decision. It is not a
+        host classification receipt and cannot mutate project or profile state by
+        itself.
+    publication_result:
+      owner: personal_profile_publication
+      schema_version: agentera.personalGlossaryPublicationResult.v1
+      required_fields:
+        - schema_version
+        - owner
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - decision_sha256
+        - review_record_sha256
+        - generation
+        - policy_version
+        - status
+        - profile_section_sha256
+        - published_at
+        - result_sha256
+      additional_fields: forbidden
+      binding_fields:
+        - candidate_id
+        - candidate_revision
+        - candidate_capsule_sha256
+        - decision_sha256
+        - generation
+        - policy_version
+      body_digest: result_sha256
+      command: ownership_contracts.personal.profile_output.command.canonical
+      status_values_from: [ownership_contracts.personal.profile_output.command.output_statuses]
+      forbidden_fields:
+        - project_glossary
+        - project_publication
+        - consumer_precedence
+        - review_authorization
+      rule: >-
+        This is the bounded result of explicit personal-profile publication only. It binds
+        the validated decision and optional review record, reports the existing
+        personal output status, and never changes Build-owned project publication.
+  shared_invariance:
+    shared_primitive: shared_primitive
+    consumer_precedence: consumer_boundary.primary_selection
+    project_publication: ownership_contracts.project.publication
+    personal_project_isolation: ownership_contracts.personal.admission.isolation_rule
+    rule: >-
+      Candidate contracts add evidence and identity bindings without adding fields
+      to the shared glossary entry. Consumers keep project precedence and Build
+      publication unchanged; personal mining has no project glossary input.
+  recovery:
+    stale_or_mismatch: fail_closed_no_effects
+    retry: >-
+      Reject the layer before effects, reread the current bounded source contract,
+      recompute the capsule and settled identities, and retry the downstream
+      operation with all exact bindings. Never repair a stale receipt in place.
+
+provenance_variants:
+  personal_explicit_definition:
+    owner: personal
+    evidence_count: 1
+    required_evidence_fields: [source_id, evidence_anchor, signal_type]
+    additional_evidence_fields: forbidden
+    source_provenance:
+      required_fields: [source_id, evidence_anchor, source_kind, signal_type, origin_id, content_fingerprint, author_class, session_id, project_id]
+      allowed_source_kinds: [conversation_turn]
+      identity_fields_must_match_full_record: true
+    allowed_signal_types: [correction, decision, instruction]
+    resolution_rule: >-
+      evidence_anchor resolves to source_id of exactly one retained
+      full-evidence shard through the bounded signal tier. One such distinct
+      retained record is sufficient; unanchored or unresolved evidence fails.
+  personal_inferred_usage:
+    owner: personal
+    evidence_count: 2
+    required_evidence_fields: [source_id, evidence_anchor, source_kind]
+    additional_evidence_fields: forbidden
+    distinctness:
+      source_ids: 2
+      evidence_anchors: 2
+    allowed_source_kinds: [instruction_document, project_config_signal]
+    resolution_rule: >-
+      Each evidence_anchor resolves to its source_id in retained full evidence.
+      Both source_id and evidence_anchor must be pairwise distinct, so two
+       signals or anchors resolving to one retained record fail. Both anchors
+       remain exposed on the entry.
+  personal_inferred_conversation:
+    owner: personal
+    evidence_count: variable
+    minimum_evidence_count: 3
+    required_evidence_fields:
+      - source_id
+      - evidence_anchor
+      - source_kind
+      - signal_type
+      - session_id
+      - project_id
+      - content_fingerprint
+      - author_class
+    additional_evidence_fields: forbidden
+    allowed_signal_types: [correction, decision, question, instruction, configuration]
+    allowed_source_kinds: [conversation_turn]
+    allowed_author_classes: [user]
+    distinctness:
+      source_ids: 3
+      evidence_anchors: 3
+      session_ids: 2
+      project_ids: 2
+      content_fingerprints: 3
+    completeness_field: provenance.evidence_complete
+    completeness_value: true
+    completeness_authority: expected_qualifying_anchor_set_exact_match
+    expected_evidence:
+      binding: generation_bound
+      context_fields: [generation, qualifying_evidence_anchors, qualifying_evidence_set_sha256]
+      exact_set: required
+      set_digest:
+        algorithm: sha256
+        encoding: lowercase_hex
+        canonicalization: >-
+          Hash canonical UTF-8 JSON containing the schema name, generation, and
+          lexicographically code-point-sorted qualifying evidence anchors. The
+          expected set digest is authoritative; list order is not.
+      duplicate_rule: >-
+        Reject duplicate source_id, evidence_anchor, or content_fingerprint at
+        every list length, even when the list still meets the minimum count.
+    admission: review_only
+    resolution_rule: >-
+      Retain every qualifying user-authored conversation record. At least three
+      pairwise-distinct source identities, anchors, and content fingerprints must
+      span at least two sessions and two projects. Agent-authored text may
+      corroborate a later review but cannot satisfy this variant. The evidence
+      list is complete, not a bounded preview; any unresolved, duplicated, or
+      missing identity fails.
+  project_file:
+    owner: project
+    evidence_count: 1
+    required_evidence_fields: [source_path, source_record_sha256]
+    additional_evidence_fields: forbidden
+    resolution_rule: >-
+      source_path is a safe project-relative path and source_record_sha256 is
+      the lowercase SHA-256 of the cited parsed source record. These reuse the
+      repository source-path and record-digest provenance vocabulary from
+      references/artifacts/state-storage-authority.yaml.
+
+ownership_contracts:
+  personal:
+    scope: user
+    implementation:
+      status: active_partial
+      active:
+        - bounded_admission
+        - bounded_explicit_discovery
+        - bounded_candidate_projection
+        - bounded_candidate_retrieval
+        - public_receipt_construction
+        - host_classification_receipt_validation
+        - deterministic_cli_admission_decision
+        - explicit_classification
+        - inferred_evidence_check
+        - authorized_personal_publication
+        - profile_section_persistence
+      inactive: [lookup]
+    allowed_provenance:
+      - personal_explicit_definition
+      - personal_inferred_usage
+      - personal_inferred_conversation
+    input:
+      tier: signal
+      authority: references/analysis/evidence-tier-authority.yaml
+      bounded_rule: >-
+        Admit only bounded personal-history signals and resolve qualifying
+        evidence one anchor at a time to retained full-evidence shards. Never
+        scan unbounded history or load a monolithic corpus.
+      excluded_categories:
+        - project_glossary_artifact_identity
+        - project_glossary_path
+        - project_glossary_record
+        - project_file_provenance
+    admission:
+      explicit:
+        candidate_signal_types: [correction, decision]
+        language_rule: >-
+          The bounded explicit discovery grammar accepts only the ten forms in
+          personal_mining_authority.explicit_discovery. Quoted or code-delimited
+          means, standalone safe definition-list colons, exact acronym expansions,
+          By X I mean Y, Use X for/to mean Y, To clarify X refers to Y, the
+          clarification prefer form, and approved correction means forms are
+          recognized. YAML/config labels, times, URLs, headings, citations,
+          indirect questions, future language, and unbound prose are rejected.
