sneakoscope 10.5.6 → 10.5.7

package/README.md

@@ -17,7 +17,7 @@
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.5.6**. Install the latest stable release from npm.
+Current package: **SKS 10.5.7**. Install the latest stable release from npm.
 
 Sneakoscope Codex (`sks`) is a local trust layer for Codex CLI and ChatGPT Desktop. It keeps agent work bounded, preserves project context, records machine-verifiable evidence, and prevents release claims that current tests or artifacts cannot support.
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.5.6"
+version = "10.5.7"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.5.6"
+version = "10.5.7"
 edition = "2021"
 
 [dependencies]

package/dist/cli/command-manifest-lite.js

@@ -70,7 +70,7 @@ const COMMAND_MANIFEST_LITE_BASE = [
     { name: 'gx', summary: 'Render/validate GX cartridges', maturity: 'labs' },
     { name: 'eval', summary: 'Run eval reports', maturity: 'labs' },
     { name: 'wiki', summary: 'Manage TriWiki and image voxel ledgers', maturity: 'beta', skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
-    { name: 'memory', summary: 'Project TriWiki memory into managed AGENTS.md blocks or run memory GC', maturity: 'beta' },
+    { name: 'memory', summary: 'Project TriWiki memory, explicit Jev promotion, digest-bound forgetting, or bounded recall', maturity: 'beta' },
     { name: 'gc', summary: 'Compact/prune runtime state', maturity: 'labs', skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
     { name: 'stats', summary: 'Show storage stats', maturity: 'labs', readonly: true, skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
     { name: 'mcp-server', summary: 'Run a stdio MCP server exposing SKS commands as tools for MCP-capable agent hosts', maturity: 'beta', skipMigrationGate: true, allowedDuringActiveRoute: true },
@@ -373,8 +373,8 @@ const COMMAND_HELP_LITE = {
         description: 'Build, refresh, publish shared shards, rebuild ignored indexes, validate, and attach wrongness-memory context to RGBA/trig LLM Wiki packs with attention.use_first and attention.hydrate_first for compact recall plus source hydration.'
     },
     memory: {
-        usage: 'sks memory build [--json] | sks memory gc [--dry-run]',
-        description: 'Project TriWiki context-pack memory into managed AGENTS.md blocks or run bounded memory cleanup.'
+        usage: 'sks memory build [--json] | sks memory gc [--dry-run] | sks memory promote --mission <id> --yes [--json] | sks memory forget --memory-id <id> --previous-digest <digest> [--json] | sks memory recall [--query <text>] [--high-risk] [--json]',
+        description: 'Project TriWiki context-pack memory, explicitly promote a Jev mission intake, write a digest-bound tombstone, or read bounded canonical memory.'
     },
     naruto: {
         usage: 'sks naruto run "task" [--agents N] [--max-threads N] [--trusted-project] [--json] | sks naruto status|subagents|proof [latest|M-...] [--json] | sks naruto execution status [--json] | sks naruto execution set --mode auto|current-session|standalone [--restart] [--json] | sks naruto parent-summary --mission M-... --stdin [--json]',

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.5.6",
+  "package_version": "10.5.7",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/agents/agent-message-bus.js

