wendkeep 0.86.0 → 0.88.0

package/.githooks/commit-msg

@@ -0,0 +1,16 @@
+#!/bin/sh
+set -eu
+
+CLI=${WENDKEEP_COMMIT_CLI:-}
+if [ -z "$CLI" ]; then
+  if [ -f "./node_modules/wendkeep/bin/wendkeep.mjs" ]; then
+    CLI=./node_modules/wendkeep/bin/wendkeep.mjs
+  elif [ -f "./bin/wendkeep.mjs" ]; then
+    CLI=./bin/wendkeep.mjs
+  else
+    echo "WENDKEEP_COMMIT_CLI_MISSING: install wendkeep or run wendkeep doctor" >&2
+    exit 2
+  fi
+fi
+
+exec node "$CLI" commit validate --message-file "$1" --consume-context

package/.githooks/prepare-commit-msg

@@ -0,0 +1,16 @@
+#!/bin/sh
+set -eu
+
+CLI=${WENDKEEP_COMMIT_CLI:-}
+if [ -z "$CLI" ]; then
+  if [ -f "./node_modules/wendkeep/bin/wendkeep.mjs" ]; then
+    CLI=./node_modules/wendkeep/bin/wendkeep.mjs
+  elif [ -f "./bin/wendkeep.mjs" ]; then
+    CLI=./bin/wendkeep.mjs
+  else
+    echo "WENDKEEP_COMMIT_CLI_MISSING: install wendkeep or run wendkeep doctor" >&2
+    exit 2
+  fi
+fi
+
+exec node "$CLI" commit prepare --message-file "$1" --source "${2:-}" --commit "${3:-}"

package/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.88.0] — 2026-08-29
+
+### Added
+
+- **Políticas oficiais e RBAC do Observer por projeto.** Captura de transcripts, uso, memória e
+  sync passa por policy única, redaction por classe/campo e matriz explícita de papéis e scopes;
+  tokens são armazenados somente por hash, escopados, expirados, revogáveis e rotacionáveis.
+- **Ciclo de vida auditável.** Retenção e purge idempotentes ficam disponíveis por CLI e endpoint,
+  com receipts retriáveis, tratamento de chegadas tardias e reconciliação segura do índice FTS.
+
+### Security
+
+- **Criptografia fail-closed no Observer.** Quando exigida, ingestão, outbox e publicação recusam
+  plaintext; o backfill protege dados legados antes de leituras, e backups de migração v5 usam
+  AES-256-GCM, manifest de integridade, permissões restritas e restore autenticado.
+- **Bootstrap remoto sem credencial irrestrita.** Server, MCP, CLI e Compose usam o registry
+  hash-only com projeto, papel, scopes e expiração explícitos, incluindo revogação e rotação.
+
+## [0.87.0] — 2026-08-29
+
+### Added
+
+- **Política universal de commits baseada em evidências.** O novo pacote `wendkeep/commit`, a CLI,
+  os hooks Git e o gate de intervalo produzem e validam mensagens determinísticas a partir de
+  autoridade, tarefas, spec, escopo e sensores rederiváveis no checkout exato do commit.
+
+### Security
+
+- **Prova remota limitada ao que o CI consegue rederivar.** Evidências causais locais permanecem
+  não publicadas; alegações remotas indisponíveis, provas circulares, sensores divergentes,
+  adulterações de escopo e caminhos privados falham de modo fechado antes da persistência.
+
 ## [0.86.0] — 2026-08-28
 
 ### Added

package/README.en.md

@@ -151,6 +151,7 @@ npx wendkeep init --no-companions --no-mcp --yes              # zero companions,
 | `--no-mcp` | Skip **wendkeep's own** vault MCP (`wendkeep-vault`). Companion MCPs still follow `--companions`. |
 | `--no-colors` | Skip the Obsidian color system (`.obsidian` snippet + graph groups). |
 | `--vscode-worktree-tasks` | Create a local, Git-excluded `.vscode/tasks.json` for creating/listing/opening/finishing worktrees; never overwrites an existing file. Also accepted by `sync`. |
+| `--git-commit-hooks` | Opt in to copying commit hooks into `.githooks/` and setting local `core.hooksPath`; custom hooks are preserved without `--force`. |
 | `--yes`, `-y` | Non-interactive; accept defaults (skips the language / vault / companion prompts). |
 | `--force` | Overwrite existing wendkeep config blocks. |
 
