musememory 3.0.1 → 3.2.0

package/.agents/context/ticket-plan.md

@@ -251,8 +251,14 @@ Source: read-only gap audit cross-checking the 168 tickets against the four rese
 
 ## Wave I — GOVERNANCE & SCALE
 
-- [ ] T-320 · HIGH (B10) · contradiction engine calibration: 7 regexes flip BOTH sides to `conflicted` at 0.85 on any 0.4-Jaccard pair (quality/contradiction.ts:15-23,85-114) → −0.8 rank, sync removal, −25 health each = 4 false positives = FAIL. Dry-run mode, negation-pair scoping, calibration fixtures · U
-- [ ] T-321 · HIGH (B12) · per-project health gate: gate/clustering/tech-debt call `list(store)` unfiltered and label by `entries[0].project` (health/gate.ts:31,220; cognition/clustering.ts:62; tech-debt.ts:102) — one number attributed to whichever memory sorts first · dep: T-153 · U
+- [x] T-320 · landed Wave 23 — HIGH (B10) · contradiction engine calibration: 7 regexes flip BOTH sides to `conflicted` at 0.85 on any 0.4-Jaccard pair (quality/contradiction.ts:15-23,85-114) → −0.8 rank, sync removal, −25 health each = 4 false positives = FAIL. Dry-run mode, negation-pair scoping, calibration fixtures · U
+  - Landed: claim-based detection (`src/quality/polarity.ts`, `src/quality/scope.ts`); subject + scope must agree before two claims oppose. Measured 8/10 non-contradictory pairs flagged before, 0/10 after. Dry-run surfaces: `memory conflicts [--dry-run]`, `propose({conflictDryRun})`, `detectConflict(…, {dryRun})`. Calibration fixture `test/calibration/contradiction_calibration.json` gated at precision/recall ≥ 0.9. Commits `18bf4f9`, `dc90539`.
+  - Correction to the original ticket text (**superseded 2026-10-22 — the earlier version of this note was wrong**): an earlier revision of this note claimed the "−0.8 rank" penalty does not exist in the ranking engine. **It does exist.** `STATUS_PENALTY` maps `conflicted: -0.8` (`src/types.ts:342`), `src/retrieval.ts:956` reads it into `statusPenalty` and `:1072` adds it to `totalScore`, and `src/retrieval/ranking.ts:6` imports `computeFactors` from `../retrieval.ts` and uses it at `:140` — so **both** retrieval paths penalise conflicted entries by −0.8. What is true is that the penalty is a *soft* rank discount, not a filter: `conflicted` entries are excluded from the status filters in `src/retrieval.ts:1686-1701`, `src/retrieval/ranking.ts:272-273` and `src/orchestrator/context.ts:144-147`, so a genuinely contradicted memory is still injected into agent prompts with no badge. That gap is tracked as **T-405**.
+- [x] T-321 · landed Wave 24 — HIGH (B12) · per-project health gate: gate/clustering/tech-debt call `list(store)` unfiltered and label by `entries[0].project` (health/gate.ts:31,220; cognition/clustering.ts:62; tech-debt.ts:102) — one number attributed to whichever memory sorts first · dep: T-153 · U
+  - Landed: `listForProject()` in `src/store.ts` is the single owner of the filter decision; the gate, the anchor audit, the drift audit, bug clustering and technical debt all take the same `project` option. The report now carries `scope` (`filter`, `projects`, `entry_count`, `code_scope`) and its `project` label is the requested filter, the sole project present, or `all` — never a guess. Surfaces: `memory health --project P`, `project` on `muse_health`/`muse_tech_debt`/`muse_bug_clusters`, `?project=` on `/api/health`. Commit `60b1aa2`, docs `27bdc81`.
+  - **Wave 25 completion (T-321 follow-up)**: a verification audit found the *functions* took `options.project` but five *surfaces* never plumbed it — `memory_anchor_audit` and `memory_drift_audit` (MCP), and `/api/drift`, `/api/cognition/clusters`, `/api/cognition/debt` (studio). A user could scope the health gate but not an anchor or drift audit. All five now take the filter, and the studio gained a labelled **Project Scope** control in the header that drives `/api/health`, `/api/drift`, `/api/cognition/clusters` and `/api/cognition/debt`, seeds from the URL query string (so a scoped link is shareable and reloadable), and renders the report's `scope` back to the user in the CLI's own wording. Cover: `test/health_project_scope_surfaces.test.ts` (7 cases) plus the original `test/health_project_scope.test.ts` (9 cases).
+  - Design note: code-side metrics (the technical-debt scan, the doc/code drift audit) stay **workspace-wide** by design — source code is shared between projects and cannot be attributed to one. `scope.code_scope` records this so the number is never misread.
+  - Note: the scope field is named `entry_count`, not `memory_count` — the published-claim gate treats any backticked `memory_*` identifier in an agent-facing document as an MCP tool name.
