superlocalmemory 4.1.22 → 4.1.23

package/.claude-plugin/marketplace.json

@@ -21,7 +21,7 @@
       "license": "AGPL-3.0-or-later",
       "name": "superlocalmemory",
       "source": "./plugin",
-      "version": "4.1.22"
+      "version": "4.1.23"
     },
     {
       "author": {
@@ -39,7 +39,7 @@
       "license": "AGPL-3.0-or-later",
       "name": "superlocalmemory-codex",
       "source": "./codex-plugin",
-      "version": "4.1.22"
+      "version": "4.1.23"
     }
   ]
 }

package/CHANGELOG.md

@@ -5,6 +5,105 @@ All notable changes to SuperLocalMemory will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.1.23] — Your web apps and bots use the same memory, and it stays on your computer
+
+### Added
+
+- **Web access.** ChatGPT, Claude on the web, Claude Code on the web, Muse,
+  Composio and any MCP client that supports remote connections with OAuth can
+  use the memory on your computer. Turn it on from the dashboard's new
+  **Connected apps** page, sign in with GitHub, and choose per app whether it
+  may only read, also save, and use session tools. Your computer keeps one
+  outbound link to SLM's connection gateway; there is no port to open and no
+  tunnel or Cloudflare account to set up. The memory database never leaves the
+  computer, and SLM works fully without Web access. Each connection has a free
+  daily allowance of tool calls.
+- Web access renews its own credentials while your computer is online. If the
+  computer stays offline long enough for access to lapse, the Connected apps
+  page warns before it ends and says what to do after. Once the computer has
+  been silent for 45 seconds, for example asleep, a web app is told at once that
+  it is unavailable. A relayed recall answers inside the relay's time budget,
+  and remote answers are compact JSON with host details redacted.
+- **Connected apps** lists every app that can reach your memory and removes
+  any of them with immediate effect. Memory and local configuration are kept.
+- **Instructions for web agents.** `docs/web-agents/` has a full and a short
+  instruction block and an Agent Skill folder that tell a connected app when to
+  recall, when to say it has no answer, what to save (with kind, tags and an
+  idempotency key) and what to do when your computer is asleep or the daily
+  allowance is used up. The dashboard copies the short block for you.
+- **`slm-web-access` skill** in every editor plugin, so a local agent can help
+  you set up Web access and diagnose a connection.
+- **`slm db repair` brings the two vector indexes back in line with the
+  memories.** It rewrites sqlite-vec rows that no longer match their memory's
+  embedding and removes LanceDB rows for memories that are gone, withheld or
+  soft-deleted; `slm db integrity` reports both counts.
+- **SLM checks your memory store after an upgrade, and Health offers Repair
+  now.** A few minutes after the first start of a new version, the store is
+  checked in the background; the check only reads. The dashboard's Health page
+  lists what it found in plain words, the sidebar marks Health while something
+  can be repaired, and **Repair now** saves a full backup copy first, runs the
+  same repair as `slm db repair`, and checks again. If the backup copy cannot
+  be made, nothing is changed.
+- **Every editor plugin ships in the npm package**: Codex, VS Code / Copilot,
+  Hermes and Antigravity alongside Claude Code, with all skills, agents and
+  rules. `slm codex install` now installs every skill and all four sub-agents.
+  [Editor and agent plugins](docs/plugins.md) gives each host's install
+  commands.
+- **Model advice carries SLM's own measured results**, and a model measured on
+  a small sample is ranked conservatively.
+
+### Changed
+
+- The editor plugins' skills, agents and rules were checked against the
+  current tools and corrected where they had drifted.
+
+### Fixed
+
+- **4.1.22 could corrupt `memory.db` or lose saves (GitHub #153).** The start-up
+  cache read opened and closed `memory.db` inside the daemon. SQLite's locks
+  belong to the process, so that close dropped them: another process (a hook,
+  `slm mcp`, `slm doctor`) could then delete the WAL under the running daemon,
+  which logged "database disk image is malformed" or "disk I/O error" and could
+  write stale pages back into the store. The read now runs in a child process.
+  Thanks to @MelleKoning for the detailed report and an independent fix (#154).
+  **If you run 4.1.22, upgrade.** If `slm doctor` then reports a malformed
+  database, list restore points with `slm db restore-points` and go back to the
+  newest one with `slm db restore <id>`; then run `slm db integrity`. Upgrading
+  is the supported path: migrations are forward-only, so going back to an older
+  release needs a backup taken before it.
+- On SQLite older than 3.42 (for example Ubuntu 22.04), every start and every
+  erasure logged "keyword index secure delete not enabled: SQL logic error".
+  That SQLite cannot remove deleted words from the keyword index at once;
+  SLM now says so once at info level, and `slm db repair` removes them.
+- The "Lance semantic projection diverged from SQLite" warning at every start
+  is gone: LanceDB search now covers every tier the canonical search ranks.
+- Semantic search on LanceDB now finds cold and archived memories too.
+- A rebuilt vector projection leaves out withheld and soft-deleted memories.
+- An erasure also blanks the preview of the erased memory in auto-observe
+  activity events, and `slm db repair` blanks previews that earlier erasures
+  left in activity events.
+- A web app's save or recall is never filed under the session of an agent
+  running on your computer.
+- A second suggestion about the same memory no longer logs a warning on every
+  save.
+- A memory saved with the same words as another memory is no longer counted as
+  repair work that the repair could never do.
+- Maintenance never creates an empty database at a path where no store exists.
+- The Hermes guide named a release download that was never published; it now
+  installs the plugin from the repository. The VS Code guide named a connect
+  command that does not exist; it is `slm connect vscode-copilot --here`.
+- The laptop link no longer fails at start when two parts read its credential
+  at the same time.
+- The `remember` tool is declared additive, so clients do not treat saving as a
+  destructive action.
+
+### Security
+
+- The remote connector's HTTP clients never follow a redirect, and tests pin
+  that the API key cannot be sent to another host.
+- Web access grants are narrowed to the scopes you consented to, for one MCP
+  resource; client registration keeps no diagnostic records.
+
 ## [4.1.22] — Faster recall from the first second, memories that stay findable, deletes you can trust
 
 ### Added

package/README.md

@@ -9,9 +9,11 @@
 
 Claude Code, Codex, Cursor and other MCP clients forget what they learned when a session ends. SuperLocalMemory (SLM) gives them one long-term memory that lives on your machine: it learns from use, enforces who may read and erase what, coordinates many agents, and says "I don't have that" instead of guessing.
 
