memleaf 0.2.32__tar.gz → 0.2.34__tar.gz

{memleaf-0.2.32 → memleaf-0.2.34}/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to memleaf are documented here.
 
+## 0.2.34 — 2026-09-08
+
+- Restrict automatic memory extraction to the current turn's visible user input and final assistant reply. Raw tool output, attachments, web/file/terminal payloads and legacy tool-evidence bodies are not new source evidence; existing or retrieved memory remains comparison context rather than source authority. Explicit memory-write prohibitions still fail closed.
+- Add persisted background processing jobs and the read-only `process_status` MCP tool. Accepted background work reports its job identity before completion, while succeeded, deferred and failed outcomes remain observable; failed or unresolved work stays retryable without advancing cleanup state.
+- Tighten source-neutral Gate coverage, exact evidence bindings, assistant-report context, date grounding, target reconciliation, duplicate/no-op handling, same-target update coordination and semantic review before automatic CREATE/UPDATE writes. Preserve candidate-local deferral and idempotent partial retries so unresolved ownership, target, evidence or timing does not fabricate a write.
+- Keep the copied Hermes provider aligned with Core on the conversation-only source boundary, background job polling, session aliasing and bounded failure/deferred diagnostics. Existing Markdown Vaults, shared Hermes/Codex retrieval and explicit remember/forget paths remain local and source-of-truth preserving.
+- Validation for this release: deterministic regression suites ran 927 tests successfully with 2 skips, and isolated MCP transport checks passed. Semantic quality and processing latency remain model-dependent; no concurrency or performance improvement is claimed, and this release does not claim real-mail or customer-business acceptance.
+
+## 0.2.33 — 2026-09-08
+
+- Extend the Gate with bounded physical-evidence batches, exact unit/quote bindings, isolated cross-batch candidate IDs, same-target update coordination, and bounded model reconciliation for compatible CREATE proposals. Failed batches remain retryable and fail closed without advancing the watermark or cleanup.
+- Align Core, HostRuntime, and the copied Hermes provider on document/attachment classification and effective capture-policy reporting: ordinary structural files follow the selected retention mode, while explicitly identified attachments still require attachment opt-in and bounded retention.
+- Keep automatic UPDATEs as `NO_CHANGE` when current evidence only restates the target or adds provenance/source metadata; preserve the selected target for real semantic state changes. Add synthetic-document real-model lifecycle acceptance and regressions for coverage, deadlines, todo completion, capture policy, and lifecycle behavior.
+- Harden automatic processing around source/date grounding, target reconciliation, update review, duplicate/no-op collision handling, and partial-retry idempotency so unresolved ownership, target, evidence, or timing stays deferred without fabricated writes.
+- Isolate read-only/general queries from stale deferred automatic turns while preserving retries for assertions, explicit scopes, and external observations; extend Core/Hermes transport and evidence regressions for these boundaries.
+- Validation for this release: the full suite ran 911 tests successfully with 2 skips. A four-phase synthetic-input real-model acceptance also passed; this does not claim real-mail or customer-business acceptance.
+
 ## 0.2.32 — 2026-09-07
 
 - Add bounded `unknown_unit` Gate diagnostics that identify the exact response field and retain only allowlisted type/length/digest and expected-set summaries; raw invalid values, legal ID lists and model output remain excluded from normal logs and failed state.

{memleaf-0.2.32/src/memleaf.egg-info → memleaf-0.2.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memleaf
-Version: 0.2.32
+Version: 0.2.34
 Summary: A local-first Markdown memory core for AI agents
 Author: memleaf contributors
 License-Expression: MIT
@@ -23,8 +23,8 @@ Dynamic: license-file
 
 [English](README.en.md) · [PyPI](https://pypi.org/project/memleaf/) · [GitHub](https://github.com/miffyblueboo/memleaf)
 
-> **版本：0.2.32。**
-> 核心库、Vault、stdio MCP Server、初始化 CLI、模型路由、提炼流程、受控检索协议和宿主适配器已经实现。本版在既有 UTF-8 证据留存预算和 metadata pending 消费策略上，为 Gate 的 `unknown_unit` 提供字段路径、类型/长度/摘要和期望集合摘要等受限诊断，并在同一合法 ID 清单约束下最多三次尝试、最多两次纠正；不记录原始值、不做 ID 猜测，持续失败不推进水位且不触发清理。保持 source-neutral 语义、Markdown 唯一事实源和无 SQLite 运行时依赖。真实模型语义效果仍需结合本地模型和代表性样本验收。
+> **版本：0.2.34。**
+> 记忆只从用户与 Agent 的可见对话提炼。Agent 已在回复中整理的事实、项目进展和明确待办可作为来源；邮件、附件、网页和终端等工具原文不进入记忆提炼。模型负责保留原话中的不确定性，现有记忆仅用于比较、去重和更新。Markdown 仍是唯一事实源。
 > **当前版本支持 Hermes 和 Codex。** Antigravity（反重力）不检测、不安装、不配置。
 
