omo-ai 5.1.40 → 5.1.42

package/bin/lib/launcher.js

@@ -4,6 +4,7 @@ import { join } from "node:path"
 import { isEngineCommand } from "./engine-commands.js"
 import { spawnNode } from "./child-process.js"
 import { doctorCoverageLines } from "./category-coverage.js"
+import { runDoctorModels } from "./model-chains.js"
 import { doctorComputerUseLines } from "./computer-use-doctor.js"
 import { doctorConfigLines } from "./config-doctor.js"
 import { runDaemonCommand } from "./daemon.js"
@@ -12,6 +13,7 @@ import { isHostStatusAll, runHostStatusAll, sessionActivityReader } from "./host
 import { runDoctor } from "./doctor.js"
 import { ensureEnginePrepared, preparePluginLaunchSpec } from "./engine-prepare.js"
 import { migrateLegacyBunGlobalManifest } from "./legacy-bun-global-migration.js"
+import { removeLegacyServiceCredentials } from "./legacy-service-credentials.js"
 import { adoptLegacyFlatState, canonicalAgentDir } from "./agent-dir.js"
 import { senpiEnvironment } from "./engine-environment.js"
 import { withHerdrAgentHint } from "./herdr-agent-hint.js"
@@ -130,6 +132,7 @@ export function rollbackMigrateCall(request) {
 
 export async function runLauncher(args = process.argv.slice(2)) {
   migrateLegacyBunGlobalManifest()
+  removeLegacyServiceCredentials()
   reportLegacyFlatAdoption()
   const command = args[0]
   // The toolkit CLI is no longer part of the Native payload; the loop is driven in-process by the
@@ -177,6 +180,10 @@ export async function runLauncher(args = process.argv.slice(2)) {
   if (command === "doctor") {
     // Doctor is a launch too: it reports only what the launch-time preparation could not fix.
     preparePluginLaunchSpec({ pluginRoot: join(packageRoot, "plugin") })
+    if (args[1] === "--models") {
+      process.exitCode = await runDoctorModels(args.slice(2), { agentDir: canonicalAgentDir() })
+      return
+    }
     const [categoryCoverage, computerUse, configDiagnostics, gateway] = args[1] === "--reap"
       ? [[], [], [], []]
       : await Promise.all([

package/bin/lib/legacy-service-credentials.js

@@ -0,0 +1,36 @@
+import { lstatSync, readFileSync, unlinkSync } from "node:fs"
+import { homedir } from "node:os"
+import { join } from "node:path"
+
+// An intermediate sign-in build left device private keys and refresh material in a plaintext
+// `~/.omo/credentials.json`, sometimes world-readable (#10697). Credentials now live only in the OS
+// keystore, so nothing reads this file; remove it on launch. Only the exact legacy shape is removed:
+// a regular file (never a symlink or FIFO) whose JSON object carries both private keys.
+const MAX_LEGACY_BYTES = 64 * 1024
+
+export function removeLegacyServiceCredentials(home = process.env.HOME || process.env.USERPROFILE || homedir()) {
+  const path = join(home, ".omo", "credentials.json")
+  let stats
+  try {
+    stats = lstatSync(path)
+  } catch {
+    return false
+  }
+  if (!stats.isFile() || stats.size > MAX_LEGACY_BYTES) return false
+
+  let parsed
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf8"))
+  } catch {
+    return false
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return false
+  if (!("signingPrivateKey" in parsed) || !("sealingPrivateKey" in parsed)) return false
+
+  try {
+    unlinkSync(path)
+  } catch {
+    return false
+  }
+  return true
+}