@@ -1,7 +1,153 @@
 import path from 'node:path';
 import fs from 'node:fs/promises';
-import { appendJsonl, nowIso } from '../fsx.js';
+import { appendJsonl, nowIso, sha256 } from '../fsx.js';
 import { appendAgentLedgerEvent } from './agent-central-ledger.js';
+export const SIBLING_MESSAGE_MAX_BYTES = 4_096;
+export const SIBLING_MESSAGE_MAX_COUNT = 8;
+export const SIBLING_MESSAGE_MAX_REPLIES = 4;
+export const SIBLING_MESSAGE_MAX_TTL_MS = 300_000;
+export const SIBLING_MESSAGE_MAX_HOPS = 1;
+export const SIBLING_MESSAGE_KINDS = Object.freeze(['need_sibling_analysis', 'evidence_request', 'handoff_clarification', 'conflict_notice']);
+const SIBLING_RELAY_LOCKS = new Map();
+async function withSiblingRelayLock(root, fn) {
+    const previous = SIBLING_RELAY_LOCKS.get(root) || Promise.resolve();
+    const next = previous.catch(() => undefined).then(fn);
+    SIBLING_RELAY_LOCKS.set(root, next.catch(() => undefined));
+    return next;
+}
+export function buildSiblingMessage(input) {
+    const created = input.created_at || nowIso();
+    const expires = input.expires_at || new Date(Date.parse(created) + 120_000).toISOString();
+    const body = String(input.body || '').trim();
+    const bodyBytes = Buffer.byteLength(body, 'utf8');
+    if (bodyBytes === 0 || bodyBytes > SIBLING_MESSAGE_MAX_BYTES)
+        throw new Error('sibling_message_body_size');
+    if (/(?:spawn|merge|publish|align|apply|permission|elevat|credential|secret|api[ _-]?key|password|token|session.?id)/i.test(body)) {
+        throw new Error('sibling_message_action_or_sensitive_content');
+    }
+    const ttlMs = Date.parse(expires) - Date.parse(created);
+    if (!Number.isFinite(ttlMs) || ttlMs <= 0 || ttlMs > SIBLING_MESSAGE_MAX_TTL_MS)
+        throw new Error('sibling_message_ttl');
+    const message = {
+        schema: 'sks.sibling-message.v1',
+        message_id: String(input.message_id),
+        sender_task_id: String(input.sender_task_id),
+        recipient_task_id: String(input.recipient_task_id),
+        mission_id: String(input.mission_id),
+        plan_id: String(input.plan_id),
+        correlation_task_key: String(input.correlation_task_key),
+        kind: input.kind,
+        body_digest: sha256(body),
+        artifact_refs: [...new Set((input.artifact_refs || []).map(String))].filter((ref) => !ref.includes('..') && !/[\\\0]/.test(ref)).slice(0, 16),
+        reply_to: input.reply_to || null,
+        created_at: created,
+        expires_at: expires,
+        hop_count: Math.max(0, Math.floor(input.hop_count || 0)),
+        status: 'pending'
+    };
+    const validation = validateSiblingMessage(message);
+    if (!validation.ok)
+        throw new Error(`sibling_message_invalid:${validation.issues.join('|')}`);
+    return message;
+}
+export function validateSiblingMessage(value, now = Date.now(), options = {}) {
+    const row = value;
+    const issues = [];
+    if (!row || row.schema !== 'sks.sibling-message.v1')
+        issues.push('schema');
+    for (const key of ['message_id', 'sender_task_id', 'recipient_task_id', 'mission_id', 'plan_id', 'correlation_task_key', 'body_digest'])
+        if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(String(row?.[key] || '')))
+            issues.push(key);
+    if (!SIBLING_MESSAGE_KINDS.includes(row?.kind))
+        issues.push('kind');
+    if (!Array.isArray(row?.artifact_refs) || row.artifact_refs.length > 16)
+        issues.push('artifact_refs');
+    if (Number(row?.hop_count) !== 0 && Number(row?.hop_count) !== SIBLING_MESSAGE_MAX_HOPS)
+        issues.push('hop_count');
+    if (!Number.isFinite(Date.parse(String(row?.created_at || ''))) || !Number.isFinite(Date.parse(String(row?.expires_at || ''))))
+        issues.push('time');
+    const ttlMs = Date.parse(String(row?.expires_at || '')) - Date.parse(String(row?.created_at || ''));
+    if (Date.parse(String(row?.expires_at || '')) <= now)
+        issues.push('expired');
+    if (ttlMs <= 0 || ttlMs > (options.maxTtlMs || SIBLING_MESSAGE_MAX_TTL_MS))
+        issues.push('ttl');
+    if (options.expectedPlanId && row?.plan_id !== options.expectedPlanId)
+        issues.push('cross_plan');