 - [ ] T-322 · MEDIUM (B13) · per-file read cache: anchor audit reads every source file 3× per health check (health/gate.ts:82,111,176 → anchors/resolver.ts:121) · U
 - [ ] T-323 · MEDIUM (B14) · anchored memories force-injected to front regardless of `anchor.status` + budget ordering (orchestrator/context.ts:104-147) — anchor to a deleted file wins the slot forever · dep: T-134 · U
 - [x] T-324 · landed Wave 21 · HIGH (B18) · checkpoint merge semantics: parseCurrentConstraints & mergeCurrentConstraints in compaction handoff; diff-preserving update preserves hand-added constraints · compaction · test/current_compaction_guard.test.ts · F
@@ -518,6 +524,8 @@ Canonical detailed artifact: `.agents/artifacts/audit-and-realigned-roadmap-2026
 - [x] T-403 · HIGH · Stored-command doctor sweep: sanitize/migrate legacy non-template `test_command`s across `.memory/memories/*.yaml` to restore 100% clean validation · src/doctor.ts, .memory/ · F
 - [x] T-404 · HIGH · Stdin TTY decoupling: add `process.stdin.isTTY` check in `src/hooks/pack.ts:readStdinJson()` to prevent test runner hanging in interactive terminals · src/hooks/pack.ts · F
 - [x] T-401 · MEDIUM · Bunfig surface hardening: configure explicit test runner timeout and isolation defaults · bunfig.toml · N
+- [x] T-405 · HIGH · [#313](https://github.com/harshsinghmp/musememory/issues/313) · Conflicted memories are still injected into agent prompts with no badge: the status filters in `src/retrieval.ts:1686-1701`, `src/retrieval/ranking.ts:272-273` and `src/orchestrator/context.ts:144-147` exclude `superseded`/`rejected`/`archived`/`expired` but not `conflicted`. A contradicted memory is −0.8 rank-penalised (`STATUS_PENALTY`, `src/types.ts:342`) and removed from sync broadcasts, yet it is still served. Note: the gap is **wider** than the original note — three retrieval paths are affected, not one. Needs its own ticket and test pass because it changes retrieval output and therefore the golden recall fixtures · retrieval, orchestrator · U — **LANDED 2026-10-24**: PR #321 (`fix/T-405-conflicted-injection`) merged into `dev` at `e30a1b7`; a single shared `includeConflicted` opt-in now gates every prompt-serving read path (shown wider still by the build-out: tiered context, FTS/gate, vector, engine passthrough, muse pool/lenses all inherit or take the flag); the golden recall fixture was deliberately untouched — the frozen corpus carries zero conflicted entries, verified, so no regen was required; cryptic-suite delta +7 tests (1408/0); Fresh Critic 9.5/10 with a mutation-verified overfetch test.
+- [x] T-406 · LOW · [#314](https://github.com/harshsinghmp/musememory/issues/314) · `memory health --project P` matches the project name case-sensitively, so `--project ALPHA` against a store holding `alpha` returns an empty report whose label still reads `ALPHA`. Exact-match is honest but silent. Needs either a case-insensitive match or an explicit "no memories for project X" line · cli/health · U — **LANDED 2026-10-24**: PR #322 (`fix/T-406-case-sensitive-project`) merged into `dev` at `d3a8f6b`; new `src/health/resolve.ts` owns the resolution (`resolveProjectName`: exact wins → unique case-insensitive → loud unresolved), wired on CLI (exit 1 + available list, `--json` stdout kept pure), MCP `muse_health` (isError) and Studio `/api/health` (404 + JSON); the gate stays a pure exact-canonical reporter (scope-case tests untouched); +8 tests (1408/0); Fresh Critic 9/10.
 - [x] T-105b · landed Wave 2 — Syntax-only promotion rule: enforce AST/schema verification before candidate confirmation · promotion · branch: feat/wave-2-trust-gates · F
 
 ## Realigned In-Line Execution Sequence
@@ -542,12 +550,97 @@ Canonical detailed artifact: `.agents/artifacts/audit-and-realigned-roadmap-2026
 19. **Wave 18: Ingestion, Suppression & Curation Gates** (`T-106`–`T-113`) — [x] Landed on dev
 20. **Wave 19: Scoring Refinements & Abstract Sidecars** (`T-118`–`T-125`) — [x] Landed on dev
 21. **Wave 20: Quality Telemetry, Honesty Gates & Retrieval Fault Signals** (`T-127`–`T-135`) — [x] Landed on dev
+22. **Wave 21: Invariant Mutation Safety & Constitutional Immunity** (`T-050`, `T-313`) — [x] Landed on dev
+23. **Wave 22: Failure Attribution & Negative Mining** (`T-144`, `T-314`, `T-315`) — [x] Landed on dev
+24. **Wave 23: Dashboard Overhaul, Terrain Maps & High-Speed Agent Hub** (`T-405`–`T-422`) — [ ] Active Roadmap
 
-## v12 Totals
+---
+
+# v13 — DASHBOARD OVERHAUL, TERRAIN MAPS & HIGH-SPEED AGENT HUB (WAVE 23, 2026-10-26)
+
+Source: Deep research on local Agent OS (Ryoku Rashin `http://127.0.0.1:3600`) and architectural design blueprint (`.agents/artifacts/2026-10-26-dashboard-rehaul-rashin-research-and-wave-23-tickets.md`).
