owfadev 0.0.1 → 0.3.1

package/.meta/plugins/core/todo/PLUGIN.md

@@ -0,0 +1,33 @@
+# todo: temporary memory
+
+## Design Overview
+
+- **Why it exists**: the cross-session delegation queue — a new session cannot reach past conversations under SASU-L; system prompt, AGENTS, skills, and the user's own words carry none of it; this page plus the AGENTS injection-line pointer is a mount point on the L layer. In essence a **collection of pointers to future moments**, an explicit instance of time-dimensional pointers: upon delegation one writes down 'act when this line is read at such a time' — the agent is a pointer executor
+- **Key rulings**:
+  - The first settleable page in the whole library: delegated, reminded on trigger, settled — `[x]` plus a log line — cleanup being silent deletion of settled entries beyond a cap of 20. log is append-only, notes append-only, profile converges with traces; only todo has settlement semantics. History goes to log; this page keeps only the live working set
+  - Read-priority order: a new session reads this page first, before hot — there may be due delegations requiring proactive action; hot is merely context warm-up
+  - No attached command — a pattern exception, by design ruling: entry format minimal, no pipeline linkage; the read/write contract travels with the injection line
+  - Two trigger kinds: date — YYYY-MM-DD, mechanically scannable; and context, semantically activated
+
+## Structure
+
+- `wiki/todo.md` single page, type: todo; self-created on first delegation. An entry = a list item `- [ ] trigger: content (by, at)`; triggers come in two kinds, date and context
+- Zero page fields: entry-level by and at use the global actor convention, see the registry header; settlement history is written to `wiki/log.md` — crossing into the log plugin's territory, the reason for depends log
+
+## Invariants
+
+- Full entry lifecycle: delegated; reminded on trigger; settled — `[x]` plus a log line; cleaned up — settled capped at 20, silently deleted, log already holding the record. The first settleable page in the whole library: log append-only, notes append-only, profile converging with traces; only todo has settlement semantics
+- This page keeps only the live working set; history goes to log: settlement events recorded as they happen, type todo; cleanup is not an event and is not recorded
+- Valuable delegations are distilled into knowledge via save upon completion; this page keeps no history
+- Read-priority order: a new session reads this page first, before hot — there may be due delegations requiring proactive action; hot is merely context warm-up
+- No attached command — a pattern exception, by design ruling: entry format minimal, no pipeline linkage; the read/write contract travels with the injection line
+
+## Bridge: on-demand
+
+A derivation-destination bridge governing action items: domain plugins one-way derive action items into this page, out-only. Constitutional principle 11. Attachment cardinality **on-demand** — domain plugins with such derivations declare it themselves or inherit it via a base, absence tolerated. Format authority is in this plugin's usage, projected to the point of consumption — division-of-labor ruling. This section elaborates: the deriving side creates no pages and invents no formats; an entry takes exactly this page's entry form; the domain plugin keeps a one-sentence self-description disclosure, SASU-L.
+
+## Changelog
+
+- 0.4 (2026-10-06) inject line compressed to pointer density (issue #12 layer discipline) — procedural detail lives in usage / PLUGIN.md / skills- 0.3 2026-10-02: global-domain batch two — established the on-demand bridge as the derivation destination; domain-plugin self-descriptions retained with a pointer
+- 0.2 2026-10-02: added 'create on absence' — when a new session's first read finds todo.md absent, it creates an empty page, so the entry discipline never falls through; guideline registration entry revised, empirically verified
+- 0.1 2026-09-14: established — the `wiki/todo.md` delegation queue, type: todo entered the registry territory values; settlement history goes to log, the log type value set extended with todo; no attached command — the write contract travels with the injection line

package/.meta/plugins/core/todo/PLUGIN.yaml

@@ -0,0 +1,22 @@
+id: todo
+schema_version: 1
+version: 0.4
+bridge: 按需
+depends:
+  - wiki
+  - log
+updated: 2026-10-06
+attachment:
+  - "wiki/todo.md — temporary memory page (cross-session delegation queue)"
+fields: {}
+inject: "Temporary memory wiki/todo.md (type: todo): cross-session delegations and reminders; entry = trigger condition (date or context) + one sentence + by/at; read first at session start (before hot; absent → create empty); due or past entries raised proactively; append upon delegation, settle upon completion ([x] + log line, history to log); settled capped at 20; live working set only; on-demand bridge — domain plugins one-way derive action items in"
+usage:
+  - Append upon delegation: `- [ ] <date YYYY-MM-DD or context phrase>: one sentence (by: <actor>, at: <date>)`; date entries are mechanically scannable, context entries are semantically activated
+  - Read this page first at the start of a new session (before hot; if absent, create an empty page): entries with now ≥ trigger day are proactively raised with the user; overdue and unsettled entries keep being raised, marked overdue
+  - Settlement = `[ ]`→`[x]` + a log line (type todo, one sentence covering content and delegation date) — events recorded as they happen, history goes to log
+  - Cleanup: settled entries capped at 20, silently delete the oldest beyond the cap (log already holds the settlement record, deletion is not an event); valuable content is distilled via save upon completion; this page keeps no history
+  - Self-create the page upon first delegation (frontmatter: type: todo + generated), independent of any initialization mechanism
+checks:
+  - Mechanical (info-level): the list of date-triggered, overdue and unsettled entries (the mechanical basis for new-session reminders); page absent (the no-delegation norm)
+  - Mechanical: entry missing trigger condition or by/at → warning; type: todo landing outside `wiki/todo.md` → error
+  - Semantic (check command): open entries > 50 → warning (bloat triage: do what should be done, distill what should be distilled via save, confirm with the user what should be dropped)

