superlocalmemory 4.0.2 → 4.0.3

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to SuperLocalMemory will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.0.3] - 2026-08-15 — Consented host integration upgrades
+
+### Added
+- `slm upgrade-hosts` provides a read-only preview of existing SLM host
+  integrations. `--apply` requires either explicit `--host` targets or
+  `--all-detected`; unbounded host mutation is rejected.
+- The npm runtime installer and interactive setup checklist direct existing
+  users to the upgrade preview. README, source docs, and Wiki source document
+  the host-specific upgrade and restart path.
+- Portable Brain evidence is now reachable from the `code`, `full`, and
+  `power` MCP profiles used by installed agents. Profile counts are now code
+  28, full 46, power 58, and whole 91; legacy count-suffixed aliases remain
+  supported.
+- The separately packaged Codex rules and skills are synchronized from the
+  shared plugin source for this release.
+
+### Changed
+- Existing portable MCP blocks are verified and preserved, retaining their
+  host-specific command paths, environment variables, and unrelated servers.
+  Codex refreshes only SLM-owned skills, agents, and lifecycle hooks.
+- Claude Code plugin updates remain owned by its native plugin manager.
+
+### Safety
+- Normal CLI commands and MCP startup no longer auto-install or update Claude
+  Code hooks. Host configuration changes require explicit operator action.
+
 ## [4.0.2] - 2026-08-15 — Portable Living Brain evidence
 
 ### Added

package/README.md

@@ -5,7 +5,7 @@
   </picture>
 </p>
 
-<h1 align="center">SuperLocalMemory V4.0.2</h1>
+<h1 align="center">SuperLocalMemory V4.0.3</h1>
 
 <h2 align="center">Rent the LLM. Own the memory.</h2>
 
@@ -27,12 +27,12 @@ guarantee here is stated as a falsifiable invariant, tested under an adversarial
 negative control, and shipped with the harness that regenerates the evidence:
 <code>python benchmark/run_all.py --trials 200 --output-dir results/</code>. What each experiment
 does <em>not</em> exercise is stated too.</p>
-<p align="center"><code>v4.0.2</code> — one control plane: <strong>SLM-Mesh</strong> peer coordination · multi-scope memory (personal / shared / global) · profiles · Cache · Compress · 7-layer retrieval · code graph · Entity Explorer · skill evolution · Modes A/B/C · GDPR retention &amp; audit chain · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
+<p align="center"><code>v4.0.3</code> — one control plane: <strong>SLM-Mesh</strong> peer coordination · multi-scope memory (personal / shared / global) · profiles · Cache · Compress · 7-layer retrieval · code graph · Entity Explorer · skill evolution · Modes A/B/C · GDPR retention &amp; audit chain · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
 Proxy: <code>slm wrap claude</code> &nbsp;·&nbsp; MCP: add <code>slm_compress</code> to your config &nbsp;·&nbsp; Skill: zero-config</p>
 <p align="center"><strong>Four public arXiv preprints</strong> · V4: <a href="https://arxiv.org/abs/2608.08253">arXiv:2608.08253</a> · companion archive: <a href="https://zenodo.org/records/21853302">Zenodo 21853302</a> (<a href="https://doi.org/10.5281/zenodo.21853302">DOI 10.5281/zenodo.21853302</a>) · prior preprints: <a href="https://arxiv.org/abs/2603.02240">2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">2604.04514</a>.</p>
 
 <p align="center">
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/v4.0.2-Current_Release-2ea44f?style=for-the-badge&logo=checkmarx&logoColor=white" alt="v4.0.2 — Current Release"/></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/v4.0.3-Current_Release-2ea44f?style=for-the-badge&logo=checkmarx&logoColor=white" alt="v4.0.3 — Current Release"/></a>
   <a href="https://arxiv.org/abs/2608.08253"><img src="https://img.shields.io/badge/arXiv-2608.08253-b31b1b?style=for-the-badge&logo=arxiv&logoColor=white" alt="SuperLocalMemory 4.0 paper on arXiv:2608.08253"/></a>
   <a href="https://zenodo.org/records/21853302"><img src="https://img.shields.io/badge/Zenodo-10.5281%2Fzenodo.21853302-1682D4?style=for-the-badge&logo=zenodo&logoColor=white" alt="V4 paper on Zenodo: 10.5281/zenodo.21853302"/></a>
   <a href="https://arxiv.org/abs/2603.14588"><img src="https://img.shields.io/badge/arXiv-2603.14588-b31b1b?style=for-the-badge&logo=arxiv&logoColor=white" alt="arXiv Paper"/></a>
@@ -62,7 +62,7 @@ SuperLocalMemory V4 combines conventional dense and lexical retrieval with graph
 
 **Memory with a sense of time.** SLM does not only store *what* an agent learned — it records *when*. Every fact carries ingestion timing and provenance; recall runs a dedicated temporal candidate channel alongside semantic, lexical, and associative retrieval; scenes and entity timelines reconstruct sequence; and the lifecycle lets neglected memory decay and self-archive instead of growing without bound. Time is a first-class ranking and lifecycle signal rather than a timestamp column an agent never reads — which is what lets a long-lived agent reason about how its context changed, not only what it currently holds.
 