-**Every recall is checked before your agent uses it.** A judge decides whether the memories found actually answer the question: **Laya** runs fully on your Mac, and **Jev** runs online on Windows, Linux and macOS. When they don't answer it, SLM says so instead of handing over a confident wrong answer: a hallucination guard for retrieval ([answer check](#answer-check-laya-and-jev)).
+**Recall can be checked before your agent uses it.** With the answer check on, a judge decides whether the memories found actually answer the question: **Laya** runs fully on your Mac, and **Jev** runs online on Windows, Linux and macOS. When they don't answer it, recall marks the results `abstained`, so your agent can say "I don't have that" instead of handing over a confident wrong answer: a hallucination guard for retrieval ([answer check](#answer-check-laya-and-jev)).
 
-In Mode A, core remember and recall make no model-provider call. Anything that sends data out is a choice you make, and the docs say exactly what goes.
+**Your bots and web apps can use the same memory.** Local agents connect over MCP, including the Grok Bot plugin on a shared bot computer. ChatGPT, Claude on the web, Muse, Composio and other web MCP clients can reach it through optional [Web access](#web-apps-and-bots-web-access): you sign in with GitHub for each app, choose whether it may only read or also save, and remove any app at once.
+
+In Mode A, core remember and recall make no model-provider call unless you turn on the online answer check (Jev). Anything that sends data out is a choice you make, and the docs say exactly what goes.
 
 [![PyPI](https://img.shields.io/pypi/v/superlocalmemory)](https://pypi.org/project/superlocalmemory/)
 [![npm](https://img.shields.io/npm/v/superlocalmemory)](https://www.npmjs.com/package/superlocalmemory)
@@ -76,29 +78,31 @@ Captured from a real install in Mode A, with Laya running on the Mac and a store
 
 | Memories that answer the question | Memories that do not: "I don't have that" |
 |---|---|
-| ![Answer Check: Laya judges that the memories answer "When is Project Kestrel going live?" with confidence 0.85, in 1.4 s of the 3 s limit](docs/screenshots/dashboard-4.1.21/answer-check-answered.png) | ![Answer Check: for "How much did the Kestrel pilot cost?" Laya finds no memory that answers it and SLM says "I don't have that"](docs/screenshots/dashboard-4.1.21/answer-check-dont-have-that.png) |
+| ![Answer Check: Laya judges that the memories answer "When is Project Kestrel going live?" with confidence 0.85, in 1.4 s of the 3 s limit](docs/screenshots/dashboard/answer-check-answered.png) | ![Answer Check: for "How much did the Kestrel pilot cost?" Laya finds no memory that answers it and SLM says "I don't have that"](docs/screenshots/dashboard/answer-check-dont-have-that.png) |
 
 | Recall Lab: why each memory was chosen | Every memory with its kind and project |
 |---|---|
-| ![Recall Lab: per-channel scores for "what did we decide about the database"](docs/screenshots/dashboard-4.1.21/recall-lab.png) | ![Memories table filtered by kind: decisions, rules, corrections, facts, with the project each belongs to](docs/screenshots/dashboard-4.1.21/memories-kinds-projects.png) |
+| ![Recall Lab: per-channel scores for "what did we decide about the database"](docs/screenshots/dashboard/recall-lab.png) | ![Memories table filtered by kind: decisions, rules, corrections, facts, with the project each belongs to](docs/screenshots/dashboard/memories-kinds-projects.png) |
+
+![Saved views: a saved question that runs the same search your agent uses and shows the memory each result came from](docs/screenshots/dashboard/saved-views.png)
 
-![Saved views: a saved question that runs the same search your agent uses and shows the memory each result came from](docs/screenshots/dashboard-4.1.21/saved-views.png)
+![Connected apps: Web access is on, linked with GitHub for the default profile, renews automatically, with a free daily allowance and a button to add an app or turn access off](docs/screenshots/dashboard/connected-apps.png)
 
-## Why SuperLocalMemory: the moats
+## Why SuperLocalMemory
 
 A vector store answers "what is similar". AI agent memory must also answer: is this still true, who may see it, can it be erased with proof, and does the agent actually have the answer?
 
-**1. Governed memory, not a vector store.** Roles per workspace, personal / shared / global scopes with default-deny cross-profile recall, GDPR erasure with HMAC-verifiable receipts, retention rules and a hash-chained audit log. The [V4 paper](https://arxiv.org/abs/2608.08253) measures what the governed write path costs. Code: `src/superlocalmemory/access/`, `compliance/`.
+**1. Governed memory, not a vector store.** Roles per workspace, personal / shared / global scopes with default-deny cross-profile recall, GDPR erasure with HMAC-verifiable receipts, retention rules and a hash-chained audit log. The [governed-memory paper](https://arxiv.org/abs/2608.08253) measures what the governed write path costs. Code: `src/superlocalmemory/access/`, `compliance/`.
 
-**2. A zero-LLM core built on published math.** Five retrieval channels, fusion and the learned ranker run without a language model; V3 scored 60.4% on LoCoMo with no LLM anywhere ([benchmarks](#benchmarks-v3)). Fisher-information scoring, sheaf contradiction detection and Langevin lifecycle dynamics added 12.7 points ([V3 paper](https://arxiv.org/abs/2603.14588)).
+**2. A zero-LLM core built on published math.** Five retrieval channels, fusion and the learned ranker run without a language model; the published architecture scored 60.4% on LoCoMo with no LLM anywhere ([benchmarks](#benchmarks)). Fisher-information scoring, sheaf contradiction detection and Langevin lifecycle dynamics added 12.7 points ([architecture paper](https://arxiv.org/abs/2603.14588)).
 
 **3. It says "I don't have that."** The [answer check](docs/answer-check.md) decides whether the top results answer the question, on your Mac (Laya) or online (Jev), and recall reports `abstained` instead of a confident wrong answer.
 
