ctxr-cli 0.2.2 → 0.4.0

package/templates/skills/ctxr-derived-artifacts.md

@@ -0,0 +1,25 @@
+A derived artifact is the deterministic output of a build over the store: catalog sections, the graph,
+the generated AGENTS.md sections, the entry files, the owned skills, adapter outputs. They rot two ways —
+stale (the source moved, the artifact did not) and clobbered (a build against the wrong base, or a hand
+edit inside a fence that the next build erases).
+
+1. Identify the source of truth and the builder: catalog ← notes (`ctxr catalog build`); graph ← notes
+   (`ctxr graph build`, lives under the cache paths, never committed); AGENTS.md sections, entry files,
+   skills, hooks ← config + the installed package (`ctxr update`); adapter outputs ← config
+   (`ctxr adapters generate`).
+2. Check BEFORE you build: `ctxr catalog check` (add `--stale` for glosses whose note changed) and
+   `ctxr doctor`. Zero coverage, a parse error, or a count far below the store's real note count means
+   the builder and the base disagree — STOP; a build now writes a broken or empty artifact. Fix the base,
+   or hand-add only your entries, matching the committed structure, and say so in the commit message.
+3. Build, then read the result back: reported counts against the source (notes vs catalog entries, graph
+   nodes vs notes); your new notes present with non-zero links; nothing else lost.
+4. Fences: never hand-edit inside a `contexture:<region>` fence — the next build overwrites it. Hand
+   edits OUTSIDE a fence (catalog glosses, prose around a generated section) are preserved by every
+   build and are the right place for them. A note's own operator-defined fenced region (a ledger, a
+   log, any block maintained via `ctxr entry append <note> --region <name>`) is a different concern —
+   that append is the sanctioned write into it, never a hand edit.
+5. Commits: artifacts under the cache paths never stage. Committed derived files (the catalog) ride
+   their own small change AFTER the content lands, path-scoped (`git add <path>`), never swept up with
+   `-A` in a checkout other sessions use.
+6. Verify the remote, not the claim: after "it's merged", `git fetch origin` and
+   `git show origin/__DEFAULT_BRANCH__:<path> | grep -c <marker>` before treating the loop as closed.

package/templates/skills/ctxr-ingest-orchestration.md

@@ -0,0 +1,42 @@
+Ingest is synthesis, not filing. The question is what the store should know after this source, not where
+to put the file — "create a new note" is one option among several, never the default.
+
+1. Capture: write a plain markdown file directly into the inbox (see AGENTS.md's capture section) — no
+   provenance frontmatter; contexture assigns it at ingest.
+2. Check: run `ctxr source check <path> --source-id <id>` and read the verdict — `new`, `already_ingested`,
+   `drift` (same identity, the source's content moved — read what changed and decide whether to update the
+   note, then `ctxr source stamp <path> --id <id>` once resolved), `alternate_source_match`, or
+   `multiple_matches`. On `multiple_matches`, stop and resolve the ambiguity yourself; never guess which
+   existing note it is. A legacy note with an identity but no hash on file: `ctxr source stamp` backfills
+   it. A source re-published under a new URL you've confirmed is the same material:
+   `ctxr source add-alt <path> --id <new-id>` on the existing note, not a second ingest.
+3. Read the source fully. Then read the existing cluster BEFORE writing anything: the catalog section for
+   the domain (`ctxr catalog show --section <id>`), every related note in it (all of them, not one or two),
+   and the graph (`ctxr graph build`, then read the graph document it writes at
+   `.contexture/cache/graph.md` for hub notes by cluster and cross-cluster bridges; `ctxr graph query hubs`
+   and `ctxr graph query neighbors <path>` on the closest note for the detail). Ask: what does the
+   store already know, and does this source confirm, extend, contradict, or nuance it?
+4. Decide — the decision table:
+
+   | The source… | Action |
+   |---|---|
+   | adds a genuinely new concept | create a new note |
+   | deepens an existing note | update and expand that note |
+   | makes two notes redundant | merge them; fix every cross-link |
+   | reveals a note is badly structured | recreate it with better structure |
+   | belongs as a section, not a page | add a section to the existing note |
+   | does several of the above | do all of them |
+
+   - Hub check: if the cluster's hub already covers this, update the hub. If this source could become a
+     hub — a note many future notes will reference — create it at hub level, not as a leaf.
+   - Bridge check: if the source connects two clusters that have no bridge note, create one or add
+     explicit cross-links.
+   - Thesis-change rule: when new material contradicts a note, patch its top-level conclusion FIRST, then
+     hunt down the now-stale verdict language further down. A corrected body under an uncorrected
+     headline is worse than either alone.
+   - Source discipline: a field the source does not confirm is "not reported" — never inferred from
+     silence in either direction.
+5. Write: for a new note, `ctxr ingest <path> --source-type <type> --source-id <id>` (stamps provenance and
+   gives it a catalog entry). Updates to existing notes are ordinary edits that preserve prior content
+   (a deliberate ingest despite an `alternate_source_match` is the same command).
+6. Verify: `ctxr lint` (orphans, broken links, leftover inbox material) and `ctxr catalog check`.

