omind 10.3.4__tar.gz

omind-10.3.4/.githooks/commit-msg

@@ -0,0 +1,9 @@
+#!/bin/sh
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Aaron K. Clark
+#
+# Reject a commit that declares no authorship. Enable with:
+#     git config core.hooksPath .githooks
+set -eu
+root=$(git rev-parse --show-toplevel)
+exec "$root/scripts/check-attribution.sh" --message-file "$1"

omind-10.3.4/.github/codeql/codeql-config.yml

@@ -0,0 +1,9 @@
+name: "omind CodeQL config"
+
+# SAST targets the shipped package only. Test files contain deliberate edge-case
+# patterns that generate noise; analyzing src/ keeps findings actionable.
+paths:
+  - src
+
+paths-ignore:
+  - tests

omind-10.3.4/.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  # Python dependencies (pyproject.toml). omind's CI installs with pip.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      python-deps:
+        patterns: ["*"]
+
+  # Keep the SHA-pinned GitHub Actions current.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns: ["*"]

omind-10.3.4/.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+# Semantic static analysis (SAST) for the Python source. Runs on pushes/PRs to
+# main and weekly, so new code paths and newly-disclosed query packs are caught.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"   # Mondays 06:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (python)
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          languages: python
+          queries: security-and-quality
+          config-file: ./.github/codeql/codeql-config.yml
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          category: "/language:python"

omind-10.3.4/.github/workflows/publish.yml

@@ -0,0 +1,80 @@
+name: publish
+# Uploads omind to PyPI on every published GitHub release (#267).
+#
+# Auth: a PyPI API token stored as the `PYPI_API_TOKEN` secret of the `pypi`
+# environment (Settings -> Environments -> pypi). Only the publish job runs in
+# that environment, so only it can read the token. Rotate the token on pypi.org
+# and re-set the secret; nothing else references it.
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Build and verify only; do not upload
+        type: boolean
+        default: true
+
+# Least privilege: read-only everywhere; the token is scoped to the `pypi`
+# environment, which only the publish job enters.
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build sdist + wheel
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: '3.12'
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+      - name: A release tag must match the packaged version
+        if: github.event_name == 'release'
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          version="$(python - <<'PY'
+          import tomllib
+          print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])
+          PY
+          )"
+          if [ "v$version" != "$TAG" ]; then
+            echo "::error::release tag $TAG does not match pyproject version $version"
+            exit 1
+          fi
+      # uv build: the same command test.yml's wheel job runs on every PR, so
+      # the build path that publishes is the one CI exercises.
+      - run: uv build
+      - name: Metadata renders on PyPI
+        run: uvx twine check --strict dist/*
+      - name: Hand the artifacts to the publish job
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    name: Upload to PyPI
+    needs: build
+    if: github.event_name == 'release' || inputs.dry_run == false
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/omind/
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          # Attestations need trusted publishing (OIDC); token uploads skip them.
+          attestations: false

