fdeops 3.28.0 → 3.29.0

package/README.md

@@ -247,7 +247,7 @@ If your work has no client commitments or operating handover to track, a simpler
 
 The CLI works with local files and Git, without network calls or telemetry. Client records remain readable Markdown if you stop using FDEOps.
 
-Your AI host may send the material it reads to its configured model. FDEOps redacts `<private>` blocks from CLI, dashboard, and hook outputs; do not load those raw blocks through the agent's file tools. Review reports before sharing client information.
+Your AI host may send the material it reads to its configured model. CLI context and smart proposals mask common email, phone, SSN-shaped, and credential patterns locally; this is not complete PII detection. FDEOps redacts `<private>` blocks from CLI, dashboard, and hook outputs; do not load those raw blocks through the agent's file tools. Review reports before sharing client information.
 
 You review proposed decisions. Enabled session hooks can save where the session left off automatically; direct CLI write commands update records when you run them.
 

package/bin/check.js

@@ -354,7 +354,7 @@ if (/\broutes methods\b|\bphase methods\b|\bengagement methods\b/.test(usage)) {
 ok('README tone')
 
 if (fs.existsSync(path.join(root, '.codex')) || fs.existsSync(path.join(root, '.opencode'))) {
-  fail('.codex/ or .opencode/ must not live at repo root - use docs/internal/experimental-agents/')
+  fail('.codex/ or .opencode/ must not live at repo root - keep personal agent setup outside the public repository')
 } else ok('no root-level experimental stubs')
 
 for (const rel of ['docs/schema.md', 'docs/skills-reference.md', 'PRIVACY.md']) {
@@ -415,18 +415,13 @@ ok('examples walkthrough files')
 }
 
 if (fs.existsSync(path.join(root, 'tasks', 'plan.md'))) {
-  fail('tasks/plan.md should not be in public tree (move to docs/internal)')
+  fail('tasks/plan.md should not be in the public tree; keep work plans outside the repository')
 }
 
 if (fs.existsSync(path.join(root, 'patterns'))) {
   fail('patterns/ is deprecated - use skills/ only (overlays live there)')
 }
 
-const pmf = path.join(root, 'docs', 'internal', 'PMF_360_REVIEW.md')
-if (fs.existsSync(pmf) && !read('docs/internal/PMF_360_REVIEW.md').includes('INTERNAL')) {
-  fail('PMF_360_REVIEW.md needs INTERNAL banner')
-} else if (fs.existsSync(pmf)) ok('internal PMF banner')
-
 const hook = read('hooks/session-start')
 const hookCode = hook.replace(/^[ \t]*#.*$/gm, '')
 if (!hook.includes('FDEOPS_ENGAGEMENT')) {

package/bin/fde.js

@@ -45,6 +45,13 @@ const HOME = os.homedir()
 const ENGAGEMENTS_ROOT = ((process.env.FDEOPS_ENGAGEMENTS_ROOT || '').trim().replace(/^~/, HOME))
   || path.join(HOME, 'fde-engagements')
 const REGISTRY = path.join(ENGAGEMENTS_ROOT, '.registry')
+const masking = require('./lib/masking').createMasking(ENGAGEMENTS_ROOT)
+function maskDisplay(text) {
+  return ['dashboard', 'vault'].includes(process.argv[2]) ? String(text) : masking.mask(text)
+}
+function maskedSections(sections, maxBytes) {
+  return context.boundedSections(sections.map(text => masking.mask(text)), maxBytes)
+}
 const DEBRIEF_MAX_BYTES = 256 * 1024
 const CODE_EXT = ['.js', '.ts', '.tsx', '.jsx', '.py', '.java', '.go', '.rb', '.cs', '.php']
 const CONF_EXT = CODE_EXT.concat(['.env', '.yaml', '.yml', '.json'])
@@ -114,7 +121,7 @@ function grepFiles(files, regex, cap) {
     try { text = fs.readFileSync(f, 'utf8') } catch (_) { continue }
     const lines = text.split('\n')
     for (let i = 0; i < lines.length && hits.length < cap; i++) {
-      if (regex.test(lines[i])) hits.push({ file: path.relative(process.cwd(), f), line: i + 1, text: lines[i].trim().slice(0, 120) })
+      if (regex.test(lines[i])) hits.push({ file: path.relative(process.cwd(), f), line: i + 1, text: maskDisplay(lines[i].trim()).slice(0, 120) })
     }
   }
   return hits
@@ -798,7 +805,7 @@ function firstLine(md, maxLen) {
   for (const raw of md.split('\n')) {
     const l = raw.trim()
     if (!l || /^#{1,6}\s/.test(l)) continue
-    const clean = l.replace(/^\*\*[^*]+:\*\*\s*/, '').replace(/\*\*/g, '').replace(/^["']|["']$/g, '').trim()
+    const clean = maskDisplay(l.replace(/^\*\*[^*]+:\*\*\s*/, '').replace(/\*\*/g, '').replace(/^["']|["']$/g, '').trim())
     if (!clean) continue
     return clean.length > maxLen ? clean.slice(0, maxLen - 1).trim() + '…' : clean
   }
@@ -811,7 +818,7 @@ function firstLine(md, maxLen) {
 function parseReality(md, maxLen) {
   const theory = (md.match(/\*\*Working theory:\*\*[^\S\r\n]*(.*)/i) || [])[1]
   const hasSchema = /\*\*(Working theory|Evidence|Differs from brief how):\*\*/i.test(md)
-  const theoryText = (theory || '').trim()
+  const theoryText = maskDisplay((theory || '').trim())
   if (theoryText) {
     const line = theoryText.length > maxLen ? theoryText.slice(0, maxLen - 1).trim() + '…' : theoryText
     return { line, missing: '' }
@@ -1081,14 +1088,14 @@ function extractStakeholders(eng) {
   for (const [key, h] of latest) {
     if (byKey.has(key)) {
       const cur = byKey.get(key)
-      byKey.set(key, { ...cur, signal: h.signal, note: cur.note || h.text.slice(0, 80) })
+      byKey.set(key, { ...cur, signal: h.signal, note: cur.note || maskDisplay(h.text).slice(0, 80) })
     } else {
       const name = displayNameFromSignalText(h.text)
       if (!name || isSignalNameNoise(name)) continue
       byKey.set(key, {
         name,
         role: '',
-        note: h.text.slice(0, 80),
+        note: maskDisplay(h.text).slice(0, 80),
         signal: h.signal,
         source: 'signal',
       })
@@ -1426,7 +1433,7 @@ function cmdResume(args) {
   const policy = readClean(eng, 'trust-profile.md')
   const success = readClean(eng, 'success.md')
   const risks = readClean(eng, 'risks.md')
-  process.stdout.write(context.boundedSections([
+  process.stdout.write(maskedSections([
     policy ? `CLIENT POLICY - trust-profile.md\n${policy}` : '',
     `${intro}\n\nENGAGEMENT: ${eng}`,
     success ? `CURRENT GOALS & ACCEPTANCE - success.md\n${success}` : '',
@@ -1832,6 +1839,7 @@ function readDebriefInput(args) {
 }
 
