wendkeep 0.58.3 → 0.60.0

package/CHANGELOG.md

@@ -4,6 +4,99 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.60.0] — 2026-07-27
+
+### Added
+
+- **O runtime ganha seis fronteiras físicas internas:** `cli`, `harness`, `vault`, `mcp`,
+  `integrations` e `pi` passam a existir como workspaces privados `@wendkeep/*`, mantendo
+  `wendkeep` como uma única unidade de instalação e publicação.
+- **O Keep Core inaugura a API programática `wendkeep/vault`.** Binding/resolução do Vault e a
+  fronteira segura de paths podem ser importados pelo novo subpath público, incluído e validado no
+  tarball.
+
+### Changed
+
+- **Binding e segurança física agora pertencem a `packages/vault`.** Os paths históricos em
+  `src/project-vault.mjs` e `hooks/vault-path-safety.mjs` permanecem como fachadas compatíveis, sem
+  alterar CLI, hooks ou dados existentes.
+- **A direção de dependências virou gate estrutural.** O workspace Vault aceita somente built-ins
+  Node e módulos internos, impedindo que Keep Core passe a depender de Harness, perfis, changes,
+  FLOW, sensores ou CLI.
+
+## [0.59.0] — 2026-07-27
+
+### Added
+
+- **Perfis de Operação separam memória persistente de governança:** `OFF`, `FLOW`, `GUIDE`,
+  `GOVERN` e `ASSURE`, com resolução explícita por sessão ou projeto e fallback conservador para
+  `GOVERN`. O novo `wendkeep profile status|use` torna a escolha e sua origem auditáveis.
+- **FLOW executa ajustes pequenos por um microcontrato E → V:** `flow start/status/show/finish`
+  exige allowlist e sensores, registra baseline Git e tentativas no Vault e produz um recibo
+  terminal imutável sem criar change, ADR ou veredicto independente. `flow promote` preserva a
+  evidência ao converter o trabalho em uma change normal, sem `--force`.
+
+### Changed
+
+- **Keep Core agora é explicitamente inegociável e sempre ativo.** Vault, identidade, sessões,
+  CORE, SHARED_MEMORY, lessons e persistência continuam funcionando em todos os perfis; apenas o
+  Wend Runtime de governança é desligado em `OFF`. Hooks, skills, `init` e `sync` respeitam a mesma
+  fronteira, e instalações novas começam em `GOVERN`.
+- **Artefatos de runtime FLOW vivem em `.brain/runtime/flows/`.** A fronteira arquitetural impede
+  dependências do Vault para o harness/perfil e mantém aberta uma modularização física posterior
+  em `cli`, `harness`, `vault`, `mcp`, `integration` e `pi`.
+
+### Fixed
+
+- **Retries concorrentes do mesmo evento de memória convergem durante a publicação.** O perdedor
+  do `open(..., 'wx')` tolera por uma janela limitada apenas o JSON ainda parcial do produtor
+  vencedor, revalidando a fronteira física do Vault a cada leitura; payload diferente, arquivo
+  permanentemente ilegível e aliases inseguros continuam falhando fechado. Fixtures de CLI também
+  isolam `WENDKEEP_SENSOR_VAULT`, permitindo que a suíte rode dentro do próprio `verify --vault`.
+- **Handoffs sequenciais da mesma ativação respeitam causalidade.** Um turno mais novo da mesma
+  sessão/ativação substitui o anterior em vez de abrir conflito; ativações realmente distintas
+  continuam exigindo resolução humana.
+- **Todas as tags de sensor de uma tarefa entram no gate.** `verify` não descarta mais tags
+  `[sensor:]` adicionais na mesma linha: IDs distintos executam uma vez, na ordem declarada, e o
+  primeiro continua disponível como alias legado para consumidores antigos.
+- **Reconciliação de memória separa reparo estrutural de decisão semântica.** O novo `memory
+  reconcile` é dry-run por padrão, reprojeta o ledger sem consumir outbox, distingue cursor físico
+  de ordem causal e usa os mesmos invariantes do CORE no projector e no health check. `verify` e
+  `flow finish` agora executam sensores contra o Vault efetivamente selecionado. `memory repair`
+  reconhece e migra por CAS checkpoints causais válidos pré-0.59, com backup/auditoria, enquanto
+  locks owner-aware por PID/token impedem reap de processos vivos e remoção ABA.
+- **Iterações truncadas preservam Markdown válido.** Backticks inline ou fences cortados pelo
+  limite de tamanho são escapados antes da escrita e não engolem mais a linha seguinte.
+- **`sync` preserva seu estágio de reparo sem reabrir fallback global.** A CLI não tenta resolver
+  o Vault antes do `init`; binding inválido falha fechado nessa primeira etapa, e apenas o vínculo
+  validado é repassado a `sync-defs` e `doctor`.
+
+### Security
+
+- **FLOW falha fechado fora do contrato.** Escapes da allowlist, superfícies protegidas, mudança
+  de configuração de sensores, metadata/flags ocultas do Git, sensores críticos vermelhos ou
+  mutantes, symlink/junction/reparse/hardlink, submodules e superfícies ignoradas bloqueiam o
+  recibo. ProjectRoot/sensor cwd ficam congelados e um snapshot terminal fecha a janela após os
+  sensores. Raízes adicionais podem ser declaradas por `harness.flow.protectedRoots`; uma política
+  canônica gera classifier, discovery e topologia. Escritas/locks do Vault falham antes de escapar,
+  usando owner+lease sem reap de processo vivo ou liberação ABA. Uma descoberta no-follow limitada
+  inclui aliases protegidos vazios/ignorados sem entrar no Vault, `.git` ou caches. Promoção
+  cross-process elege um dono, vincula semanticamente contrato/reserva/recibo/origem, preflighta
+  destinos multi-spec e permite ao perdedor repetir com `--change-slug`. IDs não atravessam o
+  runtime root, artefatos corrompidos nunca reabrem o FLOW, não existe `--force`, e promoção nunca
+  toma outra change ou repositório. Ledger, outbox, CORE/SHARED, registry, notas, sidecars,
+  temporários e backups também falham fechados em aliases físicos ou hardlinks externos.
+- **Supersession ambígua exige autorização auditável e CAS exato.** A aplicação nomeia a sessão
+  sucessora e o motivo, prova que cada evento pertence à identidade causal nomeada, rejeita flags
+  ambíguas antes de I/O, limita a mutação às duas sessões, preserva o attempt original e cria backup
+  exato do registry antes da troca.
+- **Binding ilegível não desliga governança silenciosamente.** Hooks mutantes falham fechados;
+  quando um Vault explícito ou legado é inequívoco, Keep Core continua injetado sob fallback
+  `GOVERN` junto do diagnóstico de corrupção. Config legada mais próxima inválida, shape tipado
+  incorreto, marcador ausente ou identidade divergente não herdam Vault pai/global; `profile`
+  expõe `binding_error` e rejeita flags duplicadas/ambíguas antes de I/O. O guard cobre caixa,
+  shims locais, entrypoint Node e paths/call operator de Git nos gates force/no-verify.
+
 ## [0.58.3] — 2026-07-26
 