omind-10.3.4/.github/workflows/test.yml

@@ -0,0 +1,246 @@
+name: ci
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+# Least privilege: jobs only read the repo.
+permissions:
+  contents: read
+
+# Cancel superseded runs on the same ref.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        # Windows and macOS are supported deploy platforms (filelock shim /
+        # .cmd-shim resolution on Windows; BSD userland, case-insensitive FS and
+        # the ~/.local/bin PATH behavior on macOS). Exercise the oldest and
+        # newest Python on each so platform-specific breakage can't ship green.
+        include:
+          - os: windows-latest
+            python-version: "3.10"
+          - os: windows-latest
+            python-version: "3.14"
+          - os: macos-latest
+            python-version: "3.10"
+          - os: macos-latest
+            python-version: "3.14"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      # setuptools too: the windows-latest Python 3.10 toolcache bundles a
+      # vulnerable 65.5.0 that pip-audit (rightly) flags.
+      - run: python -m pip install -U pip setuptools
+      - run: pip install -e .[dev]
+      - run: ruff check .
+      - run: mypy src
+      # filelock is not an omind dependency — pip-audit pulls it for its own
+      # cachecontrol filecache. Its fix (4.2.1) requires Python >=3.11, so the
+      # 3.10 matrix legs can never install a fixed version; ignore the six
+      # CVEs rather than pretend the 3.10 legs can be green. pip-audit 2.10
+      # has no package-level skip, hence the explicit IDs.
+      - run: >-
+          pip-audit
+          --ignore-vuln CVE-2026-112906 --ignore-vuln CVE-2026-112907
+          --ignore-vuln CVE-2026-112913 --ignore-vuln CVE-2026-112914
+          --ignore-vuln CVE-2026-112937 --ignore-vuln CVE-2026-112940
+      - run: pytest -v --cov=omind --cov-report=term-missing
+
+  wheel:
+    # CI otherwise only installs editable (`pip install -e`), so hatchling's
+    # wheel file-selection is never exercised — a change that drops the hook
+    # .sh/.js scripts or the web/static assets from the package would ship green
+    # and crash `importlib.resources` on installed nodes. Build the real wheel,
+    # install it non-editable, and assert the packaged data files are present.
+    name: Wheel build + install smoke test
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: '3.12'
+      # Same build path as publish.yml, so every PR exercises what gets uploaded.
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+      - name: Build the wheel
+        run: uv build --wheel
+      - name: Install the built wheel (not editable)
+        run: pip install dist/*.whl
+      - name: Smoke test the CLI and the packaged data files
+        run: |
+          omind --version
+          python - <<'PY'
+          from importlib.resources import files
+
+          root = files("omind")
+
+          def res(*parts):
+              p = root
+              for part in parts:
+                  p = p / part
+              return p
+
+          required = [
+              ("omi-guard.sh",),
+              ("omi-guard-hermes.sh",),
+              ("omi-gate-reset.sh",),
+              ("secret-output-guard.sh",),
+              ("git-fresh-base.sh",),
+              ("fleet-sudo.sh",),
+              ("omi-guard.opencode.js",),
+              ("_omi_enforce.py",),
+              ("web", "static", "app.js"),
+              ("web", "static", "graph.js"),
+          ]
+          missing = ["/".join(parts) for parts in required if not res(*parts).is_file()]
+          fonts = [f for f in res("web", "static", "vendor", "fonts").iterdir()]
+          assert not missing, f"wheel is missing packaged data files: {missing}"
+          assert fonts, "wheel is missing web/static/vendor/fonts"
+          print(f"OK: {len(required)} data files + {len(fonts)} fonts present in the wheel")
+          PY
+
+  upgrade:
+    # Every PR proves that people can still UPGRADE, against a real uv on a real
+    # filesystem, on every OS omind is installed on. The unit tests mock uv, and
+    # the failure this guards (#375) does not exist in a mock: `uv tool install
+    # --force` deletes the environment before it builds the new one, and on
+    # Windows cannot delete the python.exe that `omind self-update` runs from —
+    # 9.4.0 -> 9.7.5 left a machine with no omind at all.
+    #
+    # Path walked: install an OLD release the way a user did -> upgrade it to this
+    # checkout -> run this checkout's `omind self-update` -> re-run the installer
+    # over the result. The invariant after EVERY step: omind still starts.
+    name: Upgrade from ${{ matrix.from }} (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        # A pinned old release (the one #375 started from) and whatever is the
+        # newest tag today, so the baseline moves forward with every release.
+        from: [v9.4.0, latest]
+    defaults:
+      run:
+        shell: bash
+    env:
+      # The heal re-provisions ~/.claude and needs the claude CLI; not under test.
+      OMIND_NO_AUTOHEAL: '1'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: '3.12'
+      - run: python -m pip install -U pip uv
+      - name: Install the old release with bootstrap.sh, on a clean machine
+        run: |
+          bin="$(uv tool dir --bin)"
+          echo "$bin" >> "$GITHUB_PATH"
+          # Git Bash splits PATH on ':', so C:\... must become /c/... for this step.
+          if command -v cygpath >/dev/null 2>&1; then bin="$(cygpath -u "$bin")"; fi
+          export PATH="$bin:$PATH"
+          ref=()
+          [ "${{ matrix.from }}" = "latest" ] || ref=(--ref "${{ matrix.from }}")
+          # Exits 1 only because the runner has no `claude` CLI to set up.
+          scripts/bootstrap.sh --no-setup "${ref[@]}" || true
+          omind --version
+      - name: Upgrade it to this checkout
+        run: |
+          uv tool install --force --from . omind
+          want="$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)"
+          omind --version | tee version.txt
+          grep -qF "$want" version.txt
+      - name: omind self-update, for real
+        run: |
+          set +e
+          omind self-update --force 2>&1 | tee update.log
+          code=${PIPESTATUS[0]}
+          set -e
+          if grep -q "could not reach GitHub" update.log; then
+            echo "::warning::GitHub API unreachable/rate-limited from this runner; self-update not exercised"
+          elif [ "$RUNNER_OS" = "Windows" ]; then
+            # In-place replacement cannot work on Windows: it must refuse, not try.
+            [ "$code" -eq 1 ] && grep -q "refusing to update" update.log
+          else
+            [ "$code" -eq 0 ] && grep -q "updated to" update.log
+          fi
+      - name: Whatever self-update decided, omind still starts
+        run: omind --version
+      - name: bootstrap.sh over an existing install leaves a working omind
+        run: |
+          scripts/bootstrap.sh --no-setup || true
+          omind --version
+
+  secrets:
+    name: Secret scan (gitleaks, full history)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0  # gitleaks scans history
+      - name: gitleaks
+        run: |
+          docker run --rm -v "${{ github.workspace }}:/repo" \
+            --entrypoint sh ghcr.io/gitleaks/gitleaks:v8.30.1 \
+            -c "git config --global --add safe.directory /repo && \
+                gitleaks git --redact --verbose /repo"
+
+  attribution:
+    name: Commit attribution
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0  # needs the base branch to diff against
+      - name: Every commit declares its authorship
+        run: ./scripts/check-attribution.sh --range "origin/${{ github.base_ref }}..HEAD"
+
+  conformance:
+    name: MCP conformance (live stdio)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: '3.12'
+      - name: Conformance suite
+        # mcp-conformance is a private repo, so this job is a graceful no-op until
+        # MCP_CONFORMANCE_TOKEN (a PAT with read access to it) is set in the repo's
+        # Actions secrets. Then it boots `omind node` over stdio against a throwaway
+        # vault and asserts the baseline contracts (see conformance.toml).
+        env:
+          MCP_CONFORMANCE_TOKEN: ${{ secrets.MCP_CONFORMANCE_TOKEN }}
+        run: |
+          if [ -z "$MCP_CONFORMANCE_TOKEN" ]; then
+            echo "MCP_CONFORMANCE_TOKEN not set — skipping conformance suite."
+            exit 0
+          fi
+          python -m venv .venv
+          .venv/bin/pip install -U pip
+          .venv/bin/pip install -e .
+          # The token is set but may be expired or lack access to the private
+          # repo. Treat a failed clone/install as a skip, not a hard CI failure —
+          # this job is a graceful no-op until a working token is wired up, and
+          # an expired PAT shouldn't turn the whole build red.
+          if ! .venv/bin/pip install "git+https://x-access-token:${MCP_CONFORMANCE_TOKEN}@github.com/CryptoJones/mcp-conformance.git"; then
+            echo "::warning::Could not install mcp-conformance (token expired or no access?) — skipping conformance suite."
+            exit 0
+          fi
+          mkdir -p ./.conformance-vault/OMI
+          .venv/bin/mcp-conformance run -- -q
+
+# Actions pinned by commit SHA; kept current by Dependabot (.github/dependabot.yml).

