dsh-mnemon 0.4.6 → 0.5.0-rc.1

package/README.md

@@ -24,7 +24,7 @@
 <p align="center">
   <a href="./docs/en/capabilities.md"><strong>Explore the capability map</strong></a> ·
   <a href="./docs/en/getting-started.md">Start in five minutes</a> ·
-  <a href="./docs/en/releases/v0.4.6.md">Read the v0.4.6 notes</a> ·
+  <a href="./docs/en/releases/v0.4.7.md">Read the v0.4.7 notes</a> ·
   <a href="https://github.com/omdsh-dev/dsh-mnemon/blob/e6ca446e45bdd17991f3c7c98560456de465282b/docs/assets/media/dsh-mnemon-memory-system-demo.mp4">Watch the widescreen demo</a>
 </p>
 
@@ -32,29 +32,21 @@
 
 [Mnemon](https://github.com/mnemon-dev/mnemon) remains the official, prioritized native engine. The third tier is replaceable; the first two keep the same storage, workspace, and interaction model regardless of provider.
 
-Since v0.3.0, the three tiers are the **default topology** of a composable kernel rather than the only shape hard-coded into every entry point. `MemoryBoot` wires trusted Layer, Adapter, Strategy, Guard, and `MemorySource` contributions into one runtime generation. Each user turn pins a lightweight `TurnView`: exact Runtime context enters Wake eagerly, while Documents and Memory Spaces contribute only bounded routing covers and keep complete recall authority Host-side. Users still install one `dsh-mnemon` package and keep the existing settings, tools, RPC, and UI workflow. See the [composable architecture](./docs/en/architecture.md#composable-memory-kernel) and [extension guide](./docs/en/extensions.md).
+Runtime, Documents and Memory Spaces are independent Source plugins. A Strategy selects their instance-specific projections, retrieval routes and actions into an immutable per-turn View. Core provides only `ctx.mnemonMemory`; Sources own their data and optional pages, while Memory Spaces owns its private Provider children. The `dsh-mnemon` Starter preserves the default three-tier experience. See [Architecture](./docs/en/architecture.md) and [Plugin development](./docs/en/extensions.md).
 
-v0.4.0 makes Sidebar the only Memory System workspace and removes the builtin display mode and its setting. Legacy display preferences are ignored without changing memory data; the complete view-based upgrade is planned for v0.5, not this release. Read the [upgrade and compatibility notes](./docs/en/releases/v0.4.0.md#upgrade-and-compatibility) before updating.
+**v0.5.0-rc.1 introduces View-based Memory and independently published Source/Strategy/Provider plugins.** The SDK remains a prerelease API rather than a frozen extension ABI; default user configuration and workflows stay compatible. Compared with v0.4, the ordinary UI adds only three disabled-by-default enhancement switches under **Settings → Memory System**—no View page or plugin-management entry. See the [release-candidate scope and upgrade notes](./docs/en/releases/v0.5.0-rc.1.md); v0.4 remains the stable Sidebar-convergence line.
 
-v0.4.1 fixes Memory System and Save to memory rendering with this-dependent DSH settings stores, plus ZIP export failures and archive differences across timezones. It preserves the v0.4.0 workflow and existing memory formats. See the [patch release notes](./docs/en/releases/v0.4.1.md).
+The v0.5 branch includes main's v0.4.3 behavior: Sidebar is the default; optional `displayMode: builtin` places the same Source pages in the owning conversation. Legacy `buildin` is accepted and automatically saved as `builtin`, without changing memory data. The collapsed icon aligns with neighboring Sidebar controls. The settings-store and ZIP fixes from v0.4.1 are retained. See the [latest stable release notes](./docs/en/releases/v0.4.3.md) and [entry placement and scope mapping](./docs/en/configuration.md#entry-placement-displaymode-and-tabenabled).
 