package/bin/lib/model-chains.js

@@ -0,0 +1,110 @@
+/**
+ * `omo doctor --models [--json]`: per category and task agent, the model a spawn runs first, the
+ * runtime retry chain in order, and every declared rung with its source (built-in, omo.json, the
+ * category an agent borrows) and whether it runs, then the main session's model_profile lane.
+ *
+ * The answer comes from the same places `omo doctor`'s coverage line does: the pinned engine's
+ * offline model list (`engineAvailableModels`: auth.json, models.json, env keys; no network, nothing
+ * written) classified by the spawn resolvers through the staged category-coverage runtime bundle.
+ * Unlike the coverage line this is an explicit request, so a runtime that cannot answer fails it.
+ */
+
+import { COVERAGE_RUNTIME, engineAvailableModels } from "./category-coverage.js"
+import { packageRoot } from "./package-paths.js"
+import { join } from "node:path"
+import { pathToFileURL } from "node:url"
+
+const STATE_TEXT = {
+  primary: () => "runs first",
+  excluded: (rung) => `excluded by exclude_models "${rung.excludedBy}"`,
+  "no-login": () => "no login",
+  "not-reached": () => "not reached",
+  applied: () => "applied",
+}
+
+function rungModel(rung) {
+  return rung.providers === undefined ? rung.model : `${rung.model} (${rung.providers.join(" | ")})`
+}
+
+function rungLines(rungs) {
+  let fallback = 0
+  const width = Math.max(0, ...rungs.map((rung) => rungModel(rung).length))
+  return rungs.map((rung, index) => {
+    const state = rung.state === "fallback" ? `fallback ${(fallback += 1)}` : STATE_TEXT[rung.state](rung)
+    return `    ${index + 1}. ${rungModel(rung).padEnd(width)}  ${rung.source.padEnd(9)}  ${state}`
+  })
+}
+
+function entryLines(entry) {
+  const head = entry.status === "resolved"
+    ? `  ${entry.name}: ${entry.runtime.join(" -> ")}`
+    : `  ${entry.name}: ${entry.status}${entry.reason === undefined ? "" : ` (${entry.reason})`}`
+  return [head, ...rungLines(entry.rungs)]
+}
+
+/** The human report. @param {any} view the runtime's `modelChains` result */
+export function formatModelChainLines(view) {
+  const profile = view.modelProfile
+  const lane = profile.selection === "set" ? `model_profile ${profile.profile}` : `model_profile unset, default lane ${profile.profile}`
+  return [
+    "Models a spawn resolves right now (logins read offline; credentials are not probed).",
+    `exclude_models: ${view.excludeModels.length === 0 ? "none" : view.excludeModels.join(", ")}`,
+    ...(view.configProfile === undefined ? [] : [`config profile: ${view.configProfile}`]),
+    "",
+    "categories",
+    ...view.categories.flatMap(entryLines),
+    "",
+    "agents",
+    ...view.agents.flatMap(entryLines),
+    "",
+    `main session (${lane})`,
+    `  ${profile.applied ?? `none${profile.reason === undefined ? "" : ` (${profile.reason})`}`}`,
+    ...rungLines(profile.rungs),
+  ]
+}
+
+async function loadRuntime() {
+  return import(pathToFileURL(join(packageRoot, COVERAGE_RUNTIME)).href)
+}
+
+/**
+ * @typedef {{
+ *   agentDir: string,
+ *   json: boolean,
+ *   cwd?: string,
+ *   env?: Record<string, string | undefined>,
+ *   loadEngine?: () => Promise<any>,
+ *   loadRuntime?: () => Promise<any>,
+ * }} DoctorModelsOptions
+ * @param {DoctorModelsOptions} options
+ * @returns {Promise<{ output: string, failed: boolean }>}
+ */
+export async function doctorModelChains(options) {
+  try {
+    const runtime = await (options.loadRuntime ?? loadRuntime)()
+    const cwd = options.cwd ?? process.cwd()
+    const models = await engineAvailableModels({ agentDir: options.agentDir, cwd, loadEngine: options.loadEngine })
+    const view = runtime.modelChains({ models, cwd, env: options.env ?? process.env })
+    return { output: options.json ? JSON.stringify(view, null, 2) : formatModelChainLines(view).join("\n"), failed: false }
+  } catch (error) {
+    return { output: `FAIL models: ${error instanceof Error ? error.message : String(error)}`, failed: true }
+  }
+}
+
+/**
+ * Prints the report and returns the exit code: 0, 1 when the runtime cannot answer, 2 for an option
+ * other than `--json`.
+ * @param {string[]} args the arguments after `--models`
+ * @param {Omit<DoctorModelsOptions, "json">} options
+ * @returns {Promise<number>}
+ */
+export async function runDoctorModels(args, options) {
+  const unknown = args.filter((arg) => arg !== "--json")
+  if (unknown.length > 0) {
+    console.error(`omo doctor --models: unknown option ${unknown.join(" ")} (accepted: --json)`)
+    return 2
+  }
+  const result = await doctorModelChains({ ...options, json: args.includes("--json") })
+  console.log(result.output)
+  return result.failed ? 1 : 0
+}