 ## 项目定位
@@ -159,12 +159,12 @@ python -m pip install -U memleaf && python -m memleaf install
 4. 激活 `memory.provider=memleaf`；
 5. 通过 Hermes 官方 CLI 配置 memleaf MCP；
 6. 配置 MCP lazy/idle 生命周期；
-7. 验证 MCP Server 能发现 12 个工具；
+7. 验证 MCP Server 能发现 13 个工具；
 8. 写入本地 Agent 状态索引。
 
 完成后重启 Hermes。
 
-如果没有检测到 Hermes、无法取得完整模型路由、Provider 激活失败或 MCP 的 12 工具验证失败，安装会明确返回失败，不会把未完成的接入报告为成功。
+如果没有检测到 Hermes、无法取得完整模型路由、Provider 激活失败或 MCP 的 13 工具验证失败，安装会明确返回失败，不会把未完成的接入报告为成功。
 
 仓库中的 `install.sh` 保留给源码开发、离线源码安装和故障排查；普通 PyPI 用户不需要执行它。
 
@@ -234,7 +234,7 @@ Hermes 的原生 Provider 和 MCP Server 是两个不同入口，但共用同一
 - Agent 需要通过 MCP `search` 找到候选，再用当前 `retrieval_id` 调用 `read`；
 - MCP 仍用于主动 `search`、`remember`、`forget` 和维护操作；
 - MCP 连接失败时会关闭坏连接，后续请求可重建连接；
-- `process` 使用已发现或用户配置的模型路由执行准入判断和记忆整理；失败数据保留在 inbox 中；
+- Provider 自动处理通过 `process(background=true)` 持久化本地 job 后立即返回；用只读 `process_status` 查看最终的 `succeeded`、`deferred` 或 `failed` 结果。显式同步 `process` 仍可用；失败数据保留在 inbox 中；
 - cron、flush、subagent 等非主用户会话不会自动召回、捕获或处理。
 
 安装完成后可检查：
@@ -261,7 +261,7 @@ python -m memleaf.mcp_server --vault "$HOME/.memleaf"
 
 不传 `--vault` 时默认使用 `~/.memleaf`；也可以设置 `MEMLEAF_VAULT`。正常情况下不需要手工常驻，Hermes 或 Codex 会按需启动它。stdout 只输出 JSON-RPC，日志不会污染协议通道。
 
-当前提供 11 个工具：
+当前提供 13 个工具：
 
 | 工具 | 用途 |
 | --- | --- |
@@ -270,7 +270,8 @@ python -m memleaf.mcp_server --vault "$HOME/.memleaf"
 | `scope_catalog` | 返回 Scope、父级和别名，不返回具体记忆正文 |
 | `search` | 返回有界候选目录和 `found`/`no_match` 状态 |
 | `read` | 使用当前 `retrieval_id` 分页读取选中的记忆正文 |
-| `process` | 处理完整 inbox 轮次并按准入规则提炼 |
+| `process` | 处理完整 inbox 轮次并按准入规则提炼；`background=true` 时异步入队 |
+| `process_status` | 只读查询异步处理 job 状态 |
 | `remember` | 用户明确要求时创建或更新记忆 |
 | `forget_memory` | 按精确 ID 删除一条记忆 |
 | `forget_about` | 忘记明确主题；有歧义时只返回候选 |
@@ -443,7 +444,7 @@ history:
 
 ## 隐私与安全边界
 
-- 对话捕获只接收 user/assistant 可见文本，不捕获 system/developer 指令或隐藏推理。匹配到当前轮工具调用的证据另由 `capture.tool_evidence_mode` 控制；新建 Vault 默认 `bounded`（脱敏、有界正文），文件/附件正文默认不留存。旧配置显式关闭工具输出时不自动升级为保留正文；
+- 对话捕获只接收 user/assistant 可见文本，不捕获 system/developer 指令、隐藏推理或工具输出。工具原文不保存，也不会从旧 inbox 重新送入提炼；
 - 捕获落盘前尽力脱敏常见 API key、Bearer token、Cookie、JWT 和私钥，但脱敏不是加密，也不能保证识别所有敏感信息；
 - 路径校验、符号链接检查、Vault 锁、同目录临时文件、fsync 和原子替换用于保护本地写入；
 - memleaf 不主动上传整个 Vault，也没有托管后台、遥测或账号系统；
@@ -490,11 +491,12 @@ MIT，见 [LICENSE](LICENSE)。
 *Your memories, in files you own.*
 
