musememory 3.0.2 → 3.3.0

package/.agents/context/ticket-plan.md

@@ -158,10 +158,10 @@
 
 ## Wave E — P2 TEAM / SERVER / UI
 
-- [ ] T-150 · MCP Streamable HTTP transport (2025-06-18 spec) · mcp.ts · new · F
-- [ ] T-151 · Origin validation + session id + protocol version headers · mcp.ts · new · F
+- [x] T-150 · landed Wave 7 (PR #84) — verified 2026-11-08: `startHttpMcpServer` + `StreamableHTTPServerTransport` (`src/mcp.ts:3353-3494`), covered by `test/mcp_http_transport.test.ts` · mcp.ts · F
+- [x] T-151 · landed Wave 7 (PR #86) — verified 2026-11-08: protocol-version allowlist/echo (`src/mcp.ts:3199,3406-3426`), Origin 403 (`:3428-3445`), Host/DNS-rebind 403 (`:3447-3464`), session id (`:3360`); `test/mcp_http_transport.test.ts:129-365` · mcp.ts · F
 - [ ] T-152 · SSE resumability for long polls · mcp.ts · new · F
-- [ ] T-153 · per-tenant SQLite DB files (team mode) · store, root · new · F
+- [x] T-153 · landed Wave 7 (PR #90) — verified 2026-11-08: `resolveDbFilename` team/tenant DBs (`src/store.ts:138-158`), tenant dirs + `tenant_<id>.db` (`src/root.ts:153-175`), covered by `test/tenant_isolation.test.ts` · store, root · F
 - [ ] T-154 · extend `sync/pool.ts` to HTTP transport · sync · new · F
 - [ ] T-155 · git/YAML-mirror distribution path for team sync · sync · new · F
 - [ ] T-156 · Litestream sidecar backup docs+compose · docs, scripts · new · N
@@ -251,8 +251,14 @@ Source: read-only gap audit cross-checking the 168 tickets against the four rese
 
 ## Wave I — GOVERNANCE & SCALE
 
-- [ ] T-320 · HIGH (B10) · contradiction engine calibration: 7 regexes flip BOTH sides to `conflicted` at 0.85 on any 0.4-Jaccard pair (quality/contradiction.ts:15-23,85-114) → −0.8 rank, sync removal, −25 health each = 4 false positives = FAIL. Dry-run mode, negation-pair scoping, calibration fixtures · U
-- [ ] T-321 · HIGH (B12) · per-project health gate: gate/clustering/tech-debt call `list(store)` unfiltered and label by `entries[0].project` (health/gate.ts:31,220; cognition/clustering.ts:62; tech-debt.ts:102) — one number attributed to whichever memory sorts first · dep: T-153 · U
+- [x] T-320 · landed Wave 23 — HIGH (B10) · contradiction engine calibration: 7 regexes flip BOTH sides to `conflicted` at 0.85 on any 0.4-Jaccard pair (quality/contradiction.ts:15-23,85-114) → −0.8 rank, sync removal, −25 health each = 4 false positives = FAIL. Dry-run mode, negation-pair scoping, calibration fixtures · U
+  - Landed: claim-based detection (`src/quality/polarity.ts`, `src/quality/scope.ts`); subject + scope must agree before two claims oppose. Measured 8/10 non-contradictory pairs flagged before, 0/10 after. Dry-run surfaces: `memory conflicts [--dry-run]`, `propose({conflictDryRun})`, `detectConflict(…, {dryRun})`. Calibration fixture `test/calibration/contradiction_calibration.json` gated at precision/recall ≥ 0.9. Commits `18bf4f9`, `dc90539`.
+  - Correction to the original ticket text (**superseded 2026-10-22 — the earlier version of this note was wrong**): an earlier revision of this note claimed the "−0.8 rank" penalty does not exist in the ranking engine. **It does exist.** `STATUS_PENALTY` maps `conflicted: -0.8` (`src/types.ts:342`), `src/retrieval.ts:956` reads it into `statusPenalty` and `:1072` adds it to `totalScore`, and `src/retrieval/ranking.ts:6` imports `computeFactors` from `../retrieval.ts` and uses it at `:140` — so **both** retrieval paths penalise conflicted entries by −0.8. What is true is that the penalty is a *soft* rank discount, not a filter: `conflicted` entries are excluded from the status filters in `src/retrieval.ts:1686-1701`, `src/retrieval/ranking.ts:272-273` and `src/orchestrator/context.ts:144-147`, so a genuinely contradicted memory is still injected into agent prompts with no badge. That gap is tracked as **T-405**.
+- [x] T-321 · landed Wave 24 — HIGH (B12) · per-project health gate: gate/clustering/tech-debt call `list(store)` unfiltered and label by `entries[0].project` (health/gate.ts:31,220; cognition/clustering.ts:62; tech-debt.ts:102) — one number attributed to whichever memory sorts first · dep: T-153 · U
+  - Landed: `listForProject()` in `src/store.ts` is the single owner of the filter decision; the gate, the anchor audit, the drift audit, bug clustering and technical debt all take the same `project` option. The report now carries `scope` (`filter`, `projects`, `entry_count`, `code_scope`) and its `project` label is the requested filter, the sole project present, or `all` — never a guess. Surfaces: `memory health --project P`, `project` on `muse_health`/`muse_tech_debt`/`muse_bug_clusters`, `?project=` on `/api/health`. Commit `60b1aa2`, docs `27bdc81`.
+  - **Wave 25 completion (T-321 follow-up)**: a verification audit found the *functions* took `options.project` but five *surfaces* never plumbed it — `memory_anchor_audit` and `memory_drift_audit` (MCP), and `/api/drift`, `/api/cognition/clusters`, `/api/cognition/debt` (studio). A user could scope the health gate but not an anchor or drift audit. All five now take the filter, and the studio gained a labelled **Project Scope** control in the header that drives `/api/health`, `/api/drift`, `/api/cognition/clusters` and `/api/cognition/debt`, seeds from the URL query string (so a scoped link is shareable and reloadable), and renders the report's `scope` back to the user in the CLI's own wording. Cover: `test/health_project_scope_surfaces.test.ts` (7 cases) plus the original `test/health_project_scope.test.ts` (9 cases).
+  - Design note: code-side metrics (the technical-debt scan, the doc/code drift audit) stay **workspace-wide** by design — source code is shared between projects and cannot be attributed to one. `scope.code_scope` records this so the number is never misread.
+  - Note: the scope field is named `entry_count`, not `memory_count` — the published-claim gate treats any backticked `memory_*` identifier in an agent-facing document as an MCP tool name.
 - [ ] T-322 · MEDIUM (B13) · per-file read cache: anchor audit reads every source file 3× per health check (health/gate.ts:82,111,176 → anchors/resolver.ts:121) · U
 - [ ] T-323 · MEDIUM (B14) · anchored memories force-injected to front regardless of `anchor.status` + budget ordering (orchestrator/context.ts:104-147) — anchor to a deleted file wins the slot forever · dep: T-134 · U
 - [x] T-324 · landed Wave 21 · HIGH (B18) · checkpoint merge semantics: parseCurrentConstraints & mergeCurrentConstraints in compaction handoff; diff-preserving update preserves hand-added constraints · compaction · test/current_compaction_guard.test.ts · F
@@ -424,7 +430,7 @@ Two independent senior reviews of the plan (strategic + implementation-executabi
 - [x] T-381 · landed Wave 6 — embeddings spike: validate llama-cpp local embeddings E2E on the spec branch before ANY of T-071/136/137/138/139 ships · branch: feat/wave-6-embeddings-eval-harness · F
 - [ ] T-382 · deprecation policy: `deprecated: true` metadata + alias retention + "removed in vX"; prerequisite for T-201/T-202/T-203 · N
 - [x] T-383 · landed #71 — R1 red test: legacy store + added column throws before YAML write, passes after runMigrations · test/migrate.test.ts · F
-- [ ] T-384 · R2 fixture: 120 memories / 3 projects / 30 superseded / 30 expired → assert `hybridSearch` returns only matching-project non-superseded rows. Baselines T-303 + T-308 + T-140 at once · F
+- [x] T-384 · R2 fixture — verified 2026-11-08: `test/retrieval_engine.test.ts:53-91` builds 3 projects × 40 = 120 entries (20 live / 10 superseded / 10 expired per project) and asserts project isolation at scale through the hybrid path. Variance: 60 expired rows, not 30; driven via `RetrievalEngine.search` rather than `hybridSearch()` directly · F
 - [ ] T-385 · R3 baseline: 40 must-return queries from the principal's own `.memory/` + recall-set grading — gate Wave 2 on the number before T-070 ships · F
 