+    if (options.allowedRecipients && !options.allowedRecipients.includes(String(row?.recipient_task_id || '')))
+        issues.push('recipient');
+    if (options.mainTaskId && row?.kind === 'need_sibling_analysis' && row?.recipient_task_id !== options.mainTaskId)
+        issues.push('decomposition_recipient');
+    if (typeof row?.status !== 'string' || !['pending', 'replied', 'resolved', 'denied', 'expired'].includes(row.status))
+        issues.push('status');
+    return { ok: issues.length === 0, issues };
+}
+export async function appendSiblingMessage(root, input, options = {}) {
+    return withSiblingRelayLock(root, async () => {
+        const row = buildSiblingMessage(input);
+        const now = options.now || Date.now();
+        if (options.maxBytes !== undefined && Buffer.byteLength(String(input.body || '').trim(), 'utf8') > Math.min(SIBLING_MESSAGE_MAX_BYTES, Math.max(1, Math.floor(options.maxBytes))))
+            throw new Error('sibling_message_size_cap');
+        if (row.sender_task_id === row.recipient_task_id)
+            throw new Error('sibling_message_self_recipient');
+        if (options.planId && row.plan_id !== options.planId)
+            throw new Error('sibling_message_cross_plan');
+        if (options.parentTaskId && (options.senderParentTaskId !== options.parentTaskId || options.recipientParentTaskId !== options.parentTaskId)) {
+            throw new Error('sibling_message_parent_scope');
+        }
+        const allowedRecipients = options.allowedRecipients ? [...new Set(options.allowedRecipients.map(String))] : null;
+        if (allowedRecipients && !allowedRecipients.includes(row.recipient_task_id))
+            throw new Error('sibling_message_recipient_denied');
+        if (options.mainTaskId && row.kind === 'need_sibling_analysis' && row.recipient_task_id !== options.mainTaskId)
+            throw new Error('sibling_message_decomposition_main_only');
+        const requiredCapability = options.requiredCapability || 'sibling_discussion';
+        for (const side of [options.senderCapabilities, options.recipientCapabilities]) {
+            if (side && !side.includes(requiredCapability))
+                throw new Error('sibling_message_capability_denied');
+        }
+        const validation = validateSiblingMessage(row, now, {
+            ...(options.planId === undefined ? {} : { expectedPlanId: options.planId }),
+            ...(allowedRecipients === null ? {} : { allowedRecipients }),
+            ...(options.maxTtlMs === undefined ? {} : { maxTtlMs: options.maxTtlMs }),
+            ...(options.mainTaskId === undefined ? {} : { mainTaskId: options.mainTaskId })
+        });
+        if (!validation.ok)
+            throw new Error(`sibling_message_invalid:${validation.issues.join('|')}`);
+        const existing = await readRawAgentMessages(root);
+        const duplicate = existing.find((entry) => entry?.message_id === row.message_id && entry?.plan_id === row.plan_id);
+        if (duplicate)
+            return { ...row, duplicate: true, bus_entry: normalizeAgentMessageBusEntry(duplicate, row.mission_id) };
+        const planCount = existing.filter((entry) => entry?.plan_id === row.plan_id && entry?.mission_id === row.mission_id).length;
+        if (planCount >= Math.min(SIBLING_MESSAGE_MAX_COUNT, Math.max(1, Math.floor(options.maxCount || SIBLING_MESSAGE_MAX_COUNT))))
+            throw new Error('sibling_message_count_cap');
+        if (row.reply_to) {
+            const parent = existing.find((entry) => entry?.message_id === row.reply_to && entry?.plan_id === row.plan_id);
+            if (!parent)
+                throw new Error('sibling_message_reply_target_missing');
+            const replies = existing.filter((entry) => entry?.plan_id === row.plan_id && entry?.reply_to === row.reply_to).length;
+            if (replies >= Math.min(SIBLING_MESSAGE_MAX_REPLIES, Math.max(1, Math.floor(options.maxReplies || SIBLING_MESSAGE_MAX_REPLIES))))
+                throw new Error('sibling_message_reply_cap');
+        }
+        const entry = await appendAgentMessage(root, {
+            from: row.sender_task_id,
+            session_id: row.sender_task_id,