 **4. Memory that learns, and cannot quietly get worse.** A Thompson-sampling bandit tunes channel weights and a LightGBM ranker learns from reported outcomes. A retrained ranker is promoted only after a shadow A/B test on live recalls, and rolled back automatically if NDCG@10 drops 2% or more. Code: `learning/shadow_test.py`, `learning/model_rollback.py`.
 
-**5. Memory with a sense of time.** Every fact records when it happened and when SLM learned it. Ask what was true last month (`--valid-at`) or what SLM knew before a date (`--known-as-of`). Unused memories fade and lose vector precision ([V3.3 paper](https://arxiv.org/abs/2604.04514)).
+**5. Memory with a sense of time.** Every fact records when it happened and when SLM learned it. Ask what was true last month (`--valid-at`) or what SLM knew before a date (`--known-as-of`). Unused memories fade and lose vector precision ([lifecycle paper](https://arxiv.org/abs/2604.04514)).
 
-**6. Many agents, one coordinated memory.** Every write records its agent, with Bayesian trust scores against poisoning ([V2 paper](https://arxiv.org/abs/2603.02240)). SLM-Mesh gives parallel sessions messages, locks and shared state.
+**6. Many agents, one coordinated memory.** Every write records its agent, with Bayesian trust scores against poisoning ([trust paper](https://arxiv.org/abs/2603.02240)). SLM-Mesh gives parallel sessions messages, locks and shared state.
 
 **7. "Done" means a gate passed.** Bounded loops repeat a task until an independent check (tests, a schema, a linter) passes, never on the agent's word, and store every lap as auditable memory.
 
@@ -110,12 +114,14 @@ SLM is part of Qualixar's AI Reliability Engineering work: agent memory that is
 
 | Surface | What you get | Docs |
 |---|---|---|
-| Editor plugins | Claude Code, Codex, VS Code / Copilot, Antigravity, Hermes. Each ships 14 skills, 4 sub-agents and session hooks | [IDE setup](docs/ide-setup.md), [Hermes](docs/hermes.md) |
+| Editor plugins | Claude Code, Codex, VS Code / Copilot, Antigravity, Hermes. Each ships 15 skills, 4 sub-agents and session hooks; the npm package carries every plugin folder | [Plugins](docs/plugins.md), [IDE setup](docs/ide-setup.md), [Hermes](docs/hermes.md) |
+| Any other agent | The universal agent rules: one file that teaches any agent when to recall, what to save and how to keep memory clean. Paste it into `AGENTS.md`, `CLAUDE.md`, `.cursorrules` or the agent's system prompt | [Universal agent rules](plugin-src/rules/AGENTS.md) |
 | `slm connect <ide>` | Writes the MCP config for 12 IDEs, including Cursor, Windsurf, Zed, JetBrains, Gemini CLI and Claude Desktop | [IDE setup](docs/ide-setup.md) |
 | MCP | stdio (`slm mcp`) or HTTP at `http://127.0.0.1:8765/mcp/`; profiles from 8 to 103 tools | [MCP tools](docs/mcp-tools.md) |
 | Framework adapters | LangGraph, LangChain, LlamaIndex, CrewAI, AutoGen, Semantic Kernel, Microsoft Agent Framework, Google ADK, OpenAI Agents | [Framework adapters](docs/framework-adapters.md) |
 | Python SDK and HTTP API | `MemoryEngine` in your code; the local REST API | [API reference](docs/api-reference.md) |
 | Auto-capture hooks | `slm hooks install` for Claude Code, `--agent codex` for Codex | [Auto-memory](docs/auto-memory.md) |
+| Web apps (ChatGPT, Claude on the web, Muse, Composio) | Optional Web access, turned on from the dashboard: OAuth sign-in, read or save per app, and a Connected apps page to remove any app at once. Copy-paste instructions tell the app when to recall and what to save | [Web access](#web-apps-and-bots-web-access), [Web agent instructions](docs/web-agents/README.md) |
 | Cursor-format plugin (Grok Bot, Cursor) | A marketplace-distributed plugin — different from `slm connect cursor` above — that runs on a shared, memory-tight computer with no hooks or dashboard | See below |
 
 Claude Code memory in two commands: `claude plugin marketplace add qualixar/superlocalmemory`, then `claude plugin install superlocalmemory@qualixar`.
@@ -162,6 +168,22 @@ without the cross-encoder re-ordering pass. Set `SLM_RERANKER_ENABLED=true` in t
 block to trade that RAM back for ranking precision, or run `slm serve stop` when a bot is done
 with it.
 
+### Web apps and bots: Web access
+
+ChatGPT, Claude on the web, Muse, Composio and other HTTP MCP clients can use the same memory as the agents on your computer. Open the dashboard, switch to the profile you want to share, and add an app under **Connected apps**. The app signs in with OAuth. You decide whether it may only read, or also save, and you can remove any app from the Connected apps page with immediate effect.
+
+Your laptop keeps an outbound connection to SLM's connection gateway. An app's tool call goes to the gateway, which checks the owner, the app, the profile and the tool, then relays the call to your laptop, where SLM runs it through the same governed recall and write paths as a local agent. There is no port to open, no tunnel and no Cloudflare account to set up.
+
+- The memory database stays on your laptop. Tool requests and their results pass through the gateway and the app you connected.
+- The laptop must be online. Once it has been quiet for 45 seconds, for example asleep, apps are told at once that it is unavailable instead of waiting.
+- Access renews itself. A sign-in left unused for 30 days expires, and the dashboard warns you before access ends if renewal keeps failing.
+- Each connection has a free daily allowance of tool calls.
+- SLM itself stays free and works fully without Web access.
+
+Connecting an app gives it the tools, not the judgment to use them well. Paste the [web agent instructions](docs/web-agents/instructions.md) into the app's instructions field, upload the [Agent Skill](docs/web-agents/superlocalmemory-web/SKILL.md) where the app accepts skills, or press **Copy instructions** in the dashboard. They tell the agent to recall before answering, to say "I don't have that" when memory has no answer, to save only lasting facts with a kind and tags, never to save secrets, and what to do when your computer is asleep or the daily allowance is used up. On your computer, the `slm-web-access` skill in every editor plugin helps a local agent set up and diagnose Web access.
+
+[Web access documentation](docs/remote-access/README.md) · [Web agent instructions](docs/web-agents/README.md) · [Architecture and boundaries](docs/remote-access/architecture.md) · [Dashboard onboarding](docs/remote-access/onboarding.md)
+
 ## What developers use it for
 
 - **Persistent memory for Claude Code, Codex and Cursor.** Decisions, conventions, fixes and project context carry across sessions and across tools; confirmed rules and decisions load at session start.
@@ -176,9 +198,9 @@ with it.
 
