fdeops 3.27.1 → 3.29.0

package/bin/lib/masking.js

@@ -0,0 +1,138 @@
+'use strict'
+
+// Local pseudonyms, not anonymization. Recognized identifiers are replaced
+// in output and proposals, and retained in a private reversible dictionary.
+const fs = require('node:fs')
+const path = require('node:path')
+const crypto = require('node:crypto')
+const { StringDecoder } = require('node:string_decoder')
+const ALIAS = /\[\[(email|phone|identifier|credential):[a-f0-9]{16}\]\]/g
+const PATTERNS = [
+  ['credential', /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?(?:-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|$)/g],
+  ['credential', /\b(?:AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g],
+  ['credential', /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:]+:[^/\s@]+@[^\s<>"']+/gi],
+  ['credential', /\bBearer\s+[A-Za-z0-9._-]{20,}/gi],
+  ['credential', /\b(?:api[_-]?key|secret|password)\s*=\s*[^\s"']{8,}/gi],
+  ['email', /(?<![A-Za-z0-9._%+-])[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?){1,10}/g],
+  ['identifier', /\b\d{3}-\d{2}-\d{4}\b/g],
+  // Deliberately conservative: international + notation or explicit US shape.
+  // Plain integers and dates are not reliably distinguishable from business data.
+  ['phone', /(?<![\w])(?:\+\d{1,3}[ .-]?(?:\(\d{2,4}\)|\d{2,4})(?:[ .-]?\d){6,10}|\(\d{3}\)[ .-]?\d{3}[ .-]\d{4}|\d{3}[ .-]\d{3}[ .-]\d{4})(?!\d)/g],
+]
+const FAIL = 'privacy masking unavailable: check the local .privacy directory; no unmasked output was returned'
+function replacements(text, replace) {
+  let out = String(text)
+  for (const [kind, pattern] of PATTERNS) out = out.replace(pattern, value => replace(kind, value))
+  return out
+}
+function createMasking(root) {
+  const directory = path.join(root, '.privacy'), file = path.join(directory, 'identifiers.json')
+  function directoryReady(create) {
+    if (create) fs.mkdirSync(root, { recursive: true })
+    if (create) { try { fs.mkdirSync(directory, { mode: 0o700 }) } catch (e) { if (e.code !== 'EEXIST') throw e } }
+    const st = fs.lstatSync(directory)
+    if (!st.isDirectory() || st.isSymbolicLink() || (process.platform !== 'win32' && (st.mode & 0o077))) throw new Error(FAIL)
+  }
+  function read(create) {
+    let fd
+    try {
+      fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK)
+      const st = fs.fstatSync(fd)
+      if (!st.isFile() || st.nlink !== 1 || st.size > 8 * 1024 * 1024 || (process.platform !== 'win32' && (st.mode & 0o077))) throw new Error(FAIL)
+      const data = JSON.parse(fs.readFileSync(fd, 'utf8'))
+      if (data.version !== 1 || !Array.isArray(data.entries) || data.entries.length > 50000) throw new Error(FAIL)
+      const seen = new Set()
+      for (const entry of data.entries) {
+        if (!entry || typeof entry.value !== 'string' || !/^\[\[(email|phone|identifier|credential):[a-f0-9]{16}\]\]$/.test(entry.alias) || seen.has(entry.alias)) throw new Error(FAIL)
+        seen.add(entry.alias)
+      }
+      return data
+    } catch (e) { if (e.code === 'ENOENT' && create) return { version: 1, entries: [] }; throw e }
+    finally { if (fd !== undefined) fs.closeSync(fd) }
+  }
+  function transact(create, fn) {
+    let locked = false
+    const lock = path.join(directory, 'lock')
+    try {
+      directoryReady(create)
+      for (let attempt = 0; attempt < 100; attempt++) {
+        try { fs.mkdirSync(lock, { mode: 0o700 }); locked = true; break }
+        catch (e) { if (e.code !== 'EEXIST') throw e; Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10) }
+      }
+      if (!locked) throw new Error(FAIL)
+      const data = read(create), before = data.entries.length, result = fn(data.entries)
+      if (data.entries.length !== before) {
+        if (data.entries.length > 50000) throw new Error(FAIL)
+        const body = JSON.stringify(data)
+        if (Buffer.byteLength(body) > 8 * 1024 * 1024) throw new Error(FAIL)
+        const tmp = path.join(directory, `.write-${crypto.randomBytes(12).toString('hex')}`)
+        try { fs.writeFileSync(tmp, body, { mode: 0o600, flag: 'wx' }); fs.renameSync(tmp, file) }
+        finally { try { fs.unlinkSync(tmp) } catch (_) {} }
+      }
+      return result
+    } catch (_) { throw new Error(FAIL) }
+    finally { if (locked) { try { fs.rmdirSync(lock) } catch (_) {} } }
+  }
+  function mask(text) {
+    text = String(text)
+    let detected = false
+    replacements(text, (_, value) => { detected = true; return value })
+    if (!detected) return text
+    return transact(true, entries => {
+      const values = new Map(entries.map(e => [e.value, e.alias]))
+      return replacements(text, (kind, value) => {
+        if (!values.has(value)) {
+          const alias = `[[${kind}:${crypto.randomBytes(8).toString('hex')}]]`
+          entries.push({ alias, value }); values.set(value, alias)
+        }
+        return values.get(value)
+      })
+    })
+  }
+  function restore(text) {
+    text = String(text)
+    if (/\[\[(email|phone|identifier|credential):/.test(text.replace(ALIAS, ''))) throw new Error(FAIL)
+    if (!text.match(ALIAS)) return text
+    return transact(false, entries => {
+      const aliases = new Map(entries.map(e => [e.alias, e.value]))
+      return text.replace(ALIAS, alias => {
+        if (!aliases.has(alias)) throw new Error(FAIL)
+        return aliases.get(alias)
+      })
+    })
+  }
+  return { mask, restore }
+}
+
+// CLI output is finite, not an interactive stream. Buffer to catch identifiers
+// split across writes, including multiline credentials. Never fall back to raw.
+function protectOutput(masking, { maxBytes } = {}) {
+  const buffers = ['', ''], decoders = [new StringDecoder('utf8'), new StringDecoder('utf8')]
+  let overflow = false
+  for (const [index, stream] of [process.stdout, process.stderr].entries()) {
+    stream.write = (chunk, encoding, callback) => {
+      const text = typeof chunk === 'string' ? chunk : decoders[index].write(chunk)
+      buffers[index] += text
+      if (Buffer.byteLength(buffers[index]) > 16 * 1024 * 1024) { overflow = true; buffers[index] = '' }
+      const cb = typeof encoding === 'function' ? encoding : callback
+      if (cb) cb()
+      return true
+    }
+  }
+  process.once('exit', () => {
+    try {
+      if (overflow) throw new Error(FAIL)
+      // Prepare both before emitting either, so a failure cannot expose raw data.
+      const output = buffers.map((text, i) => masking.mask(text + decoders[i].end()))
+      if (maxBytes && Buffer.byteLength(output[0]) > maxBytes) {
+        const notice = '\n[Masked context truncated; retrieve a narrower topic.]\n'
+        let body = Buffer.from(output[0]).subarray(0, maxBytes - Buffer.byteLength(notice)).toString('utf8').replace(/\uFFFD$/, '')
+        const open = body.lastIndexOf('[[')
+        if (open > body.lastIndexOf(']]')) body = body.slice(0, open)
+        output[0] = body + notice
+      }
+      output.forEach((text, i) => { if (text) fs.writeSync(i + 1, text) })
+    } catch (_) { process.exitCode = 1; fs.writeSync(2, FAIL + '\n') }
+  })
+}
+module.exports = { createMasking, protectOutput }