package/templates/skills/ctxr-land.md

@@ -0,0 +1,19 @@
+The land half of the session lifecycle, after review. `ctxr-submit` is the other half; `ctxr-session-lifecycle`
+covers what surrounds both and is not repeated here.
+
+1. Resolve the target: the current session branch by default, or name one with `--branch <name>` or
+   `--pr <n>`. Never run this against `__DEFAULT_BRANCH__` itself.
+2. Run `ctxr session land` (add `--yes` only when you already have explicit approval from elsewhere in
+   this conversation; otherwise let it prompt). It reads the pull request's state, gates the merge behind
+   an explicit confirmation, merges with `--merge-method` (default squash), confirms the forge reports
+   merged, and fast-forwards the default branch in the checkout it runs from when that checkout is on
+   `__DEFAULT_BRANCH__` — a checkout that cannot fast-forward is reported, never forced.
+3. Conflicting or unknown mergeability stops the command; follow `ctxr-session-lifecycle`'s conflict
+   playbook, then retry — a retry re-reads state and performs only what remains.
+4. Add `--reap` to remove the session worktree in the same run, once it is clean and merged; otherwise
+   run `ctxr session reap` afterward, or leave cleanup to whoever owns the worktree.
+5. Report exactly what the command reported — merged or not, synced or not (with why not), reaped or not
+   (with why not). Never claim a merge or a cleanup the command itself did not confirm.
+
+Never merge by hand (a raw forge-CLI merge, the forge's web UI on this agent's behalf): `ctxr session land`
+is the only merge path, so every landing leaves the same audit trail and passes through the same gate.

package/templates/skills/ctxr-mission.md

@@ -0,0 +1,36 @@
+Keep this store's mission document — the standing "what's active right now" map AGENTS.md names at
+`organize.mission_path` when configured — current: priorities, active builds, back burner, sunset
+candidates, and debt. Hand-written content outside the fenced region is never touched.
+
+Run `ctxr rollup stale` (or `--for <mission_path>`) first — a never-written mission document, or one whose
+recorded timestamp has aged past `organize.rollup_stale_days`, is reported stale on elapsed time alone (no
+backlinks compared, unlike an entity rollup); use it instead of guessing from memory whether the document
+is out of date.
+
+1. Resolve `<mission_path>` from AGENTS.md's canonical section. If no mission document is configured for
+   this store, STOP — this skill has nothing to maintain; do not invent a path or create one unasked.
+2. Gather from recent work: the current session's own changes, and every store location the taxonomy
+   declares (read AGENTS.md's "Placing a new note" section for the configured layers) — not backlinks, and
+   not a sample. A priority absent from every configured layer is not a store priority; treat it as the
+   operator's own working memory instead and leave it out.
+3. For each active priority, state its status, its purpose, and its next useful action — a priority with no
+   next action is not actionable, and one with no purpose is not a priority; resolve or downgrade it rather
+   than carry it silently.
+4. For each back-burner item, state plainly why it is not active right now — a size cutoff, a blocking
+   dependency, a deliberate deprioritization. An item with no stated reason for being dormant reads as
+   simply forgotten; do not leave one that way.
+5. Carry sunset candidates (work whose end state is in sight or whose relevance is fading) and operational
+   debt (deferred cleanup, known gaps, workarounds owed a real fix) as their own sections, separate from
+   active and back-burner priorities — never folded into either.
+6. Synthesize into a file — bullets throughout, short clauses; skip any empty section silently (never
+   "N/A", "none", or "TBD"). Nothing dated later than today; no editorializing beyond the status/purpose/
+   next-action shape above.
+7. Write: `ctxr rollup write <mission_path> --content-file <file>` — the same command `ctxr-rollup` uses for
+   an entity, applied here to the store's own mission path; an idempotent fenced write (`changed: false` and
+   a byte-identical file when the content matches; mismatched markers abort with nothing written).
+
+## Report
+
+Mission path, `changed` or unchanged, and what moved since the last write (a priority resolved, a new
+back-burner addition, a sunset candidate promoted or dropped). Anything outside the fence you want to fix
+is a separate, explicit edit.