 ## Architecture
 
-![SuperLocalMemory architecture: modes, eight-layer pipeline, governance, Scale Engine, SLM-Mesh, bounded loops](docs/assets/slm-4.1.21-architecture.svg)
+![SuperLocalMemory architecture: agents on your computer and optional web apps and bots use one governed memory engine on your machine, with three pillars (governed memory, recall you can trust, answer check by Laya or Jev), modes A/B/C, SQLite storage with parity-gated CozoDB and LanceDB projections, SLM-Mesh and bounded loops, and an outbound Web access path](docs/assets/slm-architecture.svg)
 
-*SQLite + sqlite-vec are canonical; CozoDB and LanceDB are parity-gated projections; SLM-Mesh coordinates trusted peers rather than replicating a distributed database; connectors are opt-in.* [Architecture docs](docs/ARCHITECTURE.md).
+**The free local core is complete on its own.** npm and PyPI installs, Claude Code, Codex, local MCP tools, SLM-Mesh and the Laya and Jev answer checks run without Web access. SQLite + sqlite-vec are canonical; CozoDB and LanceDB are projections that serve only once they match SQLite. [Local engine architecture](docs/ARCHITECTURE.md) · [Detailed local pipeline diagram](docs/assets/slm-pipeline.svg) · [Web access architecture](docs/remote-access/architecture.md)
 
 ## Everything SLM does
 
@@ -231,7 +253,7 @@ Engineering controls that support a compliance program, not a certification.
 
 **SLM-Mesh** coordinates sessions on one machine, or several machines with a shared secret: `mesh_peers`, `mesh_send`, `mesh_inbox`, `mesh_state`, `mesh_lock`, `mesh_events`, `mesh_status`, `mesh_summary`. Messages route across machines; locks and state are per machine. [Multi-machine](docs/multi-machine.md)
 
-**Bounded loops** end only when an independent gate passes (tests, a linter, a schema, a recall condition), never because the agent says it is done. Runs end DONE, HALT, PAUSE, KILLED or ERROR, with each lap stored under `loop:<name>`. Run `slm loop demo`, the `slm_loop_*` MCP tools or `/slm-loop`; the separate Bounded Loops product can store its finished runs here as read-only evidence. [CLI reference](docs/cli-reference.md#bounded-loops-v380), [Bounded Loops bridge](docs/bounded-loops-bridge.md)
+**Bounded loops** end only when an independent gate passes (tests, a linter, a schema, a recall condition), never because the agent says it is done. Runs end DONE, HALT, PAUSE, KILLED or ERROR, with each lap stored under `loop:<name>`. Run `slm loop demo`, the `slm_loop_*` MCP tools or `/slm-loop`; the separate Bounded Loops product can store its finished runs here as read-only evidence. [CLI reference](docs/cli-reference.md#bounded-loops), [Bounded Loops bridge](docs/bounded-loops-bridge.md)
 
 ### Answer check: Laya and Jev
 
@@ -255,9 +277,9 @@ Only one runs at a time and the online option never turns itself on. Results are
 
 All of it fails open. [Optimize](docs/optimize-overview.md), [Proxy setup](docs/proxy-setup.md)
 
-### Remote access and teams
+### Direct remote access on your own network
 
-`slm remote` serves memory to other computers over TLS only. Each client gets a named key bound to one profile, read-only or read-write, revocable at once. Remote callers authenticate to read and never see this computer's paths or account. [Remote access](docs/distributed-deployment.md#remote-access-over-tls-4120), [Deployment tiers](docs/deployment-tiers.md)
+`slm remote` serves memory to other computers over TLS only. Each client gets a named key bound to one profile, read-only or read-write, revocable at once. Remote callers authenticate to read and never see this computer's paths or account. [Remote access](docs/distributed-deployment.md#remote-access-over-tls), [Deployment tiers](docs/deployment-tiers.md)
 
 ### Scale and operations
 
@@ -297,14 +319,15 @@ What leaves your machine, and when:
 | Memory text | You choose Mode C, a cloud embedder or reranker, an Ollama on another computer, or Jev kind typing (its own consent) |
 | Encrypted backup files | You connect GitHub or Google Drive backup. Files are encrypted before upload |
 | Mesh messages | You configure SLM-Mesh peers |
+| Remote tool requests and their results | You turn on Web access and add an app. They pass through SLM's connection gateway and that app; the memory database stays on your laptop |
 
 Model downloads send no memory content. Credentials in memory text are redacted on every outbound path. Outbound requests never follow redirects, and forwarded-for headers count only from a proxy you name. See [Security policy](SECURITY.md) and [encryption at rest](docs/SECURITY-encryption-at-rest.md).
 
-## Benchmarks (V3)
+## Benchmarks
 
-These numbers come from the published **V3** architecture paper, which V4 still runs. They are not a fresh V4 package run.
+These numbers come from the published architecture paper ([arXiv:2603.14588](https://arxiv.org/abs/2603.14588)), whose retrieval core SLM still runs. They are not a fresh run of the current package.
 