-v0.4.2 restores optional `displayMode: builtin` as a conversation placement for the same Sidebar-first UI. Legacy `buildin` is accepted and automatically saved as `builtin`; memory data is unchanged. See the [release notes](./docs/en/releases/v0.4.2.md) and [entry placement and scope mapping](./docs/en/configuration.md#entry-placement-displaymode-and-tabenabled).
-
-v0.4.3 aligns the collapsed Memory System icon with neighboring sidebar controls while preserving the expanded appearance. See the [patch release notes](./docs/en/releases/v0.4.3.md).
-
-v0.4.4 fixes session history failures on older DSH hosts by supporting both session projection contracts. Newer hosts and existing projection checkpoints remain compatible. See the [patch release notes](./docs/en/releases/v0.4.4.md).
-
-v0.4.5 registers Memory System with an installed Better Sidebar while keeping the normal DSH Sidebar entry and both client activation orders working. See the [patch release notes](./docs/en/releases/v0.4.5.md).
-
-v0.4.6 keeps DSH 0.1.1-rc.2 as the stable baseline while adding capability-detected support for the Session event snapshots used by DSH 0.1.2-alpha.4 and alpha.5. See the [patch release notes](./docs/en/releases/v0.4.6.md).
+v0.4.7 promotes the published DSH 0.1.2-rc.1 release to the stable registry baseline, keeps source verification against its alpha.5 predecessor, and retains a real WebUI regression on the previous 0.1.1-rc.2 line. See the [patch release notes](./docs/en/releases/v0.4.7.md).
 
 ## Understand the scope in 30 seconds
 
 | Tier | Keep here | How it reaches the Agent | Managed by |
 |---|---|---|---|
-| **Runtime** | Preferences, collaboration rules, project conventions, environment facts | Compact `USER.md` / `MEMORY.md` projection on every turn | Deterministic dsh-mnemon Host |
-| **Documents** | Designs, investigations, procedures, postmortems, handoffs | Search first, full Markdown on demand | Deterministic dsh-mnemon Host |
-| **Memory Spaces** | Cross-session facts, decisions, entities, relations | Bounded recall from active spaces | Mnemon Native or an external Provider |
+| **Runtime** | Preferences, collaboration rules, project conventions, environment facts | Compact `USER.md` / `MEMORY.md` projection on every turn | Runtime Source |
+| **Documents** | Designs, investigations, procedures, postmortems, handoffs | Search first, full Markdown on demand | Documents Source |
+| **Memory Spaces** | Cross-session facts, decisions, entities, relations | Bounded recall from active spaces | Memory Spaces Source + selected Provider |
 
 The tiers are not copies. A useful rule is: **every-turn context goes to Runtime, complete narratives go to Documents, and cross-task evidence goes to Memory Spaces.** Current instructions, repository files, and live tool results always outrank historical memory.
 
@@ -122,10 +114,10 @@ Windows users can install the official v0.2.3-or-newer release ZIP. The expected
 
 ### 2. Install DSH and the plugin
 
-The registry installation remains verified against stable DSH 0.1.1-rc.2, whose complete profiles require Node.js `^22.19.0 || >=24.0.0`; Node 20 lacks host primitives used by rc.2. Source compatibility is also verified against the latest DSH 0.1.2-alpha.5 preview while rc.2 remains the recommended registry target. The dsh-mnemon package itself retains Node.js 20 compatibility for older compatible DSH hosts. Use the exact published version below for a reproducible installation; plugin authors can follow the [alpha source workflow](./docs/en/development.md#dsh-012-alpha5-source-verification).
+The registry installation is verified against stable DSH 0.1.2-rc.1, whose complete profiles require Node.js `^22.19.0 || >=24.0.0`. The immediately preceding DSH 0.1.2-alpha.5 remains covered from source, and the previous 0.1.1-rc.2 registry line remains a backward-regression target. The dsh-mnemon package itself retains Node.js 20 compatibility for older compatible DSH hosts. Use the exact published version below for a reproducible installation; plugin authors can follow the [alpha source workflow](./docs/en/development.md#dsh-012-alpha5-source-compatibility).
 
 ```sh
-npm install -g @deepseek-ai/dsh@0.1.1-rc.2
+npm install -g @deepseek-ai/dsh@0.1.2-rc.1
 dsh --version
 ```
 