package/templates/skills/ctxr-organize-audit.md

@@ -0,0 +1,49 @@
+1. Run `ctxr lint` for the full health report — orphan notes, broken links, uningested inbox material,
+   catalog gaps. It always exits 0; its findings are observations for judgment, never a block.
+2. Run `ctxr doctor` for the invariants that DO block: catalog coverage, fail-closed visibility, hook
+   health, and more. Address doctor's failures before `ctxr session submit`; it runs the same checks.
+
+## Placement review
+
+The diagnostic that works: "what standard am I maintaining here, and what is my review cadence?" A
+location reviewed on a cadence is an ongoing responsibility; one touched only when its material is needed
+is reference — whatever its label says. Apply a file-count sanity check first: dozens of reference
+readings under a responsibility label is drift. Watch for topic libraries creeping back into layers
+organized by actionability. Single-note calls go through `ctxr-placement`.
+
+## Retiring: move, don't tag
+
+A status tag left in place defeats the layer — the active layers must show only active work.
+`ctxr archive <path>` moves the note into the configured archive location as a tracked rename; the
+visibility field travels unchanged (never rewrite it on the move). Retiring is reversible cold storage,
+not deletion. Verify with `git status --short` showing `R` (a rename, history preserved), not a delete
+plus an add, then `ctxr catalog check`.
+
+## Stale rollups
+
+`ctxr lint`'s rollup-stale finding (and `ctxr rollup stale` directly) names entity notes whose backlinks
+have moved since their last synthesis, or which have never been rolled up — hand each one to
+`ctxr-rollup` rather than re-synthesizing ad hoc.
+
+## Leak scan
+
+When a store declares context markers (`disclosure.leak_markers`), `ctxr lint` also flags content
+belonging to one context found inside a note that context cannot see; `ctxr check <path> --scan` runs
+the same scan on one note without needing an `--audience`. A finding names the marker context and the
+matched text — read it, then move or redact the content; the scan never auto-fixes.
+
+## Broken links have classes — classify before fixing
+
+- URL wrapped in wikilink syntax → convert to a markdown link.
+- Basename collision (differs from an existing note only by case, hyphenation, or display name) →
+  rewrite with `[[Real Name|display]]` alias syntax.
+- Dangling: bugs (typos, accidental self-references, a path rewrite that hit a folder name) get fixed;
+  healthy forward references (a name you may write about later, a planned hub) are intent markers —
+  leave them. Never fabricate stub notes to silence them; a one-line stub hides the real TODO and makes
+  orphan analysis lie.
+
+## Moves at scale
+
+Two commits, never a broken intermediate: commit 1 = the moves PLUS the wikilink fixes they require;
+commit 2 = tooling and doc patches. Before the moves, grep for hardcoded references to the old paths.
+After they land, rebuild the derived artifacts (`ctxr-derived-artifacts`) and re-run `ctxr lint`.