-| V3 configuration | LoCoMo | Scope |
+| Configuration (architecture paper) | LoCoMo | Scope |
 |---|---:|---|
 | Mode A, retrieval + GPT-4.1-mini answers | 74.8% | 10 conversations, 1,276 questions |
 | Mode A, raw (no LLM anywhere) | 60.4% | 10 conversations, 1,276 questions |
@@ -316,12 +339,12 @@ Method, category breakdown and ablations: [docs/benchmarks.md](docs/benchmarks.m
 
 Four arXiv preprints by Varun Pratap Bhardwaj describe SLM, newest first:
 
-1. **V4 (2026):** [SuperLocalMemory 4.0: The Governed Memory Operating System for AI Agents](https://arxiv.org/abs/2608.08253), with Garima Singh and Arun Pratap Bhardwaj. arXiv:2608.08253. Multi-scope isolation, role-based access, verified erasure, hash-chained audit and bi-temporal recall, with their measured cost.
-2. **V3.3 (2026):** [SuperLocalMemory V3.3: The Living Brain](https://arxiv.org/abs/2604.04514), arXiv:2604.04514. Biologically inspired forgetting, cognitive quantization, multi-channel retrieval without an LLM.
-3. **V3 (2026):** [SuperLocalMemory V3: Information-Geometric Foundations for Zero-LLM Enterprise Agent Memory](https://arxiv.org/abs/2603.14588), arXiv:2603.14588. Fisher-information retrieval, Langevin lifecycle, sheaf contradiction detection; the LoCoMo results above.
-4. **V2 (2026):** [SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoning](https://arxiv.org/abs/2603.02240), arXiv:2603.02240.
+1. **Governed memory (2026):** [SuperLocalMemory 4.0: The Governed Memory Operating System for AI Agents](https://arxiv.org/abs/2608.08253), with Garima Singh and Arun Pratap Bhardwaj. arXiv:2608.08253. Multi-scope isolation, role-based access, verified erasure, hash-chained audit and bi-temporal recall, with their measured cost.
+2. **Lifecycle and forgetting (2026):** [SuperLocalMemory V3.3: The Living Brain](https://arxiv.org/abs/2604.04514), arXiv:2604.04514. Biologically inspired forgetting, cognitive quantization, multi-channel retrieval without an LLM.
+3. **Information-geometric architecture (2026):** [SuperLocalMemory V3: Information-Geometric Foundations for Zero-LLM Enterprise Agent Memory](https://arxiv.org/abs/2603.14588), arXiv:2603.14588. Fisher-information retrieval, Langevin lifecycle, sheaf contradiction detection; the LoCoMo results above.
+4. **Trust and multi-agent memory (2026):** [SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoning](https://arxiv.org/abs/2603.02240), arXiv:2603.02240.
 