-**What V4.0.2 ships.** V4 is a *governed* local-first control plane — every canonical write is admitted, policy-authorized, tracked as durable per-store obligations (lexical, temporal, vector), and sealed by a completion manifest, so it is either fully applied or explicitly marked degraded, never silently half-done. Flagship surfaces in this release:
+**What V4.0.3 ships.** Existing users can now preview and explicitly refresh SLM-owned host integrations with `slm upgrade-hosts`, while package installation and MCP startup no longer silently modify host hook configuration. V4 remains a *governed* local-first control plane — every canonical write is admitted, policy-authorized, tracked as durable per-store obligations (lexical, temporal, vector), and sealed by a completion manifest, so it is either fully applied or explicitly marked degraded, never silently half-done. Flagship surfaces in this release:
 
 - **[SLM-Mesh](#slm-mesh-cross-session--cross-machine-coordination)** — authenticated cross-session and cross-machine peer coordination (messages, locks, shared state, inbox/outbox, optional discovery). Coordination only — not automatic replicated memory.
 - **Multi-scope memory & profiles** — workspaces (profiles) plus `personal` / `shared` / `global` scopes; cross-profile recall is default-deny.
@@ -71,7 +71,7 @@ SuperLocalMemory V4 combines conventional dense and lexical retrieval with graph
 - **Modes A / B / C** — local-only (A), on-device LLM enrichment (B), provider-assisted (C). An operating mode records technical locality facts; it does **not** determine EU AI Act legal compliance (that is deployment-context assessment — see [Privacy controls](#privacy-controls-and-operating-modes)).
 - **GDPR posture, retention & audit chain** — export, fail-closed cross-store erasure, retention policies, and a hash-chained audit trail. Engineering controls for compliance programs, not a legal certification.
 - **7-layer retrieval/recall stack & code graph** — multi-channel candidates (semantic, BM25, temporal, Hopfield, spreading activation) plus optional code-graph tools for blast radius and review context.
-- **MCP profiles** — `full` exposes **42** tools (default everyday surface); `power` **54**; `whole` **87** (all registered). Also `core` (14), `code` (24), and `mesh` (8).
+- **MCP profiles** — `code` exposes **28** tools for installed coding agents; `full` **46**; `power` **58**; `whole` **91** (all registered). Also `core` (14), `mesh` (8), and the unrestricted default surface (46 with mesh enabled).
 - **Governed write path & verifiable transactions** — admission + policy control, a per-owner obligation ledger, and a hash-sealed completion manifest with a reconciler that redrives unmet obligations.
 - **Self-healing lifecycle & admin remediation** — stale locks cleared on restart; list/resolve stuck operations from CLI, MCP, or the dashboard.
 
@@ -387,6 +387,22 @@ Full docs: [docs/multi-machine.md](docs/multi-machine.md) · [docs/distributed-d
 
 After any install path: `slm setup` → `slm doctor` → `slm warmup` (optional, pre-downloads ~500MB embedding model).
 
+### Upgrading an existing installation
+
+An npm, pip, or repository update upgrades the SLM runtime; it does not silently
+rewrite your IDE configuration, hooks, or plugin state. Review the existing
+integrations first:
+
+```bash
+slm upgrade-hosts
+```
+
+Then explicitly apply the hosts you approve, for example
+`slm upgrade-hosts --host codex --apply`, or use
+`slm upgrade-hosts --all-detected --apply` after reviewing the preview. See
+[Host Integration Upgrades](docs/host-upgrades.md) for the full safety contract
+and the Claude Code plugin update path.
+
 | Component | Size | When |
 |:----------|:-----|:-----|
 | Core libraries (numpy, scipy, networkx) | ~50MB | During install |
@@ -420,11 +436,11 @@ Control tool surface via `SLM_MCP_PROFILE`:
 | Profile | Tools | Use case |
 |:--------|:-----:|:---------|
 | `core` | 14 | Memory, session, and optimize core |
-| `code` | 24 | Core + code-graph tools + profile switching + bounded loops |
+| `code` | 28 | Core + portable Brain evidence + code-graph tools + profile switching + bounded loops |
 | `mesh` | 8 | SLM-Mesh only — multi-session / multi-machine coordination |
-| `full` | 42 | Memory + optimize + evolution + mesh + bounded loops |
-| `power` | 54 | Full + administration, lifecycle, and diagnostics |
-| `whole` | 87 | Every registered MCP tool |
+| `full` | 46 | Memory + portable Brain evidence + optimize + evolution + mesh + bounded loops |
+| `power` | 58 | Full + administration, lifecycle, and diagnostics |
+| `whole` | 91 | Every registered MCP tool |
 
 **Precedence:** `ALL` > `TOOLS` > `PROFILE` > `default`
 
@@ -435,7 +451,7 @@ slm mcp
 
 For a predictable small surface, set `core` explicitly. Leaving the variable
 unset retains the compatibility default, whose mesh tools follow the local
-mesh setting. Count-suffixed aliases remain for backward compatibility and emit a migration warning: `core14`, `code20`, `code21`, `code24`, `mesh8`, `full38`, `full39`, `full42`, `power50`, `power51`, `power54`, `whole81`, `whole84`. Unknown names stop startup instead of silently selecting another tool set.
+mesh setting. Count-suffixed aliases remain for backward compatibility and emit a migration warning: `core14`, `code20`, `code21`, `code24`, `code28`, `mesh8`, `full38`, `full39`, `full42`, `full46`, `power50`, `power51`, `power54`, `power58`, `whole81`, `whole84`, `whole91`. Unknown names stop startup instead of silently selecting another tool set.
 
 Per-IDE configs available for Claude Code, Cursor, Windsurf, VS Code Copilot, Continue, Gemini CLI, JetBrains, Zed, and more (15 configs in `ide/configs/`). See [docs/ide-setup.md](docs/ide-setup.md).
 
@@ -647,25 +663,12 @@ Multi-Agent Memory workspace.
 
 ## Framework Adapters (V4)
 
-SLM ships nine framework adapters under `ide/integrations/`. Each adapter
-wires SLM as the memory and history provider for the respective framework
-without replacing the framework's own agent runtime.
-
-| Framework | Directory |
-|-----------|-----------|
-| LangGraph | `ide/integrations/langgraph/` |
-| Semantic Kernel | `ide/integrations/semantic-kernel/` |
-| Microsoft Agent Framework | `ide/integrations/agent-framework/` |
-| LangChain | `ide/integrations/langchain/` |
-| LlamaIndex | `ide/integrations/llamaindex/` |
-| CrewAI | `ide/integrations/crewai/` |
-| AutoGen | `ide/integrations/autogen/` |
-| Google ADK | `ide/integrations/google-adk/` |
-| OpenAI Agents | `ide/integrations/openai-agents/` |
-
-Pydantic AI is not included — it does not expose a formal memory interface for
-external providers. Each adapter's `README.md` covers installation and
-configuration for that framework.
+SLM ships nine adapters under `ide/integrations/`: LangGraph, Semantic Kernel,
+Microsoft Agent Framework, LangChain, LlamaIndex, CrewAI, AutoGen, Google ADK,
+and OpenAI Agents. Each wires SLM as memory and history without replacing the
+framework runtime; its directory contains installation/configuration guidance.
+Pydantic AI is not included because it does not expose a formal external-memory
+interface.
 
