memgineering 0.11.1 → 0.12.0

package/CHANGELOG.md

@@ -11,6 +11,69 @@ language the reader wants. The bilingual rule the monorepo applies to
 
 ## [Unreleased]
 
+## [0.12.0] — 2026-08-28
+
+### Added
+
+- **A declared storage boundary now refuses the write that breaks it.**
+  `remember --never-store "health, hospital, …"` records the user's own
+  sentence plus the word list that enforces it (`--never-store` implies
+  `--rule`, so the declaration shows up in `memgineering rules` and the
+  before-edit hook). From then on, a write carrying a declared word is
+  refused with the matched word and the declaration quoted back — on a
+  hosted brain and on a folder alike, whether or not the agent read
+  anything first. Every door is screened: `remember`, `revise`'s claim /
+  summary / title, curation's free-text fields, a proposal's added lines,
+  and each note of a bulk `push` (one refusal no longer stops the batch;
+  the rest upload and the summary names what was refused). The failure
+  this closes was measured: a fast-tier agent wrote two health facts on
+  its first turn having opened nothing; in the round-12 rerun the same
+  agent was refused and the facts stayed out.
+- **Refusal is lexical by measurement, not by preference.** Against the
+  production embedding profile, semantic similarity cannot separate what
+  must be refused from what must be allowed at any threshold
+  (`docs/research/boundary-matching-2026-08.md`) — so the words the user
+  chose are the entire law: deterministic, explainable, zero-latency,
+  identical hosted and local. The matcher sees words as written — no
+  stemmer, so declare nouns; one-character terms are refused at
+  declaration time because they match half the dictionary; CJK terms
+  match inside words (that is what makes particles work), Latin terms on
+  word boundaries.
+- **What the words miss, a suggestion surfaces — and it never refuses.**
+  On a hosted brain with embeddings, a stored note that reads close to a
+  declared boundary while containing none of its words comes back with
+  one line naming the declaration and both actions: `undo`, or widen the
+  list. The catch rate on paraphrases is partial by measurement (a
+  25–50% band on hand-built sets) and it interrupts rarely (4% of benign
+  writes measured) — it exists so the user learns their word list has a
+  hole, not to detect paraphrase. Any embedding failure drops the
+  suggestion silently, never the write. A brain with no declarations
+  pays one SQL lookup and nothing else — no matching, no extra
+  embedding call.
+- **Curating a boundary.** `revise <ref> --never-store "<words>"`
+  REPLACES the word list (`--claim` required — the restated boundary is
+  part of the edit), `--no-never-store` lifts the list while keeping the
+  note, and retiring the declaration lifts the boundary entirely: a
+  retired or excluded declaration stops refusing.
+- **Crossing a boundary on purpose leaves a mark.**
+  `remember --override-boundary <declaration-path> --reason "<why>"`
+  stores the write anyway. The path is only learnable from the refusal
+  itself, the reason is enforced server-side, and the ledger records the
+  crossing — visible in `memgineering log`, counted by `evidence`.
+  Declaring a boundary is itself marked in the ledger, so the audit
+  trail starts at the declaration. Honest limit: the override's
+  `--reason` is free text and unscreened; guidance forbids restating
+  blocked content there, but nothing enforces it.
+
+### Agent guidance
+
+- The hub and the `memgineering-writing` skill changed substantially:
+  how to record a declaration (nouns, generous list, nothing
+  one-character), what to do when refused (the override is the user's
+  call, never a retry reflex), and why `--never-store` REPLACES rather
+  than adds. Restart your agent session after upgrading so the new
+  guidance is what gets injected.
+
 ## [0.11.1] — 2026-08-27
 
 ### Added
@@ -22,8 +85,9 @@ language the reader wants. The bilingual rule the monorepo applies to
   guidance tells an agent to check the file before recording anything in a
   commonly guarded domain. Honest limit, measured in fresh-session rounds: the
   check holds for agents that read before writing; a fast-tier agent that fires
-  `remember` reflexively can still miss it — a server-side advisory at write
-  time is the planned follow-up.
+  `remember` reflexively can still miss it — closed in 0.12.0, where a declared
+  boundary refuses the write itself (this entry originally promised an
+  "advisory"; what shipped is a refusal).
 - **A fact carried in from another store names its source.** New guidance
   section: when memories are migrated from another tool's files or a pasted
   document, the `--reason` names the source file — never a confirmation that

package/assets/MEMGINEERING.md

@@ -2,7 +2,7 @@
 name: memgineering
 description: Use whenever the user refers to something they told you before, asks what was decided, tells you something worth keeping, or settles something that should hold next time. The memory lives in their own folder and outlives this session; check it before answering from guesswork, and write to it when you learn something durable.
 type: skill
-version: 0.11.1
+version: 0.12.0
 ---
 
 # memgineering

package/assets/memgineering-writing/SKILL.md

@@ -322,20 +322,99 @@ what must never be WRITTEN into this brain at all. "Do not keep anything about
 my health here" is the second kind — the user's own sensitive-topics control,
 except they name the topics.
 