+            to: row.recipient_task_id,
+            body: `body_digest:${row.body_digest}`,
+            type: row.kind,
+            mission_id: row.mission_id,
+            worker_id: row.sender_task_id,
+            event_type: 'status',
+            artifact_paths: row.artifact_refs,
+            message_id: row.message_id,
+            plan_id: row.plan_id,
+            correlation_task_key: row.correlation_task_key,
+            reply_to: row.reply_to,
+            expires_at: row.expires_at,
+            hop_count: row.hop_count,
+            body_digest: row.body_digest
+        });
+        return { ...row, duplicate: false, bus_entry: entry };
+    });
+}
 export async function appendAgentMessage(root, message) {
     const eventType = normalizeAgentMessageEventType(message.event_type || message.type);
     const entry = {
@@ -18,10 +164,21 @@ export async function appendAgentMessage(root, message) {
         from: message.from,
         to: message.to || 'orchestrator',
         type: message.type || 'note',
-        body: message.body
+        body: message.body,
+        ...(message.message_id === undefined ? {} : { message_id: message.message_id }),
+        ...(message.plan_id === undefined ? {} : { plan_id: message.plan_id }),
+        ...(message.correlation_task_key === undefined ? {} : { correlation_task_key: message.correlation_task_key }),
+        ...(message.reply_to === undefined ? {} : { reply_to: message.reply_to }),
+        ...(message.expires_at === undefined ? {} : { expires_at: message.expires_at }),
+        ...(message.hop_count === undefined ? {} : { hop_count: message.hop_count }),
+        ...(message.body_digest === undefined ? {} : { body_digest: message.body_digest })
     };
     await appendJsonl(path.join(root, 'agent-messages.jsonl'), entry);
-    await appendAgentLedgerEvent(root, { agent_id: message.from, session_id: message.session_id, event_type: 'message_appended', payload: { to: entry.to, type: entry.type } });
+    await appendAgentLedgerEvent(root, { agent_id: message.from, session_id: message.session_id, event_type: 'message_appended', payload: {
+            to: entry.to, type: entry.type, message_id: entry.message_id || null, plan_id: entry.plan_id || null,
+            correlation_task_key: entry.correlation_task_key || null, reply_to: entry.reply_to || null,
+            expires_at: entry.expires_at || null, hop_count: entry.hop_count ?? null, body_digest: entry.body_digest || null
+        } });
     return entry;
 }
 export async function readAgentMessageBus(root, missionId, opts = {}) {
@@ -74,9 +231,28 @@ function normalizeAgentMessageBusEntry(value, missionId) {
         from: value.from == null ? undefined : String(value.from),
         to: value.to == null ? undefined : String(value.to),
         type: value.type == null ? undefined : String(value.type),
-        body: value.body == null ? undefined : String(value.body)
+        body: value.body == null ? undefined : String(value.body),
+        message_id: value.message_id == null ? undefined : String(value.message_id),
+        plan_id: value.plan_id == null ? undefined : String(value.plan_id),
+        correlation_task_key: value.correlation_task_key == null ? undefined : String(value.correlation_task_key),
+        reply_to: value.reply_to == null ? value.reply_to : String(value.reply_to),
+        expires_at: value.expires_at == null ? undefined : String(value.expires_at),
+        hop_count: value.hop_count == null ? undefined : Number(value.hop_count),
+        body_digest: value.body_digest == null ? undefined : String(value.body_digest)
     };
 }
+async function readRawAgentMessages(root) {
+    const file = path.join(root, 'agent-messages.jsonl');
+    const text = await fs.readFile(file, 'utf8').catch(() => '');
+    return text.split(/\n+/).filter(Boolean).flatMap((line) => {
+        try {
+            return [JSON.parse(line)];
+        }
+        catch {
+            return [];
+        }
+    });
+}
 function normalizeAgentMessageEventType(value) {
     const text = String(value || '').toLowerCase();
     if (text === 'worker_completed' || text === 'completed' || text === 'done')