 function previewLine(text, max = 240) {
+  text = masking.mask(text)
   const t = String(text || '').replace(/\s+/g, ' ').trim()
   if (t.length <= max) return t
   return `${t.slice(0, max)}… (${t.length} chars)`
@@ -1845,7 +1853,8 @@ function writeProposal(eng, text, { replace = false, locked = false } = {}) {
     finally { ownedDebriefLocks.delete(path.join(eng, DEBRIEF_PROPOSE)) }
   }, { soft: true })
   if (!debriefTransactionActive) return withDebriefRecords(eng, () => writeProposal(eng, text, { replace, locked: true }), [DEBRIEF_PROPOSE, DEBRIEF_PRIVATE, DEBRIEF_SEAL])
-  const { clean, blocks } = splitPrivate(text, { sealDangling: true })
+  const { clean: original, blocks } = splitPrivate(text, { sealDangling: true })
+  const clean = masking.mask(original)
   const proposePath = path.join(eng, DEBRIEF_PROPOSE)
   const privatePath = path.join(eng, DEBRIEF_PRIVATE)
   if (fs.existsSync(proposePath) && !replace) {
@@ -1887,6 +1896,7 @@ function stripApprovedStamp(text) {
 // One screen a human can confirm in two minutes. The file-by-file routing
 // still prints after this - agents edit prefixes; people read this.
 function printDebriefReview(text, eng) {
+  text = masking.restore(text)
   const repeats = repeatedDebriefStatements(eng, text)
   if (repeats.length) console.log(`REPLAY WARNING: ${repeats.length} source-backed statement(s) already recorded. Review newer facts and next action; applying again requires --allow-replay.\n`)
   const buckets = { decided: [], asked: [], scope: [], delivery: [], open: [], next: [], signer: [] }
@@ -2091,6 +2101,8 @@ function repeatedDebriefStatements(eng, input) {
 }
 
 function routeDebriefInput(eng, input, { dry, force, sealed = [], allowReplay = false }) {
+  input = masking.restore(input)
+  masking.mask(splitPrivate(input, { sealDangling: true }).clean)
   if (!dry && !debriefTransactionActive) {
     ensureMemoryGit(eng)
     return withDebriefRecords(eng, () => {
@@ -2207,7 +2219,11 @@ function runDebrief(args, eng) {
     const refused = refuseSymlinkWrite(proposal, { soft: true })
     if (refused) throw new Error(refused)
     if (!fs.existsSync(proposal)) throw new Error('nothing to review - run debrief --smart <notes> first')
-    const { clean: input } = splitPrivate(fs.readFileSync(proposal, 'utf8'), { sealDangling: true })
+    const stored = fs.readFileSync(proposal, 'utf8')
+    if (splitPrivate(stored, { sealDangling: true }).blocks.length) throw new Error('pending proposal contains raw private content: do not open it with an agent. Recreate it through debrief --smart from local notes, using --replace-proposal only after confirmation.')
+    const { clean: input } = splitPrivate(masking.restore(stored), { sealDangling: true })
+    const safe = masking.mask(input)
+    if (safe !== stored) atomicWriteFile(proposal, safe, { mode: 0o600, soft: true })
     return boundedDebriefPreview(eng, () => {
       printDebriefReview(input, eng)
       routeDebriefInput(eng, input, { dry: true, force: false })
@@ -2244,6 +2260,7 @@ function runDebrief(args, eng) {
       console.error('nothing to apply - run: fde debrief --smart <notes.md>   then   fde debrief --apply')
       return void (process.exitCode = 1)
     }
+    input = masking.restore(input)
     sealed = readSealedProposal(eng)
     const expected = readSealCount(eng)
     if (expected === null ? (!sealed.length && input.includes(PRIVATE_MARKER)) : sealed.length < expected) {
@@ -2465,7 +2482,7 @@ function cmdIngest(args) {
   const body = [
     '---',
     `source: ${source}`,
-    `title: ${title.replace(/\n/g, ' ').slice(0, 120)}`,
+    `title: ${title.replace(/\n/g, ' ')}`,
     `staged: ${new Date().toISOString()}`,
     `id: ${id}`,
     '---',
@@ -2498,7 +2515,7 @@ function cmdReceipts(args) {
     document.split('\n').forEach((line, i) => {
       if (!line.toLowerCase().includes(term.toLowerCase())) return
       const source = decisionSources.get(i + 1) || sourceReference(line)
-      const hit = `  ${file}:${i + 1}  ${line.trim().slice(0, 160)}${source ? ` [source: ${source.slice(0, 160)}]` : ' [source missing]'}${dirty.has(file) ? '  dirty file - review manual edits' : ''}`
+      const hit = `  ${file}:${i + 1}  ${masking.mask(line.trim()).slice(0, 160)}${source ? ` [source: ${masking.mask(source).slice(0, 160)}]` : ' [source missing]'}${dirty.has(file) ? '  dirty file - review manual edits' : ''}`
       ;(recordFiles.includes(file) && source ? records : claims).push({ file, hit })
     })
   }
@@ -2524,7 +2541,7 @@ function cmdReceipts(args) {
   if (records.length) sections.push('ON RECORD (dated, source-backed):\n' + select(records))
   if (claims.length) sections.push('CLAIMS & working notes (verify source and approval before citing):\n' + select(claims))
   if (!records.length && !claims.length) sections.push(`no record of "${term}" - a gap in the record, not proof of absence`)
-  process.stdout.write(context.boundedSections(sections))
+  process.stdout.write(maskedSections(sections))
 }
 