 ### Fixed

package/README.en.md

@@ -13,7 +13,11 @@
 
 **In the graph:** 🔵 session · 🟣 decision · 🔴 bug · 🟢 learning · 🟡 change — every note, backlinked.
 
-**A persistent‑memory harness for AI coding agents, built on your Obsidian vault.** Every Claude Code **and Codex** session is captured turn‑by‑turn into local Markdown — `init` wires both (Codex asks you to approve its hooks once; `import` backfills past sessions either way) — with token/cost tracking, auto‑extracted decisions, bugs and learnings, and a curated memory layer injected back at the start of the next session. On top of that memory core sits a native, zero‑dependency **change lifecycle** (spec → change → TDD → sensor‑gated archive) that keeps intent, work and proof wikilinked in one graph. 100% local, open‑core.
+**Persistent memory for AI coding agents, built on your Obsidian vault.** Every Claude Code **and Codex** session is captured turn by turn into local Markdown — `init` wires both (Codex asks you to approve its hooks once; `import` backfills past sessions either way) — with token/cost tracking and automatically extracted decisions, bugs, and learnings. That always-on plane is **Keep Core**. On top of it, **Wend Runtime** provides a native, zero-dependency lifecycle (spec → change → TDD → sensor-gated archive), selected through the `OFF`, `FLOW`, `GUIDE`, `GOVERN`, and `ASSURE` Operating Profiles. 100% local, open-core.
+
+The runtime is being separated into six physical boundaries — `cli`, `harness`, `vault`, `mcp`,
+`integrations`, and `pi` — without fragmenting installation. Vault is the first extracted surface
+and is importable through `wendkeep/vault`; see the [modular architecture](docs/en/architecture.md).
 
 ```bash
 npm i -D wendkeep && npx wendkeep init      # captures from the next session on
@@ -120,6 +124,9 @@ one command:
 npm install --save-dev wendkeep@latest && npx --no-install wendkeep sync --project . --yes
 ```
 
+`sync` lets its own `init` stage validate or rebuild the binding before resolving the Vault for
+later stages. An invalid `.wendkeep.json` stops at `init` without falling back to an inherited global Vault.
+
 The install stays outside `sync` on purpose: a running process cannot replace itself and
 keep going — the code in memory would still be the old one.
 