+
+## PR 1 / Issue #1: Left-Rail Cyber-Minimalist Shell, Typography & Dual-Scope Switcher
+- [ ] T-405 · UI Shell: Fixed 76px vertical left rail with clean brand mark, numbered sections (`01 OVERVIEW`..`06 ABOUT`), warm-dark aesthetic, JetBrains Mono & Archivo Black typography (English-only, zero kanji) · src/ui.ts · F
+- [ ] T-406 · Dual-Scope Memory Switcher: Header segment toggle `[ Local Project Scope (./.memory) | Global User Scope (~/.memory) | Cross-Project Mesh ]` with instant live refetch · src/ui.ts, src/store.ts, src/root.ts · F
+- [ ] T-407 · Sub-10ms UI Route Architecture: Split single embedded HTML into modular static cached templates with ETag headers and pre-compressed buffers · src/ui.ts · F
+
+## PR 2 / Issue #2: Memory Studio 2.0: Instant Graph/List View Toggle, Physics Settling & Activity Heatmap
+- [ ] T-408 · Graph vs List Toggle Switch: Instant segment toggle between interactive Canvas Graph and filterable/sortable data table with live 100ms debounced search · src/ui.ts · F
+- [ ] T-409 · Energy-Settling Canvas Physics Engine: Ring-seeded 60fps force-directed graph with auto-settling kinetic loop (`energy < SETTLE` halts rAF) and pointer capture · src/ui.ts · F
+- [ ] T-410 · Activity Calendar Heatmap & Agent Sessions Card: 52-week activity commit-style calendar for memory mutations + agent session log cards with model tags, timestamps, message counts · src/ui.ts, src/audit.ts · F
+
+## PR 3 / Issue #3: Workspace Terrain Vault: Auto-Generated Context Maps & Split Markdown Reader
+- [ ] T-411 · Workspace Terrain Generator Engine: Compile deterministic workspace maps: `stack.md`, `habits.md`, `ownership.md`, `packages.md`, `repo.md`, `logs.md` · src/vault/index.ts, src/cli.ts · F
+- [ ] T-412 · Terrain Vault Split-Pane UI: Left file tree with `GEN` badges and right rendered markdown viewer with scanline animation on `REINDEX` · src/ui.ts · F
+- [ ] T-413 · Terrain Token-Efficiency Test & Benchmark: Test suite verifying deterministic generation, zero secret leaks, and token savings · test/vault_terrain.test.ts · F
+
+## PR 4 / Issue #4: Universal Agents Hub: Detection, 1-Click MCP Wiring & Prompt Snippets
+- [ ] T-414 · Coding Agent Auto-Discovery: Detect installed agents (Antigravity, OpenCode, Claude Code, Cursor, Copilot CLI, Hermes, Crush, Goose, Aider, Codex) with `WIRED`/`UNWIRED`/`ABSENT` status · src/connect.ts, src/ui.ts · F
+- [ ] T-415 · 1-Click Wire / Unwire API: `POST /api/agents/wire` and `POST /api/agents/unwire` writing safe native MCP configs with backup protection · src/ui.ts, src/connect.ts · F
+- [ ] T-416 · "Point Any Agent" Manifest & One-Click Copy Snippet: Display exposed filesystem paths, MCP endpoints, and one-click copyable system prompt snippet for custom LLMs · src/ui.ts · F
+
+## PR 5 / Issue #5: About & Cognitive Mission Control: Architecture Specs, Quick Start & CLI Cheatsheet
+- [ ] T-417 · Poster-Style About Panel: Architectural poster with WHAT (mission), THE PIECES live facts table (SQLite, Scope, Constraints, Tools, Wiki, Audit), and PRIVACY zero-cloud guarantee · src/ui.ts · F
+- [ ] T-418 · Quick-Start Interactive Onboarding: Multi-step interactive setup cards for leading agents (Antigravity, OpenCode, Claude Code, Cursor) with copyable commands · src/ui.ts · F
+- [ ] T-419 · "Go Deeper" Interactive Command Deck: Searchable CLI command palette with copyable one-liners (`muse recall`, `muse capture`, `muse current`, `muse brief`, `muse doctor`, `muse adr`, `muse sync`) · src/ui.ts · F
+
+## PR 6 / Issue #6: System Speed, In-Memory Caching & Performance Hardening
+- [ ] T-420 · In-Memory SQLite Read Projection Cache: Cache UI list and graph responses in memory, invalidated automatically on write transactions · src/ui.ts, src/cache.ts · F
+- [ ] T-421 · Fast-Exit & Visibility Sensors: Document `visibilitychange` listeners to stop all background polling intervals and animation frames when browser tab is inactive · src/ui.ts · F
+- [ ] T-422 · Automated UI Performance Benchmark Suite: Headless benchmark asserting sub-10ms UI responses, 60fps graph rendering, and zero memory leaks · test/ui_performance.test.ts · F
+
+---
+
+# v14 — STRATEGIC HORIZONS & SOVEREIGN LIFEOS RETIREMENT (WAVES 24–29, 2026-10-26)
+
+Source: Strategic roadmaps, developer experience assets, R17–R20 tri-cognitive horizons, and LifeOS sovereignty audit.
