rollout-cli 0.6.0__tar.gz → 0.7.0__tar.gz

{rollout_cli-0.6.0 → rollout_cli-0.7.0}/.claude/skills/recall/SKILL.md

@@ -9,13 +9,17 @@ description: >
   text, full metadata, a relevance `score`, and a freshness `signal`. Recall
   passively reinforces matched records (bumps last_recall + recall_count).
   Shadowed and archived records are excluded by default; use
-  --include-shadowed / --include-archived to retrieve them. The store lives at
-  ~/.eidetic/memory (a home-dir path outside any git worktree); the wrapper
-  defaults queries to this agent's PERSONAL, PRIVATE scope (`--scope rollout-cli
-  --visibility private`, suffix read from culture.yaml) — matching where
-  /remember writes — so a no-flag recall returns this agent's own private records
-  plus the shared public pool, and Claude and the colleague backend recall each
-  other's memories because both resolve the same suffix via this skill. Use
+  --include-shadowed / --include-archived to retrieve them. The store uses
+  visibility-aware routing: PUBLIC records inside a git repo go to
+  <repo-root>/.eidetic/memory (committed, team-shared); PRIVATE records, or any
+  record outside a git repo, go to $HOME/.eidetic/memory (never committed). An
+  explicit EIDETIC_DATA_DIR wins and short-circuits to that single dir. Recall
+  reads both stores and merges. The wrapper defaults queries to this agent's
+  PERSONAL, PRIVATE scope (`--scope rollout-cli --visibility private`, suffix
+  read from culture.yaml) — matching where /remember writes — so a no-flag
+  recall returns this agent's own private records plus the shared public pool,
+  and Claude and the colleague backend recall each other's memories because both
+  resolve the same suffix via this skill. Use
   when the user says "recall", "what do we know about X", "search memory",
   "have we seen X before", "look it up in memory", "eidetic recall", or before
   answering from scratch when prior context may already be stored. Pairs with
@@ -31,7 +35,7 @@ surface; the write half is the sibling **/remember** skill.
 
 The point of a *shared* store is that memory is a **team faculty**, not a
 per-agent silo: a record Claude wrote is recallable by the colleague backend
-(and vice versa), because both resolve the same `~/.eidetic/memory` path.
+(and vice versa), because both resolve the same `$HOME/.eidetic/memory` path.
 
 ## How to run
 
@@ -168,7 +172,7 @@ bash .claude/skills/recall/scripts/recall.sh "power" --include-archived --includ
   matches. `approximate` keeps every candidate ranked by raw cosine, so it can
   return low/near-zero scores when the store is small — lower `--top-k` to trim.
   A `--min-score` threshold is a tracked follow-up.
-- **Sharing scope = one OS user.** The default store is `~/.eidetic/memory`, so
+- **Sharing scope = one OS user.** The default store is `$HOME/.eidetic/memory`, so
   every agent/process running as the *same* OS user shares it (that is the point —
   Claude + colleague). It is not isolated between OS users by anything but file
   permissions; keep genuinely private data in a `--visibility private` scope and

{rollout_cli-0.6.0 → rollout_cli-0.7.0}/.claude/skills/recall/scripts/recall.sh

@@ -6,10 +6,11 @@
 # forwards every flag verbatim — so `recall.sh "<query>" --mode hybrid --json`
 # is exactly `eidetic recall "<query>" --mode hybrid --json`.
 #
-# The store is the files backend at ~/.eidetic/memory by default — a home-dir
-# path OUTSIDE any git worktree, so Claude and the colleague backend (which runs
-# in throwaway worktrees) read the SAME memories. Set EIDETIC_DATA_DIR to opt out
-# of sharing; set EIDETIC_MONGO_URI / NEO4J_URI + --backend for a server store.
+# The store is the files backend. Default location resolves per-operation:
+# PUBLIC records inside a git repo → <repo-root>/.eidetic/memory (committed,
+# team-shared); PRIVATE records, or any record outside a git repo →
+# $HOME/.eidetic/memory (never committed). Recall reads both stores and merges.
+# An explicit EIDETIC_DATA_DIR wins and short-circuits to that single dir.
 