package/.meta/plugins/core/trust/PLUGIN.md

@@ -0,0 +1,70 @@
+# trust: Trust Fields
+
+## Design Summary
+
+- **Why it exists**: knowledge ages — turn "is this piece of knowledge still trustworthy" from re-reading the full text into reading a field. A cross-cutting field plugin: four trust fields, claimed from the registry-reserved section, shared repository-wide; a mandatory bridge attached to all domain bases
+- **Key rulings**:
+  - Level derivation is never persisted: pure computation at read time — unverified, machine-confirmed, human-reviewed, stale. The regenerable zone does not create a second truth that would drift
+  - All four fields optional: not written = unverified, blocking no read or write — trust is an enhancement, not a threshold
+  - verified is append-only, never rewritten: events are history; appends are triggered by review actions, reviews are initiated by the user, agents never spontaneously; never fabricated to inflate the level
+  - The semantics of stale_after is "if no one reviews after this point, it should be considered expired" — refreshing it is itself a renewal decision
+
+## Structure
+
+- `generated`: block-style mapping of `by` plus `at` — actor convention plus YYYY-MM-DD; who generated the page. map and save write it along the way when producing proxy pages and notes
+- `verified`: event list; items single-line `by: <actor>, at: <date>`; appendable multiple times, i.e. the review history. Who may write: human review, and mechanical verification by agent or process such as hash recalculation
+- `stale_after`: YYYY-MM-DD absolute moment; semantics "if no one reviews after this point, it should be considered expired"; refreshing it = a renewal decision
+- `sources`: source list; items contain id, resource, credibility signals — author, usage_count, last_modified
+
+## Example
+
+```yaml
+generated:
+  by: agent/GLM-5.3
+  at: 2026-09-12
+verified:
+  - "by: process:hash-recalc, at: 2026-09-12"
+  - "by: human:Joss, at: 2026-09-12"
+stale_after: 2026-12-31
+sources:
+  - id: fog-harbor-design-memo
+    resource: vault/fog-harbor/design-memo.md
+    author: human:Joss
+    usage_count: 3
+    last_modified: 2026-09-05
+```
+
+In the example above the level = human-reviewed, containing a human event; after 2026-12-31 reads show stale. All four fields are optional; usually only `generated` is written.
+
+## Level Derivation
+
+Computed at read time, never persisted:
+
+- **unverified**: no verified records
+- **machine-confirmed**: only agent or process events
+- **human-reviewed**: contains a human event, the highest level
+- **stale**: now not earlier than stale_after — independent of the levels above, overrides the display
+
+Derivation must not generate derived pages: the regenerable zone does not create a second truth that would drift; consumers — query, check, viewer — compute per the table above on the fly.
+
+## Invariants
+
+- verified events are append-only, never rewritten; events are history; appends are triggered by review actions, never fabricated to inflate the level
+- Level and stale judgments are pure comparisons, no hidden state
+- All fields optional: not written = unverified, blocking no read or write
+
+## Bridge: mandatory
+
+Field bridge: the trust-field contract shared by all domain plugins across domains, constitution principle 11. Attachment cardinality **mandatory** — all domain bases, i.e. plugins directly depending on domain, must depend on this plugin; kernel validate verifies completeness. Format authority lives in this plugin's usage, projected to the consumption sites, per the division-of-labor ruling. This section details: domain pages may optionally carry the four trust fields; each domain self-declares its trust ceiling, e.g. machine-confirmed; level derivation is computed at read time, never persisted.
+
+## Changelog
+
+- 0.9 2026-10-02: global-domain batch one — established the mandatory bridge, i.e. the field bridge; domain bases must depend on it, kernel verifies completeness
+- 0.8 2026-09-23: added the wiki dependency edge — inner-side plugins attach to wiki, aligning with the domain 0.1 declaration; omitted from the 2026-09-22 domain-ization batch
+- 0.7 2026-09-13: usage gained the verified production channel — reviews are initiated by the user, agents never append spontaneously; expert review: the input channel was idling
+- 0.6 2026-09-13: injection source moved to the manifest — removed Checks, Usage, Inject, Attachments sections, md returned to pure documentation
+- 0.5 2026-09-13: established the "Usage" section — the write-side contract is projected by the command's injection region, a single text source
+- 0.4 2026-09-12: manifest dropped layer — layering abolished: injection order changed to dependency topology plus alphabetical order, direction checks removed
+- 0.3 2026-09-12: identifiers anglicized — section headers, attached-audit contract keys, type enums, pipeline call parameters
+- 0.2 2026-09-12: disclosure patch — inlined a full-shape example of the four fields; cold-start audit guess point: spec without instances
+- 0.1 2026-09-11: established — claimed the four registry-reserved fields and backfilled the plugin section; level derivation never persisted; attached audit covers the field contract, the stale list, and trust-level counts

package/.meta/plugins/core/trust/PLUGIN.yaml

@@ -0,0 +1,23 @@
+id: trust
+schema_version: 1
+version: 0.9
+bridge: 必依
+depends:
+  - wiki
+updated: 2026-10-06
+attachment:
+  - "scripts/check.py — attached audit (trust-field contract + stale list + trust-level counts)"
+fields:
+  generated: "block-style mapping by/at (actor convention + YYYY-MM-DD), who generated the page"
+  verified: "event list, items single-line `by: <actor>, at: <date>`, appendable multiple times; the trust level is derived from this"
+  stale_after: "YYYY-MM-DD absolute moment; expiry check = the pure comparison now ≥ stale_after"
+  sources: "source list, items contain id / resource / credibility signals (author, usage_count, last_modified)"
+inject: "Trust fields (optional per page): `generated` (who generated it) / `verified` (event list, items single-line by+at) / `stale_after` (expiry moment) / `sources` (sources and signals); level derivation never persisted — no record = unverified, only agent/process = machine-confirmed, contains human = human-reviewed, past stale_after = stale"
+usage:
+  - When writing a page, write `generated` along the way (block style: `by: agent/<current-model>` / `at: <today>`)
+  - When a review action happens, append a `verified` event (single line `by: <actor>, at: <date>`), never fabricated to inflate the level
+  - Reviews are initiated by the user (triggered by human instruction); agents never append verified events on their own
+checks:
+  - Mechanical items (attached-audit script `scripts/check.py`, executed on audit discovery): generated missing by/at or wrong actor format, verified event missing by/at or wrong format, stale_after not YYYY-MM-DD, sources not a list → warning
+  - Mechanical items (info level): stale page list (past stale_after); trust-level counts (human-reviewed / machine-confirmed counts)
+  - Semantic (check command): stale-page disposition triage (refresh the moment / re-verify / deprecate) — human decides