package/templates/skills/ctxr-placement.md

@@ -0,0 +1,65 @@
+Decide where a note lives BEFORE writing it, and say why: the caller wants the reasoning (which layer, why
+this location over its sibling, which visibility, what would promote it) so they can push back — not a
+folder name. Answer the questions in order; stop early only when the content clearly resolves.
+
+__LAYER_STEP__
+
+## 2. Which location within the layer?
+
+- Match on what the content IS. When two sibling locations both seem to fit, name the distinction between
+  them (abstract vs concrete; outward-facing vs inward-facing; who-we-are vs how-it-runs) and pick by
+  altitude and audience, not by keyword.
+- Read one or two sibling notes in the chosen location and match their shape — frontmatter keys, heading
+  style, bullets vs prose — before writing.
+
+## 3. Sub-item under an existing location, or a new top-level one?
+
+Default to a sub-item until it earns promotion. A near-empty top-level location is its own kind of
+clutter — worse than a slightly crowded existing one. Starting small and promoting later is cheap;
+starting big and hollow is not. Make the promotion trigger a rule, not a vibe, and write it INTO the
+note: "Promote to its own top-level location the moment this holds 3+ distinct notes or topics."
+
+## 4. Which visibility?
+
+Visibility is a placement input, not an afterthought, because the location sets the visibility default
+(`ctxr note resolve <path>` shows the resolved value and where it came from):
+
+- Lean on the location's default; set the visibility field in frontmatter only when you must.
+- Content that bridges two contexts goes to the more restrictive one — this store fails closed to its
+  default context (AGENTS.md names it) whenever nothing more specific applies.
+- Visibility can override location: when the visibility the content requires differs from every location
+  that fits topically, the topical fit loses.
+- Credentials, full account numbers, and secrets never enter the store — last-4 only.
+
+## The collision test — "should A and B be one location?"
+
+Before merging two locations, compare their visibility defaults (the placement section shows them). If
+they differ, do NOT merge: a merged location has no safe default, every note in it needs a manual
+override, and the day one is forgotten the fail-closed protection is gone — a structural guard traded for
+human vigilance. If the two genuinely form one continuum with a fuzzy seam, place the boundary
+deliberately and give the overlap ONE bridge note with an explicit visibility value, not a merged drawer.
+A merge request often mis-detects that one side is itself mis-placed; the clean answer can be the
+opposite of merging — split the mis-placed piece out and re-home it. Say so when you see it.
+
+## Perishable vs durable
+
+One capture often mixes a durable fact with perishable specifics. The durable part (the reusable
+structure, mechanic, or trap) goes into the permanent note. The perishable part (this period's values,
+links, boilerplate) goes into a fenced `contexture:<region>` block you OVERWRITE on each refresh, never
+an accumulating pile of dead entries. Do not ingest a perishable item as source material — that
+manufactures an artifact for the graveyard; capture the durable slice by hand instead.
+
+## Wire it in
+
+Add a one-line wikilink from the relevant hub note so the new note is not an orphan; `ctxr lint` flags
+orphans and notes without a catalog entry.
+
+## Relocating an existing note
+
+`ctxr archive <path>` to retire it; a plain tracked `git mv` for an ordinary re-placement. Either way the
+frontmatter — including the visibility field — is left untouched.
+
+## Verify
+
+`ctxr note resolve <path>` for the visibility; `ctxr lint` for orphans and catalog gaps; `ctxr doctor` for
+anything that blocks a submit.

package/templates/skills/ctxr-rollup.md

@@ -0,0 +1,39 @@
+Regenerate the machine-synthesized current-state region of an entity note (a person, organization,
+product, initiative, or topic hub) from every note that references it. Hand-written content outside the
+fenced region is never touched.
+
+Run `ctxr rollup stale` (or `--for <entity>` for one) to find entities worth re-rolling — it lists every
+entity note whose backlinks have moved since its last synthesis, or which has never been rolled up at
+all; use it instead of guessing from memory which entities are out of date.
+
+1. Resolve, never create. `<entity>` is a path or a note name; several candidates → list them and ask.
+   When a location has more than one plausible hub, prefer the shorter-named, undated one. If no entity
+   note exists, STOP and say so — creating it is a separate task, not a side effect of a rollup.
+2. Refuse non-entities. Dated notes, journal entries, meeting notes, generated files, and store
+   infrastructure are INPUTS to rollups, not entities. If the name resolves to one of those, stop and ask
+   which entity was meant.
+3. Gather: `ctxr rollup gather <entity>` enumerates the candidate sources (notes linking to it). Fewer
+   than 3 accepted sources → push back ("only N notes reference this; a rollup would be thin — continue?")
+   and do not auto-continue.
+4. Read EVERY accepted source, not a sample — the value of a rollup is total recall over the entity's
+   corpus. Per source note its date (filename, frontmatter, then mtime as a last resort), its kind, and
+   what it says about THIS entity specifically. For a long source, grep for the entity first.
+5. Synthesize into a file, in this shape — bullets throughout, short clauses; skip any empty subsection
+   silently (never "N/A", "none", or "TBD"):
+
+   ```
+   ## Current state
+   ### Status            — one fact per line; what it is, what is happening now, headline problem or metric
+   ### Recent activity   — `YYYY-MM-DD — what happened [[Source]]`, most recent first
+   ### Open threads      — unresolved decisions, blockers, pending actions; each links where it was raised
+   ### Key people        — `[[Person]] — role in this entity's orbit`; only people present in the corpus
+   ### Sources           — every note consulted, sorted; the audit trail
+   ```
+
+   Provenance rules: every fact traceable to a source note — nothing from memory or earlier conversation;
+   no editorializing or recommendations; nothing dated later than today; inline `[[wikilinks]]` when one
+   claim has one clear source.
+6. Write: `ctxr rollup write <entity> --content-file <file>` — an idempotent fenced write (`changed: false`
+   and a byte-identical file when the content matches; mismatched markers abort with nothing written).
+7. Report: entity path, sources accepted, `changed` or unchanged, and notable findings (e.g. the oldest
+   unresolved thread). Anything outside the fence you want to fix is a separate, explicit edit.