@@ -163,6 +170,7 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | Group | Use it for | Detailed guide |
 |---|---|---|
 | **Installation and updates** | `init`, `sync`, companions, and the first project↔vault binding | [Installation and first use](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/getting-started.md) |
+| **Operating profiles** | `profile`, `flow`, always-on Keep Core, and Wend Runtime governance | [Operating profiles](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md) |
 | **Changes and verification** | `change`, specs, sensors, TDD, evidence, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
 | **Shared memory** | CORE, SHARED, status, validation, repair, and curation | [Memory](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory.md) |
 | **Sessions and import** | hooks, registry, session focus, and Claude/Codex backfill | [Sessions and import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/sessions-and-import.md) |
@@ -174,6 +182,34 @@ Operations that deserve step-by-step guidance: [verify and exits 0/1/2](https://
 [legacy-memory migration](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory-migration.md), and
 [safe retroactive import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/retroactive-import.md).
 
+## Operating Profiles — Keep Core is always active
+
+**Keep Core is always active**: the Vault, sessions, identity, CORE/SHARED, lessons, costs,
+and persistence do not turn off with the harness. **Wend Runtime** controls only the governance
+layer:
+
+| Profile | Route | Use |
+|---|---|---|
+| `OFF` | LLM-native harness | No Wend router, skill gate, or gates; explicit selection only. |
+| `FLOW` | E → V | Microcontract with Git baseline, allowlist, sensor, and receipt, without a change. |
+| `GUIDE` | P → E → V | Compact guided change. |
+| `GOVERN` | P → R → E → V | Current a2 loop and compatible fallback. |
+| `ASSURE` | P → R → E → V → C | Governance with confirmation and handoff. |
+
+A corrupt binding never selects `OFF`: with one unambiguous explicit or legacy Vault, Keep Core
+remains active under `GOVERN`, the error stays visible, and mutation guards fail closed. Additional
+roots that FLOW must protect can be declared as project-relative paths under
+`harness.flow.protectedRoots` in `.wendkeep.json`; any change below them requires promotion.
+Invalid local config, marker, or identity never silently falls back to a parent/global Vault.
+
+`wendkeep profile status/use` makes the choice observable; `wendkeep flow
+start/finish/promote` handles local adjustments without manufacturing an ADR and fails closed on
+physical escapes, Git metadata/hidden flags, mutating sensors, protected surfaces, or incomplete
+session projection. Bounded no-follow discovery sees empty/ignored protected aliases; Vault writes
+and owner+lease locks validate physical topology. Concurrent promotion elects one owner and supports
+retry through `--change-slug`. Read the complete
+[Operating profiles guide](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md).
+
 ## Shared Project Memory v2
 
 Hot memory now separates human authorship, operational state, and evidence:
@@ -211,7 +247,13 @@ ledger, SHARED, and checkpoint: `degraded` with a durable outbox is a warning; a
 lost publication, or mismatched checkpoint blocks. See [migration](docs/en/commands/memory-migration.md)
 and [diagnostics](docs/en/commands/maintenance-and-diagnostics.md).
 
-If status blocks, preserve the evidence and run `wendkeep memory repair --vault <vault>` to save a backup of the corrupt ledger, retain valid lines, and re-project. Then run `status --gate` again. Conflicts require explicit curation with `memory promote <id>` or `memory reject <id>`; doctor only diagnoses.
+If status blocks, preserve the evidence and run `wendkeep memory repair --vault <vault>` to back up
+the corrupt ledger, retain valid lines, and re-project. Repair never reclassifies attempts. A
+valid pre-0.59 causal checkpoint is CAS-migrated to the physical boundary with backup/audit. A
+demonstrably superseded ambiguity uses `memory reconcile <session> --by-session <successor>
+--reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
+without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
+explicit curation with `memory promote <id>` or `memory reject <id>`; doctor only diagnoses.
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.
 