@@ -259,7 +260,8 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | **Notes and knowledge** | BUG/APR/ADR, repairs, renumbering, lessons, and dashboard | [Notes and knowledge](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/notes-and-knowledge.md) |
 | **Costs and observability** | safe dry-run, tri-state, aggregation, trends, and historical rebuild | [Costs and observability](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/costs-and-observability.md) |
 | **Maintenance and diagnostics** | doctor, frontier/manifest freshness, drift, version, and help | [Maintenance and diagnostics](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/maintenance-and-diagnostics.md) |
-| **Local Observer** | `observer serve`, registration, incremental publication, `reconcile`, outbox, and multi-project index | [Local Observer](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/observer.md) |
+| **Evidence-based commits** | `wendkeep commit`, tasks derived from contracts, tests only from canonical execution bound to the exact SHA, opt-in Git hooks, privacy, and remote range gate | [Commits](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/commit.md) |
+| **Local Observer** | `observer serve`, scoped/expiring hash-only bootstrap, incremental publishing with canonical timestamps, `reconcile`, policy, stable structural identities, content-bound hashes, deletion-safe capture, required encryption, retention, purge, and multi-project index | [Local Observer](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/observer.md) · [Security](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/observer-security.md) |
 
 Operations that deserve step-by-step guidance: [verify and exits 0/1/2](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/verify.md),
 [causal TDD attestation](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/tdd.md),

package/README.md

@@ -151,6 +151,7 @@ npx wendkeep init --no-companions --no-mcp --yes              # zero companions,
 | `--no-mcp` | Skip **wendkeep's own** vault MCP (`wendkeep-vault`). Companion MCPs still follow `--companions`. |
 | `--no-colors` | Skip the Obsidian color system (`.obsidian` snippet + graph groups). |
 | `--vscode-worktree-tasks` | Create a local, Git-excluded `.vscode/tasks.json` for creating/listing/opening/finishing worktrees; never overwrites an existing file. Also accepted by `sync`. |
+| `--git-commit-hooks` | Opt in to copying commit hooks into `.githooks/` and setting local `core.hooksPath`; custom hooks are preserved without `--force`. |
 | `--yes`, `-y` | Non-interactive; accept defaults (skips the language / vault / companion prompts). |
 | `--force` | Overwrite existing wendkeep config blocks. |
 
@@ -259,7 +260,8 @@ The README is the map; the guides provide syntax, options, exit codes, examples,
 | **Notes and knowledge** | BUG/APR/ADR, repairs, renumbering, lessons, and dashboard | [Notes and knowledge](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/notes-and-knowledge.md) |
 | **Costs and observability** | safe dry-run, tri-state, aggregation, trends, and historical rebuild | [Costs and observability](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/costs-and-observability.md) |
 | **Maintenance and diagnostics** | doctor, frontier/manifest freshness, drift, version, and help | [Maintenance and diagnostics](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/maintenance-and-diagnostics.md) |
-| **Local Observer** | `observer serve`, registration, incremental publication, `reconcile`, outbox, and multi-project index | [Local Observer](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/observer.md) |
+| **Evidence-based commits** | `wendkeep commit`, tasks derived from contracts, tests only from canonical execution bound to the exact SHA, opt-in Git hooks, privacy, and remote range gate | [Commits](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/commit.md) |
+| **Local Observer** | `observer serve`, scoped/expiring hash-only bootstrap, incremental publishing with canonical timestamps, `reconcile`, policy, stable structural identities, content-bound hashes, deletion-safe capture, required encryption, retention, purge, and multi-project index | [Local Observer](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/observer.md) · [Security](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/observer-security.md) |
 