package/templates/skills/ctxr-session-capture.md

@@ -0,0 +1,65 @@
+End-of-session capture: propose what the session produced that is durable, write only what is approved.
+The approval gate is what keeps the blast radius low — nothing is written without it.
+
+## When
+
+Fires on the user's own closing utterance ("done", "ship it", "that's all", a sign-off) or an explicit
+request. A request to open a pull request is also a wrap signal — finish the pull request first, then
+propose (after the LAST one of a batch, not once per request).
+
+Anti-triggers — stay silent when: an error, failed test, pending question, or requested follow-up is
+outstanding (the session is not over); the recent turns are dominated by tuning the store or this skill
+itself (nothing is capturable until that lands and gets used); the items would substantially repeat a
+proposal already made this session. The agent's own summary never counts as a signal, nor does a cue
+word inside quoted text, nor a request for a session summary. Zero durable items → silent; never emit
+"scanned, nothing to save".
+
+## What is durable
+
+Include: decisions with their rationale; net-new concepts; net-new people, organizations, or
+initiatives with context; reusable patterns and playbooks; resolved non-obvious problems worth future
+recall; durable preference or environment facts the user corrected you on.
+
+Exclude: tool output, command traces, transient debugging; read-only investigation with no conclusion;
+scratch work that landed on no decision.
+
+Unsure → propose (the user can decline).
+
+## Proposal — ONE message, empty proposal omitted
+
+```
+### Store notes
+- A1  path: <layer>/<location>/<Title>.md
+      visibility: <value> — <one-line rationale; `ctxr note resolve` on a sibling shows the default>
+      sketch: bullets
+```
+
+Secret-marker pass: any item whose content looks like a credential gets `⚠ suspected-secret:` on its
+own line with why (patterns worth checking: `sk-`, `ghp_`, `AKIA` + 16 chars, `Bearer …`, a JWT
+`eyJ…`, a URL with a token/key/secret parameter). The marker is a hint; the user is the gate.
+
+End with: "Approve by ID (e.g. `A1 A3`) or `skip`." An edit request → re-propose. An ambiguous
+answer → do not proceed.
+
+## Apply
+
+Write ONLY the approved items to a YAML proposal file, in the shape `ctxr session capture` reads:
+
+```yaml
+notes:
+  - id: A1
+    path: <layer>/<location>/<Title>.md
+    mode: create            # or: append
+    visibility: <value>     # optional; omit to take the location default
+    body: |
+      matching the frontmatter and style of the sibling notes (`ctxr-placement` decides the location)
+```
+
+Then run `ctxr session capture --proposal <file>`. It validates and writes every item independently —
+one bad path never blocks the rest. These note commits ride the session pull request
+(`ctxr-session-lifecycle`).
+
+## Report from actual writes
+
+Report exactly what the command reported — wrote / appended / refused (with reason) / skipped, by ID —
+never from the proposal itself. A refused item is surfaced prominently with its reason.

package/templates/skills/ctxr-session-lifecycle.md

@@ -0,0 +1,38 @@
+Every write lands via a session worktree and a reviewed pull request; nothing commits to the default
+branch (`__DEFAULT_BRANCH__`). This skill covers what surrounds a session — starting one, re-scanning before
+any plan, resolving conflicts, and sequencing several pull requests. `ctxr-submit` and `ctxr-land` are
+the two verbs at the seams; their steps are not repeated here.
+
+## Start
+
+`ctxr session start` creates a worktree on a fresh branch off the fetched default branch; work there.
+If you find yourself on the default branch or in the root checkout, stop — `ctxr session list` shows the
+active sessions to work in instead.
+
+## Re-scan before any plan
+
+Re-scan whenever state may have moved under you — before presenting a plan, before running `ctxr-submit`,
+after any gap in the conversation: `git fetch origin`, `git status --short`, `git diff --stat`,
+`git diff --cached --stat`, `git ls-files --others --exclude-standard`,
+`git log --oneline origin/__DEFAULT_BRANCH__..HEAD`. State moves under you while you work; a plan that grows
+between scans is normal. Name the delta from the previous scan rather than silently folding new work into
+old buckets.
+
+## Conflict playbook
+
+From the session worktree: `git fetch origin && git rebase origin/__DEFAULT_BRANCH__`. For each conflicting
+file inspect both sides (`git show`), understand what each represents, and produce a version that keeps
+both meanings — never take one side blindly. `git add <file>`, `GIT_EDITOR=true git rebase --continue`,
+then `git push --force-with-lease origin <branch>` (aborts if the remote moved underneath you). Never
+resolve on the default branch.
+
+## Multi-PR sequencing
+
+Parallel when the units are file-disjoint — one `ctxr session start` per unit. Sequential when files
+overlap: wait for the merge (`ctxr-land`), then start the next session off the updated default branch.
+Worktrees isolate directories, not logical writes: a hot file every session appends to collides at merge
+time regardless — sequence those.
+
+## Reclaiming
+
+__RECLAIMING_STEP__