 set -euo pipefail
 
@@ -34,12 +35,10 @@ resolve_eidetic() {
         fi
         dir=$(dirname "$dir")
     done
-    cat >&2 <<'EOF'
-error: eidetic CLI not found.
-hint: install it with `uv tool install eidetic-cli` (or `pipx install eidetic-cli`),
-      or run from inside the eidetic-cli checkout with `uv` available.
-      The console script is `eidetic` (dist name: eidetic-cli).
-EOF
+    # In a vendored copy there is no eidetic-cli checkout to fall back to, so the
+    # only honest remedy is to install the CLI. One `error:` + one `hint:` line.
+    printf 'error: eidetic CLI not found.\n' >&2
+    printf 'hint: install it with: uv tool install eidetic-cli (or pipx install eidetic-cli); the console script is eidetic.\n' >&2
     return 1
 }
 
@@ -65,15 +64,22 @@ EOF
 }
 
 case "${1:-}" in
-    -h | --help | help | "")
+    -h | --help)
         usage
         exit 0
         ;;
+    "")
+        # A missing query is a usage error, not success. The bareword `help` is
+        # a legitimate search term, so it is intentionally NOT a usage alias.
+        printf 'error: no query given.\n' >&2
+        printf 'hint: recall.sh "<query>" [--mode ...] [--json]; run recall.sh --help for usage.\n' >&2
+        exit 1
+        ;;
 esac
 
 resolve_eidetic || exit 2
 
-# ── default to this agent's PERSONAL, PRIVATE scope (culture.yaml `suffix`) ──
+# ── default to this agent's PERSONAL scope, PUBLIC visibility (culture.yaml `suffix`) ──
 # Query this agent's OWN personal scope by default, matching where /remember
 # writes, instead of the global `default` scope shared by every project on this
 # host. We read the `suffix` from the nearest culture.yaml (walking up from this
@@ -82,15 +88,16 @@ resolve_eidetic || exit 2
 # backend (running in a worktree of this same repo) resolves the same suffix,
 # keeping the Claude↔colleague shared-memory story intact.
 #
-# The personal scope is PRIVATE by default to match /remember: in eidetic's model
-# a private record is served only to a recall in the SAME scope (`can_serve`), so
-# querying with --scope <suffix> --visibility private is what retrieves those
-# isolated records (a public/default recall can't see them). Scope and visibility
-# are paired — the private default applies only when we inject the resolved scope,
+# Visibility defaults to PUBLIC (a recipe-level policy override of eidetic's
+# upstream private default — see the POLICY OVERRIDE comment below) to match
+# /remember, so a plain recall queries the in-repo public pool at
+# <repo>/.eidetic/memory that /remember writes to. Scope and visibility are
+# paired — the public default applies only when we inject the resolved scope,
 # and only if the caller didn't pass --visibility (so an explicit
-# `--visibility public` still wins). An explicit --scope on the command line takes
-# over steering entirely; a wheel install with no culture.yaml falls back to the
-# plain CLI default (`default`/`public`).
+# `--visibility private` still wins, also surfacing this agent's private $HOME
+# notes). An explicit --scope on the command line takes over steering entirely; a
+# wheel install with no culture.yaml falls back to the plain CLI default
+# (`default`/`public`).
 resolve_scope() {
     local dir suffix=""
     dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
@@ -100,9 +107,12 @@ resolve_scope() {
             # inline `# comment` or trailing space can't bleed into the scope),
             # then strip surrounding quotes only — matching the canonical parser
             # in .claude/skills/cicd/scripts/_resolve-nick.sh.
+            # `|| true`: under `set -o pipefail`, `head -n1` closing the pipe
+            # early can SIGPIPE `sed`, making the substitution non-zero and
+            # aborting the script. An empty parse must yield "" here, not exit.
             suffix=$(sed -n \
                 's/^[[:space:]]*-\{0,1\}[[:space:]]*suffix:[[:space:]]*\([^[:space:]]*\).*/\1/p' \
-                "$dir/culture.yaml" | head -n1 | tr -d "\"'")
+                "$dir/culture.yaml" | head -n1 | tr -d "\"'" || true)
             break
         fi
         dir=$(dirname "$dir")
@@ -127,7 +137,20 @@ if ! has_flag --scope "$@"; then
     EIDETIC_SCOPE=$(resolve_scope)
     if [ -n "$EIDETIC_SCOPE" ]; then
         SCOPE_ARGS+=(--scope "$EIDETIC_SCOPE")
-        has_flag --visibility "$@" || SCOPE_ARGS+=(--visibility private)
+        # rollout-cli eidetic-memory recipe POLICY OVERRIDE (not eidetic's
+        # upstream private default): default to PUBLIC, so a plain recall queries
+        # the in-repo public pool (<repo>/.eidetic/memory) this repo writes to.
+        # Pass --visibility private to also surface this agent's private ($HOME)
+        # notes. The two-store read model reads both dirs regardless.
+        has_flag --visibility "$@" || SCOPE_ARGS+=(--visibility public)
+    elif ! has_flag --visibility "$@"; then
+        # No suffix AND no explicit --visibility: the query runs against
+        # eidetic's own default (scope=default, visibility=public), not this
+        # agent's private personal scope — so an empty result isn't silently
+        # misread. Warn on stderr (stdout stays clean for --json). Warn ONLY
+        # here: an explicit --scope (outer guard) or --visibility (this guard) is
+        # a deliberate choice, honored verbatim, so either flag silences this.
+        printf 'warning: no culture.yaml suffix resolved; querying the public default scope rather than a private personal scope. Pass --scope or --visibility to target deliberately.\n' >&2
     fi
 fi
 