-**Check before you record, not after.** Before writing something in a domain
-people commonly guard — health, beliefs, relationships, politics, sexuality,
-money trouble — run `memgineering open boundaries` first, unless this session
-has already read that file. The card shows a base file's whole body, and the
-boundaries live in the body — a recall card or a resurface line may name the
-file without quoting them, and an empty-looking card is not permission. A declared storage boundary beats every
-"write it down" trigger in this skill: skip the write and say in one sentence
-why. If nothing is declared and the remark still feels sensitive, the section
-below applies — record, but say so once, plainly.
-
-When the user declares one ("never write anything about my family"), it is
-worth two writes: the line itself into `BOUNDARIES.md` — their file, their
-words — and, since it should hold next time, a `--rule`; see
-`memgineering-rules`.
+**The second kind is enforced, not advised.** A write carrying a declared word
+is refused by the product — at every door, on a hosted brain and on a folder,
+whether or not you read anything first. That is deliberate: guidance only
+reaches the agent that reads, and the failure this answers was a session that
+wrote two health facts on its first turn having opened nothing.
+
+### Recording one
+
+When the user says "never write anything about my health here", it takes one
+write and a word list:
+
+```bash
+memgineering remember "Nothing about my health gets written into this brain" \
+  --never-store "health, hospital, clinic, diagnosis, symptom, medication" \
+  --reason "they said it twice and it keeps getting missed"
+```
+
+The sentence is theirs and stays their words. The LIST is what refuses, so:
+
+- **Nouns, not verbs.** There is no stemmer: a verb will not be caught in
+  another tense, in any language.
+- **Nothing one character long** — refused at the door. A single Korean
+  syllable, or an English letter, matches half the dictionary.
+- **Be generous.** A word costs nothing until it matches, and a topic the list
+  misses is a fact that lands silently.
+- A term in a language written without spaces between words matches INSIDE a
+  word — which is what makes it work at all where particles attach to nouns,
+  and also means it catches compounds the user may not have pictured. Latin
+  terms match on word boundaries instead: "med" will not catch "media".
+
+`--never-store` implies `--rule`, so the declaration appears in
+`memgineering rules` and in the before-edit hook — which is where the user sees
+what they have declared.
+
+### Widening, narrowing, lifting
+
+`--never-store` **REPLACES** the list; it does not add to it. So to add a word,
+read the declaration first and name every word it should still hold:
+
+```bash
+memgineering revise <ref> \
+  --claim "<the boundary, restated to cover the new word>" \
+  --never-store "health, hospital, clinic, diagnosis, symptom, medication, therapy"
+```
+
+`--claim` is required, and an unchanged claim is refused — restate the boundary
+rather than copying the line already there. **Naming only the new word deletes
+the words already declared**, which is the opposite of what anybody asking for
+this wants.
+
+To lift a boundary entirely: `memgineering retire <the declaration>`. That is
+the un-declare path, and it is the user's decision, never yours.
+
+On a hosted brain the declaration NOTE is the record — there is no route that
+edits a base file's body, so mirroring the sentence into `BOUNDARIES.md` is a
+folder-brain and onboarding-time thing.
+
+### When a write is refused
+
+The refusal names the word and quotes the declaration. What it means is that
+the person whose brain this is already decided, so:
+
+- **Record everything else** you learned, leaving that fact out, and carry on.
+  A refusal is not a failed task.
+- **Do not send it again with the word taken out.** The boundary is about the
+  fact, not the spelling.
+- **Do not put what was blocked into `reason`, a title, a scope, or any other
+  field.** The ledger is stored too; moving it is storing it.
+- **Do not attach `--never-store` to get past the screen.** A write that
+  declares a boundary is exempt from screening, which makes that a bypass — and
+  it is recorded in the ledger as one, at every door.
+- There IS an exception flag, and it is not yours to reach for. It exists for
+  the user saying "no, keep this one". If they did not say that in this
+  conversation, the answer is to leave the fact out.
+
+### The suggestion, and what silence from it is worth
+
+A write can be plainly on a declared topic while carrying none of the declared
+words, and words cannot see that. When the server notices one it says so after
+storing it — it never refuses — and offers the two things worth doing: take the
+note back with `undo`, or widen the list so next time it is refused properly.
+
+Measured, it notices roughly a third to a half of them, and it is skewed: a
+topic with broad vocabulary is caught more often than a narrow one. **So
+silence from it is not permission.** It is a prompt to widen a list, not a
+clean bill of health, and telling the user what it said is usually the right
+move — the decision is theirs.
+
+### What the enforcement does not cover
+
+The word list is checked on every write that carries user prose. It is NOT
+checked on `reason` — say so plainly if that matters to them — and a brain in a
+folder can always be edited outside this tool, which no CLI can prevent.
 
 ## What to raise with the user