+
+## Wave 24: Showcase, Interactive Playground & DX Assets
+- [ ] T-423 · Terminal Showreel & GIF Recording: Script and record high-fidelity terminal demo (`showreel.mp4`, `muse-memory-demo.gif`) on v3.0.0 highlighting failure attribution, negative mining, and HOT.md compounding · assets/, docs/ · N
+- [ ] T-424 · Interactive WASM/SQLite Web Playground: In-browser memory studio preview on `apps/website` with zero backend server dependencies · apps/website · F
+- [ ] T-425 · Competitive Benchmark Showcase: Real-time latency, recall accuracy, and token-cost comparison matrix vs Mem0, Zep, and Letta · apps/website, docs/ · N
+- [ ] T-426 · Multi-Agent Interactive Demos: Interactive agent switcher in website docs demonstrating context injection across Antigravity, OpenCode, Claude Code, and Cursor · apps/website · N
+
+## Wave 25: R17 Tri-Cognitive Playbooks & Episodic Narrative Horizon
+- [ ] T-427 · Procedural Playbook Engine (`ProceduralMemory`): Model and persist executable step trajectories, pre-conditions, verification assertions, and rollback recipes · src/cognition/playbooks.ts · F
+- [ ] T-428 · Episodic Causal Narrative Horizon: Group linear observations into causal episodes (`Goal ➔ Hypothesis ➔ Trajectory ➔ Verification ➔ Retrospective`) · src/cognition/episodes.ts · F
+- [ ] T-429 · Bi-Temporal Validity Windows: Stored dual timestamps (`asserted_at` vs `valid_from`/`valid_until`) allowing historical queries without clobbering active state · src/schema.ts, src/store.ts · F
+- [ ] T-430 · Ebbinghaus Utility-Reinforced Cognitive Forgetting Curve: Exponential decay for unverified candidate notes; reinforcement for green test executions · src/quality/decay.ts · F
+- [ ] T-431 · CLI & MCP Playbook Commands: Wire `memory playbook --run <id>`, `memory playbook --list`, and `muse_playbook_recall` / `muse_playbook_record` MCP tools · src/cli/playbook.ts, src/mcp.ts · F
+
+## Wave 26: R18 AST Associative Callgraph Retrieval & Speculative Pre-Flight
+- [ ] T-432 · Recursive SQLite CTE Associative Expansion (Zero-Daemon HippoRAG): 2-hop associative graph traversal using in-process SQLite recursive CTEs (`WITH RECURSIVE call_tree AS (...)`) · src/sqlite.ts, src/retrieval/ · F
+- [ ] T-433 · Speculative Pre-Flight Context Push: Git and editor hooks pre-calculating token-budgeted memory knapsacks on file opening or branch switching · src/hooks/preflight.ts · F
+- [ ] T-434 · Cross-File Symbol Blast-Radius Risk Scoring: AST identifier cross-reference scoring to rate modification risk for proposed code changes · src/anchors/blast_radius.ts · F
+- [ ] T-435 · AST-Anchored Invariant Auto-Recall: Bind exported symbols and route interfaces directly to governing ADRs and architectural invariants · src/retrieval/anchors.ts · F
+
+## Wave 27: R19 Git-Branchable Memories & Multi-Tenant Agency Enclaves
+- [ ] T-436 · Branchable Memory Overlays (`memory branch` / `branch-merge`): Branch-isolated memory layers tracking git feature branch lifecycles · src/store/branch.ts · F
+- [ ] T-437 · Multi-Tenant Agency Enclaves (`scope: client`): Cryptographically segregated client vaults across Council divisions (Sol, Jasper, Crew, Nexus) · src/store/enclaves.ts · F
+- [ ] T-438 · Zero-Knowledge Memory Attestation: Cryptographic SHA-256 signing of SyncPackets with tamper-evident audit chains for client handoffs · src/sync/attestation.ts · F
+- [ ] T-439 · Semantic Contradiction Merge Resolver: Interactive 3-way semantic conflict resolution on branch merge into `main` · src/quality/branch_merge.ts · F
+
+## Wave 28: R20 Test-Driven Reinforcement & Regression Sentry
+- [ ] T-440 · Automated CI / Test Harness Integration: Bind memory utility directly to real test outcomes (`bun test`, `vitest`, `cargo test`); increment ROI on green, decay on red · src/quality/test_feedback.ts · F
+- [ ] T-441 · Negative Anti-Pattern Regression Sentry: Proactive watchdog matching test failures against `BUG_PRONE_PATTERN` and `DO_NOT_USE` records · src/cognition/sentry.ts · F
+- [ ] T-442 · Flaky Test & Environment Drift Detector: Correlate test flakiness and failure bursts with dependency updates and environmental churn · src/doctor/flaky.ts · F
+- [ ] T-443 · Autonomous Remediation Playbook Generator: Automatically synthesize recurring test fix sequences into verified reusable playbooks · src/cognition/remediation.ts · F
+
+## Wave 29: Sovereign Ecosystem Migration & Decommissioning
+- [x] T-444 · Sovereign Persona & Memory Ingestion: Synthesize user persona into `~/.memory/USER.md` and SQLite memory store; legacy import tool permanently removed from source · F
+- [x] T-445 · Native Vibeguard CLI (`memory scan-secrets`): Standalone secret scanning binary in `musememory` with zero external dependencies · src/cli/secrets.ts · F
+- [x] T-446 · Machine Terrain Collector in `src/vault/`: Incorporate hardware, toolchain, and package scans into unified workspace maps (`memory terrain`) · src/vault/system.ts · F
+- [x] T-447 · Global Governance De-LifeOSification: Remove all legacy imports and rewrite governance directives to point purely to Muse Memory and Muse Skills · ~/.agents/AGENTS.md · N
+- [x] T-448 · Sovereign Ecosystem Decommissioning Gate: Verification audit confirming zero dangling runtime dependencies and legacy tool removal · test/sovereignty_gate.test.ts · F
+
+## v14 Totals
 | Section | Tickets |
 |---|---|
-| Total Tracked Tickets | 290 |
-| Landed on dev | 212 |
-| Active Remaining | 78 |
+| Total Tracked Tickets | 334 |
+| Landed on dev | 222 |
+| Active Remaining | 112 |
+
+
 
 

package/.agents/skills/muse-health/SKILL.md

@@ -20,6 +20,32 @@ Call the `muse_health` MCP tool (or execute `memory health`):
 }
 ```
 
+To scope the report to a single memory project, pass `project`:
+
+```json
+{
+  "dir": ".",
+  "project": "my-app"
+}
+```
+
+**Read `scope` before trusting the number.** The report states exactly what it
+covered: `scope.filter` (the requested project, or `null` for the whole store),
+`scope.projects` (every project whose memories were considered), and
+`scope.entry_count`. The `project` field is the requested filter, the sole
+project present in the store, or `"all"` — it is never a guess. Code-side
+metrics (the technical-debt scan, the documentation/code drift audit) always
+cover the whole workspace, because source code is shared between projects and
+cannot be attributed to one of them; `scope.code_scope` records this.