{rollout_cli-0.6.0 → rollout_cli-0.7.0}/.claude/skills/remember/SKILL.md

@@ -8,10 +8,13 @@ description: >
   dedups by content hash) — re-remembering updates in place, never duplicates.
   Stamps a `created` date on every record at ingest time. Accepts `supersedes`
   (id of the record this one replaces, for within-scope shadowing via `sweep`)
-  and `links` (list of related-memory ids). The store lives at
-  ~/.eidetic/memory (a home-dir path outside any git worktree), and the wrapper
-  defaults records to this agent's PERSONAL, PRIVATE scope (`--scope rollout-cli
-  --visibility private`, suffix read from culture.yaml) so they don't leak to a
+  and `links` (list of related-memory ids). The store uses visibility-aware
+  routing: PUBLIC records inside a git repo go to <repo-root>/.eidetic/memory
+  (committed, team-shared); PRIVATE records, or any record outside a git repo,
+  go to $HOME/.eidetic/memory (never committed). An explicit EIDETIC_DATA_DIR
+  wins and short-circuits to that single dir. The wrapper defaults records to
+  this agent's PERSONAL, PRIVATE scope (`--scope rollout-cli --visibility
+  private`, suffix read from culture.yaml) so they don't leak to a
   default/other-scope recall — Claude and the colleague backend still share them
   because both resolve the same suffix via this skill. Pass `--visibility public`
   to contribute to the shared public pool instead. Use when the user says
@@ -25,7 +28,7 @@ description: >
 `remember` drives **`eidetic remember`**, the write half of the memory surface
 (the read half is the sibling **/recall** skill). Records you store here are
 recallable later by *any* agent on this machine — Claude or the colleague
-backend — because the default store is one shared `~/.eidetic/memory` path.
+backend — because the default store is one shared `$HOME/.eidetic/memory` path.
 
 ## How to run
 

{rollout_cli-0.6.0 → rollout_cli-0.7.0}/.claude/skills/remember/scripts/remember.sh

@@ -12,10 +12,11 @@
 # Upsert is idempotent by id (and dedups by content hash): re-remembering the
 # same record updates it in place, never duplicates.
 #
-# The store is the files backend at ~/.eidetic/memory by default — a home-dir
-# path OUTSIDE any git worktree, so a record Claude remembers is recallable by
-# the colleague backend (which runs in throwaway worktrees), and vice versa.
-# Set EIDETIC_DATA_DIR to opt out of sharing; use --backend mongo|neo4j (with
+# The store is the files backend. Default location resolves per-operation:
+# PUBLIC records inside a git repo → <repo-root>/.eidetic/memory (committed,
+# team-shared); PRIVATE records, or any record outside a git repo →
+# $HOME/.eidetic/memory (never committed). An explicit EIDETIC_DATA_DIR still
+# wins and short-circuits to that single dir. Use --backend mongo|neo4j (with
 # EIDETIC_MONGO_URI / NEO4J_URI) for a server-backed shared store.
 
 set -euo pipefail
@@ -40,12 +41,10 @@ resolve_eidetic() {
         fi
         dir=$(dirname "$dir")
     done
-    cat >&2 <<'EOF'
-error: eidetic CLI not found.
-hint: install it with `uv tool install eidetic-cli` (or `pipx install eidetic-cli`),
-      or run from inside the eidetic-cli checkout with `uv` available.
-      The console script is `eidetic` (dist name: eidetic-cli).
-EOF
+    # In a vendored copy there is no eidetic-cli checkout to fall back to, so the
+    # only honest remedy is to install the CLI. One `error:` + one `hint:` line.
+    printf 'error: eidetic CLI not found.\n' >&2
+    printf 'hint: install it with: uv tool install eidetic-cli (or pipx install eidetic-cli); the console script is eidetic.\n' >&2
     return 1
 }
 