 Operations that deserve step-by-step guidance: [verify and exits 0/1/2](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/verify.md),
 [causal TDD attestation](https://github.com/rogersialves/wendkeep/blob/main/docs/en/commands/tdd.md),

package/docs/en/commands/commit.md

@@ -0,0 +1,159 @@
+# Evidence-based commits
+
+**English** · [Português](../../pt-BR/commands/commit.md)
+
+## Purpose
+
+Produce the same auditable message from Codex, Claude Code, or another Git client using typed input,
+public references, and a staged-index summary only. The deterministic kernel does not read the
+Vault, `.brain`, session registries, or the network.
+
+## When to use
+
+Use before `feat`, `fix`, `refactor`, or `perf` implementation commits that must record causal
+authority, tasks, tests, scope, and verifiable evidence consistently across harnesses.
+
+## When not to use
+
+Do not use it to invent proof, publish private content, rewrite history, or automate pushes.
+`docs`, `test`, and `chore` commits need no context only when every changed file is objectively
+documentation/test material. Product changes require the governed body regardless of type.
+
+## Prerequisites
+
+Run inside a Git repository with WendKeep installed locally and the selected product files already
+present in the staged index.
+
+## Syntax
+
+```bash
+npx --no-install wendkeep commit context --input <json|-> [--json]
+npx --no-install wendkeep commit context --clear [--json]
+npx --no-install wendkeep commit render --input <json|->
+npx --no-install wendkeep commit prepare --message-file <path> [--source <source>]
+npx --no-install wendkeep commit validate --message-file <path> [--json]
+```
+
+## Options and exit codes
+
+- Exit `0`: context written/cleared or message valid.
+- Exit `1`: invalid governed message.
+- Exit `2`: invalid argument, JSON, Git state, privacy boundary, or stale context.
+- `--consume-context` is reserved for the `commit-msg` wrapper and removes context after validation.
+
+## Opt-in installation
+
+The default `init` does not enable Git hooks. To copy the portable wrappers and set
+`core.hooksPath=.githooks` for this repository only:
+
+```bash
+npx --no-install wendkeep init --git-commit-hooks --yes
+```
+
+Custom hooks are never overwritten silently. When `init` finds a conflict it preserves the file.
+Review it and rerun with `--force` only when replacement is intended; the previous file is retained
+as `.bak`.
+A custom `core.hooksPath` is also a conflict and remains untouched without `--force`.
+
+## Examples
+
+### Prepare a commit
+
+Create JSON matching `schema/commit-message-v1.schema.json`. Declare authority and evidence
+references, but do not provide `tasks`, `tests`, `fresh`, or `verified`. Runtime derives tasks from
+completed canonical Task Contracts. Tests come only from `[sensor:<id>]` sensors executed by the
+collector; `[phase:verify]` alone is never a result. Sensors
+declared in an Envelope must exactly match the canonical reexecution in IDs, configuration,
+command, severity, and result; only that reexecution emits a `Tests` line. The remote gate
+re-executes each sensor in the checkout for that exact commit SHA. Every
+published reference gets a re-derived SHA-256 digest. ADR/design validate artifact ID and path;
+tasks containing `[req:]` require a versioned, sanitized `spec` reference that defines every
+requirement. Evidence Envelope, Verdict, receipt, and TDD attestation may participate in local
+validation, but are omitted from remote Evidence: worktree/session/branch IDs are not published,
+and self-contained consistency is not promoted to proof. A message claiming them as
+`fresh`/`verified` is rejected with `WENDKEEP_COMMIT_REMOTE_PROOF_UNAVAILABLE`. The fixed trailers