+
+**The same filter works on every audit surface.** `muse_tech_debt`,
+`muse_bug_clusters`, `memory_anchor_audit` and `memory_drift_audit` all take
+`project`, and so do the studio's `/api/health`, `/api/drift`,
+`/api/cognition/clusters` and `/api/cognition/debt` endpoints
+(`?project=my-app`). The Cognitive Studio's **Project Scope** control in the
+header drives all of them and keeps the value in the URL, so a scoped view is
+shareable and survives a reload.
+
 ### Step 2: Evaluate 5-Pillar Scorecard
 The engine evaluates 5 distinct hardening dimensions, outputting an overall letter grade (**A–F**) and a gate status (**PASS**, **WARN**, or **FAIL**):
 
@@ -48,6 +74,9 @@ If the gate status is **WARN** or **FAIL**, the engine outputs an ordered remedi
 # Full terminal health dashboard
 memory health
 
+# Scope the report to one memory project
+memory health --project my-app
+
 # Output raw JSON for CI/CD gating (exits 1 on FAIL)
 memory health --json
 

package/.agents/standards/README.md

@@ -16,6 +16,7 @@
 | [`system-design.md`](./system-design.md) | Domain modelling, resilience, migration rehearsal, schemas. |
 | [`workflows.md`](./workflows.md) | Scaled tiers, the 5-phase pipeline, PR-per-feature and the post-merge sequence. |
 | [`git-workflow.md`](./git-workflow.md) | Branch lifecycle, commit standards, SemVer. |
+| [`landing-gate.md`](./landing-gate.md) | The delivery contract: a commit is not a delivery. `bun run check:landed` proves work reached the remote before *landed* may be used. |
 | [`dox-hierarchy.md`](./dox-hierarchy.md) | Reading order, child document shape, the closeout checklist, the pruning loop. |
 | [`council-roles.md`](./council-roles.md) | Muse / Sol / Jasper / Crew / Nexus responsibilities and subagent dispatch policy. |
 | [`memory-context.md`](./memory-context.md) | Context hygiene, the `.memory` store lifecycle, durable proposals. |

package/.agents/standards/dox-hierarchy.md

@@ -36,7 +36,8 @@ Update the closest owning `AGENTS.md` when a change affects:
 3. Refresh every affected Child DOX Index.
 4. Remove stale or contradictory text immediately.
 5. Run existing verification when relevant.
-6. Report any docs intentionally left unchanged and why.
+6. **Run the Landing Gate** — `bun run check:landed`. The closeout may not write remote-state language (*landed*, *shipped*, *verified on `dev`*) before this passes. If it fails, the entry says **local** and the report says what is missing. See [The Landing Gate](./landing-gate.md).
+7. Report any docs intentionally left unchanged and why.
 
 ---
 

package/.agents/standards/git-workflow.md

@@ -18,6 +18,18 @@
 6. For production bugs, use `hotfix/*` rather than merging unfinished work from `dev`.
 7. Prefer a new revert commit over rewriting shared history.
 
+> **Delivery is a separate step from committing.** A branch with a clean,
+> green, well-formatted commit history is still **local** until it is reachable
+> from `origin/dev`. Run `bun run check:landed` before describing any work as
+> landed, shipped or merged — see [The Landing Gate](./landing-gate.md). Rule 3
+> above is enforced by that gate, not by memory.
+>
+> **Never `git add -A` in a checkout another agent may be writing.** Stage the
+> exact paths you edited and verify with `git status --short` immediately
+> before staging; a broad `git add` silently absorbs a concurrent agent's
+> in-progress edits into your commit. The lease protocol is in
+> `.agents/artifacts/WORKTREE-LEASE.md`.