omind-10.3.4/.gitignore

@@ -0,0 +1,22 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+*.egg
+build/
+dist/
+.eggs/
+.venv/
+venv/
+env/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+.vscode/
+.idea/
+*.swp
+.DS_Store
+Thumbs.db
+.claude/
+.aider*

omind-10.3.4/.gitleaks.toml

@@ -0,0 +1,19 @@
+# gitleaks config. Uses the default rule set; allowlists obvious test fixtures
+# and the generated mesh node-id/backup-password placeholders so CI stays signal,
+# not noise. omind has no committed credentials: backup passwords and node IDs
+# are generated at runtime with `secrets.token_*` and written outside the repo.
+title = "omind gitleaks"
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Test/e2e fixtures and docs use obvious fake tokens/paths."
+paths = [
+  '''tests/.*''',
+  '''docs/.*''',
+  # The e2e harness reads provider keys from the environment at runtime; it
+  # commits no secrets. gitleaks' generic-api-key rule false-positives on the
+  # high-entropy env-var NAME in runpod_api_key()'s docstring (e2e/providers.py).
+  '''e2e/.*''',
+]

omind-10.3.4/.woodpecker.yml

@@ -0,0 +1,14 @@
+when:
+  - event: push
+  - event: pull_request
+
+steps:
+  test:
+    image: python:3.12-slim
+    commands:
+      - python -m pip install -U pip
+      - pip install -e .[dev]
+      - ruff check .
+      - mypy src
+      - pip-audit
+      - pytest -v