 
-## 通用处理与只读验收（0.2.32）
+## 通用处理与只读验收（0.2.34）
 
-邮件、日历、工单、文件、浏览器与普通对话共用证据准入、覆盖检查和写入路径。
-自动摘要只能使用获准引用的原文；助手复述和旧记忆回读不能单独授权新增写入。
-模型负责语义判断，代码验证来源和原文引用。通过引用校验并不保证模型的语义判断一定正确。
+所有自动记忆只从用户与 Agent 的可见对话中提炼。Agent 已经在回复里总结的
+事实、进展和明确待办可以保留；不重新读取或分析邮件、附件、网页、文件、终端输出。
+建议、猜测、提问和条件必须保留其性质，不能升级为用户决定、已完成动作或已核实事实。
+已有记忆的纯复述不新建；新结论与旧记忆比较后才新增或更新。
 
 ```bash
 memleaf audit --vault /path/to/existing/vault --json
@@ -505,29 +507,17 @@ memleaf process --vault /path/to/existing/vault --source hermes --session-id SES
 `--dry-run` 在私有临时副本运行正常处理，可能调用配置的独立 Model Route；不会改写原 Vault。
 检测到原 Vault 并发变化时会拒绝输出可用预览。没有一键应用预览的功能。
 
-工具执行状态与证据完整性分别记录；超限、丢失或不完整内容不会被模型的 NO_CHANGE 升级为完整。
-执行成功但尚有未解决项时，结果显示 `coverage_status=partial`，并保留来源以供有界重试或补充证据。
-行为、限制、测试协议变更见 [通用处理说明](docs/general-processing.md)。
+处理结果只反映可见对话的记忆提炼。若对话中的项目归属或含义仍不确定，
+`coverage_status` 可以为 `partial`；工具执行错误或原文截断本身不再造成提炼漏项。
+`external_evidence_status=disabled` 表示工具证据不属于提炼输入。
+行为、限制、测试协议见 [通用处理说明](docs/general-processing.md)。
 
-### 工具证据留存配置
+### 对话来源边界
 
-```yaml
-capture:
-  tool_evidence_mode: bounded  # bounded | metadata | off
-  include_attachments: false
-```
-
-`bounded` 允许当前轮真实工具观察保留有界、脱敏的正文；小结果可能完整保留，
-不是承诺只保存模型总结。`metadata` 仅留工具调用标识等元数据（仍可能包含标题），
-不保留证据正文，也不把主动排除误报成提炼漏项。`off` 不保存工具证据记录。
-三种模式均不允许把助手复述或旧记忆回读变成独立的新事实。
-
-现有配置未提供新字段时，旧 `include_tool_output: false` 或未设置该开关均按
-`metadata` 处理，旧 `true` 按 `bounded` 处理。显式新字段优先；新建 Vault 只写
-新字段，不再同时写含义冲突的旧开关。`include_attachments: true` 仍受上述总模式限制。
-宿主通过结构化文件路径、文件/附件标识识别文档；不承诺识别任意 Shell 命令或不透明工具
-隐藏读取的文件。用户粘贴的可见文档和显式 `remember` 内容不属于自动附件抓取。
+新建配置使用 `capture.tool_evidence_mode: off` 与 `include_attachments: false`。
+旧配置中的 `bounded`、`metadata` 等值仅为兼容而接受，不能重新开启工具原文提炼。
+状态接口展示实际生效的 `off`。用户自己粘贴到可见消息中的内容属于对话来源。
 
-策略在待捕获缓存、inbox 写入和新模型提炼输入处共同执行。配置收紧不会自动删除已提交
-记忆或改写已捕获 inbox；失败前已经冻结的提交计划也不作为新的模型调用重新提炼。
-已捕获工具原文的清理仍遵守原有安全期，明确忘记使用 `forget_memory/forget_about`。
+边界在宿主采集、Core capture 和历史 inbox 的新处理处执行。
+已提交记忆不会自动删除。旧版本已冻结但未完成的计划不会被静默丢弃或重新规划，
+不含新来源边界标记的计划会停止恢复并保留现场，避免越过新的输入约定。

{memleaf-0.2.32 → memleaf-0.2.34}/README.en.md

@@ -4,8 +4,8 @@
 
 [中文](README.md) · [PyPI](https://pypi.org/project/memleaf/) · [GitHub](https://github.com/miffyblueboo/memleaf)
 
-> **Version: 0.2.32.**
-> The core library, Vault, stdio MCP server, initialization CLI, model routing, memory extraction, controlled retrieval protocol, and host adapters are implemented. Building on the existing UTF-8 evidence budget and metadata-mode pending-evidence policy, this release adds bounded `unknown_unit` Gate diagnostics for field path, type/length/digest and expected-set summaries, with at most three attempts and two corrections constrained by the same legal-ID inventory; it never logs the raw value or guesses an ID, and a persistently failed Gate does not advance the watermark or trigger cleanup. This preserves source-neutral semantics, Markdown as the sole source of truth, and zero SQLite runtime dependencies. Real-model semantics still require local acceptance with the selected model and representative inputs.
+> **Version: 0.2.34.**
+> Automatic extraction now uses only the current turn's visible user input and final assistant reply. Raw tool output, attachments, web/file/terminal payloads and legacy tool-evidence bodies are not new source evidence; existing or retrieved memory remains comparison context rather than source authority. Background processing is persisted as a local job and can be checked through the read-only `process_status` MCP tool; failed work remains retryable and fail closed. The release also tightens source/date grounding, target reconciliation, duplicate/no-op handling and semantic review before writes. Markdown remains the sole source of truth with no SQLite runtime dependency. Acceptance covers deterministic regression suites and synthetic inputs; it does not claim real-mail or customer-business acceptance.
 > **The current release supports Hermes and Codex.** Antigravity is not detected, installed, or configured.
 
 ## Project scope
@@ -141,12 +141,12 @@ Both installation paths automatically:
 4. Activate `memory.provider=memleaf`.
 5. Configure the memleaf MCP entry through Hermes' official CLI.
 6. Configure MCP lazy/idle lifecycle settings.
-7. Verify that the MCP server exposes all 12 tools.
+7. Verify that the MCP server exposes all 13 tools.
 8. Record the local Agent integration status.
 
 Restart Hermes after installation.
 
-If Hermes cannot be detected, no complete model route can be configured, Provider activation fails, or the 12-tool MCP verification fails, the installer returns an explicit failure rather than reporting an incomplete integration as successful.
+If Hermes cannot be detected, no complete model route can be configured, Provider activation fails, or the 13-tool MCP verification fails, the installer returns an explicit failure rather than reporting an incomplete integration as successful.
 
