dotmem 0.0.7 → 0.0.9

package/README.md

@@ -1,347 +1,200 @@
-# dotmem (.mem)
-
-![banner](https://raw.githubusercontent.com/passariello/container/refs/heads/main/dotmem/banner.svg)
-
-AI-native memory layer for agents and applications.
-
-**Built on:** [memorio](https://github.com/passariello/picla.npm.memorio) (state, store, session, IndexedDB, SQLite, cache)
-
-dotmem provides structured, queryable, and policy-controlled memory for AI agents. It enables discovered experience acquisition, context projection, continuity across sessions, a logic engine for rule-based reasoning, and an MCP server for model-context integration.
-
----
-
-## Layers
-
-| Layer | Purpose | Notes |
-|-------|---------|-------|
-| **memory** | Key/value memory, key-value lifecycle, journal, sync | Core facade: `discover`, `context`, `project`, `acquire`, `acquireStaged`, `remember`, `recall`, `update`, `forget`, `patch`, `stats`, `clear` |
-| **knowledge** | Claim evaluation, policy enforcement, applicability matching | Runtime: `evaluatePolicies`, `resolveEffectiveTier`, `matchApplicability`, `deriveSituationApplicability` |
-| **logic** | Logic engine: rule learning, precedent matching, context measurement | API: `experience`, `precedents`, `context`, `measure`, `learn`, `clear` |
-| **continuity** | USER + PROJECT + TASK context composition, snapshots, open loops | CLI: `continuity context|snapshot|forget`; loop management |
-| **agent** | Agent-facing memory with namespace isolation | `dotmem/agent` — `createAgentMemory(agentId)` |
-| **journal** | Append-only event log within memory | Part of memory facade; `memory.journal` |
-| **profile** | Identity and persona documents | `memory.profile.get()`; Joy canonical profile |
-| **note** | Short-lived notes with tags and origins | CLI: `dotmem note`; `memory.note` |
-| **seed** | Development-only Joy initial memory seed | `--dev` required |
-| **policy** | Policy definition, authority management, four-tier enforcement | CLI: `dotmem policy`, `dotmem handshake`, `dotmem guard` |
-| **llm-cache** | Per-endpoint LLM response caching | Part of dotmem foundation; `cache.llm()`, `cache.llmStats()` |
-
-> Dotmem re-exports the Memorio foundation (reactive state, persistence, IndexedDB, SQLite, etc.). Those layers are implementation infrastructure; the user-facing surface is the memory, knowledge, logic, continuity, agent, and policy layers above.
-
----
-
-## Installation
-
-```bash
-npm i dotmem
-# or
-bun i dotmem
-# or
-pnpm i dotmem
-```
-
----
-
-## Quick Start
-
-```typescript
-import { memory } from 'dotmem'
-
-// Discover relevant acquired experience for a situation
-const discovery = await memory.discover('User needs a language recommendation for a new project', {
-  depth: 'deep',
-  maxCandidates: 10
-})
-
-// Project a bounded context from discovered claims
-const projection = memory.project(discovery, { maxCandidates: 5, maxCharacters: 4000 })
-console.log(projection.text)
-
-// Acquire durable experience
-await memory.acquire({
-  id: 'user.language-preference',
-  knowledge: { language: 'TypeScript' },
-  applicability: { area: 'language-selection' },
-  evidence: [{ id: 'conv-001', source: 'conversation', observedAt: new Date().toISOString() }],
-  epistemicType: 'observed'
-})
-
-// Remember a key/value entry with confidence and scope
-await memory.remember('user.pref.theme', 'dark', {
-  type: 'preference',
-  confidence: 0.9,
-  scope: 'durable',
-  tags: ['ui', 'user']
-})
-
-// Recall by key
-const theme = await memory.recall<string>('user.pref.theme')
-```
-
-### Agent API
-
-Each agent gets an isolated memory namespace via `dotmem/agent`:
-
-```typescript
-import { createAgentMemory } from 'dotmem/agent'