 // Portable snapshot; stdout is read-only. --out creates a new file and never
@@ -2552,7 +2569,7 @@ function cmdHandoff(args, label = 'Handoff') {
   const decisionText = d => `${d.text} (decisions.md:${d.line}, redacted view)`
   const next = stripTemplateNoise(sectionBody(readClean(eng, 'context.md'), 'Next action', { lastNonEmpty: true }))
   const gaps = collectDoctorIssues(eng, { readiness: true })
-  const report = context.boundedSections([
+  const report = maskedSections([
     `# ${label}: ${engagementSlugFromPath(eng)}\nSnapshot: ${new Date().toISOString()} · memory ${memoryHead(eng) || 'unversioned'}\nRead-only record, not proof of approval. Confirm sources with the named customer before relying on a claim. Private blocks are excluded; review remaining client information before sharing.`,
     `## Constraints - trust-profile.md\n${stripTemplateNoise(readClean(eng, 'trust-profile.md')) || '(missing)'}`,
     `## Signer and success - success.md\nSigner: ${signer || '(missing; do not infer)'}\n${success || '(missing)'}`,
@@ -2585,8 +2602,8 @@ function cmdRecall(args) {
   const eng = resolveEngagement()
   if (!eng) { console.error('no engagement - bind a client before recall'); process.exit(2) }
   const files = ['context.md', 'trust-profile.md', 'success.md', 'decisions.md', 'risks.md', 'delivery.md', 'stakeholders.md', 'brief.md', 'reality.md', 'assumptions.md', 'terrain.md', 'handoff.md']
-  const result = context.recallSections(files.map(file => ({ file, text: readClean(eng, file) })), query)
-  process.stdout.write(context.boundedSections([
+  const result = context.recallSections(files.map(file => ({ file, text: readClean(eng, file) })), query, 12, masking.mask)
+  process.stdout.write(maskedSections([
     `RECALL - ${eng}\n${result.total ? `${result.sections.length} of ${result.total} matching lines; refine the query if evidence is omitted.` : 'No matching record. This is not proof that the event never happened.'}\nSources are local record assertions; verify dates, supersession and approval scope.`,
     ...result.sections,
   ], maxBytes))
@@ -2597,7 +2614,7 @@ function cmdCapture() {
   if (!eng) process.exit(0) // silent: capture must never break a session
   // Workspace git facts (cwd), not the engagement memory repo.
   const branch = sh('git branch --show-current')
-  const lastCommit = sh("git log -1 --format='%h %s'").slice(0, 100)
+  const lastCommit = sh("git log -1 --format='%h %s'")
   // porcelain lines are "XY path" - sh() trims, so parse by first whitespace
   const changed = sh('git status --porcelain').split('\n').filter(Boolean).slice(0, 8)
     .map(l => l.trim().split(/\s+/).slice(1).join(' ')).join(' ')
@@ -2942,7 +2959,7 @@ function collectDoctorIssues(eng, { readiness = false } = {}) {
   }
   const dupes = findDuplicateOpenRisks(eng)
   if (dupes.length) {
-    const sample = (dupes[0][0] || '').replace(/\s+/g, ' ').trim().slice(0, 60)
+    const sample = maskDisplay((dupes[0][0] || '').replace(/\s+/g, ' ').trim()).slice(0, 60)
     issues.push(
       `${dupes.length} duplicate open-risk cluster(s) (e.g. "${sample}${sample.length >= 60 ? '…' : ''}") - consolidate or retire echoes in risks.md`
     )
@@ -3218,7 +3235,7 @@ function hasEvalReceipt(eng) {
 function hygieneTriageLines(eng) {
   const issues = collectDoctorIssues(eng)
   if (!issues.length) return []
-  const top = issues[0].replace(/\s+/g, ' ').trim().slice(0, 72)
+  const top = maskDisplay(issues[0].replace(/\s+/g, ' ').trim()).slice(0, 72)
   return [
     `  hygiene: ${issues.length} issue(s) - ${top}${issues[0].length > 72 ? '…' : ''}`,
     '    → say "@fde clean up the fieldbook" when ready (agent runs fde doctor; nothing auto-rewrites), or: fde doctor',
@@ -3258,14 +3275,14 @@ function recordDigest(eng) {
   const signer = ((success.match(/^\*\*Stakeholder who signs off:\*\*[^\S\n]*(.*)$/m) || [])[1] || '').trim()
   // "(none)" rather than a missing line: on session start, nobody named to sign
   // off is the fact worth seeing, not an absence to scroll past.
-  const lines = [`  signer: ${signer.slice(0, 110) || '(none)'}`]
+  const lines = [`  signer: ${masking.mask(signer).slice(0, 110) || '(none)'}`]
   const { rows } = parseValueLedger(eng)
   const promisedRow = [...rows].reverse().find(r => r.promised)
   if (promisedRow) {
-    lines.push(`  promised: ${formatValueLedgerLine(promisedRow).slice(0, 110)}`)
+    lines.push(`  promised: ${masking.mask(formatValueLedgerLine(promisedRow)).slice(0, 110)}`)
   } else {
     const target = ((success.match(/^\*\*Baseline[^\S\n]*→[^\S\n]*target:\*\*[^\S\n]*(.*)$/m) || [])[1] || '').trim()
-    if (target) lines.push(`  promised: ${target.slice(0, 110)}`)
+    if (target) lines.push(`  promised: ${masking.mask(target).slice(0, 110)}`)
   }
   const decisions = datedDecisions(readClean(eng, 'decisions.md')).slice(-2)
   for (const d of decisions) lines.push(`  decided: ${formatDecisionRecord(d.text)}; source: ${previewLine(sourceReference(d.text) || '(missing)', 100)}`)
@@ -3320,7 +3337,7 @@ function cmdRedact(args) {
   }
   console.log(`REDACT - ${hits.length} matching line(s) for ${JSON.stringify(term)}`)
   hits.slice(0, 20).forEach(h => {
-    const preview = h.line.length > 100 ? h.line.slice(0, 97) + '…' : h.line
+    const preview = h.line.length > 100 ? masking.mask(h.line).slice(0, 97) + '…' : h.line
     console.log(`  ${h.file}:${h.lineNo}  ${preview}`)
   })
   if (hits.length > 20) console.log(`  … +${hits.length - 20} more`)
@@ -3365,12 +3382,12 @@ function cmdPrep(args) {
   const people = extractStakeholders(eng).slice(0, 8)
   console.log('\nStakeholders (table + signal history)')
   if (!people.length) console.log('  (none yet - log contacts with --signal)')
-  else people.forEach(p => console.log(`  [${p.signal}] ${p.name}${p.role ? ` - ${p.role}` : ''}${p.note ? ` · ${p.note.slice(0, 60)}` : ''}`))
+  else people.forEach(p => console.log(`  [${p.signal}] ${p.name}${p.role ? ` - ${p.role}` : ''}${p.note ? ` · ${masking.mask(p.note).slice(0, 60)}` : ''}`))
 
   const risks = extractRisks(eng).slice(0, 5)
   console.log('\nOpen risks (table + dated bullets)')
   if (!risks.length) console.log('  (none logged)')
-  else risks.forEach(r => console.log(`  [${r.severity}] ${r.text.slice(0, 100)}`))
+  else risks.forEach(r => console.log(`  [${r.severity}] ${masking.mask(r.text).slice(0, 100)}`))
 
   const success = firstLine(readClean(eng, 'success.md'), 160)
   console.log('\nSuccess looks like')
@@ -3381,7 +3398,7 @@ function cmdPrep(args) {
     .slice(-5)
   console.log('\nRecent decisions')
   if (!decisions.length) console.log('  (none logged)')
-  else decisions.forEach(l => console.log(`  ${l.trim().slice(0, 120)}`))
+  else decisions.forEach(l => console.log(`  ${masking.mask(l.trim()).slice(0, 120)}`))
 
   const next = nextActionLine(readClean(eng, 'context.md'))
   console.log('\nWalk in with')
@@ -3421,7 +3438,7 @@ function cmdGarden(args) {
   }
   const dupes = findDuplicateOpenRisks(eng)
   if (dupes.length) {
-    const sample = (dupes[0][0] || '').replace(/\s+/g, ' ').trim().slice(0, 50)
+    const sample = maskDisplay((dupes[0][0] || '').replace(/\s+/g, ' ').trim()).slice(0, 50)
     proposals.push({
       id: 'dedupe-risks',
       kind: 'apply',
@@ -3601,7 +3618,7 @@ function cmdStatus(args) {
       const eng = path.join(ENGAGEMENTS_ROOT, d, '.fde')
       if (!fs.existsSync(eng)) continue
       const s = computeSignals(eng)
-      const note = [s.memoryWarn, (s.dirtyFiles && s.dirtyFiles.length) ? `dirty:${s.dirtyFiles.length}` : '', s.reason || s.topRisk].filter(Boolean).join(' · ').slice(0, 70)
+      const note = maskDisplay([s.memoryWarn, (s.dirtyFiles && s.dirtyFiles.length) ? `dirty:${s.dirtyFiles.length}` : '', s.reason || s.topRisk].filter(Boolean).join(' · ')).slice(0, 70)
       rows.push({ name: d, phase: s.phase, trust: s.trust, signalAge: s.signalAge, stale: s.stale, updated: s.updated, reason: note, memoryWarn: s.memoryWarn, dirtyFiles: s.dirtyFiles, valueLines: valueLedgerStatusLines(eng, { compact: true }) })
     }
   } else {
@@ -3611,7 +3628,7 @@ function cmdStatus(args) {
       process.exit(2)
     }
     const s = computeSignals(eng)
-    const note = [s.memoryWarn, (s.dirtyFiles && s.dirtyFiles.length) ? `dirty:${s.dirtyFiles.length}` : '', s.reason || s.topRisk].filter(Boolean).join(' · ').slice(0, 70)
+    const note = maskDisplay([s.memoryWarn, (s.dirtyFiles && s.dirtyFiles.length) ? `dirty:${s.dirtyFiles.length}` : '', s.reason || s.topRisk].filter(Boolean).join(' · ')).slice(0, 70)
     rows.push({ name: engagementSlugFromPath(eng), phase: s.phase, trust: s.trust, signalAge: s.signalAge, stale: s.stale, updated: s.updated, reason: note, memoryWarn: s.memoryWarn, dirtyFiles: s.dirtyFiles, valueLines: valueLedgerStatusLines(eng) })
   }
   if (!rows.length) { console.log('no engagements yet'); return }
@@ -4085,6 +4102,7 @@ ${fs.existsSync(html) ? `\n  Open the fieldbook:  ${html}` : ''}
 function printUsage() {
   console.log(`fde - deterministic core of fdeops
   fde demo                 the whole loop on a fake client (fde demo --clean removes it)
+  fde privacy              show masking capability and its boundaries
   fde scan                 day-1 recon of this repo (facts, no AI)
   fde resume               load this workspace's engagement memory (bounded)
   fde resume --full        load the complete context.md (no bound)
@@ -4123,12 +4141,32 @@ function printUsage() {
   ingest is a sink only - source MCPs (Granola/Gmail/…) are user-configured; never ambient sync`)
 }
 