@@ -279,7 +321,7 @@ explore → propose → apply (TDD) → verify → archive
 ```
 
 - **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
-- **Apply** — implement each `tarefas.md` task. Tag a task that needs machine proof with `[sensor:<id>]` — one sensor per task (a task carries a single sensor; split it in two if you need two) — and the requirement it satisfies with `[req:<ID>]`, of which a task may declare several.
+- **Apply** — implement each `tarefas.md` task. Mark machine proof with one or more `[sensor:<id>]` tags on the same task: every distinct ID enters the gate once, in declaration order. Also mark satisfied requirements with one or more `[req:<ID>]` tags.
 - **Verify** — `wendkeep verify` runs the sensors your tasks declared (from `wendkeep.sensors.json` at the project root) and writes `evidencia.json`. A red `critical` fails the gate; a red `warning` is advisory. `verify --deep` builds a self-contained package with complete effective requirements (living contract + this change's delta), so the independent verifier never needs to reconstruct unarchived requirements from `07-Specs`. Every change needs a `verdict.json` to archive; `verify --deep` writes a trivial one automatically when the change declares no `[req:]`.
 - **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each capability's spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md`, moves the change to `_arquivo/`, and mints an ADR in `04-Decisões/`.
 

package/README.md

@@ -13,7 +13,11 @@
 
 **In the graph:** 🔵 session · 🟣 decision · 🔴 bug · 🟢 learning · 🟡 change — every note, backlinked.
 
-**A persistent‑memory harness for AI coding agents, built on your Obsidian vault.** Every Claude Code **and Codex** session is captured turn‑by‑turn into local Markdown — `init` wires both (Codex asks you to approve its hooks once; `import` backfills past sessions either way) — with token/cost tracking, auto‑extracted decisions, bugs and learnings, and a curated memory layer injected back at the start of the next session. On top of that memory core sits a native, zero‑dependency **change lifecycle** (spec → change → TDD → sensor‑gated archive) that keeps intent, work and proof wikilinked in one graph. 100% local, open‑core.
+**Persistent memory for AI coding agents, built on your Obsidian vault.** Every Claude Code **and Codex** session is captured turn by turn into local Markdown — `init` wires both (Codex asks you to approve its hooks once; `import` backfills past sessions either way) — with token/cost tracking and automatically extracted decisions, bugs, and learnings. That always-on plane is **Keep Core**. On top of it, **Wend Runtime** provides a native, zero-dependency lifecycle (spec → change → TDD → sensor-gated archive), selected through the `OFF`, `FLOW`, `GUIDE`, `GOVERN`, and `ASSURE` Operating Profiles. 100% local, open-core.
+
+The runtime is being separated into six physical boundaries — `cli`, `harness`, `vault`, `mcp`,
+`integrations`, and `pi` — without fragmenting installation. Vault is the first extracted surface
+and is importable through `wendkeep/vault`; see the [modular architecture](docs/en/architecture.md).
 
 ```bash
 npm i -D wendkeep && npx wendkeep init      # captures from the next session on
@@ -120,6 +124,9 @@ one command:
 npm install --save-dev wendkeep@latest && npx --no-install wendkeep sync --project . --yes
 ```
 
+`sync` lets its own `init` stage validate or rebuild the binding before resolving the Vault for
+later stages. An invalid `.wendkeep.json` stops at `init` without falling back to an inherited global Vault.
+
 The install stays outside `sync` on purpose: a running process cannot replace itself and
 keep going — the code in memory would still be the old one.
 
@@ -163,6 +170,7 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | Group | Use it for | Detailed guide |
 |---|---|---|
 | **Installation and updates** | `init`, `sync`, companions, and the first project↔vault binding | [Installation and first use](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/getting-started.md) |
+| **Operating profiles** | `profile`, `flow`, always-on Keep Core, and Wend Runtime governance | [Operating profiles](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md) |
 | **Changes and verification** | `change`, specs, sensors, TDD, evidence, and archive | [Changes and verification](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/changes-and-verification.md) |
 | **Shared memory** | CORE, SHARED, status, validation, repair, and curation | [Memory](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory.md) |
 | **Sessions and import** | hooks, registry, session focus, and Claude/Codex backfill | [Sessions and import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/sessions-and-import.md) |
@@ -174,6 +182,34 @@ Operations that deserve step-by-step guidance: [verify and exits 0/1/2](https://
 [legacy-memory migration](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/memory-migration.md), and
 [safe retroactive import](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/retroactive-import.md).
 
+## Operating Profiles — Keep Core is always active
+
+**Keep Core is always active**: the Vault, sessions, identity, CORE/SHARED, lessons, costs,
+and persistence do not turn off with the harness. **Wend Runtime** controls only the governance
+layer:
+
+| Profile | Route | Use |
+|---|---|---|
+| `OFF` | LLM-native harness | No Wend router, skill gate, or gates; explicit selection only. |
+| `FLOW` | E → V | Microcontract with Git baseline, allowlist, sensor, and receipt, without a change. |
+| `GUIDE` | P → E → V | Compact guided change. |
+| `GOVERN` | P → R → E → V | Current a2 loop and compatible fallback. |
+| `ASSURE` | P → R → E → V → C | Governance with confirmation and handoff. |
+
+A corrupt binding never selects `OFF`: with one unambiguous explicit or legacy Vault, Keep Core
+remains active under `GOVERN`, the error stays visible, and mutation guards fail closed. Additional
+roots that FLOW must protect can be declared as project-relative paths under
+`harness.flow.protectedRoots` in `.wendkeep.json`; any change below them requires promotion.
+Invalid local config, marker, or identity never silently falls back to a parent/global Vault.
+
+`wendkeep profile status/use` makes the choice observable; `wendkeep flow
+start/finish/promote` handles local adjustments without manufacturing an ADR and fails closed on
+physical escapes, Git metadata/hidden flags, mutating sensors, protected surfaces, or incomplete
+session projection. Bounded no-follow discovery sees empty/ignored protected aliases; Vault writes
+and owner+lease locks validate physical topology. Concurrent promotion elects one owner and supports
+retry through `--change-slug`. Read the complete
+[Operating profiles guide](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/operating-profiles.md).
+
 ## Shared Project Memory v2
 
 Hot memory now separates human authorship, operational state, and evidence:
@@ -211,7 +247,13 @@ ledger, SHARED, and checkpoint: `degraded` with a durable outbox is a warning; a
 lost publication, or mismatched checkpoint blocks. See [migration](docs/en/commands/memory-migration.md)
 and [diagnostics](docs/en/commands/maintenance-and-diagnostics.md).
 
-If status blocks, preserve the evidence and run `wendkeep memory repair --vault <vault>` to save a backup of the corrupt ledger, retain valid lines, and re-project. Then run `status --gate` again. Conflicts require explicit curation with `memory promote <id>` or `memory reject <id>`; doctor only diagnoses.
+If status blocks, preserve the evidence and run `wendkeep memory repair --vault <vault>` to back up
+the corrupt ledger, retain valid lines, and re-project. Repair never reclassifies attempts. A
+valid pre-0.59 causal checkpoint is CAS-migrated to the physical boundary with backup/audit. A
+demonstrably superseded ambiguity uses `memory reconcile <session> --by-session <successor>
+--reason <reason>` as a dry run and requires `--apply`; the decision is backed up and audited
+without rewriting ledger, CORE, or notes. Run `status --gate` again afterwards. Conflicts require
+explicit curation with `memory promote <id>` or `memory reject <id>`; doctor only diagnoses.
 
 Session notes use one live `## Agentes, tokens e custos` snapshot. Main-agent and subagent hooks recompose it atomically, with costs, token dimensions, reasoning tokens and effort per model/source. Every hook that rewrites a session note takes a per-file lock and writes through a temp file + rename, so the `SubagentStop` fan-out (one hook run per subagent) can never leave a note half-written; a note whose frontmatter reads back damaged is left untouched rather than patched.
 
@@ -279,7 +321,7 @@ explore → propose → apply (TDD) → verify → archive
 ```
 
