memorykit 0.6.0__tar.gz → 0.8.0__tar.gz

{memorykit-0.6.0 → memorykit-0.8.0}/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 0.8.0 — 2026-08-30
+
+- Add safe automatic project detection for GitHub Copilot plugin installs.
+  `SessionStart` accepts only the host-supplied `cwd` and `sessionId`, requires
+  `sessionId` to exactly match `COPILOT_AGENT_SESSION_ID`, resolves the Git
+  top-level and a canonical `github.com/owner/repository` origin through the
+  provider's existing normalizer, and fails closed for missing, foreign-host,
+  deep-namespace, invalid, or conflicting repository context.
+- Persist only `session_id` and normalized `project` in a private, atomic,
+  idempotent binding under `CONTEXT_KIT_MEMORY_HOME/session-bindings`. Session
+  IDs are validated as safe filenames, same-session cross-project reuse is
+  refused, explicit configuration keeps precedence, and `SessionEnd` removes
+  the matching binding. Crash leftovers cannot cross sessions because lookup is
+  keyed by the host-generated session ID.
+- Fail closed on non-POSIX hosts, where the standard library cannot verify
+  owner-only ACLs for the binding root. Windows and other unsupported platforms
+  retain the full explicit project configuration path.
+- Keep project resolution in the provider used by both CLI and MCP. MCP tool
+  arguments, prompt content, MCP working directory, and `PWD` remain ineligible
+  scope inputs. Hosts without Copilot's matching hook/session-ID support,
+  including APM, still require explicit project configuration.
+
+## 0.7.0 — 2026-08-29
+
+- Make plugin-installed MCP safe and configurable in GitHub Copilot: declare
+  `stdio` explicitly and forward the operator-set
+  `CONTEXT_KIT_MEMORY_PROJECT` (or deprecated
+  `PRODUCTIVITY_SKILLS_MEMORY_PROJECT`) into the child process. The server still
+  refuses when no explicit scope is configured; prompt content cannot select
+  another project store.
+- Move MCP proposal-only and absolute-source enforcement into the provider, so
+  quoted frontmatter follows the same parser as CLI capture and policy cannot
+  drift between surfaces. Provider validation now refuses a missing or
+  non-regular evidence source instead of skipping hash verification.
+- Bound incoming JSON-RPC frames before decoding and reconcile the MCP server
+  version in packaging tests.
+- Add MCP tool safety annotations and collapse missing-source versus
+  hash-mismatch failures into one capture refusal, avoiding a path-existence
+  distinction while preserving explicit failure.
+
 ## 0.6.0 — 2026-08-09
 
 - **Package the memory contract, validator, and MCP server as `memorykit`, ready

{memorykit-0.6.0 → memorykit-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: memorykit
-Version: 0.6.0
+Version: 0.8.0
 Summary: Provenance-bound durable memory: an immutable record contract, a validator, append-only review state, and a standard-library stdio MCP server. No Python dependencies; requires git on PATH.
 Project-URL: Homepage, https://github.com/mbeacom/context-kit
 Project-URL: Repository, https://github.com/mbeacom/context-kit
@@ -77,20 +77,16 @@ Installing `memory` also installs `context-handoff`, `verify`, and
 The contract, validator, and MCP server are also packaged as **`memorykit`**, a
 pure-standard-library Python package (ADR-0002, ADR-0009).
 
-> **Not on PyPI yet.** The package is publish-ready but the name has not been
-> claimed, so `pip install memorykit` does **not** currently install this — it
-> will fail, or, if someone else claims the name first, install something else
-> entirely. Until the release workflow runs, install from a clone.
-
 ```bash
-# From a clone of https://github.com/mbeacom/context-kit
-pip install ./plugins/memory      # or: uv tool install ./plugins/memory
+pip install memorykit             # or: uv tool install memorykit
 ```
 
-Once published, that becomes:
+To work from a clone instead — for contributing, or to run an unreleased
+revision:
 
 ```bash
-pip install memorykit             # or: uv tool install memorykit
+# From a clone of https://github.com/mbeacom/context-kit
+pip install ./plugins/memory      # or: uv tool install ./plugins/memory
 ```
 
 Either way that is the whole install: no bootstrap step, no plugin runtime, no
@@ -130,7 +126,8 @@ is the reverse of the `indexkit` launcher's preference, and deliberate.
 
 ## Local-only reviewed records
 
-Python 3 is the only requirement. Configure an explicit project and plugin root:
+Python 3.10+ and Git on `PATH` are required. Configure an explicit project and
+plugin root:
 
 ```bash
 export CONTEXT_KIT_MEMORY_PROJECT=owner/repository
@@ -223,12 +220,13 @@ authoring a `memory-v1` record from a candidate stays an explicit judgment step.
 
 See [`references/session-mining.md`](skills/memory-workflows/references/session-mining.md).
 
-## MCP surface for non-plugin hosts
+## MCP surface
 
 An optional stdio MCP server exposes `memory_recall`, `memory_capture`, and
-`memory_review` so hosts that consume skills plus MCP can use durable memory
-without a plugin runtime. It is standard library only and shells out to the
-same provider, so the CLI and MCP paths cannot drift.
+`memory_review` so hosts that consume skills plus MCP can use durable memory.
+GitHub Copilot and Claude Code plugin installs discover it automatically;
+package-only hosts can launch it directly. It is standard library only and
+shells out to the same provider, so the CLI and MCP paths cannot drift.
 