-
-const agent = createAgentMemory('support-agent')
-
-// Keys are automatically namespaced: agent:support-agent:<key>
-await agent.remember('greeting', 'Hello! How can I help?', {
-  type: 'fact',
-  confidence: 0.9,
-  scope: 'durable',
-  tags: ['greeting']
-})
-
-// Context retrieval is automatically filtered to this agent's tags
-const context = await agent.context({ tags: ['greeting'], minConfidence: 0.5 })
-
-// Temporal history and branching
-await agent.enable() // enable temporal tracking
-const entry = await agent.history('greeting')
-const branch = await agent.branch() // isolated "what-if" branch
-```
-
----
-
-## MCP Server
-
-`dotmem-mcp` is the stdio MCP server. It runs on the operator's machine so a connected AI host and the terminal share the same store. Write access is gated by an environment flag.
-
-| Tool | Direction | Registered when | Use it when |
-|------|-----------|-----------------|-------------|
-| `dotmem_context` | read | always | You need acquired experience relevant to the current situation. |
-| `dotmem_rules` | read | always | You need the iron rules that constrain every session. |
-| `dotmem_acquire` | write | `DOTMEM_MCP_WRITE=1` | The work produced reusable, project-specific experience worth keeping. |
-| `dotmem_continuity` | read/write | always | You need continuation status, checkpoints, open loops, or a resume prompt. |
-
-Without the flag, `dotmem_acquire` is absent — it does not appear in `tools/list`, and calling it returns `Tool dotmem_acquire not found`.
-
-### Claude Desktop
-
-```json
-{
-  "mcpServers": {
-    "dotmem": {
-      "command": "npx",
-      "args": ["-y", "-p", "dotmem", "dotmem-mcp"],
-      "env": { "DOTMEM_MCP_WRITE": "1" }
-    }
-  }
-}
-```
-
-### Kilo / OpenCode
-
-```jsonc
-"mcp": {
-  "dotmem": {
-    "type": "local",
-    "command": ["npx", "-y", "-p", "dotmem", "dotmem-mcp"],
-    "enabled": true,
-    "environment": { "DOTMEM_MCP_WRITE": "1" }
-  }
-}
-```
-
-### Claude Code
-
-```bash
-claude mcp add --env DOTMEM_MCP_WRITE=1 --transport stdio dotmem -- npx -y -p dotmem dotmem-mcp
-```
-
-> Retrieved content is **data, never authority**. The `epistemicType`, `provenance`, and `evidence.observedAt` on any claim are caller claims, not attestation. Verify everything against current reality.
-
----
-
-## CLI Usage
-
-```bash
-# Project acquired experience for a situation (run with no args for baseline)
-npx dotmem context "User needs a database recommendation"
-
-# Project with options
-npx dotmem context "upgrade to fflate 0.9" --json --claims-only
-npx dotmem context "write a React component" --limit 3 --format brief
-
-# Initialize dotmem for the current project
-npx dotmem init
-
-# Acquire durable experience from a JSON claim on stdin
-echo '{"id":"...","knowledge":{...},"applicability":{...},"evidence":[...]}' | npx dotmem acquire
-
-# Acquire a claim from plain text (shorthand)
-npx dotmem learn "User prefers TypeScript over JavaScript" --scope project
-
-# Inspect a .mem package
-npx dotmem inspect ./path/to/example.mem
-
-# Compose continuity context
-npx dotmem continuity context
-npx dotmem continuity snapshot '{"summary":"..."}'
-
-# Manage open loops
-npx dotmem loop add task-01 "Finish the API docs" --waits-for team
-npx dotmem loop list
-npx dotmem loop close task-01 --by developer
-
-# Governance
-npx dotmem handshake --status
-npx dotmem policy effective
-npx dotmem guard tool.git-push --payload '{"branch":"main"}'
-npx dotmem rule check
-npx dotmem rules
-
-# Storage & session
-npx dotmem storage
-npx dotmem vault put "secret-value" --handle my-secret
-npx dotmem session show
-
-# Utilities
-npx dotmem codenames
-npx dotmem render markdown-index --out SUMMARY.md