@@ -134,6 +126,8 @@ dsh plugin --profile web add dsh-mnemon
 dsh --profile web
 ```
 
+When the Web profile is published under a cloud hostname, stable DSH 0.1.2-rc.1 needs an HTTPS reverse proxy or access gateway, an explicit trusted authority, and the one-time launch URL printed at Host startup. Follow the [cloud-hosted WebUI procedure](./docs/en/operations.md#cloud-hosted-webui); do not expose the loopback service directly.
+
 DSH profiles have independent plugin rosters. Install the same package separately for one-shot Headless tasks:
 
 ```sh
@@ -221,8 +215,8 @@ See [Operations, security, and troubleshooting](./docs/en/operations.md) for bac
 | Configure scope, routing, and model selection | [Configuration](./docs/en/configuration.md) |
 | Back up, update, or troubleshoot | [Operations](./docs/en/operations.md) |
 | Integrate tools, commands, or RPC | [Interface reference](./docs/en/interfaces.md) |
-| Build a Layer, Adapter, Strategy, Guard, or MemorySource extension | [Extension guide](./docs/en/extensions.md) |
-| Review the release | [v0.4.6 release notes](./docs/en/releases/v0.4.6.md) |
+| Build a Source, Strategy or Memory Spaces Provider plugin | [Extension guide](./docs/en/extensions.md) |
+| Review the stable release | [v0.4.3 release notes](./docs/en/releases/v0.4.3.md) |
 
 See the [documentation hub](./docs/en/README.md) for the full map.
 

package/README.zh-CN.md

@@ -24,7 +24,7 @@
 <p align="center">
   <a href="./docs/zh-CN/capabilities.md"><strong>先看能力地图</strong></a> ·
   <a href="./docs/zh-CN/getting-started.md">5 分钟开始</a> ·
-  <a href="./docs/zh-CN/releases/v0.4.6.md">v0.4.6 升级说明</a> ·
+  <a href="./docs/zh-CN/releases/v0.4.7.md">v0.4.7 升级说明</a> ·
   <a href="https://github.com/omdsh-dev/dsh-mnemon/blob/e6ca446e45bdd17991f3c7c98560456de465282b/docs/assets/media/dsh-mnemon-memory-system-demo.mp4">观看宽屏实机演示</a>
 </p>
 
@@ -32,29 +32,21 @@
 
 [Mnemon](https://github.com/mnemon-dev/mnemon) 仍是官方优先的原生引擎。可以替换的是第三层；无论选择哪个 Provider，前两层的存储、工作区和交互心智保持不变。
 
-从 v0.3.0 开始，三层是可组合内核中的**默认拓扑**，不再是各入口各自写死的唯一结构。`MemoryBoot` 把受信任的 Layer、Adapter、Strategy、Guard 与 `MemorySource` 装配为一代运行图；每个用户回合固定一份轻量 `TurnView`：Runtime 精确内容 eager 进入 Wake，Documents 与 Memory Spaces 只给出有界路由封面，完整召回权限保留在 Host。用户仍只安装一个 `dsh-mnemon`，设置、工具、RPC 与 UI 工作流不变。参见[可组合架构](./docs/zh-CN/architecture.md#可组合记忆内核)与[扩展开发指南](./docs/zh-CN/extensions.md)。
+Runtime、Documents、Memory Spaces 是独立 Source 插件；Strategy 将各实例的投影、检索 route 与 action 组合成逐回合不可变 View。Core 只提供 `ctx.mnemonMemory`，Source 拥有数据与可选页面，Memory Spaces 自己拥有内部 Provider 子节点。`dsh-mnemon` Starter 保持默认三层使用体验。详见[架构](./docs/zh-CN/architecture.md)与[插件开发](./docs/zh-CN/extensions.md)。
 