package/bin/lib/provider-map.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Derived from @code-yeongyu/senpi 2026.10.19-2 builtinProviders(). builtinProviderIds and oauthProviderIds are the engine registry verbatim; providers maps a source harness id onto the omo provider that serves the same endpoint; oauthLogins maps a source OAuth id onto the omo provider to run /login for. Re-derive all four whenever the senpi pin changes.",
+  "_comment": "Derived from @code-yeongyu/senpi 2026.10.21-2 builtinProviders(). builtinProviderIds and oauthProviderIds are the engine registry verbatim; providers maps a source harness id onto the omo provider that serves the same endpoint; oauthLogins maps a source OAuth id onto the omo provider to run /login for. Re-derive all four whenever the senpi pin changes.",
   "builtinProviderIds": [
     "alibaba-token-plan",
     "amazon-bedrock",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omo-ai",
-  "version": "5.1.40",
+  "version": "5.1.42",
   "type": "module",
   "description": "OmO Native - the standalone omo command with the OMO extension built in: bun add -g omo-ai",
   "bin": {
@@ -17,7 +17,7 @@
     "postinstall": "node bin/senpi-patch.mjs"
   },
   "dependencies": {
-    "@code-yeongyu/senpi": "2026.10.19-2"
+    "@code-yeongyu/senpi": "2026.10.21-2"
   },
   "repository": {
     "type": "git",