package/.meta/plugins/core/trust/scripts/check.py

@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""trust plugin attached audit: mechanical items (trust-field contract / stale list / trust watermark).
+
+Triage of stale pages (refresh stale_after, re-verify, or deprecate) is a semantic item, under the check command.
+"""
+import datetime
+import re
+
+ACTOR_RE = re.compile(r"^(human:.+|process:.+|agent/.+)$")
+DATE_RE = re.compile(r"^\d{4}-\d{2}-\d{2}$")
+
+
+def _bad_actor(val):
+    return not ACTOR_RE.match(str(val))
+
+
+def _bad_date(val):
+    s = str(val)
+    if not DATE_RE.match(s):
+        return True
+    try:  # calendar validity (dates like 2026-13-99 that match the format but are not real dates)
+        datetime.date.fromisoformat(s)
+        return False
+    except ValueError:
+        return True
+
+
+def check(ctx):
+    issues = []
+    today = datetime.date.today()
+    reviewed = confirmed = 0
+    for rel, fm, body in ctx.pages:
+        gen = fm.get("generated")
+        verified = fm.get("verified")
+        stale_after = fm.get("stale_after")
+        if gen is not None:
+            if not isinstance(gen, dict):
+                issues.append({"level": "warning", "message": f"{rel}: generated should be a block mapping by/at"})
+            elif gen.get("by") is None or gen.get("at") is None:
+                issues.append({"level": "warning", "message": f"{rel}: generated missing by or at"})
+            else:
+                if _bad_actor(gen["by"]):
+                    issues.append({"level": "warning", "message": f"{rel}: generated.by {gen['by']!r} does not match the actor convention"})
+                if _bad_date(gen["at"]):
+                    issues.append({"level": "warning", "message": f"{rel}: generated.at {gen['at']!r} not YYYY-MM-DD"})
+        if verified is not None:
+            events = verified if isinstance(verified, list) else [verified]
+            has_human = False
+            for ev in events:
+                text = ev if isinstance(ev, str) else str(ev)
+                m_by = re.search(r"by:\s*(.+?)(?:\s*,\s*at:|$)", text)
+                m_at = re.search(r"at:\s*(\S+)", text)
+                if not m_by or not m_at:
+                    issues.append({"level": "warning", "message": f"{rel}: verified event missing by or at ({text.strip()!r})"})
+                    continue
+                by, at = m_by.group(1).strip(), m_at.group(1).rstrip(",");  # tolerate trailing comma
+                if _bad_actor(by):
+                    issues.append({"level": "warning", "message": f"{rel}: verified.by {by!r} does not match the actor convention"})
+                if _bad_date(at):
+                    issues.append({"level": "warning", "message": f"{rel}: verified.at {at!r} not YYYY-MM-DD"})
+                if by.startswith("human:"):
+                    has_human = True
+            if has_human:
+                reviewed += 1
+            else:
+                confirmed += 1
+        if stale_after is not None:
+            if _bad_date(stale_after):
+                issues.append({"level": "warning", "message": f"{rel}: stale_after {stale_after!r} not YYYY-MM-DD"})
+            elif datetime.date.fromisoformat(str(stale_after)) <= today:
+                issues.append({"level": "info", "message": f"{rel}: past stale_after ({stale_after}) — stale page, disposal belongs to the human"})
+        if fm.get("sources") is not None and not isinstance(fm.get("sources"), list):
+            issues.append({"level": "warning", "message": f"{rel}: sources should be a list"})
+    if reviewed or confirmed:
+        issues.append({"level": "info", "message": f"trust watermark: human-reviewed {reviewed} pages / machine-confirmed {confirmed} pages (the rest unverified)"})
+    return issues