@@ -60,7 +59,10 @@ Usage:
 
 A record needs `id`, `text`, and `type`; `hash` and `metadata` are recommended
 (hash is derived from text when omitted). Upsert is idempotent by id.
-Public data only. Every flag is forwarded verbatim to `eidetic remember`.
+Records default to this agent's PUBLIC personal scope (--scope from the
+culture.yaml suffix), committed in-repo at <repo>/.eidetic/memory; pass
+--visibility private to keep a record in $HOME (uncommitted). Every flag is
+forwarded verbatim to `eidetic remember`.
 See `eidetic explain remember`.
 EOF
 }
@@ -72,9 +74,19 @@ case "${1:-}" in
         ;;
 esac
 
+# No record argument AND stdin is an interactive terminal → `eidetic remember`
+# would block forever waiting for NDJSON. Show usage instead of hanging. A piped
+# or redirected stdin (`cat records.ndjson | remember.sh`) is not a TTY and
+# proceeds to the batch path normally.
+if [ "$#" -eq 0 ] && [ -t 0 ]; then
+    usage >&2
+    printf 'hint: pass a JSON record as an argument, or pipe NDJSON on stdin.\n' >&2
+    exit 1
+fi
+
 resolve_eidetic || exit 2
 
-# ── default to this agent's PERSONAL, PRIVATE scope (culture.yaml `suffix`) ──
+# ── default to this agent's PERSONAL scope, PUBLIC visibility (culture.yaml `suffix`) ──
 # A record this agent remembers should land in its OWN personal scope, not the
 # global `default` scope shared by every project on this host. We read the
 # `suffix` from the nearest culture.yaml (walking up from this script), so the
@@ -83,14 +95,15 @@ resolve_eidetic || exit 2
 # (running in a worktree of this same repo) resolves the same suffix, keeping
 # the Claude↔colleague shared-memory story intact.
 #
-# The personal scope is PRIVATE by default: in eidetic's model only a private
-# record is isolated to its scope (`can_serve`), so private is what actually
-# keeps these records from leaking to a default/other-scope recall. Scope and
-# visibility are paired — the private default applies only when we inject the
-# resolved scope, and only if the caller didn't pass --visibility (so an
-# explicit `--visibility public` still wins). An explicit --scope on the command
-# line takes over steering entirely; a wheel install with no culture.yaml falls
-# back to the plain CLI default (`default`/`public`).
+# Visibility defaults to PUBLIC (a recipe-level policy override of eidetic's
+# upstream private default — see the POLICY OVERRIDE comment below), so a plain
+# remember lands in the in-repo, committed, team- and mesh-shared pool at
+# <repo>/.eidetic/memory. Scope and visibility are paired — the public default
+# applies only when we inject the resolved scope, and only if the caller didn't
+# pass --visibility (so an explicit `--visibility private` still wins, keeping
+# the record in $HOME / uncommitted). An explicit --scope on the command line
+# takes over steering entirely; a wheel install with no culture.yaml falls back
+# to the plain CLI default (`default`/`public`).
 resolve_scope() {
     local dir suffix=""
     dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
@@ -100,9 +113,12 @@ resolve_scope() {
             # inline `# comment` or trailing space can't bleed into the scope),
             # then strip surrounding quotes only — matching the canonical parser
             # in .claude/skills/cicd/scripts/_resolve-nick.sh.
+            # `|| true`: under `set -o pipefail`, `head -n1` closing the pipe
+            # early can SIGPIPE `sed`, making the substitution non-zero and
+            # aborting the script. An empty parse must yield "" here, not exit.
             suffix=$(sed -n \
                 's/^[[:space:]]*-\{0,1\}[[:space:]]*suffix:[[:space:]]*\([^[:space:]]*\).*/\1/p' \
-                "$dir/culture.yaml" | head -n1 | tr -d "\"'")
+                "$dir/culture.yaml" | head -n1 | tr -d "\"'" || true)
             break
         fi
         dir=$(dirname "$dir")
@@ -127,7 +143,19 @@ if ! has_flag --scope "$@"; then
     EIDETIC_SCOPE=$(resolve_scope)
     if [ -n "$EIDETIC_SCOPE" ]; then
         SCOPE_ARGS+=(--scope "$EIDETIC_SCOPE")
-        has_flag --visibility "$@" || SCOPE_ARGS+=(--visibility private)
+        # rollout-cli eidetic-memory recipe POLICY OVERRIDE (not eidetic's
+        # upstream private default): default to PUBLIC so a plain remember lands
+        # in <repo>/.eidetic/memory — committed, team- and mesh-shared. Pass
+        # --visibility private to keep a record in $HOME (uncommitted).
+        has_flag --visibility "$@" || SCOPE_ARGS+=(--visibility public)
+    elif ! has_flag --visibility "$@"; then
+        # No suffix AND no explicit --visibility: the record falls back to
+        # eidetic's own default (scope=default, visibility=public). Don't let an
+        # expected-private record go public silently — warn on stderr (stdout
+        # stays clean for --json). Warn ONLY here: an explicit --scope (outer
+        # guard) or --visibility (this guard) means the caller chose deliberately
+        # and is honored verbatim, so either flag silences this.
+        printf 'warning: no culture.yaml suffix resolved; this record falls back to the public default scope. Pass --scope or --visibility to place it deliberately.\n' >&2
     fi
 fi
 