+
 ---
 
 ## 2. Meaningful Git Commit Standard
@@ -85,7 +97,8 @@ All releases and git tags must follow strict `vX.Y.Z` semantic versioning:
 
 ### Release Invariants
 - Sync `package.json` `"version"` with the `vX.Y.Z` tag in the release commit.
-- Stage on `release/vX.Y.Z` from `dev` → merge to `master` → back-merge to `dev`.
+- Any version bump regenerates derived artifacts **in the same commit**: `claims.json` embeds the package version, so a bump without `bun run claims:generate` fails CI's `claims:check` (caught live on the v3.1.0 cut).
+- Stage on `release/vX.Y.Z` from `dev` → merge to `main` → back-merge to `dev`.
 - CI publishes on `v*` tag push (`git tag -a vX.Y.Z -m "release: vX.Y.Z"`). Never publish manually.
 - **README "What's New" Rule**:
   - Keep only the current release/feature highlights in `README.md` under `## 🚀 What's New`.

package/.agents/standards/landing-gate.md

@@ -0,0 +1,253 @@
+# 🚚 The Landing Gate — A Commit Is Not a Delivery
+
+> **Doctrine**: Work is **LANDED** only when it is reachable from the
+> integration branch **on the remote**. Until then it is **LOCAL**. A commit is
+> an artifact, not a delivery.
+>
+> **Enforced by**: `scripts/check-landed.ts` (exits non-zero when the work
+> cannot be proven delivered). Prose that an agent can forget is not a rule;
+> this is a gate.
+
+---
+
+## 1. The failure this standard exists to prevent
+
+On **2026-10-22**, two complete waves of work — `T-320` (contradiction engine
+calibration) and `T-321` (per-project health gate scope) — were committed to a
+local branch and a local `dev`, and the session ended.
+
+| What happened | What it looked like from the outside |
+| :--- | :--- |
+| 6 commits, 2 waves, all code written | Complete |
+| `bun test` green, `tsc` clean, build clean | Verified |
+| A close-out document describing both waves as shipped | Shipped |
+| Under a heading reading *"Recently Landed Waves (Verified on `dev`)"* | **On `dev`** |
+| **No push. No pull request. No CI run.** | — |
+
+`dev` did not contain the work. `origin/dev` had already moved to **v3.0.2**
+while the branch sat local, so the branch had **diverged** and a direct push
+would have been rejected. The work was invisible to review, invisible to the
+release, and invisible to every agent that later read the close-out document
+and believed it.
+
+**The code was correct. Every test was green. The failure was not a coding
+failure — it was a false claim about the remote that nothing had ever checked.**
+
+The three sub-failures, in order:
+
+1. **The gate was missing.** Nothing between "tests pass" and "the work is
+   delivered" existed, so "delivered" became a matter of opinion.
+2. **The claim was written before the fact.** The close-out document asserted
+   remote state *before* the push — the sequence was reversed.
+3. **The close-out document became the next session's source of truth.** A
+   later session read "landed, verified on `dev`" and built on it.
+
+---
+
+## 2. The vocabulary is the gate
+
+These words assert a fact about the remote. **They may only be used when
+`check-landed.ts` has exited 0 in the same session:**
+
+> landed · shipped · merged · released · published · deployed ·
+> *verified on `dev`* · *on `dev`* · *in `dev`* · *upstreamed*
+
+Until the gate has run, the only permitted words are:
+
+> **local** · *committed locally on `<branch>` at `<sha>`* · *not yet pushed* ·
+> *not yet reviewed* · *not yet landed*
+
+**This applies to every artifact, not just chat:** commit messages, close-out
+documents in `.agents/context/`, PR bodies, changelog entries, issue comments,
+and the final report to the user. A doc that says "landed" is a doc that will
+be read as truth by the next session — which is exactly how a six-commit
+silent failure survived a close-out.
+
+---
+
+## 3. The gate
+
+```bash
+bun run check:landed                                        # is this LANDED?
+bun run scripts/check-landed.ts --pr --branch <name>       # is this REVIEWABLE?
+```
+
+### Post-merge mode — `bun run check:landed`
+
+Answers: *is this work on `origin/dev`?*
+
+| Check | Fails when |
+| :--- | :--- |
+| `HEAD` is an ancestor of `origin/dev` | The work is committed but not on the integration branch. |
+| Nothing unpushed | A commit exists that the remote has never seen. |
+| PR state (informational) | — |
+
+### Pre-review mode — `--pr --branch <name>`
+
+Answers: *is this branch reviewable?*
+
+| Check | Fails when |
+| :--- | :--- |
+| `origin/<name>` exists | The branch was never pushed. |
+| A pull request exists and is `OPEN` | There is nothing to review. |
+| No failing PR checks | The PR is already red. |
+
+### Reading the result
+
+```
+RESULT: LANDED              → exit 0. The remote-state claims are earned.
+RESULT: LOCAL               → exit 1. The work is LOCAL. Say so.
+RESULT: REVIEWABLE          → exit 0. Pre-review mode only.
+RESULT: NOT REVIEWABLE      → exit 1. Pre-review mode only.
+```
+
+> **The two verdicts never contain each other as substrings.** An earlier
+> draft used `NOT LANDED` — which contains `LANDED`, so a report quoting the
+> output, or a `grep "LANDED"`, could read a failure as a success. The
+> failure verdicts are `LOCAL` and `NOT REVIEWABLE`. `test/landing_gate.test.ts`
+> pins this.