package/.meta/plugins/core/user-profile/PLUGIN.md

@@ -0,0 +1,39 @@
+# user-profile: user profile
+
+## Design Overview
+
+- **Why it exists**: a continuing cognition profile of the user — turning 'who the user is and what they prefer' from conversational memory into a checkable page: assertions carry evidence, preferences expire, updates leave traces. Positioned as the user profile of the agent memory line, facing the real user; not the fictional persona of the product-design line. The dimension framework borrows from the former's research, the update mechanism from the latter; selection rationale in `research-user-profile.md`
+- **Key rulings**:
+  - Convergence-style updates: new values replace old ones, trace left in the body — distinct from notes' append-only; the profile page is the first semantically updatable page in the whole library
+  - Zero own fields: traces and trust fully reuse trust; dimensions not enumerated, the architecture presets no field list
+  - Assertion evidence = inline wikilinks in the body, pointing to any page inside wiki — a citation is a link, no cross-domain mechanism dependencies
+  - Updates uniformly go through the profile command, shedding the map/save parasitism on 2026-09-29; dual-track triggering: explicit user request, or the agent recognizing significant signals
+  - The mapping edge was removed 2026-10-02: under the bridge law it reached domain via the vault chain, causing a global plugin to be misjudged — caught by an actual kernel test; the 'hanging edges are harmless' premise failed
+  - Privacy double safeguard: diary-type assets record only meta-signals, content never entering the profile; profile content is instance data, never entering the repo
+
+## Structure
+
+- `wiki/profile.md` — a single-page profile, type: profile. Static identity layer — form of address, language, background — and dynamic preference layer — subjects, style, habits — in open sections; dimensions not enumerated
+- Zero own fields: traces and trust fully reuse trust, namely generated, verified, stale_after, sources
+- Assertion evidence = inline wikilinks in the body, pointing to any page inside wiki — session pages, vault proxy pages, lark archive pages, notes. A citation is a link, no cross-domain mechanism dependencies; three depends edges: wiki, trust, sessions. The mapping edge was removed 2026-10-02 — under the bridge law it reached domain via the vault chain, causing a global plugin to be misjudged; the 2026-09-29 'hanging edges are harmless' premise failed
+
+## Invariants
+
+- Convergence-style updates: new values replace old ones, trace left in the body, a single line recording who changed what and when — distinct from notes' append-only; the profile page is the first semantically updatable page in the whole library
+- Updates uniformly go through the profile command, dual-track triggering — explicit user request, or the agent's spontaneous call upon recognizing significant signals; since 2026-09-29 free of the map/save parasitism, profile evidence naturally cross-domain
+- Assertions must carry evidence wikilinks; a single incremental assertion is not itself a preference — preferences are patterns aggregated within the page
+- Diary-type assets record only meta-signals — presence, cadence; content never enters the profile. The exemption followed mapping; a second privacy red-line safeguard
+- Privacy red line: profile content is instance data, never entering the framework repo or test-repo
+- The profile page carries no tags: a single-page territory, read directly, not in vocabulary retrieval — an explicit decision, not an omission
+- Profile page absence is not an error: untriggered is the norm; profile self-creates on first trigger, independent of any initialization mechanism
+
+## Bridge: on-demand
+
+The cognition bridge: the global profile's extension point toward domain-level cognition pages, constitutional principle 11. The profile body carries a `## Domain Cognition` section; a line = domain name plus a path-form wikilink to the cognition page, bb-track user.md the first case, the path form wildcarding multiple courses and archives. Attachment cardinality **on-demand**: domain plugins with cognition profiles register, and registration is maintained by the domain plugin's archive-creation action; if the profile is absent the domain plugin works as usual — on-demand bridge absence tolerance; even with the profile present it only aggregates pointers, never copying domain state. Consumption discipline: before personalized output, read the profile **and its registered cognition pages** — the bridge holds only 'who is present, where to read'; cognition-page shape knowledge belongs to the domain plugins, each disclosing its own, SASU-L. The zero-own-fields ruling stands unbroken: registration goes through a body section, never touching frontmatter. Line-format authority lives in the registering-side domain plugin's usage, the bb-track precedent; this section is the elaboration — division-of-labor ruling.
+
+## Changelog
+
+- 0.6 (2026-10-06) inject line: sections lost to the kernel comment-strip clip restored (quoted values are now protected), tightened for budget headroom — issue #12 post-migration nit- 0.5 (2026-10-06) inject line compressed to pointer density (issue #12 layer discipline) — procedural detail lives in usage / PLUGIN.md / skills- 0.4 2026-10-02: global-domain batch three — established the cognition bridge, on-demand: the profile body `## Domain Cognition` registration section, aggregate-don't-copy, read-first discipline; bb-track user.md the first registration; the mapping edge removed — under the bridge law it reached domain via the vault chain, causing a global plugin to be misjudged, caught by an actual kernel test; the 'hanging edges are harmless' premise failed
+- 0.3 2026-09-29: profile command established — the write side shed its parasitism on the map and save dual entry points, both commands' consumes entries removed; the evidence domain opened to any page inside wiki, dissolving the cross-domain ownership suspension; first creation self-builds on trigger, absorbing the profile part of the pending initialization items; tags explicitly not applied; depends kept, ruling: reference-level edges retained, not cut
+- 0.2 2026-09-14: usage added the profile distillation methodology — signal criteria, layered placement, assertions concrete and verifiable; the executable part of the distillation entered the write-side contract, closing the SASU-L disclosure loop: an agent running map or save knows how to distill, without relying on model priors; the full text remains in `docs/research-user-profile.md`
+- 0.1 2026-09-13: established — `wiki/profile.md` convergence-style cognition profile, type: profile entered the registry value set; depends were wiki, trust, mapping, sessions; dual signal channels hung on save and map, consumes inserted after trust and before derivation; three checks — the assertion evidence gate as warning, wrong territory as error, page absence as info-level

package/.meta/plugins/core/user-profile/PLUGIN.yaml

@@ -0,0 +1,30 @@
+id: user-profile
+schema_version: 1
+version: 0.6
+bridge: 按需
+depends:
+  - wiki
+  - trust
+  - sessions
+updated: 2026-10-06
+attachment:
+  - "wiki/profile.md — user profile page (a continuing cognition profile of the user)"
+fields: {}
+commands:
+  - profile
+inject: "User profile wiki/profile.md (type: profile): continuing cognition of the user, static identity + dynamic preference layers, dimensions open; convergence-style updates (new replaces old, trace in body), assertions carry evidence wikilinks, preference layer stale_after; zero own fields, reuses trust; not in the notes territory, no tags; updates via the profile command (dual-track trigger, self-creates on first); read before personalized decisions; cognition bridge — domain cognition pages register one line each in ## Domain Cognition, the profile aggregates pointers only"
+usage:
+  - Dual-track triggering: the user explicitly invokes profile; the agent calls it spontaneously in any session upon recognizing significant signals — signal distillation uniformly goes through this command, not parasitic on other command flows
+  - Signal criteria: self-reported signals (preference expressions, corrections, background) and behavioral signals (subjects, fields, material habits); record only recurring subjects/fields, explicit preference expressions, corrections to output, and stable background facts (identity/tools/environment); one-off and instrumental content and uncertain observations are not recorded
+  - Evidence domain: any page inside wiki works (session pages, vault proxy pages, lark archive pages, notes) — a citation is a wikilink, no cross-domain dependencies established
+  - Layered placement: immutable identity facts go to the static layer; drifting interests and habits go to the dynamic layer with stale_after (renewed as observed)
+  - An assertion = one line of concrete, verifiable claim + inline evidence wikilink ('prefers concise Chinese replies' beats 'likes brevity'); a single incremental assertion is not directly promoted to a preference — preferences are patterns aggregated within the page
+  - Convergence-style updates: when a new value replaces an old one, a trace is left in the body (single line: who changed what, when); full-page rewrites are limited to profile construction/consolidation (preview shown, awaiting confirmation)
+  - First creation: the first trigger self-creates the page (frontmatter: type: profile + generated, dynamic layer carries stale_after), independent of any initialization mechanism
+  - Diary-type assets record only meta-signals (presence, cadence); content never enters the profile (the exemption followed mapping)
+  - Privacy red line: profile content is instance data, never entering the framework repo or test-repo
+  - Cognition bridge registration (a domain-plugin-side action, disclosed on this side): when a domain cognition plugin creates its archive and the profile is present, maintain one line in the profile's `## Domain Cognition` section (domain name + path-form wikilink); if the profile is absent, skip without proxy-creating it (on-demand bridge absence tolerance); multiple courses and archives register via the path-form wildcard (bb: <term>/<course> form)
+checks:
+  - Semantic (check command): profile assertion missing an evidence wikilink → warning
+  - Mechanical: a type: profile page landing in `wiki/notes/` or `wiki/vault/` (wrong territory) → error
+  - Mechanical (info-level): profile page absent (the untriggered norm; profile self-creates on first trigger)