 ---
 
@@ -697,21 +700,13 @@ runtime capability is enabled and healthy. See [CHANGELOG.md](CHANGELOG.md) for
 the complete release history.
 ## Research Papers
 
-SuperLocalMemory has a V4 arXiv preprint with a companion Zenodo archive, plus three earlier arXiv preprints (2026):
-
-- **SuperLocalMemory 4.0: The Governed Memory Operating System for AI Agents:** [arXiv:2608.08253](https://arxiv.org/abs/2608.08253) · [Zenodo 21853302](https://zenodo.org/records/21853302) · [DOI 10.5281/zenodo.21853302](https://doi.org/10.5281/zenodo.21853302).
-- **The Living Brain (V3.3):** [arXiv:2604.04514](https://arxiv.org/abs/2604.04514) · [Zenodo 19435120](https://zenodo.org/records/19435120)
-- **Information-Geometric Foundations (V3):** [arXiv:2603.14588](https://arxiv.org/abs/2603.14588) · [Zenodo 19038659](https://zenodo.org/records/19038659)
-- **Trust & Behavioral Foundations (V2):** [arXiv:2603.02240](https://arxiv.org/abs/2603.02240) · [Zenodo 18709670](https://zenodo.org/records/18709670)
+SuperLocalMemory has a V4 [arXiv preprint](https://arxiv.org/abs/2608.08253) with [Zenodo archive](https://zenodo.org/records/21853302) and [DOI](https://doi.org/10.5281/zenodo.21853302), plus [The Living Brain (V3.3)](https://arxiv.org/abs/2604.04514), [Information-Geometric Foundations (V3)](https://arxiv.org/abs/2603.14588), and [Trust & Behavioral Foundations (V2)](https://arxiv.org/abs/2603.02240).
 
 Use the citation metadata on the linked arXiv or Zenodo records.
 
 ## Support / License / Qualixar
-See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines, the [Wiki](https://github.com/qualixar/superlocalmemory/wiki) for detailed documentation, and [LICENSE](LICENSE) for the GNU Affero General Public License v3.0 (AGPL-3.0).
-For commercial licensing (closed-source, proprietary, or hosted use), see [COMMERCIAL-LICENSE.md](COMMERCIAL-LICENSE.md) or contact varun.pratap.bhardwaj@gmail.com.
-Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar · Part of [Qualixar](https://qualixar.com) · Author: [Varun Pratap Bhardwaj](https://varunpratap.com)
-Acknowledgments: [Everything Claude Code](https://github.com/affaan-m/everything-claude-code) informed skill observation; [HKUDS/OpenSpace](https://github.com/HKUDS/OpenSpace) informed skill-evolution verification.
-Qualixar builds open-source infrastructure for AI reliability engineering. Start at [qualixar.com](https://qualixar.com) or browse the [research archive](https://huggingface.co/Qualixar).
+See [CONTRIBUTING.md](CONTRIBUTING.md), the [Wiki](https://github.com/qualixar/superlocalmemory/wiki), and [LICENSE](LICENSE) (AGPL-3.0). For commercial licensing, see [COMMERCIAL-LICENSE.md](COMMERCIAL-LICENSE.md) or contact varun.pratap.bhardwaj@gmail.com.
+Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar · [Qualixar](https://qualixar.com) · [research archive](https://huggingface.co/Qualixar). Acknowledgments: [Everything Claude Code](https://github.com/affaan-m/everything-claude-code) informed skill observation; [HKUDS/OpenSpace](https://github.com/HKUDS/OpenSpace) informed skill-evolution verification.
 
 ## Star This Project
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superlocalmemory",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "description": "Local-first agent memory with MCP and an agent-native CLI. Documented clients include Claude Code, Cursor, and Windsurf.",
   "keywords": [
     "ai-memory",

package/plugin/.claude-plugin/plugin.json

@@ -15,5 +15,5 @@
   "mcpServers": "./.mcp.json",
   "name": "superlocalmemory",
   "repository": "https://github.com/qualixar/superlocalmemory",
-  "version": "4.0.2"
+  "version": "4.0.3"
 }

package/plugin/CLAUDE.md

@@ -1,4 +1,4 @@
-<!-- BEGIN SuperLocalMemory v4.0.2 -->
+<!-- BEGIN SuperLocalMemory v4.0.3 -->
 
 ## SuperLocalMemory (SLM) — Agent Rules
 
@@ -39,6 +39,6 @@ slm-recall · slm-remember · slm-session · slm-status · slm-cache · slm-comp
 ### Subagents
 slm-memory-advisor (memory decisions, session hygiene, scope/profile guidance) · slm-optimize-advisor (context compression + KV cache) · slm-governance-advisor (scope/roles/compliance/GDPR)
 
-<!-- END SuperLocalMemory v4.0.2 -->
+<!-- END SuperLocalMemory v4.0.3 -->
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-governance-advisor.md

@@ -77,4 +77,4 @@ slm-scope · slm-governance · slm-profile · slm-remember · slm-recall
 # What NOT to do
 Never session_init twice; never forget without dry-run preview; never store secrets; never bypass role checks; never claim an erasure succeeded without verifying via recall.
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-loop-runner.md

@@ -68,4 +68,4 @@ assessment. The gate is the authority.
 