 ```bash
 # From the plugin:
@@ -239,6 +237,24 @@ CONTEXT_KIT_MEMORY_PROJECT=owner/repository \
 CONTEXT_KIT_MEMORY_PROJECT=owner/repository memorykit-mcp
 ```
 
+The bundled `.mcp.json` forwards explicit project/home configuration into the
+plugin process. GitHub Copilot Desktop can additionally bind the MCP child to
+the active project through trusted host data: `SessionStart` requires payload
+`sessionId` to exactly match `COPILOT_AGENT_SESSION_ID`, then resolves payload
+`cwd` to the Git top-level and accepts only a canonical
+`github.com/owner/repository` origin on POSIX. It stores only that session ID and
+project under the private memory home and removes the binding on `SessionEnd`.
+
+Explicit `--project`, `CONTEXT_KIT_MEMORY_PROJECT`, deprecated
+`PRODUCTIVITY_SKILLS_MEMORY_PROJECT`, and `CLAUDE_PLUGIN_OPTION_PROJECT` take
+precedence, in that order, over the binding. MCP cwd, `PWD`, prompts, and tool
+arguments never select scope. APM, package-only use, and hosts without the
+matching Copilot hook/session ID still require explicit configuration. The same
+is true on Windows and for other Git hosts or deeper repository namespaces,
+whose privacy or identity cannot be represented safely by this automatic path.
+MCP capture records must use an absolute `source` path because plugin hosts may
+launch the server outside the active repository.
+
 The surface can propose memory but **cannot activate it**: a record whose
 frontmatter is not `review: proposed` is refused, and proposals stay out of
 active recall until promoted with the append-only `record-state` CLI.
@@ -248,7 +264,7 @@ See [`references/mcp-server.md`](skills/memory-workflows/references/mcp-server.m
 
 ## Opt-in lifecycle queue
 
-Claude hooks are inert until enabled:
+Recall and payload-queue behavior is inert until enabled:
 
 ```bash
 export CONTEXT_KIT_MEMORY_PROJECT=owner/repository
@@ -260,6 +276,11 @@ memory records or mutate a provider store. Claude Code and GitHub Copilot CLI
 both load `hooks/hooks.json`; APM does not deploy hooks, so capture stays an
 explicit command there.
 
+Copilot's routing-only `SessionStart` binding is the bounded exception: it is
+created even when both switches are off, contains no transcript or secret, and
+is cleaned at `SessionEnd` (not `Stop`/`agentStop`). It is ephemeral routing
+metadata, not automatic memory capture.
+
 ## Components
 
 | Component | Purpose |
@@ -270,7 +291,7 @@ explicit command there.
 | `/review-memory` | Review freshness, conflicts, and consolidation proposals. |
 | `/archive-handoff` | Explicitly preserve a validated handoff as historical memory. |
 | `memory-provider.py` | Launcher for the `memorykit` provider: stdlib validator, local store, MemPalace adapter, and hook dispatcher. |
-| `src/memorykit/` | The packaged engine (`memorykit`, not yet on PyPI): contract, validator, provider, MCP server. |
+| `src/memorykit/` | The packaged `memorykit` engine: contract, validator, provider, MCP server. |
 
 ## Safety boundaries
 

{memorykit-0.6.0 → memorykit-0.8.0}/README.md

@@ -34,20 +34,16 @@ Installing `memory` also installs `context-handoff`, `verify`, and
 The contract, validator, and MCP server are also packaged as **`memorykit`**, a
 pure-standard-library Python package (ADR-0002, ADR-0009).
 
-> **Not on PyPI yet.** The package is publish-ready but the name has not been
-> claimed, so `pip install memorykit` does **not** currently install this — it
-> will fail, or, if someone else claims the name first, install something else
-> entirely. Until the release workflow runs, install from a clone.
-
 ```bash
-# From a clone of https://github.com/mbeacom/context-kit
-pip install ./plugins/memory      # or: uv tool install ./plugins/memory
+pip install memorykit             # or: uv tool install memorykit
 ```
 
-Once published, that becomes:
+To work from a clone instead — for contributing, or to run an unreleased
+revision:
 
 ```bash
-pip install memorykit             # or: uv tool install memorykit
+# From a clone of https://github.com/mbeacom/context-kit
+pip install ./plugins/memory      # or: uv tool install ./plugins/memory
 ```
 
 Either way that is the whole install: no bootstrap step, no plugin runtime, no
@@ -87,7 +83,8 @@ is the reverse of the `indexkit` launcher's preference, and deliberate.
 
 ## Local-only reviewed records
 
-Python 3 is the only requirement. Configure an explicit project and plugin root:
+Python 3.10+ and Git on `PATH` are required. Configure an explicit project and
+plugin root:
 
 ```bash
 export CONTEXT_KIT_MEMORY_PROJECT=owner/repository
@@ -180,12 +177,13 @@ authoring a `memory-v1` record from a candidate stays an explicit judgment step.
 
 See [`references/session-mining.md`](skills/memory-workflows/references/session-mining.md).
 
-## MCP surface for non-plugin hosts
+## MCP surface
 
 An optional stdio MCP server exposes `memory_recall`, `memory_capture`, and
-`memory_review` so hosts that consume skills plus MCP can use durable memory
-without a plugin runtime. It is standard library only and shells out to the
-same provider, so the CLI and MCP paths cannot drift.
+`memory_review` so hosts that consume skills plus MCP can use durable memory.
+GitHub Copilot and Claude Code plugin installs discover it automatically;
+package-only hosts can launch it directly. It is standard library only and
+shells out to the same provider, so the CLI and MCP paths cannot drift.
 