+
+The gate prints the **exact commands and SHAs** it used. **Quote that
+evidence; do not restate it as an assertion.** A report that pastes the
+command and its exit code is auditable. A report that says "landed on dev" is
+not.
+
+---
+
+## 4. Where the gate MUST run
+
+### 4.1 Before the close-out DOX pass
+
+The close-out pass writes to `.agents/context/current.md` under a heading that
+claims *"Recently Landed Waves (Verified on `dev`)"*. **Run the gate first.**
+
+If the gate fails, the entry is not a "Landed Wave" — it belongs under
+*Next Up* with the word **local** in it, and the report must say what is
+missing (push / PR / CI / merge).
+
+### 4.2 Before the final report to the user
+
+A report that omits the remote state leaves the reader to assume the best
+case. The report **must** carry the block in §5.
+
+### 4.3 Before writing any remote-state claim
+
+Anywhere. Any artifact. Including a commit message body that says "merged" or
+a changelog entry that says "released".
+
+### 4.4 After every push
+
+Re-run it. A push that lands on a *feature* branch is not a delivery; the
+PR and the merge are.
+
+---
+
+## 5. The report contract
+
+Every final report carries this block. It is short, it is mechanical, and it
+is the thing that makes "did you actually finish?" answerable at a glance.
+
+```markdown
+## Remote state
+
+| | |
+| :--- | :--- |
+| Branch | `fix/T-321-per-project-health-gate` @ `983de69` |
+| Integration | `origin/dev` @ `8092ae6` |
+| Landed | ✅ `git merge-base --is-ancestor HEAD origin/dev` → exit 0 |
+| Pull request | #315 — MERGED |
+| Unpushed | none |
+| Gate | `bun run check:landed` → `RESULT: LANDED` |
+```
+
+When the gate has **not** been run or has **failed**, the block reads:
+
+```markdown
+## Remote state
+
+| | |
+| :--- | :--- |
+| Branch | `fix/x` @ `abc1234` |
+| Landed | ❌ **LOCAL — not pushed, not reviewed, not landed** |
+| Gate | `bun run check:landed` → `RESULT: LOCAL` |
+| Remaining | push → `gh pr create` → CI → merge |
+```
+
+**Never omit this block.** A report without it is indistinguishable from a
+report about work that shipped — which is the entire failure mode.
+
+---
+
+## 6. The staging rule (concurrent agents in one checkout)
+
+The other half of the failure class: **a commit that does not contain the
+work it claims to contain.**
+
+A dispatched subagent writing into the same checkout, while the orchestrator
+runs `git add -A`, produces a commit that silently absorbs the subagent's
+in-progress edits. The commit message then describes work that is *not* in it.
+This happened for real on 2026-10-22 and was only caught by the subagent
+reporting it — nothing mechanical would have caught it.
+
+### Rules
+
+1. **Never `git add -A`. Never `git add .`.** Stage the exact paths you
+   edited. There is no exception for "the tree looks clean".
+2. **Run `git status --short` immediately before staging.** If you see files
+   you did not touch, another agent is writing here — stop, coordinate, or
+   wait.
+3. **Never commit into a checkout another agent holds a lease on.** The lease
+   protocol lives in `.agents/artifacts/WORKTREE-LEASE.md`.
+4. **A commit's message must match its contents.** After committing, read
+   `git show --stat HEAD`. If the file list does not match the message, the
+   commit is wrong — fix it before pushing.
+5. **One worktree per agent when they can overlap.** If two agents may touch
+   the same files, give them separate worktrees and reconcile at the end.
+
+---
+
+## 7. Exceptions, and what to do instead
+
+| Situation | What to do |
+| :--- | :--- |
+| No network / offline | Say **local**. Report the branch and SHA, state that the push is pending, and give the exact command. Never write "landed". |
+| The principal asked for local-only work | Still run the gate and report the truth: *committed locally, deliberately not pushed*. |
+| The integration branch does not exist yet | The gate fails. Create it, or report local with the reason. |
+| The work genuinely belongs on a feature branch (a draft PR) | Use `--pr` mode. The report says **ready for review**, not landed. |
+| The gate fails but you believe the work is fine | The gate is right and you are wrong, or the work is genuinely not delivered. Investigate; do not describe the work as landed. |
+
+**There is no state in which the honest answer is silence.** If the gate did
+not run, the report says the gate did not run.
+
+---
+
+## 8. Why this is a standard and not a habit
+
+The failure was not a lapse of diligence. The agent was thorough — it wrote
+a close-out document, ran the full test suite, verified the CLI by hand, and
+documented the design decisions in detail. Every one of those steps was
+performed **correctly**, and the work still never shipped.
+
+Diligence applied to the wrong axis. The agent verified *the code* and
+assumed *the delivery*. A standard that only says "be more careful" cannot
+fix that, because the agent was already careful.
+
+So this standard does three things that diligence alone did not:
+
+1. **It names the exact state** — LOCAL or LANDED — so there is no ambiguity
+   to resolve by feel.
+2. **It replaces the judgement with a command** that exits non-zero.
+3. **It forces the evidence into the report**, so the next reader (human or
+   agent) can check instead of believing.
+
+The rule exists because the cheapest possible fix for this class of failure
+is not "try harder". It is "make the wrong thing impossible to say".