 The repository `install.sh` remains for source development, offline source installation, and troubleshooting. Normal PyPI users do not need to run it.
 
@@ -216,7 +216,7 @@ Hermes' native Provider and the MCP server are separate entry points, but they s
 - The Agent uses MCP `search` to find candidates and `read` with the current `retrieval_id` to load selected bodies.
 - MCP remains the deliberate interface for `search`, `remember`, `forget`, and maintenance.
 - A failed MCP request closes the broken connection so a later request can create a fresh one.
-- `process` uses a discovered or user-configured model route for admission and memory summarization; failed data remains in the inbox.
+- Provider automatic processing enqueues a durable local job with `process(background=true)` and returns immediately; use the read-only `process_status` tool to inspect its final `succeeded`, `deferred`, or `failed` result. Explicit synchronous `process` remains available, and failed data remains in the inbox.
 - cron, flush, and subagent contexts do not automatically recall, capture, or process memory.
 
 Check the native provider after installation with:
@@ -243,7 +243,7 @@ python -m memleaf.mcp_server --vault "$HOME/.memleaf"
 
 Without `--vault`, the server uses `~/.memleaf`; `MEMLEAF_VAULT` can also specify the Vault. In normal use the server does not need to be kept running manually: Hermes or Codex starts it on demand. stdout contains only JSON-RPC messages so logs do not corrupt the protocol stream.
 
-The server currently exposes 12 tools:
+The server currently exposes 13 tools:
 
 | Tool | Purpose |
 | --- | --- |
@@ -253,7 +253,8 @@ The server currently exposes 12 tools:
 | `search` | Return a bounded candidate directory and `found`/`no_match` status |
 | `list_todos` | Enumerate current todo memories across scopes with status/date filters and pagination |
 | `read` | Read a selected memory body in pages using the current `retrieval_id` |
-| `process` | Process complete inbox turns under the admission rules |
+| `process` | Process complete inbox turns under the admission rules; `background=true` enqueues a job |
+| `process_status` | Read the status of a background processing job |
 | `remember` | Create or update memory after an explicit request |
 | `forget_memory` | Delete one memory by exact ID |
 | `forget_about` | Forget an unambiguous topic; return candidates when ambiguous |
@@ -426,7 +427,7 @@ Directories are normally created with mode `0700`, and files are stored as plain
 
 ## Privacy and security boundaries
 
-- Conversation capture accepts visible user/assistant text, never system/developer instructions or hidden reasoning. Matched current-turn tool evidence is controlled separately by `capture.tool_evidence_mode`: new Vaults use bounded/redacted observations; document/attachment bodies are excluded by default. Legacy configurations disabling tool output are not silently opted into body retention.
+- Conversation capture accepts only visible user/assistant text, never system/developer instructions, hidden reasoning, or tool output. Tool bodies are not saved or reprocessed from older inbox records; legacy tool-evidence settings cannot re-enable raw-source extraction.
 - Common API keys, Bearer tokens, cookies, JWTs, and private keys are redacted on a best-effort basis before capture is written. Redaction is not encryption and cannot detect every secret.
 - Path validation, symlink checks, Vault locks, same-directory temporary files, fsync, and atomic replacement protect local writes.
 - memleaf does not upload the entire Vault and has no hosted backend, telemetry, or account system.
@@ -474,11 +475,9 @@ MIT; see [LICENSE](LICENSE).
 *Your memories, in files you own.*
 
 
-## General processing and read-only inspection (0.2.32)
+## General processing and read-only inspection (0.2.34)
 
-Dialogue, calendars, tickets, files, web results and other tools share the evidence, coverage and write path.
-Models interpret semantics; Core validates physical provenance and exact original quotations.
-A valid quotation establishes provenance, not the truth or entailment of a generated claim.
+Automatic memory extraction uses only visible user and assistant conversation text. Findings already summarized in the final assistant reply can be retained; mail, attachments, web pages, files and terminal output are not re-read or analyzed. Suggestions, guesses, questions and conditions retain their original status and cannot be promoted to decisions, completed actions or verified facts. Existing-memory restatements do not create new memories; new conclusions are compared with existing memories before creation or update.
 