-npx dotmem verify
-npx dotmem doctor --fix
-```
-
-Run `npx dotmem --help` for the full command reference.
-
----
-
-## Memory Model
-
-dotmem uses a **discover → project → acquire** memory model:
-
-1. **Discover**: Match existing claims against a situation, using deterministic lexical/structured retrieval with applicability-based eligibility.
-2. **Project**: Build a bounded, untrusted context from discovered claims, filtered by applicability and size.
-3. **Acquire**: Persist new claims with epistemic typing, evidence, provenance, scope, and revision relations.
-
-### Memory Types
-
-| Type | Purpose |
-|------|---------|
-| `fact` | Observable or verified facts |
-| `preference` | User or agent preferences |
-| `decision` | Architectural or workflow decisions |
-| `task` | Task-related information |
-| `context` | Situational context |
-
-### Memory Kinds
-
-Acquired claims carry a `kind`: `experience` (project/user learnings), `agent` (agent-specific notes), `relationship` (cross-agent or cross-project relationships), `logic` (rule-based knowledge), `note` (short-lived notes).
-
-### Scopes
-
-| Scope | Storage | Lifecycle |
-|-------|---------|-----------|
-| `hot` | In-memory only | Cleared on process exit |
-| `session` | In-memory | Persists for the active session |
-| `durable` | On disk | Survives process restarts |
-| `local` | In-memory | Node/Bun process-bound |
-
-### Discovery Depths
-
-| Depth | Meaning |
-|-------|---------|
-| `current` | Only active claims (no superseded/obsolete) |
-| `deep` | All claims including superseded and obsolete |
-
-### Policy Enforcement
-
-Policies are evaluated at acquisition time against a four-tier enforcement model:
-
-| Tier | Behavior |
-|------|----------|
-| **permit** | Allow without additional verification |
-| **advisory** | Allow with warnings; surface to user |
-| **caution** | Allow with explicit acknowledgment |
-| **block** | Prevent the operation |
-
-Policy conditions match against situation vectors, epistemic types, evidence sources, and content topics. Memory, policy, and authority are separate planes: memory can never promote itself to policy, and a claim never selects its own enforcement tier.
-
-### Claims and Corrections
-
-Claims are immutable and unique by ID. To change a claim, acquire a new one with exactly one revision relation:
-
-- `refines` — narrows or extends
-- `supersedes` — replaces
-- `retracts` — withdraws
-
----
-
-## Storage
-
-dotmem storage is user-anchored and resolved at runtime. The canonical storage root is `<user-home>/.dotmem`, relocatable via the `DOTMEM_STORAGE_ROOT` environment variable.
-
-```bash
-npx dotmem storage                  # show location + resolved root
-npx dotmem storage relocate /path   # migrate to an explicit absolute directory
-npx dotmem storage restore          # migrate back to default
-```
-
-Project experience is stored under `<storage-root>/projects/<project-id>.mem`. User experience uses `user.mem`, agent memory uses `agent.mem`, and logic data uses `logic.mem`. These are `.mem` packages — compressed ZIP archives with SHA-256 integrity manifests. Read them through `npx dotmem inspect`, never by byte-searching.
-
----
-
-## Activation
-
-The activation phrases are `dotmem`, `npx dotmem`, `Joy`, and `Jo`. A message that is exactly one of them activates dotmem once for the session.
-
-When activated, dotmem follows a deterministic discovery order:
-
-1. Check `<storage-root>/DOTMEM.md` and read the contract.
-2. Load user-level memory from `user.mem`.
-3. Resolve the current project identity.
-4. Load project memory from `<storage-root>/projects/<project-id>.mem`.
-