package/.meta/plugins/core/vault/PLUGIN.md

@@ -0,0 +1,28 @@
+# vault: Default Domain
+
+## Design Summary
+
+- **Why it exists**: the first instance of domain, i.e. the **default domain** — a repository holding real assets: any format enters as-is, integrity registered by hash. Dual role: itself a local-file domain; and doubling as the general asset repository where other domains land on demand, the `url` field being the passthrough interface — bb and email attachment materialization goes through this channel
+- **Key rulings**:
+  - Append-only on the command side, freedom to delete and modify belongs to the human: agent writes only produce new files — immutable originals are the foundation of trust; proxies and indexes are all regenerable, only the original is the single truth
+  - A concept-declaration plugin: it only states what vault is and what rules it sets — mapping rules belong to mapping, layout rules to structure, the domain contract to domain; a symmetric division of labor with the wiki side's "concept and structure"
+  - Governance deferred, all three blocks claimed by 0.4: source preservation is the url field; structure rules moved to structure; lifecycle propagation belongs to mapping working with check — a paradigm of establishing the concept first and claiming after real use
+
+## Structure
+
+No structure or scripts of its own. The external territory is the root-level `vault/` container itself; the wiki-side territory is `wiki/vault/`, territory conventions belong to mapping.
+
+## Invariants
+
+- The command side is append-only toward vault: agent writes only produce new files, never modifying existing ones
+- Freedom to delete and modify belongs to the human: deleting, modifying, moving are human rights, commands do not perform them
+- Immutable originals are the foundation of trust: proxies and indexes are all regenerable, only the original is the single truth
+
+## Changelog
+
+- 0.6 2026-10-02: global-domain batch one — added the trust and log mandatory-bridge edges; vault previously lacked even the trust edge, confirmed by audit; constitution principle 11, kernel verifies completeness
+- 0.5 2026-09-22: domain-ization — depends gained domain, i.e. the default-domain positioning, and wiki, i.e. the territory declaration `wiki/vault/`; the dual role spelled out: doubling as the landing repository for other domains, the url field as the passthrough interface
+- 0.4 2026-09-14: all three governance blocks claimed — source preservation, claiming the registry-reserved field `url`, provenance registration for URL-type assets, the write contract in mapping usage; structure rules moved to the structure plugin established at 0.1; lifecycle and change propagation go to mapping reference counting with recomputation audit trails, in coordination with check triage
+- 0.3 2026-09-13: injection source moved to the manifest — removed Checks, Inject, Attachments sections, md returned to pure documentation
+- 0.2 2026-09-13: purification — removed functional references to mapping and check, rules stated self-sufficiently
+- 0.1 2026-09-12: established — concept-declaration plugin; governance deferred: source preservation, structure rules, and lifecycle suggestions to be claimed after real use

package/.meta/plugins/core/vault/PLUGIN.yaml

@@ -0,0 +1,13 @@
+id: vault
+schema_version: 1
+version: 0.6
+depends:
+  - domain
+  - wiki
+  - trust
+  - log
+updated: 2026-10-06
+attachment: []
+fields:
+  url: "Source URL; provenance registration for URL-type assets (source preservation), optional for manual placement, required for agent channels (delegate etc.); also the interface for other domains to land via vault"
+inject: "Default domain — real-asset repository `vault/`, wiki-side territory `wiki/vault/`: holds assets of any format, doubling as the landing repository for other domains (the url field is the passthrough interface); append-only on the command side, freedom to delete and modify belongs to the human; layout rules belong to the structure plugin"

package/.meta/plugins/core/wiki/PLUGIN.md

@@ -0,0 +1,37 @@
+# wiki: The md World
+
+## Design Summary
+
+- **Why it exists**: the **inner root** of the dual-root concept — paired with the outer root domain, it declares what wiki is and how page origin is determined. A concept-declaration plugin: it owns no territory, fields, commands, or scripts, holding only invariants; the "inner" half of Section 8 of mechanics
+- **Key rulings**:
+  - The inner/outer distinction is the first cut: wiki = the totality of the md world — projections of all domains plus native knowledge, the common language layer between agent and human; everything on the outer side belongs to the domain contract
+  - Origin dichotomy, expanded in 0.7 into two territory forms: to determine what a page is, look at the path first, then the frontmatter — the path is the origin proof, not a metadata self-claim
+  - Two territory forms, 2026-10-02 group meeting: proxy pages — projections of reconcilable external sources; plus in-domain native pages — domain-side archives whose true body lives here, first case bb-track user.md. This legitimizes the existing tension of lark and email archive pages, it does not open an exception hatch
+  - Session pages are minutes, not mirrors: once the conversation vanishes the page is the true body, writing is birth — the line versus lark-im archives is whether the source is alive and reconcilable
+  - frontmatter takes a minimal YAML subset: the parser is lenient but this is the boundary — top-level scalars, block lists, one-level block mappings; more complex structures silently deform; this is the page-format contract
+
+## Structure
+
+Container `wiki/`, zoned by the origin dichotomy, pages have three origin layers:
+
+- Domain territories, pages each domain declares as its territory, in two forms: proxy pages are the default — projections of reconcilable external sources, vault assets, lark objects, etc., territory paths self-disclosed by each domain's injection line; **in-domain native pages** are domain-side archives declared by a domain — the true body lives here, no external source to reconcile, shape owned by the domain plugin; first case bb-track cognition profile user.md; lark person files and email person files carried this tension all along, this move legitimizes them rather than opening a hatch
+- Native territory, everything else: writings whose true body lives here — notes knowledge, sessions minutes, tmp and todo workspaces, profile cognition profile. Among them session pages are minutes, not mirrors: once the conversation runtime vanishes the page is the true body, writing is birth; the line versus lark-im archives is whether the source is alive and reconcilable, judgment method in domain
+- Derived facilities: index, tags, hot, log — mechanical projections, zero edges to the environment
+
+Cross-cutting plugins — tag, trust, link — occupy fields and syntax, not pages, and do not belong to the page-origin layering.
+
+## Invariants
+
+- The path is the origin proof: to determine what a page is, first look at where it is — among the three zones above — then at the frontmatter; which domain a territory belongs to is likewise read from path convention, the declaration proper lives in each domain's manifest
+- All text in the repository is UTF-8; type is required on knowledge pages; reserved-name exemptions apply
+- frontmatter takes a minimal YAML subset — top-level scalars, block lists, one-level block mappings: the parser is lenient but this is the boundary; more complex structures will silently deform
+
+## Changelog
+
+- 0.7 2026-10-02: two territory forms — proxy pages as the default, plus in-domain native pages, i.e. domain-side archives declared by a domain with shape owned by the domain plugin; group-meeting ruling, first case bb-track cognition profile user.md; legitimizes the existing tension of lark and email archive pages, not an exception hatch
+- 0.6 2026-09-29: narrative reinforcement — the origin dichotomy spelled out as three page-origin layers: domain territories, native territory, derived facilities; added cross-cutting plugin positioning; sessions characterized as minutes not mirrors, the source vanishes and the page is the true body
+- 0.5 2026-09-22: domain-ization — the origin dichotomy generalized to "pages each domain declares as its territory", removing the vault-specific hardcoding; territory-to-domain mapping read from path convention, declarations in each domain's manifest; first paragraph rewritten to the inner/outer narrative
+- 0.4 2026-09-13: injection line gained the minimal-YAML-subset frontmatter boundary — expert review: the legal subset was undefined
+- 0.3 2026-09-13: injection source moved to the manifest — removed Checks, Inject, Attachments sections, md returned to pure documentation
+- 0.2 2026-09-13: purification — removed "see plugin X" back-references and nominal anchors, zones stated self-sufficiently by origin
+- 0.1 2026-09-12: established — concept-declaration plugin, the origin-dichotomy invariant migrated from the original vault plugin's PLUGIN.md