+        evidence_count: 1
+      inferred:
+        candidate_signal_types: [instruction, configuration]
+        source_kinds: [instruction_document, project_config_signal]
+        identity_rule: >-
+          A requested term must occur as a complete case-insensitive token in
+          two pairwise-distinct retained source identities and anchors. Duplicate
+          identities or anchors fail and successful admission exposes both.
+        evidence_count: 2
+      read_rule: >-
+        Read the bounded signal tier once, select only authority-declared signal
+        types and source kinds, and resolve each selected evidence_anchor through
+        direct single-shard retrieval. Never iterate full history or read legacy
+        corpus.json. Missing, legacy, corrupt, or insufficient evidence returns
+        deterministic recovery without a candidate.
+      insufficient_recovery: >-
+        Refresh bounded local-history evidence or provide another distinct
+        qualifying record; no personal glossary candidate was admitted.
+      isolation_rule: >-
+        Admission accepts only the personal tiers directory and optional legacy
+        corpus location. It has no project-glossary identity, path, or record
+        input, and its result is invariant to project-glossary presence.
+    retention_and_decay:
+      retention: Retained entries decay rather than disappearing solely because evidence ages.
+      confidence: Apply the existing profile permanence decay class to integer confidence.
+      permanence: Remains independently classified and is not changed by evidence age or confidence decay.
+      authority: packages/cli/src/capabilities/profile/instructions.ts#Profile-format
+    profile_output:
+      owner: personal_profile_publication
+      lifecycle_callable: packages/cli/src/analytics/personalGlossaryProfile.ts#updatePersonalGlossaryProfile
+      command:
+        canonical: npx -y agentera@next report personal-glossary-publish
+        namespace: report
+        input_flag: --input
+        stdin_value: "-"
+        format: json
+        dry_run_flag: --dry-run
+        project_checkout: not_required
+        request:
+          schema_version: agentera.personalGlossaryPublishRequest.v1
+          required_fields: [schema_version, receipt, decision, as_of]
+          optional_fields: [review_authorization]
+          additional_fields: forbidden
+          max_utf8_bytes: 16384
+          profile_path_rule: >-
+            Resolve only $AGENTERA_PROFILE_DIR/PROFILE.md through the canonical
+            user-profile authority. The request cannot select a path, project
+            root, project glossary, or other artifact.
+          current_decision_rule: >-
+            Accept either a complete CLI-owned automatic_admission decision with
+            explicit_current_authorized reason and no review authorization, or one
+            current review_required decision with an exact stored accept or correct
+            authorization. Before effects, revalidate the current projection,
+            capsule, receipt, generation, policy, semantic fingerprint, current
+            meaning and revision, scope, conflict, retraction, secret content, and
+            the existing decision rules. A review authorization never skips current
+            evidence validation and does not permit project scope.
+          review_authorization:
+            required_fields: [review_id, review_record_sha256]
+            additional_fields: forbidden
+            dispositions: [accept, correct]
+            source: personal_mining_authority.review_records.disposition.publication_authorization
+            rule: >-
+              The command rereads one current user-local review record, validates its
+              canonical record hash and all receipt, decision, projection, policy,
+              semantic-fingerprint, and revision bindings, then uses its approved
+              corrected meaning and personal scope only for correct. No direct review
+              record, correction, key, nonce, signature, profile path, or project path
+              is accepted from publication input.
+          date_rule: >-
+            as_of is one injected ISO calendar date. Use it for lifecycle
+            rendering and derive published_at as UTC midnight of that exact date;
+            never read the wall clock for publication content or replay.
+        result:
+          schema_version: agentera.personalGlossaryPublicationResult.v1
+          fields: [schema_version, owner, candidate_id, candidate_revision, candidate_capsule_sha256, decision_sha256, review_record_sha256, generation, policy_version, status, profile_section_sha256, published_at, result_sha256]
+          max_utf8_bytes: 4096
+        output_statuses: [changed, unchanged_replay, dry_run_candidate]
+        rule: >-
+          The packaged headless command accepts only one bounded structured
+          receipt and CLI decision, revalidates authorization immediately before
+          effects, and invokes the lifecycle_callable without duplicating merge,
+          decay, replacement, or persistence behavior. It changes only the owned
+          PROFILE.md Glossary section. JSON output contains opaque bindings only;
+          diagnostics use stable generic envelopes. Dry-run computes a candidate
+          without writing PROFILE.md.
+      section:
+        heading: "## Glossary"
+        start_marker: "<!-- agentera:personal-glossary:start -->"
+        end_marker: "<!-- agentera:personal-glossary:end -->"
+        encoding: deterministic_json_fence
+        document_schema_version: agentera.personalGlossarySection.v1
+        entry_shape: shared_primitive
+        lifecycle_metadata: [as_of, confidence_basis]
+        boundary_rule: >-
+          Add one owned section when absent or replace exactly the bytes from its
+          start marker through its end marker. Reject unmatched markers,
+          duplicate owned sections, or an unowned Glossary heading before any
+          write. Preserve every other profile byte exactly.
+      merge_identity:
+        normalization: unicode_caseless_exact_no_normalization
+        rule: >-
+          One locale-independent Unicode caseless-exact term identity may occur
+          once. Identity performs no Unicode normalization, accent folding, or
+          compatibility folding; canonically distinct strings remain distinct.
+          Preserve the established spelling and observed_at date. Fresh
+          qualifying evidence may refresh an entry only when meaning and
+          provenance kind are unchanged; divergent meaning or provenance kind is
+          a conflict rather than an implicit overwrite.
+      refresh_rule: >-
+        For matching fresh qualifying evidence, set confidence and its
+        confidence_basis to the fresh evidence-based integer, replace only the
+        same-kind personal evidence anchors, and set last_confirmed_at to the
+        injected as_of date. Preserve observed_at and permanence. This rule is
+        stable for identical input and as_of.
+      decay_rule: >-
+        Without matching fresh evidence, retain the entry and permanence. Derive
+        confidence from its unchanged confidence_basis, its permanence-class
+        lambda, and calendar days from last_confirmed_at to injected as_of using
+        the Profile formula; round to the nearest integer after applying the
+        existing floor. The section-level basis prevents same-date drift and
+        repeated compounding from already-decayed confidence. Age alone never
+        removes an entry.
+      isolation_rule: >-
+        The command accepts only one receipt, one CLI decision, and an injected
+        ISO date. It resolves the canonical user PROFILE.md path itself and has
+        no project root, project glossary parameter, artifact lookup, or project
+        file read.
+      filesystem:
+        authority: host_filesystem
+        configured_path: canonical_user_profile_authority
+        outcomes: ordinary_permissions_and_io
+        same_user_path_manipulation: outside_agentera_threat_model
+        symlink_confinement: not_claimed
+        rule: >-
+          Profile storage uses ordinary current-user filesystem permissions and
+          atomic replacement. This contract does not claim symlink confinement.
+  project:
+    scope: repository
+    implementation:
+      status: active
+      active: [audit_proposal_digest, build_publication, confirmed_variant_guard]
+      inactive: [lookup, precedence, semantic_equivalence_review]
+    allowed_provenance: [project_file]
+    input:
+      authority: repository_files
+      bounded_rule: Admit only the cited project-relative record bound by its record SHA-256.