+`Remote-Proof-Scope: git,authority,tasks,spec,sensors` and `Local-Causal-Proof: unpublished` make
+that boundary explicit. Range re-derives authority/artifacts, task/spec, Git `Scope`, and
+config/sensors from the SHA, and only canonical reexecution emits `Tests`. `Co-Authored-By` is
+omitted until a trusted identity registry can resolve it.
+
+The normal authority is the causal ADR:
+
+```json
+{ "authority": { "kind": "adr", "adr": "ADR-1234", "ref": "docs/ADR-1234.md", "issue": "#123" } }
+```
+
+Only when no causal change/ADR exists may the native harness declare the fallback below. `issue`
+must be `#NNN` and `design` must be versioned in the same commit under
+`docs/superpowers/specs/` or `plans/`:
+
+```json
+{
+  "authority": {
+    "kind": "native",
+    "issue": "#40",
+    "design": "docs/superpowers/specs/approved-design.md"
+  }
+}
+```
+
+Runtime observes effective profile `OFF`, no causal context/change/lease or ADR, and the issue in the
+design. This mode emits unique `Authority: native-no-causal-change`, `Issue`, and `Design` trailers. Free text, unversioned
+design, stale/unverified proof, or a missing body/tests fail closed.
+
+```bash
+git add <product-files>
+npx --no-install wendkeep commit context --input commit-input.json
+git commit -m "feat(scope): draft"
+```
+
+`commit context` calculates the staged diff SHA-256 and stores the sanitized context at
+`.git/wendkeep-commit-input.json`, outside the working tree. `prepare-commit-msg` replaces the draft
+with the canonical message; `commit-msg` validates it and consumes the context. If the index changes,
+the context becomes stale and must be recreated.
+`commit-msg` rereads context, compares the complete message and staged hash/files, and consumes
+context only after success. Merge, squash, and amend clear incompatible context so it cannot leak
+to the next commit. `--message-file` stays inside the repository or Git directory.
+
+Other commands:
+
+```bash
+npx --no-install wendkeep commit render --input commit-input.json
+npx --no-install wendkeep commit validate --message-file .git/COMMIT_EDITMSG
+npx --no-install wendkeep commit context --clear
+```
+
+Objectively trivial commits remain unchanged. Implementation
+commits (`feat`, `fix`, `refactor`, and `perf`) require a Conventional Commit subject with an ADR or
+the restricted native fallback above, Capability, Evidence, Tasks, Tests, and Scope sections, the
+staged hash, and a `WendKeep-Commit: v1` trailer. Amend, merge, and squash never receive duplicate or
+invented proof.
+
+## Privacy and fail-closed behavior
+
+- Embedded absolute paths, any configured/default Vault, `.brain`, session registries, PII, and secrets are rejected
+  before persistence.
+- `reported`, `legacy-unbound`, `stale`, and `unproven` evidence cannot be presented as proof.
+- Context holds sanitized references and diff metadata, never private Vault content.
+- `--no-verify` is not accepted: CI validates every new commit, including merges and novel resolutions.
+
+## Expected result
+
+A deterministic, self-contained message with no private material, the hash of the committed index,
+and coherent causal trailers.
+
+## Common errors and diagnosis
+
+`wendkeep doctor` reports `[commit-hooks] healthy`, `disabled`, `missing`, or `drift` and remains
+read-only. After review, recover missing or divergent files with:
+
+```bash
+npx --no-install wendkeep init --git-commit-hooks --force --yes
+```
+
+When abandoning a commit, remove only its transient context with
+`wendkeep commit context --clear`. No command rewrites history or pushes automatically.
+
+## Next steps
+
+Review the generated message, commit it, and let the PR range gate detect any local bypass.