 ```bash
 memleaf audit --vault /path/to/existing/vault --json
@@ -488,32 +487,24 @@ memleaf process --vault /path/to/existing/vault --source hermes --session-id SES
 Audit is local/read-only, never calls a model, never infers producing versions and never repairs automatically.
 Dry-run executes the normal processor on a private temporary copy and may call the configured Model Route.
 It does not modify the source Vault; concurrent source changes invalidate the preview. There is no apply-preview mode.
-Execution success is separate from evidence completeness: `coverage_status=partial` reports unresolved work.
+Processing results describe visible-conversation extraction. If project ownership or meaning remains uncertain, `coverage_status=partial` may report unresolved work. Tool execution errors or truncated raw payloads do not create extraction gaps because those payloads are outside the input.
+`external_evidence_status=disabled` means tool evidence is not part of the extraction input.
 See [general processing](docs/general-processing.md) for the protocol, limits and verification boundaries.
 
-### Tool-evidence retention
+### Conversation source boundary
 
 ```yaml
 capture:
-  tool_evidence_mode: bounded  # bounded | metadata | off
+  tool_evidence_mode: off
   include_attachments: false
 ```
 
-`bounded` keeps bounded, redacted current-turn observations; small tool results may be
-retained in full, not just as model summaries. `metadata` keeps identifiers and permitted
-metadata (which may include titles), not bodies; intentional exclusions are not reported
-as unresolved extraction. `off` retains no tool-evidence records. None of these modes makes
-assistant synthesis or retrieved old memory independent evidence of new facts.
-
-For an existing file without the new mode, legacy `include_tool_output: false` or an
-absent boolean means `metadata`; true means `bounded`. An explicit new mode takes
-precedence. New Vaults write only the new mode. Attachment opt-in remains subject to the
-mode. Adapters classify structural file paths, file IDs and attachment handles, not
-arbitrary opaque shell commands. Pasted visible documents and explicit remember text
-are not automatic attachment capture.
-
-The policy applies to pending cache, inbox writes, and new model-planning inputs.
-Tightening it is not a retroactive rewrite of committed memories or captured inbox files.
-Previously frozen operations are recovered as existing plans, not new model calls.
-Captured evidence retains its existing cleanup grace period; use explicit forget for
-memory deletion. See `docs/evidence-retention.md` for limits and scope.
+New configurations use `capture.tool_evidence_mode: off` and `include_attachments: false`.
+Legacy `bounded` and `metadata` values remain accepted for compatibility but cannot
+re-enable raw tool extraction. Status output reports the effective `off` behavior.
+Content a user pastes into a visible message is conversation input.
+
+The boundary is enforced by host capture, Core capture and new processing of historical
+inbox records. Committed memories are not deleted automatically. Frozen operations without
+the conversation-only policy marker are not silently replayed or replanned; they remain
+available for inspection so the new input contract is not bypassed.

{memleaf-0.2.32 → memleaf-0.2.34}/README.md

@@ -4,8 +4,8 @@
 
 [English](README.en.md) · [PyPI](https://pypi.org/project/memleaf/) · [GitHub](https://github.com/miffyblueboo/memleaf)
 
-> **版本：0.2.32。**
-> 核心库、Vault、stdio MCP Server、初始化 CLI、模型路由、提炼流程、受控检索协议和宿主适配器已经实现。本版在既有 UTF-8 证据留存预算和 metadata pending 消费策略上，为 Gate 的 `unknown_unit` 提供字段路径、类型/长度/摘要和期望集合摘要等受限诊断，并在同一合法 ID 清单约束下最多三次尝试、最多两次纠正；不记录原始值、不做 ID 猜测，持续失败不推进水位且不触发清理。保持 source-neutral 语义、Markdown 唯一事实源和无 SQLite 运行时依赖。真实模型语义效果仍需结合本地模型和代表性样本验收。
+> **版本：0.2.34。**
+> 记忆只从用户与 Agent 的可见对话提炼。Agent 已在回复中整理的事实、项目进展和明确待办可作为来源；邮件、附件、网页和终端等工具原文不进入记忆提炼。模型负责保留原话中的不确定性，现有记忆仅用于比较、去重和更新。Markdown 仍是唯一事实源。
 > **当前版本支持 Hermes 和 Codex。** Antigravity（反重力）不检测、不安装、不配置。
 
 ## 项目定位
@@ -140,12 +140,12 @@ python -m pip install -U memleaf && python -m memleaf install
 4. 激活 `memory.provider=memleaf`；
 5. 通过 Hermes 官方 CLI 配置 memleaf MCP；
 6. 配置 MCP lazy/idle 生命周期；
-7. 验证 MCP Server 能发现 12 个工具；
+7. 验证 MCP Server 能发现 13 个工具；
 8. 写入本地 Agent 状态索引。
 