package/plugin/CHANGELOG.md

@@ -7,6 +7,59 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.1.42] - 2026-10-22
+
+
+**Memory sync checks each new keyring entry without re-reading the chain before it.** The client now uses the shared receiver's incremental entry point (omo-service #600, re-vendored), and the receiver moves along with the verified chain state. Appending one entry to a 1,000-entry chain used to hand the receiver all 1,006 entries again; it now hands it one, at any chain length. What the receiver refuses is unchanged, including a replayed or lower-seq entry. ([#10694](https://github.com/code-yeongyu/oh-my-openagent/pull/10694), fixes [#10655](https://github.com/code-yeongyu/oh-my-openagent/issues/10655))
+
+**The engine moves to senpi 2026.10.21-2: idle task hosts exit again, reopened sessions stop spending quota, and sessions share their prompt cache ([#10893](https://github.com/code-yeongyu/oh-my-openagent/pull/10893)).** A monitor watch no longer keeps every task shard host on the machine running, so idle hosts exit as designed. Reopening an unattended session no longer spends quota on goals or background events until you send input or choose Resume. Responses prompt-cache keys follow the model, instructions and tool schemas instead of the session, so new sessions and task children with the same prefix reuse one cache. A goal waiting on a subscription limit retries at the provider's reset time instead of hammering the spent account. On Windows, input sent while a turn is running no longer gets stuck or races through the whole fallback chain. Switching a long conversation to a smaller-context model while the current one is at its limit now applies at the next message, saving an API key over an OAuth login (or the reverse) replaces the credential instead of storing one that is never used, a busy command monitor is no longer muted after 200 lines a day, and every assistant reply records its timing (time to first token and generation rate).
+
+**OmO records when an answer says "tests pass" or "done" with nothing in the session behind it.** When a turn's final answer says tests pass, a build or typecheck is clean, a feature already exists, or the work is done, OmO checks the session for a check that passed after the last code edit, and records in the session whether the claim is backed. It starts in shadow mode: nothing is shown to you or the agent and no turn is blocked or continued, because on a week of our own sessions most flags were still false positives. Setting the `omo-senpi-claim-receipt-nudge` flag turns on a short note under a flagged answer (once per message you send) and passes the flagged claims to a gate reviewer spawned afterwards. ([#10785](https://github.com/code-yeongyu/oh-my-openagent/pull/10785))
+
+**`omo doctor --models` shows which model every task category and agent runs, and `exclude_models` keeps a model out of all of them ([#10763](https://github.com/code-yeongyu/oh-my-openagent/pull/10763)).** The new doctor view prints, per category and agent, the model a spawn runs first, the retry chain in order, and each rung's source (built-in, omo.json, or the category an agent borrows) with why it does or does not run: excluded, no login, or not reached. It reads the same resolvers spawns use, and `--json` gives the same view to scripts. The new top-level `exclude_models` list (`provider/model`, a bare model id, or a `*` pattern such as `"claude-fable-*"`) is honored by category and agent chains, memory children (the session model they would inherit included), the main session's model profile, explicit task pins, and task children respawned or resumed on a recorded model, including their recorded fallback chains. Before, no setting could stop a builtin rung from running; only logging out of its provider did (#10759).
+
+**Geeky becomes Obsessive.** The two GPT lanes' display names are now Obsessive · Normal and Obsessive · Heavy, with one-line descriptions to match and a shared caution, NOT RECOMMENDED FOR WRITING OR EVERYDAY WORK., that the session-start notice renders in bold; the `geeky-normal` and `geeky-heavy` ids and the `family` they report stay unchanged, so a saved `model_profile`, a picker choice or a user overlay keeps resolving exactly as before. A `model_profiles` entry may set its own `caution` string, and one that replaces a builtin inherits its caution when it does not. ([#10608](https://github.com/code-yeongyu/oh-my-openagent/pull/10608), [#10590](https://github.com/code-yeongyu/oh-my-openagent/issues/10590))
+
+**Obsessive · Normal leads with GPT-6 Astra at medium.** The `geeky-normal` model profile resolves GPT-6 Astra at medium on every GPT provider first, with its GPT-6.1 Sol Fast, GPT-6.1 Sol and GPT-5.6 Sol rungs kept as availability fallbacks; Obsessive · Heavy keeps Astra at high. ([#10608](https://github.com/code-yeongyu/oh-my-openagent/pull/10608), [#10590](https://github.com/code-yeongyu/oh-my-openagent/issues/10590))
+
+**Memory sync can verify and seal real batches.** The sync engine now has a production verifier and sealer: each row another device appended is checked against this device's verified copy of the account chain, then opened with the epoch key the device holds, and only that memory's own notes reach it. Outgoing batches are encrypted, signed and linked the same way. Nothing uses this yet; the device sign-in that opens a session comes next. ([#10625](https://github.com/code-yeongyu/oh-my-openagent/issues/10625), [#10627](https://github.com/code-yeongyu/oh-my-openagent/pull/10627))