 **Principal decisions — all resolved 2026-10-14:**
@@ -518,6 +524,8 @@ Canonical detailed artifact: `.agents/artifacts/audit-and-realigned-roadmap-2026
 - [x] T-403 · HIGH · Stored-command doctor sweep: sanitize/migrate legacy non-template `test_command`s across `.memory/memories/*.yaml` to restore 100% clean validation · src/doctor.ts, .memory/ · F
 - [x] T-404 · HIGH · Stdin TTY decoupling: add `process.stdin.isTTY` check in `src/hooks/pack.ts:readStdinJson()` to prevent test runner hanging in interactive terminals · src/hooks/pack.ts · F
 - [x] T-401 · MEDIUM · Bunfig surface hardening: configure explicit test runner timeout and isolation defaults · bunfig.toml · N
+- [x] T-405 · HIGH · [#313](https://github.com/harshsinghmp/musememory/issues/313) · Conflicted memories are still injected into agent prompts with no badge: the status filters in `src/retrieval.ts:1686-1701`, `src/retrieval/ranking.ts:272-273` and `src/orchestrator/context.ts:144-147` exclude `superseded`/`rejected`/`archived`/`expired` but not `conflicted`. A contradicted memory is −0.8 rank-penalised (`STATUS_PENALTY`, `src/types.ts:342`) and removed from sync broadcasts, yet it is still served. Note: the gap is **wider** than the original note — three retrieval paths are affected, not one. Needs its own ticket and test pass because it changes retrieval output and therefore the golden recall fixtures · retrieval, orchestrator · U — **LANDED 2026-10-24**: PR #321 (`fix/T-405-conflicted-injection`) merged into `dev` at `e30a1b7`; a single shared `includeConflicted` opt-in now gates every prompt-serving read path (shown wider still by the build-out: tiered context, FTS/gate, vector, engine passthrough, muse pool/lenses all inherit or take the flag); the golden recall fixture was deliberately untouched — the frozen corpus carries zero conflicted entries, verified, so no regen was required; cryptic-suite delta +7 tests (1408/0); Fresh Critic 9.5/10 with a mutation-verified overfetch test.
+- [x] T-406 · LOW · [#314](https://github.com/harshsinghmp/musememory/issues/314) · `memory health --project P` matches the project name case-sensitively, so `--project ALPHA` against a store holding `alpha` returns an empty report whose label still reads `ALPHA`. Exact-match is honest but silent. Needs either a case-insensitive match or an explicit "no memories for project X" line · cli/health · U — **LANDED 2026-10-24**: PR #322 (`fix/T-406-case-sensitive-project`) merged into `dev` at `d3a8f6b`; new `src/health/resolve.ts` owns the resolution (`resolveProjectName`: exact wins → unique case-insensitive → loud unresolved), wired on CLI (exit 1 + available list, `--json` stdout kept pure), MCP `muse_health` (isError) and Studio `/api/health` (404 + JSON); the gate stays a pure exact-canonical reporter (scope-case tests untouched); +8 tests (1408/0); Fresh Critic 9/10.
 - [x] T-105b · landed Wave 2 — Syntax-only promotion rule: enforce AST/schema verification before candidate confirmation · promotion · branch: feat/wave-2-trust-gates · F
 