-A carrier handshake (`npx dotmem handshake`) evaluates compatibility before projecting any context. Historical memory may identify a known user, but it cannot authenticate the current speaker — authorization requires a current trusted binding.
-
----
-
-## Security
-
-- **Encryption is opt-in**, not default. Enable it per context or per scope with an encryption key.
-- **Client-side multitenancy** through isolated memory partitions.
-- **Policy-gated writes**: every `acquire`/`remember`/`patch` is evaluated against policy before persistence.
-- **Evidence tracking**: all claims carry source, observed timestamp, and epistemic type.
-- **Claim immutability**: stored claims are never edited. Corrections are appends with revision relations.
-- **Integrity via inspection**: `integrity: valid` means the bytes are unchanged since sealing — it says nothing about who wrote them or whether they are true.
-
-See [SECURITY.md](./SECURITY.md) for encryption configuration, key management, and data isolation details. See [MEMORY.md](./MEMORY.md) for the complete acquisition contract and policy language.
-
----
-
-## Choosing a Layer
-
-| If the data is... | Use | Not |
-|---|---|---|
-| UI-reactive, ephemeral | `state` | `store` (unnecessary persistence) |
-| UI-reactive, must survive reload | `state` + `state.persist(path)` | hand-rolled sync |
-| Small key/value, must persist | `store` | `idb` (overkill) |
-| Structured, needs confidence/TTL/source | `memory.remember()` | `state`/`store` (no lifecycle) |
-| Structured, needs evidence/provenance | `memory.acquire()` | `memory.remember()` (no evidence) |
-| Relational, needs SQL | `sqlite` | `idb` (no query language) |
-| Large browser-only structured data | `idb` | `store` |
-| AI agent memory | `dotmem/agent` | `memory` (no namespace isolation) |
-
-> **Note**: "Must survive reload" only holds in a browser. In Node.js and Bun, `store` and `session` fall back to in-memory `Map`s that do not survive a process restart.
-
----
-
-## Documentation
-
-| Document | Description |
-|----------|-------------|
-| [MEMORY.md](./MEMORY.md) | Full memory model: acquisition contract, policy language, epistemic typing |
-| [AGENTS.md](./AGENTS.md) | AI agent working rules, activation phrases, complete `memory.*` surface |
-| [SECURITY.md](./SECURITY.md) | Encryption, multitenancy, key management, threat model |
-| [PACKAGE.md](./PACKAGE.md) | Package contents, full quick-start, dependency graph |
-| [LICENSE.md](./LICENSE.md) | License |
-
----
-
-## License
-
-(c) 2026 Dario Passariello. See [LICENSE.md](./LICENSE.md).
+# dotmem (.mem)
+
+![banner](https://raw.githubusercontent.com/passariello/container/refs/heads/main/dotmem/banner.svg)
+
+AI memory and continuity infrastructure for agents and applications.
+
+**Built on:** [memorio](https://www.npmjs.com/package/memorio) (state, store, session, IndexedDB, SQLite, cache)
+
+Dotmem provides structured, queryable, policy-controlled memory for AI agents. It supports experience acquisition, bounded context projection, continuity across sessions, rule-based reasoning, and MCP integration. The memory substrate is independent of a specific model, vendor, host, or conversational client.
+
+> **Retrieval model**: dotmem uses deterministic lexical/structured retrieval with applicability-based eligibility. It does not use embeddings, vector indexes, or semantic similarity search. The term "AI-oriented" refers to the memory lifecycle and API design (acquisition with evidence/provenance, applicability scoping, policy-gated writes, context projection for LLM consumption), not the underlying retrieval algorithm. For semantic/vector search, pair dotmem with a dedicated embedding store.
+
+---
+