 ```bash
 # From the plugin:
@@ -196,6 +194,24 @@ CONTEXT_KIT_MEMORY_PROJECT=owner/repository \
 CONTEXT_KIT_MEMORY_PROJECT=owner/repository memorykit-mcp
 ```
 
+The bundled `.mcp.json` forwards explicit project/home configuration into the
+plugin process. GitHub Copilot Desktop can additionally bind the MCP child to
+the active project through trusted host data: `SessionStart` requires payload
+`sessionId` to exactly match `COPILOT_AGENT_SESSION_ID`, then resolves payload
+`cwd` to the Git top-level and accepts only a canonical
+`github.com/owner/repository` origin on POSIX. It stores only that session ID and
+project under the private memory home and removes the binding on `SessionEnd`.
+
+Explicit `--project`, `CONTEXT_KIT_MEMORY_PROJECT`, deprecated
+`PRODUCTIVITY_SKILLS_MEMORY_PROJECT`, and `CLAUDE_PLUGIN_OPTION_PROJECT` take
+precedence, in that order, over the binding. MCP cwd, `PWD`, prompts, and tool
+arguments never select scope. APM, package-only use, and hosts without the
+matching Copilot hook/session ID still require explicit configuration. The same
+is true on Windows and for other Git hosts or deeper repository namespaces,
+whose privacy or identity cannot be represented safely by this automatic path.
+MCP capture records must use an absolute `source` path because plugin hosts may
+launch the server outside the active repository.
+
 The surface can propose memory but **cannot activate it**: a record whose
 frontmatter is not `review: proposed` is refused, and proposals stay out of
 active recall until promoted with the append-only `record-state` CLI.
@@ -205,7 +221,7 @@ See [`references/mcp-server.md`](skills/memory-workflows/references/mcp-server.m
 
 ## Opt-in lifecycle queue
 
-Claude hooks are inert until enabled:
+Recall and payload-queue behavior is inert until enabled:
 
 ```bash
 export CONTEXT_KIT_MEMORY_PROJECT=owner/repository
@@ -217,6 +233,11 @@ memory records or mutate a provider store. Claude Code and GitHub Copilot CLI
 both load `hooks/hooks.json`; APM does not deploy hooks, so capture stays an
 explicit command there.
 
+Copilot's routing-only `SessionStart` binding is the bounded exception: it is
+created even when both switches are off, contains no transcript or secret, and
+is cleaned at `SessionEnd` (not `Stop`/`agentStop`). It is ephemeral routing
+metadata, not automatic memory capture.
+
 ## Components
 
 | Component | Purpose |
@@ -227,7 +248,7 @@ explicit command there.
 | `/review-memory` | Review freshness, conflicts, and consolidation proposals. |
 | `/archive-handoff` | Explicitly preserve a validated handoff as historical memory. |
 | `memory-provider.py` | Launcher for the `memorykit` provider: stdlib validator, local store, MemPalace adapter, and hook dispatcher. |
-| `src/memorykit/` | The packaged engine (`memorykit`, not yet on PyPI): contract, validator, provider, MCP server. |
+| `src/memorykit/` | The packaged `memorykit` engine: contract, validator, provider, MCP server. |
 
 ## Safety boundaries
 

{memorykit-0.6.0 → memorykit-0.8.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "memorykit"
-version = "0.6.0"
+version = "0.8.0"
 description = "Provenance-bound durable memory: an immutable record contract, a validator, append-only review state, and a standard-library stdio MCP server. No Python dependencies; requires git on PATH."
 requires-python = ">=3.10"
 keywords = [

{memorykit-0.6.0 → memorykit-0.8.0}/src/memorykit/__init__.py

@@ -19,6 +19,6 @@ Two entry points, one implementation:
 
 from __future__ import annotations
 
-__version__ = "0.6.0"
+__version__ = "0.8.0"
 
 __all__ = ["__version__"]

{memorykit-0.6.0 → memorykit-0.8.0}/src/memorykit/mcp.py

@@ -26,7 +26,7 @@ from pathlib import Path
 from typing import Any
 
 SERVER_NAME = "context-kit-memory"
-SERVER_VERSION = "0.3.0"
+SERVER_VERSION = "0.8.0"
 # Newest first. The client's requested version is echoed when supported.
 SUPPORTED_PROTOCOLS = ("2025-06-18", "2025-03-26", "2024-11-05")
 # The provider is this package's sibling module, so one path is correct in both
@@ -38,6 +38,11 @@ SUPPORTED_PROTOCOLS = ("2025-06-18", "2025-03-26", "2024-11-05")
 PROVIDER = Path(__file__).resolve().with_name("provider.py")
 CALL_TIMEOUT_SECONDS = 120.0
 MAX_RECORD_BYTES = 32 * 1024
+MAX_FRAME_CHARS = MAX_RECORD_BYTES * 8
+EVIDENCE_ERROR_MARKERS = (
+    "referenced source is not a readable file",
+    "source_hash does not match the referenced source file",
+)
 