package/docs/en/commands/observer-security.md

@@ -0,0 +1,154 @@
+# Observer security
+
+**English** · [Português](../../pt-BR/commands/observer-security.md)
+
+## Purpose
+
+The Observer is a local/team read model, never a new authority over the Vault, specs, memory, or
+sync. Its threat model assumes a compromised remote host, stolen token, curious operator, copied
+database/outbox, adversarial payload, and interrupted purge. Host/Origin validation remains active;
+mutations and sensitive reads fail closed, including on loopback.
+
+| Class | Default | Primary risk |
+|---|---|---|
+| document | `metadata` | full memory/decisions |
+| transcript | `metadata` | conversation and tools |
+| prompt/response | `redacted` | PII and secrets |
+| usage | `aggregate` | cost and operational identity |
+| audit/receipt | minimal metadata | deleting the proof itself |
+
+Policy v1 restricts by class, `project_id`, path glob, and `entity_type`. Later rules win only in
+the matching project. Redaction covers Bearer values, URL/connection-string credentials, access
+keys, email, phone, and safe configurable regular expressions. Its schema is
+`schema/observer-policy-v1.schema.json`.
+With `transcript_capture: messages`, arrays, JSONL, and the canonical `{messages:[...]}` envelope
+retain only `user|assistant|system` messages with string `role`/`content` after redaction; extra
+fields, tool records, and malformed entries are dropped or fail closed.
+Explicit policy is the publisher's sole capture authority; `WENDKEEP_OBSERVER_CAPTURE_LEVEL` is
+only translated into policy for legacy callers that supplied no policy file, and can never elevate
+or suppress explicit `none|metadata|messages|full` or `selected` documents.
+For document/transcript upserts, `content_hash` always binds the final content after capture and
+redaction; metadata/selected capture uses the SHA-256 of empty content. Document deletions remain
+effective even when content capture is `none`, preserve their path/revision/operation metadata,
+and never carry stale content or content hashes.
+Redaction never rewrites validated structural identity fields such as project/event/entity IDs,
+logical paths, revisions, or operations. Path privacy is enforced fail-closed by project/path
+capture rules; it is not implemented by renaming a storage key through a content-redaction rule.
+The per-event structural contract also preserves accepted snake/camel aliases, document/session/
+agent/call/transcript/rollup keys, timestamps, roles, status, coverage, model/pricing dimensions,
+workflow, and source provenance. `title`, `summary`, `agent_name`, content, prompt/response, and
+metadata remain redactable display/content fields.
+During incremental publishing, missing or blank turn timestamps inherit the batch's canonical
+instant, numeric epoch milliseconds are normalized to ISO 8601, and invalid non-empty values fail
+closed before policy/store; the event and payload use the same instant.
+
+## When to use
+
+Use it before enabling Observer for real data, registering or revoking credentials, restricting
+capture, protecting SQLite/outbox, defining retention, or deleting data with verifiable proof.
+
+## When not to use
+
+Do not use it as a corporate KMS/secret manager, to publish Vault/runtime data, to replace local
+authority, or to delete tables and indexes manually. `full` capture remains opt-in and subject to
+policy/redaction.
+
+## Prerequisites
+
+Use Node.js 22.13+, keep the bind on loopback, and inject tokens/keys only through environment
+variables. The bootstrap token is registered hash-only with explicit projects and a finite expiry;
+it is not a registry-bypassing wildcard admin. For Docker, also set
+`WENDKEEP_OBSERVER_BOOTSTRAP_PROJECTS`, `WENDKEEP_OBSERVER_BOOTSTRAP_EXPIRES_AT`, and a 32-byte
+hex/base64 `WENDKEEP_OBSERVER_ENCRYPTION_KEY`. The operator owns the key and external receipts.
+
+## Syntax
+
+```bash
+npx wendkeep observer serve --token <token> --bootstrap-projects <p1,p2> --bootstrap-expires-at <ISO> [--bootstrap-token-id <id>] [--require-loopback-auth] [--require-encryption]
+npx wendkeep observer security token create --project-id <project> --role <role> --scopes <scopes> --token-env <env> --expires-at <ISO>
+npx wendkeep observer security token rotate --project-id <project> --token-id <id> --token-env <env> --expires-at <ISO> [--new-token-id <id>]
+npx wendkeep observer security token revoke --project-id <project> --token-id <id>
+npx wendkeep observer security policy set --project-id <project> --file <policy.json>
+npx wendkeep observer security policy show --project-id <project>