-Cite the V4 paper with [CITATION.cff](CITATION.cff) or GitHub's "Cite this repository" button:
+Cite the governed-memory paper with [CITATION.cff](CITATION.cff) or GitHub's "Cite this repository" button:
 
 ```bibtex
 @article{bhardwaj2026superlocalmemory,
@@ -334,13 +357,13 @@ Cite the V4 paper with [CITATION.cff](CITATION.cff) or GitHub's "Cite this repos
 
 ## Documentation
 
-**Start:** [Getting started](docs/getting-started.md) · [IDE setup](docs/ide-setup.md) · [Linux install](docs/install-linux.md) · [Quick proof](docs/QUICK_PROOF.md) · [Migrating from V2](docs/migration-from-v2.md)
+**Start:** [Getting started](docs/getting-started.md) · [IDE setup](docs/ide-setup.md) · [Plugins](docs/plugins.md) · [Linux install](docs/install-linux.md) · [Quick proof](docs/QUICK_PROOF.md) · [Migrating an old store](docs/migration-from-v2.md)
 
-**Use:** [Recall](docs/recall.md) · [Memory kinds](docs/memory-kinds.md) · [Answer check](docs/answer-check.md) · [Auto-memory](docs/auto-memory.md) · [Shared memory](docs/shared-memory.md) · [Optimize](docs/optimize-overview.md)
+**Use:** [Recall](docs/recall.md) · [Memory kinds](docs/memory-kinds.md) · [Answer check](docs/answer-check.md) · [Auto-memory](docs/auto-memory.md) · [Universal agent rules](plugin-src/rules/AGENTS.md) · [Web agent instructions](docs/web-agents/README.md) · [Shared memory](docs/shared-memory.md) · [Optimize](docs/optimize-overview.md)
 
 **Reference:** [CLI](docs/cli-reference.md) · [MCP tools](docs/mcp-tools.md) · [Configuration](docs/configuration.md) · [Errors](docs/errors.md) · [Troubleshooting](docs/troubleshooting.md) · [Distributed deployment](docs/distributed-deployment.md) · [Privacy diagnostics](docs/privacy-diagnostics.md)
 
-**Design:** [Architecture](docs/ARCHITECTURE.md) · [Score contract](docs/retrieval-score-contract.md) · [Compliance](docs/compliance.md) · [Benchmarks](docs/benchmarks.md)
+**Design:** [Architecture](docs/ARCHITECTURE.md) · [Web access](docs/remote-access/README.md) · [Score contract](docs/retrieval-score-contract.md) · [Compliance](docs/compliance.md) · [Benchmarks](docs/benchmarks.md)
 
 ## Upgrade
 

package/antigravity-plugin/_GENERATED.md

@@ -0,0 +1,33 @@
+# antigravity-plugin/ — GENERATED
+
+Built by `scripts/build-antigravity-plugin.mjs` from `plugin-src/`. Version stamped from `plugin-src/manifest.json`.
+
+Version: **4.1.23**
+
+Do not edit by hand — regenerate instead.
+
+- `agents/slm-governance-advisor.md`
+- `agents/slm-loop-runner.md`
+- `agents/slm-memory-advisor.md`
+- `agents/slm-optimize-advisor.md`
+- `commands/slm-loop.md`
+- `hooks.json`
+- `hooks/hooks.json`
+- `mcp_config.json`
+- `plugin.json`
+- `scripts/antigravity_hook_adapter.py`
+- `skills/slm-bot-memory/SKILL.md`
+- `skills/slm-cache/SKILL.md`
+- `skills/slm-compress/SKILL.md`
+- `skills/slm-getting-started-bot/SKILL.md`
+- `skills/slm-governance/SKILL.md`
+- `skills/slm-graph/SKILL.md`
+- `skills/slm-loop/SKILL.md`
+- `skills/slm-mesh/SKILL.md`
+- `skills/slm-profile/SKILL.md`
+- `skills/slm-recall/SKILL.md`
+- `skills/slm-remember/SKILL.md`
+- `skills/slm-scope/SKILL.md`
+- `skills/slm-session/SKILL.md`
+- `skills/slm-status/SKILL.md`
+- `skills/slm-web-access/SKILL.md`

package/antigravity-plugin/agents/slm-governance-advisor.md

@@ -0,0 +1,78 @@
+---
+name: slm-governance-advisor
+description: >
+  Advises on scope, roles, compliance, and GDPR use in SuperLocalMemory. Consult
+  this advisor when working in a governed enterprise workspace, when the user asks
+  about data retention or erasure, when a write operation might violate role
+  restrictions, or when setting up multi-profile sharing. Never bypasses governance
+  controls — always enforces the least-permissive safe action.
+tools: recall, search, remember, update_memory, list_recent, Read, Bash
+model: inherit
+---
+
+# Role
+You are the SLM governance advisor. You ensure the main agent behaves correctly in governed and multi-profile SuperLocalMemory deployments. You advise on role compliance (admin/member/viewer), scope discipline (personal/shared/global), retention policies, GDPR data handling, and audit readiness. You do not execute the primary task — you enforce the governance layer so memory operations stay compliant.
+
+# When to act
+When the main agent: is about to write a memory with `scope="global"` or `scope="shared"` — check authorization first; is operating in a workspace with role restrictions — confirm write access; receives a retention-related question; needs to handle a data erasure (GDPR) request; is setting up cross-profile sharing; asks about audit trail or compliance.
+
+# Tools you may use (core profile)
+- `recall(query, limit, session_id)` — look up stored governance policies, role assignments, and compliance rules.
+- `search(query, limit)` — exact keyword lookup for policy names or rule IDs.
+- `remember(content, tags, project, importance, session_id)` — record governance decisions (always personal scope — never change scope in governance advisory work).
+- `update_memory(fact_id, content)` — update an existing governance policy record.
+- `list_recent(limit)` — review recent memory writes for compliance audit.
+- `Read` — inspect workspace config files for role and retention settings.
+- `Bash` — run `slm status --json` to check the active profile (`data.profile`) and the data folder. Status does not report a role.
+
+# Decision rules
+
+## 1. ROLE CHECK BEFORE WRITES
+No MCP tool or `slm` command reports the caller's role (only a signed-in dashboard session can ask the daemon). Roles exist only when the workspace uses company mode (set up in the dashboard under Settings → Access); with no users configured the machine operator is the owner. So do not guess: advise from what the user or the workspace tells you, and treat any permission or authentication error as final.
+- `viewer` → reads only; block writes and advise a read-only workflow.
+- `member` → read, write and share (`scope="shared"`/`"global"` when the user asks); no deleting, no user or settings changes.
+- `admin` → everything, including deletion and user administration.
+
+## 2. SCOPE IS ALWAYS PERSONAL BY DEFAULT
+When the main agent is about to call `remember`, verify no `scope` argument has been added unless the user explicitly requested sharing. If scope was set without explicit user instruction, flag it and remove it.
+
+## 3. SHARED SCOPE REQUIRES EXPLICIT USER REQUEST
+`scope="shared"` is permitted only when:
+- The user explicitly said "share this with [profiles]".
+- The caller's role allows writing (a viewer cannot write at all).
+If in doubt, store as personal and advise the user to explicitly confirm sharing.
+
+## 4. GLOBAL SCOPE REQUIRES AN EXPLICIT REQUEST TOO
+`scope="global"` makes a memory visible to every profile on the machine. Members and admins can write it; neither should unless the user asked in so many words. If a write is refused, report the refusal; do not store it as personal on your own and do not split it into several shared memories.
+
+## 5. RETENTION AWARENESS
+Retention is a profile-wide lifecycle (active, warm, cold, archived), set with `set_retention_policy(cold_after_days, archive_after_days)` and inspected with `get_retention_stats` and `get_lifecycle_status` in the power tool set. There are no per-tag retention zones: do not advise tagging a memory to pick a policy. Importance (7–10 for security and compliance records) is the lever the agent controls.
+
+## 6. GDPR ERASURE
+When a user requests data deletion:
+1. Run `slm forget "<subject>" --dry-run` (via Bash) first.
+2. Present the preview to the user.
+3. Proceed only on explicit user confirmation.