-const [cmd, ...args] = process.argv.slice(2)
+const [cmd, ...rawArgs] = process.argv.slice(2)
+let outputBudget
+if (['resume', 'recall', 'handoff', 'defend'].includes(cmd) && !rawArgs.some(a => ['--full', '--init', '--bind', '--out'].includes(a))) {
+  try { outputBudget = context.budgetArgs(rawArgs).maxBytes } catch (_) {}
+}
+require('./lib/masking').protectOutput(masking, { maxBytes: outputBudget })
+let args
+try {
+  args = rawArgs.map(arg => masking.restore(arg))
+  for (const key of ['FDEOPS_ENGAGEMENT', 'FDEOS_ENGAGEMENT']) {
+    if (process.env[key]) process.env[key] = masking.restore(process.env[key])
+  }
+  // Resolve privacy-state failures before a user-authorized argument write.
+  args.forEach(arg => masking.mask(arg))
+}
+catch (e) { console.error(e.message); process.exit(1) }
 if (args.includes('--help') || args.includes('-h') || cmd === 'help' || cmd === '--help' || cmd === '-h') {
   printUsage()
   process.exit(0)
 }
+try {
 switch (cmd) {
+  case 'privacy':
+    if (args.length) { console.error('usage: fde privacy'); process.exitCode = 2; break }
+    console.log(`FDEOps ${require('../package.json').version} - identifier masking enabled by default.\nCLI responses, smart proposals, handoff packets and ingest MCP results use local aliases.\nPatterns: common emails, international/US phones, SSN-shaped identifiers and supported credentials.\nNames and arbitrary sensitive prose are not detected; mark them <private>.\nRaw files, pasted chat, upstream MCP content and local dashboard/vault files bypass this protection.`)
+    break
   case 'demo': cmdDemo(args); break
   case 'scan': cmdScan(); break
   case 'resume': cmdResume(args); break
@@ -4162,3 +4200,8 @@ switch (cmd) {
     // Missing or unknown command must fail - exit 0 made typos look like success in scripts/hooks.
     process.exit(1)
 }
+
+} catch (error) {
+  console.error(error && error.message ? error.message : "command failed")
+  process.exitCode = 1
+}

package/bin/lib/context.js

@@ -45,7 +45,7 @@ function boundedSections(sections, maxBytes = DEFAULT_BYTES) {
 
 // Literal, client-scoped lexical retrieval. Retain independently matching
 // records, including conflicting/older ones; recency never means truth.
-function recallSections(documents, query, maxHits = 12) {
+function recallSections(documents, query, maxHits = 12, outputText = text => text) {
   const words = [...new Set(query.toLocaleLowerCase().split(/\s+/).filter(Boolean))].slice(0, 16)
   const hits = []
   for (const { file, text } of documents) {
@@ -57,7 +57,7 @@ function recallSections(documents, query, maxHits = 12) {
       if (!score) continue
       const first = Math.max(0, i - 1)
       const last = Math.min(lines.length, i + 3)
-      const excerpt = lines.slice(first, last).map(l => Buffer.byteLength(l) <= 1024 ? l : clipUtf8(l, 900) + OMITTED).join('\n')
+      const excerpt = lines.slice(first, last).map(outputText).map(l => Buffer.byteLength(l) <= 1024 ? l : clipUtf8(l, 900) + OMITTED).join('\n')
       hits.push({ file, line: first + 1, end: last, score, text: excerpt.trim() })
     }
   }