-v0.4.0 将 Sidebar 设为记忆系统的唯一工作台入口，移除 builtin 展示模式及其设置。旧展示偏好会被忽略，不改变记忆数据；完整的 view-based 升级计划放在 v0.5，不包含在本版中。更新前请阅读[升级与兼容性说明](./docs/zh-CN/releases/v0.4.0.md#升级与兼容性)。
+**v0.5.0-rc.1 引入 View-based Memory，以及独立发布的 Source/Strategy/Provider 插件。** SDK 仍是预发布 API，尚未冻结扩展 ABI；默认用户配置与使用流程保持兼容。相对 v0.4，普通界面只在“设置 → 记忆系统”增加三个默认关闭的增强开关，不增加 View 页或插件管理入口。参阅 [RC 范围与升级说明](./docs/zh-CN/releases/v0.5.0-rc.1.md)；v0.4 仍是稳定的 Sidebar 收敛发行线。
 
-v0.4.1 修复记忆系统和存入记忆在依赖 `this` 的 DSH settings store 上的渲染崩溃，以及 ZIP 导出失败和跨时区归档差异；保留 v0.4.0 工作流与既有记忆格式。详见[补丁发布说明](./docs/zh-CN/releases/v0.4.1.md)。
+v0.5 分支已纳入 main 的 v0.4.3 行为：默认使用 Sidebar，可选 `displayMode: builtin` 将同一组 Source 页面放入所属会话。旧 `buildin` 可识别并自动保存为 `builtin`，不改变记忆数据；折叠图标与侧栏相邻控件对齐，v0.4.1 的 settings store 与 ZIP 修复也继续保留。详见[最新稳定版说明](./docs/zh-CN/releases/v0.4.3.md)与[入口位置及范围映射](./docs/zh-CN/configuration.md#入口位置displaymode-与-tabenabled)。
 
-v0.4.2 恢复可选 `displayMode: builtin`，只将 Sidebar 优先迭代的共用界面放入会话。旧 `buildin` 仍可识别，并自动保存为 `builtin`，不改变记忆数据。详见[发布说明](./docs/zh-CN/releases/v0.4.2.md)与[入口位置与范围映射](./docs/zh-CN/configuration.md#入口位置displaymode-与-tabenabled)。
-
-v0.4.3 让折叠后的记忆系统图标与侧栏相邻控件对齐，并保留原有展开样式。详见[补丁发布说明](./docs/zh-CN/releases/v0.4.3.md)。
-
-v0.4.4 同时支持新旧 DSH 会话投影接口，修复旧版宿主读取会话历史失败的问题，并保持新版宿主和已有投影检查点兼容。详见[补丁发布说明](./docs/zh-CN/releases/v0.4.4.md)。
-
-v0.4.5 在已安装 Better Sidebar 时向其注册记忆系统，同时保留 DSH 普通 Sidebar 入口，并兼容两种客户端加载顺序。详见[补丁发布说明](./docs/zh-CN/releases/v0.4.5.md)。
-
-v0.4.6 继续以 DSH 0.1.1-rc.2 作为稳定基线，并通过能力检测兼容 DSH 0.1.2-alpha.4 与 alpha.5 的 Session 事件快照接口。详见[补丁发布说明](./docs/zh-CN/releases/v0.4.6.md)。
+v0.4.7 将已发布的 DSH 0.1.2-rc.1 提升为稳定的 registry 基线，继续对其 alpha.5 前序版本执行源码验证，并保留上一条 0.1.1-rc.2 版本线的真实 WebUI 回归。详见[补丁发布说明](./docs/zh-CN/releases/v0.4.7.md)。
 
 ## 30 秒理解能力边界
 
 | 层级 | 适合保存 | 如何进入 Agent 上下文 | 由谁管理 |
 |---|---|---|---|
-| **运行时** | 偏好、协作规则、项目约定、环境事实 | `USER.md` / `MEMORY.md` 每轮紧凑投影 | dsh-mnemon Host 确定性管理 |
-| **档案** | 设计、调查、流程、复盘、交接材料 | 先检索，再按需阅读全文 | dsh-mnemon Host 确定性管理 |
-| **记忆体** | 跨会话事实、决策、实体与关系 | 从已激活记忆体召回有界证据 | Mnemon Native 或三方 Provider |
+| **运行时** | 偏好、协作规则、项目约定、环境事实 | `USER.md` / `MEMORY.md` 每轮紧凑投影 | Runtime Source |
+| **档案** | 设计、调查、流程、复盘、交接材料 | 先检索，再按需阅读全文 | Documents Source |
+| **记忆体** | 跨会话事实、决策、实体与关系 | 从已激活记忆体召回有界证据 | Memory Spaces Source + 所选 Provider |
 