package/templates/skills/ctxr-submit.md

@@ -0,0 +1,26 @@
+The submit half of the session lifecycle — everything up to and including opening the pull request.
+`ctxr-land` is the other half, after review; `ctxr-session-lifecycle` covers what surrounds both (starting
+a session, the conflict playbook, sequencing several pull requests) and is not repeated here.
+
+1. Re-scan (mandatory — never replay a plan from an earlier snapshot): `git fetch origin`,
+   `git status --short`, `git diff --stat`, `git diff --cached --stat`,
+   `git ls-files --others --exclude-standard`, `git log --oneline origin/__DEFAULT_BRANCH__..HEAD`. State moves
+   under you while you work; name the delta from the previous scan rather than silently folding new work
+   into old buckets.
+2. Capture pass: run `ctxr-session-capture` exactly once here — closing a session is itself a capture
+   trigger; do not fire it again after submitting.
+3. Stage surgically: `git add <paths>`, never `git add -A`; confirm with `git status --short` that the
+   staged set matches the intended unit. Derived artifacts under the cache paths never stage.
+4. One coherent unit per pull request. If the session produced two disjoint units, say so and ask
+   whether to split.
+5. Fire gate: `ctxr session submit` commits, pushes, and opens the pull request — an external side
+   effect, and plan consent is not fire consent. Present the branch, the title, and what rides it; wait
+   for an explicit go before running it.
+6. Run: `ctxr session submit --branch "<name>" --title "<title>" --body "<why / what changed /
+   verification / follow-ups>"`. Name a real branch with `--branch` — never let a generated name reach
+   the forge. It runs the full store validation first; fix a failure, never bypass it. If no forge is
+   reachable it still pushes and prints the manual pull-request instructions.
+7. Verify before any retry: a transport error can arrive AFTER the push or the pull-request open already
+   succeeded. Before retrying anything, `git ls-remote origin <branch>` and the forge's pull-request list
+   for the branch — never replay a push or a pull-request open blindly.
+8. Hand off: report the pull request, then point at `ctxr-land` for after review.

package/dist/commands/identity.d.ts

@@ -1,24 +0,0 @@
-import type { CommandOutcome, CommandRequires } from '../core/command.js';
-import type { Store } from '../core/store.js';
-export declare const requires: CommandRequires;
-export interface IdentityEditData {
-    path: string;
-    entries: number;
-}
-export interface IdentityAddFlags {
-    file: string;
-    text: string;
-}
-export declare function executeAdd(store: Store, flags: IdentityAddFlags): Promise<CommandOutcome<IdentityEditData>>;
-export interface IdentityReplaceFlags {
-    file: string;
-    match: string;
-    text: string;
-}
-export declare function executeReplace(store: Store, flags: IdentityReplaceFlags): Promise<CommandOutcome<IdentityEditData>>;
-export interface IdentityRemoveFlags {
-    file: string;
-    match: string;
-}
-export declare function executeRemove(store: Store, flags: IdentityRemoveFlags): Promise<CommandOutcome<IdentityEditData>>;
-//# sourceMappingURL=identity.d.ts.map

package/dist/commands/identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/commands/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAU1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAmBD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAIjH;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAIzH;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAIvH"}