package/bin/lib/masking.js

@@ -0,0 +1,138 @@
+'use strict'
+
+// Local pseudonyms, not anonymization. Recognized identifiers are replaced
+// in output and proposals, and retained in a private reversible dictionary.
+const fs = require('node:fs')
+const path = require('node:path')
+const crypto = require('node:crypto')
+const { StringDecoder } = require('node:string_decoder')
+const ALIAS = /\[\[(email|phone|identifier|credential):[a-f0-9]{16}\]\]/g
+const PATTERNS = [
+  ['credential', /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?(?:-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|$)/g],
+  ['credential', /\b(?:AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g],
+  ['credential', /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:]+:[^/\s@]+@[^\s<>"']+/gi],
+  ['credential', /\bBearer\s+[A-Za-z0-9._-]{20,}/gi],
+  ['credential', /\b(?:api[_-]?key|secret|password)\s*=\s*[^\s"']{8,}/gi],
+  ['email', /(?<![A-Za-z0-9._%+-])[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?){1,10}/g],
+  ['identifier', /\b\d{3}-\d{2}-\d{4}\b/g],
+  // Deliberately conservative: international + notation or explicit US shape.
+  // Plain integers and dates are not reliably distinguishable from business data.
+  ['phone', /(?<![\w])(?:\+\d{1,3}[ .-]?(?:\(\d{2,4}\)|\d{2,4})(?:[ .-]?\d){6,10}|\(\d{3}\)[ .-]?\d{3}[ .-]\d{4}|\d{3}[ .-]\d{3}[ .-]\d{4})(?!\d)/g],
+]
+const FAIL = 'privacy masking unavailable: check the local .privacy directory; no unmasked output was returned'
+function replacements(text, replace) {
+  let out = String(text)
+  for (const [kind, pattern] of PATTERNS) out = out.replace(pattern, value => replace(kind, value))
+  return out
+}
+function createMasking(root) {
+  const directory = path.join(root, '.privacy'), file = path.join(directory, 'identifiers.json')
+  function directoryReady(create) {
+    if (create) fs.mkdirSync(root, { recursive: true })
+    if (create) { try { fs.mkdirSync(directory, { mode: 0o700 }) } catch (e) { if (e.code !== 'EEXIST') throw e } }
+    const st = fs.lstatSync(directory)
+    if (!st.isDirectory() || st.isSymbolicLink() || (process.platform !== 'win32' && (st.mode & 0o077))) throw new Error(FAIL)
+  }
+  function read(create) {
+    let fd
+    try {
+      fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK)
+      const st = fs.fstatSync(fd)
+      if (!st.isFile() || st.nlink !== 1 || st.size > 8 * 1024 * 1024 || (process.platform !== 'win32' && (st.mode & 0o077))) throw new Error(FAIL)
+      const data = JSON.parse(fs.readFileSync(fd, 'utf8'))
+      if (data.version !== 1 || !Array.isArray(data.entries) || data.entries.length > 50000) throw new Error(FAIL)
+      const seen = new Set()
+      for (const entry of data.entries) {
+        if (!entry || typeof entry.value !== 'string' || !/^\[\[(email|phone|identifier|credential):[a-f0-9]{16}\]\]$/.test(entry.alias) || seen.has(entry.alias)) throw new Error(FAIL)
+        seen.add(entry.alias)
+      }
+      return data
+    } catch (e) { if (e.code === 'ENOENT' && create) return { version: 1, entries: [] }; throw e }
+    finally { if (fd !== undefined) fs.closeSync(fd) }
+  }
+  function transact(create, fn) {
+    let locked = false
+    const lock = path.join(directory, 'lock')
+    try {
+      directoryReady(create)
+      for (let attempt = 0; attempt < 100; attempt++) {
+        try { fs.mkdirSync(lock, { mode: 0o700 }); locked = true; break }
+        catch (e) { if (e.code !== 'EEXIST') throw e; Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10) }
+      }
+      if (!locked) throw new Error(FAIL)
+      const data = read(create), before = data.entries.length, result = fn(data.entries)
+      if (data.entries.length !== before) {
+        if (data.entries.length > 50000) throw new Error(FAIL)
+        const body = JSON.stringify(data)
+        if (Buffer.byteLength(body) > 8 * 1024 * 1024) throw new Error(FAIL)
+        const tmp = path.join(directory, `.write-${crypto.randomBytes(12).toString('hex')}`)
+        try { fs.writeFileSync(tmp, body, { mode: 0o600, flag: 'wx' }); fs.renameSync(tmp, file) }
+        finally { try { fs.unlinkSync(tmp) } catch (_) {} }
+      }
+      return result
+    } catch (_) { throw new Error(FAIL) }
+    finally { if (locked) { try { fs.rmdirSync(lock) } catch (_) {} } }
+  }
+  function mask(text) {
+    text = String(text)
+    let detected = false
+    replacements(text, (_, value) => { detected = true; return value })
+    if (!detected) return text
+    return transact(true, entries => {
+      const values = new Map(entries.map(e => [e.value, e.alias]))
+      return replacements(text, (kind, value) => {
+        if (!values.has(value)) {
+          const alias = `[[${kind}:${crypto.randomBytes(8).toString('hex')}]]`
+          entries.push({ alias, value }); values.set(value, alias)
+        }
+        return values.get(value)
+      })
+    })
+  }
+  function restore(text) {
+    text = String(text)
+    if (/\[\[(email|phone|identifier|credential):/.test(text.replace(ALIAS, ''))) throw new Error(FAIL)
+    if (!text.match(ALIAS)) return text
+    return transact(false, entries => {
+      const aliases = new Map(entries.map(e => [e.alias, e.value]))
+      return text.replace(ALIAS, alias => {
+        if (!aliases.has(alias)) throw new Error(FAIL)
+        return aliases.get(alias)
+      })
+    })
+  }
+  return { mask, restore }
+}
+
+// CLI output is finite, not an interactive stream. Buffer to catch identifiers
+// split across writes, including multiline credentials. Never fall back to raw.
+function protectOutput(masking, { maxBytes } = {}) {
+  const buffers = ['', ''], decoders = [new StringDecoder('utf8'), new StringDecoder('utf8')]
+  let overflow = false
+  for (const [index, stream] of [process.stdout, process.stderr].entries()) {
+    stream.write = (chunk, encoding, callback) => {
+      const text = typeof chunk === 'string' ? chunk : decoders[index].write(chunk)
+      buffers[index] += text
+      if (Buffer.byteLength(buffers[index]) > 16 * 1024 * 1024) { overflow = true; buffers[index] = '' }
+      const cb = typeof encoding === 'function' ? encoding : callback
+      if (cb) cb()
+      return true
+    }
+  }
+  process.once('exit', () => {
+    try {
+      if (overflow) throw new Error(FAIL)
+      // Prepare both before emitting either, so a failure cannot expose raw data.
+      const output = buffers.map((text, i) => masking.mask(text + decoders[i].end()))
+      if (maxBytes && Buffer.byteLength(output[0]) > maxBytes) {
+        const notice = '\n[Masked context truncated; retrieve a narrower topic.]\n'
+        let body = Buffer.from(output[0]).subarray(0, maxBytes - Buffer.byteLength(notice)).toString('utf8').replace(/\uFFFD$/, '')
+        const open = body.lastIndexOf('[[')
+        if (open > body.lastIndexOf(']]')) body = body.slice(0, open)
+        output[0] = body + notice
+      }
+      output.forEach((text, i) => { if (text) fs.writeSync(i + 1, text) })
+    } catch (_) { process.exitCode = 1; fs.writeSync(2, FAIL + '\n') }
+  })
+}
+module.exports = { createMasking, protectOutput }

package/bin/lib/memory.js

@@ -53,7 +53,7 @@ function createMemoryApi(deps) {
           execFileSync('git', ['add', '--', f], { cwd: eng, stdio: 'ignore', timeout: 10000 })
         }
       } else {
-        execFileSync('git', ['add', '-A'], { cwd: eng, stdio: 'ignore', timeout: 10000 })
+        execFileSync('git', ['add', '-A', '--', '.', ':(exclude).privacy'], { cwd: eng, stdio: 'ignore', timeout: 10000 })
       }
       const porcelain = execFileSync('git', ['status', '--porcelain'], {
         cwd: eng, encoding: 'utf8', timeout: 10000, stdio: ['ignore', 'pipe', 'ignore'],
@@ -72,6 +72,9 @@ function createMemoryApi(deps) {
           })
         }
       }
+      // Even a previously staged alias dictionary must never enter a CLI commit.
+      const privateStaged = execFileSync('git', ['diff', '--cached', '--name-only'], { cwd: eng, encoding: 'utf8', timeout: 10000 }).split('\n').some(f => f.split('/').includes('.privacy'))
+      if (privateStaged) throw new Error('private alias state must not be staged in engagement history')
       const still = execFileSync('git', ['diff', '--cached', '--name-only'], {
         cwd: eng, encoding: 'utf8', timeout: 10000, stdio: ['ignore', 'pipe', 'ignore'],
       }).toString().trim()
@@ -131,7 +134,7 @@ function createMemoryApi(deps) {
       execFileSync('git', ['init'], { cwd: eng, stdio: 'ignore', timeout: 10000 })
       atomicWriteFile(
         path.join(eng, '.gitignore'),
-        ['*.lock', '*.tmp', '.last-write', '.debrief-propose', '.debrief-private', '.debrief-seal', ''].join('\n')
+        ['*.lock', '*.tmp', '.last-write', '.debrief-propose', '.debrief-private', '.debrief-seal', '.privacy/', ''].join('\n')
       )
       const owner = writeOwnerIfMissing(eng)
       configureMemoryGitIdentity(eng, owner)

package/mcp/fdeops-ingest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops-ingest-mcp",
-  "version": "3.28.0",
+  "version": "3.29.0",
   "private": true,
   "description": "Thin stdio MCP sink for FDEOps ingest (stage → propose → apply). Zero runtime dependencies.",
   "bin": {