+
+**A signed-in device now reaches memory sync.** Memory sync used to stay idle on every device, because nothing gave it the device's sign-in. It now reads the device `omo login` signed in, and the key pair that device registered, then opens the account's sync for that memory. A device that is signed in but has not joined the account's memory yet says so instead of reporting no sign-in. When the device signs out or is removed, sync closes and goes back to idle. ([#10625](https://github.com/code-yeongyu/oh-my-openagent/issues/10625), [#10630](https://github.com/code-yeongyu/oh-my-openagent/pull/10630))
+
+**A subtask whose category has no model left now finishes on the model your session runs.** When every model in a delegated task's category is out (its usage limit is spent or its provider is not signed in), the task continues on your session's model in the same conversation, so tool calls it already finished are not run again. Before, it stopped with a usage-limit error even though your own model was working. The task's row, `task_output` and the completion notice say which model it ran on and why, for example `parent-model:usage limit, resets 3:20am`, and name any tool call the limit cut off, which never ran. Categories with a model that still works route exactly as before, and a session model on the same spent account still ends with the old error. Until the engine can limit this to spent or signed-out models, a task whose category models all fail for another reason, such as an overload, also continues on your session's model and says so ([#10750](https://github.com/code-yeongyu/oh-my-openagent/issues/10750), [#10772](https://github.com/code-yeongyu/oh-my-openagent/pull/10772)).
+
+**Git worktrees of one repository can share the main checkout's memory.** Set `memory.auto_identity: "git"` (for example in `~/.omo/omo.jsonc`, so worktrees created outside the main checkout see it) and every linked worktree, including the ones Orca creates per agent, reads and writes the main checkout's memory instead of starting empty. The main checkout keeps its existing memory, sessions that are already bound keep theirs, and the default `"path"` leaves behavior unchanged. ([#9659](https://github.com/code-yeongyu/oh-my-openagent/issues/9659), [#10047](https://github.com/code-yeongyu/oh-my-openagent/pull/10047))
+
+
+## [5.1.41] - 2026-10-22
+
+**The engine moves to senpi 2026.10.21-1: engine hosts start faster and idle far more quietly, Claude subscriptions use the native 1M context again, and desktop threads are lighter ([#10740](https://github.com/code-yeongyu/oh-my-openagent/pull/10740)).** A new engine host starts about 0.1 s faster, and an idle engine host wakes 405 times per 90 s instead of 1,106. Current Claude subscription models (Fable 5, Sonnet 5, Haiku 5.5, Opus 4.7 and later) get their native 1M window back without asking for extra usage, and the Claude subscription lane runs Claude Code 2.1.306. Each desktop thread's engine supervisor starts from its own small program instead of the whole CLI, and messages and tool cards no longer keep duplicate copies (about 640 bytes per message and 2 KB per tool card). Models that models.dev marks deprecated stay available, labeled deprecated, instead of disappearing (GitHub Copilot Claude Opus 4.7, GPT-5.5 and GPT-5.4, Baseten Kimi K2 and others), and the model catalog is refreshed; some models get updated thinking levels (for example Nemotron 3 Ultra: off is now none). A message that was already delivered no longer stays listed under Steering, and with several accounts for one provider a usage limit stops failing turns once its reset has passed; a quota failure now says when it resets.
+
+**Memory sync refuses signatures under weak Ed25519 keys.** Bun's WebCrypto accepts a signature made under a small-order public key, such as the identity key, for any message. The sync client now checks every key and signature it verifies itself, and refuses any keyring record that would bring a weak or malformed signing key into the account's keyring, including keys that appear only inside a fork-resolution's evidence. ([#10743](https://github.com/code-yeongyu/oh-my-openagent/pull/10743), fixes [#10742](https://github.com/code-yeongyu/oh-my-openagent/issues/10742))
+
+**Outside full access, computer use asks before it acts on your screen as a whole.** Clicks, typing, key presses, scrolling, drags, pointer moves and holds aimed at the desktop or a display land on your real pointer and frontmost app, so they now need the same "Allow foreground computer control?" approval as foreground input; without it they fail with `ControlRequired` and nothing is sent. Input to one window in the background still needs no approval, and full access keeps working without a prompt, headless runs included. The macOS background check no longer moves your pointer back after you moved it, and a stopped session stays stopped when the desktop engine restarts. ([#10788](https://github.com/code-yeongyu/oh-my-openagent/issues/10788), [#10790](https://github.com/code-yeongyu/oh-my-openagent/pull/10790))
+