 PARSE_ERROR = -32700
 INVALID_REQUEST = -32600
@@ -70,14 +75,15 @@ TOOLS: list[dict[str, Any]] = [
             "required": ["query"],
             "additionalProperties": False,
         },
+        "annotations": {"readOnlyHint": True, "openWorldHint": False},
     },
     {
         "name": "memory_capture",
         "description": (
             "Persist a context-kit/memory-v1 record as review: proposed. The "
-            "record must cite real evidence: its source_hash is verified "
-            "against the source file. Proposed records are inert until a human "
-            "accepts them with the record-state CLI."
+            "record must cite real evidence at an absolute source path: its "
+            "source_hash is verified against the source file. Proposed records "
+            "are inert until a human accepts them with the record-state CLI."
         ),
         "inputSchema": {
             "type": "object",
@@ -94,6 +100,12 @@ TOOLS: list[dict[str, Any]] = [
             "required": ["record"],
             "additionalProperties": False,
         },
+        "annotations": {
+            "readOnlyHint": False,
+            "destructiveHint": False,
+            "idempotentHint": True,
+            "openWorldHint": False,
+        },
     },
     {
         "name": "memory_review",
@@ -106,6 +118,7 @@ TOOLS: list[dict[str, Any]] = [
             "properties": {},
             "additionalProperties": False,
         },
+        "annotations": {"readOnlyHint": True, "openWorldHint": False},
     },
 ]
 
@@ -119,26 +132,10 @@ def _log(message: str) -> None:
     print(f"{SERVER_NAME}: {message}", file=sys.stderr, flush=True)
 
 
-def _project_scope() -> str:
-    for name in ("CONTEXT_KIT_MEMORY_PROJECT", "CLAUDE_PLUGIN_OPTION_PROJECT"):
-        # Portable first, then the Claude userConfig fallback the CLI accepts.
-        # Checking only the portable name would make every tool refuse on a
-        # normal Claude install configured through the plugin's option.
-        project = os.environ.get(name, "").strip()
-        if project:
-            return project
-    raise ToolError(
-        "no memory project is configured; set CONTEXT_KIT_MEMORY_PROJECT to "
-        "an explicit owner/repository. Memory is never read from or written "
-        "to an inferred global store."
-    )
-
-
-def _run_provider(argv: list[str]) -> str:
+def _run_provider(argv: list[str], *, redact_evidence_errors: bool = False) -> str:
     if not PROVIDER.is_file():
         raise ToolError(f"memory provider script is missing: {PROVIDER}")
-    project = _project_scope()
-    command = [sys.executable, str(PROVIDER), *argv, "--project", project]
+    command = [sys.executable, str(PROVIDER), *argv]
     try:
         result = subprocess.run(
             command,
@@ -154,23 +151,14 @@ def _run_provider(argv: list[str]) -> str:
         raise ToolError(f"memory command could not run: {exc}") from exc
     if result.returncode != 0:
         detail = result.stderr.decode("utf-8", errors="replace").strip()
+        if redact_evidence_errors and any(
+            marker in detail for marker in EVIDENCE_ERROR_MARKERS
+        ):
+            detail = "memory capture refused: cited source evidence did not validate"
         raise ToolError(detail or f"memory command exited {result.returncode}")
     return result.stdout.decode("utf-8", errors="replace").strip()
 
 
-def _frontmatter_value(record: str, field: str) -> str | None:
-    lines = record.splitlines()
-    if not lines or lines[0].strip() != "---":
-        return None
-    for line in lines[1:]:
-        if line.strip() == "---":
-            break
-        key, separator, value = line.partition(":")
-        if separator and key.strip() == field:
-            return value.strip()
-    return None
-
-
 def _tool_memory_recall(arguments: dict[str, Any]) -> str:
     query = arguments.get("query")
     if not isinstance(query, str) or not query.strip():
@@ -192,38 +180,21 @@ def _tool_memory_capture(arguments: dict[str, Any]) -> str:
         raise ToolError(
             f"record exceeds {MAX_RECORD_BYTES} bytes; keep a memory atomic"
         )
-    review = _frontmatter_value(record, "review")
-    if review is None:
-        raise ToolError("record is missing flat YAML frontmatter with a `review` field")
-    if review != "proposed":
-        # `capture` takes the initial state from frontmatter, so without this
-        # guard an agent could write `review: accepted` and activate a memory
-        # with no human review at all.
-        raise ToolError(
-            "this surface can only propose memory, but the record declares "
-            f"review: {review}. Set `review: proposed` and promote it later "
-            "with `memory-provider.py record-state <id> --review accepted "
-            "--reason ...` after the evidence has been checked."
-        )
-    # `validate_memory` verifies `source_hash` only when the source is a
-    # *regular file* (`source.is_file()`), so `exists()` here would be a weaker
-    # gate than the one it exists to mirror: a record citing a directory would
-    # pass this check, skip hash verification entirely, and persist with any
-    # 64-character hash and unverifiable provenance. Match the provider.
-    source = _frontmatter_value(record, "source")
-    if not source:
-        raise ToolError("record is missing a `source` field citing its evidence")
-    if not Path(source).expanduser().is_file():
-        raise ToolError(
-            f"the cited source is not a readable file: {source}. A memory must "
-            "point at evidence that can be re-read and hashed."
-        )
     handle, temporary = tempfile.mkstemp(prefix="memory-capture-", suffix=".md")
     path = Path(temporary)
     try:
         with os.fdopen(handle, "wb") as stream:
             stream.write(raw)
-        return _run_provider(["capture", str(path)])
+        return _run_provider(
+            [
+                "capture",
+                str(path),
+                "--require-review",
+                "proposed",
+                "--require-absolute-source",
+            ],
+            redact_evidence_errors=True,
+        )
     finally:
         path.unlink(missing_ok=True)
 