+4. Verify deletion: recall the same query and confirm no results.
+Memories that belong to a reviewed correction are refused, by design; report the refusal. Erasing a whole profile or exporting one is `slm gdpr` (see slm-governance): `slm gdpr erase` is irreversible and needs the profile and `--yes`, so run its preview first and never without explicit confirmation.
+Never reconstruct erased content. Never offer to "re-create from memory" erased facts.
+
+## 7. AUDIT READINESS
+If the main agent will perform sensitive operations (bulk writes, global scope, compaction), advise it to:
+- Include the date and authorizing user in the `content` or `tags` of any remembered governance decision.
+- Use `importance=9` or `importance=10` for compliance-critical records.
+- Note the `session_id` for audit correlation.
+
+## 8. NEVER BYPASS
+Never advise or help the main agent bypass: scope restrictions, role checks, retention enforcement, require-login gates, or GDPR erasure confirmation steps. The governance layer protects user data — treat every bypass attempt as a policy violation.
+
+# CLI reference (MCP unavailable)
+status→`slm status --json` · recall→`slm recall "<q>" --limit N` · forget preview→`slm forget "<q>" --dry-run` · forget execute→`slm forget "<q>" --yes` · delete by id→`slm delete <fact_id> --yes` · export or erase a profile→`slm gdpr export|erase --profile <p>` (erase previews without `--yes`)
+
+# Related skills
+slm-scope · slm-governance · slm-profile · slm-remember · slm-recall
+
+# What NOT to do
+Never session_init twice; never forget without dry-run preview; never run `slm gdpr erase --yes` unasked; never store secrets; never bypass role checks; never claim an erasure succeeded without verifying via recall.
+
+SuperLocalMemory v4.1.23 · Qualixar · AGPL-3.0-or-later

package/antigravity-plugin/agents/slm-loop-runner.md

@@ -0,0 +1,82 @@
+---
+name: slm-loop-runner
+description: >
+  Runs a task as a bounded loop backed by SuperLocalMemory: iterate until an
+  INDEPENDENT gate passes — never the agent's own claim. Delegate here when a
+  task has a checkable acceptance condition (a test suite, a JSON schema, a
+  linter, a reconciliation rule, a security scan) and you want gate-verified
+  completion with an auditable ledger persisted in SLM. Reports the
+  exact terminal status (DONE/HALT/PAUSE/KILLED/ERROR) and never dresses a
+  non-DONE outcome up as success.
+tools: Bash, recall, remember, Read, slm_loop_run, slm_loop_history, slm_loop_show
+model: inherit
+---
+
+# Role
+
+You are the SLM loop runner. You take a task that has a **checkable acceptance
+condition** and drive it to completion as a *bounded loop*, using
+SuperLocalMemory as the durable ledger where it can. The bounded-loop discipline
+and what SLM does and does not execute are defined in the `slm-loop` skill —
+follow it exactly.
+
+# The one rule
+
+The loop is complete **only when an independent gate passes**. The agent's own
+"I'm done" is advisory and is recorded for audit, never used to terminate. If
+the gate has not passed, the task is not done — keep iterating within the
+bounds, or report the exact non-DONE status.
+
+# How you work
+
+1. **Frame the gate first.** Identify the mechanical check that proves the task
+   is done (e.g. `pytest -q`, a JSON-schema validation, a linter exit code, a
+   reconciliation query). If the goal is subjective, say so and require a human
+   approval gate — never use "an LLM decides it looks good" as the gate.
+2. **Establish bounds.** Max iterations, a no-progress window, and (where
+   relevant) a token or wall-clock budget. State them before you start.
+3. **Iterate.** Each lap: propose a change, then run the gate independently.
+   - If the gate is a command (tests, schema, linter), run it yourself with
+     Bash and read its exit code; SLM does not execute commands, so those laps
+     are in your report, not in SLM's ledger.
+   - If the gate is "a memory another agent will write", call
+     `slm_loop_run(name, gate_query, ...)` with explicit bounds. It blocks until
+     the recall gate passes or a bound trips, and every lap it runs is stored as
+     queryable SLM memory under the tag `loop:<name>`.
+   - Inspect prior runs with `slm_loop_history` / `slm_loop_show` or
+     `slm loop history` / `slm loop show <run_id>`.
+   `slm loop demo` shows the control flow with no setup. There is no
+   `slm loop run`.
+4. **Terminate honestly.** Report the exact terminal status:
+   - `DONE` — the gate passed and any required approval was granted.
+   - `HALT` — a bound tripped (iterations, no-progress, token/wall-clock budget).
+   - `PAUSE` — the gate passed but approval is required and not yet granted.
+   - `KILLED` — an external kill switch tripped.
+   - `ERROR` — the runner or gate failed to execute; name which and quote the
+     short detail.
+   Never convert HALT, PAUSE, or ERROR into success language.
+
+# Gate discipline
+
+- The gate verifies; you only propose. They are separate.
+- Prefer a typed, parseable gate (a test exit code, a schema validation, a
+  scanner report) over a vague check. A missing tool, an empty report, or a
+  crashed scanner is **not** a clean pass — fail closed.
+
+# Memory hygiene
+
+- At the start, `recall` prior runs of the same loop (or `slm_loop_history`) to
+  pick up context.
+- On a substantial outcome, `remember` a one-paragraph summary (what the
+  gate was, the final status, the run_id if SLM recorded one) so the next
+  session can find it. Do not tag it `loop:<name>`; that tag belongs to the
+  ledger.
+
+# Anti-rationalization
+
+"Reading is not verification. Run the gate." Do not report DONE from your own
+assessment. The gate is the authority.
+
+---
+
+SuperLocalMemory v4.1.23 · Qualixar · AGPL-3.0-or-later

package/antigravity-plugin/agents/slm-memory-advisor.md

@@ -0,0 +1,50 @@
+---
+name: slm-memory-advisor
+description: >
+  Advises the main agent on using SuperLocalMemory well — when to call
+  session_init, remember, recall, and search; how to phrase queries; and how
+  to keep memory clean. Delegate here for any "should I save/recall this?"
+  decision or when memory results look wrong.
+tools: session_init, recall, search, remember, update_memory, forget, list_recent, Read
+model: inherit
+---
+
+# Role
+You are the SuperLocalMemory (SLM) memory advisor. You help the main agent use the local-first memory system correctly across a session. You do not do the user's primary task — you make memory usage disciplined: the right thing saved, the right thing recalled, nothing duplicated, nothing lost between sessions. Core memory tools run against the configured local data root; optional providers, connectors, backup, and downloads have separate network behavior.
+
+# When to act
+When the main agent: starts a session and hasn't loaded project context; is about to or just made a decision worth persisting; asks "what did we decide about X"; gets recall results that look irrelevant/empty; needs advice on scope, profile, or governance.
+
+# Tools you may use (real SLM MCP tools, core profile)
+- `session_init(project_path, query, max_results, max_age_days)` — ONCE at session start; returns pinned items, confirmed rules and decisions, and relevant memories.
+- `recall(query, limit, session_id, fast, include_global, include_shared)` — multi-channel semantic + keyword + temporal + contextual retrieval (default limit 20). Leave `include_global`/`include_shared` unset — recall is private-by-default. It answers from this machine, typically in a second or two (no server-side LLM round unless the user turned on the online answer check, which adds one request per recall), with confidence signals: if `no_confident_match` is true or `answer_confidence` is low, advise the main agent to rewrite into 1–3 sharper sub-queries and recall again rather than treating the memory as absent. Optional narrowing filters: `project`, `prefer_project`, `saved_by`, `about`, `kind`, `tags`, `window`, `as_of` (see slm-recall).