 ## Realigned In-Line Execution Sequence
@@ -542,12 +550,197 @@ Canonical detailed artifact: `.agents/artifacts/audit-and-realigned-roadmap-2026
 19. **Wave 18: Ingestion, Suppression & Curation Gates** (`T-106`–`T-113`) — [x] Landed on dev
 20. **Wave 19: Scoring Refinements & Abstract Sidecars** (`T-118`–`T-125`) — [x] Landed on dev
 21. **Wave 20: Quality Telemetry, Honesty Gates & Retrieval Fault Signals** (`T-127`–`T-135`) — [x] Landed on dev
+22. **Wave 21: Invariant Mutation Safety & Constitutional Immunity** (`T-050`, `T-313`) — [x] Landed on dev
+23. **Wave 22: Failure Attribution & Negative Mining** (`T-144`, `T-314`, `T-315`) — [x] Landed on dev
+24. **Wave 23: Dashboard Overhaul, Terrain Maps & High-Speed Agent Hub** (`T-451`–`T-468`) — [ ] Active Roadmap
 
-## v12 Totals
+---
+
+# v13 — DASHBOARD OVERHAUL, TERRAIN MAPS & HIGH-SPEED AGENT HUB (WAVE 23, 2026-10-26)
+
+Source: Deep research on local Agent OS (Ryoku Rashin `http://127.0.0.1:3600`) and architectural design blueprint (`.agents/artifacts/2026-10-26-dashboard-rehaul-rashin-research-and-wave-23-tickets.md`).
+
+> **Renumbered 2026-11-08.** This wave originally used `T-405`–`T-422`, which collided with the already-landed `T-405` (conflicted-memory injection, PR #321) and `T-406` (project-casing, PR #322). The block is now `T-451`–`T-468`; ticket text is unchanged. **PR 1 (`T-451`–`T-453`) implemented locally 2026-11-08** — see the annotations below and v15; not committed/pushed, so not landed.
+
+## PR 1 / Issue #1: Left-Rail Cyber-Minimalist Shell, Typography & Dual-Scope Switcher
+- [x] T-451 · UI Shell: Fixed 76px vertical left rail with clean brand mark, numbered sections (`01 OVERVIEW`..`06 ABOUT`), warm-dark aesthetic, JetBrains Mono & Archivo Black typography (English-only, zero kanji) · src/ui.ts · F — **LOCAL 2026-11-08**: implemented in `src/ui_assets.ts` (rail with six numbered sections + tools group, warm `#0c0a09` palette, Archivo Black / JetBrains Mono, zero emoji in the rail, About anchor); `test/ui.test.ts` T-451; gate 1449/0, tsc clean, build 434 modules; gauntlet CAPPED at the 5-round ceiling (last critic 7.99 — see `.agents/artifacts/gauntlet-wave23-pr1/`); landed PR #337 at `d0c9600`.
+- [x] T-452 · Dual-Scope Memory Switcher: Header segment toggle `[ Local Project Scope (./.memory) | Global User Scope (~/.memory) | Cross-Project Mesh ]` with instant live refetch · src/ui.ts, src/store.ts, src/root.ts · F — **LOCAL 2026-11-08**: segmented switcher wired to `?scope=`; `/api/memories`, `/api/stats`, `/api/current`, `/api/wiki`, `/api/user-profile` and `/api/audit` resolve project / lazy global `~/.memory` / mesh aggregation (`origin_project`, first 200); global and mesh reads open with `skipSyncConstraints`/`skipAutoWiki` and never re-sync a store; mutations stay project-scoped behind a visible scope banner and `requireProjectScope()`; `test/ui.test.ts` T-452 + `test/mesh.test.ts` read-only test; landed PR #337 at `d0c9600`.
+- [x] T-453 · Sub-10ms UI Route Architecture: Split single embedded HTML into modular static cached templates with ETag headers and pre-compressed buffers · src/ui.ts · F — **LOCAL 2026-11-08**: `src/ui_assets.ts` splits CSS / markup / client JS; `/assets/studio.css` + `/assets/studio.js` serve strong ETags, pre-gzipped buffers, `Vary: Accept-Encoding` and 304 fast paths; standalone export inlines the same modules; `test/ui.test.ts` T-453; landed PR #337 at `d0c9600`.
+
+## PR 2 / Issue #2: Memory Studio 2.0: Instant Graph/List View Toggle, Physics Settling & Activity Heatmap
+- [x] T-454 · LANDED 2026-11-08 — PR #339 (`3e621fa`): Graph vs List Toggle Switch: Instant segment toggle between interactive Canvas Graph and filterable/sortable data table with live 100ms debounced search · src/ui.ts · F
+- [x] T-455 · LANDED 2026-11-08 — PR #340 (`05b4fdf`): Energy-Settling Canvas Physics Engine: Ring-seeded 60fps force-directed graph with auto-settling kinetic loop (`energy < SETTLE` halts rAF) and pointer capture · src/ui.ts · F
+- [x] T-456 · LANDED 2026-11-08 — PR #341 (`436d198`): Activity Calendar Heatmap & Agent Sessions Card: 52-week activity commit-style calendar for memory mutations + agent session log cards with model tags, timestamps, message counts · src/ui.ts, src/audit.ts · F
+
+## PR 3 / Issue #3: Workspace Terrain Vault: Auto-Generated Context Maps & Split Markdown Reader
+- [x] T-457 · LANDED 2026-11-08 — PR #342 (`8006427`): Workspace Terrain Generator Engine: Compile deterministic workspace maps: `stack.md`, `habits.md`, `ownership.md`, `packages.md`, `repo.md`, `logs.md` · src/vault/index.ts, src/cli.ts · F
+- [x] T-458 · LANDED 2026-11-08 — PR #343 (`65113af`): Terrain Vault Split-Pane UI: Left file tree with `GEN` badges and right rendered markdown viewer with scanline animation on `REINDEX` · src/ui.ts · F