package/dist/core/align/code-navigation-align.js

@@ -17,6 +17,7 @@ import { walkCodeInventory } from '../triwiki/context-graph/extractors/code/inve
 import { codeInventoryInputHashes } from '../triwiki/code-navigation-policy.js';
 import { clearContextGraphSnapshotCache, clearWorkspaceContextIndex } from '../triwiki/context-graph/query/index.js';
 import { withTriWikiStateLock } from '../triwiki/triwiki-cleanup.js';
+import { preserveCanonicalMemory, rebuildSharedIndexes } from '../git-hygiene/shared-memory-publish.js';
 import { publishArchitectureMapToStage } from '../triwiki/context-graph/store/architecture-map-store.js';
 import { alignPendingRoot, alignPendingWiki, alignSourceFingerprint, projectAlignCodePack, publishAlignContextIndex } from './align-context-index.js';
 import { ALIGN_LEDGER_ARTIFACT, ALIGN_OUTPUT_ARTIFACTS, ALIGN_PLAN_ARTIFACT, ALIGN_STAGING_ROOT_REL, buildInitialAlignLedger, refreshAlignGate } from './align-route.js';
@@ -43,7 +44,7 @@ if (new Set(ALIGN_OUTPUT_ARTIFACTS).size !== ALIGN_OUTPUT_ARTIFACTS.length) {
 }
 const ALIGN_REPLACED_SURFACES = Object.freeze([
     { key: 'wiki', rel: '.sneakoscope/wiki' },
-    { key: 'memory', rel: '.sneakoscope/memory' },
+    { key: 'legacy_memory_runtime', rel: '.sneakoscope/memory' },
     { key: 'context_graph_cache', rel: '.sneakoscope/cache/context-graph' },
     { key: 'code_pack_freshness_cache', rel: '.sneakoscope/cache/code-pack-head-freshness.json' },
     { key: 'generated_agents_projection', rel: '.sneakoscope/context/AGENTS.generated.md' },
@@ -167,7 +168,15 @@ async function validateStaging(input) {
     if (!packValidation.ok || !isCodePackProjectionBoundToSnapshot(input.snapshot.snapshotHash, pack))
         return false;
     const contextPack = await readJson(path.join(input.stageWiki, 'context-pack.json'), null);
-    return validateCodeNavigationContextPack(contextPack, input.root).ok;
+    if (!validateCodeNavigationContextPack(contextPack, input.root).ok)
+        return false;
+    for (const [relative, expected] of Object.entries(input.canonicalHashes || {})) {
+        const file = path.join(input.stageWiki, relative);
+        const stat = await fsp.stat(file).catch(() => null);
+        if (!stat?.isFile() || await fileSha256(file) !== expected)
+            return false;
+    }
+    return true;
 }
 async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCas) {
     const startedAt = Date.now();
@@ -177,6 +186,28 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
     if (staleStage?.isSymbolicLink())
         throw new Error('code_navigation_staging_symlink_refused');
     if (staleStage) {
+        const entries = await fsp.readdir(stageBase, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isDirectory() || entry.isSymbolicLink())
+                throw new Error('align_recovery_stage_invalid');
+            const journal = await readJson(path.join(stageBase, entry.name, 'swap-journal.json'), null);
+            const priorRoot = path.join(stageBase, entry.name, 'previous');
+            for (const surface of ALIGN_REPLACED_SURFACES) {
+                const prior = path.join(priorRoot, surface.key);
+                if (!(await lstatOrNull(prior)))
+                    continue;
+                if ((await lstatOrNull(prior))?.isSymbolicLink())
+                    throw new Error('align_recovery_symlink');
+                const active = path.join(root, surface.rel);
+                if (!await lstatOrNull(active) && journal?.phase === 'prior_moved') {
+                    await ensureDir(path.dirname(active));
+                    await guardedRename(guard, prior, active);
+                }
+                else if (await lstatOrNull(prior)) {
+                    await guardedRm(guard, prior, { recursive: true, force: true });
+                }
+            }
+        }
         await guardedRm(guard, stageBase, { recursive: true, force: true });
         if (await lstatOrNull(stageBase))
             throw new Error('code_navigation_stale_staging_not_removed');
@@ -311,8 +342,11 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
         await writeJsonAtomic(path.join(stageWiki, 'code-pack.json'), pack);
         await writeJsonAtomic(path.join(stageWiki, 'context-pack.json'), contextPack);
         await publishArchitectureMapToStage(stageWiki, snapshot, { root, missionId });
+        const canonicalHashes = await preserveCanonicalMemory(root, stageWiki);
+        await rebuildSharedIndexes(pendingRoot);
+        ledger.publication.canonical_memory_sha256 = canonicalHashes;
         ledger.publication.staged = true;
-        ledger.validation.staged_readback = await validateStaging({ stageWiki, root, snapshot, pack, contextPack, manifest });
+        ledger.validation.staged_readback = await validateStaging({ stageWiki, root, snapshot, pack, contextPack, manifest, canonicalHashes });
         if (!ledger.validation.staged_readback)
             throw new Error('code_navigation_staging_validation_failed');
         const prior = await inspectPriorSurfaces(root);
@@ -321,15 +355,36 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
         ledger.input_state.prior_state_digest = prior.length
             ? crypto.createHash('sha256').update(prior.map((surface) => surface.descriptor).sort().join('\n')).digest('hex')
             : null;
+        await writeJsonAtomic(path.join(stageRoot, 'swap-journal.json'), {
+            schema: 'sks.align-swap-journal.v1',
+            phase: 'prepared',
+            mission_id: missionId,
+            active_surfaces: prior.map((surface) => surface.rel).sort(),
+            created_at: nowIso()
+        });
         for (const surface of prior) {
             const temporary = path.join(previousRoot, surface.key);
             await ensureDir(path.dirname(temporary));
             await guardedRename(guard, surface.absolute, temporary);
             movedPrior.push({ surface, temporary });
         }
+        await writeJsonAtomic(path.join(stageRoot, 'swap-journal.json'), {
+            schema: 'sks.align-swap-journal.v1',
+            phase: 'prior_moved',
+            mission_id: missionId,
+            active_surfaces: prior.map((surface) => surface.rel).sort(),
+            created_at: nowIso()
+        });
         await ensureDir(path.dirname(activeWiki));
         await guardedRename(guard, stageWiki, activeWiki);
         promoted = true;
+        await writeJsonAtomic(path.join(stageRoot, 'swap-journal.json'), {
+            schema: 'sks.align-swap-journal.v1',
+            phase: 'promoted',
+            mission_id: missionId,
+            active_surfaces: prior.map((surface) => surface.rel).sort(),
+            created_at: nowIso()
+        });
         clearContextGraphSnapshotCache();
         clearWorkspaceContextIndex(root);
         ledger.publication.transactional_directory_replaced = true;