 三层不是同一内容的副本。简单判断规则是：**每轮都需要的放运行时，需要完整阅读的放档案，需要跨任务按需召回的放记忆体。**当前指令、仓库文件与实时工具结果始终高于历史记忆。
 
@@ -122,10 +114,10 @@ Windows 推荐安装 v0.2.3 或更高版本的官方 ZIP；标准安装目录与
 
 ### 2. 安装 DSH 与插件
 
-Registry 安装仍以稳定的 DSH 0.1.1-rc.2 验证；其完整 profile 需要 Node.js `^22.19.0 || >=24.0.0`，Node 20 缺少 rc.2 使用的宿主原语。源码兼容性也已针对最新的 DSH 0.1.2-alpha.5 预览版验证，rc.2 仍是推荐的 registry 安装目标。dsh-mnemon 包本身仍为较旧且兼容的 DSH Host 保留 Node.js 20 支持。下面显式指定已发布版本以保证可复现安装；插件作者可参照 [alpha 源码验证流程](./docs/zh-CN/development.md#dsh-012-alpha5-源码验证)。
+Registry 安装以稳定的 DSH 0.1.2-rc.1 验证；其完整 profile 需要 Node.js `^22.19.0 || >=24.0.0`。它的直接前序版本 DSH 0.1.2-alpha.5 继续通过源码覆盖，上一条 0.1.1-rc.2 registry 版本线则保留为向后回归目标。dsh-mnemon 包本身仍为较旧且兼容的 DSH Host 保留 Node.js 20 支持。下面显式指定已发布版本以保证可复现安装；插件作者可参照 [alpha 源码兼容流程](./docs/zh-CN/development.md#dsh-012-alpha5-源码兼容)。
 
 ```sh
-npm install -g @deepseek-ai/dsh@0.1.1-rc.2
+npm install -g @deepseek-ai/dsh@0.1.2-rc.1
 dsh --version
 ```
 
@@ -134,6 +126,8 @@ dsh plugin --profile web add dsh-mnemon
 dsh --profile web
 ```
 
+将 Web profile 发布到云端域名时，稳定版 DSH 0.1.2-rc.1 需要 HTTPS 反向代理或访问网关、显式可信 authority，以及 Host 启动时输出的一次性启动 URL。请按[云端 WebUI 操作步骤](./docs/zh-CN/operations.md#cloud-hosted-webui)配置，不要把回环服务直接暴露到公网。
+
 DSH 各 profile 的插件清单彼此独立。一次性 Headless 任务需要单独安装：
 
 ```sh
@@ -221,8 +215,8 @@ dsh plugin --profile headless add "link:/absolute/path/to/dsh-mnemon"
 | 配置范围、路由与模型 | [配置参考](./docs/zh-CN/configuration.md) |
 | 备份、更新或排障 | [运维指南](./docs/zh-CN/operations.md) |
 | 接入工具、命令或 RPC | [接口参考](./docs/zh-CN/interfaces.md) |
-| 开发 Layer、Adapter、Strategy、Guard 或 MemorySource 扩展 | [扩展开发指南](./docs/zh-CN/extensions.md) |
-| 查看本次升级 | [v0.4.6 发布说明](./docs/zh-CN/releases/v0.4.6.md) |
+| 开发 Source、Strategy 或 Memory Spaces Provider 插件 | [扩展开发指南](./docs/zh-CN/extensions.md) |
+| 查看稳定版升级 | [v0.4.3 发布说明](./docs/zh-CN/releases/v0.4.3.md) |
 
 完整目录见[文档中心](./docs/zh-CN/README.md)。
 

package/SECURITY.md

@@ -17,7 +17,7 @@ Please **do not open a public issue** for security vulnerabilities.
 