+- [x] T-459 · LANDED 2026-11-08 — PR #344: Terrain Token-Efficiency Test & Benchmark: Test suite verifying deterministic generation, zero secret leaks, and token savings · test/vault_terrain.test.ts · F
+
+## PR 4 / Issue #4: Universal Agents Hub: Detection, 1-Click MCP Wiring & Prompt Snippets
+- [x] T-460 · LANDED 2026-11-08 — PR #345: Coding Agent Auto-Discovery: Detect installed agents (Antigravity, OpenCode, Claude Code, Cursor, Copilot CLI, Hermes, Crush, Goose, Aider, Codex) with `WIRED`/`UNWIRED`/`ABSENT` status · src/connect.ts, src/ui.ts · F
+- [x] T-461 · LANDED 2026-11-08 — PR #346: 1-Click Wire / Unwire API: `POST /api/agents/wire` and `POST /api/agents/unwire` writing safe native MCP configs with backup protection · src/ui.ts, src/connect.ts · F
+- [x] T-462 · LANDED 2026-11-08 — PR #347: "Point Any Agent" Manifest & One-Click Copy Snippet: Display exposed filesystem paths, MCP endpoints, and one-click copyable system prompt snippet for custom LLMs · src/ui.ts · F
+
+## PR 5 / Issue #5: About & Cognitive Mission Control: Architecture Specs, Quick Start & CLI Cheatsheet
+- [x] T-463 · LANDED 2026-11-08 — PR #348: Poster-Style About Panel: Architectural poster with WHAT (mission), THE PIECES live facts table (SQLite, Scope, Constraints, Tools, Wiki, Audit), and PRIVACY zero-cloud guarantee · src/ui.ts · F
+- [x] T-464 · LANDED 2026-11-08 — PR #349: Quick-Start Interactive Onboarding: Multi-step interactive setup cards for leading agents (Antigravity, OpenCode, Claude Code, Cursor) with copyable commands · src/ui.ts · F
+- [x] T-465 · LANDED 2026-11-08 — PR #350: "Go Deeper" Interactive Command Deck: Searchable CLI command palette with copyable one-liners (`muse recall`, `muse capture`, `muse current`, `muse brief`, `muse doctor`, `muse adr`, `muse sync`) · src/ui.ts · F
+
+## PR 6 / Issue #6: System Speed, In-Memory Caching & Performance Hardening
+- [x] T-466 · LANDED 2026-11-08 — PR #351: In-Memory SQLite Read Projection Cache: Cache UI list and graph responses in memory, invalidated automatically on write transactions · src/ui.ts, src/cache.ts · F
+- [x] T-467 · LANDED 2026-11-08 — PR #352: Fast-Exit & Visibility Sensors: Document `visibilitychange` listeners to stop all background polling intervals and animation frames when browser tab is inactive · src/ui.ts · F
+- [x] T-468 · LANDED 2026-11-08 — PR #353: Automated UI Performance Benchmark Suite: Headless benchmark asserting sub-10ms UI responses, 60fps graph rendering, and zero memory leaks · test/ui_performance.test.ts · F
+
+---
+
+# v14 — STRATEGIC HORIZONS & SOVEREIGN LIFEOS RETIREMENT (WAVES 24–29, 2026-10-26)
+
+Source: Strategic roadmaps, developer experience assets, R17–R20 tri-cognitive horizons, and LifeOS sovereignty audit.
+
+## Wave 24: Showcase, Interactive Playground & DX Assets
+- [x] T-423 · LANDED 2026-11-08 — PR #362: Terminal Showreel & GIF Recording: Script and record high-fidelity terminal demo (`showreel.mp4`, `muse-memory-demo.gif`) on v3.0.0 highlighting failure attribution, negative mining, and HOT.md compounding · assets/, docs/ · N
+- [x] T-424 · LANDED 2026-11-08 — PR #365: Interactive WASM/SQLite Web Playground: In-browser memory studio preview on `apps/website` with zero backend server dependencies · apps/website · F
+- [x] T-425 · LANDED 2026-11-08 — PR #363: Competitive Benchmark Showcase: Real-time latency, recall accuracy, and token-cost comparison matrix vs Mem0, Zep, and Letta · apps/website, docs/ · N
+- [x] T-426 · LANDED 2026-11-08 — PR #364: Multi-Agent Interactive Demos: Interactive agent switcher in website docs demonstrating context injection across Antigravity, OpenCode, Claude Code, and Cursor · apps/website · N
+
+## Wave 25: R17 Tri-Cognitive Playbooks & Episodic Narrative Horizon
+- [x] T-427 · LANDED 2026-11-08 — PR #356: Procedural Playbook Engine (`ProceduralMemory`): Model and persist executable step trajectories, pre-conditions, verification assertions, and rollback recipes · src/cognition/playbooks.ts · F
+- [x] T-428 · LANDED 2026-11-08 (wired: memory briefing prints recent episodes) — PR #357: Episodic Causal Narrative Horizon: Group linear observations into causal episodes (`Goal ➔ Hypothesis ➔ Trajectory ➔ Verification ➔ Retrospective`) · src/cognition/episodes.ts · F
+- [x] T-429 · LANDED 2026-11-08 (wired: memory briefing prints recent episodes) — PR #359: Bi-Temporal Validity Windows: Stored dual timestamps (`asserted_at` vs `valid_from`/`valid_until`) allowing historical queries without clobbering active state · src/schema.ts, src/store.ts · F
+- [x] T-430 · LANDED 2026-11-08 (wired: memory briefing prints recent episodes) — PR #358: Ebbinghaus Utility-Reinforced Cognitive Forgetting Curve: Exponential decay for unverified candidate notes; reinforcement for green test executions · src/quality/decay.ts · F