+**OmO counts how often you had to repeat a standing instruction ([#10780](https://github.com/code-yeongyu/oh-my-openagent/issues/10780), [#10786](https://github.com/code-yeongyu/oh-my-openagent/pull/10786)).** Rules like "never filter the monitor output" now live in `system/agreements.md` with a count. When you correct the agent on something an agreement already covers, the count goes up; after the third time (`memory.agreements.needs_human_threshold`) the agent is told the rule keeps being broken and you see a notice. `/agreements` lists them and lets you add your own, acknowledge one, or drop one; the agreements you add can only be changed by you. The design is inspired by dinobot by roach (PolyForm Noncommercial 1.0.0); no dinobot code was used.
+
+**The launcher deletes a legacy `~/.omo/credentials.json` left by an intermediate sign-in build.** The file held the device's private keys and account refresh material in plaintext, sometimes world-readable; upgrading removes it. Only the exact legacy shape is removed. ([#10697](https://github.com/code-yeongyu/oh-my-openagent/issues/10697), [#10698](https://github.com/code-yeongyu/oh-my-openagent/pull/10698))
+
+**Report a problem from inside OmO ([#10546](https://github.com/code-yeongyu/oh-my-openagent/pull/10546)).** `/feedback` (or `/bug`) sends a bug report or an idea to the OmO team in one step: your description plus your account, this device, versions, this conversation's recent messages, recent logs and your settings. Passwords, keys and tokens are removed first with the same redactor `/share` uses, your memory is never sent, and `OMO_DISABLE_FEEDBACK=1` saves the report as a local file instead of uploading it. The desktop app's Report a problem dialog uses the same report.
+
+**A DAG node whose child dies on infrastructure is retried instead of taking its whole branch down.** When a mass-ulw node's child stops answering its heartbeats or loses its host session, the node is now retried automatically, at most twice, with a backoff. Its dependents are skipped only if the retries fail too. Before, one starved wave failed and every later node was skipped (an overloaded machine skipped 54 of 61 nodes). Task failures and cancelled nodes behave as before, and the TUI and the desktop app share this behaviour ([#10605](https://github.com/code-yeongyu/oh-my-openagent/issues/10605), [#10616](https://github.com/code-yeongyu/oh-my-openagent/pull/10616)).
+
+**Stopping a language server on Windows no longer raises a stray broken-pipe error.** When an LSP server's pipe closed while OmO was shutting the server down, Windows could report the failed write after cleanup had already let go of it, and the EPIPE escaped as an unhandled error. Every pipe of a spawned language server now keeps an error handler for its whole life, so the failure is logged as ignored cleanup noise ([#9601](https://github.com/code-yeongyu/oh-my-openagent/issues/9601), [#10725](https://github.com/code-yeongyu/oh-my-openagent/pull/10725)).
+
+**The frontend skill now covers HTML reports, figures and slides, and its stripe check catches square callouts.** The skill now loads for any HTML, CSS or SVG made for visual output (a report printed to PDF, a figure, a diagram, a slide, an image for Notion or Slack), not only web UI. Its `check-accent-stripes.ts` linter fails a coloured bar along one side of a box whether the box is rounded or square, and a 2px-or-wider accent outline on a rounded card. Neutral hairlines, table rules, a blockquote's neutral rule, focus rings and input validation states stay allowed. The `visualize` skill runs the linter on every page before previewing or showing it ([#10774](https://github.com/code-yeongyu/oh-my-openagent/issues/10774), [#10776](https://github.com/code-yeongyu/oh-my-openagent/pull/10776)).
+
+**`ulw-research` shows its report inline and checks a visual reproduction against the source ([#10812](https://github.com/code-yeongyu/oh-my-openagent/pull/10812)).** When the host can show an HTML page in the thread (`show_html_page`, `html_render`), the run ends with the report there, before the file paths, on every tier and even when the research was shortened; a built app or 3D scene shown inline no longer stands in for it. When the ask is to recreate something visual, such as a clip rebuilt in 3D, the run puts real frames of the source next to its own output at the same moments, writes down what differs, fixes the biggest gaps, and shows the side-by-side pairs in the report.
+
+
+### Changed
+
+- Combine macOS root-test shards and Codex/Senpi compatibility into one runner job, preserving their existing check names through Ubuntu status jobs. Full-matrix CI now requests two macOS runners per head instead of five, including unchanged native binary parity; fast paths skip the combined allocation ([#10804](https://github.com/code-yeongyu/oh-my-openagent/pull/10804)).
+
+- CI: pull requests run the macOS and Windows legs only when a platform-specific path changes: any path a macOS/Windows-only CI step names (derived from the workflow), native crates, the launcher and platform packaging, the Windows Git Bash runtime, the Codex installer, platform-named sources, and the CI workflows. Pushes to `dev` and merge groups still run every OS, and the `run-full-ci` label forces the full matrix on a pull request ([#10856](https://github.com/code-yeongyu/oh-my-openagent/issues/10856)). ([#10859](https://github.com/code-yeongyu/oh-my-openagent/pull/10859))
+
 ## [5.1.40] - 2026-10-20
 