+
+---
+
+## 9. Related
+
+- [Git Branching, Commits & SemVer](./git-workflow.md) — branch lifecycle, commit format, SemVer.
+- [Agent Development Workflows & Phase Gates](./workflows.md) — the 5-phase pipeline; Phase 5 (Ship) depends on this gate.
+- [DOX Hierarchy & Subtree Contracts](./dox-hierarchy.md) — the closeout checklist; step 5 runs this gate.
+- [Execution & Cognitive Kernel](./execution-kernel.md) — judgment laws and the general evidence-before-claims doctrine.

package/.agents/standards/memory-context.md

@@ -38,13 +38,12 @@ The `./.memory` directory at the project root is the local persistent memory sto
 
 ## 3. Creed Native Context & Canonical LifeOS Sources
 
-When available on the system, agents reference these canonical LifeOS sources:
+Agents reference these canonical sovereign Muse Memory sources:
 
-1. `~/.config/LIFEOS/USER/PRINCIPAL/PRINCIPAL_IDENTITY.md` — Stable principal identity and preferences.
-2. `~/.config/LIFEOS/USER/DIGITAL_ASSISTANT/DA_IDENTITY.md` — Muse and Agency Council roles, routing, and gates.
-3. `~/.config/LIFEOS/USER/TELOS/PRINCIPAL_TELOS.md` — Mission, goals, strategies, and challenges.
-4. `~/.config/LIFEOS/USER/CONFIG/OPERATIONAL_RULES.md` — Principal-specific operating rules.
-5. `~/.config/LIFEOS/USER/PROJECTS.md` — Project routing and aliases.
+1. `~/.memory/USER.md` — Stable principal identity, telos, agency council roles, preferences, and portfolio routing.
+2. `./CURRENT.md` — Active working project constraints, invariants, and open loops.
+3. `~/.memory/` — Global long-term cognitive memory store (via `memory` MCP server).
+4. `./.memory/` — Project-scoped memory store.
 
 ### Durable-Memory Proposal Format
 When a durable fact, preference, constraint, or recurring pattern is learned, propose a narrow Markdown diff:

package/.agents/standards/security-vibeguard.md

@@ -35,7 +35,7 @@ Before executing high-risk system commands:
 Before finalizing commits, merges, or deliverables, run the Vibeguard security scan:
 
 ```bash
-bun ~/.config/LIFEOS/runtime/TOOLS/SecretScan.ts .
+memory scan-secrets .
 ```
 
 If the scan reports any credential leakage or pattern matches, resolve them immediately before declaring completion.

package/.agents/standards/workflows.md

@@ -44,14 +44,19 @@ To balance velocity with rigor, overhead is strictly proportional to task risk:
 
 ### Phase 4: 🛡️ Review & Hardening (Nexus Quality Gate)
 - Run targeted automated tests (`bun test` / `vitest`).
-- Run the Vibeguard SecretScan (`bun ~/.config/LIFEOS/runtime/TOOLS/SecretScan.ts .`).
+- Run the Vibeguard SecretScan (`memory scan-secrets .` or `bun run src/cli.ts scan-secrets .`).
 - Verify WCAG 2.2 AA accessibility and responsive mobile breakpoints.
 
 ### Phase 5: 🚢 Ship & Archive (Crew)
 - Create structured Conventional Commits following the Git standard.
+- **Run the Landing Gate**: `bun run check:landed`. Phase 5 is not complete
+  until it exits `RESULT: LANDED`. A green test suite is not a delivery —
+  the work must be reachable from `origin/dev`. See
+  [The Landing Gate](./landing-gate.md).
 - **Archive Work Artifacts**: Move completed plans or temporary scratchpads into `.agents/archive/` using the timestamped format `[title]-[YYYYMMDD-HHMMSS].md`.
-- **DOX Pass**: Update `./.agents/context/current.md` and the nearest owning `AGENTS.md`.
+- **DOX Pass**: Update `./.agents/context/current.md` and the nearest owning `AGENTS.md`. The close-out may only write "landed" language under a *"Recently Landed Waves"* heading **after** the gate has passed; until then the entry says **local**.
 - **Memory Update**: Persist newly confirmed invariants or architectural decisions into `./.memory`.
+- **Report**: the final report to the user carries the Remote State block from [The Landing Gate](./landing-gate.md) §5.
 
 ---
 
@@ -63,5 +68,6 @@ To balance velocity with rigor, overhead is strictly proportional to task risk:
    a. `updatedocs` skill — complete mode (doc↔code drift sync; CHANGELOG/docs alignment).
    b. `updateagents` skill — all modes (AGENTS.md + `.agents/` context synchronization).
    c. `git` skill — end-to-end, **stopping before release**. Release cutting is principal-confirmed only; never auto-release.
+   d. **The Landing Gate** — `bun run check:landed`. This is the step that proves the merge actually happened on the remote rather than being assumed. See [The Landing Gate](./landing-gate.md).
 4. **Docs upkeep.** Update CHANGELOG.md, CONTRIBUTING.md, and credits (package.json author/contributors, README credits) whenever required: behavioral changes, new dependencies, new contributors, process changes.
 5. Gates unchanged: green per commit, Why/What/Verification commit bodies, zero secret exposure, English only.