package/bin/lib/memory.js

@@ -53,7 +53,7 @@ function createMemoryApi(deps) {
           execFileSync('git', ['add', '--', f], { cwd: eng, stdio: 'ignore', timeout: 10000 })
         }
       } else {
-        execFileSync('git', ['add', '-A'], { cwd: eng, stdio: 'ignore', timeout: 10000 })
+        execFileSync('git', ['add', '-A', '--', '.', ':(exclude).privacy'], { cwd: eng, stdio: 'ignore', timeout: 10000 })
       }
       const porcelain = execFileSync('git', ['status', '--porcelain'], {
         cwd: eng, encoding: 'utf8', timeout: 10000, stdio: ['ignore', 'pipe', 'ignore'],
@@ -72,6 +72,9 @@ function createMemoryApi(deps) {
           })
         }
       }
+      // Even a previously staged alias dictionary must never enter a CLI commit.
+      const privateStaged = execFileSync('git', ['diff', '--cached', '--name-only'], { cwd: eng, encoding: 'utf8', timeout: 10000 }).split('\n').some(f => f.split('/').includes('.privacy'))
+      if (privateStaged) throw new Error('private alias state must not be staged in engagement history')
       const still = execFileSync('git', ['diff', '--cached', '--name-only'], {
         cwd: eng, encoding: 'utf8', timeout: 10000, stdio: ['ignore', 'pipe', 'ignore'],
       }).toString().trim()
@@ -131,7 +134,7 @@ function createMemoryApi(deps) {
       execFileSync('git', ['init'], { cwd: eng, stdio: 'ignore', timeout: 10000 })
       atomicWriteFile(
         path.join(eng, '.gitignore'),
-        ['*.lock', '*.tmp', '.last-write', '.debrief-propose', '.debrief-private', '.debrief-seal', ''].join('\n')
+        ['*.lock', '*.tmp', '.last-write', '.debrief-propose', '.debrief-private', '.debrief-seal', '.privacy/', ''].join('\n')
       )
       const owner = writeOwnerIfMissing(eng)
       configureMemoryGitIdentity(eng, owner)

package/bin/lib/render.js

@@ -374,7 +374,7 @@ function deliveryHtml(e) {
   return `<section class="fb-block fb-delivery" aria-label="Delivery evidence">
 <div class="fb-sec-row"><h2 class="fb-sec">Delivery evidence</h2><span class="fb-count">${rows.length} outcome${rows.length === 1 ? '' : 's'}</span></div>
 <p class="fb-evidence-note">Recorded in delivery.md. Acceptance reflects the saved record, not independent verification.</p>
-${rows.length ? `<div class="fb-table-scroll" role="region" aria-label="Promised, measured and accepted outcomes" tabindex="0"><table class="fb-table fb-value-table"><thead><tr><th scope="col">Outcome</th><th scope="col">Promised</th><th scope="col">Measured</th><th scope="col">Acceptance</th><th scope="col">Evidence</th></tr></thead><tbody>${rows.map(r => `<tr><th scope="row">${inlineMd(r.slice || 'Outcome')}<span class="fb-value-state t-${r.state === 'accepted' ? 'green' : 'amber'}">${labels[r.state]}</span></th><td>${cell(r.promised, 'Not recorded')}</td><td>${cell(r.measured, 'Not yet measured')}</td><td>${cell(r.accepted, 'Not recorded')}</td><td>${cell(r.evidence, 'Not recorded')}</td></tr>`).join('')}</tbody></table></div>` : `<div class="fb-empty-evidence"><strong>No delivery evidence yet</strong><p>Ask your agent to define one useful increment: the expected result, how to measure it, and who will accept it.</p></div>`}
+${rows.length ? `<div class="fb-table-scroll" role="region" aria-label="Promised, measured and accepted outcomes" tabindex="0"><table class="fb-table fb-value-table"><thead><tr><th scope="col">Outcome</th><th scope="col">Promised</th><th scope="col">Measured</th><th scope="col">Acceptance</th><th scope="col">Evidence</th></tr></thead><tbody>${rows.map(r => `<tr><th scope="row">${inlineMd(r.slice || 'Outcome')}<span class="fb-value-state t-${r.state === 'accepted' ? 'green' : 'amber'}">${labels[r.state]}</span>${r.acceptanceIssue ? `<span class="fb-muted">${inlineMd(r.acceptanceIssue)}</span>` : ''}</th><td>${cell(r.promised, 'Not recorded')}</td><td>${cell(r.measured, 'Not yet measured')}</td><td>${cell(r.accepted, 'Not recorded')}</td><td>${cell(r.evidence, 'Not recorded')}</td></tr>`).join('')}</tbody></table></div>` : `<div class="fb-empty-evidence"><strong>No delivery evidence yet</strong><p>Ask your agent to define one useful increment: the expected result, how to measure it, and who will accept it.</p></div>`}
 </section>`
 }
 