+      excluded_categories: [personal_history_record, personal_history_anchor]
+    proposal_digest:
+      algorithm: sha256
+      encoding: lowercase_hex
+      canonicalization: >-
+        Hash the complete terminology finding except proposal_digest as canonical
+        JSON with mapping keys sorted recursively. Sort canonical_evidence and
+        each variant evidence by source_path, line, then source_record_sha256;
+        sort variants by case-insensitive term and then exact term. The digest
+        therefore changes when any proposal, confidence, severity, divergence,
+        term, source path, line identity, or source-record digest changes, but not
+        when equivalent evidence or variant arrays arrive in a different order.
+        Locale-independent lowercase ordering is only a deterministic sort key;
+        it does not define term identity.
+    proposal_validation:
+      owner: audit
+      shared_runtime: packages/cli/src/audit/terminologyDrift.ts#validateTerminologyProposal
+      required_rules:
+        - safe_distinct_evidence_identities_per_term
+        - unicode_caseless_exact_unique_term_identities
+        - best_supported_canonical_term_with_lexicographic_tie_break
+        - authority_confidence_floor_and_range
+        - confidence_below_70_forces_info_severity
+        - canonical_evidence_and_variant_order
+        - canonical_proposal_digest
+      publication_rule: >-
+        Build publication accepts only the complete canonical finding that this
+        Audit-owned validator can emit. Publication reuses this validator and
+        must not duplicate or weaken Audit proposal semantics.
+    entry_derivation:
+      term: proposal.proposed_canonical_term
+      meaning: proposal.concept
+      confidence: proposal.confidence
+      permanence: stable
+      temporal.observed_at: confirmation.confirmed_at calendar date
+      temporal.last_confirmed_at: confirmation.confirmed_at calendar date
+      provenance.kind: project_file
+      provenance.evidence: >-
+        Exactly the first canonical_evidence record after proposal-digest
+        canonical ordering, projected to source_path and source_record_sha256.
+        Line identifies and revalidates the source record during publication but
+        is not persisted because it is not part of the shared project_file
+        provenance variant.
+      rejection_rule: >-
+        Reject before effects when any required proposal or derived entry value
+        is absent or invalid; never invent a field or extend the shared entry.
+    publication:
+      owner: build
+      command: npx -y agentera@next state glossary publish --input REQUEST --format json
+      request:
+        schema_version: agentera.glossaryPublicationRequest.v1
+        required_fields: [schema_version, proposal, confirmation]
+        additional_fields: forbidden
+        proposal_shape: complete_terminology_drift_finding_with_proposal_digest
+        confirmation:
+          required_fields: [proposal_digest, confirmed_by, confirmed_at]
+          additional_fields: forbidden
+          confirmed_by: user
+          confirmed_at: iso_8601_timestamp
+          binding: >-
+            proposal_digest must equal the digest recomputed from proposal and
+            therefore binds the exact finding, every cited source record, and
+            the user's timestamped confirmation.
+      persisted_document:
+        schema_version: agentera.projectGlossary.v1
+        required_fields: [schema_version, approvals, entries]
+        additional_fields: forbidden
+        approvals:
+          type: list
+          immutable_record_fields: [proposal_digest, proposal, confirmation]
+          additional_record_fields: forbidden
+        entries:
+          type: list
+          item: shared_primitive
+          approval_fields: forbidden
+        terminology_set_identity:
+          normalization: unicode_caseless_exact_no_normalization
+          members: [paired_entry.term, paired_approval.proposal.variants.term]
+          uniqueness: global_across_complete_document
+          rule: >-
+            Every Unicode caseless-exact canonical or variant term belongs to
+            exactly one approval-entry pair. Identity performs no Unicode
+            normalization, accent folding, or compatibility folding. Reject
+            duplicate variants and every cross-set canonical/variant collision
+            before effects. An exact replay compares against its existing pair
+            and remains a no-op.
+      transaction: >-
+        Under the established project writer lock, resolve the registered
+        project path, safely re-read every cited project-relative source line,
+        recompute its SHA-256 and the proposal digest, validate the complete
+        candidate bytes, then atomically replace the single glossary document.
+        Creation follows the same path. Dry-run performs all validation without
+        publication.
+      merge_and_replay: >-
+        Preserve unrelated valid approvals and entries semantically unchanged.
+        Canonical and variant identity is case-insensitive and globally unique
+        across confirmed canonical sets. An exact approval and derived-entry
+        replay is a no-op. An approval without its matching entry, a matching
+        term with changed entry or proposal, reuse of an old confirmation for
+        changed proposal content, duplicate identity, cross-set terminology
+        collision, or malformed existing state is a conflict and must never be
+        repaired or overwritten implicitly.
+    confirmed_variant_guard:
+      owner: packages/cli/src/validate/glossaryVariantGuard.ts#scanConfirmedVariantViolations
+      validation_surface: packages/cli/test/cli/glossaryVariantGuard.test.ts
+      loader: packages/cli/src/state/write/glossaryPublication.ts#loadProjectGlossaryDocument
+      source_rule: >-
+        Resolve the glossary through the canonical artifact registry and consume
+        only complete validated approval-entry pairs. Derive each forbidden
+        variant from approval.proposal.variants and its canonical replacement
+        from the paired entry.term; never infer equivalence or consume personal
+        glossary state.
+      matching: exact_case_sensitive_boundary_aware_literal
+      approved_evidence_rule: >-
+        The exact source_path, line, and source_record_sha256 retained by the
+        immutable proposal is historical evidence and does not self-trigger.
+        Changed bytes at that location or a matching variant elsewhere fail.
+      exclusions:
+        - generated_output
+        - vendor_and_dependency_state
+        - cache_state
+        - repository_metadata
+        - historical_agentera_state
+        - project_glossary_document
+        - unrelated_agentera_state
+      excluded_directory_names:
+        - .agentera
+        - .agentera-generated
+        - .cache
+        - .git
+        - .next
+        - .pnpm
+        - .turbo
+        - .venv
+        - .vite
+        - build
+        - bundle
+        - coverage
+        - dist
+        - node_modules
+        - target
+        - vendor
+      exclusion_rule: >-
+        Skip a directory only when its basename exactly equals one declared
+        name. The validator and fixtures consume this list directly; prefixes,
+        suffixes, substrings, and nearby ordinary source names remain scanned.
+      failure_rule: >-
+        Emit one deterministic violation per variant location with the canonical
+        term, confirmed proposal evidence, offending source location, and the
+        runnable validation command. A malformed present glossary fails closed;
+        an absent glossary leaves the pre-existing legacy checks unchanged.
+
+consumer_boundary:
+  contract_status: active
+  implementation:
+    acquisition: active
+    advice_resolution: active
+    capability_integrations:
+      build: active
+      discuss: active
+      plan: active
+      prime: active
+  forbidden_persisted_entry_fields: [precedence, collision, review]
+  deterministic_judgments:
+    term_identity: unicode_caseless_exact_no_normalization
+    term_identity_runtime: packages/cli/src/registries/glossaryTermIdentity.ts#unicodeCaselessExact
+    meaning_identity: exact_string
+    project_state_validity: schema_and_bound_validation
+    project_gap: valid_project_state_without_exact_term_identity
+    forbidden_semantic_heuristics: [scores, thresholds, embeddings, automatic_merge]
+  host_reviewed_judgments:
+    inferred_semantic_equivalence: >-
+      The host may identify a possible equivalence only from the current
+      meaning-sensitive input and bounded candidate meanings. It never selects
+      authority, merges entries, or resolves the review itself.