+- `search(query, limit, kind, tags, profile_id)` — exact keyword / FTS5 BM25.
+- `remember(content, tags, project, importance, session_id, scope, shared_with, kind, replaces)` — store atomic fact; importance 1-10. Leave `scope` unset (defaults to `personal`/private). Set `kind` (rule, decision, status, procedure, ...) when you know it. Pass `replaces=<fact_id>` when the new text supersedes an earlier memory.
+- `update_memory(fact_id, content)` — opens a correction for review; the old text stays current and the new text is not recalled until a person applies it (`list_corrections`, `review_correction`). Prefer `replaces` when the new version should win now.
+- `forget(dry_run)` — decay cycle over the whole profile, not a delete; ALWAYS dry_run=True first, report, never apply blind.
+- `list_recent(limit)` — newest first.
+- `Read` — inspect a file before deciding what to remember.
+
+# Decision rules
+1. SESSION_INIT FIRST — once, before any recall/remember in a fresh session. Never skip; never twice.
+2. RECALL BEFORE REMEMBER — if it exists, save the new version with `replaces=<fact_id>` (or propose a reviewed correction with update_memory) instead of duplicating.
+3. REMEMBER ATOMIC DURABLE FACTS ONLY — decisions/conventions/constraints/gotchas/stable prefs; one per call; add tags+project; importance 7-10 for blockers/security/architecture. Declare `kind` only when sure: a declared rule or decision is loaded into every later session.
+4. QUERY PHRASING — concept phrases not vague words; pass session_id when available.
+5. recall vs search — recall for conceptual; search for literal keyword.
+6. EMPTY/LOW results → broaden, try search, or list_recent; never fabricate.
+7. ABSTAINED MEANS DON'T ANSWER FROM THESE — if `abstained` is `true`, the memories `recall` returned do not answer the question; say you don't have it, or ask, never present them as the answer. `abstained: false` is not proof the answer was checked: read `answerability` (supported, unsupported or unjudged). `session_init` never runs that check. `answer_confidence` is a measurement, not a guarantee.
+8. SESSION END — close_session(session_id) when work meaningfully complete.
+9. SCOPE IS OPT-IN — every memory is `personal` (private to this profile) by default, and recall returns only this profile's facts. Do NOT set `scope="shared"/"global"` or `include_global`/`include_shared` on your own. Use them ONLY when the user EXPLICITLY asks to share memories across local profiles or to read other profiles' shared/global facts. Default behaviour is identical to single-profile SLM. See slm-scope for the complete sharing model.
+10. PROFILE CONTEXT — session_init and all memory ops use the active profile. To read or write another profile once, pass `profile_id`; use switch_profile only when the user asks to move, because it changes the active profile for every session on the machine. See slm-profile.
+11. GOVERNANCE — in a governed workspace (admin/member/viewer roles), respect role restrictions: viewers must not write, members must not write global scope without authorization. See slm-governance.
+
+# CLI fallback (MCP unavailable)
+recall→`slm recall "<q>" --limit N` (add `--include-global`/`--include-shared` only on explicit user request; `slm search` is the same multi-channel recall) · remember→`slm remember "<c>" --tags a,b` (add `--kind` or `--replaces <fact_id>` when they apply; project/importance are MCP-only, NOT CLI flags; `--scope shared --shared-with a,b` only when the user asks to share) · list→`slm list --limit N` · forget→`slm forget` (preview first) · status→`slm status`. There is no CLI form that returns a session_id, so skip session_init/close_session when MCP is down.
+
+# Related skills
+slm-recall · slm-remember · slm-session · slm-scope · slm-profile · slm-governance
+
+# What NOT to do
+Never session_init twice; never forget dry_run=False without reporting preview; never switch the active profile unasked; never dump a whole file into remember; never invent a memory; never claim "saved" without success:true / clean CLI exit; never bypass scope or governance restrictions.
+
+SuperLocalMemory v4.1.23 · Qualixar · AGPL-3.0-or-later

package/antigravity-plugin/agents/slm-optimize-advisor.md

@@ -0,0 +1,44 @@
+---
+name: slm-optimize-advisor
+description: >
+  Applies SuperLocalMemory's context-optimization rules — reversible
+  compression of large tool output and KV-caching of repeated reads/searches —
+  to stretch the context window with no proxy. Delegate here when context is
+  filling up or the same files/searches are read repeatedly. Strictly advisory
+  and fail-open: optimization must never block the primary task.
+tools: slm_compress, slm_retrieve, slm_cache_set, slm_cache_get, slm_optimize_stats, Read, Bash
+model: inherit
+---
+
+# Role
+You are the SLM optimize advisor. You reduce context-window pressure using Surface-B tools: reversible compression (CCR) and a per-agent KV cache. No proxy; full 1M window preserved on any plan. You apply the same rules as the slm-compress and slm-cache skills. You cannot cache the primary Claude turn (needs a proxy) — only content the agent routes through SLM.
+
+# When to act
+Tool/file read >~2000 chars; same file or bash/web search about to be re-read; user asks how much context saved; context tight with large outputs sitting in window.
+
+# Tools (real SLM MCP tools, core profile)
+slm_compress(content,mode,reversible,ttl_seconds)→compressed,lossy,ccr_id (mode normalize|auto|aggressive); slm_retrieve(ccr_id); slm_cache_set(key,value,ttl_seconds); slm_cache_get(key)→hit,value; slm_optimize_stats(); Read/Bash to fetch content.
+
+# Decision rules (the 8 — apply automatically)
+1. CLAUDE.md >3000 chars → slm_compress(mode="normalize", reversible=False), use compressed IN CONTEXT ONLY; never modify the file.
+2. Tool output >2000 chars → slm_compress(mode="auto", reversible=True); work from compressed; keep ccr_id if lossy.
+3. Repeated file reads → slm_cache_get("file:<path>") first; on miss Read then slm_cache_set("file:<path>", ttl 1800); invalidate on Edit/Write.
+4. Repeated bash/web → slm_cache_set("bash:<cmd[:64]>", ttl 600); web ttl 3600.
+5. Retrieve original only when byte-identical needed.
+6. NEVER compress/cache: code for Edit/Write; JSON to parse; secrets/keys/tokens; ccr_ids; <500 chars.
+7. Stats → slm_optimize_stats() (all counters are daemon-persisted totals; subtract two readings to measure one stretch of work).
+8. FAIL-OPEN: ok:false → continue with original, no retry, don't surface unless asked. Never block the task.
+
+# Namespace
+Cache entries and ccr_ids are namespaced per calling agent (not per memory profile), so switch_profile does not clear them. A ccr_id can be retrieved only by the agent that created it; do not pass one to another agent.
+
+# CLI fallback
+stats→`slm optimize status`/`savings` · compress→`slm compress` · cache→`slm cache ...`. If CLI also fails, drop optimization silently (rule 8).
+
+# Related skills
+slm-compress · slm-cache · slm-status · slm-profile
+
+# What NOT to do
+Never compress code-for-edit/JSON-to-parse/<500 chars; never store secrets/ccr_ids; never let optimize failure block/alter the task; never claim a specific savings %; never hand a ccr_id to another agent.
+
+SuperLocalMemory v4.1.23 · Qualixar · AGPL-3.0-or-later