 **Onboarding saves only the facts you keep, and the TUI and the desktop share one completion flag.** The facts you accept are written through memory's own write path, and finishing onboarding in either the TUI or the desktop marks it done for both. ([#10506](https://github.com/code-yeongyu/oh-my-openagent/pull/10506))

package/plugin/extensions/dream-persona.md

@@ -32,7 +32,7 @@ Work with bounded reads. Determine file size first with `wc -c`; read small file
 The primary agent's context (its prompts, skills, and external memory files) is stored in a memory filesystem rooted at `$MEMORY_DIR`. Changes to these files reach the primary agent's context after they're committed to the memory git repo.
 
 The filesystem contains:
-- **Prompts** (`system/`): always in-context. Reserve for identity, preferences, conventions, and active project context the agent needs on every turn. Keep files concise; move verbose content to external memory. `system/boundaries.md` is the user's exact words about what the agent must not do: leave it as you found it. `system/self-aware.md` is yours: promote a line from `reference/self/observations.md` when a later outcome confirmed it, edit entries in place, keep at most 12, and move expired or disconfirmed ones to `reference/self/ARCHIVE.md`. Identity stays in persona; the user's words stay in boundaries.
+- **Prompts** (`system/`): always in-context. Reserve for identity, preferences, conventions, and active project context the agent needs on every turn. Keep files concise; move verbose content to external memory. `system/boundaries.md` is the user's exact words about what the agent must not do: leave it as you found it. `system/agreements.md` is the counted agreement ledger; do not edit it (the run is rejected if you do), because its counts are kept by the facts lane and `/agreements`. `system/self-aware.md` is yours: promote a line from `reference/self/observations.md` when a later outcome confirmed it, edit entries in place, keep at most 12, and move expired or disconfirmed ones to `reference/self/ARCHIVE.md`. Identity stays in persona; the user's words stay in boundaries.
 - **Skills** (`skills/`): procedural memory for specialized workflows.
 - **External memory** (everything else): reference material retrieved on demand by name and description. This includes `notes/facts/<YYYY-MM>.md` fact files and `people/` observation ledgers.
 
@@ -52,7 +52,7 @@ Read `$AUDIT_PATH` and repair findings before consolidation:
 - `path_orphan`: use `git mv` into the home its content belongs to.
 - `frontmatter_invalid`: leave to the writer owning the file unless only the description is missing.
 
-Never touch `system/boundaries.md` or delete evidence. Report unresolved findings with reasons.
+Never touch `system/boundaries.md` or `system/agreements.md`, and never delete evidence. Report unresolved findings with reasons.
 
 ## Phase 2: Consolidate
 

package/plugin/extensions/facts-persona.md

@@ -13,4 +13,15 @@ Use `scope: "person"` only for an explicit proper name, a known alias from the p
 
 Use absolute dates. Resolve relative dates against `today` in the payload. Omit ephemera, guesses, plans not adopted, transient task state, and facts already contradicted in the same transcript. Keep each record self-contained and preserve the stated meaning without adding inference.
 
-Call nothing when no durable fact qualifies.
+## Agreements
+
+When the payload has `agreements` and the `record_agreement` tool is available, treat every correction, prohibition, or standing instruction from the person about how the agent must work as an agreement, not a fact. Cues include "again", "I told you", "never", "stop doing", "how many times", 자꾸, 또, 다시는, 몇 번 말해야.
+
+- If an item in `agreements` already requires what the person is correcting, call `record_agreement` with `{"action":"reaffirm","id":"<that item's id>","date":"YYYY-MM-DD"}`. Add `"text"` with a stronger wording only when that item is `by: "agent"`; never reword a `by: "human"` item.
+- Otherwise call it with `{"action":"new","applies":"global"|"project","text":"...","date":"YYYY-MM-DD"}`. Use `project` when the rule is about this repository only. Write the text as one imperative rule in the person's language, at most 240 characters.
+- One call per correction event. A correction repeated twice in the payload is two reaffirms. Never invent an id.
+- Only the person's own words in user turns count. An agent's suggestion, plan, or recommendation is never an agreement, even when the person did not object to it.
+
+Facts about how to treat the person stay `record_fact` person records; rules about how the agent must work go to `record_agreement`.
+
+Call nothing when no durable fact or agreement qualifies.