+- [x] T-431 · LANDED 2026-11-08 — PR #360 + #361: CLI & MCP Playbook Commands: Wire `memory playbook --run <id>`, `memory playbook --list`, and `muse_playbook_recall` / `muse_playbook_record` MCP tools · src/cli/playbook.ts, src/mcp.ts · F
+
+## Wave 26: R18 AST Associative Callgraph Retrieval & Speculative Pre-Flight
+- [x] T-432 · LANDED 2026-11-09 — direct dev 2389985: Recursive SQLite CTE Associative Expansion (Zero-Daemon HippoRAG): 2-hop associative graph traversal using in-process SQLite recursive CTEs (`WITH RECURSIVE call_tree AS (...)`) · src/associative.ts, src/retrieval.ts · F
+- [x] T-433 · LANDED 2026-11-09 — PR #370: Speculative Pre-Flight Context Push: Pre-flight context builder (CLI; hook wiring deferred) on file opening or branch switching · src/hooks/preflight.ts · F
+- [x] T-434 · LANDED 2026-11-09 — PR #371: Cross-File Symbol Blast-Radius Risk Scoring: File/symbol blast-radius heuristic (registry AST integration deferred) to rate modification risk for proposed code changes · src/intelligence/blast_risk.ts · F
+- [x] T-435 · LANDED 2026-11-09 — PR #372: Anchor-Matched Invariant Auto-Recall: Bind exported symbols and route interfaces directly to governing ADRs and architectural invariants · src/retrieval/anchors.ts · F
+
+## Wave 27: R19 Git-Branchable Memories & Multi-Tenant Agency Enclaves
+- [x] T-436 · LANDED 2026-11-09 — PR #377: Branchable Memory Overlays (`memory overlay` with `set`/`rm`; merge via T-439): Branch-isolated memory layers tracking git feature branch lifecycles · src/store/branch.ts · F
+- [x] T-437 · LANDED 2026-11-09 — PR #378: Multi-Tenant Agency Enclaves: authenticated encrypted client vaults (store-key, at-rest); `scope: client` descoped (ADR-007) · src/store/enclaves.ts · F
+- [x] T-438 · LANDED 2026-11-09 — PR #379: Signed Packet Attestation v2: Ed25519 over canonical hashes with seq/head/key-id with tamper-evident audit chains for client handoffs · src/sync/attestation.ts · F
+- [x] T-439 · LANDED 2026-11-09 — PR #380: Semantic Contradiction Merge Resolver: Interactive 3-way semantic conflict resolution on branch merge into `main` · src/quality/branch_merge.ts · F
+
+## Wave 28: R20 Test-Driven Reinforcement & Regression Sentry
+- [ ] T-440 · Automated CI / Test Harness Integration: Bind memory utility directly to real test outcomes (`bun test`, `vitest`, `cargo test`); increment ROI on green, decay on red · src/quality/test_feedback.ts · F
+- [ ] T-441 · Negative Anti-Pattern Regression Sentry: Proactive watchdog matching test failures against `BUG_PRONE_PATTERN` and `DO_NOT_USE` records · src/cognition/sentry.ts · F
+- [ ] T-442 · Flaky Test & Environment Drift Detector: Correlate test flakiness and failure bursts with dependency updates and environmental churn · src/doctor/flaky.ts · F
+- [ ] T-443 · Autonomous Remediation Playbook Generator: Automatically synthesize recurring test fix sequences into verified reusable playbooks · src/cognition/remediation.ts · F
+
+## Wave 29: Sovereign Ecosystem Migration & Decommissioning
+- [x] T-444 · Sovereign Persona & Memory Ingestion: Synthesize user persona into `~/.memory/USER.md` and SQLite memory store; legacy import tool permanently removed from source · F
+- [x] T-445 · Native Vibeguard CLI (`memory scan-secrets`): Standalone secret scanning binary in `musememory` with zero external dependencies · src/cli/secrets.ts · F
+- [x] T-446 · Machine Terrain Collector in `src/vault/`: Incorporate hardware, toolchain, and package scans into unified workspace maps (`memory terrain`) · src/vault/system.ts · F
+- [x] T-447 · Global Governance De-LifeOSification: Remove all legacy imports and rewrite governance directives to point purely to Muse Memory and Muse Skills · ~/.agents/AGENTS.md · N
+- [x] T-448 · Sovereign Ecosystem Decommissioning Gate: Verification audit confirming zero dangling runtime dependencies and legacy tool removal · test/sovereignty_gate.test.ts · F
+
+## v14 Totals
 | Section | Tickets |
 |---|---|
-| Total Tracked Tickets | 290 |
-| Landed on dev | 212 |
-| Active Remaining | 78 |
+| Total Tracked Tickets | 334 |
+| Landed on dev | 222 |
+| Active Remaining | 112 |
+
+
+
+
+
+## Late additions (post-v3.2.0)
+
+- [x] T-449 · LANDED 2026-11-08 via PR #337 (`c0f7aef`, caller scan) + PR #338 (`94620895`, home-store guard, doc-link skip) · triage filed as GitHub issue #336 — test hermeticity: 9 local failures from `~/.memory` / `~/.agents` ancestor leakage (8 env-contamination) + 1 intelligence regex flake (stateful `g`-flag `RegExp` + definition counted as caller). Dry-run only; no code changed. Branch: `new` · F
+- [ ] T-450 · DEFERRED: scope which `.agents/` subpaths should be gitignored (e.g. artifacts, plans, context/current.md) vs. kept tracked (standards, skills). Audit consumer impact (collaborators, DOX, skills) before removing any. No execution until user scopes. Branch: `new` · N
+
+---
+