package/dist/core/artifact-schemas.js

@@ -1,5 +1,110 @@
 import path from 'node:path';
 import { exists, nowIso, readJson, writeJsonAtomic } from './fsx.js';
+import { MEMORY_DISPOSITIONS, MEMORY_POLICY_REVISION } from './decisions/types.js';
+import { containsPlaintextSecret } from './secret-redaction.js';
+import { stableDigest } from './decisions/state.js';
+export const JEV_MEMORY_LIMITS = Object.freeze({ textChars: 512, evidence: 16, images: 8, entryBytes: 8192, fileBytes: 131072, entries: 16 });
+export const MEMORY_HASH = /^[a-f0-9]{64}$/;
+export const MEMORY_ID = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,95}$/;
+export function memoryRelativePath(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 320
+        && !value.includes('\\') && !value.includes('\0') && !path.posix.isAbsolute(value)
+        && !/^[A-Za-z]:/.test(value) && !value.split('/').some((part) => part === '..' || part === '.' || !part);
+}
+export function validateJevMemoryIntake(data) {
+    const row = data;
+    const errors = [];
+    if (!row || row.schema !== 'sks.jev-memory-intake.v1')
+        return validationResult('sks.jev-memory-intake.v1', ['schema']);
+    const allowed = ['schema', 'memory_id', 'idempotency_key', 'workflow_run_id', 'candidate_digest', 'mission_id', 'turn_id', 'session_id_hash', 'disposition', 'scope', 'text_redacted', 'text_hash', 'source_kind', 'source_digest', 'evidence_refs', 'evidence_hashes', 'context_graph_hash', 'jev_decision', 'image_voxel_refs', 'lifecycle_state', 'ttl', 'created_at', 'policy_revision', 'redaction_status', 'promotion_status'];
+    if (Object.keys(row).some((key) => !allowed.includes(key)))
+        errors.push('unknown_field');
+    for (const key of ['memory_id', 'idempotency_key', 'candidate_digest', 'session_id_hash', 'text_hash', 'source_digest', 'context_graph_hash'])
+        if (typeof row[key] !== 'string' || !MEMORY_HASH.test(row[key]))
+            errors.push(key);
+    for (const key of ['mission_id', 'turn_id', 'workflow_run_id'])
+        if (typeof row[key] !== 'string' || !MEMORY_ID.test(row[key]))
+            errors.push(key);
+    if (!MEMORY_DISPOSITIONS.includes(row.disposition) || ['sensitive_no_store', 'ephemeral_turn', 'keep_baseline', 'needs_confirmation'].includes(row.disposition))
+        errors.push('disposition_not_storable');
+    if (!['mission', 'project', 'user', 'route'].includes(row.scope))
+        errors.push('scope');
+    if (!['user_prompt', 'mission_artifact', 'tool_evidence', 'image_evidence'].includes(row.source_kind))
+        errors.push('source_kind');
+    if (typeof row.text_redacted !== 'string' || !row.text_redacted.trim() || row.text_redacted.length > JEV_MEMORY_LIMITS.textChars)
+        errors.push('text_bound');
+    if (!Array.isArray(row.evidence_refs) || row.evidence_refs.length > JEV_MEMORY_LIMITS.evidence || row.evidence_refs.some((ref) => !memoryRelativePath(ref)))
+        errors.push('evidence_refs');
+    if (!row.evidence_hashes || typeof row.evidence_hashes !== 'object' || Array.isArray(row.evidence_hashes)
+        || Object.keys(row.evidence_hashes).length > JEV_MEMORY_LIMITS.evidence
+        || Object.entries(row.evidence_hashes).some(([ref, hash]) => !memoryRelativePath(ref) || !MEMORY_HASH.test(hash) || !row.evidence_refs?.includes(ref))
+        || row.evidence_refs?.some(ref => !row.evidence_hashes?.[ref]))
+        errors.push('evidence_hashes');
+    if (!Array.isArray(row.image_voxel_refs) || row.image_voxel_refs.length > JEV_MEMORY_LIMITS.images)
+        errors.push('image_voxel_refs');
+    else
+        for (const ref of row.image_voxel_refs) {
+            if (!ref || typeof ref !== 'object') {
+                errors.push('image_ref');
+                continue;
+            }
+            if (!MEMORY_ID.test(ref.image_id || '') || !MEMORY_ID.test(ref.anchor_id || '') || !MEMORY_HASH.test(ref.sha256 || '') || !ref.relation_id || ref.relation_id.length > 96)
+                errors.push('image_ref_identity');