package/.meta/plugins/core/wiki/PLUGIN.yaml

@@ -0,0 +1,8 @@
+id: wiki
+schema_version: 1
+version: 0.7
+depends: []
+updated: 2026-10-06
+attachment: []
+fields: {}
+inject: "wiki container `wiki/` (the inner side of the inner/outer distinction): origin dichotomy — territory pages in two forms: proxy pages (default, projections of reconcilable external sources, territory paths self-disclosed by each domain's injection line) and in-domain native pages (domain-side archives declared by the domain — the true body lives here, no external source to reconcile, shape owned by the domain plugin; first case bb-track cognition profile user.md); everything outside territories is native pages (writings whose true body lives here; session pages are minutes not mirrors — once the conversation vanishes the page is the true body, writing is birth); index / tags / hot / log are derived pages (mechanical projections); page frontmatter takes a minimal YAML subset (top-level scalars / block lists / one-level block mappings), more complex structures are not parsed"

package/.meta/protocol/actions.md

@@ -0,0 +1,42 @@
+# Action discipline: path zones × action tiers
+
+> The semantic shape of permissions: this table does not rely on code for "enforcement", but deterministic structural operations are entrusted to scripts (`.meta/scripts/wiki_plugin_kernel.py`: compliance / dependencies / injection / registry / copy sync; `.meta/scripts/pipeline.py`: index / tags rebuild, hot / log rolling, post-write self-attestation), while semantic judgment is entrusted to the LLM; the agent consults this table before acting, and check audits afterwards from script output and git traces.
+> Four execution principles: deterministic structural operations go through scripts, semantic judgment through the LLM; rules spell out in plain text "how to do" rather than "what it is"; if one read suffices, there is no second scan (call frugality); write commands must close with `pipeline.py verify` self-attestation (the minimal attester form: the LLM executes, the script attests).
+
+## Path zones
+
+| Zone | Paths | Nature |
+|---|---|---|
+| Regenerable | `wiki/index.md`, `wiki/tags.md`, `wiki/hot.md`, the `.meta/protocol/registry.yaml` plugins section | Derived projections, wholly rebuildable; the pipeline may rerun freely |
+| Precious | `wiki/notes/**`, `.meta/plugins/**`, `.meta/command/**`, the AGENTS.md hand-written region | Append-only or human-edited |
+| Immutable | existing entries of `wiki/log.md` and `wiki/archive/**`, `vault/**` (from the command's perspective) | Content must not be rewritten after writing |
+| Workspace | `projects/**` | Full agent read-write authority (in contrast to the append-only vault); the self-describing `project.md` accompanies each project |
+| Temporary | `wiki/tmp/**` | No retention promise, may be cleaned; invisible to the derived layer (index/tags/link graph), exempt from broken-link checks |
+
+## Action tiers
+
+| Tier | Typical actions | How executed |
+|---|---|---|
+| Mechanical-auto | index / tags / registry rebuild, injection-region rebuild, hot window eviction, log archival routing, hash recalculation, query log lines, command copy sync, post-write self-attestation | Execute directly (whatever scripts can do goes through scripts: `wiki_plugin_kernel.py` and `pipeline.py`), no asking |
+| Mechanical-confirm | tag merges (batch edits to plugin fields), reserved-field migration, tmp over-age cleanup (present list, delete after confirmation) | Present the list, execute after confirmation |
+| Semantic-report | note-merge suggestions, near-duplicate alerts, staleness judgments on proxy descriptions | Report the differences; the human decides |
+| Always-human | deletion, history rewriting, changes to existing `vault/` files, rewriting note bodies | Commands never execute these; ghost-writing on explicit user instruction must leave a log trace |
+
+The criterion: touching "plugin-owned fields or regenerable pages" → mechanical; touching "bodies or existing history" → human.
+
+## Commit discipline
+
+> In this framework git is process-layer infrastructure (version control / audit evidence / lockfile), not a plugin; this section gives the commit rules for data-zone writes—for the engineering side see constitution principle 8; the two domains do not encroach on each other.
+
+- **One write operation = one commit**: one map / save / profile / check fix, together with all its derived products (pages + index / tags / hot / log + new vault assets), enters the commit atomically; commit only after verify passes—what is committed is what has been self-attested; no commit when nothing changed
+- **Message format `module: summary`** (isomorphic with the engineering side; module word + half-width colon): the data-zone module vocabulary is taken from the commands, defined at this single point and not re-copied into command docs—`map: <asset name>`, `save: <page title>`, `profile: <one-liner>`, `check: <conclusion>`, `query: <topic>`
+- **The agent only adds paths it has written; `git add -A` is forbidden**: commit rights over human hand edits (vault deletions/changes, manual wiki edits) belong to the human—the agent only reports; committing on someone's behalf requires explicit user instruction
+- No pushing; history rewriting is forbidden (constitution principle 8, globally applicable)
+
+## Rolling mechanisms (spelled out)
+
+- **log**: main-file window ≤100 entries (about 14k characters). Write log entries via `pipeline.py log <type> "<one-liner>"`—on overflow, the oldest stretch is moved, grouped by entry month, into `wiki/archive/YYYY-MM/log.md`; entry content is unchanged to the character, only relocated; the archive directory falls into the immutable zone
+- **hot**: ≤25 entries, <5 days, ≤200 characters per entry. Write hot entries via `pipeline.py hot <type> "<one-liner>"`—out-of-window entries are evicted and over-long entries truncated automatically before writing
+- **Index / registry**: on deviation from reality → rebuild directly inside check (`pipeline.py index` / `tags`; `wiki_plugin_kernel.py all`), no asking
+- **Vocabulary**: before writing tags, map / save first reads `wiki/tags.md` (the derived zone is the vocabulary), preferring to reuse existing words; near-duplicate merging is a mechanical-confirm item
+- **Parameter ownership**: mechanical parameters such as rolling windows defer to the `pipeline.py` source (the script source is the rule list), while plugin PLUGIN.md files keep the semantic explanations—commands and docs do not re-copy the numbers