package/mcp/fdeops-ingest/server.js

@@ -10,6 +10,10 @@
 
 const fs = require('fs')
 const path = require('path')
+const os = require('os')
+const masking = require('../../bin/lib/masking').createMasking(
+  (process.env.FDEOPS_ENGAGEMENTS_ROOT || '').trim().replace(/^~/, os.homedir()) || path.join(os.homedir(), 'fde-engagements')
+)
 const { spawnSync } = require('child_process')
 
 const PROTOCOL_VERSION = '2024-11-05'
@@ -171,7 +175,9 @@ function cliPayload(out) {
 }
 
 function toolResult(payload) {
-  const text = typeof payload === 'string' ? payload : JSON.stringify(payload, null, 2)
+  let text
+  try { text = masking.mask(typeof payload === 'string' ? payload : JSON.stringify(payload, null, 2)) }
+  catch (_) { return { isError: true, content: [{ type: 'text', text: 'privacy masking unavailable; no unmasked tool output returned' }] } }
   return { content: [{ type: 'text', text }] }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops",
-  "version": "3.28.0",
+  "version": "3.29.0",
   "description": "Client delivery tools for Forward Deployed Engineers. One @fde skill, local Markdown engagement records, and an offline dashboard for decisions, evidence, approvals, and next actions.",
   "bin": {
     "fdeops": "bin/install.js",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "fdeops",
-  "version": "3.28.0",
+  "version": "3.29.0",
   "description": "Forward deployed engineering skills for AI coding agents. One @fde skill for the client work around the code. You confirm; then it lands in .fde/ on your laptop.",
   "author": {
     "name": "Subash Natarajan",

package/skills/fde/SKILL.md

@@ -28,7 +28,7 @@ A one-line typo or compile error in a file that will not ship. On a bound client
 | **When did we agree?** | Don't argue from memory. Search the record. | `fde receipts <term>` | - |
 | **What's the outcome?** | A number nobody signed is claimed, not delivered. | `fde status` | `references/readout.md` |
 
-After a meeting: `fde debrief --smart` → one REVIEW screen (decisions / asks / scope / delivery gaps / next / signer) → in chat, a four-row card (omit empty; Previously / Not yet agreed) → **Save this update?** (engineer accepted the record, not customer approval of every ask) → `--apply`. Walk-in: `fde prep`. Friday: `fde status`.
+After a meeting: the agent runs `fde debrief --smart`, interprets and reconciles the sanitized proposal, then validates it with `fde debrief --review`. Show the human one concise review of consequential changes and uncertainties → **Save this update?** → `--apply` only after confirmation → verify the saved facts. See `references/debrief.md` for the shared preparation contract. Walk-in: `fde prep`. Friday: `fde status`.
 
 ## Ground loop
 
@@ -69,7 +69,7 @@ Writes need a bind (`FDEOPS_ENGAGEMENT` or registry). Never install fdeops on in
 |----------|---------|
 | where are we | `fde resume` |
 | day-1 look at the repo | `fde scan` |
-| debrief / pasted notes | `fde debrief --smart` → REVIEW → four-row chat card → Save this update? → `--apply`. `--smart` is a gate, not a brain. `references/debrief.md` |
+| debrief / pasted notes | `fde debrief --smart` → agent reconciliation → one plain-English review → Save this update? → `--apply`. `--smart` is a gate, not a brain. `references/debrief.md` |
 | prep me for … | `fde prep "<label>"` |
 | when did we agree | `fde receipts <term>` |
 | sponsor update / defend the number | `fde defend` |
@@ -211,3 +211,7 @@ Ready to build with no `terrain.md` / plan: discover or plan first. Takeover wit
 - Evidence on every claim. The FDE will be challenged on these files.
 - Overlays activate on signal, not on request.
 - Load `.fde/` files on demand, never the whole folder.
+
+## Identifier masking
+
+Before reading engagement content in a session, run `fde privacy` to verify runtime support. If the command is unavailable, stop and update the CLI; a new skill alone does not upgrade an older executable. Use CLI context and previews for model input. They mask common email, phone, SSN-shaped, and credential patterns by default; aliases remain consistent within the local engagements root. Preserve complete alias tokens when drafting updates; the CLI resolves them locally. Never read the private `.privacy/` dictionary, sealed sidecars, raw sensitive notes, or local dashboard/vault files to recover an identity. Names, company names, addresses, and unrecognized formats are not automatically detected: keep sensitive prose in `<private>` blocks. Direct file tools, pasted chat, and upstream source MCPs bypass this boundary.

package/skills/fde/references/debrief.md

@@ -4,7 +4,7 @@
 
 **Large transcripts or emails** sitting in Granola/Gmail/Notion → prefer **`fde ingest stage`** first (via source MCPs the FDE configured), then the same propose → confirm → **`fde ingest apply`** path. See `references/ingest.md`. Pasted short notes stay on this debrief verb.
 
-**Read first:** `context.md`, `stakeholders.md` (signals against what's known).
+**Read first:** the bounded `fde resume` packet for the bound client. Use `fde recall` for the specific prior decision, action, or delivery result needed to reconcile this update. Do not reload the whole engagement.
 
 **Who runs the CLI:** you (the agent). Never tell the FDE to type `fde debrief …`.
 
@@ -13,7 +13,7 @@
 - The `fde` CLI is **local, deterministic, no AI**. `--smart` is a **gate + writer**, not a brain.
 - It keeps lines that already have `decision:` / `risk:` / `delivery:` / `contact:` / `next:` / `signer:` prefixes, plus a thin keyword pass (e.g. "we agreed", person+verb lines, "open question", "X signs off").
 - `signer: Priya` fills **Stakeholder who signs off** in `success.md` and logs Priya as a contact. The CLI proposes it when a sentence says someone signs off / approves / has final say. If the notes name who can say yes and the proposal does not carry a `signer:` line, add one - that is the most expensive sentence in the meeting.
-- Real messy notes without prefixes often route **0 useful lines** - everything else lands as a context dump. That is expected. **You are the router:** rewrite `.debrief-propose` with type prefixes, then `--apply`.
+- Heuristics can miss facts **and mislabel prefixed lines**. You interpret every candidate against the sanitized source, not just unprefixed lines. Split distinct decisions, requests, actions, and results; keep uncertainty. The user reviews meaning, never prefix syntax.
 - `.debrief-propose` is raw lines only (no routing annotations). "Edit if mis-routed" means **rewrite the line with the right prefix**, not leave a comment in the file.
 