@@ -326,7 +297,22 @@ def _write(sink: Any, payload: dict[str, Any]) -> None:
 def serve(stdin: Any = None, stdout: Any = None) -> int:
     source = stdin if stdin is not None else sys.stdin
     sink = stdout if stdout is not None else sys.stdout
-    for line in source:
+    while True:
+        line = source.readline(MAX_FRAME_CHARS + 1)
+        if not line:
+            break
+        if len(line) > MAX_FRAME_CHARS:
+            while line and not line.endswith("\n"):
+                line = source.readline(MAX_FRAME_CHARS + 1)
+            _write(
+                sink,
+                _error(
+                    None,
+                    INVALID_REQUEST,
+                    f"JSON-RPC frame exceeds {MAX_FRAME_CHARS} characters",
+                ),
+            )
+            continue
         line = line.strip()
         if not line:
             continue

{memorykit-0.6.0 → memorykit-0.8.0}/src/memorykit/provider.py

@@ -17,6 +17,7 @@ import json
 import os
 import re
 import shutil
+import stat
 import subprocess
 import sys
 import tempfile
@@ -25,6 +26,7 @@ import uuid
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path
+from urllib.parse import urlsplit
 
 SCHEMA = "context-kit/memory-v1"
 MAX_BYTES = 32 * 1024
@@ -54,9 +56,13 @@ WAKE_SCHEMA = "context-kit/memory-wake-v1"
 # Session mining recognizes GitHub Copilot CLI event logs
 # (`~/.copilot/session-state/<session-id>/events.jsonl`).
 SESSION_PRODUCER = "github-copilot-cli"
-# `session_id` arrives from the session log and is used to name a candidate
-# file, so it is validated as a single safe path component before use.
+# Session identifiers arrive from Copilot logs and lifecycle payloads and are
+# used in filenames, so they must remain one bounded path component.
 SESSION_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$")
+COPILOT_SESSION_ID_ENV = "COPILOT_AGENT_SESSION_ID"
+SESSION_BINDING_DIRNAME = "session-bindings"
+SESSION_BINDING_MAX_BYTES = 512
+SESSION_BINDING_KEYS = frozenset({"session_id", "project"})
 MAX_TURN_CHARS = 2000
 MAX_CANDIDATE_TURNS = 400
 # A wake digest primes a session, so it competes with real work for context.
@@ -437,11 +443,12 @@ def _indexkit_home() -> Path:
     return default_root / "indexkit"
 
 
-def _config(args: argparse.Namespace) -> Config:
+def _config(args: argparse.Namespace, *, allow_session_binding: bool = True) -> Config:
     provider = (
         getattr(args, "provider", None)
         or _first_env(
             "CONTEXT_KIT_MEMORY_PROVIDER",
+            "PRODUCTIVITY_SKILLS_MEMORY_PROVIDER",
             "CLAUDE_PLUGIN_OPTION_PROVIDER",
         )
         or "none"
@@ -453,6 +460,7 @@ def _config(args: argparse.Namespace) -> Config:
         getattr(args, "home", None)
         or _first_env(
             "CONTEXT_KIT_MEMORY_HOME",
+            "PRODUCTIVITY_SKILLS_MEMORY_HOME",
             "CLAUDE_PLUGIN_OPTION_MEMORY_HOME",
         )
         or "~/.local/share/context-kit/memory"
@@ -460,14 +468,19 @@ def _config(args: argparse.Namespace) -> Config:
     home = Path(home_value).expanduser().resolve()
     project = getattr(args, "project", None) or _first_env(
         "CONTEXT_KIT_MEMORY_PROJECT",
+        "PRODUCTIVITY_SKILLS_MEMORY_PROJECT",
         "CLAUDE_PLUGIN_OPTION_PROJECT",
     )
+    if not project and allow_session_binding:
+        project = _copilot_session_binding_project(home)
     auto_value = _first_env(
         "CONTEXT_KIT_MEMORY_AUTO_CAPTURE",
+        "PRODUCTIVITY_SKILLS_MEMORY_AUTO_CAPTURE",
         "CLAUDE_PLUGIN_OPTION_AUTO_CAPTURE",
     )
     recall_value = _first_env(
         "CONTEXT_KIT_MEMORY_RECALL_ON_START",
+        "PRODUCTIVITY_SKILLS_MEMORY_RECALL_ON_START",
         "CLAUDE_PLUGIN_OPTION_RECALL_ON_START",
     )
     return Config(
@@ -611,7 +624,13 @@ def _read_bounded(
     return raw, text
 
 
-def validate_memory(path: Path, *, verify_source: bool = True) -> dict[str, object]:
+def validate_memory(
+    path: Path,
+    *,
+    verify_source: bool = True,
+    require_review: str | None = None,
+    require_absolute_source: bool = False,
+) -> dict[str, object]:
     raw, text = _read_bounded(path)
     fields, body = _parse_frontmatter(text)
     missing = [field for field in REQUIRED_FIELDS if field not in fields]
@@ -633,6 +652,11 @@ def validate_memory(path: Path, *, verify_source: bool = True) -> dict[str, obje
         raise Refusal(f"freshness must be one of {sorted(FRESHNESS_STATES)}")
     if fields["review"] not in REVIEW_STATES:
         raise Refusal(f"review must be one of {sorted(REVIEW_STATES)}")
+    if require_review is not None and fields["review"] != require_review:
+        raise Refusal(
+            f"memory review must be {require_review!r} for this operation; "
+            f"got {fields['review']!r}"
+        )
     if not HASH_RE.fullmatch(fields["source_hash"]):
         raise Refusal("source_hash must be a lowercase SHA-256 digest")
     _validate_timestamp(fields["observed_at"], "observed_at")
@@ -666,8 +690,18 @@ def validate_memory(path: Path, *, verify_source: bool = True) -> dict[str, obje
     _nonempty_section(sections["## Review Notes"], "Review Notes")
 