 完成后重启 Hermes。
 
-如果没有检测到 Hermes、无法取得完整模型路由、Provider 激活失败或 MCP 的 12 工具验证失败，安装会明确返回失败，不会把未完成的接入报告为成功。
+如果没有检测到 Hermes、无法取得完整模型路由、Provider 激活失败或 MCP 的 13 工具验证失败，安装会明确返回失败，不会把未完成的接入报告为成功。
 
 仓库中的 `install.sh` 保留给源码开发、离线源码安装和故障排查；普通 PyPI 用户不需要执行它。
 
@@ -215,7 +215,7 @@ Hermes 的原生 Provider 和 MCP Server 是两个不同入口，但共用同一
 - Agent 需要通过 MCP `search` 找到候选，再用当前 `retrieval_id` 调用 `read`；
 - MCP 仍用于主动 `search`、`remember`、`forget` 和维护操作；
 - MCP 连接失败时会关闭坏连接，后续请求可重建连接；
-- `process` 使用已发现或用户配置的模型路由执行准入判断和记忆整理；失败数据保留在 inbox 中；
+- Provider 自动处理通过 `process(background=true)` 持久化本地 job 后立即返回；用只读 `process_status` 查看最终的 `succeeded`、`deferred` 或 `failed` 结果。显式同步 `process` 仍可用；失败数据保留在 inbox 中；
 - cron、flush、subagent 等非主用户会话不会自动召回、捕获或处理。
 
 安装完成后可检查：
@@ -242,7 +242,7 @@ python -m memleaf.mcp_server --vault "$HOME/.memleaf"
 
 不传 `--vault` 时默认使用 `~/.memleaf`；也可以设置 `MEMLEAF_VAULT`。正常情况下不需要手工常驻，Hermes 或 Codex 会按需启动它。stdout 只输出 JSON-RPC，日志不会污染协议通道。
 
-当前提供 11 个工具：
+当前提供 13 个工具：
 
 | 工具 | 用途 |
 | --- | --- |
@@ -251,7 +251,8 @@ python -m memleaf.mcp_server --vault "$HOME/.memleaf"
 | `scope_catalog` | 返回 Scope、父级和别名，不返回具体记忆正文 |
 | `search` | 返回有界候选目录和 `found`/`no_match` 状态 |
 | `read` | 使用当前 `retrieval_id` 分页读取选中的记忆正文 |
-| `process` | 处理完整 inbox 轮次并按准入规则提炼 |
+| `process` | 处理完整 inbox 轮次并按准入规则提炼；`background=true` 时异步入队 |
+| `process_status` | 只读查询异步处理 job 状态 |
 | `remember` | 用户明确要求时创建或更新记忆 |
 | `forget_memory` | 按精确 ID 删除一条记忆 |
 | `forget_about` | 忘记明确主题；有歧义时只返回候选 |
@@ -424,7 +425,7 @@ history:
 
 ## 隐私与安全边界
 
-- 对话捕获只接收 user/assistant 可见文本，不捕获 system/developer 指令或隐藏推理。匹配到当前轮工具调用的证据另由 `capture.tool_evidence_mode` 控制；新建 Vault 默认 `bounded`（脱敏、有界正文），文件/附件正文默认不留存。旧配置显式关闭工具输出时不自动升级为保留正文；
+- 对话捕获只接收 user/assistant 可见文本，不捕获 system/developer 指令、隐藏推理或工具输出。工具原文不保存，也不会从旧 inbox 重新送入提炼；
 - 捕获落盘前尽力脱敏常见 API key、Bearer token、Cookie、JWT 和私钥，但脱敏不是加密，也不能保证识别所有敏感信息；
 - 路径校验、符号链接检查、Vault 锁、同目录临时文件、fsync 和原子替换用于保护本地写入；
 - memleaf 不主动上传整个 Vault，也没有托管后台、遥测或账号系统；
@@ -471,11 +472,12 @@ MIT，见 [LICENSE](LICENSE)。
 *Your memories, in files you own.*
 