 ---
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-memory-advisor.md

@@ -46,4 +46,4 @@ slm-recall · slm-remember · slm-session · slm-scope · slm-profile · slm-gov
 # What NOT to do
 Never session_init twice; never forget dry_run=False without reporting preview; never dump a whole file into remember; never invent a memory; never claim "saved" without success:true / clean CLI exit; never bypass scope or governance restrictions.
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-optimize-advisor.md

@@ -41,4 +41,4 @@ slm-compress · slm-cache · slm-status · slm-profile
 # What NOT to do
 Never compress code-for-edit/JSON-to-parse/<500 chars; never store secrets/ccr_ids; never let optimize failure block/alter the task; never claim a specific savings %; never carry ccr_ids across profile switches.
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin/requirements.txt

@@ -1 +1 @@
-superlocalmemory==4.0.2
+superlocalmemory==4.0.3

package/plugin/skills/slm-cache/SKILL.md

@@ -145,4 +145,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-compress/SKILL.md

@@ -147,4 +147,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-governance/SKILL.md

@@ -245,4 +245,4 @@ Before running any destructive operation (`forget`, `compact_memories`):
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-graph/SKILL.md

@@ -311,4 +311,4 @@ profile. See `slm-profile` for the full profile switching workflow.
 
 ---
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-loop/SKILL.md

@@ -96,4 +96,4 @@ paused, name the approval needed; when errored, quote the short detail.
 
 ---
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-mesh/SKILL.md

@@ -279,4 +279,4 @@ mesh availability.
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-profile/SKILL.md

@@ -31,9 +31,9 @@ project, a client engagement, a production vs staging environment.
 | Profile | Tools | When to use |
 |---------|-------|-------------|
 | `core` | 14 tools — remember, recall, search, session, optimize | Minimal footprint, no code tools |
-| `code` | 24 tools — core + 6 code-graph tools + switch_profile + 3 bounded-loop tools | Default for IDE/coding agents |
-| `full` | 42 tools — code + all memory ops + mesh + bounded loops | Multi-session, team workflows |
-| `power` | 54 tools — full + governance + behavioral tools | Enterprise, admin, audit use cases |
+| `code` | 28 tools — core + portable Brain evidence + code graph + profile switching + bounded loops | Default for IDE/coding agents |
+| `full` | 46 tools — code + all memory ops + mesh + bounded loops | Multi-session, team workflows |
+| `power` | 58 tools — full + governance + behavioral tools | Enterprise, admin, audit use cases |
 | `mesh` | 8 tools — mesh coordination only | Lightweight cross-session signalling |
 
 The profile is set at MCP server startup via `SLM_MCP_PROFILE` in the MCP config.
@@ -145,4 +145,4 @@ Name them differently in your MCP config (e.g. `superlocalmemory-personal` and
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-recall/SKILL.md

@@ -236,4 +236,4 @@ before recalling, then switch back. See `slm-profile` for workspace switching.
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-remember/SKILL.md

@@ -238,4 +238,4 @@ different workspace, use `switch_profile` first. See `slm-profile`.
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-scope/SKILL.md

@@ -173,4 +173,4 @@ to review the impact. See `slm-remember` for the full deletion discipline.
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-session/SKILL.md

@@ -227,4 +227,4 @@ explicitly and call `recall` with `include_global`/`include_shared` after
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-status/SKILL.md

@@ -163,4 +163,4 @@ multi-profile setup. To switch the active profile, see `slm-profile`.
 
 ---
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin-src/rules/AGENTS.md

@@ -82,10 +82,10 @@ When the SLM MCP server is unavailable, use these CLI equivalents:
 
 ## Tool reference (core profile — 14 tools)
 
-> The MCP config ships `SLM_MCP_PROFILE=code` (24 tools): the 14 core memory tools below
+> The MCP config ships `SLM_MCP_PROFILE=code` (28 tools): the 14 core memory tools below
 > **plus** 6 code-graph tools (`build_code_graph`, `get_blast_radius`, `query_graph`,
 > `semantic_search_code`, `get_review_context`, `detect_changes`) and `switch_profile`.
-> Use `full` (42 tools) to add mesh coordination. Use `power` (54 tools) for governance
+> Use `full` (46 tools) to add mesh coordination. Use `power` (58 tools) for governance
 > and audit tools. See slm-profile for profile switching.
 
 | Tool               | Signature (key params)                                                                       | Notes                                  |
@@ -128,4 +128,4 @@ When the SLM MCP server is unavailable, use these CLI equivalents:
 - **slm-optimize-advisor** — context compression and KV cache
 - **slm-governance-advisor** — scope/role compliance, retention policies, GDPR
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-cache/SKILL.md

@@ -145,4 +145,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-compress/SKILL.md

@@ -147,4 +147,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-governance/SKILL.md

@@ -245,4 +245,4 @@ Before running any destructive operation (`forget`, `compact_memories`):
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-graph/SKILL.md

@@ -311,4 +311,4 @@ profile. See `slm-profile` for the full profile switching workflow.
 
 ---
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-loop/SKILL.md

@@ -96,4 +96,4 @@ paused, name the approval needed; when errored, quote the short detail.
 
 ---
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-mesh/SKILL.md

@@ -279,4 +279,4 @@ mesh availability.
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-profile/SKILL.md

@@ -31,9 +31,9 @@ project, a client engagement, a production vs staging environment.
 | Profile | Tools | When to use |
 |---------|-------|-------------|
 | `core` | 14 tools — remember, recall, search, session, optimize | Minimal footprint, no code tools |
-| `code` | 24 tools — core + 6 code-graph tools + switch_profile + 3 bounded-loop tools | Default for IDE/coding agents |
-| `full` | 42 tools — code + all memory ops + mesh + bounded loops | Multi-session, team workflows |
-| `power` | 54 tools — full + governance + behavioral tools | Enterprise, admin, audit use cases |
+| `code` | 28 tools — core + portable Brain evidence + code graph + profile switching + bounded loops | Default for IDE/coding agents |
+| `full` | 46 tools — code + all memory ops + mesh + bounded loops | Multi-session, team workflows |
+| `power` | 58 tools — full + governance + behavioral tools | Enterprise, admin, audit use cases |
 | `mesh` | 8 tools — mesh coordination only | Lightweight cross-session signalling |
 