     source = Path(fields["source"]).expanduser()
-    if verify_source and source.is_file():
-        actual = hashlib.sha256(source.read_bytes()).hexdigest()
+    if require_absolute_source and not source.is_absolute():
+        raise Refusal("memory source must be an absolute path for this operation")
+    if verify_source:
+        if not source.is_file():
+            raise Refusal(f"referenced source is not a readable file: {source}")
+        try:
+            source_bytes = source.read_bytes()
+        except OSError as exc:
+            raise Refusal(
+                f"referenced source is not a readable file: {source}"
+            ) from exc
+        actual = hashlib.sha256(source_bytes).hexdigest()
         if actual != fields["source_hash"]:
             raise Refusal("source_hash does not match the referenced source file")
     return {
@@ -746,6 +780,288 @@ def _normalize_repository(remote: str) -> str:
     return "/".join(parts[-2:])
 
 
+def _normalize_copilot_origin(remote: str) -> str:
+    """Return an unambiguous project identity for automatic Copilot binding.
+
+    The memory contract represents repositories as `owner/name`, so automatic
+    detection cannot safely collapse a different host or a deeper namespace
+    onto that shape. Those repositories remain available through explicit
+    project configuration.
+    """
+    value = remote.strip()
+    host = ""
+    path = ""
+    if value.startswith("git@") and ":" in value:
+        authority, path = value.split(":", 1)
+        host = authority.rsplit("@", 1)[-1]
+    elif "://" in value:
+        parsed = urlsplit(value)
+        host = parsed.hostname or ""
+        path = parsed.path
+        if parsed.query or parsed.fragment:
+            raise Refusal(
+                "automatic Copilot project detection refuses origin queries "
+                "and fragments"
+            )
+    else:
+        raise Refusal(
+            "automatic Copilot project detection requires a canonical GitHub origin"
+        )
+    if host.lower() != "github.com":
+        raise Refusal(
+            "automatic Copilot project detection requires a github.com origin"
+        )
+    parts = [part for part in path.strip("/").split("/") if part]
+    if parts and parts[-1].endswith(".git"):
+        parts[-1] = parts[-1][:-4]
+    if len(parts) != 2 or not all(parts):
+        raise Refusal(
+            "automatic Copilot project detection requires exactly owner/repository"
+        )
+    project = _normalize_repository(value)
+    if project != "/".join(parts) or not REPOSITORY_RE.fullmatch(project):
+        raise Refusal("repository origin is not a concrete owner/name identity")
+    return project
+
+
+def _validate_session_id(value: object) -> str:
+    if not isinstance(value, str) or not SESSION_ID_RE.fullmatch(value):
+        raise Refusal("Copilot session id is not a safe path component")
+    return value
+
+
+def _copilot_session_id() -> str | None:
+    value = os.environ.get(COPILOT_SESSION_ID_ENV)
+    if not value:
+        return None
+    return _validate_session_id(value)
+
+
+def _private_session_bindings_supported() -> bool:
+    return os.name == "posix"
+
+
+def _session_binding_directory(home: Path, *, create: bool) -> Path | None:
+    if not _private_session_bindings_supported():
+        raise Refusal(
+            "automatic Copilot project detection requires verifiable POSIX "
+            "owner-only permissions; set CONTEXT_KIT_MEMORY_PROJECT explicitly"
+        )
+    directory = home / SESSION_BINDING_DIRNAME
+    if create:
+        home.mkdir(parents=True, exist_ok=True)
+        try:
+            os.mkdir(directory, 0o700)
+        except FileExistsError:
+            pass
+    try:
+        metadata = directory.lstat()
+    except FileNotFoundError:
+        return None
+    if not stat.S_ISDIR(metadata.st_mode):
+        raise Refusal(f"session binding root is not a real directory: {directory}")
+    if os.name == "posix":
+        if metadata.st_uid != os.getuid():
+            raise Refusal(f"session binding root is owned by another user: {directory}")
+        if stat.S_IMODE(metadata.st_mode) & 0o077:
+            raise Refusal(f"session binding root permissions must be 0700: {directory}")
+    return directory
+
+
+def _session_binding_path(
+    home: Path, session_id: str, *, create_directory: bool
+) -> Path | None:
+    safe_id = _validate_session_id(session_id)
+    directory = _session_binding_directory(home, create=create_directory)
+    if directory is None:
+        return None
+    return directory / f"{safe_id}.json"
+
+
+def _load_session_binding(home: Path, session_id: str) -> dict[str, object] | None:
+    path = _session_binding_path(home, session_id, create_directory=False)
+    if path is None:
+        return None
+    flags = os.O_RDONLY
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    try:
+        descriptor = os.open(path, flags)
+    except FileNotFoundError:
+        return None
+    except OSError as exc:
+        raise Refusal(f"cannot safely open Copilot session binding: {path}") from exc
+    try:
+        metadata = os.fstat(descriptor)
+        if not stat.S_ISREG(metadata.st_mode):
+            raise Refusal(f"Copilot session binding is not a regular file: {path}")
+        if os.name == "posix":
+            if metadata.st_uid != os.getuid():
+                raise Refusal(
+                    f"Copilot session binding is owned by another user: {path}"
+                )
+            if stat.S_IMODE(metadata.st_mode) & 0o077:
+                raise Refusal(
+                    f"Copilot session binding permissions must be 0600: {path}"
+                )
+        if metadata.st_size > SESSION_BINDING_MAX_BYTES:
+            raise Refusal(f"Copilot session binding is unexpectedly large: {path}")
+        with os.fdopen(descriptor, "rb") as stream:
+            descriptor = -1
+            raw = stream.read(SESSION_BINDING_MAX_BYTES + 1)
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
+    if len(raw) > SESSION_BINDING_MAX_BYTES:
+        raise Refusal(f"Copilot session binding is unexpectedly large: {path}")
+    try:
+        payload = json.loads(raw)
+    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise Refusal(f"Copilot session binding is invalid JSON: {path}") from exc
+    if not isinstance(payload, dict) or set(payload) != SESSION_BINDING_KEYS:
+        raise Refusal(f"Copilot session binding has unexpected fields: {path}")
+    if payload.get("session_id") != session_id:
+        raise Refusal(f"Copilot session binding id does not match its filename: {path}")
+    return payload
+
+
+def _read_session_binding(home: Path, session_id: str) -> str | None:
+    payload = _load_session_binding(home, session_id)
+    if payload is None:
+        return None
+    path = _session_binding_path(home, session_id, create_directory=False)
+    assert path is not None
+    project = payload.get("project")
+    if not isinstance(project, str) or not REPOSITORY_RE.fullmatch(project):
+        raise Refusal(f"Copilot session binding has an invalid project: {path}")
+    return project
+
+
+def _session_binding_bytes(session_id: str, project: str) -> bytes:
+    raw = (
+        json.dumps(
+            {"session_id": session_id, "project": project},
+            sort_keys=True,
+            separators=(",", ":"),
+        )
+        + "\n"
+    ).encode("utf-8")
+    if len(raw) > SESSION_BINDING_MAX_BYTES:
+        raise Refusal("Copilot session binding exceeds its size limit")
+    return raw
+
+
+def _replace_session_binding(path: Path, *, session_id: str, project: str) -> None:
+    raw = _session_binding_bytes(session_id, project)
+    with tempfile.NamedTemporaryFile(
+        dir=path.parent,
+        prefix=f".{path.name}.",
+        delete=False,
+    ) as handle:
+        handle.write(raw)
+        handle.flush()
+        os.fsync(handle.fileno())
+        temporary = Path(handle.name)
+    os.chmod(temporary, 0o600)
+    try:
+        os.replace(temporary, path)
+    finally:
+        temporary.unlink(missing_ok=True)
+
+
+def _write_session_binding(home: Path, session_id: str, project: str) -> str:
+    if not REPOSITORY_RE.fullmatch(project):
+        raise Refusal("memory project must be a concrete owner/name identity")
+    path = _session_binding_path(home, session_id, create_directory=True)
+    assert path is not None
+    raw = _session_binding_bytes(session_id, project)
+    with tempfile.NamedTemporaryFile(
+        dir=path.parent,
+        prefix=f".{path.name}.",
+        delete=False,
+    ) as handle:
+        handle.write(raw)
+        handle.flush()
+        os.fsync(handle.fileno())
+        temporary = Path(handle.name)
+    os.chmod(temporary, 0o600)
+    try:
+        try:
+            os.link(temporary, path, follow_symlinks=False)
+        except FileExistsError:
+            existing_payload = _load_session_binding(home, session_id)
+            assert existing_payload is not None
+            existing = existing_payload.get("project")
+            if existing == project:
+                return "unchanged"
+            if not isinstance(existing, str) or not REPOSITORY_RE.fullmatch(existing):
+                raise Refusal("Copilot session binding is already conflicted")
+            # A conflicting SessionStart must not leave the old project
+            # addressable through the same session id. Keep only the two-field
+            # minimum payload, but make the project deliberately invalid so all
+            # later resolution fails closed until matching SessionEnd cleanup.
+            _replace_session_binding(path, session_id=session_id, project="")
+            raise Refusal(
+                "refusing to reuse a Copilot session binding for another project"
+            ) from None
+    finally:
+        temporary.unlink(missing_ok=True)
+    return "created"
+
+
+def _remove_session_binding(home: Path, session_id: str) -> bool:
+    path = _session_binding_path(home, session_id, create_directory=False)
+    if path is None:
+        return False
+    if _load_session_binding(home, session_id) is None:
+        return False
+    path.unlink()
+    return True
+
+
+def _copilot_session_binding_project(home: Path) -> str | None:
+    session_id = _copilot_session_id()
+    if session_id is None:
+        return None
+    return _read_session_binding(home, session_id)
+
+
+def _decode_hook_payload(payload: bytes) -> dict[str, object]:
+    try:
+        decoded = json.loads(payload)
+    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise Refusal(f"hook payload must be valid JSON: {exc}") from exc
+    if not isinstance(decoded, dict):
+        raise Refusal("hook payload must be a JSON object")
+    return decoded
+
+
+def _matching_copilot_payload_session(
+    payload: dict[str, object],
+) -> str | None:
+    session_id = _copilot_session_id()
+    if session_id is None:
+        return None
+    payload_session_id = _validate_session_id(payload.get("sessionId"))
+    if payload_session_id != session_id:
+        raise Refusal("Copilot environment and hook payload session ids do not match")
+    return session_id
+
+
+def _project_from_session_start(payload: dict[str, object]) -> str:
+    cwd = payload.get("cwd")
+    if not isinstance(cwd, str) or not cwd or not Path(cwd).is_absolute():
+        raise Refusal("Copilot SessionStart cwd must be an absolute path")
+    repository = Path(cwd).resolve(strict=True)
+    if not repository.is_dir():
+        raise Refusal("Copilot SessionStart cwd must be a directory")
+    top_level = Path(_git(repository, "rev-parse", "--show-toplevel"))
+    if not top_level.is_absolute():
+        raise Refusal("git returned a non-absolute repository top-level")
+    root = top_level.resolve(strict=True)
+    return _normalize_copilot_origin(_git(root, "remote", "get-url", "origin"))
+
+
 def _assert_project_matches(metadata: dict[str, object], config: Config) -> None:
     project = config.project
     if not project:
@@ -1407,7 +1723,11 @@ def _provider_version(config: Config) -> tuple[str, str]:
 