+# v15 — VERIFIED REMAINDER AUDIT (2026-11-08)
+
+Source: per-ticket verification of **every unchecked ticket in this plan** against the live tree (`src/`, `test/`, `apps/website/`, `Dockerfile`, `.gitignore`). Evidence rules: a ticket-number comment alone was **not** accepted; a module path only counted if the behaviour exists; a test file only counted if it asserts behaviour. Four tickets were found already implemented and are now marked done; the rest are classified below so no future pass re-litigates them.
+
+## Renumber applied in this pass
+
+Wave 23 (v13) originally used `T-405`–`T-422`, colliding with the landed `T-405` (conflicted injection, PR #321) and `T-406` (project casing, PR #322). The block is now:
+
+| old | new | old | new |
+|---|---|---|---|
+| T-405 | T-451 | T-414 | T-460 |
+| T-406 | T-452 | T-415 | T-461 |
+| T-407 | T-453 | T-416 | T-462 |
+| T-408 | T-454 | T-417 | T-463 |
+| T-409 | T-455 | T-418 | T-464 |
+| T-410 | T-456 | T-419 | T-465 |
+| T-411 | T-457 | T-420 | T-466 |
+| T-412 | T-458 | T-421 | T-467 |
+| T-413 | T-459 | T-422 | T-468 |
+
+References updated: this file, `.agents/context/roadmap.md`, `.agents/context/current.md`. The historical blueprint artifact keeps its original IDs plus a pointer note; `HANDOFF.md`'s `T-405`/`T-406` mentions are the *unrelated landed fixes* and were deliberately left untouched.
+
+## Status summary
+
+| Outcome | Count | Tickets |
+|---|---|---|
+| Implemented → marked done | 4 | `T-150`, `T-151`, `T-153`, `T-384` |
+| Partial (real code, incomplete scope) | 15 | below |
+| Not implemented | 86 | 83 remain; `T-451`–`T-453` implemented locally on 2026-11-08 |
+| Dropped by principal decision | 1 | `T-163` (D3: dashboard keeps writes) |
+| Filed / deferred | 2 | `T-449` (issue #336), `T-450` (needs scoping) |
+| **Unique open at audit start** | **108** | **104 remain unchecked after this pass** |
+
+## Implemented (now marked `[x]`)
+
+| ID | Evidence |
+|---|---|
+| T-150 | `src/mcp.ts:3353-3494` (`startHttpMcpServer`, `StreamableHTTPServerTransport`); `test/mcp_http_transport.test.ts` |
+| T-151 | `src/mcp.ts:3199,3360,3406-3464` (protocol allowlist, session id, Origin/Host guards); `test/mcp_http_transport.test.ts:129-365` |
+| T-153 | `src/store.ts:138-158`, `src/root.ts:153-175`; `test/tenant_isolation.test.ts` |
+| T-384 | `test/retrieval_engine.test.ts:53-91` (3 projects × 40 entries; 20 live / 10 superseded / 10 expired per project) |
+
+## Partial
+
+| ID | Evidence | Remaining gap |
+|---|---|---|
+| T-033 | `src/optimize.ts:297-305` prunes via `deleteEntry`; `src/store.ts:1867-1926` tombstones | no optimize-side tombstone/restore call or test |
+| T-203 | CLI `handleRecallCommand` delegates to `queryContext` (`src/cli/retrieval.ts:155`); MCP `memory_recall` separate (`src/mcp.ts:1956`) | no deprecation notice / formal alias |
+| T-176 | `src/cli/versioning.ts:53-121` branch refs + checkout | no store-level fork/merge of entry state |
+| T-178 | RRF A/B weight presets (`src/retrieval/rrf.ts:22-37`) | no graph-on/off gate in the eval harness |
+| T-179 | wikilink expansion (`src/retrieval.ts:1374-1460`) | no HRR half, no T-178 gating |
+| T-316 | write-time `linked_memory_ids` (`src/store.ts:1131-1176`) | scores session/tag/lexical overlap only; `store.ts` never imports `plasticity.ts` |
+| T-323 | anchored entries re-sorted by truncation rank (`src/orchestrator/context.ts:424`); freshness gate withholds orphaned anchors | `anchor.status` itself is never consulted |
+| T-369 | claims relabelled `[CLAIMED]` (`src/benchmark/suite.ts:210`) | assertions still `>= 0` (`test/benchmark.test.ts:50-71`) — no threshold gate |
+| T-378 | `LspProvider` now used (`test/intelligence.test.ts:175`) | 5 dead imports remain (`quality`, `settings`, `orchestrator`) |
+| T-385 | recall-set + latency grading (`src/quality/eval.ts`, `test/recall-eval.test.ts`) | fixture is 20 synthetic queries, not 40 from the principal's store |
+| T-460 | detection engine (`src/agents/detect.ts:82-123`) | no `WIRED`/`UNWIRED`/`ABSENT` vocabulary, no hub UI |
+| T-423 | `apps/website/public/showreel.mp4`, `assets/muse-memory-demo.gif` | not a terminal recording; mp4 not under `assets/` |
+| T-425 | capability matrix (`apps/website/src/pages/compare.astro:37`) | no competitor rows, no measured latency/recall/token figures |
+| T-429 | `valid_from`/`valid_to` (`src/sqlite.ts:150,375`) | no `asserted_at` / `valid_until` split |
+| T-434 | blast-radius via `src/intelligence/adapters/*` + `memory_code_intel_blast_radius` (`src/mcp.ts:1236`) | not the AST cross-file risk module at the named path |
+
+## Not implemented (86)
+