 The profile is set at MCP server startup via `SLM_MCP_PROFILE` in the MCP config.
@@ -145,4 +145,4 @@ Name them differently in your MCP config (e.g. `superlocalmemory-personal` and
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-recall/SKILL.md

@@ -236,4 +236,4 @@ before recalling, then switch back. See `slm-profile` for workspace switching.
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-remember/SKILL.md

@@ -238,4 +238,4 @@ different workspace, use `switch_profile` first. See `slm-profile`.
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-scope/SKILL.md

@@ -173,4 +173,4 @@ to review the impact. See `slm-remember` for the full deletion discipline.
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-session/SKILL.md

@@ -227,4 +227,4 @@ explicitly and call `recall` with `include_global`/`include_shared` after
 
 ---
 
-*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-status/SKILL.md

@@ -163,4 +163,4 @@ multi-profile setup. To switch the active profile, see `slm-profile`.
 
 ---
 
-SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.3 · Qualixar · AGPL-3.0-or-later

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superlocalmemory"
-version = "4.0.2"
+version = "4.0.3"
 description = "Local-first agent memory with auditable hybrid retrieval"
 readme = "README.md"
 license = "AGPL-3.0-or-later"

package/scripts/postinstall-interactive.js

@@ -554,6 +554,7 @@ function printFirstRunChecklist(config) {
   console.log('Next steps:');
   console.log('  slm status --verbose       — daemon, mode, dashboard, health');
   console.log('  slm doctor                 — run health checks (DB, models, ports)');
+  console.log('  slm upgrade-hosts          — preview existing host integrations after an update');
   console.log('  slm health --watch         — live health ladder readout');
   console.log('  slm dashboard              — open the dashboard in your browser');
   console.log('');

package/scripts/postinstall.js

@@ -206,6 +206,10 @@ function main(argv = process.argv.slice(2)) {
   console.log('');
   console.log('      slm setup');
   console.log('');
+  console.log('  If this updated an existing SLM installation, preview host integrations first:');
+  console.log('');
+  console.log('      slm upgrade-hosts');
+  console.log('');
   console.log('  Prefer to tune performance profiles? Use:  slm reconfigure');
   console.log('');
   return 0;

package/src/superlocalmemory/__init__.py

@@ -32,7 +32,7 @@ if "OMP_NUM_THREADS" not in os.environ:
     os.environ["OMP_NUM_THREADS"] = "2"
 # ---------------------------------------------------------------------------
 
-__version__ = "4.0.2"
+__version__ = "4.0.3"
 
 _REQUIRED_VERSIONS = {
     "sentence_transformers": "5.3.0",

package/src/superlocalmemory/cli/commands.py

@@ -321,25 +321,22 @@ def cmd_session(args: Namespace) -> None:
         print("Session close failed (daemon unreachable?)")
 
 
+def _cmd_upgrade_hosts(args: Namespace) -> None:
+    """Run the consented host-integration refresh command."""
+    from superlocalmemory.cli.host_upgrades import cmd_upgrade_hosts
+
+    cmd_upgrade_hosts(args)
+
+
 def dispatch(args: Namespace) -> None:
     """Route CLI command to the appropriate handler."""
-    # Auto-install/upgrade hooks on version change (single file read, ~0.1ms)
-    if (
-        args.command not in ("hooks", "codex", "init", "mcp")
-        and not getattr(args, "dry_run", False)
-    ):
-        try:
-            from superlocalmemory.hooks.claude_code_hooks import auto_install_if_needed
-            auto_install_if_needed()
-        except Exception:
-            pass
-
     handlers = {
         "init": cmd_init,
         "setup": cmd_setup,
         "mode": cmd_mode,
         "provider": cmd_provider,
         "connect": cmd_connect,
+        "upgrade-hosts": _cmd_upgrade_hosts,
         "migrate": cmd_migrate,
         "list": cmd_list,
         "remember": cmd_remember,
@@ -2151,6 +2148,7 @@ _COMMAND_GROUPS: list[tuple[str, list[tuple[str, str]]]] = [
         ("mode", "Switch memory mode: a (local) / b (Ollama) / c (cloud)"),
         ("provider", "Configure the cloud LLM provider + API key (Mode C)"),
         ("connect", "Auto-configure detected IDEs (Cursor, VS Code, …)"),
+        ("upgrade-hosts", "Preview or explicitly refresh existing SLM host integrations"),
         ("hooks", "Install/inspect Claude Code hooks"),
         ("codex", "Configure the Codex / OpenAI integration"),
     ]),
@@ -2206,6 +2204,7 @@ _COMMAND_GROUPS: list[tuple[str, list[tuple[str, str]]]] = [
     ("Learning & maintenance", [
         ("evolve", "Skill-evolution controls"),
         ("observe", "External observation / telemetry ingestion"),
+        ("brain", "Show profile-scoped Living Brain evidence"),
         ("decay", "Run a forgetting/decay pass"),
         ("consolidate", "Merge/consolidate related memories"),
         ("quantize", "Quantize embeddings to save space"),
@@ -2967,14 +2966,6 @@ def cmd_mcp(_args: Namespace) -> None:
     except Exception:
         pass  # A diagnostic must never prevent the server from starting.
 