 Report privately through one of these channels, in order of preference:
 
-1. **GitHub Security Advisories** — use the “Report a vulnerability” flow on the [Security tab](../../security) of this repository (private vulnerability reporting).
+1. **GitHub Security Advisories** — use the “Report a vulnerability” flow on the [Security tab](https://github.com/omdsh-dev/dsh-mnemon/security) of this repository (private vulnerability reporting).
 2. **Email** — `grivn.wang@gmail.com` (maintainer). Use a subject prefix like `[dsh-mnemon security]`.
 
 Please include, when possible:
@@ -39,7 +39,7 @@ In scope:
 
 - The plugin bundle (`lib/`, `cordis.patch.yml`): data-loss, privilege-escalation, path-traversal, secret-leak, and memory-corruption style issues in plugin code.
 - The control plane: lock handling, revision conflict checks, atomic writes, and subagent isolation boundaries.
-- The composable-memory boundary: Catalog/Topology generation checks, Strategy permission enforcement, non-bypassable Kernel Guards, and Plan/Receipt integrity.
+- The composable-memory boundary: generation/turn ownership, View validation, grant and live authority checks, and Evidence/Receipt integrity.
 - The WebUI: XSS or injection via rendered memory content.
 
 Out of scope:
@@ -51,8 +51,8 @@ Out of scope:
 ## Known limitations
 
 - There is no deterministic credential/secret detection today. Do not write keys, tokens, or private keys into Runtime Memory, Documents, or Memory Spaces.
-- Cordis isolation provides lifecycle ownership and scope composition, not a security sandbox. Layer executors, Provider Adapters, Strategies, and Guards are ordinary JavaScript in the DSH Host process. Install extensions only from trusted sources.
-- Model-generated Strategy source is not executed automatically. Manifests, permission wrapping, replay, and Kernel validation reduce accidental authority but cannot make hostile in-process code safe.
+- Cordis isolation provides lifecycle ownership and scope composition, not a security sandbox. Sources, their Providers, and Strategies are ordinary JavaScript in the DSH Host process. Install extensions only from trusted sources.
+- Model-generated Strategy source is not executed automatically. Manifests, scoped grants, replay, and Core/Host validation reduce accidental authority but cannot make hostile in-process code safe.
 - Runtime Memory and Documents are local, and Mnemon Native is local by default. Enabled third-party Providers can make network or local-process calls and expose data according to their configured endpoints and credentials.
 
 ---
@@ -72,7 +72,7 @@ Out of scope:
 
 请**不要**为安全漏洞开公开 issue，按优先级使用以下渠道私下报告：
 
-1. **GitHub Security Advisories**：在本仓库 [Security 页](../../security) 使用“Report a vulnerability”（私密漏洞报告）。
+1. **GitHub Security Advisories**：在本仓库 [Security 页](https://github.com/omdsh-dev/dsh-mnemon/security) 使用“Report a vulnerability”（私密漏洞报告）。
 2. **邮件**：`grivn.wang@gmail.com`（维护者），主题加 `[dsh-mnemon security]` 前缀。
 
 请尽量附上：受影响版本、最小复现或 PoC、是否已被公开利用、披露偏好（协调披露 / 署名 / 保密期）。
@@ -84,13 +84,13 @@ Out of scope:
 
 ### 范围
 
-**范围内**：插件 bundle 与 `cordis.patch.yml` 中的数据丢失、提权、路径穿越、秘密泄露类问题；控制面（锁、revision 冲突检查、原子写、子 Agent 隔离）；可组合记忆边界（Catalog/Topology generation、Strategy 权限约束、不可绕过的 Kernel Guard、Plan/Receipt 完整性）；WebUI 对记忆内容渲染的 XSS/注入。
+**范围内**：插件 bundle 与 `cordis.patch.yml` 中的数据丢失、提权、路径穿越、秘密泄露类问题；控制面（锁、revision 冲突检查、原子写、子 Agent 隔离）；可组合记忆边界（generation/turn 所有权、View 校验、grant 与当前权限检查、Evidence/Receipt 完整性）；WebUI 对记忆内容渲染的 XSS/注入。
 