package/bin/lib/trust.js

@@ -3,7 +3,7 @@
 function createTrustApi(deps) {
   const {
     fs, path, readClean, readEng, parseMdTable, sectionBody, SIGNAL_LEDGER, memoryDirtyManual,
-    stripTemplateNoise, stripLegendLines,
+    stripTemplateNoise, stripLegendLines, extractRisks,
   } = deps
 
   // phase / trust / top risk / freshness - identical heuristic for status + dashboard.
@@ -129,27 +129,7 @@ function createTrustApi(deps) {
   }
 
   function countOpenRisks(eng) {
-    const md = readClean(eng, 'risks.md')
-    const body = md.split(/^#{1,6}\s+Retired\b/im)[0] || md
-    let n = 0
-    for (const raw of body.split('\n')) {
-      const t = raw.trim()
-      if (!t || t.startsWith('<!--') || /^#{1,6}\s/.test(t)) continue
-      if (/risk\s*\|\s*status|mitigation/i.test(t) || /^\|?[\s|:-]+$/.test(t)) continue
-      // Bullet risk with substance (skip empty "- " stubs). The bullet marker
-      // must be followed by space: "**Status:** open · closed" is a legend, and
-      // counting it as a risk reported one open risk on an empty register.
-      if (/^[-*]\s/.test(t)) {
-        if (t.replace(/^[-*]\s+/, '').trim()) n++
-        continue
-      }
-      // Table row: first cell must have risk text (day-1 "| | open | |" placeholders don't count).
-      if (/^\|/.test(t) && t.length > 12) {
-        const riskCell = t.split('|').map(c => c.trim())[1] || ''
-        if (riskCell) n++
-      }
-    }
-    return n
+    return extractRisks(eng).length
   }
 
   function nextActionLine(ctx) {
@@ -166,7 +146,7 @@ function createTrustApi(deps) {
   function computeSignals(eng) {
     // readClean, not readEng: status/dashboard echo topRisk and stakeholder lines
     // to the terminal and the rendered HTML - a <private> risk must never surface.
-    const ctx = readClean(eng, 'context.md'); const stake = readClean(eng, 'stakeholders.md'); const risks = readClean(eng, 'risks.md')
+    const ctx = readClean(eng, 'context.md'); const stake = readClean(eng, 'stakeholders.md')
     // Prefer structured tokens from stakeholders + CLI ledger (ledger survives wipes)
     const signalText = stake + '\n' + readClean(eng, SIGNAL_LEDGER)
     const phase = parsePhase(ctx)
@@ -215,11 +195,7 @@ function createTrustApi(deps) {
       trust = sLines.some(l => /\bred\b/i.test(l)) ? 'RED'
         : sLines.some(l => /amber|gone quiet|routing around|escalat/i.test(l)) ? 'amber' : 'new'
     }
-    const topRisk = (risks.split('\n').find(l => {
-      const t = l.trim()
-      return /^[-|]/.test(t) && t.length > 20 && !/^\|?[-\s|]+$/.test(t) &&
-        !/risk\s*\|\s*status|mitigation/i.test(t) && !t.startsWith('<!--')
-    }) || '').replace(/\|/g, ' ').replace(/\s+/g, ' ').trim().slice(0, 80)
+    const topRisk = (extractRisks(eng)[0]?.text || '').replace(/\s+/g, ' ').trim().slice(0, 80)
     // Prefer trust trigger / memory warn over a random risk line; always keep mem.warn available
     const reason = (trustReason || mem.warn) ? (trustReason || mem.warn) : topRisk
     // What the triage line is actually quoting. A risk bullet printed under

package/bin/lib/value-ledger.js

@@ -26,6 +26,7 @@ function evidenceSource(evidence) {
 }
 
 function valueState({ measured, accepted, acceptanceStatus, evidence }) {
+  if (withdrawalMention({ measured, accepted, acceptanceStatus, evidence })) return 'claimed'
   if (!measured || PENDING_CELL_RE.test(measured)) return 'unmeasured'
   if (!acceptanceName(accepted) || !evidenceSource(evidence)) return 'claimed'
   // Explicit status is authoritative when the column exists. Unknown values
@@ -37,4 +38,48 @@ function valueState({ measured, accepted, acceptanceStatus, evidence }) {
   return 'accepted'
 }
 