-    # Auto-install hooks on MCP startup (fast path: ~0.1ms if already current)
-    # CRITICAL: No stdout — MCP uses stdio transport, any print corrupts protocol
-    try:
-        from superlocalmemory.hooks.claude_code_hooks import auto_install_if_needed
-        auto_install_if_needed()
-    except Exception:
-        pass
-
     from superlocalmemory.mcp.server import server
 
     server.run(transport="stdio")

package/src/superlocalmemory/cli/host_upgrades.py

@@ -0,0 +1,175 @@
+"""Consented, non-destructive upgrades for existing host integrations.
+
+Package installation owns the SLM executable.  This module owns the separate
+operator-approved step that refreshes SLM-owned integration assets.  It never
+discovers a host and edits it implicitly: preview is the default and apply
+requires either explicit hosts or an explicit all-detected acknowledgement.
+"""
+
+from __future__ import annotations
+
+from argparse import Namespace
+from pathlib import Path
+from typing import Any
+
+
+def validate_upgrade_request(*, apply: bool, hosts: list[str], all_detected: bool) -> None:
+    """Reject unbounded mutations before any host filesystem access."""
+    if apply and not hosts and not all_detected:
+        raise ValueError("--apply requires at least one --host or --all-detected")
+    if hosts and all_detected:
+        raise ValueError("choose explicit --host values or --all-detected, not both")
+
+
+def cmd_upgrade_hosts(args: Namespace) -> None:
+    """Preview or explicitly apply host integration refreshes."""
+    hosts = list(getattr(args, "hosts", []) or [])
+    apply = bool(getattr(args, "apply", False))
+    all_detected = bool(getattr(args, "all_detected", False))
+    try:
+        validate_upgrade_request(apply=apply, hosts=hosts, all_detected=all_detected)
+    except ValueError as exc:
+        print(f"Error: {exc}")
+        return
+
+    from superlocalmemory.hooks.portable_kit import supported_ides
+
+    detected = set(_detected_hosts())
+    targets = sorted(detected) if all_detected else (hosts or sorted(detected))
+    managed_hosts = set(supported_ides()) | {"claude-code", "hermes"}
+    unknown = sorted(set(targets) - managed_hosts)
+    if unknown:
+        print(f"Error: unsupported host(s): {', '.join(unknown)}")
+        return
+    if not targets:
+        print("No existing SLM host integrations were detected.")
+        print("Run `slm setup` for first-time setup, or use `--host <name>` to target one host.")
+        return
+
+    operation = "Applying" if apply else "Previewing"
+    print(f"{operation} SLM host upgrades: {', '.join(targets)}")
+    if not apply:
+        print("No host files will be changed. Re-run with --apply and explicit targets to proceed.")
+
+    for host in targets:
+        result = _upgrade_host(host, apply=apply, already_integrated=host in detected)
+        status = result.get("status", "error")
+        detail = result.get("detail", "")
+        print(f"  [{status}] {host}: {detail}")
+
+    if apply:
+        print("Restart affected host applications, then run `slm doctor` to verify SLM itself.")
+
+
+def _detected_hosts(home: Path | None = None) -> list[str]:
+    """Return only hosts already containing an SLM-owned integration block."""
+    from superlocalmemory.hooks.portable_kit import (
+        IDE_MATRIX,
+        _load_config,
+        _ParseError,
+    )
+
+    effective_home = home or Path.home()
+    detected: list[str] = []
+    for host, desc in IDE_MATRIX.items():
+        if not desc.fmt:
+            continue
+        path = effective_home / desc.mcp_path_global
+        try:
+            data = _load_config(path, desc.fmt)
+        except _ParseError:
+            continue
+        if _contains_slm_block(data, desc):
+            detected.append(host)
+
+    # Claude Code's plugin is host-managed. A local SLM hook installation is
+    # the durable evidence that its SLM integration exists; upgrading the
+    # plugin remains an explicit Claude Code marketplace action.
+    try:
+        from superlocalmemory.hooks.claude_code_hooks import check_status
+
+        if check_status().get("installed"):
+            detected.append("claude-code")
+    except Exception:
+        pass
+
+    # Hermes has a native YAML mapping rather than the portable-kit schema.
+    # Detect it for reporting, but never overwrite it with an invented format.
+    hermes_path = effective_home / ".hermes" / "config.yaml"
+    try:
+        hermes = _load_config(hermes_path, "yaml")
+        servers = hermes.get("mcp_servers", {})
+        if isinstance(servers, dict) and "superlocalmemory" in servers:
+            detected.append("hermes")
+    except _ParseError:
+        pass
+    return sorted(set(detected))
+
+
+def _contains_slm_block(data: dict[str, Any], desc: Any) -> bool:
+    if desc.fmt == "yaml":
+        providers = data.get(desc.server_key, [])
+        return isinstance(providers, list) and any(
+            isinstance(item, dict)
+            and item.get("params", {}).get("serverName") == "superlocalmemory"
+            for item in providers
+        )
+    servers = data.get(desc.server_key, {})
+    return isinstance(servers, dict) and "superlocalmemory" in servers
+
+
+def _upgrade_host(host: str, *, apply: bool, already_integrated: bool) -> dict[str, str]:
+    """Refresh assets without degrading a working, host-specific MCP block."""
+    if host == "claude-code":
+        return {
+            "status": "plugin-managed",
+            "detail": "run `claude plugin update superlocalmemory@qualixar` in Claude Code",
+        }
+
+    if host == "hermes":
+        if already_integrated:
+            return {
+                "status": "verified",
+                "detail": "existing native Hermes SLM mapping preserved",
+            }
+        return {
+            "status": "blocked",
+            "detail": "Hermes is not connected; follow docs/ide-setup.md before retrying",
+        }
+
+    if host == "codex" and already_integrated:
+        from superlocalmemory.hooks.codex_assets import install_assets
+        from superlocalmemory.hooks.codex_hooks import install_hooks
+
+        assets, hooks = install_assets(dry_run=not apply), install_hooks(dry_run=not apply)
+        if not assets.get("success") or not hooks.get("success"):
+            return {"status": "blocked", "detail": "could not refresh SLM-owned Codex assets"}
+        action = "would refresh" if not apply else "refreshed"
+        return {
+            "status": "updated" if apply else "preview",
+            "detail": (
+                f"{action} SLM-owned Codex skills, agents, and hooks; "
+                "MCP block preserved"
+            ),
+        }
+
+    if already_integrated:
+        return {
+            "status": "verified",
+            "detail": "existing SLM MCP block preserved; no portable host assets require refresh",
+        }
+
+    # An explicitly named, not-yet-connected host is a first-time connection.
+    # This branch is never reached by --all-detected.
+    from superlocalmemory.hooks.portable_kit import connect_ide
+
+    result = connect_ide(host, dry_run=not apply)
+    if result.get("error"):
+        return {"status": "blocked", "detail": str(result["error"])}
+    action = result.get("mcp_config", "unknown")
+    if not apply:
+        return {"status": "preview", "detail": f"would refresh SLM MCP block ({action})"}
+    return {"status": "updated", "detail": f"SLM MCP block {action}"}
+
+
+__all__ = ("cmd_upgrade_hosts", "validate_upgrade_request")

package/src/superlocalmemory/cli/main.py

@@ -69,7 +69,7 @@ documentation:
 