+**Wave A/B/C/D leftovers (7).** `T-016` no dispatch-coverage matrix (only name parity in `test/connect_tools_alignment.test.ts:24`); `T-034` no `secure_delete` in `src/`; `T-048` no wake gate/actionable-keys allowlist; `T-051` no `memory_pressure` event; `T-201` all 30 detectors live (`src/migrator/detect.ts:15-374`); `T-202` 52 registry entries, none frozen (`src/agents/registry.ts`); `T-205` `Dockerfile:9-11` still runs `bun test` + `tsc --noEmit`.
+
+**Wave E team/server/interop (14).** `T-152` no `Last-Event-ID`/event store (`src/daemon.ts:27-40` is plain SSE); `T-154` `src/sync/pool.ts:12-85` filesystem-only; `T-155` no git/YAML distribution path; `T-156` no Litestream service (`docker-compose.yml:1-10`); `T-168` no Hermes provider; `T-169` no Muse-MCP adapter; `T-170` no catalog packaging; `T-171` no qdrant adapter (`src/store/` is only `sidecars.ts`); `T-172` checksum validation only (`src/sync/federation.ts:65-82`), no probes/lock scope; `T-173` no observer/observed relation; `T-174` no peer/namespace columns (`src/schema.ts`); `T-175` only USER.md reserved slots (`src/orchestrator/context.ts:386-390`); `T-180`/`T-181` no spec documents.
+
+**Dashboard (9).** `T-157`–`T-162` no route/panel for recall-debug, lineage, eval, lifecycle tower, config honesty, or team mesh (`src/ui.ts:156-778` routes, `:1103-1115` tabs); `T-164` consolidation is on-demand only (`src/consolidate.ts:51`); `T-165` cadence is N-day + inactivity, no turn trigger (`src/optimize.ts:98-131`); `T-166` `crontabLine` has no ownership token (`src/routines.ts:71-73`).
+
+**Quality/scale (14).** `T-317` no PPR/restart set; `T-318` telemetry exists (`src/quality/telemetry.ts:177-195`) but no auto-tuner; `T-319` no `is_inference`/`parent_ids`/review queue (`src/sqlite.ts:138-165`); `T-322` anchor audit re-reads per anchor (`src/anchors/resolver.ts:287`), no cache; `T-325` `rollupTemporal` has no period filter (`src/compounding/temporal.ts:171-181`); `T-326` tiers 0/1 call full `queryContext` (`src/retrieval/tiered.ts:49`); `T-327` `list()` has no paging (`src/store.ts:638-641`); `T-328` clock is `length + Date.now()` (`src/sync/engine.ts:118-120`); `T-329` no episode table / retrieval unit; `T-330` no `absent` type or role scoping; `T-332` no packet signature/peer allowlist (`src/sync/packet.ts:72-103`); `T-333` `confirm()` never extends expiry (`src/store.ts:1356-1387`); `T-334` no `write_origin`; `T-335` no `visible_until` window (`src/store.ts:224-266`).
+
+**Test integrity (8).** `T-371` (lying security tests, `test/security_hardening.test.ts:88-100,127`), `T-372` (tautological doctor test, `test/doctor.test.ts:11-16`), `T-373` (grep-only UI asserts, `test/ui.test.ts:52-218`), `T-374` (`toBeDefined`/`>= 0`, `test/health.test.ts:221-228`, `test/benchmark.test.ts:47-72`), `T-375` (`Array.isArray`-only, `test/ui.test.ts`, `test/mcp.test.ts:72-131`, `test/mesh.test.ts:349`), `T-376` (duplicate suites, `graph*`, `panda_loader`/`upgrade`, `retrieval*`, `sqlite_primary`/`store`), `T-377` (`markStale` imported never called, `test/sqlite_primary.test.ts:4,47-90`), and `T-382` (no `deprecated` metadata anywhere in `src/`). All seven T-371–T-377 defects are still present, not fixed.
+
+**Wave 23 (14 remaining; new IDs).** `T-451`–`T-453` are implemented locally (rail, dual-scope switcher, modular ETag/gzip assets — see the v13 annotations and `current.md`). `T-454`–`T-459` and `T-461`–`T-468` remain: no graph/list toggle, no kinetic-settling loop, no activity heatmap, no terrain pane, no agents-hub wire/unwire routes, no About poster / quick-start / command deck, no UI projection cache, no `visibilitychange` idling, and no `test/ui_performance.test.ts`. `src/vault/` still writes only `system.md` — none of the six terrain maps exist.
+
+**Wave 24–29 (17).** `T-424` no playground/WASM page; `T-426` no agent-switcher demo; `T-427` no `src/cognition/playbooks.ts`; `T-428` no `src/cognition/episodes.ts`; `T-430` no `src/quality/decay.ts`; `T-431` no `src/cli/playbook.ts` or playbook MCP tools; `T-432` no `WITH RECURSIVE` in `src/`; `T-433` no `src/hooks/preflight.ts`; `T-435` no `src/retrieval/anchors.ts`; `T-436` no `src/store/branch.ts`; `T-437` no `src/store/enclaves.ts`; `T-438` no `src/sync/attestation.ts`; `T-439` no `src/quality/branch_merge.ts`; `T-440` no `src/quality/test_feedback.ts`; `T-441` no `src/cognition/sentry.ts`; `T-442` no flaky-test detector (`src/doctor` is a flat module); `T-443` no `src/cognition/remediation.ts`.
+
+## Dropped by decision
+
+- `T-163` — read-only dashboard invariant. Principal decision **D3**: the dashboard keeps its 12 write endpoints; the invariant was dropped. The ticket text is stale; no code should be written for it.
+
+## Filed / deferred
+
+- `T-449` — **OPEN**, GitHub issue #336. Triage only so far (9 local failures: 8 env-contamination from `~/.memory`/`~/.agents` ancestors, 1 intelligence regex flake). No fix landed.
+- `T-450` — **DEFERRED** pending principal scoping of `.agents/` gitignore vs tracked paths. `.gitignore:80-81` still tracks all of `.agents/`.
 