+            if (!Number.isInteger(ref.width) || ref.width <= 0 || !Number.isInteger(ref.height) || ref.height <= 0 || !Array.isArray(ref.bbox) || ref.bbox.length !== 4 || !ref.bbox.every(Number.isFinite) || ref.bbox[0] < 0 || ref.bbox[1] < 0 || ref.bbox[2] <= 0 || ref.bbox[3] <= 0 || ref.bbox[0] + ref.bbox[2] > ref.width || ref.bbox[1] + ref.bbox[3] > ref.height)
+                errors.push('image_ref_bbox');
+        }
+    if (!['ACTIVE', 'PINNED', 'DORMANT', 'STALE', 'CONFLICTED', 'QUARANTINED', 'DELETE_CANDIDATE', 'DELETED'].includes(row.lifecycle_state))
+        errors.push('lifecycle');
+    const zeroTtl = ['ephemeral_turn', 'sensitive_no_store', 'needs_confirmation', 'keep_baseline'].includes(row.disposition);
+    if (!Number.isSafeInteger(row.ttl) || row.ttl < 0 || row.ttl > 365 * 86400 || (!zeroTtl && row.ttl === 0) || (zeroTtl && row.ttl !== 0))
+        errors.push('ttl');
+    if (typeof row.created_at !== 'string' || !Number.isFinite(Date.parse(row.created_at)) || !row.created_at.endsWith('Z'))
+        errors.push('created_at');
+    if (row.policy_revision !== MEMORY_POLICY_REVISION)
+        errors.push('policy_revision');
+    if (row.redaction_status?.status !== 'pass' || !MEMORY_HASH.test(row.redaction_status?.rule_digest || ''))
+        errors.push('redaction_status');
+    if (row.jev_decision !== null && (!MEMORY_HASH.test(row.jev_decision?.digest || '') || Object.keys(row.jev_decision).length !== 1))
+        errors.push('jev_decision');
+    if (!['staged', 'needs_confirmation', 'promoted', 'rejected', 'tombstoned'].includes(row.promotion_status))
+        errors.push('promotion_status');
+    if (Buffer.byteLength(JSON.stringify(row)) > JEV_MEMORY_LIMITS.entryBytes)
+        errors.push('entry_bytes');
+    if (containsPlaintextSecret(row) || /data:image\/|[\w.+-]+@[\w.-]+\.[A-Za-z]{2,}|(?:\/Users\/|\/home\/)[^/\s]+/.test(row.text_redacted || ''))
+        errors.push('sensitive_content');
+    if (row.text_hash !== stableDigest(row.text_redacted))
+        errors.push('text_hash_mismatch');
+    if (row.memory_id !== stableDigest({ text: row.text_hash, scope: row.scope, source: row.source_digest }))
+        errors.push('memory_id_mismatch');
+    if (row.idempotency_key !== stableDigest({ workflow: row.workflow_run_id, turn: row.turn_id, candidate: row.candidate_digest }))
+        errors.push('idempotency_key_mismatch');
+    return validationResult('sks.jev-memory-intake.v1', errors);
+}
+export function validateCanonicalMemoryMetadata(value) {
+    const row = value;
+    const errors = row ? [...validateJevMemoryIntake(row.intake).errors] : ['memory_metadata'];
+    if (row)
+        for (const key of ['effective_trust', 'evidence_score', 'priority']) {
+            if (typeof row[key] !== 'number' || !Number.isFinite(row[key]) || row[key] < 0 || row[key] > 1)
+                errors.push(key);
+        }
+    if (row && Object.keys(row).some(key => !['intake', 'effective_trust', 'evidence_score', 'priority'].includes(key)))
+        errors.push('unknown_memory_metadata');
+    return validationResult('sks.canonical-memory-metadata.v1', errors);
+}
+export function validateMemoryTombstone(data) {
+    const row = data;
+    const errors = [];
+    if (!row || row.schema !== 'sks.memory-tombstone.v1')
+        return validationResult('sks.memory-tombstone.v1', ['schema']);
+    if (!MEMORY_HASH.test(row.memory_id) || !MEMORY_HASH.test(row.previous_digest) || row.id !== row.memory_id)
+        errors.push('identity');
+    if (!['explicit_forget', 'policy_quarantine'].includes(row.reason) || !Number.isFinite(Date.parse(row.created_at)))
+        errors.push('reason_or_time');
+    if (Object.keys(row).length !== 6 || containsPlaintextSecret(row))
+        errors.push('unexpected_content');
+    return validationResult('sks.memory-tombstone.v1', errors);
+}
 export const EFFORTS = new Set(['none', 'low', 'medium', 'high', 'xhigh', 'forensic_vision', 'recovery']);
 export const WORK_ORDER_STATUSES = new Set(['pending', 'in_progress', 'implemented', 'verified', 'blocked']);
 export const ARTIFACT_FILES = {