-module.exports = { PENDING_CELL_RE, acceptanceName, evidenceSource, valueState }
+// These checks flag explicit conflicts for human review. They do not authenticate
+// approval, infer delegation, or revoke history when the current signer changes.
+function withdrawalMention(row) {
+  return [row.measured, row.accepted, row.acceptanceStatus, row.evidence].filter(Boolean).some(value => {
+    const text = String(value)
+      .replace(/\[source:[^\]]*\]/gi, '')
+      .replace(/\S*[/\\]\S*/g, '') // artifact names are sources, not withdrawal events
+      .replace(/\b(?:not|never)\s+(?:been\s+)?(?:withdrawn|retracted|revoked|superseded)\b/gi, '')
+    // A withdrawn result is different from a result counting revoked tokens.
+    return /^(?:withdrawn|retracted|revoked|superseded)(?:\s*:|\s*$)/i.test(text.trim()) ||
+      /\b(?:approval|acceptance|evidence|measurement|result|assertion)\b[^.;\n]{0,40}\b(?:withdrawn|retracted|revoked|superseded)\b/i.test(text) ||
+      /\b(?:withdrawn|retracted|revoked|superseded|retracts?|withdraws?)\b[^.;\n]{0,25}\b(?:approval|acceptance|evidence|measurement|result|assertion)\b/i.test(text)
+  })
+}
+
+function scopeIssue(row, goal) {
+  const rowPromise = String(row.promised || '')
+  const goalLine = String(goal).match(/^(?:\*\*)?(?:Done when|Acceptance check):(?:\*\*)?\s*(.*)$/im)
+  const scopeSpecified = /\b(?:production|staging|synthetic|slides?|demo|prototype|poc)\b/i.test(rowPromise)
+  const promise = scopeSpecified ? rowPromise : `${rowPromise} ${goalLine ? goalLine[1] : goal}`
+  const acceptance = String(row.accepted || '')
+  const limited = acceptance.match(/\b(staging|slides?(?: design)?|demo|prototype|poc)\s+only\b/i)
+  if (limited) {
+    const scope = limited[1].toLowerCase()
+    const matchingGoal = scope.startsWith('slide') ? /\bslides?\b/i.test(promise) : new RegExp('\\b' + scope + '\\b', 'i').test(promise)
+    if (!matchingGoal || /\b(?:production|clinical use|go.live)\b/i.test(promise)) return 'approval scope is limited; review against the promised outcome'
+  }
+  const measured = String(row.measured || '')
+  const productionUntested = measured.split(/[;.\n]/).some(clause => /\bproduction\b/i.test(clause) && /\b(?:not|never|untested|unmeasured|pending)\b/i.test(clause))
+  if (/\bproduction\b/i.test(promise) && /\b(?:staging|synthetic|prototype|poc)\b/i.test(measured) && (!/\bproduction\b/i.test(measured) || productionUntested)) return 'measurement scope differs from production promise; review required'
+  return ''
+}
+
+function reconcileValueRows(rows, goal = '') {
+  const key = row => String(row.slice || '').trim().toLowerCase()
+  const withdrawn = new Set(rows.filter(withdrawalMention).map(key).filter(Boolean))
+  return rows.map(row => {
+    let acceptanceIssue = scopeIssue(row, goal)
+    if (withdrawalMention(row)) acceptanceIssue = 'withdrawal recorded; review current acceptance'
+    else if (withdrawn.has(key(row))) acceptanceIssue = 'conflicting withdrawal for this slice; review history before relying on acceptance'
+    return acceptanceIssue ? { ...row, acceptanceIssue, state: row.state === 'unmeasured' ? 'unmeasured' : 'claimed' } : row
+  })
+}
+
+module.exports = { PENDING_CELL_RE, acceptanceName, evidenceSource, valueState, reconcileValueRows }

package/mcp/fdeops-ingest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops-ingest-mcp",
-  "version": "3.27.1",
+  "version": "3.29.0",
   "private": true,
   "description": "Thin stdio MCP sink for FDEOps ingest (stage → propose → apply). Zero runtime dependencies.",
   "bin": {

package/mcp/fdeops-ingest/server.js

@@ -10,6 +10,10 @@
 
 const fs = require('fs')
 const path = require('path')
+const os = require('os')
+const masking = require('../../bin/lib/masking').createMasking(
+  (process.env.FDEOPS_ENGAGEMENTS_ROOT || '').trim().replace(/^~/, os.homedir()) || path.join(os.homedir(), 'fde-engagements')
+)
 const { spawnSync } = require('child_process')
 
 const PROTOCOL_VERSION = '2024-11-05'
@@ -171,7 +175,9 @@ function cliPayload(out) {
 }
 
 function toolResult(payload) {
-  const text = typeof payload === 'string' ? payload : JSON.stringify(payload, null, 2)
+  let text
+  try { text = masking.mask(typeof payload === 'string' ? payload : JSON.stringify(payload, null, 2)) }
+  catch (_) { return { isError: true, content: [{ type: 'text', text: 'privacy masking unavailable; no unmasked tool output returned' }] } }
   return { content: [{ type: 'text', text }] }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops",
-  "version": "3.27.1",
+  "version": "3.29.0",
   "description": "Client delivery tools for Forward Deployed Engineers. One @fde skill, local Markdown engagement records, and an offline dashboard for decisions, evidence, approvals, and next actions.",
   "bin": {
     "fdeops": "bin/install.js",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "fdeops",
-  "version": "3.27.1",
+  "version": "3.29.0",
   "description": "Forward deployed engineering skills for AI coding agents. One @fde skill for the client work around the code. You confirm; then it lands in .fde/ on your laptop.",
   "author": {
     "name": "Subash Natarajan",

package/skills/fde/SKILL.md

@@ -28,7 +28,7 @@ A one-line typo or compile error in a file that will not ship. On a bound client
 | **When did we agree?** | Don't argue from memory. Search the record. | `fde receipts <term>` | - |
 | **What's the outcome?** | A number nobody signed is claimed, not delivered. | `fde status` | `references/readout.md` |
 
-After a meeting: `fde debrief --smart` → one REVIEW screen (decisions / asks / scope / delivery gaps / next / signer) → in chat, a four-row card (omit empty; Previously / Not yet agreed) → **Save this update?** (engineer accepted the record, not customer approval of every ask) → `--apply`. Walk-in: `fde prep`. Friday: `fde status`.
+After a meeting: the agent runs `fde debrief --smart`, interprets and reconciles the sanitized proposal, then validates it with `fde debrief --review`. Show the human one concise review of consequential changes and uncertainties → **Save this update?** → `--apply` only after confirmation → verify the saved facts. See `references/debrief.md` for the shared preparation contract. Walk-in: `fde prep`. Friday: `fde status`.
 