+npx wendkeep observer security purge --project-id <project> --before <ISO> --classes <classes> [--dry-run]
+npx wendkeep observer security retention run --project-id <project> [--dry-run] [--operation-id <id>]
+```
+
+## Options and exit codes
+
+- `viewer` reads metadata/aggregates; `auditor` may receive sensitive scopes; `publisher` ingests;
+  `admin` manages policy, purge, and recovery. Role, scope, and project must authorize together.
+- Tokens persist only as SHA-256; expiry, rotation, and revocation take effect without restart.
+- After rotating bootstrap credentials, update both token and token ID in the environment; restart
+  never reactivates an expired or revoked predecessor.
+- `--token-env` names the variable holding the secret; the command never prints its value.
+- `--require-loopback-auth` protects the whole API; sensitive reads require a token without it too.
+- `--require-encryption` fails when external key material is missing or invalid.
+- `WENDKEEP_OBSERVER_REQUIRE_ENCRYPTION=1` applies the same fail-closed behavior to `status`,
+  `security`, `register`, `publish`, and `reconcile`; with a configured key, every first v5 upgrade
+  creates only `.bak.enc` plus its manifest before any read/backfill.
+- Exit `0` means the operation completed; exit `1` means invalid configuration, authorization,
+  policy, key, or operation. The hook retains fail-open exit `0` for the local workflow, but aborts
+  before persisting unsafe content.
+
+Audit stores capability, outcome, route, and time, never a Bearer value, prompt, response, or payload.
+
+## Examples
+
+Explicit audited offline recovery:
+
+```powershell
+$env:OBSERVER_RECOVERY_TOKEN = '<strong-temporary-secret>'
+npx wendkeep observer security token create --data-dir C:\WendKeepObserver `
+  --project-id project-a --role admin --scopes '*' --token-env OBSERVER_RECOVERY_TOKEN `
+  --expires-at 2026-09-29T12:00:00Z --reason 'offline recovery' --json
+npx wendkeep observer security token revoke --data-dir C:\WendKeepObserver `
+  --project-id project-a --token-id <id> --reason 'recovery complete' --json
+```
+
+Always dry-run purge first. The retention runner is explicit and idempotent (CLI or
+`POST /v1/projects/:id/security/retention`), with no hidden timer:
+
+```powershell
+npx wendkeep observer security purge --data-dir C:\WendKeepObserver `
+  --project-id project-a --before 2026-08-01T00:00:00Z `
+  --classes documents,calls,transcripts --dry-run --json
+```
+
+```powershell
+npx wendkeep observer security retention run --data-dir C:\WendKeepObserver `
+  --project-id project-a --operation-id scheduled-2026-08-29 --dry-run --json
+```
+
+## Expected result
+
+TTL is independent for documents, calls, and transcripts. Counts, projection/FTS removal, events,
+and receipt share one transaction; retry is idempotent and late old data creates new proof.
+
+AES-256-GCM uses project/class/record/field AAD and an external `keyProvider`. The v6 backfill
+removes plaintext and derived indexes before reads; a wrong key fails without disclosing content.
+Structural migration `006-observer-security.sql` creates a backup, checks checksum, rolls back, and
+supports retry. In required at-rest mode the backup is `.bak.enc`, carries a manifest/key ID and
+restrictive permissions, fails restore with a wrong key, and leaves no plaintext `.bak` behind.
+
+The hook applies metadata/redacted policy by default; `WENDKEEP_OBSERVER_POLICY_FILE` selects an
+explicit policy. `WENDKEEP_OBSERVER_OUTBOX_KEY_ENV` names the outbox key variable and
+`WENDKEEP_OBSERVER_OUTBOX_KEY_ID` identifies the key. Compose requires authentication and
+encryption. The dashboard keeps Bearer only in memory, exports a sanitized copy, and exposes
+Security. MCP requires scopes for calls/full search. Sync carries only `policy_ref`, without
+duplicating tokens or authority.
+
+## Common errors and diagnosis
+
+- `observer_token_missing|expired|revoked`: create/rotate a scoped token or use offline recovery.
+- `observer_project_forbidden|role_forbidden|scope_forbidden`: check project/role/scope intersection.
+- `observer_encryption_key_unavailable|observer_decryption_failed`: check key ID/material; never
+  weaken required mode.
+- `observer_policy_invalid`: validate fields/captures and remove invalid or explosive regexes.
+- v6 migration failure: preserve `.pre-006-*.bak.enc` and its manifest, correct the cause, and retry.
+
+## Next steps
+
+Read [Local Observer](observer.md), dry-run retention, validate revoked/expired tokens, and keep the
+receipt outside the database when external proof is required. Never publish the database, backup,
+outbox, key, token, or `/data`.