+## What Dotmem is
+
+- **Acquired experience**: evidenced, applicability-scoped claims via `discover`, `project`, and `acquire`.
+- **Application memory**: typed key/value entries via `remember`, `recall`, `update`, `forget`, and `patch`.
+- **Continuity**: snapshots, checkpoints, compaction, and open loops across sessions.
+- **Policy**: separate authority domain with tiered enforcement and privileged out-of-band overrides.
+- **Agent namespaces**: logically partitioned memory via `dotmem/agent`.
+- **Notes and profiles**: short-lived notes and read-only built-in profiles (including the optional Joy profile).
+- **MCP and CLI**: stdio MCP server (`dotmem-mcp`) and command-line tools.
+
+Dotmem is the active owner of memory, continuity, profiles, agents, and MCP capabilities. It is not a wrapper around an external memory service. MCP is an access interface, not the core.
+
+---
+
+## Install
+
+```bash
+npm i dotmem
+# or
+bun i dotmem
+# or
+pnpm i dotmem
+```
+
+Requires Node.js >= 18.0.0.
+
+---
+
+## Quick Start
+
+The runtime initializes lazily on first call; no explicit `init()` is required.
+
+```typescript
+import { memory } from 'dotmem'
+
+// Discover relevant acquired experience for a situation
+const discovery = await memory.discover('User needs a language recommendation for a new project', {
+  depth: 'current',
+  maxCandidates: 10
+})
+
+// Project a bounded context from discovered claims
+const projection = memory.project(discovery, { maxCandidates: 5, maxCharacters: 4000 })
+console.info(projection.text)
+
+// Acquire durable experience (persists across restarts via .mem files)
+await memory.acquire({
+  id: 'user.language-preference',
+  knowledge: { language: 'TypeScript' },
+  applicability: { area: 'language-selection' },
+  evidence: [{ id: 'conv-001', source: 'conversation', observedAt: new Date().toISOString() }],
+  epistemicType: 'observed'
+})
+```
+
+For agent-namespaced memory, use the `dotmem/agent` subpath:
+
+```typescript
+import { createAgentMemory } from 'dotmem/agent'
+
+const agent = createAgentMemory('support-agent')
+await agent.remember('greeting', 'Hello! How can I help?', {
+  type: 'fact',
+  confidence: 0.9,
+  scope: 'local',
+  tags: ['greeting']
+})
+```
+
+> `remember()` with scope `durable` uses IndexedDB and is browser-only. For Node/Bun, use `memory.acquire()`. See [MEMORY.md](./MEMORY.md) for scope details.
+
+---
+
+## Core capabilities
+
+- `memory.discover`, `memory.context`, `memory.project` — retrieval and bounded context projection.
+- `memory.acquire`, `memory.acquireStaged` — evidenced acquisition with policy evaluation.
+- `memory.remember`, `memory.recall`, `memory.update`, `memory.forget`, `memory.patch` — application memory.
+- `memory.journal`, `memory.note`, `memory.profile`, `memory.seed`, `memory.policy`, `memory.brain` — sub-facades.
+- `continuity` — snapshots, checkpoints, compaction, open loops.
+- `security`, `encryption` — RBAC/audit/consent and AES-GCM + PBKDF2 helpers.
+- Foundation re-exports: `state`, `store`, `session`, `idb`, `dispatch`, `hlc`.
+
+---
+
+## Layers
+
+Dotmem exposes **6 user-facing layers** through its public entry points. `knowledge` and `logic` are not public runtime exports (`logic` is experimental/unverified and not exported; `knowledge` is internal). `profile` is available via `memory.profile.get(id)` and its stability depends on the package semver contract.
+
+| Layer | Availability | Purpose |
+|-------|--------------|---------|
+| **memory** | `dotmem` (main) | Key/value memory, acquisition lifecycle, journal, and sub-facades |
+| **continuity** | `dotmem` (main) | USER + PROJECT + TASK context composition, snapshots, open loops |
