total-recall-brain 3.13.0 → 3.13.2

package/src/core/validated-write.mjs

@@ -1,85 +1,158 @@
 /**
- * src/core/validated-write.mjs
- *
- * Validated write adapter — routes memory mutations through the SSSS §6
- * Operation Contract (processOperation) instead of bypassing it via raw
- * writeNode(). This ensures every write gets:
- *   - Envelope validation (Stage 1)
- *   - Idempotency deduplication (Stage 2)
- *   - Authorization checks (Stage 3)
- *   - Lease protection (Stage 4)
- *   - Schema validation (Stage 5)
- *   - Atomic commit (Stage 6)
- *   - Audit trail (Stage 7)
+ * Validated write adapter — all vault node mutations go through the SSSS 0.9
+ * package kernel (processOperationAsync).
  *
  * Usage:
- *   import { writeNodeValidated } from './validated-write.mjs';
- *   const result = writeNodeValidated(node, vaultDir);
+ *   const result = await writeNodeValidatedAsync(node, vaultDir);
  *   if (!result.success) throw new Error(result.validation.errors.join('; '));
  */
 
 import crypto from 'node:crypto';
-import path from 'node:path';
-import matter from 'gray-matter';
-import { processOperation } from './operation-validator.mjs';
+import { processOperationAsync } from './operation-validator.mjs';
 import { safeStringify } from './vault.mjs';
 import { invalidate } from './vault-cache.mjs';
 
+const SAFE_NAME = /^[a-zA-Z0-9_-]+$/;
+
 /**
- * Write a memory node through the full §6 Operation Contract pipeline.
- *
- * @param {object} node - The memory node object (slug, category, title, body, etc.)
- * @param {string} vaultDir - Absolute path to the vault directory
- * @param {object} [options]
- * @param {string} [options.agentRole='admin'] - Agent authorization role
- * @param {string} [options.workspaceId='default'] - Workspace scope
- * @param {string} [options.idempotencyKey] - Idempotency key (auto-generated if omitted)
- * @param {string} [options.leaseStore] - Path to lease store directory
- * @param {string} [options.eventLogDir] - Path to event log directory
- * @param {boolean} [options.dryRun=false] - Validate without committing
- * @returns {object} Operation response (§6.4)
+ * Normalize a vault node so package universal frontmatter + TR memory v2 pass.
  */
-export function writeNodeValidated(node, vaultDir, options = {}) {
+export function prepareNodeForContract(node = {}) {
+  const prepared = { ...node };
+  if (!prepared.type) prepared.type = 'memory';
+
+  // Identity fallbacks
+  if (!prepared.slug) {
+    prepared.slug = prepared.proposal_id || prepared.migration_id || prepared.release_id || 'unnamed';
+  }
+  // Proposal "category" is a topic label in TR; vault folder is always proposals/.
+  if (prepared.type === 'proposal') {
+    if (prepared.category && prepared.category !== 'proposals') {
+      prepared.proposal_topic = prepared.proposal_topic || prepared.category;
+    }
+    prepared.category = 'proposals';
+  } else if (!prepared.category) {
+    if (prepared.type === 'migration') prepared.category = 'migrations';
+    else if (prepared.type === 'schema-proposal') prepared.category = 'schema-proposals';
+    else prepared.category = 'uncategorized';
+  }
+
+  // Package 0.9 universal fields
+  if (!prepared.title) {
+    prepared.title = prepared.name || prepared.summary || prepared.slug || 'Untitled';
+  }
+  if (!prepared.description) {
+    prepared.description = prepared.rationale || prepared.summary || prepared.title;
+  }
+  if (!prepared.timestamp) {
+    prepared.timestamp = prepared.updated || prepared.created || prepared.proposed_at
+      || prepared.applied_at || new Date().toISOString();
+  }
+
+  if (prepared.type === 'memory') {
+    if (!prepared.schema_version) prepared.schema_version = 2;
+    if (!prepared.status) prepared.status = 'active';
+    if (!prepared.updated) prepared.updated = new Date().toISOString();
+    if (!prepared.last_accessed) prepared.last_accessed = new Date().toISOString();
+    if (!prepared.created) prepared.created = prepared.updated;
+    // Package core enum for memory.category is closed; remap host-only folders.
+    const MEMORY_CATEGORIES = new Set([
+      'invariants', 'patterns', 'anti-patterns', 'preferences',
+      'decisions', 'concepts', 'facts', 'lore',
+    ]);
+    if (prepared.category && !MEMORY_CATEGORIES.has(prepared.category)) {
+      const original = prepared.category;
+      prepared.tags = Array.isArray(prepared.tags) ? [...prepared.tags] : [];
+      if (!prepared.tags.includes(`folder:${original}`)) prepared.tags.push(`folder:${original}`);
+      prepared.category = original === 'instructions' ? 'preferences' : 'facts';
+    }
+    // Fill schema v2 required fields so partial updates (graph linking) still validate.
+    if (prepared.schema_version === 2) {
+      if (prepared.confidence === undefined || prepared.confidence === null) prepared.confidence = 0.5;
+      if (prepared.importance === undefined || prepared.importance === null) prepared.importance = 3;
+      if (!prepared.modality) prepared.modality = 'descriptive';
+      if (!prepared.subject) prepared.subject = 'agent';
+      if (!prepared.predicate) prepared.predicate = 'know';
+      if (!prepared.object) prepared.object = prepared.slug || 'fact';
+      if (!prepared.sentiment_polarity) prepared.sentiment_polarity = 'descriptive';
+      if (!prepared.sentiment_target) prepared.sentiment_target = prepared.slug || 'memory';
+    }
+    const now = new Date().toISOString();
+    if (!prepared.x_temporal_context) {
+      prepared.x_temporal_context = prepared.updated || prepared.created || now;
+    }
+    if (!prepared.x_citations) {
+      prepared.x_citations = [{
+        source: prepared.source?.type || 'unknown',
+        title: prepared.title || 'Untitled Memory',
+        url: prepared.source?.session_id ? `session://${prepared.source.session_id}` : 'unknown',
+        published: prepared.x_temporal_context,
+        relevance: 1.0,
+        accessed: now,
+      }];
+    }
+  }
+
+  return prepared;
+}
+
+function buildEnvelope(node, options = {}) {
   const {
-    agentRole = 'admin',
     workspaceId = 'default',
     idempotencyKey,
-    leaseStore,
-    eventLogDir,
     dryRun = false,
+    path: pathOverride,
   } = options;
 