+  project_state:
+    gap_proving_states: [canonically_absent, valid_empty, valid_nonmatching]
+    invalid_states: [malformed, unreadable, ambiguous_path, over_bound]
+    invalid_rule: >-
+      An invalid project state cannot prove a project gap. Abstain rather than
+      falling back to a personal meaning, repairing state, or guessing authority.
+  acquisition:
+    implementation: active
+    runtime: packages/cli/src/analytics/glossaryInputAcquisition.ts#acquireGlossaryInputs
+    mutation: forbidden
+    bounds:
+      authority: consumer_boundary.profile_grounding.max_profile_utf8_bytes
+      max_source_utf8_bytes: 65536
+      max_entries: 100
+      rule: >-
+        Apply the existing bounded profile-read byte ceiling to each source and
+        admit at most 100 entries from either owned glossary. The entry ceiling
+        is declared only here and consumed by the runtime and schema validator.
+        Reject raw bytes above the source ceiling before decoding, decode UTF-8
+        fatally, and reject a parsed document above the entry ceiling; never
+        replacement-decode, truncate, or partially admit input. Exactly 65,536
+        raw bytes and 100 entries are permitted.
+    availability:
+      states:
+        - absent
+        - valid_empty
+        - valid_present
+        - malformed
+        - unreadable
+        - ambiguous
+        - over_bound
+      valid: [absent, valid_empty, valid_present]
+      invalid: [malformed, unreadable, ambiguous, over_bound]
+      project_gap_proving: [absent, valid_empty]
+      rule: >-
+        Classify the two sources independently. Project absence means the
+        canonical artifact does not exist; personal absence means PROFILE.md or
+        its owned Glossary section does not exist. A present empty owned document
+        is valid_empty. Invalid states expose no entries and cannot prove a
+        project gap. Dual invalid or absent input exposes no glossary entries;
+        valid project entries remain available when personal input is invalid.
+    project:
+      identity: glossary
+      discovery: packages/cli/src/registries/artifactRegistry.ts#loadArtifactRecord
+      path_resolution: packages/cli/src/registries/artifactRegistry.ts#resolveArtifactPath
+      docs_override: canonical_GLOSSARY.md_mapping_only
+      docs_override_read: bounded_no_follow_regular_file
+      project_root: packages/cli/src/state/projectRoot.ts#validateRealProjectRoot
+      boundary_rule: >-
+        Resolve only the registered glossary identity and its canonical docs
+        override under one validated real project root. Missing canonical
+        artifacts are absent. Unsafe overrides, path escapes, symlink ambiguity,
+        or unavailable registry identity classify ambiguous; malformed present
+        docs mappings or glossary documents fail closed and never fall back to a
+        default path.
+      filesystem_guarantee: >-
+        Open the canonical .agentera/docs.yaml and resolved glossary target with
+        O_NOFOLLOW after lstat snapshots of every existing project-relative path
+        component. Match the opened regular-file descriptor to the snapshotted
+        device and inode, read raw bytes from that descriptor, and require its
+        size, mtime, ctime, device, and inode plus every snapshotted parent path
+        identity to remain unchanged through the read. For an absent target,
+        require the first missing component to remain missing while all existing
+        parent identities remain unchanged. The descriptor pins accepted bytes;
+        a symlink, parent swap, changed identity, unsupported no-follow boundary,
+        or failed stability check is ambiguous. This does not claim detection of
+        an identity swapped away and restored between observations, because such
+        a swap cannot change bytes already pinned to the verified descriptor.
+      external_docs_rule: >-
+        A symlinked, escaped, changed, unreadable, malformed, over-bound, or
+        non-UTF-8 docs mapping is ambiguous and never selects a glossary target.
+      document_validation: ownership_contracts.project.publication
+      approval_output: forbidden
+      raw_source_provenance_output: forbidden
+    personal:
+      owner: ownership_contracts.personal.profile_output.owner
+      profile_path_input: >-
+        The caller passes exactly the profile path already returned by canonical
+        profile context. Acquisition does not discover or return that path and
+        accepts no project identity, root, glossary path, or project record.
+      section: ownership_contracts.personal.profile_output.section
+      parser: packages/cli/src/analytics/personalGlossaryProfile.ts#personalGlossaryConsumerEntries
+      grounding_parser_isolation: >-
+        profile-grounding continues to remove the owned section and never
+        exposes it. Consumer acquisition separately parses exactly the existing
+        single owned marker range and returns no bytes outside that range.
+      provenance_output: forbidden
+      producer_invariance: >-
+        Personal parsing accepts only profile bytes and therefore returns the
+        same result regardless of project glossary presence.
+    output:
+      entry_fields: [term, meaning, owner]
+      owners: [personal, project]
+      source_fields: [owner, availability, entries, gap_proving, diagnostic]
+      diagnostic_fields: [class, recovery]
+      diagnostic_rule: >-
+        Diagnostics name only the availability class and a public recovery.
+        They never contain profile paths, artifact paths, raw bytes, sections,
+        definitions, entries, anchors, approval records, or provenance.
+      entry_rule: >-
+        Return only validated term and meaning plus source ownership. Do not
+        return confidence, permanence, temporal metadata, personal anchors,
+        profile paths, unrelated profile sections, project approval records, or
+        project source provenance. Acquisition does not select precedence,
+        fallback, tension, review, or a primary outcome.
+  advice_resolution:
+    implementation: active
+    runtime: packages/cli/src/analytics/glossaryAdviceResolution.ts#resolveGlossaryAdvice
+    mutation: forbidden
+    invocation:
+      command: npx -y agentera@next report glossary-advice --input REQUEST --format json
+      request_schema_version: agentera.glossaryAdviceRequest.v1
+      request_fields: [schema_version, requested_term, host_review]
+      max_request_utf8_bytes: 131072
+      acquisition: internal_bounded_owned_sources
+      project_root: current_working_directory
+      profile_path: canonical_registry_resolution
+      output_envelope_fields: [schemaVersion, command, status, advice]
+      rule: >-
+        Consumers send the requested term and optional host review through one
+        structured stdin or file request. The CLI acquires both owned sources;
+        callers never read raw project glossary or profile files. The command is
+        read-only, headless, JSON-only, and never refreshes either source.
+    input:
+      fields: [requested_term, acquired, host_review]
+      requested_term_utf8_bound: consumer_boundary.acquisition.bounds.max_source_utf8_bytes
+      acquired_contract: consumer_boundary.acquisition.output
+      host_review:
+        optional: true
+        fields: [relation, candidate_owner, candidate_term]
+        relations: [inferred_equivalence]
+        candidate_owners: [personal]
+        rule: >-
+          A host may report only one explicit inferred-equivalence relation to
+          one differently named, valid acquired personal candidate. Omission
+          means no inferred candidate. Unknown relations, owners, fields, or
+          candidates fail before selection and never echo input content.