 - **Propose** — `wendkeep change new <slug>` scaffolds `08-Mudanças/<slug>/` (`proposta.md`, `design.md`, `tarefas.md`; `--simple` skips the design). It becomes the global *current* change. When the change declares `spec_impact: required`, you author the delta yourself at `specs/<capability>/spec.md` — there is no placeholder to delete. Multiple changes may remain open: `change list`/`status` and the hooks show every pending one, while commands without `--change` act on the current one alone. `change use <slug>` changes focus and `change continue <archived> <new>` creates an auditable continuation.
-- **Apply** — implement each `tarefas.md` task. Tag a task that needs machine proof with `[sensor:<id>]` — one sensor per task (a task carries a single sensor; split it in two if you need two) — and the requirement it satisfies with `[req:<ID>]`, of which a task may declare several.
+- **Apply** — implement each `tarefas.md` task. Mark machine proof with one or more `[sensor:<id>]` tags on the same task: every distinct ID enters the gate once, in declaration order. Also mark satisfied requirements with one or more `[req:<ID>]` tags.
 - **Verify** — `wendkeep verify` runs the sensors your tasks declared (from `wendkeep.sensors.json` at the project root) and writes `evidencia.json`. A red `critical` fails the gate; a red `warning` is advisory. `verify --deep` builds a self-contained package with complete effective requirements (living contract + this change's delta), so the independent verifier never needs to reconstruct unarchived requirements from `07-Specs`. Every change needs a `verdict.json` to archive; `verify --deep` writes a trivial one automatically when the change declares no `[req:]`.
 - **Archive** — `wendkeep change archive <slug>` **gates** on the evidence (blocks unless every declared critical sensor is green), promotes each capability's spec delta (`ADDED`/`MODIFIED`/`REMOVED`) into the living `07-Specs/<capability>.md`, moves the change to `_arquivo/`, and mints an ADR in `04-Decisões/`.
 

package/bin/wendkeep.mjs

@@ -22,12 +22,13 @@ function version() {
   }
 }
 
-const HELP = `wendkeep ${version()} — capture AI coding agent sessions into your Obsidian vault.
+const HELP = `wendkeep ${version()} — keep durable AI sessions in an Obsidian vault, with optional governance.
 