-  // Build the Markdown content from the node object
-  const { body, _filePath, ...frontmatter } = node;
-  if (!frontmatter.type) frontmatter.type = 'memory';
-  if (!frontmatter.schema_version) frontmatter.schema_version = 2;
-  if (!frontmatter.updated) frontmatter.updated = new Date().toISOString();
-  if (!frontmatter.last_accessed) frontmatter.last_accessed = new Date().toISOString();
+  const prepared = prepareNodeForContract(node);
+  const { body, _filePath, _layer, _filepath, ...frontmatter } = prepared;
 
-  const content = safeStringify(body || '', frontmatter);
+  if (!SAFE_NAME.test(String(frontmatter.slug))) {
+    throw new Error(`Invalid slug: ${frontmatter.slug}`);
+  }
+  if (!SAFE_NAME.test(String(frontmatter.category))) {
+    throw new Error(`Invalid category: ${frontmatter.category}`);
+  }
 
-  // Build the §6.1 envelope
-  const category = frontmatter.category || 'uncategorized';
-  const slug = frontmatter.slug || 'unnamed';
-  const vfsPath = `${category}/${slug}.md`;
+  const content = safeStringify(body || '', frontmatter);
+  const vfsPath = pathOverride || `${frontmatter.category}/${frontmatter.slug}.md`;
 