 
 _NO_DAEMON_COMMANDS = {
-    "setup", "mode", "provider", "connect", "migrate", "mcp", "warmup", "hooks", "codex",
+    "setup", "mode", "provider", "connect", "upgrade-hosts", "migrate", "mcp", "warmup", "hooks", "codex",
     "config", "evolve", "db",
     # v3.4.22 escape hatches — never auto-start the daemon on these.
     "disable", "enable", "clear-cache", "reconfigure", "benchmark",
@@ -123,12 +123,17 @@ def main() -> None:
         and sys.argv[1] == "connect"
         and "--dry-run" in sys.argv[2:]
     )
+    _is_host_upgrade_preview = (
+        len(sys.argv) >= 2
+        and sys.argv[1] == "upgrade-hosts"
+        and "--apply" not in sys.argv[2:]
+    )
 
     # WP-07: lazy first-run init — runs after hook/mcp fast-paths so stdout
     # is never polluted on those paths (CRIT-3, MCP JSON-RPC purity).
     # Guarded: any failure must not crash the CLI (AC4).
     _is_mcp_cmd = len(sys.argv) >= 2 and sys.argv[1] == "mcp"
-    if not _is_mcp_cmd and not _is_metadata_cmd and not _is_connect_dry_run:
+    if not _is_mcp_cmd and not _is_metadata_cmd and not _is_connect_dry_run and not _is_host_upgrade_preview:
         try:
             from superlocalmemory.cli._lazy_init import _ensure_initialized
             _ensure_initialized()
@@ -148,7 +153,7 @@ def main() -> None:
 
     # One-time post-upgrade banner — silent for fresh installs and
     # same-version runs. Guarded against I/O errors internally.
-    if not _is_mcp_stdio and not _is_metadata_cmd and not _is_connect_dry_run:
+    if not _is_mcp_stdio and not _is_metadata_cmd and not _is_connect_dry_run and not _is_host_upgrade_preview:
         from superlocalmemory.cli.version_banner import check_and_emit_upgrade_banner
         if check_and_emit_upgrade_banner(_ver):
             # First post-upgrade invocation: apply the data-dir migration if
@@ -285,6 +290,23 @@ def main() -> None:
         ),
     )
 
+    upgrade_p = sub.add_parser(
+        "upgrade-hosts",
+        help="Preview or explicitly refresh installed SLM host integrations",
+    )
+    upgrade_p.add_argument(
+        "--host", action="append", dest="hosts", default=[],
+        help="Explicit host to refresh (repeatable; for example: codex, cursor)",
+    )
+    upgrade_p.add_argument(
+        "--all-detected", action="store_true", default=False,
+        help="Target only hosts that already contain an SLM integration",
+    )
+    upgrade_p.add_argument(
+        "--apply", action="store_true", default=False,
+        help="Apply the previewed changes; default is read-only preview",
+    )
+
     migrate_p = sub.add_parser("migrate", help="Migrate data from V2 to V3 schema")
     migrate_p.add_argument(
         "--rollback", action="store_true", help="Rollback migration",
@@ -966,7 +988,10 @@ def main() -> None:
         sys.exit(0)
 
     # V3.3.19: Auto-trigger setup wizard on first use
-    if not (args.command == "connect" and getattr(args, "dry_run", False)):
+    if not (
+        (args.command == "connect" and getattr(args, "dry_run", False))
+        or (args.command == "upgrade-hosts" and not getattr(args, "apply", False))
+    ):
         from superlocalmemory.cli.setup_wizard import check_first_use
         check_first_use(args.command)
 

package/src/superlocalmemory/mcp/profiles.py

@@ -23,7 +23,14 @@ _PROFILE_CORE: frozenset[str] = frozenset({  # 14
     "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
 })
 
-_PROFILE_CODE: frozenset[str] = _PROFILE_CORE | frozenset({  # 24
+# Portable Brain evidence must reach the coding-host profile shipped by the
+# Claude/Codex plugins, not only an unrestricted server.
+_PROFILE_BRAIN: frozenset[str] = frozenset({
+    "get_brain_evidence_status", "record_agent_experience",
+    "record_cognitive_turn", "finalize_cognitive_turn",
+})
+
+_PROFILE_CODE: frozenset[str] = _PROFILE_CORE | _PROFILE_BRAIN | frozenset({  # 28
     "build_code_graph", "get_blast_radius", "query_graph",
     "semantic_search_code", "get_review_context", "detect_changes",
     # switch_profile lets a plugin/IDE session change the active workspace over
@@ -40,23 +47,21 @@ _PROFILE_FULL_MESH: frozenset[str] = frozenset({  # 8
     "mesh_state", "mesh_lock", "mesh_events", "mesh_status",
 })
 