package/docs/en/commands/observer.md

@@ -26,7 +26,9 @@ WendKeep hooks.
 
 Use Node.js 22.13 or newer for the SQL Observer. Keep Core and the remaining commands continue to
 support Node.js 18 or newer. Explicitly register each project and set `WENDKEEP_OBSERVER_TOKEN`;
-loopback reads remain open, while every mutation requires a Bearer token.
+every mutation and every sensitive-content read requires a Bearer token, including on loopback.
+Metadata and aggregates may remain locally open when `--require-loopback-auth` is omitted. See
+[Observer security](observer-security.md).
 
 ## Syntax
 
@@ -36,7 +38,7 @@ npx wendkeep observer register --project <project> --vault <vault> --data-dir <d
 npx wendkeep observer publish --project <project> --vault <vault> --data-dir <directory>
 npx wendkeep observer reconcile --project <project> --vault <vault> --data-dir <directory> [--url http://127.0.0.1:8787]
 npx wendkeep observer memory import --project <project> --vault <vault> --url http://127.0.0.1:8787 --token <token> --json
-npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <directory> --token <token>
+npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <directory> --token <token> --bootstrap-projects <p1,p2> --bootstrap-expires-at <ISO> [--require-loopback-auth] [--require-encryption]
 ```
 
 ## Options and exit codes
@@ -46,7 +48,13 @@ npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <directory>
 - `--project` and `--vault` identify a project for `register`, `publish`, `reconcile`, and `memory import`.
 - `--host` accepts only `127.0.0.1`, `localhost`, or `::1`; other hosts are rejected before
   listening.
-- `--token` or `WENDKEEP_OBSERVER_TOKEN` authenticates mutations; `--allow-non-loopback` fails without one.
+- `--token` or `WENDKEEP_OBSERVER_TOKEN` supplies hash-only bootstrap material; explicit projects
+  and finite expiry are required, and all mutations/sensitive reads go through the registry;
+  `--allow-non-loopback` fails without one.
+- `--require-loopback-auth` also requires Bearer for local metadata and aggregates and enables the
+  project's secure ingestion policy.
+- `--require-encryption` requires a 32-byte hex/base64 `WENDKEEP_OBSERVER_ENCRYPTION_KEY`; use
+  `WENDKEEP_OBSERVER_ENCRYPTION_KEY_ID` to identify the external key.
 - `WENDKEEP_OBSERVER_CAPTURE_LEVEL` accepts `metadata` (default, no messages), `messages`, or
   `full-transcript`. Absolute local paths are never published.
 - Exit `0` means success; exit `1` means configuration or operation failure; the publisher hook
@@ -57,7 +65,10 @@ npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <directory>
 ```powershell
 npx wendkeep observer register --project C:\GitHub\WendKeep --vault C:\GitHub\WendKeep\.WendKeep-vault --data-dir C:\WendKeepObserver
 $env:WENDKEEP_OBSERVER_TOKEN = '<strong-local-token>'
-npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir C:\WendKeepObserver --token $env:WENDKEEP_OBSERVER_TOKEN
+$env:WENDKEEP_OBSERVER_BOOTSTRAP_PROJECTS = 'project-a'
+$env:WENDKEEP_OBSERVER_BOOTSTRAP_EXPIRES_AT = '2026-09-29T12:00:00Z'
+$env:WENDKEEP_OBSERVER_ENCRYPTION_KEY = '<32-bytes-in-hex-or-base64>'
+npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir C:\WendKeepObserver --token $env:WENDKEEP_OBSERVER_TOKEN --require-loopback-auth
 $env:WENDKEEP_OBSERVER_URL = 'http://127.0.0.1:8787'
 ```
 
@@ -67,15 +78,19 @@ For local Docker:
 docker compose -f docker/wendkeep-observer/compose.yaml up -d --build
 ```
 