-  const envelope = {
+  return {
     type: 'operation',
     idempotency_key: idempotencyKey || crypto.randomUUID(),
     path: vfsPath,
     workspace_id: workspaceId,
     content,
-    dry_run: dryRun,
+    dry_run: !!dryRun,
+    actor: { role: options.agentRole || 'system' },
   };
+}
+
+/**
+ * @deprecated Use {@link writeNodeValidatedAsync}.
+ */
+export function writeNodeValidated(node, vaultDir, options = {}) {
+  return writeNodeValidatedAsync(node, vaultDir, options);
+}
 
-  // Run the full §6.3 pipeline
-  const result = processOperation(envelope, vaultDir, {
+/**
+ * Write a node through the SSSS 0.9 package kernel.
+ */
+export async function writeNodeValidatedAsync(node, vaultDir, options = {}) {
+  const {
+    agentRole = 'system',
+    leaseStore,
+    eventLogDir,
+    dryRun = false,
+  } = options;
+
+  const envelope = buildEnvelope(node, { ...options, agentRole });
+  const result = await processOperationAsync(envelope, vaultDir, {
     agentRole,
     leaseStore,
     eventLogDir,
   });
 
-  // Invalidate vault cache on successful commit
   if (result.success && !dryRun) {
     invalidate(vaultDir);
   }
@@ -88,13 +161,8 @@ export function writeNodeValidated(node, vaultDir, options = {}) {
 }
 
 /**
- * Validate a node against the §6 pipeline without committing.
- * Useful for pre-flight checks on user input.
- *
- * @param {object} node - The memory node object
- * @param {string} vaultDir - Absolute path to the vault directory
- * @returns {object} Validation result with errors/warnings
+ * Validate a node without committing.
  */
 export function validateNode(node, vaultDir) {
-  return writeNodeValidated(node, vaultDir, { dryRun: true });
+  return writeNodeValidatedAsync(node, vaultDir, { dryRun: true });
 }

package/src/core/vault.mjs

@@ -3,6 +3,8 @@ import path from 'path';
 import matter from 'gray-matter';
 import { logger } from './logger.mjs';
 
+const SAFE_NAME = /^[a-zA-Z0-9_-]+$/;
+
 /**
  * Atomic file write using write-then-rename to prevent partial corruption.
  */
@@ -113,42 +115,27 @@ export function loadMergedNodes(globalVaultDir, projectVaultDir) {
 
 
 /**
- * Write a memory node to the vault.
+ * Write a vault node through the SSSS 0.9 Operation Contract (package kernel).
+ * Always async — callers must await.
+ *
+ * @param {object} node
+ * @param {string} vaultDir - Vault root (or scoped root such as proposals/)
+ * @param {object} [options]
+ * @returns {Promise<object>} Operation response
  */
-const SAFE_NAME = /^[a-zA-Z0-9_-]+$/;
-
-export function writeNode(node, vaultDir) {
-  if (!SAFE_NAME.test(node.slug)) throw new Error(`Invalid slug: ${node.slug}`);
-  if (!SAFE_NAME.test(node.category)) throw new Error(`Invalid category: ${node.category}`);
-  const targetDir = path.join(vaultDir, node.category);
-  const filePath = path.join(targetDir, `${node.slug}.md`);
-  
-  const dirPath = path.dirname(filePath);
-  if (!fs.existsSync(dirPath)) {
-    fs.mkdirSync(dirPath, { recursive: true });
+export async function writeNode(node, vaultDir, options = {}) {
+  // Dynamic import avoids circular dependency with validated-write → vault.safeStringify
+  const { writeNodeValidatedAsync } = await import('./validated-write.mjs');
+  const result = await writeNodeValidatedAsync(node, vaultDir, {
+    agentRole: options.agentRole || 'system',
+    workspaceId: options.workspaceId || 'default',
+    ...options,
+  });
+  if (!result.success) {
+    const errors = result.validation?.errors || [result.error || 'unknown validation failure'];
+    throw new Error(`writeNode contract failure: ${errors.join('; ')}`);
   }
-  
-  const { body, ...frontmatter } = node;
-  
-  if (frontmatter.type === 'memory') {
-    const now = new Date().toISOString();
-    if (!frontmatter.x_temporal_context) {
-      frontmatter.x_temporal_context = frontmatter.updated || frontmatter.created || now;
-    }
-    if (!frontmatter.x_citations) {
-      frontmatter.x_citations = [{
-        source: frontmatter.source?.type || 'unknown',
-        title: frontmatter.title || 'Untitled Memory',
-        url: frontmatter.source?.session_id ? `session://${frontmatter.source.session_id}` : 'unknown',
-        published: frontmatter.x_temporal_context,
-        relevance: 1.0,
-        accessed: now
-      }];
-    }
-  }
-  
-  const raw = safeStringify(body || '', frontmatter);
-  atomicWrite(filePath, raw);
+  return result;
 }
 