package/dist/commands/identity.js

@@ -1,35 +0,0 @@
-import { ExitCode } from '../core/exit-codes.js';
-import { UnknownIdentityRoleError } from '../core/errors.js';
-import { addIdentityEntry, IDENTITY_ROLES, removeIdentityEntry, replaceIdentityEntry, } from '../core/identity.js';
-export const requires = { store: 'required' };
-function checkRole(role) {
-    if (!IDENTITY_ROLES.includes(role)) {
-        throw new UnknownIdentityRoleError(role, IDENTITY_ROLES);
-    }
-}
-function outcome(store, result, humanSummary) {
-    return {
-        exitCode: ExitCode.Ok,
-        data: result,
-        findings: [],
-        humanSummary,
-        storeRoot: store.root,
-        schemaVersion: store.config.schema_version,
-    };
-}
-export async function executeAdd(store, flags) {
-    checkRole(flags.file);
-    const result = await addIdentityEntry(store.root, store.config, flags.file, flags.text);
-    return outcome(store, result, `Added an entry to "${result.path}" (${result.entries} total).`);
-}
-export async function executeReplace(store, flags) {
-    checkRole(flags.file);
-    const result = await replaceIdentityEntry(store.root, store.config, flags.file, flags.match, flags.text);
-    return outcome(store, result, `Replaced the entry matching "${flags.match}" in "${result.path}" (${result.entries} total).`);
-}
-export async function executeRemove(store, flags) {
-    checkRole(flags.file);
-    const result = await removeIdentityEntry(store.root, store.config, flags.file, flags.match);
-    return outcome(store, result, `Removed the entry matching "${flags.match}" from "${result.path}" (${result.entries} total).`);
-}
-//# sourceMappingURL=identity.js.map

package/dist/commands/identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/commands/identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAO/D,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAE,cAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,wBAAwB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAY,EAAE,MAAyC,EAAE,YAAoB;IAC5F,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE;QACZ,YAAY;QACZ,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAY,EAAE,KAAuB;IACpE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,sBAAsB,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;AACjG,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAY,EAAE,KAA2B;IAC5E,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACzG,OAAO,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,gCAAgC,KAAK,CAAC,KAAK,SAAS,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;AAC/H,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAY,EAAE,KAA0B;IAC1E,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,+BAA+B,KAAK,CAAC,KAAK,WAAW,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;AAChI,CAAC"}

package/dist/core/checks/identity-checks.d.ts

@@ -1,16 +0,0 @@
-/**
- * agent-identity spec: "Identity files... SHALL live under a path declared
- * in the store's retrieval exclusion configuration." Catalog and graph
- * already can't surface anything under an excluded prefix (they're both
- * built from listNotes()) — this check guards the one way that guarantee
- * could quietly break: an operator editing config.retrieval.exclude_paths
- * and dropping an identity path from it.
- *
- * session-capture-command spec (D3): checked against each ROLE'S RESOLVED
- * path — not the identity directory alone — so a role relocated outside
- * `identity.path` (e.g. into a directory a harness runtime links into)
- * still cannot leak into retrieval.
- */
-export declare const identityExclusionCheck: import("./types.js").CheckDefinition;
-export declare const IDENTITY_CHECKS: import("./types.js").CheckDefinition[];
-//# sourceMappingURL=identity-checks.d.ts.map

package/dist/core/checks/identity-checks.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-checks.d.ts","sourceRoot":"","sources":["../../../src/core/checks/identity-checks.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,sCAyBjC,CAAC;AAEH,eAAO,MAAM,eAAe,wCAA2B,CAAC"}

package/dist/core/checks/identity-checks.js

@@ -1,43 +0,0 @@
-import { IDENTITY_ROLES, identityFilePath } from '../identity.js';
-import { defineCheck } from './types.js';
-/**
- * agent-identity spec: "Identity files... SHALL live under a path declared
- * in the store's retrieval exclusion configuration." Catalog and graph
- * already can't surface anything under an excluded prefix (they're both
- * built from listNotes()) — this check guards the one way that guarantee
- * could quietly break: an operator editing config.retrieval.exclude_paths
- * and dropping an identity path from it.
- *
- * session-capture-command spec (D3): checked against each ROLE'S RESOLVED
- * path — not the identity directory alone — so a role relocated outside
- * `identity.path` (e.g. into a directory a harness runtime links into)
- * still cannot leak into retrieval.
- */
-export const identityExclusionCheck = defineCheck({
-    id: 'identity.excluded_from_retrieval',
-    title: 'Every identity role\'s resolved path is excluded from retrieval',
-    severity: 'invariant',
-    capability: 'agent-identity',
-    scopes: ['store'],
-    async run(ctx) {
-        const findings = [];
-        for (const role of IDENTITY_ROLES) {
-            const resolvedPath = identityFilePath(ctx.config, role);
-            const covered = ctx.config.retrieval.exclude_paths.some((prefix) => {
-                const trimmed = prefix.replace(/\/+$/, '');
-                return resolvedPath === trimmed || resolvedPath.startsWith(`${trimmed}/`);
-            });
-            if (!covered) {
-                findings.push({
-                    code: 'identity.not_excluded',
-                    severity: 'error',
-                    message: `The ${role} identity file "${resolvedPath}" is not covered by retrieval.exclude_paths — it could leak into the catalog or graph.`,
-                    subject: resolvedPath,
-                });
-            }
-        }
-        return { status: findings.length > 0 ? 'fail' : 'pass', findings };
-    },
-});
-export const IDENTITY_CHECKS = [identityExclusionCheck];
-//# sourceMappingURL=identity-checks.js.map