+## What this changes about "next"
 
+Wave 23 **PR 1 is now implemented locally** (`T-451`–`T-453`: rail, dual-scope switcher, modular cached assets), so the next build is **PR 2 — `T-454`–`T-456`** (graph/list toggle, kinetic-settling loop, activity heatmap). `T-316` remains the only already-unblocked quality ticket (partial: Hebbian half missing) and `T-318` is missing. The only open filed defect is `T-449`. The 86 "not implemented" tickets are accurate backlog, not stale checkboxes.

package/.agents/skills/muse-health/SKILL.md

@@ -20,6 +20,32 @@ Call the `muse_health` MCP tool (or execute `memory health`):
 }
 ```
 
+To scope the report to a single memory project, pass `project`:
+
+```json
+{
+  "dir": ".",
+  "project": "my-app"
+}
+```
+
+**Read `scope` before trusting the number.** The report states exactly what it
+covered: `scope.filter` (the requested project, or `null` for the whole store),
+`scope.projects` (every project whose memories were considered), and
+`scope.entry_count`. The `project` field is the requested filter, the sole
+project present in the store, or `"all"` — it is never a guess. Code-side
+metrics (the technical-debt scan, the documentation/code drift audit) always
+cover the whole workspace, because source code is shared between projects and
+cannot be attributed to one of them; `scope.code_scope` records this.
+
+**The same filter works on every audit surface.** `muse_tech_debt`,
+`muse_bug_clusters`, `memory_anchor_audit` and `memory_drift_audit` all take
+`project`, and so do the studio's `/api/health`, `/api/drift`,
+`/api/cognition/clusters` and `/api/cognition/debt` endpoints
+(`?project=my-app`). The Cognitive Studio's **Project Scope** control in the
+header drives all of them and keeps the value in the URL, so a scoped view is
+shareable and survives a reload.
+
 ### Step 2: Evaluate 5-Pillar Scorecard
 The engine evaluates 5 distinct hardening dimensions, outputting an overall letter grade (**A–F**) and a gate status (**PASS**, **WARN**, or **FAIL**):
 
@@ -48,6 +74,9 @@ If the gate status is **WARN** or **FAIL**, the engine outputs an ordered remedi
 # Full terminal health dashboard
 memory health
 
+# Scope the report to one memory project
+memory health --project my-app
+
 # Output raw JSON for CI/CD gating (exits 1 on FAIL)
 memory health --json
 

package/.agents/standards/README.md

@@ -16,6 +16,7 @@
 | [`system-design.md`](./system-design.md) | Domain modelling, resilience, migration rehearsal, schemas. |
 | [`workflows.md`](./workflows.md) | Scaled tiers, the 5-phase pipeline, PR-per-feature and the post-merge sequence. |
 | [`git-workflow.md`](./git-workflow.md) | Branch lifecycle, commit standards, SemVer. |
+| [`landing-gate.md`](./landing-gate.md) | The delivery contract: a commit is not a delivery. `bun run check:landed` proves work reached the remote before *landed* may be used. |
 | [`dox-hierarchy.md`](./dox-hierarchy.md) | Reading order, child document shape, the closeout checklist, the pruning loop. |
 | [`council-roles.md`](./council-roles.md) | Muse / Sol / Jasper / Crew / Nexus responsibilities and subagent dispatch policy. |
 | [`memory-context.md`](./memory-context.md) | Context hygiene, the `.memory` store lifecycle, durable proposals. |

package/.agents/standards/dox-hierarchy.md

@@ -36,7 +36,8 @@ Update the closest owning `AGENTS.md` when a change affects:
 3. Refresh every affected Child DOX Index.
 4. Remove stale or contradictory text immediately.
 5. Run existing verification when relevant.
-6. Report any docs intentionally left unchanged and why.
+6. **Run the Landing Gate** — `bun run check:landed`. The closeout may not write remote-state language (*landed*, *shipped*, *verified on `dev`*) before this passes. If it fails, the entry says **local** and the report says what is missing. See [The Landing Gate](./landing-gate.md).
+7. Report any docs intentionally left unchanged and why.
 
 ---
 

package/.agents/standards/frontend-astro.md

@@ -1,6 +1,6 @@
 # 🚀 Astro Frontend Engineering Standards
 
-> **Runtime Target**: Astro v7.3.x · Bun / Node runtime · TypeScript Strict
+> **Runtime Target**: Astro v7.4.7 · Bun / Node runtime · TypeScript Strict
 > **Applies to**: `apps/website/` — the Muse Memory marketing and documentation site.
 
 ---
@@ -130,3 +130,5 @@ bun run --cwd apps/website scripts/audit-visual.ts
 bun test                    # the whole repository suite
 bunx tsc --noEmit           # type check
 ```
+
+> Build note: the site runs the Astro CLI through Node (`apps/website/scripts/astro.mjs`); Bun’s CJS/ESM interop rejects Astro’s `cookie` import.

package/.agents/standards/git-workflow.md

@@ -18,6 +18,18 @@
 6. For production bugs, use `hotfix/*` rather than merging unfinished work from `dev`.
 7. Prefer a new revert commit over rewriting shared history.
 
+> **Delivery is a separate step from committing.** A branch with a clean,
+> green, well-formatted commit history is still **local** until it is reachable
+> from `origin/dev`. Run `bun run check:landed` before describing any work as
+> landed, shipped or merged — see [The Landing Gate](./landing-gate.md). Rule 3
+> above is enforced by that gate, not by memory.
+>
+> **Never `git add -A` in a checkout another agent may be writing.** Stage the
+> exact paths you edited and verify with `git status --short` immediately
+> before staging; a broad `git add` silently absorbs a concurrent agent's
+> in-progress edits into your commit. The lease protocol is in
+> `.agents/artifacts/WORKTREE-LEASE.md`.
+
 ---
 
 ## 2. Meaningful Git Commit Standard
@@ -85,7 +97,8 @@ All releases and git tags must follow strict `vX.Y.Z` semantic versioning:
 
 ### Release Invariants
 - Sync `package.json` `"version"` with the `vX.Y.Z` tag in the release commit.
-- Stage on `release/vX.Y.Z` from `dev` → merge to `master` → back-merge to `dev`.
+- Any version bump regenerates derived artifacts **in the same commit**: `claims.json` embeds the package version, so a bump without `bun run claims:generate` fails CI's `claims:check` (caught live on the v3.1.0 cut).
+- Stage on `release/vX.Y.Z` from `dev` → merge to `main` → back-merge to `dev`.
 - CI publishes on `v*` tag push (`git tag -a vX.Y.Z -m "release: vX.Y.Z"`). Never publish manually.
 - **README "What's New" Rule**:
   - Keep only the current release/feature highlights in `README.md` under `## 🚀 What's New`.