 /**

package/src/core/webauthn-store.mjs

@@ -0,0 +1,272 @@
+/**
+ * WebAuthn / passkey credential store for Total Recall dashboard.
+ *
+ * Credentials live under <brain>/config/webauthn.json (mode 0600).
+ * Challenges are in-memory only (short TTL).
+ * Never store secret values here — only authenticator public keys.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import {
+  generateRegistrationOptions,
+  verifyRegistrationResponse,
+  generateAuthenticationOptions,
+  verifyAuthenticationResponse,
+} from '@simplewebauthn/server';
+
+const CHALLENGE_TTL_MS = 5 * 60 * 1000;
+/** @type {Map<string, { challenge: string, type: string, exp: number }>} */
+const challenges = new Map();
+
+const DASHBOARD_USER = {
+  id: Buffer.from('total-recall-dashboard-owner'),
+  name: 'dashboard',
+  displayName: 'Total Recall Owner',
+};
+
+export function resolveWebAuthnPath(brainDir) {
+  return path.join(brainDir, 'config', 'webauthn.json');
+}
+
+function loadStore(brainDir) {
+  const filePath = resolveWebAuthnPath(brainDir);
+  if (!fs.existsSync(filePath)) {
+    return { version: 1, credentials: [] };
+  }
+  try {
+    const data = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    if (!data || !Array.isArray(data.credentials)) {
+      return { version: 1, credentials: [] };
+    }
+    return data;
+  } catch {
+    return { version: 1, credentials: [] };
+  }
+}
+
+function saveStore(brainDir, store) {
+  const filePath = resolveWebAuthnPath(brainDir);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(store, null, 2) + '\n', {
+    encoding: 'utf8',
+    mode: 0o600,
+  });
+}
+
+export function listPasskeys(brainDir) {
+  const store = loadStore(brainDir);
+  return store.credentials.map((c) => ({
+    id: c.id,
+    created_at: c.created_at || null,
+    transports: c.transports || [],
+    deviceType: c.deviceType || null,
+    backedUp: !!c.backedUp,
+    label: c.label || 'Passkey',
+  }));
+}
+
+export function hasPasskeys(brainDir) {
+  return loadStore(brainDir).credentials.length > 0;
+}
+
+function putChallenge(key, challenge, type) {
+  challenges.set(key, { challenge, type, exp: Date.now() + CHALLENGE_TTL_MS });
+}
+
+function takeChallenge(key, type) {
+  const row = challenges.get(key);
+  challenges.delete(key);
+  if (!row) return null;
+  if (row.exp < Date.now()) return null;
+  if (type && row.type !== type) return null;
+  return row.challenge;
+}
+
+/**
+ * Derive rpID + origin from the request (localhost-safe).
+ */
+export function resolveRpFromRequest(req) {
+  const rawHost = String(req.get('x-forwarded-host') || req.get('host') || 'localhost:3000');
+  const host = rawHost.split(',')[0].trim();
+  let hostname = host.split(':')[0] || 'localhost';
+  // WebAuthn: 127.0.0.1 is awkward; prefer localhost
+  if (hostname === '127.0.0.1') hostname = 'localhost';
+
+  const protoHeader = req.get('x-forwarded-proto');
+  const proto =
+    protoHeader?.split(',')[0]?.trim() ||
+    (req.secure || process.env.NODE_ENV === 'production' ? 'https' : 'http');
+
+  // Rebuild origin; map 127.0.0.1 → localhost for WebAuthn origin match
+  let originHost = host.replace(/^127\.0\.0\.1/, 'localhost');
+  const origin = `${proto}://${originHost}`;
+
+  return {
+    rpID: hostname,
+    rpName: 'Total Recall',
+    origin,
+  };
+}
+
+function challengeKey(req, kind) {
+  const sid = req.auth?.type || 'anon';
+  return `${kind}:${sid}:${req.ip || 'local'}`;
+}
+
+/**
+ * @param {string} brainDir
+ * @param {import('express').Request} req
+ */
+export async function beginRegistration(brainDir, req) {
+  const { rpID, rpName } = resolveRpFromRequest(req);
+  const store = loadStore(brainDir);
+  const options = await generateRegistrationOptions({
+    rpName,
+    rpID,
+    userName: DASHBOARD_USER.name,
+    userDisplayName: DASHBOARD_USER.displayName,
+    userID: DASHBOARD_USER.id,
+    attestationType: 'none',
+    excludeCredentials: store.credentials.map((c) => ({
+      id: c.id,
+      transports: c.transports,
+    })),
+    authenticatorSelection: {
+      residentKey: 'preferred',
+      userVerification: 'preferred',
+      authenticatorAttachment: 'platform',
+    },
+  });