 
-## 通用处理与只读验收（0.2.32）
+## 通用处理与只读验收（0.2.34）
 
-邮件、日历、工单、文件、浏览器与普通对话共用证据准入、覆盖检查和写入路径。
-自动摘要只能使用获准引用的原文；助手复述和旧记忆回读不能单独授权新增写入。
-模型负责语义判断，代码验证来源和原文引用。通过引用校验并不保证模型的语义判断一定正确。
+所有自动记忆只从用户与 Agent 的可见对话中提炼。Agent 已经在回复里总结的
+事实、进展和明确待办可以保留；不重新读取或分析邮件、附件、网页、文件、终端输出。
+建议、猜测、提问和条件必须保留其性质，不能升级为用户决定、已完成动作或已核实事实。
+已有记忆的纯复述不新建；新结论与旧记忆比较后才新增或更新。
 
 ```bash
 memleaf audit --vault /path/to/existing/vault --json
@@ -486,29 +488,17 @@ memleaf process --vault /path/to/existing/vault --source hermes --session-id SES
 `--dry-run` 在私有临时副本运行正常处理，可能调用配置的独立 Model Route；不会改写原 Vault。
 检测到原 Vault 并发变化时会拒绝输出可用预览。没有一键应用预览的功能。
 
-工具执行状态与证据完整性分别记录；超限、丢失或不完整内容不会被模型的 NO_CHANGE 升级为完整。
-执行成功但尚有未解决项时，结果显示 `coverage_status=partial`，并保留来源以供有界重试或补充证据。
-行为、限制、测试协议变更见 [通用处理说明](docs/general-processing.md)。
+处理结果只反映可见对话的记忆提炼。若对话中的项目归属或含义仍不确定，
+`coverage_status` 可以为 `partial`；工具执行错误或原文截断本身不再造成提炼漏项。
+`external_evidence_status=disabled` 表示工具证据不属于提炼输入。
+行为、限制、测试协议见 [通用处理说明](docs/general-processing.md)。
 
-### 工具证据留存配置
+### 对话来源边界
 
-```yaml
-capture:
-  tool_evidence_mode: bounded  # bounded | metadata | off
-  include_attachments: false
-```
-
-`bounded` 允许当前轮真实工具观察保留有界、脱敏的正文；小结果可能完整保留，
-不是承诺只保存模型总结。`metadata` 仅留工具调用标识等元数据（仍可能包含标题），
-不保留证据正文，也不把主动排除误报成提炼漏项。`off` 不保存工具证据记录。
-三种模式均不允许把助手复述或旧记忆回读变成独立的新事实。
-
-现有配置未提供新字段时，旧 `include_tool_output: false` 或未设置该开关均按
-`metadata` 处理，旧 `true` 按 `bounded` 处理。显式新字段优先；新建 Vault 只写
-新字段，不再同时写含义冲突的旧开关。`include_attachments: true` 仍受上述总模式限制。
-宿主通过结构化文件路径、文件/附件标识识别文档；不承诺识别任意 Shell 命令或不透明工具
-隐藏读取的文件。用户粘贴的可见文档和显式 `remember` 内容不属于自动附件抓取。
+新建配置使用 `capture.tool_evidence_mode: off` 与 `include_attachments: false`。
+旧配置中的 `bounded`、`metadata` 等值仅为兼容而接受，不能重新开启工具原文提炼。
+状态接口展示实际生效的 `off`。用户自己粘贴到可见消息中的内容属于对话来源。
 
-策略在待捕获缓存、inbox 写入和新模型提炼输入处共同执行。配置收紧不会自动删除已提交
-记忆或改写已捕获 inbox；失败前已经冻结的提交计划也不作为新的模型调用重新提炼。
-已捕获工具原文的清理仍遵守原有安全期，明确忘记使用 `forget_memory/forget_about`。
+边界在宿主采集、Core capture 和历史 inbox 的新处理处执行。
+已提交记忆不会自动删除。旧版本已冻结但未完成的计划不会被静默丢弃或重新规划，
+不含新来源边界标记的计划会停止恢复并保留现场，避免越过新的输入约定。

memleaf-0.2.34/docs/capture-budget-design.md

@@ -0,0 +1,9 @@
+# Capture budget compatibility
+
+Automatic extraction uses only the current turn's visible user input and final assistant reply. Historical context, intermediate assistant messages, tool calls/results and hidden payloads are not new memory sources.
+
+The shared evidence-budget helper remains available for legacy parsing and standalone provider compatibility. Its record, UTF-8 body and aggregate limits are implementation bounds, not permission to capture external content. Automatic capture discards tool evidence before inbox persistence, and processing excludes raw evidence in older inbox files. Legacy `bounded` or `metadata` configuration cannot restore it.
+
+Synthetic tests retain deterministic budget, redaction, overflow and idempotency checks for that helper. Runtime acceptance verifies excluded payloads never reach model prompts or cause partial/deferred work. A final visible reply can support multiple independently useful memories through exact source bindings; repeated existing facts remain comparison-only and should produce NO_CHANGE.
+
+Model context capacity is separate from capture compatibility. Visible messages still consume prompt capacity, and model failure must preserve retryable input rather than silently dropping it. Synthetic checks, live model results, installation and release are reported separately.

{memleaf-0.2.32 → memleaf-0.2.34}/docs/config-migrations.md

@@ -6,7 +6,7 @@ This document describes the configuration and Vault-layout compatibility boundar
 
 The current persisted top-level sections are `vault`, `agents`, `scopes`, `native_sources`, `process`, `history`, `capture`, and `llm`. Retrieval remains Scope Map -> search -> read; there is no configurable legacy injection mode.
 
-`capture.tool_evidence_mode` is the current tool-evidence retention setting and accepts `bounded`, `metadata`, or `off`. `capture.include_attachments` is independent and defaults to `false`.
+Automatic extraction uses only the current turn’s visible user input and final assistant reply. `capture.tool_evidence_mode` defaults to `off` and `capture.include_attachments` to `false`. Legacy `bounded` and `metadata` values remain readable for configuration compatibility, but all modes exclude raw tool and attachment payloads.
 
 ## Deprecated fields
 
@@ -22,7 +22,7 @@ memleaf's own current installers no longer pass the two deprecated no-op flags;
 ## Automatic migration
 
 When reading an older configuration, `capture.include_tool_output: true` becomes `tool_evidence_mode: bounded`; `false` becomes `metadata`. Saving the normalized configuration writes only the current field. If both legacy and current fields are present but disagree, loading fails closed instead of guessing.