 **范围外**：上游依赖（`mnemon`、`cordis`、DSH 核心、React）自身的问题（报告给上游，我们可协助定位与临时规避）；功能缺失、文档问题（走普通 issue）；你自行写入记忆数据中的凭据或秘密（插件当前没有秘密检测器，见 README 披露）。
 
 ### 已知限制
 
 - 当前没有确定性的凭据/秘密检测，请勿向热记忆、Documents 或 Memory Spaces 写入密钥、token、私钥。
-- Cordis isolate 提供生命周期所有权和作用域组合，不是安全沙箱。Layer executor、Provider Adapter、Strategy 与 Guard 都是在 DSH Host 进程执行的普通 JavaScript，只能安装受信任来源的扩展。
-- 模型生成的 Strategy 源码不会自动执行。manifest、权限封装、replay 与 Kernel 校验可以降低意外越权，但无法让恶意同进程代码变安全。
+- Cordis isolate 提供生命周期所有权和作用域组合，不是安全沙箱。Source、其内部 Provider 与 Strategy 都是在 DSH Host 进程执行的普通 JavaScript，只能安装受信任来源的扩展。
+- 模型生成的 Strategy 源码不会自动执行。manifest、限定范围的 grant、replay 与 Core/Host 校验可以降低意外越权，但无法让恶意同进程代码变安全。
 - Runtime Memory 与 Documents 为本地存储，Mnemon Native 默认本地；显式启用的三方 Provider 可能按配置 endpoint 与凭据发起网络调用或本地进程调用，并向对应服务暴露数据。

package/cordis.patch.yml

@@ -3,6 +3,7 @@
 # variables for one-field overrides such as cliPath.
 - insert:
     - id: mnemon
+      # Core/Host and default settings. Sources own their independent Entries.
       name: dsh-mnemon
       config:
         routingGuidance: true
@@ -26,3 +27,44 @@
           candidateMultiplier: 3
           maxMediumResults: 4
           maxUnknownResults: 2
+    - id: mnemon-source-runtime
+      name: dsh-mnemon-source-runtime
+    - id: mnemon-source-documents
+      name: dsh-mnemon-source-documents
+    - id: mnemon-source-memory-spaces
+      name: dsh-mnemon-source-memory-spaces
+      config:
+        # Every default Provider is an
+        # explicit child. A custom parent composition may choose a subset.
+        providers:
+          - use: dsh-mnemon-provider-mnemon-native
+            instanceId: mnemon-native
+          - use: dsh-mnemon-provider-openviking
+            instanceId: openviking
+          - use: dsh-mnemon-provider-honcho
+            instanceId: honcho
+          - use: dsh-mnemon-provider-mem0
+            instanceId: mem0
+          - use: dsh-mnemon-provider-hindsight
+            instanceId: hindsight
+          - use: dsh-mnemon-provider-holographic
+            instanceId: holographic
+          - use: dsh-mnemon-provider-retaindb
+            instanceId: retaindb
+          - use: dsh-mnemon-provider-byterover
+            instanceId: byterover
+          - use: dsh-mnemon-provider-supermemory
+            instanceId: supermemory
+    - id: mnemon-strategy-default-three-tier
+      name: dsh-mnemon-strategy-default-three-tier
+    # v0.5 ships these narrowly scoped enhancements with the Starter so the
+    # Settings switches are always available. They remain opt-in.
+    - id: mnemon-strategy-auto-capture
+      name: dsh-mnemon-strategy-auto-capture
+      disabled: true
+    - id: mnemon-strategy-light-context
+      name: dsh-mnemon-strategy-light-context
+      disabled: true
+    - id: mnemon-strategy-scoped
+      name: dsh-mnemon-strategy-scoped
+      disabled: true