 Usage:
   wendkeep init [options]      Set up wendkeep in a project (cross-platform).
     --vault <path>         Obsidian vault folder (default: <project>/.<project-name>-vault).
     --project <path>       Project root to wire (default: current directory).
+    --profile <name>       Operating profile: OFF, FLOW, GUIDE, GOVERN (default), or ASSURE.
     --no-mcp               Do not add the mcpvault MCP server to .mcp.json.
     --companions <csv>     Companion plugins/MCP to pin: context-mode,caveman,understand-anything
                            (default: none — opt in explicitly). dotcontext is legacy — the native a2 loop replaces it.
@@ -46,7 +47,7 @@ Usage:
                            command — the three steps that repeat identically after every
                            package update. Stops at the first failing step. Install the
                            package first (npm i -D wendkeep@latest); a running process
-                           cannot replace itself. · --vault P · --yes.
+                           cannot replace itself. · --vault P · --profile <name> · --yes.
 
   wendkeep doctor [--vault P]  Run a vault health check.
   wendkeep change <sub>        Change lifecycle: new [--simple] | use | bind <slug> --session <id> | continue | list | show |
@@ -56,6 +57,11 @@ Usage:
   wendkeep theme sync          Re-aplica o color system (snippet CSS + graph color groups) num vault
                            existente — recupera o grafo cinza sem re-init. --vault P.
   wendkeep session <sub>       Session registry: list | show <id> | use <id>.
+  wendkeep profile <sub>       Operating profile: status | use <OFF|FLOW|GUIDE|GOVERN|ASSURE>.
+                           --session <id> sets an audited session override; otherwise changes
+                           the project default. The Vault/session/memory core is always active.
+  wendkeep flow <sub>          Low-ceremony E -> V contract: start | status | show | finish | promote.
+                           FLOW records scope, sensors and a receipt without creating a change.
   wendkeep spec <sub>          Specs: list | show | effective [--change] [--json] | migrate | rebase.
   wendkeep sensors <sub>       list | add <id> "<command>" [--severity --type --report].
   wendkeep cost [opts]         Aggregate AI-coding spend across the vault's sessions.
@@ -95,7 +101,9 @@ Usage:
                            behind the closing block. Dry-run by default · --apply · --json.
   wendkeep lesson add "t" "l"   Record a project-local lesson (injected at SessionStart).
   wendkeep memory <sub>          Shared memory v2: status | migrate [--apply] | repair |
+                           reconcile <session> --by-session <session> --reason <text> [--apply] |
                            promote <candidate> | reject <candidate>. --vault P.
+                           Reconcile is dry-run by default; the original attempt remains audited.
   wendkeep validate-memory [path]  Validate .brain/CORE.md against the compaction
                            protocol (cap 25, 3 sections, no secrets/PII).
                            --vault <path> validates the complete v2 bundle.
@@ -142,11 +150,25 @@ async function preferProjectVault(argv) {
   if (optionValue(argv, '--vault')) return;
   try {
     const { resolveProjectVault } = await import('../src/project-vault.mjs');
+    // A sensor may itself invoke WendKeep. `verify`/`flow finish` already selected the
+    // authoritative Vault explicitly, so preserve that choice across the child process
+    // instead of letting the sensor cwd's project binding redirect it.
+    const sensorVault = process.env.WENDKEEP_SENSOR_VAULT;
+    if (sensorVault) {
+      const selected = resolveProjectVault({
+        startDir: optionValue(argv, '--project') || process.cwd(),
+        explicitVault: sensorVault,
+      });
+      process.env.OBSIDIAN_VAULT_PATH = selected.base;
+      return;
+    }
     const resolved = resolveProjectVault({ startDir: optionValue(argv, '--project') || process.cwd() });
     process.env.OBSIDIAN_VAULT_PATH = resolved.base;
-  } catch {
+  } catch (error) {
     // Backward-compatible manual CLI behavior: individual commands still explain
-    // --vault / legacy env when no project binding exists. Hooks do not use this path.
+    // --vault / legacy env only when no project binding exists. A configured but
+    // corrupt/missing/mismatched binding must abort before dispatch to another Vault.
+    if (error?.code !== 'WENDKEEP_VAULT_UNCONFIGURED') throw error;
   }
 }
 