 ## Ground loop
 
@@ -69,7 +69,7 @@ Writes need a bind (`FDEOPS_ENGAGEMENT` or registry). Never install fdeops on in
 |----------|---------|
 | where are we | `fde resume` |
 | day-1 look at the repo | `fde scan` |
-| debrief / pasted notes | `fde debrief --smart` → REVIEW → four-row chat card → Save this update? → `--apply`. `--smart` is a gate, not a brain. `references/debrief.md` |
+| debrief / pasted notes | `fde debrief --smart` → agent reconciliation → one plain-English review → Save this update? → `--apply`. `--smart` is a gate, not a brain. `references/debrief.md` |
 | prep me for … | `fde prep "<label>"` |
 | when did we agree | `fde receipts <term>` |
 | sponsor update / defend the number | `fde defend` |
@@ -211,3 +211,7 @@ Ready to build with no `terrain.md` / plan: discover or plan first. Takeover wit
 - Evidence on every claim. The FDE will be challenged on these files.
 - Overlays activate on signal, not on request.
 - Load `.fde/` files on demand, never the whole folder.
+
+## Identifier masking
+
+Before reading engagement content in a session, run `fde privacy` to verify runtime support. If the command is unavailable, stop and update the CLI; a new skill alone does not upgrade an older executable. Use CLI context and previews for model input. They mask common email, phone, SSN-shaped, and credential patterns by default; aliases remain consistent within the local engagements root. Preserve complete alias tokens when drafting updates; the CLI resolves them locally. Never read the private `.privacy/` dictionary, sealed sidecars, raw sensitive notes, or local dashboard/vault files to recover an identity. Names, company names, addresses, and unrecognized formats are not automatically detected: keep sensitive prose in `<private>` blocks. Direct file tools, pasted chat, and upstream source MCPs bypass this boundary.

package/skills/fde/references/audit.md

@@ -4,11 +4,11 @@
 
 **Read first:** `context.md` if it exists - otherwise start cold. The point of this phase is to establish ground truth, not assume it.
 
-## Method - part 1: read everything that exists (you do this work)
+## Method - part 1: inspect the inherited record (you do this work)
 
 Before forming any opinion:
 