-_PROFILE_FULL: frozenset[str] = frozenset({  # 34 base — EXPLICIT literal, NOT runtime _ESSENTIAL_TOOLS (OQ-2)
+_PROFILE_FULL: frozenset[str] = frozenset({  # 38 base — EXPLICIT literal, NOT runtime _ESSENTIAL_TOOLS (OQ-2)
     "remember", "recall", "search", "fetch", "list_recent", "delete_memory", "update_memory",
     "get_status", "session_init", "observe", "close_session", "report_feedback", "forget",
     "run_maintenance", "consolidate_cognitive", "get_soft_prompts", "set_mode", "report_outcome",
     "log_tool_event", "get_assertions", "reinforce_assertion", "contradict_assertion",
+    "get_brain_evidence_status", "record_agent_experience",
+    "record_cognitive_turn", "finalize_cognitive_turn",
     "evolve_skill", "skill_health", "skill_lineage", "switch_profile",
     "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
     # v3.8.0: bounded-loop tools (CLI + /slm-loop command + MCP).
     "slm_loop_run", "slm_loop_history", "slm_loop_show",
-    # v4: prestage_context IS registered (see mcp/server.py) but is deliberately
-    # NOT in full/power. The profile names are a user-facing config contract
-    # (SLM_MCP_PROFILE=full42) and the published tool-count table depends on
-    # them; adding a tool here would make "full42" serve 43 tools. New tools
-    # reach users through the `whole` profile until a profile rename is shipped.
-}) | _PROFILE_FULL_MESH  # 42
+    # prestage_context remains registered but deliberately raw-server-only.
+}) | _PROFILE_FULL_MESH  # 46
 
-_PROFILE_POWER: frozenset[str] = _PROFILE_FULL | frozenset({  # 54
+_PROFILE_POWER: frozenset[str] = _PROFILE_FULL | frozenset({  # 58
     "get_version", "get_mode", "health", "consistency_check", "recall_trace",
     "get_lifecycle_status", "set_retention_policy", "compact_memories",
     "get_behavioral_patterns", "audit_trail", "quantize", "get_retention_stats",
@@ -85,15 +90,19 @@ _PROFILE_ALIASES: dict[str, str] = {
     "code20": "code",
     "code21": "code",
     "code24": "code",
+    "code28": "code",
     "full38": "full",
     "full39": "full",
     "full42": "full",
+    "full46": "full",
     "power50": "power",
     "power51": "power",
     "power54": "power",
+    "power58": "power",
     "mesh8": "mesh",
     "whole81": "whole",
     "whole84": "whole",
+    "whole91": "whole",
 }
 
 # Plain-English descriptions for UI display.
@@ -101,8 +110,8 @@ _PROFILE_ALIASES: dict[str, str] = {
 # one sentence, user-facing language only.
 PROFILE_DESCRIPTIONS: dict[str, str] = {
     "core": "Essential memory: store, recall, search, sessions",
-    "code": "Core + code-graph tools + profile switching (default for IDE coding agents)",
-    "full": "All everyday memory, optimization, and mesh tools",
-    "power": "Everything in full plus advanced governance/behavioral tools",
+    "code": "Core + code graph, portable Brain evidence, and profile switching (default for IDE coding agents)",
+    "full": "All everyday memory, portable Brain evidence, optimization, and mesh tools",
+    "power": "Everything in full plus advanced governance and behavioral tools",
     "mesh": "Cross-device mesh coordination only",
 }

package/src/superlocalmemory/mcp/server.py

@@ -77,13 +77,13 @@ def reset_engine():
 
 # Register tools and resources -------------------------------------------------
 #
-# Essential-only default: 34 base tools + 8 mesh tools = 42 registered
+# Essential-only default: 38 base tools + 8 mesh tools = 46 registered
 # when mesh is enabled. Set ``SLM_MCP_ALL_TOOLS=1`` to expose the full
 # toolset. Rationale: IDEs cap at 50-100 tools total (Cursor,
 # Antigravity, Windsurf) and a maximal SLM registration crowds out
 # other MCP servers the user may have installed.
 # Admin/diagnostics tools remain available via CLI (`slm <command>`).
-# Set SLM_MCP_ALL_TOOLS=1 to enable all 87 tools (power users).
+# Set SLM_MCP_ALL_TOOLS=1 to enable all 91 tools (power users).
 
 import os as _os_reg
 
@@ -103,10 +103,8 @@ _ESSENTIAL_TOOLS: set[str] = {
     # Memory management (2)
     "forget", "run_maintenance",
     # NOTE: prestage_context IS registered (see register_prestage_tool below)
-    # but is deliberately absent from the default surface. _ESSENTIAL_TOOLS must
-    # stay at 42 to match the full42 profile: the profile names are a
-    # user-facing config contract and the published tool-count table depends on
-    # them. New tools reach users via the `whole` profile until a rename ships.
+    # but is deliberately absent from the default surface. Brain evidence is
+    # intentionally present: it is the portable contract for installed agents.
     # Infinite memory + learning (4)
     "consolidate_cognitive", "get_soft_prompts",
     "set_mode", "report_outcome",

package/src/superlocalmemory/ui/js/od-mcp.js

@@ -9,9 +9,9 @@
 //     current: "core",
 //     profiles: {
 //       core:  { count: 14, tools: [...], description: "..." },
-//       code:  { count: 24, tools: [...], description: "..." },
-//       full:  { count: 42, tools: [...], description: "..." },
-//       power: { count: 54, tools: [...], description: "..." },
+//       code:  { count: 28, tools: [...], description: "..." },
+//       full:  { count: 46, tools: [...], description: "..." },
+//       power: { count: 58, tools: [...], description: "..." },
 //       mesh:  { count:  8, tools: [...], description: "..." },
 //     },
 //     aliases: { "code21": "code", ... },
@@ -370,9 +370,9 @@
     codeBlock.textContent =
       '"env": {\n' +
       '  "SLM_MCP_PROFILE": "core"    // 14 tools — minimal\n' +
-      '  // "SLM_MCP_PROFILE": "code"  // 24 tools — + code graph + loops\n' +
-      '  // "SLM_MCP_PROFILE": "full"  // 42 tools — + mesh\n' +
-      '  // "SLM_MCP_PROFILE": "power" // 54 tools — + governance\n' +
+      '  // "SLM_MCP_PROFILE": "code"  // 28 tools — + Brain, code graph, loops\n' +
+      '  // "SLM_MCP_PROFILE": "full"  // 46 tools — + mesh\n' +
+      '  // "SLM_MCP_PROFILE": "power" // 58 tools — + governance\n' +
       '  // "SLM_MCP_PROFILE": "mesh"  //  8 tools — mesh only\n' +
       '}';
     body2.appendChild(codeBlock);