package/.meta/protocol/experiments.md

@@ -0,0 +1,40 @@
+# Disclosure paradigm: SASU-L and the zero-contamination discipline
+
+> Ruling of 2026-09-12: with the project positioned for personal use, the test-set matrix and cross-validation protocol were abolished (never executed; the design is preserved in git history). This document retains the SASU-L disclosure paradigm and the zero-contamination discipline, as a mirror for writing skills / docs and for self-review.
+> Basis (two rounds of empirical work on 2026-09-12: cold start on a fictional vault, migration of 25 items in a real vault): in real deployments the agent knows things only in SASU-L order, with zero priors; every "assumed known" in the framework is non-portable knowledge-layer leakage (an extension of the principle-2 touchstone). Empirical regularities—wrong-guess points = where the spec lacks examples; behavioral divergence points = where rules are absent from the execution site; silent rot = where formal-layer feedback is missing.
+
+## SASU-L: the environment's only disclosure channel
+
+1. **S** (system prompt) — the harness base: identity, toolset, general behavioral rules. Outside the framework's control; treat it as the given environment; differences in S across harnesses are not charged to the framework's account (including whether AGENTS.md is auto-injected at all—that too is an S-layer property)
+2. **A** (AGENTS.md) — the workspace constitution: system-injected, including the plugin injection region—identity, principles, structural map
+3. **S** (Skills) — the capability surface: skill **descriptions** are available at session start; bodies load on trigger—the actual reading happens inside L
+4. **U** (user prompt) — the user's own words: the sole legitimate source of task semantics
+5. **L** (loop) — the execute-observe cycle: reading anchors, reading pages, calling tools, post-write feedback. Anchors and pages (registry, vocabulary, PLUGIN.md, hot, index, pre-existing pages) are **resources accessed within L, not standalone stages**; **pre-existing pages are part of the spec**—the agent uses existing pages as format references (empirically: multiple sessions in the migration experiment consulted precedent pages to align format), hence gold-sample quality is disclosure quality
+
+The first four links are a static availability ordering; all actual reading happens in L. Any information beyond this—training priors, spec restatements stuffed into prompts, verbal conventions—counts as nonexistent on the agent side.
+
+## Zero-contamination discipline (also used for comparisons and spot checks)
+
+- Cold-start subagent: no conversation history; the prompt contains only two things—what the environment supplies (role positioning + working directory) and the **U-layer original user task text**
+- **U-layer purity**: no restating any S / A layer content (e.g. do not write "remember to reuse the vocabulary" or "remember to run the pipeline"—that is the Skills layer's job; restating it inflates the measurement)
+- Interaction steps (confirmations / questions) declare their proxy approach under an "experiment protocol" statement, but must not slip in format answers along the way
+- When a comparison is needed: run the same type of task before and after the change and compare friction points; running them simultaneously contaminates both
+
+## Validate by use (since 2026-09-12)
+
+Whether a change works is judged by real-use feedback: friction points (guessing formats, missed steps, repeatedly explaining the same thing) are spec voids; fix one spot, use one spot—no matrix thresholds.
+
+## Layer content & capacity discipline (2026-10-06, issue #12)
+
+Supplement distilled from the inject-region overrun incident (instance AGENTS.md at 39 KB, 97% injection region, silently truncated on four of five mainstream harnesses). SASU-L ordered *when* each channel becomes available but never stated *what each layer may carry and how much*—so the one channel with no norm, the A-layer injection region, became the dumping ground. The paradigm's own empirical rule had already located the fix: behavioral divergence points sit where rules are absent from the **execution site**—and the execution site is L (skill bodies, pages, anchors read at the moment of use), not A. A is the constitution, not the execution site.
+
+**Content contract—what each layer stores:**
+
+- **A (AGENTS.md)**—task-independent orientation only: identity and positioning, principles, the structural map (top-level layout, territory roots), red lines, entry pointers. Injection projections are **pointer-dense, not disclosure-complete**: a plugin's line states what it is, where its territory sits, its red lines, and where the full disclosure lives. Procedures, formats, field semantics and per-plugin mechanisms are **forbidden in A**—they belong to S or L.
+- **S (skills)**—the capability surface. Descriptions are one-line trigger surfaces (the skill catalog is also always-on session context—the same tax as A, so the same leanness applies). Bodies carry the procedures and the constitutional constraints that travel with the operation (append-only, no-regeneration zones): a skill may be slimmed, never below its constitutional clauses.
+- **U (user prompt)**—task semantics only; the purity rule above stands.
+- **L (loop)**—the full-disclosure home: plugin manifests (the `inject` field stays the single source of a plugin's disclosure text whether or not it projects into A), PLUGIN.md design docs, wiki declaration pages, precedent pages—read at the moment of use.
+
+**One home per fact.** The same disclosure is not carried in parallel across layers (inject region ↔ PLUGIN.md ↔ skill body): with three copies, one silently rots. Each fact is stated once, in the layer the contract assigns; the other layers hold pointers to it.
+
+**Capacity is structural, not disciplinary.** The kernel enforces a byte budget on the projected injection region (manifest `inject_tier`: `full` projects, `member` exits; a member must reach a full-tier domain root through depends—validate checks, else it exits into invisibility). **Exposure ladder for exited members**: the family root's line must name every member (id + one phrase—the roster floor for members with no skill surface), the skill catalog carries trigger-surface awareness, and L-layer reads resolve the full contract on demand. Overrun blocks mechanical actions (a validate error since the 2026-10-06 tier migration landed the region at ~13.5 KB against the 15 KiB budget).