+      additional_fields: forbidden
+    output:
+      schema_version: agentera.glossaryAdvice.v1
+      fields: [outcome, applicable_meaning, applicable_owner, review, tension, advisory]
+      owners: [personal, project]
+      advisory_fields: [reason, ownership_state]
+      advisory_reasons: [personal_input_unavailable, inferred_equivalence]
+      advisory_ownership_states: [project_governs_exact]
+      rule: >-
+        Return exactly one matrix outcome and its authority-declared semantics.
+        Include only the selected meaning and owner. An orthogonal advisory may
+        expose only its bounded reason and ownership state. Never return the
+        requested or candidate term, acquisition diagnostics, source content,
+        paths, anchors, approvals, provenance, unrelated entries, or conflict
+        state.
+    failure:
+      classes: [invalid_request, invalid_acquisition, invalid_host_review]
+      rule: >-
+        Fail once before selection with only a bounded class and public recovery;
+        never quote or serialize an input term, meaning, diagnostic, path, raw
+        entry, profile or project content, approval, anchor, or provenance.
+  primary_selection:
+    dimensions:
+      project_input: [invalid, valid_gap, valid_exact]
+      personal_input: [invalid, valid_without_exact, valid_exact]
+      exact_meaning: [not_applicable, equivalent, divergent]
+      inferred_candidate: [absent, present]
+    valid_state_rule: >-
+      exact_meaning is equivalent or divergent exactly when both inputs have an
+      exact term; otherwise it is not_applicable. inferred_candidate is
+      considered only when no personal exact term exists.
+    order:
+      - invalid_or_unavailable_project
+      - equivalent_exact_collision
+      - divergent_exact_collision
+      - project_only
+      - proven_project_gap
+      - inferred_equivalence
+      - invalid_or_unavailable_personal
+      - no_applicable_entry
+    rule: >-
+      Evaluate rows in this order and select exactly the first matching primary
+      outcome. The declared valid input state space must match exactly one row;
+      availability and inferred-equivalence advisories never compete with a
+      usable exact project meaning.
+  outcome_matrix:
+    invalid_or_unavailable_project:
+      when: project input is malformed, unreadable, ambiguous, or over bound
+      match:
+        project_input: [invalid]
+        personal_input: [invalid, valid_without_exact, valid_exact]
+        exact_meaning: [not_applicable]
+        inferred_candidate: [absent, present]
+      judgment: deterministic
+      selected_owner: none
+      selected_meaning: none
+      review: unavailable
+      tension: authority_unavailable
+    equivalent_exact_collision:
+      when: valid personal and project entries have exact term identity and exact meaning identity
+      match:
+        project_input: [valid_exact]
+        personal_input: [valid_exact]
+        exact_meaning: [equivalent]
+        inferred_candidate: [absent, present]
+      judgment: deterministic
+      selected_owner: project
+      selected_meaning: project
+      review: none
+      tension: none
+    divergent_exact_collision:
+      when: valid personal and project entries have exact term identity but not exact meaning identity
+      match:
+        project_input: [valid_exact]
+        personal_input: [valid_exact]
+        exact_meaning: [divergent]
+        inferred_candidate: [absent, present]
+      judgment: deterministic
+      selected_owner: project
+      selected_meaning: project
+      review: none
+      tension: divergent_exact_collision
+    project_only:
+      when: >-
+        valid project input has an exact term and personal input is invalid,
+        unavailable, valid without an exact term, or only a differently named
+        inferred-equivalence candidate
+      match:
+        project_input: [valid_exact]
+        personal_input: [invalid, valid_without_exact]
+        exact_meaning: [not_applicable]
+        inferred_candidate: [absent, present]
+      judgment: deterministic
+      selected_owner: project
+      selected_meaning: project
+      review: none_for_primary
+      tension: none
+    proven_project_gap:
+      when: project state is gap-proving and one valid personal exact term exists
+      match:
+        project_input: [valid_gap]
+        personal_input: [valid_exact]
+        exact_meaning: [not_applicable]
+        inferred_candidate: [absent, present]
+      judgment: deterministic
+      selected_owner: personal
+      selected_meaning: personal
+      review: none
+      tension: none
+    inferred_equivalence:
+      when: >-
+        project state is gap-proving, personal input is valid without an exact
+        term, and the host identifies a possible semantic-equivalence candidate
+      match:
+        project_input: [valid_gap]
+        personal_input: [valid_without_exact]
+        exact_meaning: [not_applicable]
+        inferred_candidate: [present]
+      judgment: host_reviewed
+      selected_owner: none_until_review
+      selected_meaning: none_until_review
+      review: required_when_meaning_sensitive
+      tension: inferred_equivalence
+    invalid_or_unavailable_personal:
+      when: >-
+        project state is gap-proving and personal input is malformed,
+        unavailable, or over bound, so no fallback can be proven
+      match:
+        project_input: [valid_gap]
+        personal_input: [invalid]
+        exact_meaning: [not_applicable]
+        inferred_candidate: [absent, present]
+      judgment: deterministic
+      selected_owner: none
+      selected_meaning: none
+      review: unavailable
+      tension: input_unavailable
+    no_applicable_entry:
+      when: >-
+        project state is gap-proving, personal input is valid without an exact
+        term, and no inferred-equivalence candidate is present
+      match:
+        project_input: [valid_gap]
+        personal_input: [valid_without_exact]
+        exact_meaning: [not_applicable]
+        inferred_candidate: [absent]
+      judgment: deterministic
+      selected_owner: none
+      selected_meaning: none
+      review: none
+      tension: none
+  orthogonal_advisories:
+    personal_input_unavailable_with_project_exact:
+      primary_outcome: project_only
+      when: personal_input is invalid and project_input is valid_exact
+      match:
+        project_input: [valid_exact]
+        personal_input: [invalid]
+        exact_meaning: [not_applicable]
+        inferred_candidate: [absent, present]
+      caveat_reason: personal_input_unavailable
+      ownership_state: project_governs_exact
+      rule: >-
+        Preserve the exact project meaning. The bounded availability caveat may
+        report only reason and ownership state; it never becomes another primary
+        outcome or exposes personal content.
+    inferred_equivalence_with_project_exact:
+      primary_outcome: project_only
+      when: >-
+        personal_input is valid_without_exact, project_input is valid_exact, and
+        inferred_candidate is present
+      match:
+        project_input: [valid_exact]
+        personal_input: [valid_without_exact]
+        exact_meaning: [not_applicable]
+        inferred_candidate: [present]
+      review: required_when_the_inferred_relation_is_meaning_sensitive
+      caveat_reason: inferred_equivalence
+      ownership_state: project_governs_exact
+      rule: >-
+        Project authority remains the usable primary meaning. Host review governs
+        only the possible differently named relation and cannot displace, merge,
+        or suppress the exact project entry.