@@ -156,10 +178,26 @@ async function main() {
   // Intercepted BEFORE vault resolution so it works anywhere — help must never depend
   // on project state, and no command may treat --help as a runnable default.
   if (cmd && (rest.includes('--help') || rest.includes('-h'))) {
-    process.stdout.write(HELP);
+    if (cmd === 'flow') {
+      const { FLOW_HELP } = await import('../src/flow.mjs');
+      process.stdout.write(FLOW_HELP);
+    } else if (cmd === 'profile') {
+      const { PROFILE_HELP } = await import('../src/profile.mjs');
+      process.stdout.write(PROFILE_HELP);
+    } else {
+      process.stdout.write(HELP);
+    }
     process.exit(0);
   }
-  if (cmd && !['init', 'hook', '--version', '-v', '--help', '-h', 'help'].includes(cmd)) {
+  const validatesStandaloneCore = cmd === 'validate-memory'
+    && !rest.includes('--vault')
+    && !rest.some((item) => item.startsWith('--vault='));
+  if (cmd
+    && !validatesStandaloneCore
+    // `sync` starts with `init` and resolves the freshly bound Vault itself. Pre-resolving
+    // here would prevent that repair step from reporting a corrupt binding as its own
+    // first-stage failure (and could never make it as far as the guarded init).
+    && !['init', 'sync', 'hook', '--version', '-v', '--help', '-h', 'help'].includes(cmd)) {
     await preferProjectVault(rest);
   }
   switch (cmd) {
@@ -211,6 +249,16 @@ async function main() {
       runSession(rest);
       break;
     }
+    case 'profile': {
+      const { runProfile } = await import('../src/profile.mjs');
+      process.exit(runProfile(rest));
+      break;
+    }
+    case 'flow': {
+      const { runFlow } = await import('../src/flow.mjs');
+      process.exit(await runFlow(rest));
+      break;
+    }
     case 'theme': {
       const { runTheme } = await import('../src/theme.mjs');
       runTheme(rest);

package/docs/en/commands/changes-and-verification.md

@@ -14,6 +14,9 @@ Use for any non-trivial implementation or fix that must leave auditable proof.
 ## When not to use
 
 Do not create a change merely to inspect health, import sessions, or run read-only maintenance.
+For local maintenance eligible for the `FLOW` profile, use the microcontract in
+[Operating profiles](operating-profiles.md); under `OFF`, the lifecycle remains available but is
+not imposed by Wend Runtime.
 
 ## Prerequisites
 
@@ -32,7 +35,8 @@ npx wendkeep change archive <slug>
 
 ## Options and exit codes
 
-- `wendkeep change new <slug> [--simple]` creates proposal, design, tasks, and active pointer.
+- `wendkeep change new <slug> [--simple]` creates a change; `--simple` only skips design, is not
+  `FLOW`, and preserves the legacy lifecycle/ADR contract.
 - `change use`, `list`, `show`, `status`, `diff`, `done`, and `undone` inspect or update work
   without archiving it.
 - `change continue <archived> <new>` starts follow-up work without inheriting stale proof.
@@ -70,10 +74,12 @@ and mints an ADR. Archive passes only with closed tasks, green required sensors,
 
 - `no change`: select one with `change use <slug>` or pass `--change`.
 - `spec_impact: pending`: choose `required` with a delta or `none` with a real reason.
-- Sensor not executed: keep `[sensor:id]` on the same checkbox line as the task.
+- Sensor not executed: keep one or more `[sensor:id]` tags on the same checkbox line. Every
+  distinct ID on that line is required and runs once, in declaration order.
 - Stale evidence: rerun `verify` and `verify --deep` after task/spec edits.
 - Rebase conflict: resolve the delta or use `--accept-current` only when that is the decision.
 
 ## Next steps
 
-Read the deep [verify guide](verify.md) and [maintenance and diagnostics](maintenance-and-diagnostics.md).
+Read [Operating profiles](operating-profiles.md), the deep [verify guide](verify.md), and
+[maintenance and diagnostics](maintenance-and-diagnostics.md).

package/docs/en/commands/getting-started.md

@@ -27,18 +27,22 @@ Do not run `init --force` as a generic repair for memory or unreadable configura
 ```bash
 npm install --save-dev wendkeep
 npx wendkeep init [options]
-npx wendkeep sync [--project <root>] [--vault <vault>] [--yes]
+npx wendkeep sync [--project <root>] [--vault <vault>] [--profile <profile>] [--yes]
 ```
 
 ## Options and exit codes
 
 - `--vault <path>` selects the vault; otherwise the local `.wendkeep.json` binding wins.
 - `--project <path>` selects the project root.
+- `--profile <OFF|FLOW|GUIDE|GOVERN|ASSURE>` selects the Operating Profile; new installs use
+  `GOVERN`, re-init/sync without the flag preserves the existing choice, and `OFF` is never inferred.
 - `--no-mcp`, `--no-colors`, and `--no-companions` disable optional integrations.
 - `--companions <csv>` explicitly enables companion integrations.
 - `--yes` accepts non-interactive defaults; `--force` refreshes managed blocks only.
 - Exit `0` means setup/sync completed. Any other exit identifies the failed stage. `sync` stops at
   `init`, `sync-defs`, or `doctor` instead of hiding the error.
+- `sync` does not pre-resolve the Vault before `init`: an invalid binding fails closed at that first
+  stage, and only a validated binding reaches `sync-defs` and `doctor`; no global fallback is used.
 