package/.meta/protocol/registry.yaml

@@ -0,0 +1,75 @@
+# owfa Field Registry (protocol artifact, aggregated projection)
+#
+# Rules:
+# - The protocol section is the authoritative source; revisions must pass check
+# - The plugins section is aggregated from the fields declarations of each PLUGIN.yaml; check validates consistency, and on deviation this table is rewritten with PLUGIN.yaml as the authority
+# - The reserved section is a backfill channel: legitimate staging fields, exempt from the ghost check, awaiting a future plugin's claim
+# - map / save read this table as step 0 (one-read anchor: fields and value sets are visible before writing, no full-repo scan)
+# - Fields stack by composition: one page = protocol fields + each plugin's fields (e.g. a source page = protocol + vault + tag)
+# - Actor convention (the unified value format for all attribution fields): human:name (e.g. human:Joss) / process:workflow name (e.g. process:hash-recalc) / agent/model identifier (e.g. agent/GLM-5.3)
+# - Legacy value migration mapping: seed→draft, developing→draft, done→stable
+
+protocol:
+  type:
+    values: [source, session, profile, todo, structure, language, lark, calendar, project, email, bb, tmp]
+    note: "Territory values are closed (extending values requires revising this table)—determines page ownership and mechanical checks: source=proxy page, session=sessions territory, profile=profile page, todo=temporary memory page, structure=structure declaration page, language=language declaration page (wiki/language.md, `language`/`terms` block mappings, owned by the language plugin), lark=external pointer page (wiki/lark/ territory, the token is the identity proof, owned by the lark plugin family), calendar=time territory page (month page, two-section system), project=project declaration page (wiki/projects.md, `projects` block mapping; the project proper lives in the root container projects/), email=personal mailbox domain page (wiki/email/ territory—digest page / people / threads / sources archives, token = email address or Message-ID, owned by the email plugin), bb=BB course domain page (wiki/bb/ territory—domain-root digest page and course identity pages, term_id/course_id is the identity proof, owned by the bb plugin), tmp=temporary page (path is the territory, invisible to the derived layer); import/interop consumer sides tolerate unknown types"
+    defaults: [concept, qa, decision, entity, comparison]
+    defaults_note: "Form defaults vocabulary—knowledge forms within the notes territory, no mechanical semantics; instances extend it freely (no revision of this table required), prefer reuse to prevent vocabulary fragmentation"
+  status:
+    values: [draft, stable, deprecated]
+    note: "Three lifecycle values; deprecated = kept for links and history but no longer current"
+  title:
+    note: "Page title, a string; recommended as a required field"
+  description:
+    note: "One-sentence description (≤80 characters); data source for index entries and viewer hints; when absent, the index takes the first sentence of the body"
+  created:
+    note: YYYY-MM-DD
+  updated:
+    note: "YYYY-MM-DD, refreshed by any write operation"
+
+plugins:
+  calendar:
+    calendar:
+      note: block mapping (declaration page) — source key → source declaration (value syntax belongs to the adapter: lark-calendar uses `lark/<profile> <calendar_id|primary>`); the source key is the end-of-line tag on schedule lines
+  cron:
+    cron:
+      note: block mapping (task page) — trigger (deferred-trigger declaration; v0.4 generalizes the v0.3 schedule key, schedule reads as the time form): time form = crontab 5-field or human-readable cadence, local timezone by default; condition form = condition <kind> <target> [pattern] [interval] [max_fires] [cooldown], kind first batch file|command|http|process|port|webhook (open vocabulary — extend words, not machinery), pattern semantics fixed as no-match→match edge (default any change after baseline) / action (the action in one sentence) / form (execution shape: session edition | script edition — criterion: any agent-judgment step means session, purely mechanical means script; orthogonal to trigger, all four combinations legal) / domain (owning domain, tagged when a domain plugin registers via the bridge, omittable for cross-domain tasks) / status (active in-service | paused suspended | deprecated retired) / last_run (most recent run or fire time, machine-maintained) / machine (optional: executing-machine anchor for multi-device location; no linkage built)
+  device:
+    device:
+      note: block mapping (device profile page in notes) — serial (serial number) / purchased (purchase date YYYY-MM-DD) / warranty_until (warranty or coverage end date YYYY-MM-DD, the attached-audit scan item), a three-key minimal set; remaining keys open (model, vendor, etc.; the architecture does not enumerate)
+  language:
+    language:
+      note: block mapping (declaration page) — canonical key → one-sentence rule (open vocabulary, e.g. default/teaching/annotation/register); output language and writing baseline — register = the writing register (audience reading level, default first/second-year undergraduates), consumed by bb-teach and bb-quiz
+    terms:
+      note: block mapping (declaration page) — term original → unified translation (single-line value); the cross-session translation-consistency lookup piece
+  link:
+    aliases:
+      note: YAML list, aliases/short names, for link resolution
+    related:
+      note: YAML list, full-name wikilinks of related pages
+  mapping:
+    raw_file:
+      note: root-relative path, always present on proxy pages
+    raw_sha256:
+      note: hexadecimal SHA-256, mechanically recomputable from vault
+  sessions:
+    participants:
+      note: YAML list, actor convention (human:name / process:flow name / agent/model id), the multi-agent collaboration extension point
+  tag:
+    tags:
+      note: YAML list ≤5; primary language follows the language page's default key (absent → session language); English tags lowercase kebab-case; hierarchy ≤2, `/` separated; restating type forbidden
+  trust:
+    generated:
+      note: block-style mapping by/at (actor convention + YYYY-MM-DD), who generated the page
+    sources:
+      note: source list, items contain id / resource / credibility signals (author, usage_count, last_modified)
+    stale_after:
+      note: YYYY-MM-DD absolute moment; expiry check = the pure comparison now ≥ stale_after
+    verified:
+      note: event list, items single-line `by: <actor>, at: <date>`, appendable multiple times; the trust level is derived from this
+  vault:
+    url:
+      note: Source URL; provenance registration for URL-type assets (source preservation), optional for manual placement, required for agent channels (delegate etc.); also the interface for other domains to land via vault
+
+reserved: {}
+