+  refresh_events:
+    required:
+      - initial_meaning_sensitive_input
+      - later_user_requirement_change_that_can_change_meaning
+      - later_user_intent_change_that_can_change_meaning
+      - later_acceptance_change_that_can_change_meaning
+      - later_deliberation_premise_change_that_can_change_meaning
+      - later_cycle_intent_change_that_can_change_meaning
+      - clarification_answer_for_a_reviewed_term
+    not_required:
+      - unrelated_conversation_turn
+      - unchanged_input_replay
+      - background_state_reread
+      - status_or_progress_render
+      - tool_output_without_requirement_or_intent_change
+      - artifact_rendering
+      - evaluator_text_without_user_change
+      - control_only_continuation
+    rule: >-
+      Refresh only at a governed event whose changed input can alter the meaning
+      used by the capability. Rereads and incidental turns do not refresh advice.
+  discuss_integration:
+    implementation: active
+    invocation: consumer_boundary.advice_resolution.invocation
+    governed_events: consumer_boundary.refresh_events
+    outcome_authority: consumer_boundary.outcome_matrix
+    disclosure: consumer_boundary.disclosure.transient_advice
+    interaction:
+      scope: current_user_authored_meaning_sensitive_input
+      transcript_scan: forbidden
+      done_only_control: no_refresh
+      review_rule: >-
+        Before meaning-sensitive reasoning or decision framing relies on an
+        inferred relation, ask one focused clarification question under the
+        existing one-question-per-turn and Done contract. The clarification may
+        identify a host-reviewed relation for a fresh advice request but is not
+        decision confirmation, approval, or publication consent.
+      exact_collision_rule: >-
+        Use an applicable project meaning for a divergent exact collision and
+        surface the bounded divergence as a concise scratchpad tension or Crux.
+        Never ask the user to choose project versus personal authority.
+      unavailable_rule: >-
+        Continue without glossary grounding when advice is unavailable, invalid,
+        or has no applicable entry. Ask ordinary clarification only when the term
+        is necessary and ambiguous, without fabricating glossary facts.
+    output_rule: >-
+      Use only the transient applicable meaning and owner needed for the current
+      deliberation, and never quote unrelated glossary content.
+    mutation: forbidden
+    forbidden_effects:
+      - glossary_write
+      - glossary_approval
+      - publication_consent
+      - progress_caveat
+      - plan_conflict
+      - decision_conflict
+  plan_integration:
+    implementation: active
+    invocation: consumer_boundary.advice_resolution.invocation
+    governed_events: consumer_boundary.refresh_events
+    outcome_authority: consumer_boundary.outcome_matrix
+    disclosure: consumer_boundary.disclosure.transient_advice
+    mode:
+      precedence:
+        - explicit_delegated_or_orchestrated_no_pause
+        - direct_user_invocation_with_available_clarification_turn
+        - unknown_or_ambiguous
+      signals:
+        explicit_delegated_or_orchestrated_no_pause:
+          result: autonomous
+        direct_user_invocation_with_available_clarification_turn:
+          result: interactive
+        unknown_or_ambiguous:
+          result: interactive_waiting
+      silence_or_timeout: never_autonomous
+      rule: >-
+        Use the first matching signal. Unknown or conflicting mode evidence waits
+        for interactive clarification; silence and elapsed time never imply
+        autonomous execution.
+    interaction:
+      scope: current_user_authored_meaning_sensitive_input
+      transcript_scan: forbidden
+      control_only_continuation: no_refresh
+      review:
+        interactive_sequence:
+          - emit_one_focused_clarification
+          - wait_for_user_answer
+          - refresh_advice_for_affected_term
+          - finalize_affected_scope_requirements_tasks_acceptance
+        autonomous_sequence:
+          - abstain_from_disputed_meaning
+          - defer_affected_scope_requirements_tasks_acceptance
+          - emit_transient_handoff_intent
+        clarification_effects:
+          - not_plan_approval
+          - not_decision_confirmation
+          - not_glossary_approval
+          - not_publication_consent
+      exact_collision_rule: >-
+        Use an applicable project meaning for a divergent exact collision. Where
+        the divergence materially affects planning, represent only the bounded
+        tension and never disclose the personal definition.
+      unavailable_rule: >-
+        Continue without glossary grounding when advice is unavailable, invalid,
+        or has no applicable entry. In interactive Plan, ask ordinary focused
+        clarification only when the term is necessary and meaning-critical.
+    autonomous_handoff_intent:
+      status: transient_emitted_not_delivered
+      caller_fields: [event, reason, ownership_state]
+      fixed_values:
+        event: current
+      accepted_writer_flags:
+        [--input]
+      input: one progress cycle YAML/JSON mapping whose glossary_caveat contains the three caller fields
+      writer_owned_fields: [caveat_id, capability, transition_id]
+      forbidden_fields: [caveat_id, capability, transition_id]
+      forbidden_claims: [delivered, stored, persisted, published, durable_envelope]
+      durable_writer: build
+      writer_interface: npx -y agentera@next state progress explain --verb append --format json
+      writer_result: authoritative_identity_and_six_field_envelope
+      allowed_reason_state_pairs: consumer_boundary.autonomous_caveat.allowed_current_pairs
+      rule: >-
+        Emit one intent only when autonomous meaning-sensitive work has unresolved
+        review or unavailable authority. The emitted-only intent contains exactly
+        event=current, reason, and ownership_state, the three caller inputs accepted
+        by the Build writer in one bounded structured record input. It is not delivered, stored, persisted, or published.
+        The writer creates caveat_id, capability=build, and transition_id=null to
+        complete the authoritative current envelope.
+    exact_project_personal_unavailable:
+      primary_outcome: project_only
+      advisory_reason: personal_input_unavailable
+      advisory_ownership_state: project_governs_exact
+      plan_action: ground_exact_project_meaning
+      autonomous_handoff_intent: none
+      durable_unresolved_caveat: none
+      rule: >-
+        Unavailable personal input does not make exact project authority
+        unresolved. Keep the advisory transient and never emit or publish it as
+        an autonomous unresolved handoff.
+    unavailable:
+      invalid_project:
+        interactive: clarify_or_wait_when_meaning_critical
+        autonomous: abstain_defer_and_emit_authority_unavailable
+        handoff_pair: [authority_unavailable, authority_unavailable]
+      invalid_personal_after_project_gap:
+        interactive: clarify_or_wait_when_meaning_critical
+        autonomous: abstain_defer_and_emit_personal_input_unavailable
+        handoff_pair: [personal_input_unavailable, authority_unavailable]
+    behavior_matrix:
+      interactive_review_required:
+        mode: interactive
+        plan_action: clarify_refresh_then_finalize
+        handoff_intent: none
+      autonomous_review_required:
+        mode: autonomous
+        plan_action: abstain_and_defer
+        handoff_intent: emitted
+      exact_project_personal_unavailable:
+        mode: any
+        plan_action: ground_exact_project_meaning
+        handoff_intent: none
+      unavailable_unresolved:
+        mode: autonomous
+        plan_action: abstain_and_defer
+        handoff_intent: emitted
+      divergent_exact_collision:
+        mode: any
+        plan_action: ground_project_and_bound_tension
+        handoff_intent: none
+      irrelevant_or_no_applicable_entry:
+        mode: any
+        plan_action: leave_unaffected_planning_unchanged
+        handoff_intent: none
+    output_rule: >-
+      Use only the transient applicable meaning and owner needed for affected
+      planning. An autonomous handoff intent is emitted, not delivered or stored,
+      and contains exactly event=current, reason, and ownership_state for a later
+      Build write.