 def _capture_memory(args: argparse.Namespace, config: Config) -> int:
     source = Path(args.artifact).expanduser().resolve()
-    metadata = validate_memory(source)
+    metadata = validate_memory(
+        source,
+        require_review=args.require_review,
+        require_absolute_source=args.require_absolute_source,
+    )
     _assert_project_matches(metadata, config)
     raw = source.read_bytes()
     destination = config.records_path / f"{metadata['id']}.md"
@@ -2709,32 +3029,86 @@ def _hook_recall(config: Config) -> int:
     return 0
 
 
+def _hook_session_start(config: Config, payload: bytes) -> int:
+    effective = config
+    try:
+        decoded = _decode_hook_payload(payload)
+        session_id = _matching_copilot_payload_session(decoded)
+        if session_id is not None:
+            project = _project_from_session_start(decoded)
+            _write_session_binding(config.home, session_id, project)
+            if not config.project:
+                effective = Config(
+                    provider=config.provider,
+                    home=config.home,
+                    project=project,
+                    auto_capture=config.auto_capture,
+                    recall_on_start=config.recall_on_start,
+                )
+    except (OSError, Refusal) as exc:
+        # Routing metadata must fail closed without breaking session startup.
+        print(f"memory session binding skipped: {exc}", file=sys.stderr)
+    return _hook_recall(effective)
+
+
 def _run_hook(event: str, config: Config, payload: bytes) -> int:
     if event == "session-start":
-        return _hook_recall(config)
-    if not config.auto_capture:
-        print("{}")
-        return 0
+        return _hook_session_start(config, payload)
+
+    decoded: dict[str, object] | None = None
+    cleanup_session_id: str | None = None
+    effective = config
+    if event == "session-end" and os.environ.get(COPILOT_SESSION_ID_ENV):
+        try:
+            decoded = _decode_hook_payload(payload)
+            cleanup_session_id = _matching_copilot_payload_session(decoded)
+        except (OSError, Refusal) as exc:
+            print(f"memory session binding cleanup skipped: {exc}", file=sys.stderr)
+            cleanup_session_id = None
+        if cleanup_session_id is not None and not config.project:
+            try:
+                bound_project = _read_session_binding(config.home, cleanup_session_id)
+                if bound_project:
+                    effective = Config(
+                        provider=config.provider,
+                        home=config.home,
+                        project=bound_project,
+                        auto_capture=config.auto_capture,
+                        recall_on_start=config.recall_on_start,
+                    )
+            except (OSError, Refusal):
+                # Cleanup below still removes a private conflicted binding, but
+                # no memory operation may resolve through it.
+                pass
+
+    response: dict[str, object] = {}
     try:
-        decoded = json.loads(payload)
-    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise Refusal(f"hook payload must be valid JSON: {exc}") from exc
-    if not isinstance(decoded, dict):
-        raise Refusal("hook payload must be a JSON object")
-    pending_dir = config.home / "pending-hooks" / config.project_slug
-    pending = _new_write_once_path(pending_dir, f"-{event}.json")
-    if _write_once(pending, payload) != "created":
-        raise Refusal(f"refusing to reuse a generated hook payload path: {pending}")
-    print(
-        json.dumps(
-            {
+        if effective.auto_capture:
+            if decoded is None:
+                decoded = _decode_hook_payload(payload)
+            pending_dir = effective.home / "pending-hooks" / effective.project_slug
+            pending = _new_write_once_path(pending_dir, f"-{event}.json")
+            if _write_once(pending, payload) != "created":
+                raise Refusal(
+                    f"refusing to reuse a generated hook payload path: {pending}"
+                )
+            response = {
                 "status": "queued-for-review",
                 "event": event,
                 "pending": str(pending),
                 "provider_invoked": False,
             }
-        )
-    )
+    finally:
+        if cleanup_session_id is not None:
+            try:
+                _remove_session_binding(effective.home, cleanup_session_id)
+            except (OSError, Refusal) as exc:
+                # An unsafe or changed binding is left untouched for inspection.
+                print(
+                    f"memory session binding cleanup skipped: {exc}",
+                    file=sys.stderr,
+                )
+    print(json.dumps(response))
     return 0
 
 
@@ -2761,6 +3135,8 @@ def _parser() -> argparse.ArgumentParser:
     capture = sub.add_parser("capture")
     capture.add_argument("artifact")
     capture.add_argument("--local-only", action="store_true")
+    capture.add_argument("--require-review", choices=sorted(REVIEW_STATES))
+    capture.add_argument("--require-absolute-source", action="store_true")
     _add_config_args(capture)
 
     archive = sub.add_parser("archive-handoff")
@@ -2870,7 +3246,10 @@ def main(argv: list[str] | None = None) -> int:
             print(json.dumps({"status": "valid", "id": metadata["id"]}))
             return 0
 
-        config = _config(args)
+        allow_session_binding = not (
+            args.command == "hook" and args.event in {"session-start", "session-end"}
+        )
+        config = _config(args, allow_session_binding=allow_session_binding)
         if args.command == "capture":
             return _capture_memory(args, config)
         if args.command == "archive-handoff":