package/dist/core/commands/gc-command.js

@@ -4,6 +4,61 @@ import { flag } from './command-utils.js';
 import { compileMistakeRules } from '../verification/mistake-rule-compiler.js';
 export async function memoryCommand(sub, args = []) {
     const action = String(sub || '').toLowerCase();
+    if (['promote', 'forget', 'recall'].includes(action)) {
+        const root = await sksRoot();
+        const json = flag(args, '--json');
+        if (action === 'promote') {
+            const missionId = String(readOption(args, '--mission', '') || '').trim();
+            if (!missionId || !flag(args, '--yes')) {
+                const blocked = { schema: 'sks.jev-memory-promotion.v1', ok: false, promoted: [], rejected: ['explicit_mission_and_yes_required'] };
+                if (json)
+                    console.log(JSON.stringify(blocked, null, 2));
+                else {
+                    console.log('Memory promotion blocked: pass --mission <id> --yes.');
+                    process.exitCode = 1;
+                }
+                return blocked;
+            }
+            const { promoteJevMemoryIntake } = await import('../git-hygiene/shared-memory-publish.js');
+            const result = await promoteJevMemoryIntake(root, missionId, { explicit: true, requireConfirmation: true });
+            if (json)
+                console.log(JSON.stringify(result, null, 2));
+            else
+                console.log(result.ok ? `Memory promotion: ${result.promoted.length} record(s)` : `Memory promotion blocked: ${result.rejected.join(', ')}`);
+            if (!result.ok)
+                process.exitCode = 1;
+            return result;
+        }
+        if (action === 'forget') {
+            const memoryId = String(readOption(args, '--memory-id', positionalMemoryId(args)) || '').trim();
+            const previousDigest = String(readOption(args, '--previous-digest', '') || '').trim();
+            if (!memoryId || !previousDigest) {
+                const blocked = { schema: 'sks.memory-tombstone.v1', ok: false, blockers: ['memory_id_and_previous_digest_required'] };
+                if (json)
+                    console.log(JSON.stringify(blocked, null, 2));
+                else {
+                    console.log('Memory forget blocked: pass --memory-id <id> --previous-digest <digest>.');
+                    process.exitCode = 1;
+                }
+                return blocked;
+            }
+            const { writeJevMemoryTombstone } = await import('../git-hygiene/shared-memory-publish.js');
+            const result = await writeJevMemoryTombstone(root, { memoryId, previousDigest });
+            const output = { ...result, ok: true };
+            if (json)
+                console.log(JSON.stringify(output, null, 2));
+            else
+                console.log(`Memory tombstone written: ${result.path}`);
+            return output;
+        }
+        const { readSharedMemoryOverlay } = await import('../git-hygiene/shared-memory-publish.js');
+        const result = await readSharedMemoryOverlay(root, { query: String(readOption(args, '--query', '') || ''), highRisk: flag(args, '--high-risk') });
+        if (json)
+            console.log(JSON.stringify(result, null, 2));
+        else
+            console.log(`Memory recall: ${result.available ? result.items.length : `unavailable (${result.reason || 'unknown'})`}`);
+        return result;
+    }
     if (['build', 'project', 'agents', 'agents-md'].includes(action)) {
         const root = await projectRoot();
         const json = flag(args, '--json');
@@ -106,6 +161,9 @@ function readOption(args = [], name, fallback = null) {
     const prefixed = args.find((arg) => String(arg).startsWith(`${name}=`));
     return prefixed ? String(prefixed).slice(name.length + 1) : fallback;
 }
+function positionalMemoryId(args = []) {
+    return (args || []).find((arg) => !String(arg).startsWith('--')) || '';
+}
 export async function statsCommand(args = []) {
     const root = await sksRoot();
     const full = flag(args, '--full');

package/dist/core/commands/wiki-command.js

@@ -14,7 +14,7 @@ import { validateImageVoxelLedger } from '../wiki-image/validation.js';
 import { maybeFinalizeRoute } from '../proof/auto-finalize.js';
 import { wikiWrongnessCommand } from '../triwiki-wrongness/wrongness-cli.js';
 import { recordImageWrongnessFromValidation } from '../triwiki-wrongness/image-wrongness.js';
-import { publishSharedMemory, rebuildSharedIndexes, sharedMemorySummary, validateSharedMemory } from '../git-hygiene/shared-memory-publish.js';
+import { promoteJevMemoryIntake, publishSharedMemory, rebuildSharedIndexes, sharedMemorySummary, validateSharedMemory } from '../git-hygiene/shared-memory-publish.js';
 import { codePackPath, isCodePackProjectionBoundToSnapshot } from '../triwiki/code-pack.js';
 import { runContextGraphLint } from '../triwiki/context-graph/lint/index.js';
 import { contextIndexFreshness } from '../triwiki/context-graph/store/index-freshness.js';
@@ -57,14 +57,28 @@ export async function wikiCommand(sub, args = []) {
     if (sub === 'publish') {
         const root = await sksRoot();
         if (!flag(args, '--shared'))
-            throw new Error('Usage: sks wiki publish latest --shared [--redact] [--json]');
+            throw new Error('Usage: sks wiki publish latest --shared [--redact] [--jev-memory --mission <id>] [--json]');
         const target = positionalArgs(args)[0] || 'latest';
         if (target !== 'latest')
             throw new Error('Usage: sks wiki publish latest --shared [--redact] [--json]');
+        let promotion = null;
+        const missionId = readFlagValue(args, '--mission', '');
+        if (flag(args, '--jev-memory')) {
+            if (!missionId)
+                throw new Error('Usage: --jev-memory requires --mission <id>');
+            promotion = await promoteJevMemoryIntake(root, missionId, { explicit: true, requireConfirmation: true });
+            if (!promotion.ok) {
+                process.exitCode = 2;
+                if (flag(args, '--json'))
+                    return console.log(JSON.stringify({ promotion }, null, 2));
+                console.log(`Jev memory promotion: blocked (${promotion.rejected.join(', ')})`);
+                return;
+            }
+        }
         const result = await publishSharedMemory(root, { target: 'wiki', redact: flag(args, '--redact') });
         process.exitCode = result.ok ? 0 : 2;
         if (flag(args, '--json'))
-            return console.log(JSON.stringify(result, null, 2));
+            return console.log(JSON.stringify({ ...result, ...(promotion ? { promotion } : {}) }, null, 2));
         console.log(`Shared wiki publish: ${result.ok ? 'ok' : 'blocked'}`);
         console.log(`Written: ${result.written.length}`);
         for (const blocker of result.blockers)