-1. **Inherit the paper.** Any previous `.fde/`, docs, README claims, ADRs, ticket history the FDE can export. Read it all - the previous FDE's decisions are evidence, not verdicts.
+1. **Inherit the paper.** Start with `fde resume` and inventory the available docs, ADRs, ticket exports and operational handoff. Do not recursively load `.fde/` or raw transcripts. List the claims and unknowns, then use `fde recall <specific topic>` to retrieve bounded evidence for each consequential claim. Review the relevant source when an excerpt is insufficient; keep unrelated history on disk. Previous decisions are evidence, not verdicts.
 2. **Run the discover scans** (see `discover.md` part 1: churn, test gaps, "temporary" grep, AI components). On a takeover, add:
 ```bash
 git log --format="%an" | sort | uniq -c | sort -rn | head   # who actually built this
@@ -55,7 +55,7 @@ Build without a plan in an inherited system is the fastest path to the second in
 
 ## Principles
 
-- Read everything that exists before forming any opinion.
+- Inventory the record; verify consequential claims through targeted, bounded retrieval before forming an opinion.
 - "It should work" is not "it works." Verify.
 - The most dangerous systems are the ones everyone assumes someone else understands.
 - Don't build until `audit.md`, `terrain.md`, `reality.md` are written.

package/skills/fde/references/debrief.md

@@ -4,7 +4,7 @@
 
 **Large transcripts or emails** sitting in Granola/Gmail/Notion → prefer **`fde ingest stage`** first (via source MCPs the FDE configured), then the same propose → confirm → **`fde ingest apply`** path. See `references/ingest.md`. Pasted short notes stay on this debrief verb.
 
-**Read first:** `context.md`, `stakeholders.md` (signals against what's known).
+**Read first:** the bounded `fde resume` packet for the bound client. Use `fde recall` for the specific prior decision, action, or delivery result needed to reconcile this update. Do not reload the whole engagement.
 
 **Who runs the CLI:** you (the agent). Never tell the FDE to type `fde debrief …`.
 
@@ -13,7 +13,7 @@
 - The `fde` CLI is **local, deterministic, no AI**. `--smart` is a **gate + writer**, not a brain.
 - It keeps lines that already have `decision:` / `risk:` / `delivery:` / `contact:` / `next:` / `signer:` prefixes, plus a thin keyword pass (e.g. "we agreed", person+verb lines, "open question", "X signs off").
 - `signer: Priya` fills **Stakeholder who signs off** in `success.md` and logs Priya as a contact. The CLI proposes it when a sentence says someone signs off / approves / has final say. If the notes name who can say yes and the proposal does not carry a `signer:` line, add one - that is the most expensive sentence in the meeting.
-- Real messy notes without prefixes often route **0 useful lines** - everything else lands as a context dump. That is expected. **You are the router:** rewrite `.debrief-propose` with type prefixes, then `--apply`.
+- Heuristics can miss facts **and mislabel prefixed lines**. You interpret every candidate against the sanitized source, not just unprefixed lines. Split distinct decisions, requests, actions, and results; keep uncertainty. The user reviews meaning, never prefix syntax.
 - `.debrief-propose` is raw lines only (no routing annotations). "Edit if mis-routed" means **rewrite the line with the right prefix**, not leave a comment in the file.
 
 ## Method (you do this work)
@@ -22,25 +22,24 @@
 
 1. Save the FDE's notes to a temp `.md` file in the workspace (or pipe stdin).
 2. Run `fde debrief --smart <notes.md>` (or `npx fdeops debrief --smart …`).
-3. Open `.debrief-propose`. If lines lack type prefixes, **rewrite them** before showing the FDE, e.g.:
-   - `decision: agreed chargebacks stay phase 2 - Priya`
-   - `decision: freeze the API [approved: Priya 2026-09-08]` (optional; missing means unconfirmed)
-   - `risk: legal may reopen scope if we slip the SOW date`
-   - `contact: Priya pushed hard on Friday deck [signal:amber]`
-   - `signer: Priya` (she can say yes; lands in `success.md`)
-   - `next: send one-pager before Thursday 9am`
-   - unprefixed lines stay context color only
-4. Show the **REVIEW** block first (decided / asked / open / next / signer). That is the one screen to confirm. File routing stays underneath.
-5. In **chat**, after that REVIEW, present a four-row card and omit empty rows:
-   - Decided
-   - Asked / open
-   - Next
-   - Signer
-   Then a **Previously:** line from the record, and **Not yet agreed** for anything still proposed. Ask **Save this update?** Saving means the engineer accepted this as the engagement record, not that the customer approved every ask. Uncertainty stays visible.
-6. On FDE confirm → run `fde debrief --apply`.
-7. On reject → stop; ask what to change; do not apply. Do not rebuild or replace the CLI REVIEW engine.
-
-No invented names or quotes. If the propose looks wrong, fix prefixes with judgment then re-apply or use the fallback path.
+3. Run `fde debrief --review` before opening an existing proposal so legacy identifiers are masked. Open the proposal only after review succeeds. Never open a proposal containing manually inserted raw private blocks. Prepare the pending proposal using **Prepare one update** below. Read only the sanitized `.debrief-propose`, never the sealed private sidecars or raw private source. Preserve privacy markers, source metadata, and complete identifier aliases such as `[[email:...]]`. The CLI restores known aliases locally on apply. Never read `.privacy/` or try to recover an identity with file tools. If an alias is truncated, retrieve a narrower excerpt; never guess or edit the token.
+4. Run `fde debrief --review` after editing. Treat the CLI REVIEW and routing output as your validation, not a second presentation to the user. Resolve errors and replay warnings before asking for confirmation.
+5. Show **one** concise review in chat: name the client, then the consequential changes in plain English. Include decisions, requests still unagreed, actions, reported delivery, signer or contact changes, and unresolved conflicts when present. Show the previous value only where it changes the meaning. Omit empty categories and CLI routing details; do not impose a fixed four-row card that hides other changes. If the proposal is too large to show faithfully, split the review into explicit batches; never approve hidden changes.
+6. Ask **Save this update?** This confirms the engineer's record, not customer acceptance. On confirmation, apply precisely that proposal with `fde debrief --apply`. A material correction requires a revised review and renewed confirmation. On rejection, leave the proposal pending and do not apply.
+7. Verify the changed facts through bounded `fde resume` / targeted `fde recall`. If a fieldbook is part of the current task, regenerate it using the existing command and destination after the confirmed save; do not make the user run it. End with a brief saved/not-saved result and the next action, not another full summary.
+
+### Prepare one update (shared with ingest)
+
+Do this work yourself before the human review:
+
+- **Check meaning, not keywords.** “We settled on delaying the rewrite” is a decision; “Mara will request access” is an action, even if the heuristic calls it a contact. A wish or suggestion remains a request, not agreement. Do not infer authority, approval, a calendar date from an unanchored relative date, or production value from staging.