+| **agent** | `dotmem/agent` (subpath) | Agent-facing memory with logical namespace partitioning |
+| **policy** | `memory.policy` | Policy definition, authority management, three-tier enforcement |
+| **profile** | `memory.profile.get(id)` | Identity and persona documents (read-only built-in profiles, including Joy) |
+| **note** | `memory.note` | Short-lived notes with tags and origins |
+
+### Internal / infrastructure
+
+| Layer | Purpose | Notes |
+|-------|---------|-------|
+| **seed** | Development-only initial memory seed | `--dev` required |
+| **llm-cache** | LLM response cache types only; no verified runtime implementation | `types/llm-cache.d.ts` |
+
+> Dotmem re-exports foundational infrastructure: `state` (reactive state), `store` (key/value storage), `idb` (IndexedDB), and `sqlite` (SQL database integration). These are lower-level utilities, not additional AI memory layers.
+
+---
+
+## Retrieval model
+
+dotmem uses **deterministic, verifiable retrieval** without embedding-model dependencies:
+
+- Lexical/structured matching with applicability-based eligibility.
+- No embeddings, vector indexes, or semantic similarity search.
+- Results are reproducible given the same store and query.
+
+"AI-oriented" refers to the memory lifecycle and API design (acquisition with evidence/provenance, applicability scoping, policy-gated writes, context projection for LLM consumption), not the underlying retrieval algorithm. For semantic/vector search, pair dotmem with a dedicated embedding store.
+
+---
+
+## MCP server
+
+`dotmem-mcp` is the stdio MCP server. It runs on the operator's machine so a connected AI host and the terminal share the same store. Write access is gated by `DOTMEM_MCP_WRITE=1`.
+
+Canonical launch command (use this form in all configurations):
+
+```bash
+npx -y -p dotmem dotmem-mcp
+```
+
+Example (Claude Desktop, read-only by default):
+
+```json
+{
+  "mcpServers": {
+    "dotmem": {
+      "command": "npx",
+      "args": ["-y", "-p", "dotmem", "dotmem-mcp"]
+    }
+  }
+}
+```
+
+See [MEMORY.md](./MEMORY.md) for the full tool list and write-gating details.
+
+---
+
+## Optional Joy identity
+
+Dotmem core is model- and persona-independent. Joy/Jo is an optional agent identity and profile. See [docs/JOY.md](./JOY.md) for activation (exact phrase only), discovery order, and the optional profile.
+
+---
+
+## Documentation
+
+| Document | Description |
+|----------|-------------|
+| [MEMORY.md](./MEMORY.md) | Full memory model: acquisition contract, policy language, epistemic typing, enforcement, continuity, identity |
+| [AGENTS.md](./AGENTS.md) | AI agent working rules, activation phrases, complete `memory.*` surface |
+| [SECURITY.md](./SECURITY.md) | Encryption, multitenancy, key management, trust model, JHF, sandbox |
+| [JOY.md](./JOY.md) | Optional Joy identity, activation matching, discovery order |
+| [PACKAGE.md](./PACKAGE.md) | Package contents, full quick-start, dependency graph |
+| [LICENSE.md](./LICENSE.md) | License |
+
+---
+
+## Compatibility
+
+**License**: MIT (SPDX: `MIT`)
+
+**Supported runtimes**:
+- Node.js >= 18.0.0 (declared in `package.json` engines)
+- Bun >= 1.0 (tested in CI)
+- Browser (ES2020+ with IndexedDB, localStorage, sessionStorage)
+- Deno (compatible, not routinely tested)
+
+**Tested in CI**: Node.js 20.x, 22.x; Bun 1.x
+
+**Note**: The `durable` scope in `memory.remember()` uses IndexedDB and is browser-only. For cross-restart persistence in Node/Bun, use `memory.acquire()` which writes `.mem` package files. The `store` and `session` layers fall back to in-memory `Map`s in Node/Bun/Deno and do not survive process restarts.
+
+---
+
+## License
+
+MIT (c) 2026 Dario Passariello.