+    handoff: consumer_boundary.autonomous_caveat.handoff.plan
+    mutation: forbidden
+    forbidden_effects:
+      - glossary_write
+      - glossary_approval
+      - publication_consent
+      - progress_caveat
+      - plan_conflict
+      - decision_conflict
+  disclosure:
+    transient_advice:
+      allowed: [outcome, applicable_meaning, applicable_owner, review, tension, advisory]
+      minimum_rule: >-
+        Include a meaning only when that meaning is selected by the matrix and
+        needed for the current meaning-sensitive work. Never include unrelated entries.
+      forbidden:
+        - personal_evidence_anchor
+        - personal_profile_path
+        - raw_personal_glossary_section
+        - unrelated_entry
+        - provenance
+        - project_source_path
+    durable_surfaces:
+      surfaces: [progress_evidence, prime_attention, diagnostics, errors]
+      allowed: [caveat_id, event, capability, reason, ownership_state, transition_id]
+      forbidden:
+        - personal_definition
+        - project_definition
+        - personal_evidence_anchor
+        - personal_profile_path
+        - raw_personal_glossary_section
+        - raw_project_glossary_section
+        - unrelated_entry
+        - provenance
+        - project_source_path
+      failure_rule: >-
+        Errors identify only the invalid input class and a public recovery command;
+        they never quote private bytes, definitions, paths, anchors, or provenance.
+    plan_artifacts:
+      surfaces:
+        [
+          scope,
+          requirements,
+          constraints,
+          tasks,
+          task_acceptance,
+          overall_acceptance,
+          diagnostics,
+          handoff,
+        ]
+      allowed_sources:
+        [user_authored_term, user_authored_clarification, derived_behavioral_requirement]
+      forbidden_content:
+        - profile_derived_definition
+        - personal_glossary_definition
+        - personal_evidence_anchor
+        - personal_profile_path
+        - raw_personal_glossary_section
+        - raw_project_glossary_section
+        - unrelated_entry
+        - provenance
+        - project_source_path
+      user_term_rule: >-
+        A term already supplied by the user may remain in the plan. Never copy or
+        quote a profile-derived or personal glossary definition; express only the
+        derived behavioral requirement needed by the plan.
+  autonomous_caveat:
+    durable_owner: build
+    durable_channel: progress
+    authority: skills/agentera/schemas/artifacts/progress.yaml#ENTITY_AUTHORITY
+    publication_command: npx -y agentera@next state progress append
+    publication_boundary: progress_cycle.glossary_caveat
+    publication_status: active_build
+    writer_runtime: packages/cli/src/state/progressEntities.ts#appendProgressEntity
+    writer_interface: npx -y agentera@next state progress explain --verb append --format json
+    envelope_validator: packages/cli/src/state/progressGlossaryCaveat.ts#validateProgressGlossaryCaveat
+    lifecycle_validator: packages/cli/src/state/progressGlossaryCaveat.ts#glossaryCaveatLifecycleInvalidEntities
+    allowed_current_pairs:
+      - reason: inferred_equivalence
+        ownership_state: review_required
+      - reason: inferred_equivalence
+        ownership_state: project_governs_exact
+      - reason: authority_unavailable
+        ownership_state: authority_unavailable
+      - reason: personal_input_unavailable
+        ownership_state: authority_unavailable
+    identity:
+      field: caveat_id
+      type: opaque_non_content_id
+      alphabet: abcdefghijklmnopqrstuvwxyz
+      length: 10
+      pattern: "^[a-z]{10}$"
+      rule: >-
+        Assign a fresh opaque ID for a current caveat and carry it unchanged to
+        its matching terminal event. The ID must not encode a term, meaning,
+        anchor, path, provenance, or project identity.
+    envelope:
+      schema_version: agentera.glossaryConsumerCaveat.v1
+      fields: [caveat_id, event, capability, reason, ownership_state, transition_id]
+      additional_fields: forbidden
+      max_string_utf8_bytes: 64
+      events: [current, resolved, superseded]
+      capabilities: [build]
+      reasons: [inferred_equivalence, authority_unavailable, personal_input_unavailable]
+      ownership_states: [project_governs_exact, review_required, authority_unavailable]
+      transition_rule: >-
+        current and resolved require null transition_id. Superseded requires one
+        different opaque successor caveat_id. Every field is required; only
+        transition_id may be null.
+      current_append:
+        caller_fields: [event, reason, ownership_state]
+        caller_fixed_values:
+          event: current
+        writer_fields: [caveat_id, capability, transition_id]
+        writer_fixed_values:
+          capability: build
+          transition_id: null
+        rule: >-
+          A current append requires the caller to submit event=current, reason,
+          and ownership_state. The writer creates the opaque identity, Build
+          capability, and null current-transition field; it never defaults event.
+    lifecycle:
+      current: >-
+        Append current once when autonomous meaning-sensitive work cannot pause
+        and review or authority remains unresolved.
+      resolved: >-
+        Append resolved with the same caveat_id after explicit clarification or
+        a governed refresh proves the caveat no longer applies.
+      superseded: >-
+        Append superseded with the old caveat_id and the fresh successor ID as
+        transition_id when a governed refresh replaces, rather than resolves,
+        the caveat.
+      matching_rule: >-
+        The latest valid event for one caveat_id determines whether it is current.
+        A terminal event affects only its matching identity. Supersession is valid
+        only when a matching current successor event also exists.
+      expiration: none
+      expiration_rule: >-
+        Time alone never resolves or hides a caveat. Only an explicit matching
+        resolved or valid superseded transition makes it noncurrent.
+    prime_projection:
+      status: active
+      runtime: packages/cli/src/state/progressGlossaryCaveat.ts#projectCurrentGlossaryCaveats
+      retrieval: canonical_validated_progress_entities
+      attention_text: "normal: glossary review required before meaning-sensitive work"
+      max_attention_entries: 1
+      source:
+        artifact: progress
+        boundary: progress_cycle
+        capability: build
+      capacity:
+        public_attention_limit: 6
+        reserved_glossary_slots: 1
+        policy: reserve_final_slot_when_current
+        unrelated_retention: first_five_in_existing_order
+      insertion: reserved_final_slot_when_current
+      rule: >-
+        Reconstruct current caveats by opaque identity from validated canonical
+        progress entities. A matching resolved event or valid superseded event
+        removes only that identity. Invalid, orphan, mismatched, or duplicate
+        terminal evidence is omitted and cannot suppress a valid current event.
+        Emit at most the declared generic attention text when one or more current
+        caveats remain; preserve the relative order of every unrelated attention
+        entry and do not change next-action selection.