+- **Keep facts traceable.** Preserve supplied source locators on each consequential fact, using `[source: ...]`. If only a local file or staged item exists, cite that actual locator as a note source, not a customer receipt. Do not invent a meeting date or speaker. A source label is not authenticated approval.
+- **Reconcile only what changed.** Compare affected facts with the current record using targeted retrieval. Leave unchanged sourced statements out of an accidental re-import. Preserve earlier history; record changed or conflicting claims explicitly. If everything is already recorded, say so and leave the pending proposal unapplied. If it blocks a later capture, explain that no new facts were saved and ask permission to replace that pending review; use `--replace-proposal` with the new notes only after that authorization. Do not delete proposal files or private sidecars manually. Do not use `--allow-replay` without explicit approval of an intentional repeat.
+- **Protect the current next action.** A late meeting note does not automatically supersede a newer action. Keep older actions as dated context unless their current priority is established; show a conflict when it needs a decision. Use exactly one physical `next:` line for the current action. If multiple current actions are explicitly agreed, include them on that same line separated by semicolons; the CLI retains only the last `next:` line. Keep other dated commitments in context. Do not silently discard other commitments.
+- **Keep memory useful.** Retain consequential facts and indispensable context; remove chatter and repetition from the proposal, not from the source. Preserve the raw input outside `.fde/` (staged material stays in `.inbox/`). Never remove privacy placeholders or modify sealed sidecars. Ask only about a consequential ambiguity that cannot remain explicitly unknown.
+- **Structure the result.** Use `decision:` / `risk:` / `delivery:` / `contact:` / `next:` / `signer:`. Preserve `ask:` / `scope:` as explicitly proposed context when appropriate. Prepare the seven-field delivery row yourself for a reported result (see below); unknown fields stay `pending`. The human should not have to fill out a ledger to capture a meeting.
+
+Before showing the review, check that every consequential fact in the sanitized source is represented, already recorded, or explicitly unresolved. Check classified lines as carefully as unclassified ones. Nothing is saved simply because this preparation is complete.
 
 ### Fallback - you structure, then route
 
@@ -53,10 +52,10 @@ If `--smart` is unavailable or you already have clean prefixes:
    - **Risks** - new / confirmed / retired
    - **Open questions** - what to chase next
 2. Format lines as `decision:` / `risk:` / `delivery:` / `contact:` / `next:` / `signer:` (contacts may end with `[signal:green|amber|red]`).
-3. Show the same **chat card** as the smart path (omit empty rows; Previously; Not yet agreed; **Save this update?**). Do not invent a second confirm surface.
+3. Follow **Prepare one update** and show the same single plain-English review as the preferred path. Include every consequential change and ask **Save this update?**.
 4. On confirm, pipe to `fde debrief` (or write a file and run it).
 
-One clarifying question max if the dump is ambiguous - then write. Never stall capture on completeness.
+Ask at most one focused question at a time when ambiguity would change the record. Otherwise preserve the unknown and include it in the review. Never treat silence as confirmation.
 
 ## Artifact
 
@@ -66,7 +65,7 @@ One clarifying question max if the dump is ambiguous - then write. Never stall c
 
 ## Checkpoint
 
-Read back the 2-3 most consequential captures in one breath - so the FDE can correct on the spot. Then stop. No summary theatre.
+Use the single pre-save review above. After saving, report verification and the next action briefly; do not ask for a second approval or repeat the review.
 
 ## Principles
 
@@ -74,3 +73,15 @@ Read back the 2-3 most consequential captures in one breath - so the FDE can cor
 - Verbatim quote outranks paraphrase; hesitation outranks quote.
 - Signals move on evidence, never on vibe alone.
 - A meeting with no decisions and no actions - say so; that is a finding.
+
+## Delivery rows and repeated updates
+
+For a measured or promised slice, use a reviewed structured line:
+
+```text
+delivery: Replay|risk-mitigation|zero duplicates|zero duplicates on staging|pending|[source: transcript:42]|pending
+```
+
+The seven fields are Slice, Bucket, Promised, Measured, Accepted by, Evidence, Rollback. Keep unknowns `pending`; never infer approval. This lands in the value ledger during the same confirmed apply. A `delivery:` line without pipes stays a narrative note. Incorrect field counts refuse the write rather than shifting the meaning of cells.
+
+A sourced statement already in the record triggers a replay warning. Before applying, compare newer facts and the current next action. Remove repeated statements from the proposal if this is an accidental re-import. Only after the engineer explicitly confirms an intentional repeat, apply with `fde debrief --apply --allow-replay`. This does not silently deduplicate history and does not authenticate sources.

package/skills/fde/references/discover.md

@@ -108,7 +108,7 @@ Flag every one. AI components don't fail like regular code - they degrade as the
 
 **6. Data flow.** Where data enters, how it moves, where it stops. Entry points first: routes, queues, cron, file drops.
 
-**7. Existing capability.** Trace the requested user action through existing code, configuration, tests, and operating workarounds. In `terrain.md`, record what can already be reused and the evidence that it works or fails. Check whether a configuration, ownership, or process change could resolve the observed break. A disabled feature is a lead, not a proven root cause. Keep observations and hypotheses distinct; option selection still belongs to plan / three-options.
+**7. Existing capability.** Trace the requested user action through existing code, configuration, tests, and operating workarounds. In `terrain.md`, record what can already be reused and the evidence that it works or fails. Check whether a configuration, ownership, or process change could resolve the observed break. A disabled feature is a lead, not a proven root cause. Keep observations and hypotheses distinct; option selection still belongs to plan / three-options. Summarize the remaining gap in `reality.md`: what works today → what the customer needs → what is still missing, with sources. If existing capability meets the need, say so; do not manufacture a build requirement.
 
 ## Method - part 2: the humans (you coach, the FDE asks)
 
@@ -150,7 +150,7 @@ Always map the estate before you score a use case - not only when someone said "
 **The 5 questions (ask the data owner, not the sponsor):**
 1. **Where does data live?** - List every source: databases, warehouses, SaaS exports, spreadsheets, S3 buckets, vendor APIs. Map it.
 2. **How fresh is it?** - Real-time, daily batch, "someone uploads a CSV on Mondays"? Freshness determines what's buildable.
-3. **Who owns it?** - Not "IT" - the named person who can grant access and explain the schema. No name = no access in practice.
+3. **Who owns it?** - Not "IT" - the named person who can grant access and explain the schema. No named owner: access responsibility remains unverified.