omind-10.3.4/AGENTS.md

@@ -0,0 +1,156 @@
+# AGENTS.md — orientation for AI agents working on omind
+
+Read this before changing code. It covers what a contributor doc can't: the
+invariants that break *silently*, the current state of in-flight work, and the
+dead ends someone already walked down.
+
+For dev setup, the four quality gates, the module map, SemVer rules, and PR
+conventions, see **[CONTRIBUTING.md](CONTRIBUTING.md)** — this file does not
+repeat them.
+
+---
+
+## The one-paragraph version
+
+omind gives AI agents durable memory as **plain Markdown notes** in an Obsidian
+vault, replicated peer-to-peer over git, exposed to agents through a local MCP
+server (`omind node`) and enforced by a hook-based guard. Roughly a third of the
+repo is memory; the rest is agent enforcement (`guard.py`, `policy.py`,
+`verify.py`), fleet provisioning (`provision.py`, `agents.py`), and mesh
+replication (`mesh.py`, `merge.py`). Know which subsystem you are in.
+
+## Invariants — violate these and something breaks quietly
+
+1. **The Markdown files are the source of truth.** Indexes, caches, and vectors
+   are derived and disposable. Anything derived lives in the state dir
+   (`paths.state_dir()`), never in the vault: vault contents are committed and
+   mesh-synced, so a derived file there would replicate machine-specific junk
+   fleet-wide.
+2. **Retrieval fails open.** Every layer of search returns `None` on any problem
+   and the caller falls back to the older, dumber path. A missing model, a
+   corrupt index, a locked database, a missing FTS5 build — all degrade search;
+   none may break it. Test the failure branch, not just the happy one.
+3. **Multi-note writes go through `omind.txn`.** One note at a time is already
+   atomic (same-dir temp + `os.replace`). Two or more is not, and a crash
+   between them used to leave partial state with no way back. Any new operation
+   that writes several notes must journal its pre-images through
+   `txn.Transaction` under `store.write_lock()`, or it reintroduces the gap
+   `omind recover` exists to close. Recovery refuses to overwrite a note edited
+   after the crash — that edit is newer than the pre-image.
+4. **All note writes go through `OmiStore`** (`notes.upsert_note` for external
+   writers) — flock, atomic rename, Lamport `Rev:` stamping, soft delete.
+   Deletes archive (`Disabled: true`); only `omind mesh purge` truly removes.
+5. **`OmiStore.safe_name` guards every read and write.** Path traversal must stay
+   impossible; there are tests enforcing this. Don't route around them.
+6. **`store.py` stays framework-free.** No FastAPI, no MCP. The CLI and the web
+   app both build on it.
+7. **Credential notes are de-prioritised** in search and in the gate's
+   suggestions unless the query is itself about credentials
+   (`retrieve._CREDENTIAL_PENALTY`). The gate must never steer an agent into the
+   secrets notes. This is load-bearing, not decoration.
+8. **No MCP tool may return unbounded output.** Every list-shaped tool pages
+   (`limit`, `offset`, `total`, `has_more`) via `server._page`. `list-notes` once
+   returned ~90,800 tokens in a single result; `tests/test_server.py::
+   test_every_list_tool_is_bounded` exists so a new tool cannot regress that.
+9. **Reserved files are not memories.** `index.md` and `Memory Template.md` are
+   scaffolding; reading one does *not* clear the consult gate
+   (`paths.NON_CONSULT_FILENAMES` — an anti-dodge measure, issue #109).
+
+---
+
+## Handoff: the 2026-10-02 backlog sweep (shipped)
+
+The 2026-08-27 handoff below is history too. Current state: **v10.2.11 on `main`**.
+Trust **BACKLOG.md + CHANGELOG.md** (10.1.1–10.2.11) for detail.
+
+The sweep closed #393 #392 #391 #394 #414 #402 #403 #406 #416 #377 #380 #417 #419
+#420 #423 #425 via PRs #405, #407–#413, #415, #418, #421, #422, #424 and #426.
+Every item from that sweep is closed.
+
+Lessons for the next agent:
+
+- `windows-latest` CI runners are real Windows. Tests must be platform-correct: use
+  `tmp_path` absolute paths, `.as_posix()` in command text, and pin `provision._windows`.
+- PowerShell `-Command` turns a native exit 2 into 1 unless the command ends with
+  the null-guarded `exit $LASTEXITCODE`.
+- Recall names must be stored filenames, never titles.