+      expiration: none
+      forbidden_sources:
+        - timestamp
+        - recency
+        - plan_state
+        - transient_plan_handoff
+        - profile_presence
+        - unrelated_progress
+      forbidden_output:
+        - caveat_id
+        - transition_id
+        - reason
+        - ownership_state
+        - definition
+        - meaning
+        - anchor
+        - path
+        - raw_section
+        - provenance
+        - source_bytes
+      malformed_evidence:
+        prime: omit
+        direct_progress_retrieval: fail_closed_generic_corrupt_entity
+        allowed_diagnostic: canonical progress evidence is corrupt; run state validation
+        forbidden_diagnostic_content:
+          [stored_filename, stored_path, parser_text, raw_value, raw_bytes, provenance]
+    handoff:
+      plan: >-
+        Plan cannot write progress. In autonomous mode it emits at most one
+        transient intent containing exactly event=current, reason, and
+        ownership_state and stores no caveat or conflict in plan state. It never
+        emits identity, capability, transition_id, or a purported complete or
+        delivered durable envelope.
+      discuss: >-
+        Discuss pauses for clarification; it does not persist caveat evidence or
+        turn review into decision approval.
+      build: >-
+        Build is the sole durable writer and may later pass all three emitted
+        intent inputs to the typed progress writer. The writer preserves the
+        caller-owned event, reason, and ownership_state and creates authoritative
+        identity, capability, and transition_id fields. Advice never invokes
+        glossary publication.
+  publication_isolation:
+    rule: >-
+      Advice, tension, review, clarification, caveat publication, resolution, and
+      supersession never invoke glossary publication, authorize a proposal, reuse
+      confirmation, satisfy a decision, or approve plan state.
+    project_publication_authority: ownership_contracts.project.publication
+  downstream_gate:
+    status: blocked_until_contract_valid
+    validator: packages/cli/src/registries/glossaryEntryContract.ts#validateGlossaryEntryContract
+    command: npx -y agentera@next check validate vocabularyAuthority --format json
+    required_sections:
+      - consumer_boundary.acquisition
+      - consumer_boundary.advice_resolution
+      - consumer_boundary.primary_selection
+      - consumer_boundary.outcome_matrix
+      - consumer_boundary.orthogonal_advisories
+      - consumer_boundary.refresh_events
+      - consumer_boundary.discuss_integration
+      - consumer_boundary.plan_integration
+      - consumer_boundary.disclosure
+      - consumer_boundary.autonomous_caveat
+      - consumer_boundary.publication_isolation
+    failure_rule: >-
+      Discuss, Plan, Build, advice, and prime integration remain blocked when
+      validation reports a missing or contradictory section. Acquisition itself
+      fails closed. Each issue names the invalid section and required correction.
+  profile_grounding:
+    implementation: active_exclusion_only
+    capabilities: [discuss, plan, build]
+    command: npx -y agentera@next report profile-grounding --format json
+    schema_version: agentera.profileGrounding.v1
+    parser: packages/cli/src/analytics/personalGlossaryProfile.ts#personalProfileGrounding
+    max_profile_utf8_bytes: 65536
+    validity:
+      statuses: [absent, valid, repair_needed]
+      classes: [absent, valid, malformed, ambiguous, unreadable, unsafe, oversized, invalid_utf8]
+    freshness:
+      states: [current, stale, unknown]
+      rule: Freshness is computed only after one source passes validity and never changes validity.
+    recovery:
+      repair: >-
+        Use the Profile capability to repair or regenerate PROFILE.md, then retry `npx -y agentera@next report profile-grounding --format json`; no profile bytes were changed.
+      absent: >-
+        Use the Profile capability to generate PROFILE.md, then retry npx -y agentera@next report profile-grounding --format json.
+    raw_profile_read: forbidden
+    content_rule: >-
+      Return the complete profile with exactly the validated owned personal
+      Glossary marker range removed. Preserve every byte outside that range.
+      This is profile grounding only and performs no glossary lookup, project
+      glossary read, precedence, matching, review, collision, or advisory work.
+      Profile Full retains access to the complete stored profile for regeneration.
+    failure_rule: >-
+      Absent and repair-needed profiles return nonzero with the shared validity
+      object, exact advancing recovery, unknown freshness, and no profile
+      content. Oversized, unsafe, unreadable, invalid UTF-8, and malformed or
+      ambiguous owned Glossary sources fail closed without path or byte leaks.
+  exact_collision:
+    behavior: project_precedence_at_consumption
+    persistence: forbidden
+    personal_entry_suppression: forbidden
+  inferred_semantic_equivalence:
+    behavior: user_review
+    automatic_merge: forbidden
+    suppression: forbidden
+    precedence: forbidden
+  rule: >-
+    Audit remains mutation-free and Build project-glossary publication is active.
+    Build, Discuss, Plan, and prime bounded glossary consumption are active, and
+    Build progress caveat publication and explicit personal publication are active.
+    Profile Full preserves an existing owned section, then uses only the current
+    consent-bound personal generation and canonical authorized personal publication.
+    Project-driven personal-profile mutation and docs-mapping mutation remain deferred.
+
+deferred_capability_contracts:
+  profile:
+    capabilities: [profile]
+    implementation: active_partial
+    intended_behavior: personal_glossary_synthesis
+    active_behavior:
+      - ownership_contracts.personal.admission
+      - personal_mining_authority.profile_full
+    inactive_behavior: [lookup]
+    contracts:
+      admission: ownership_contracts.personal.input
+      provenance: ownership_contracts.personal.allowed_provenance
+      confidence: shared_primitive.fields.confidence
+      retention_and_decay: ownership_contracts.personal.retention_and_decay
+      profile_full: personal_mining_authority.profile_full
+    forbidden_current_claims: [lookup, project_glossary_consumption]
+  audit:
+    capabilities: [audit]
+    implementation: active_partial
+    active_behavior: terminology_drift_finding_generation
+    finding_family:
+      status: implemented
+      mutation: forbidden
+      evidence: ownership_contracts.project.input
+      confidence: skills/agentera/protocol.yaml#CONFIDENCE_SCALE
+      filtering: skills/agentera/capabilities/audit/schemas/validation.yaml
+      canonical_proposal_rule: >-
+        Propose the term with the most distinct verified project-file anchors;
+        break ties lexicographically. A proposal is an audit finding, never a
+        decision or persisted glossary entry.
+      personal_comparison_rule: >-
+        A supplied personal-profile term may annotate divergence for the same
+        assessed concept. Missing profile evidence adds no divergence and never
+        invents a personal term.
+    proposal_output:
+      implementation: active
+      intended_output: read_only_terminology_drift_finding
+      digest: ownership_contracts.project.proposal_digest
+    inputs:
+      personal_history: ownership_contracts.personal.input
+      project_file: ownership_contracts.project.input
+      project_file_history_classification: forbidden
+    forbidden_current_claims: [persistence, approval, docs_mapping_mutation, lookup]
+  build_publication:
+    capabilities: [build]
+    implementation: active
+    active_behavior: ownership_contracts.project.publication
+    output: skills/agentera/schemas/artifacts/glossary.yaml
+    inactive_behavior:
+      [
+        lookup,
+        precedence,
+        semantic_equivalence_review,
+        personal_profile_mutation,
+        docs_mapping_mutation,
+      ]
+    forbidden_current_claims:
+      [lookup, precedence, review, personal_profile_mutation, docs_mapping_mutation]
+  consumers:
+    capabilities: [discuss, plan, build, prime]
+    implementation:
+      build: active
+      discuss: active
+      plan: active
+      prime: active
+    behavior: consumer_boundary
+    forbidden_current_claims: []