package/plugin/extensions/gateway-rules-extension.mjs

@@ -1,2 +1,2 @@
-// omo:Kcq2bQdUERce5dG0ffmgL4ZP73NYCL9gV6hNY6iD4-0:5LLt7853QZ0R275mM__hYa8UeDUj-ySee_PqmOY8R7U
+// omo:E7JXJ6LzVrHaMKRkWNlHWq0HbBiFzPKOood_scJBn2M:5LLt7853QZ0R275mM__hYa8UeDUj-ySee_PqmOY8R7U
 function e(e){return e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;")}function r(r,s){let i=[`<operating-rules version="${e(r).replaceAll('"',"&quot;")}">`];for(let r of s)i.push(`- ${e(r)}`);return i.push("</operating-rules>"),i.join("\n")}function s(e,r){if(null===e||"object"!=typeof e||Array.isArray(e))throw Error(`${r} must be an object`);return e}function i(e,r){let s=e[r];if("string"!=typeof s||0===s.length)throw Error(`${r} must be a non-empty string`);return s}function o(e){let r=s(e,"a rules target"),o=i(r,"session_durable_id"),n=r.binding_id;if(null!=n&&"string"!=typeof n)throw Error("binding_id must be a string");let t=r.behavioral;if(null===t)return{session_durable_id:o,binding_id:n??void 0,behavioral:null};if(!Array.isArray(t)||!t.every(e=>"string"==typeof e))throw Error("behavioral must be an array of rule texts, or null to clear the session's rules");return{session_durable_id:o,binding_id:n??void 0,behavioral:t}}function n(e,r){let o=i(s(r,"blockForSession args"),"session_durable_id"),n=e.one(["version","block"],"SELECT version, block FROM gateway_rules_blocks WHERE session_durable_id = ?",[o]);return void 0===n?null:{version:String(n.version),block:String(n.block)}}function t(e,r){let o=i(s(r,"sessionsWithRules args"),"scope");return{sessions:e.all(["session_durable_id","version"],"SELECT session_durable_id, version FROM gateway_rules_blocks WHERE scope = ?",[o],"session_durable_id").map(e=>({session_durable_id:String(e.session_durable_id),version:String(e.version)}))}}async function l(n,t){let l=s(t,"rulesCommitted args"),a=i(l,"scope"),d=i(l,"version"),u=l.now??Date.now();if("number"!=typeof u||!Number.isFinite(u))throw Error("now must be a finite timestamp");if(!Array.isArray(l.targets))throw Error("targets must be an array");let _=[];for(let s of l.targets){let i=o(s);if(null===i.behavioral){let e=n.exec("DELETE FROM gateway_rules_blocks WHERE session_durable_id = ?",[i.session_durable_id]);_.push({session_durable_id:i.session_durable_id,outcome:e>0?"removed":"absent"});continue}let t=r(d,i.behavioral),l=n.exec("INSERT INTO gateway_rules_blocks (session_durable_id, scope, version, block, updated_at) VALUES (?, ?, ?, ?, ?)\n       ON CONFLICT(session_durable_id) DO UPDATE SET scope = excluded.scope, version = excluded.version, block = excluded.block, updated_at = excluded.updated_at\n       WHERE gateway_rules_blocks.version != excluded.version",[i.session_durable_id,a,d,t,u]);if(void 0===i.binding_id){_.push({session_durable_id:i.session_durable_id,outcome:l>0?"updated":"unchanged"});continue}let c=await n.enqueue({binding_id:i.binding_id,event_id:`rules_changed:${a}:${d}:${i.session_durable_id}`,text:[`<operating-rules-changed scope="${e(a).replaceAll('"',"&quot;")}" version="${e(d).replaceAll('"',"&quot;")}">`,"The operating rules for this gateway scope changed; this session's system prompt carries the new block from its next turn.","</operating-rules-changed>"].join("\n"),mode:"follow_up"});_.push({session_durable_id:i.session_durable_id,outcome:l>0?"updated":"unchanged",delivery:"ok"===c.kind?{kind:"ok",delivery_id:c.delivery_id,deduplicated:!0===c.deduplicated}:{kind:"error",error:c.error}})}return{scope:a,version:d,outcomes:_}}export{n as blockForSession,l as rulesCommitted,t as sessionsWithRules};