+  putChallenge(challengeKey(req, 'reg'), options.challenge, 'reg');
+  return options;
+}
+
+/**
+ * @param {string} brainDir
+ * @param {import('express').Request} req
+ * @param {object} response - browser registration response JSON
+ * @param {{ label?: string }} opts
+ */
+export async function finishRegistration(brainDir, req, response, opts = {}) {
+  const expectedChallenge = takeChallenge(challengeKey(req, 'reg'), 'reg');
+  if (!expectedChallenge) {
+    throw new Error('Registration challenge expired or missing. Try again.');
+  }
+  const { rpID, origin } = resolveRpFromRequest(req);
+  const verification = await verifyRegistrationResponse({
+    response,
+    expectedChallenge,
+    expectedOrigin: origin,
+    expectedRPID: rpID,
+    requireUserVerification: false,
+  });
+  if (!verification.verified || !verification.registrationInfo) {
+    throw new Error('Passkey registration failed verification');
+  }
+
+  const { credential, credentialDeviceType, credentialBackedUp } = verification.registrationInfo;
+  const store = loadStore(brainDir);
+  const id = credential.id;
+  // Replace if same id re-registered
+  store.credentials = store.credentials.filter((c) => c.id !== id);
+  store.credentials.push({
+    id,
+    publicKey: Buffer.from(credential.publicKey).toString('base64url'),
+    counter: credential.counter ?? 0,
+    transports: response.response?.transports || credential.transports || [],
+    deviceType: credentialDeviceType,
+    backedUp: !!credentialBackedUp,
+    label: opts.label || 'Passkey',
+    created_at: new Date().toISOString(),
+  });
+  saveStore(brainDir, store);
+  return { id, verified: true };
+}
+
+/**
+ * @param {string} brainDir
+ * @param {import('express').Request} req
+ */
+export async function beginAuthentication(brainDir, req) {
+  const store = loadStore(brainDir);
+  if (!store.credentials.length) {
+    throw new Error('No passkeys registered. Register a passkey first.');
+  }
+  const { rpID } = resolveRpFromRequest(req);
+  const options = await generateAuthenticationOptions({
+    rpID,
+    userVerification: 'preferred',
+    allowCredentials: store.credentials.map((c) => ({
+      id: c.id,
+      transports: c.transports,
+    })),
+  });
+  putChallenge(challengeKey(req, 'auth'), options.challenge, 'auth');
+  return options;
+}
+
+/**
+ * @param {string} brainDir
+ * @param {import('express').Request} req
+ * @param {object} response
+ */
+export async function finishAuthentication(brainDir, req, response) {
+  const expectedChallenge = takeChallenge(challengeKey(req, 'auth'), 'auth');
+  if (!expectedChallenge) {
+    throw new Error('Authentication challenge expired or missing. Try again.');
+  }
+  const store = loadStore(brainDir);
+  const credId = response?.id;
+  const stored = store.credentials.find((c) => c.id === credId);
+  if (!stored) {
+    throw new Error('Unknown passkey credential');
+  }
+  const { rpID, origin } = resolveRpFromRequest(req);
+
+  const verification = await verifyAuthenticationResponse({
+    response,
+    expectedChallenge,
+    expectedOrigin: origin,
+    expectedRPID: rpID,
+    credential: {
+      id: stored.id,
+      publicKey: Buffer.from(stored.publicKey, 'base64url'),
+      counter: stored.counter || 0,
+      transports: stored.transports,
+    },
+    requireUserVerification: false,
+  });
+
+  if (!verification.verified) {
+    throw new Error('Passkey authentication failed');
+  }
+
+  const newCounter = verification.authenticationInfo?.newCounter;
+  if (typeof newCounter === 'number') {
+    stored.counter = newCounter;
+    saveStore(brainDir, store);
+  }
+
+  return {
+    verified: true,
+    credentialId: stored.id,
+  };
+}
+
+export function deletePasskey(brainDir, credentialId) {
+  const store = loadStore(brainDir);
+  const before = store.credentials.length;
+  store.credentials = store.credentials.filter((c) => c.id !== credentialId);
+  if (store.credentials.length === before) {
+    return { found: false };
+  }
+  saveStore(brainDir, store);
+  return { found: true, deleted: true };
+}
+
+/** Test helper */
+export function _clearChallengesForTests() {
+  challenges.clear();
+}