+- Enforcement classifiers must bind markers to their own stage; repo-scoped rules
+  match only real command sites.
+- Fail-open must never drop the seed hard rules.
+
+---
+
+## Handoff: the 2026-08-27 multi-agent review (shipped — history)
+
+The 2026-07-24 retrieval handoff below is history: `feat/hybrid-retrieval-token-budgets`
+landed long ago, and #167–#178 all shipped (see BACKLOG.md). Current state at this
+writing: **v8.8.0 on `main`**, 1,000+ tests + ruff + mypy strict green. Trust
+**BACKLOG.md + CHANGELOG.md** for what's open — not older handoffs.
+
+### What changed and why
+
+A nine-slice multi-agent review (report:
+[docs/reviews/2026-08-27-multi-agent-review.md](docs/reviews/2026-08-27-multi-agent-review.md))
+found 35 issues; all are fixed in the working tree. The classes worth remembering:
+
+- **Locking is total now, and the pattern is uniform.** Any read-modify-write of a
+  small state file (gate sentinels, re-close/off-topic counters, `loop_guard.json`,
+  `node.json`, `backup.json`, harness settings.json) goes through
+  `filelock.exclusive()` on a SIBLING `.lock` path — never on the data file itself,
+  because the data file is replaced atomically and a flock on a replaced inode
+  protects nothing. Apply this to any new state file.
+- **Optimistic concurrency is the coordination story.** `upsert_note` captures the
+  version BEFORE reading existing fields; checkpoint/okf/consolidate pin versions;
+  `edit-note` without a token answers `concurrency: "unverified"` instead of
+  silently last-write-wins.
+- **Deletion yields to newer edits.** Purge tombstones carry the purge-time Rev;
+  `_apply_tombstones` keeps and reports a note whose live Rev dominates it.
+- **Merge LWW losses are visible in the vault** (`merge-lww` tag), not just daemon
+  stderr. If you touch `merge.py`, keep scalar losses tagged.
+- **The index stores the encoder IDENTITY** (`embed.model_identity`: name +
+  embedding-space digest), not the model name — same name/different snapshot used
+  to mix vector spaces silently. Refresh also BACKFILLS chunks missing vectors.
+- **Self-update pins the resolved commit SHA**, never the mutable tag, and records
+  the previous version for `omind self-update --rollback`.
+- **Enforcement hardening:** `guard reset` is compliance-logged (`gate-reset`);
+  freshness recorded at PreToolUse is RETRACTED on PostToolUse failure; the
+  verifier prompt fences untrusted material and parses verdicts by token; Layer E
+  uses the strict `policy.opt_in_satisfied` matcher.
+
+### Things that will bite you (still true)
+
+- Retrieval/enforcement fail OPEN — every new path must degrade, never raise into
+  the agent. `SearchIndex.search` now blanket-catches; keep it that way.
+- Recency only re-ranks matches (`test_recency_only_reorders_matches...`).
+- The index doesn't strip fences from `[[wikilinks]]`; lint.py does.
+- `link_targets()` preserves case.
+- Never mutate a cached `NoteSummary`; use `dataclasses.replace`.
+- `mesh purge` requires `--yes` (or a TTY confirm) — keep it gated.
+- `read-note` caps bodies (20k default / 65k hard) — keep it bounded (invariant 8).
+
+### Where to pick up
+
+The feature roadmap (agent identity/attribution, a usefulness feedback loop,
+sleep-time consolidation, write-time dedup, scoped writes) is Part 2 of the review
+report — none of it is started.
+
+---
+
+## Working agreements
+
+- **BACKLOG.md and the GitHub Issues tab are two views of one list.** File an
+  issue for every backlog line and link it both ways; check the box when it
+  ships. Both had drifted badly before 2026-07-24 (every "Open" item was already
+  closed upstream) — don't let that happen again.
+- **GitHub is the only remote** (Codeberg is end-of-life).
+- **Commit/push only when asked.** Branch off `main` (`feat/`, `fix/`, `docs/`,
+  `chore/`, `refactor/`), conventional-commit subjects.
+- **Docs carry the footer** (`*Proudly Made in Nebraska. Go Big Red! 🌽
+  <https://xkcd.com/2347/>*`); the README carries the centred banner version.
+- **Report honestly.** If a gate fails, say so with the output. If you skipped
+  part of the scope, say which part and why — see how #174 and #177 were left
+  open rather than half-done.
+
+---
+
+*Proudly Made in Nebraska. Go Big Red! 🌽 <https://xkcd.com/2347/>*