package/dist/core/checks/identity-checks.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-checks.js","sourceRoot":"","sources":["../../../src/core/checks/identity-checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,EAAE,EAAE,kCAAkC;IACtC,KAAK,EAAE,iEAAiE;IACxE,QAAQ,EAAE,WAAW;IACrB,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE,CAAC,OAAO,CAAC;IACjB,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC3C,OAAO,YAAY,KAAK,OAAO,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,uBAAuB;oBAC7B,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO,IAAI,mBAAmB,YAAY,wFAAwF;oBAC3I,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrE,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,sBAAsB,CAAC,CAAC"}

package/dist/core/identity.d.ts

@@ -1,46 +0,0 @@
-import type { StoreConfig } from '../config/schema.js';
-/**
- * agent-identity spec: three canonical, harness-neutral roles — posture,
- * durable world facts, durable user facts — kept distinct from retrievable
- * knowledge (excluded from every retrieval leg via each resolved path being
- * covered by config.retrieval.exclude_paths). A harness's own
- * identity-injection adapter decides how these reach a running agent; core
- * never reads their content itself.
- *
- * session-capture-command spec (D3): a role's path is CONFIGURABLE
- * (`identity.files`) — a store whose runtime keeps its memory elsewhere
- * points the role there, and every consumer below resolves through
- * `identityFilePath`/`identityFilePaths` rather than assuming the canonical
- * layout, so the relocated file IS the mechanism, not a copy of it.
- */
-export declare const IDENTITY_ROLES: readonly ['posture', 'world-facts', 'user-facts'];
-export type IdentityRole = (typeof IDENTITY_ROLES)[number];
-/** The canonical filename each role resolves to under `identity.path` when no override is configured. */
-export declare const IDENTITY_FILES: Record<IdentityRole, string>;
-/** The store-relative path this role resolves to: its configured binding, or its canonical file under `identity.path`. */
-export declare function identityFilePath(config: StoreConfig, role: IdentityRole): string;
-export declare function identityFilePaths(config: StoreConfig): string[];
-/** Creates any of the three canonical identity files that don't exist yet — never overwrites an existing one. */
-export declare function ensureIdentityFiles(root: string, config: StoreConfig): Promise<string[]>;
-/**
- * session-capture-command spec (D4): an entry is the text between two
- * delimiter lines. The default delimiter ('') means an empty (blank) line,
- * so paragraphs are entries and a heading-sectioned file's headings simply
- * become part of the entry that follows them — no section vocabulary, no
- * format detection.
- */
-export declare function splitEntries(text: string, delimiter: string): string[];
-export declare function joinEntries(entries: readonly string[], delimiter: string): string;
-export interface IdentityEntryResult {
-    /** The role's resolved, store-relative path. */
-    path: string;
-    /** The entry count after the edit. */
-    entries: number;
-}
-/** Appends a new entry at the end of the role's file, creating it (with no other entries) if it doesn't exist yet. */
-export declare function addIdentityEntry(root: string, config: StoreConfig, role: IdentityRole, text: string): Promise<IdentityEntryResult>;
-/** Replaces the single entry containing `match`; refuses, writing nothing, when zero or several entries match. */
-export declare function replaceIdentityEntry(root: string, config: StoreConfig, role: IdentityRole, match: string, text: string): Promise<IdentityEntryResult>;
-/** Removes the single entry containing `match`; refuses, writing nothing, when zero or several entries match. */
-export declare function removeIdentityEntry(root: string, config: StoreConfig, role: IdentityRole, match: string): Promise<IdentityEntryResult>;
-//# sourceMappingURL=identity.d.ts.map

package/dist/core/identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/core/identity.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIvD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,YAAI,SAAS,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAChF,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,yGAAyG;AACzG,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAIvD,CAAC;AAQF,0HAA0H;AAC1H,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,CAIhF;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAE/D;AAED,iHAAiH;AACjH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAY9F;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAmBtE;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAIjF;AAwBD,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,sHAAsH;AACtH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAQxI;AAED,kHAAkH;AAClH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,mBAAmB,CAAC,CAQ9B;AAED,iHAAiH;AACjH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,mBAAmB,CAAC,CAQ9B"}