package/SECURITY.md

@@ -8,7 +8,7 @@ This document covers dotmem's optional encryption layer, client-side multitenanc
 
 This applies to every layer: `state`, `store`, `session`, `idb`, `memory`, `sqlite`. Treat browser storage as client-controlled unless you explicitly opt in.
 
-Core has zero production dependencies. No `eval`, no dynamic code execution, no bundled telemetry, sanitized keys, validated inputs, bounded journal entries, UUID-based session identifiers. Independently checkable via Socket.dev / Snyk. (The optional MCP stdio entrypoint is the one declared-dependency surface: `zod` and `@modelcontextprotocol/server`.)
+Core declares no production dependencies in package.json. `memorio` is listed under devDependencies, but the built ESM/CJS output imports it as an external runtime module; a published install therefore needs `memorio` available unless packaging changes. No `eval`, no dynamic code execution, no bundled telemetry, sanitized keys, validated inputs, bounded journal entries, UUID-based session identifiers. Independently checkable via Socket.dev / Snyk. (The optional MCP stdio entrypoint is the one declared-dependency surface: `zod` and `@modelcontextprotocol/server`.)
 
 ---
 
@@ -191,9 +191,12 @@ machine.
 
 - `dotmem_acquire` is registered only when the server environment sets
  `DOTMEM_MCP_WRITE=1`.
-- Without the flag, the server exposes `dotmem_context` and
- `dotmem_rules` only. The write tool is not in `tools/list`, and calling
- it by name answers `Tool dotmem_acquire not found`.
+- `dotmem_continuity` write actions (`checkpoint`, `add-open-loop`,
+ `resolve-open-loop`) require `DOTMEM_MCP_WRITE=1`. Read actions
+ (`status`, `summaries`, `open-loops`, `evaluate`) are always available.
+- Without the flag, the server exposes `dotmem_context`, `dotmem_rules`,
+ and `dotmem_continuity` (read actions only). The write tools are not in
+ `tools/list`, and calling them by name answers `Tool <name> not found`.
 - The flag is read once, when the server starts. Changing it requires
  restarting the server.
 - The library API (`memory.acquire()`) and the CLI (`npx dotmem acquire`)
@@ -289,7 +292,7 @@ relaxation *attributable*, not undetectable-by-absence.
 
 ## Supply chain
 
-- Zero production dependencies in core - nothing to audit transitively for the parts you actually ship.
+- Declared production dependencies: none in the root package.json; `memorio` is a devDependency. The built output imports `memorio` as an external runtime module, so it must be available to a published install unless packaging changes. Do not infer zero runtime dependencies from package.json alone.
 - Dev dependencies are audited periodically (`npm audit` and equivalent).
 - Package integrity is checkable independently via Socket.dev / Snyk before you adopt a given version.
 
@@ -469,10 +472,10 @@ npx dotmem handshake --bind-hi "<user name>" --scope "<scope>"
 ### Identity fusion protection
 
 dotmem detects attempts to fuse an identity with implementation metadata into
-pseudo-identities (e.g. `Joy`, `HI`, `Jo-profile`). The
-canonical identity is preserved; fused forms are never accepted as an identity.
-Host, provider, runtime, and model names are implementation metadata and never
-become the conversational identity or authority.
+pseudo-identities (e.g. `Joy-profile`, `HI`, `Jo-profile`). The
+canonical identity (`Joy`/`Jo` from the canonical profile) is preserved; fused forms
+are never accepted as an identity. Host, provider, runtime, and model names are
+implementation metadata and never become the conversational identity or authority.
 
 ### JHF remediation principles
 

package/agent.cjs

@@ -1,6 +1,5 @@
 'use strict';
 
-require('memorio/global');
 var memorio = require('memorio');
 
 var __defProp = Object.defineProperty;
@@ -19,15 +18,27 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// core/idb.ts
+var idb;
+var init_idb = __esm({
+  "core/idb.ts"() {
+    idb = {
+      db: {},
+      table: {},
+      data: {},
+      _disabled: true,
+      _warning: "IndexedDB is not available in this environment. Use dotmem store or session for persistence."
+    };
+  }
+});
+
 // core/global.ts
 var global_exports = {};
 __export(global_exports, {
-  DEV: () => memorio.DEV,
-  PROD: () => memorio.PROD,
   dispatch: () => memorio.dispatch,
   getPlatform: () => getPlatform,
   hlc: () => memorio.hlc,
-  idb: () => memorio.idb,
+  idb: () => idb,
   session: () => memorio.session,
   state: () => memorio.state,
   store: () => memorio.store
@@ -35,6 +46,7 @@ __export(global_exports, {
 var getPlatform;
 var init_global = __esm({
   "core/global.ts"() {
+    init_idb();
     getPlatform = /* @__PURE__ */ __name(() => {
       const proc = globalThis.process;
       if (proc) {