 ## Method (you do this work)
@@ -22,25 +22,24 @@
 
 1. Save the FDE's notes to a temp `.md` file in the workspace (or pipe stdin).
 2. Run `fde debrief --smart <notes.md>` (or `npx fdeops debrief --smart …`).
-3. Open `.debrief-propose`. If lines lack type prefixes, **rewrite them** before showing the FDE, e.g.:
-   - `decision: agreed chargebacks stay phase 2 - Priya`
-   - `decision: freeze the API [approved: Priya 2026-09-08]` (optional; missing means unconfirmed)
-   - `risk: legal may reopen scope if we slip the SOW date`
-   - `contact: Priya pushed hard on Friday deck [signal:amber]`
-   - `signer: Priya` (she can say yes; lands in `success.md`)
-   - `next: send one-pager before Thursday 9am`
-   - unprefixed lines stay context color only
-4. After editing, run `fde debrief --review` to show the pending proposal without replacing it. Show the **REVIEW** block first (decided / asked / open / next / signer). That is the one screen to confirm. File routing stays underneath.
-5. In **chat**, after that REVIEW, present a four-row card and omit empty rows:
-   - Decided
-   - Asked / open
-   - Next
-   - Signer
-   Then a **Previously:** line from the record, and **Not yet agreed** for anything still proposed. Ask **Save this update?** Saving means the engineer accepted this as the engagement record, not that the customer approved every ask. Uncertainty stays visible.
-6. On FDE confirm → run `fde debrief --apply`.
-7. On reject → stop; ask what to change; do not apply. Do not rebuild or replace the CLI REVIEW engine.
-
-No invented names or quotes. If the propose looks wrong, fix prefixes with judgment then re-apply or use the fallback path.
+3. Run `fde debrief --review` before opening an existing proposal so legacy identifiers are masked. Open the proposal only after review succeeds. Never open a proposal containing manually inserted raw private blocks. Prepare the pending proposal using **Prepare one update** below. Read only the sanitized `.debrief-propose`, never the sealed private sidecars or raw private source. Preserve privacy markers, source metadata, and complete identifier aliases such as `[[email:...]]`. The CLI restores known aliases locally on apply. Never read `.privacy/` or try to recover an identity with file tools. If an alias is truncated, retrieve a narrower excerpt; never guess or edit the token.
+4. Run `fde debrief --review` after editing. Treat the CLI REVIEW and routing output as your validation, not a second presentation to the user. Resolve errors and replay warnings before asking for confirmation.
+5. Show **one** concise review in chat: name the client, then the consequential changes in plain English. Include decisions, requests still unagreed, actions, reported delivery, signer or contact changes, and unresolved conflicts when present. Show the previous value only where it changes the meaning. Omit empty categories and CLI routing details; do not impose a fixed four-row card that hides other changes. If the proposal is too large to show faithfully, split the review into explicit batches; never approve hidden changes.
+6. Ask **Save this update?** This confirms the engineer's record, not customer acceptance. On confirmation, apply precisely that proposal with `fde debrief --apply`. A material correction requires a revised review and renewed confirmation. On rejection, leave the proposal pending and do not apply.
+7. Verify the changed facts through bounded `fde resume` / targeted `fde recall`. If a fieldbook is part of the current task, regenerate it using the existing command and destination after the confirmed save; do not make the user run it. End with a brief saved/not-saved result and the next action, not another full summary.
+
+### Prepare one update (shared with ingest)
+
+Do this work yourself before the human review:
+
+- **Check meaning, not keywords.** “We settled on delaying the rewrite” is a decision; “Mara will request access” is an action, even if the heuristic calls it a contact. A wish or suggestion remains a request, not agreement. Do not infer authority, approval, a calendar date from an unanchored relative date, or production value from staging.
+- **Keep facts traceable.** Preserve supplied source locators on each consequential fact, using `[source: ...]`. If only a local file or staged item exists, cite that actual locator as a note source, not a customer receipt. Do not invent a meeting date or speaker. A source label is not authenticated approval.
+- **Reconcile only what changed.** Compare affected facts with the current record using targeted retrieval. Leave unchanged sourced statements out of an accidental re-import. Preserve earlier history; record changed or conflicting claims explicitly. If everything is already recorded, say so and leave the pending proposal unapplied. If it blocks a later capture, explain that no new facts were saved and ask permission to replace that pending review; use `--replace-proposal` with the new notes only after that authorization. Do not delete proposal files or private sidecars manually. Do not use `--allow-replay` without explicit approval of an intentional repeat.
+- **Protect the current next action.** A late meeting note does not automatically supersede a newer action. Keep older actions as dated context unless their current priority is established; show a conflict when it needs a decision. Use exactly one physical `next:` line for the current action. If multiple current actions are explicitly agreed, include them on that same line separated by semicolons; the CLI retains only the last `next:` line. Keep other dated commitments in context. Do not silently discard other commitments.
+- **Keep memory useful.** Retain consequential facts and indispensable context; remove chatter and repetition from the proposal, not from the source. Preserve the raw input outside `.fde/` (staged material stays in `.inbox/`). Never remove privacy placeholders or modify sealed sidecars. Ask only about a consequential ambiguity that cannot remain explicitly unknown.
+- **Structure the result.** Use `decision:` / `risk:` / `delivery:` / `contact:` / `next:` / `signer:`. Preserve `ask:` / `scope:` as explicitly proposed context when appropriate. Prepare the seven-field delivery row yourself for a reported result (see below); unknown fields stay `pending`. The human should not have to fill out a ledger to capture a meeting.
+
+Before showing the review, check that every consequential fact in the sanitized source is represented, already recorded, or explicitly unresolved. Check classified lines as carefully as unclassified ones. Nothing is saved simply because this preparation is complete.
 
 ### Fallback - you structure, then route
 
@@ -53,10 +52,10 @@ If `--smart` is unavailable or you already have clean prefixes:
    - **Risks** - new / confirmed / retired
    - **Open questions** - what to chase next
 2. Format lines as `decision:` / `risk:` / `delivery:` / `contact:` / `next:` / `signer:` (contacts may end with `[signal:green|amber|red]`).
-3. Show the same **chat card** as the smart path (omit empty rows; Previously; Not yet agreed; **Save this update?**). Do not invent a second confirm surface.
+3. Follow **Prepare one update** and show the same single plain-English review as the preferred path. Include every consequential change and ask **Save this update?**.
 4. On confirm, pipe to `fde debrief` (or write a file and run it).
 
-One clarifying question max if the dump is ambiguous - then write. Never stall capture on completeness.
+Ask at most one focused question at a time when ambiguity would change the record. Otherwise preserve the unknown and include it in the review. Never treat silence as confirmation.
 
 ## Artifact
 
@@ -66,7 +65,7 @@ One clarifying question max if the dump is ambiguous - then write. Never stall c
 
 ## Checkpoint
 
-Read back the 2-3 most consequential captures in one breath - so the FDE can correct on the spot. Then stop. No summary theatre.
+Use the single pre-save review above. After saving, report verification and the next action briefly; do not ask for a second approval or repeat the review.
 
 ## Principles
 

package/skills/fde/references/discover.md

@@ -108,7 +108,7 @@ Flag every one. AI components don't fail like regular code - they degrade as the
 
 **6. Data flow.** Where data enters, how it moves, where it stops. Entry points first: routes, queues, cron, file drops.
 
-**7. Existing capability.** Trace the requested user action through existing code, configuration, tests, and operating workarounds. In `terrain.md`, record what can already be reused and the evidence that it works or fails. Check whether a configuration, ownership, or process change could resolve the observed break. A disabled feature is a lead, not a proven root cause. Keep observations and hypotheses distinct; option selection still belongs to plan / three-options.
+**7. Existing capability.** Trace the requested user action through existing code, configuration, tests, and operating workarounds. In `terrain.md`, record what can already be reused and the evidence that it works or fails. Check whether a configuration, ownership, or process change could resolve the observed break. A disabled feature is a lead, not a proven root cause. Keep observations and hypotheses distinct; option selection still belongs to plan / three-options. Summarize the remaining gap in `reality.md`: what works today → what the customer needs → what is still missing, with sources. If existing capability meets the need, say so; do not manufacture a build requirement.
 