 ## Examples
 
@@ -46,7 +50,7 @@ First installation in the current project:
 
 ```bash
 npm install --save-dev wendkeep
-npx wendkeep init --no-companions
+npx wendkeep init --profile GOVERN --no-companions
 ```
 
 Later update:
@@ -60,7 +64,7 @@ With pnpm, pin a concrete version because minimum-release-age policies may keep
 behind:
 
 ```bash
-pnpm add -D wendkeep@0.58.2
+pnpm add -D wendkeep@X.Y.Z --config.minimumReleaseAge=0
 pnpm exec wendkeep sync --yes
 ```
 

package/docs/en/commands/memory.md

@@ -25,6 +25,7 @@ Pass the vault explicitly in automation. Preserve backups and evidence before re
 ```bash
 npx wendkeep memory status [--gate] --vault <vault>
 npx wendkeep memory repair --vault <vault>
+npx wendkeep memory reconcile <ambiguous-session> --by-session <successor-session> --reason <reason> [--apply] --vault <vault>
 npx wendkeep memory promote <candidate> --vault <vault>
 npx wendkeep memory reject <candidate> --vault <vault>
 npx wendkeep validate-memory [CORE-path]
@@ -44,7 +45,20 @@ npx wendkeep validate-memory --vault <v2-vault>
 - A valid legacy vault warns and exits `0`. For v2, status correlates `last_memory_attempt`,
   disposition, outbox, ledger, SHARED, and checkpoint: an ambiguous attempt, lost publication, or
   mismatched checkpoint blocks; `degraded` with an intact outbox is a warning.
-- `memory repair` locks, writes a `.bak`, retains valid events, and reprojects state.
+- `memory repair` is structural only: it uses PID/token-owned locks, writes a `.bak`, retains
+  valid events, and reprojects state. When it recognizes a valid pre-0.59 checkpoint whose cursor
+  is causal, it CAS-migrates it to the physical boundary with backup/audit; it never reclassifies
+  registry attempts or accepts a tuple that cannot be fully re-derived.
+- `memory reconcile` is a dry run by default. `--apply` requires two named sessions plus a reason,
+  CAS-checks the exact attempt, backs up the registry, and limits mutation to the ambiguous attempt
+  and its successor. Replay is CORE-aware, checkpoints use the physical ledger cursor, and the
+  command neither rewrites ledger/CORE/notes nor consumes the outbox. Retrying the same applied
+  decision is idempotent.
+- Every memory path validates the physical topology of `.brain`, ledger, outbox, CORE, SHARED,
+  candidates, registry, notes, backups, temporary files, and sidecars before reading or writing.
+  Junctions, symlinks, reparse points, or hardlinks fail closed without touching external bytes.
+  Locks publish owner and lease atomically, never reap a live PID by age alone, and release only
+  the lease they acquired.
 - `promote`/`reject` append auditable decisions and never rewrite the ledger in place.
 - `validate-memory <CORE.md>` checks the 25-line cap, required sections, and secrets.
 - `validate-memory --vault` requires a complete v2 bundle and is not the legacy-vault gate.
@@ -53,6 +67,8 @@ npx wendkeep validate-memory --vault <v2-vault>
 
 ```bash
 npx wendkeep memory status --gate --vault .MyApp-vault
+npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --vault .MyApp-vault
+npx wendkeep memory reconcile old --by-session current --reason "delivery continued" --apply --vault .MyApp-vault
 npx wendkeep validate-memory .MyApp-vault/.brain/CORE.md
 npx wendkeep memory promote candidate-123 --vault .MyApp-vault
 ```
@@ -73,7 +89,9 @@ of a global projection that has already advanced with concurrent events.
   let idempotent replay finish. An event ID absent from both locations means lost publication.
 - An `ambiguous` attempt, an `applied` attempt without event IDs, a `projected` event found only in
   the outbox, or a mismatched checkpoint is blocking: preserve the artifacts and investigate
-  before repair.
+  before repair. If the ambiguity is demonstrably superseded by a successor session, inspect the
+  `memory reconcile` dry run before authorizing `--apply`; the command fails when the ambiguous
+  attempt already contains event IDs.
 - Ordinary pending candidate: recoverable warning, requiring human choice when appropriate.
 - Missing `event_cursor` or mismatched v2 hash: preserve the bundle and assess `memory repair`.
 - `validate-memory --vault` fails on legacy: validate CORE only or migrate first.