 4. **What's the quality?** - Sample 100 rows from each critical source. Check: nulls, duplicates, format consistency, semantic correctness. A 60% null rate in a key field = that source is fiction.
 5. **What are the governance constraints?** - PII classification, retention policies, cross-border rules, consent basis. One missed constraint = a compliance stop later.
 
@@ -164,6 +164,10 @@ Always map the estate before you score a use case - not only when someone said "
 
 A use case that depends on a "Blocker" source **or a Blocker pipe** doesn't get scored - it gets a remediation conversation first. `what-breaks` finding an invisible integration at ship is already too late. Write this to `terrain.md` under a `## Data estate` section.
 
+**Promised dependencies are not ready dependencies.** For consequential promises such as "data in two weeks," record or update one dependency entry in `assumptions.md` with the responsible owner, dated verification checkpoint, and evidence needed. Unknown owners or dates stay unknown; propose a checkpoint for confirmation. Link the affected work; if the checkpoint slips, identify what can proceed and what needs replanning. Missing ownership is an unresolved dependency, not proof that the project will fail. On-prem or restricted access is a constraint to investigate, not a red flag by itself.
+
+**Verify the future operator now.** Check the proposed owner in `success.md` against who will actually monitor, recover, and support the result. Record whether they have agreed, access or training gaps, and a practical handoff check there; carry these into `handoff.md` at close. Keep unconfirmed ownership explicit. Reuse supplied evidence and ask only what changes the plan.
+
 ## When scope is a transformation, not a single problem
 
 Score every candidate use case before anything gets prototyped:

package/skills/fde/references/ingest.md

@@ -4,7 +4,7 @@
 
 **Connect / capability (different entry):** "connect a new MCP", "connect Granola/Slack/Notion", "what can you pull?" → `references/connect.md` first. Recipes: `mcp/recipes/` (file, granola, slack, notion).
 
-**Read first:** `context.md` (what's already logged, what's stale). Bind the engagement before staging anything.
+**Read first:** the bounded `fde resume` packet and targeted recall for affected prior facts. Bind the engagement before staging anything.
 
 **Who runs the CLI:** you (the agent). Never tell the FDE to type `fde ingest …`. Never auto-apply. Never background-sync or poll sources on your own.
 
@@ -31,9 +31,9 @@ List what you can actually call **this session**:
 3. **Stage** - `fde ingest stage [--source NAME] [--title TEXT] [file|-]` writes raw text into `<engagement>/.inbox/` (outside the memory git ledger).
 4. **List** (optional) - `fde ingest list` shows staged items when you need an id or filename.
 5. **Propose** - `fde ingest propose <id-or-filename>` runs the debrief `--smart` path on the staged body (+ provenance line). Opens `.debrief-propose`.
-6. **Rewrite prefixes** - same as debrief: lines without `decision:` / `risk:` / `delivery:` / `contact:` / `next:` / `signer:` need **you** to rewrite before showing the FDE. `--smart` is a gate, not a brain.
-7. **Show** the same chat card as debrief (decided / asked / open / next / signer; omit empty; Previously; Not yet agreed; **Save this update?**). Wait for confirm. The CLI REVIEW printout is unchanged.
-8. **Apply** - on FDE confirm only → `fde ingest apply` (= `fde debrief --apply`). On reject → stop; ask what to change.
+6. **Prepare** - follow **Prepare one update** in `references/debrief.md`. Interpret every sanitized candidate, including already-prefixed lines; reconcile changed facts, preserve source locators, and keep raw chatter out of memory. Preserve privacy placeholders and sealed sidecars.
+7. **Validate and show** - run `fde debrief --review` after editing, then show the same single plain-English review as debrief, including delivery changes and conflicts. Ask **Save this update?** and wait for confirmation. CLI output is agent validation, not a second user review.
+8. **Apply and verify** - on FDE confirm only → `fde ingest apply` (= `fde debrief --apply`), then verify affected facts through bounded resume/recall. Refresh the current fieldbook if it is part of this task. On reject, leave the proposal pending; material edits require a revised review.
 
 No invented names, meetings, or quotes. If the propose looks wrong, fix prefixes with judgment, then re-show before apply.
 
@@ -56,7 +56,7 @@ fde ingest apply
 
 ## Provenance
 
-When a staged fact came from a named source, carry `via:<source>` on the applied line where useful (e.g. `via:granola`, `via:gmail`). Helps receipts and sponsor disputes later - not mandatory on every context line.
+Carry an actual `[source: ...]` locator on each consequential fact. Preserve upstream IDs or links when supplied; otherwise cite the staged item path as a note source. Retain its `via:` metadata, but do not treat a standalone `via:` line as a source marker for every fact or as proof of approval. Re-imports still require semantic comparison; exact replay protection is not semantic deduplication.
 
 ## MCP sink + recipes
 
@@ -64,7 +64,7 @@ Optional `mcp/fdeops-ingest` wraps the same verbs over stdio. Source MCPs remain
 
 ## Checkpoint
 
-Before apply, read back the 2-3 most consequential captures in one breath - same as debrief. Confirm which sources you staged and what would land in the record. Then stop.
+Use the single review from debrief: identify the client and sources, show consequential changes, then wait. Do not add another summary or approval step.
 
 ## Principles
 

package/skills/fde/references/land.md

@@ -57,6 +57,7 @@ Intent: coach the FDE's first *customer* conversation - what keeps the sponsor u
 - "Before you open the laptop - what would make this a bad engagement for *them*, not just a delayed project?"
 - "What are they afraid you'll miss?"
 - "Who loses credibility if this goes wrong?"
+- "If nothing changes over the agreed timeframe, what happens, and who bears it?" Record the consequence and its source in `brief.md`; distinguish reported impact from measured cost. Unknown cost stays unknown, not an invented ROI.
 
 Let silence sit. If their fear doesn't match the written brief, the brief is wrong - say so plainly, log it.
 
@@ -67,6 +68,7 @@ Let silence sit. If their fear doesn't match the written brief, the brief is wro
 - **The sacred thing** - "Is there anything in this environment I should treat as untouchable?" The hesitation before the answer is the answer.
 - **Exception path (operating map seed)** - "When the happy path breaks this week, what do people actually do - who do they call, what spreadsheet opens, what do they skip?" Capture the break → workaround → who owns it. Do not build a full map on day 1; seed rows later in `terrain.md` → `## Operating map (exception-led)` during discover. Unknowns stay `unknown - ask:`.
 - **AI posture and policy** - tools already in use (sanctioned or shadow), and: "Does your organisation have a policy on AI-generated code? Are there decisions where you would not be comfortable with AI involvement?"
+- **Future operator** - "Who will run this after we leave, and have they agreed?" Record the proposed operator and unresolved ownership in `success.md`, separately from the signer. A sponsor naming a team is not that team accepting responsibility; verify with the operator during discover.
 - **Boundaries in multi-vendor rooms** - who owns what surface, who signs off before a change crosses it.
 
 ## The day 1 deliverable