 ## Method - part 2: the humans (you coach, the FDE asks)
 
@@ -150,7 +150,7 @@ Always map the estate before you score a use case - not only when someone said "
 **The 5 questions (ask the data owner, not the sponsor):**
 1. **Where does data live?** - List every source: databases, warehouses, SaaS exports, spreadsheets, S3 buckets, vendor APIs. Map it.
 2. **How fresh is it?** - Real-time, daily batch, "someone uploads a CSV on Mondays"? Freshness determines what's buildable.
-3. **Who owns it?** - Not "IT" - the named person who can grant access and explain the schema. No name = no access in practice.
+3. **Who owns it?** - Not "IT" - the named person who can grant access and explain the schema. No named owner: access responsibility remains unverified.
 4. **What's the quality?** - Sample 100 rows from each critical source. Check: nulls, duplicates, format consistency, semantic correctness. A 60% null rate in a key field = that source is fiction.
 5. **What are the governance constraints?** - PII classification, retention policies, cross-border rules, consent basis. One missed constraint = a compliance stop later.
 
@@ -164,6 +164,10 @@ Always map the estate before you score a use case - not only when someone said "
 
 A use case that depends on a "Blocker" source **or a Blocker pipe** doesn't get scored - it gets a remediation conversation first. `what-breaks` finding an invisible integration at ship is already too late. Write this to `terrain.md` under a `## Data estate` section.
 
+**Promised dependencies are not ready dependencies.** For consequential promises such as "data in two weeks," record or update one dependency entry in `assumptions.md` with the responsible owner, dated verification checkpoint, and evidence needed. Unknown owners or dates stay unknown; propose a checkpoint for confirmation. Link the affected work; if the checkpoint slips, identify what can proceed and what needs replanning. Missing ownership is an unresolved dependency, not proof that the project will fail. On-prem or restricted access is a constraint to investigate, not a red flag by itself.
+
+**Verify the future operator now.** Check the proposed owner in `success.md` against who will actually monitor, recover, and support the result. Record whether they have agreed, access or training gaps, and a practical handoff check there; carry these into `handoff.md` at close. Keep unconfirmed ownership explicit. Reuse supplied evidence and ask only what changes the plan.
+
 ## When scope is a transformation, not a single problem
 
 Score every candidate use case before anything gets prototyped:

package/skills/fde/references/ingest.md

@@ -4,7 +4,7 @@
 
 **Connect / capability (different entry):** "connect a new MCP", "connect Granola/Slack/Notion", "what can you pull?" → `references/connect.md` first. Recipes: `mcp/recipes/` (file, granola, slack, notion).
 
-**Read first:** `context.md` (what's already logged, what's stale). Bind the engagement before staging anything.
+**Read first:** the bounded `fde resume` packet and targeted recall for affected prior facts. Bind the engagement before staging anything.
 
 **Who runs the CLI:** you (the agent). Never tell the FDE to type `fde ingest …`. Never auto-apply. Never background-sync or poll sources on your own.
 
@@ -31,9 +31,9 @@ List what you can actually call **this session**:
 3. **Stage** - `fde ingest stage [--source NAME] [--title TEXT] [file|-]` writes raw text into `<engagement>/.inbox/` (outside the memory git ledger).
 4. **List** (optional) - `fde ingest list` shows staged items when you need an id or filename.
 5. **Propose** - `fde ingest propose <id-or-filename>` runs the debrief `--smart` path on the staged body (+ provenance line). Opens `.debrief-propose`.
-6. **Rewrite prefixes** - same as debrief: lines without `decision:` / `risk:` / `delivery:` / `contact:` / `next:` / `signer:` need **you** to rewrite before showing the FDE. `--smart` is a gate, not a brain.
-7. **Show** the same chat card as debrief (decided / asked / open / next / signer; omit empty; Previously; Not yet agreed; **Save this update?**). Wait for confirm. The CLI REVIEW printout is unchanged.
-8. **Apply** - on FDE confirm only → `fde ingest apply` (= `fde debrief --apply`). On reject → stop; ask what to change.
+6. **Prepare** - follow **Prepare one update** in `references/debrief.md`. Interpret every sanitized candidate, including already-prefixed lines; reconcile changed facts, preserve source locators, and keep raw chatter out of memory. Preserve privacy placeholders and sealed sidecars.
+7. **Validate and show** - run `fde debrief --review` after editing, then show the same single plain-English review as debrief, including delivery changes and conflicts. Ask **Save this update?** and wait for confirmation. CLI output is agent validation, not a second user review.
+8. **Apply and verify** - on FDE confirm only → `fde ingest apply` (= `fde debrief --apply`), then verify affected facts through bounded resume/recall. Refresh the current fieldbook if it is part of this task. On reject, leave the proposal pending; material edits require a revised review.
 
 No invented names, meetings, or quotes. If the propose looks wrong, fix prefixes with judgment, then re-show before apply.
 
@@ -56,7 +56,7 @@ fde ingest apply
 
 ## Provenance
 
-When a staged fact came from a named source, carry `via:<source>` on the applied line where useful (e.g. `via:granola`, `via:gmail`). Helps receipts and sponsor disputes later - not mandatory on every context line.
+Carry an actual `[source: ...]` locator on each consequential fact. Preserve upstream IDs or links when supplied; otherwise cite the staged item path as a note source. Retain its `via:` metadata, but do not treat a standalone `via:` line as a source marker for every fact or as proof of approval. Re-imports still require semantic comparison; exact replay protection is not semantic deduplication.
 
 ## MCP sink + recipes
 
@@ -64,7 +64,7 @@ Optional `mcp/fdeops-ingest` wraps the same verbs over stdio. Source MCPs remain
 
 ## Checkpoint
 
-Before apply, read back the 2-3 most consequential captures in one breath - same as debrief. Confirm which sources you staged and what would land in the record. Then stop.
+Use the single review from debrief: identify the client and sources, show consequential changes, then wait. Do not add another summary or approval step.
 
 ## Principles
 

package/skills/fde/references/land.md

@@ -57,6 +57,7 @@ Intent: coach the FDE's first *customer* conversation - what keeps the sponsor u
 - "Before you open the laptop - what would make this a bad engagement for *them*, not just a delayed project?"
 - "What are they afraid you'll miss?"
 - "Who loses credibility if this goes wrong?"
+- "If nothing changes over the agreed timeframe, what happens, and who bears it?" Record the consequence and its source in `brief.md`; distinguish reported impact from measured cost. Unknown cost stays unknown, not an invented ROI.
 
 Let silence sit. If their fear doesn't match the written brief, the brief is wrong - say so plainly, log it.
 
@@ -67,6 +68,7 @@ Let silence sit. If their fear doesn't match the written brief, the brief is wro
 - **The sacred thing** - "Is there anything in this environment I should treat as untouchable?" The hesitation before the answer is the answer.
 - **Exception path (operating map seed)** - "When the happy path breaks this week, what do people actually do - who do they call, what spreadsheet opens, what do they skip?" Capture the break → workaround → who owns it. Do not build a full map on day 1; seed rows later in `terrain.md` → `## Operating map (exception-led)` during discover. Unknowns stay `unknown - ask:`.
 - **AI posture and policy** - tools already in use (sanctioned or shadow), and: "Does your organisation have a policy on AI-generated code? Are there decisions where you would not be comfortable with AI involvement?"
+- **Future operator** - "Who will run this after we leave, and have they agreed?" Record the proposed operator and unresolved ownership in `success.md`, separately from the signer. A sponsor naming a team is not that team accepting responsibility; verify with the operator during discover.
 - **Boundaries in multi-vendor rooms** - who owns what surface, who signs off before a change crosses it.
 
 ## The day 1 deliverable