+Compose requires token, bootstrap allowlist/expiry, and key material; it starts with full
+authentication and required encryption. An `encryption_required` policy refuses plaintext ingest/outbox.
+
 ## Local web dashboard
 
 With the server running, open [http://127.0.0.1:8787/](http://127.0.0.1:8787/) in a browser. The
-dashboard is served by the same process and opens directly for reads, without a form or token. Keep the port
-bound to the computer loopback; do not expose this address on a network interface.
+dashboard is served by the same process. Enter the token in the local form: it remains only in page
+memory, is sent as Bearer for queries, and is discarded on reload. Keep the port bound to the
+computer loopback; do not expose this address on a network interface.
 
 The dashboard shows the multi-project list, version, health, latest session, active change, change
 count, and last capture time. Opening a project exposes Overview, Consumption, Sessions, Memory,
-Changes, and Sync screens. Consumption shows total cost, token categories, primary agents,
+Changes, Sync, and Security screens. Consumption shows total cost, token categories, primary agents,
 subagents, providers, models, daily trend, historical coverage, and calls with prompt, response,
 and transcript content according to the selected capture level. Loading, empty, unavailable-server, conflict, no-pricing, and stale-data
 states are visible, with manual refresh and an automatic 15-second refresh.
@@ -160,18 +175,21 @@ complete, archive, repair, or promote state.
 - `POST /v1/projects/:project_id/ingest` — idempotent batches of documents, sessions, agents,
   rollups, calls, and transcripts.
 - `GET /v1/projects/:project_id/memory/tree` — document tree and metadata.
-- `GET /v1/projects/:project_id/memory/document?path=...` — complete Markdown content.
+- `GET /v1/projects/:project_id/memory/document?path=...` — complete Markdown content; requires Bearer.
 - `GET /v1/projects/:project_id/memory/search?q=...` — ranked chunk search with matching passage
-  and provenance; uses a lexical fallback when FTS5 is unavailable.
+  and provenance; uses a lexical fallback when FTS5 is unavailable and requires Bearer.
 - `GET /v1/projects/:project_id/sync` — mode, counts, conflicts, and latest event.
 - `PUT /v1/projects/:project_id/sync` — compatibility configuration; SQL remains authoritative.
-- `GET /v1/projects/:project_id/memory/export` — read-only export with complete content.
+- `GET /v1/projects/:project_id/memory/export` — read-only export sanitized by default; requires Bearer.
 - `POST /v1/projects/:project_id/memory/events` — idempotent batch ingestion.
 - `GET /v1/projects/:project_id/usage/summary` — filterable totals by period, change, session,
   agent, provider, model, and role.
 - `GET /v1/projects/:project_id/usage/breakdown` — agent, subagent, and model hierarchy.
-- `GET /v1/projects/:project_id/usage/calls` — individual calls with prompt and response.
-- `GET /v1/projects/:project_id/transcripts/:transcript_id` — compressed transcript validated by hash.
+- `GET /v1/projects/:project_id/usage/calls` — individual calls with prompt and response; requires Bearer.
+- `GET /v1/projects/:project_id/transcripts/:transcript_id` — compressed transcript validated by hash; requires Bearer.
+- `GET /v1/projects/:project_id/security` — policy, token counts, and sanitized audit; requires admin.
+- `PUT /v1/projects/:project_id/security/policy` — updates the effective policy without restart; requires admin.
+- `POST /v1/projects/:project_id/security/purge` — transactional dry-run/purge with receipt; requires admin.
 
 The `/v1` routes reject transported or expanded bodies above their limits and validate project,
 path, revision, hash, idempotency, and isolation before writing to SQLite. Use `memory/export` for