package/src/server/api.mjs

@@ -176,7 +176,12 @@ function resolveRequestedModel(requestedModel, runtimeConfig) {
 }
 
 function ssssReferenceDir() {
-  return path.join(SKILLS_DIR, 'total-recall', 'skills', 'tr-ssss', 'references');
+  const candidates = [
+    path.join(SKILLS_DIR, 'total-recall', 'references'),
+    path.join(SKILLS_DIR, 'total-recall', 'modules', 'ssss', 'references'),
+    path.join(SKILLS_DIR, 'total-recall', 'skills', 'tr-ssss', 'references'),
+  ];
+  return candidates.find((p) => fs.existsSync(p)) || candidates[0];
 }
 
 function listSsssReferences(req) {
@@ -401,7 +406,7 @@ apiRouter.post('/v1/chat/completions', requireScope('chat:write'), async (req, r
 
 
     const dateStr = new Date().toLocaleString('en-US', { weekday: 'long', year: 'numeric', month: 'long', day: 'numeric', timeZoneName: 'short' });
-    let baseSystemPrompt = `You are Total Recall, a Sovereign AI OS running a database-free, Markdown-first Structured Semantic Syntax System (SSSS) architecture. The current date and time is ${dateStr}.
+    let baseSystemPrompt = `You are Total Recall — portable personal memory for any IDE. Your brain is a database-free, Markdown-first Structured Semantic Syntax System (SSSS) vault on disk. Core loop: write (remember/session) → dream (consolidate) → read (recall + compiled surfaces) → optional daemon tasks. The current date and time is ${dateStr}.
 CRITICAL RULES — you have these tools and MUST use them:
 
 BROWSER TOOLS (headless Chromium — use for web tasks):
@@ -510,10 +515,14 @@ You have a REAL browser AND full desktop control. Use them. Navigate, click, typ
         baseSystemPrompt += `\n\n=== TIER 1 HOT MEMORY INSTRUCTIONS ===\n${compressInstructions(instructions)}`;
       }
 