-A persisted older config with no `capture` section, or with a partial capture section that has neither evidence field, normalizes to `tool_evidence_mode: metadata`, preserving the previous safe metadata-only behavior. New Vaults still write an explicit `bounded` mode.
+A missing capture mode normalizes to `off`. New Vaults write `off` and `include_attachments: false`. Explicit legacy values remain parseable, but effective capture status always reports `off` and attachment inclusion `false`; compatibility never restores raw evidence as a memory source.
 
 The obsolete `inject` section is removed during normalization. No current runtime component consumes it.
 

memleaf-0.2.34/docs/evidence-retention.md

@@ -0,0 +1,96 @@
+# Evidence retention
+
+Memleaf extracts memories from the visible conversation only. User messages and
+complete Agent messages are the source boundary. Tool results, mail bodies,
+documents, attachments, retrieved snippets, and terminal output are not
+captured as memory evidence and are never sent to the extraction model.
+
+The `tool_evidence` argument remains accepted at compatibility boundaries so an
+older host can call a newer Vault. It has no retention authority: the effective
+policy drops it before pending-cache, inbox, planning, or model input. A visible
+Agent message may report a result in its own words; that message is evaluated as
+conversation text, while the underlying tool result remains unavailable.
+
+## Effective policy and compatibility
+
+New Vaults write this explicit capture policy:
+
+```yaml
+capture:
+  visible_messages_only: true
+  tool_evidence_mode: off
+  include_attachments: false
+  redact_secrets: true
+```
+
+`capture_policy_status` always reports the effective boundary as:
+
+```json
+{
+  "tool_evidence_mode": "off",
+  "include_attachments": false,
+  "body_retention": "off"
+}
+```
+
+Older configurations remain readable. `bounded`, `metadata`, `off`, and the
+legacy `include_tool_output` boolean are validated and normalized for migration,
+but none of them can re-enable tool bodies. A legacy `true` or an explicit
+`bounded` value is therefore readable configuration state, not permission to
+collect raw evidence. Invalid modes and non-boolean flags fail closed.
+
+Loading a configuration does not rewrite it. Normal saves may make the
+compatibility fields explicit, but they do not restore discarded source text.
+
+## Redaction and budget helpers
+
+The redaction and UTF-8 budget functions remain deterministic defensive helpers
+for callers that validate legacy or untrusted records. They may return a bounded
+or redacted in-memory value for that pure-function contract. Their result is not
+an admissible memory source: capture applies the conversation-only policy after
+validation and returns no tool evidence.
+
+Structural `path`, `file`, `file_id`, `file://`, and explicit `attachment_id`
+arguments may still be classified for diagnostics. Classification never grants
+permission to retain the referenced body. A path that happens to point at an
+attachment cannot authorize attachment content.
+
+## Ingress and legacy data
+
+- Direct `Memleaf.capture(..., tool_evidence=...)` stores only the visible event.
+- `HostRuntime.observe_external_tool` drops tool, mail, document, and attachment
+  bodies before writing its pending state.
+- The standalone Hermes adapter may keep its compatibility call shape, but Core
+  applies the same no-body boundary.
+- A legacy inbox can still be parsed for migration and audit compatibility. Its
+  old `tool_evidence` fields are excluded from admission and model prompts; they
+  do not become retryable or partial evidence.
+
+The policy does not silently rewrite an existing user's inbox or knowledge. An
+old raw field may remain in an already captured file until the user explicitly
+forgets or cleans it, but processing never treats that field as source text.
+
+## Processing status
+
+Intentional tool-evidence exclusion is a complete policy decision. It reports
+`external_evidence_status=disabled`, with zero retained body bytes and zero
+unresolved evidence caused by the exclusion. It must not create a `partial`
+coverage result, a deferred inbox turn, or a retry request. Partial coverage and
+deferred recovery remain available for failures in the visible conversation
+pipeline and model validation.
+
+No later policy change reconstructs a body that was discarded at capture. The
+host must not re-read a mail server, document, attachment, or terminal result to
+make a Gate decision pass.
+
+## Verification
+
+The contract tests cover:
+
+- default, legacy, and explicit bounded configuration compatibility;
+- effective `off`/disabled status and invalid-setting rejection;
+- pure redaction and UTF-8 budget behavior;
+- direct capture and HostRuntime dropping raw bodies;
+- legacy inbox bodies remaining outside model input and partial accounting;
+- admission of visible user and Agent messages only;
+- MCP, CLI, and Hermes status reporting the disabled policy.