-      const ssssPath = path.join(AGENT_DIR, 'skills', 'total-recall', 'skills', 'tr-ssss', 'SKILL.md');
-      if (fs.existsSync(ssssPath)) {
+      const ssssCandidates = [
+        path.join(AGENT_DIR, 'skills', 'total-recall', 'references', 'ssss-reference.md'),
+        path.join(AGENT_DIR, 'skills', 'total-recall', 'SKILL.md'),
+      ];
+      const ssssPath = ssssCandidates.find((p) => fs.existsSync(p));
+      if (ssssPath) {
         const ssssContent = fs.readFileSync(ssssPath, 'utf8');
-        baseSystemPrompt += `\n\n=== STRUCTURED SEMANTIC SYNTAX SYSTEM (SSSS) DOCUMENTATION ===\nYou are the orchestrator of this system. Here is the architectural specification:\n${compressSsssSkill(ssssContent)}`;
+        baseSystemPrompt += `\n\n=== STRUCTURED SEMANTIC SYNTAX SYSTEM (SSSS) DOCUMENTATION ===\nPrefer @ssss/cli for mutations. Compact reference:\n${compressSsssSkill(ssssContent)}`;
       }
 
       // Load user profile — drives all personalisation and idle work
@@ -580,13 +589,14 @@ Use execute_code to call these endpoints with node's built-in fetch() — you ar
         // No profile yet — enter interview mode
         const interviewTask = fs.readFileSync(interviewTaskPath, 'utf8');
         baseSystemPrompt += `\n\n=== ONBOARDING INTERVIEW MODE ===
-This user has not been onboarded yet. You MUST conduct the onboarding interview before doing anything else.
-DO NOT answer any other questions until the interview is complete.
-Ask questions one at a time, warmly and conversationally. Listen carefully. Reflect back what you hear.
-After the interview, write the user's answers to:
+This user has no user-profile yet. Conduct the portable-memory onboarding interview before unrelated work.
+Total Recall is personal memory for any IDE (write → dream → read → optional tasks) — not a vendor OS takeover.
+Ask questions one at a time, warmly and conversationally. Reflect each answer before the next.
+After the interview, write answers to:
    - ${BRAIN_DIR}/memory-vault/preferences/user-profile.md
    - ${BRAIN_DIR}/memory-vault/preferences/user-priorities.md
    - ${BRAIN_DIR}/memory-vault/preferences/user-interests.md
+Prefer CLI when available: npx total-recall remember preference "..." --tags user,profile,onboarding
 Then mark ${interviewTaskPath} as status: done.
 
 INTERVIEW TASK:
@@ -643,7 +653,7 @@ ${interviewTask}`;
           // Overwrite system prompt to protect the CPU/memory footprint of the fallback model
           const systemMsgIdx = currentMessages.findIndex(m => m.role === 'system');
           if (systemMsgIdx !== -1) {
-            currentMessages[systemMsgIdx].content = `You are Total Recall, a Sovereign AI OS running a database-free, Markdown-first Structured Semantic Syntax System (SSSS) architecture. The current date and time is ${dateStr}.
+            currentMessages[systemMsgIdx].content = `You are Total Recall — portable personal memory (Markdown vault on disk). The current date and time is ${dateStr}.
 You are operating in a lightweight text-only mode. Answer the user's questions directly, concisely, and helpfully without using tools. Keep your responses short and complete.`;
           }
           
@@ -913,20 +923,20 @@ apiRouter.get('/v1/chat/suggestions', requireAuth, requireScope('chat:read'), (r
       const standardSuggestions = [
         {
           type: 'fact',
-          title: '🧠 Sovereign OS Operations',
-          text: 'Let\'s review the core architecture of your Sovereign OS and see how we can make memory vaults even more powerful.',
+          title: '🧠 Memory loop',
+          text: 'Walk the portable memory loop: remember → dream → recall, and connect an IDE so surfaces stay in sync.',
           nodes: []
         },
         {
           type: 'concept',
-          title: '💡 Custom Agent Skills',
-          text: 'What kind of specialized automation skills should we design next for developer productivity?',
+          title: '💡 Skills across any repo',
+          text: 'What skills should we track or deploy next? Hosts are equal — skill track any path via the registry.',
           nodes: []
         },
         {
           type: 'question',
-          title: '❓ Brain Health & Scaling',
-          text: 'Would you like to analyze system health indexes and run a memory compilation to ensure all search indexes are fully synchronized?',
+          title: '❓ Vault health',
+          text: 'Want a vault compile / dream pass so search indexes and instruction surfaces stay synchronized?',
           nodes: []
         }
       ];