{rollout_cli-0.6.0 → rollout_cli-0.7.0}/CHANGELOG.md

@@ -5,11 +5,28 @@ All notable changes to this project will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/). This project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.0] - 2026-06-23
+
+### Added
+
+- `eidetic-memory` rollout recipe (`recipes/eidetic-memory/`) — propagates the eidetic-origin `remember` + `recall` skills to every AgentCulture repo with a `.claude/skills/` kit, and adds them fresh where absent. `apply.sh` drops both wrappers verbatim and, on a fresh add, localizes each SKILL.md’s illustrative `--scope <nick>` example to the target’s `culture.yaml` suffix (else repo basename); `check.sh` skips repos lacking a quoted-semver `pyproject.toml`, a `CHANGELOG.md`, or a skills kit. The engine bumps the target version + prepends a CHANGELOG entry (so the org-wide version-check passes) and opens one PR per repo. README carries the 57-repo downstream-consumer ledger + reconciliation procedure.
+- `eidetic-memory` now also wires a memory-discipline **"Conventions and workflow"** section into each target’s `CLAUDE.md` (`files/CLAUDE.snippet.tmpl`) — a per-task *recall-before / remember-after* convention with the scope reference localized to the target’s nick (`__REPO_NICK__`), so the vendored skills are actually used, not just present. The section frames each repo’s memory as **in-repo and public** (records resolve to `<repo-root>/.eidetic/memory`, committed and team/mesh-shared), matching the wrappers’ public default. Inserted idempotently on a marker phrase: slotted under an existing `## Conventions and workflow` heading when one exists, else appended (the file is created if the repo has none). `check.sh` now requires the section present (alongside byte-matching wrappers) before classifying a repo `done`; `manifest.toml` declares `CLAUDE.md` in `touched_files`.
+
+### Changed
+
+- Refreshed the `eidetic-memory` recipe’s bundled `remember` / `recall` wrappers — and rollout-cli’s own vendored copies — from **eidetic-cli 0.10.0** (cite-don’t-import), picking up eidetic’s **project-local store default**: PUBLIC records inside a git repo resolve to `<repo-root>/.eidetic/memory` (committed, team-shared), PRIVATE records (or any record outside a repo) go to `$HOME/.eidetic/memory` (uncommitted), `EIDETIC_DATA_DIR` still wins, and recall reads both stores and merges. Also carries the 0.9.3 hardening (interactive-stdin guard, `help` as a search term, SIGPIPE-safe suffix parsing). **Recipe-level policy override** (the wrappers are no longer byte-verbatim): the injected default visibility is flipped from eidetic’s `private` to **`public`** (one line + a `POLICY OVERRIDE` comment in each wrapper), so a plain `/remember` keeps memory in-repo at `./.eidetic/memory`; the reconciliation procedure re-applies this `sed` after each `cp` from origin. rollout-cli’s own `CLAUDE.md` + skill copies dogfood the change.
+
+### Fixed
+
+- `rollout/core/devex_pr.py` `open_pr` now **requires** `gh`. The engine opens a PR for a freshly-cloned sibling (an arbitrary repo + branch) from rollout-cli’s own cwd, which only `gh pr create --repo --head --base` can target; `devex pr open` operates on the current checkout and rejects those flags, so it silently failed to open PRs whenever it was on PATH. The earlier "prefer gh, fall back to devex" selection was internally inconsistent — the devex fallback built a command devex would reject (Qodo review). `open_pr` now selects `gh` unconditionally and raises a clear `PrError` (pointing at `https://cli.github.com`) when `gh` is absent, instead of falling through to a broken devex invocation. `build_pr_command`’s pure `tool="devex"` branch is retained (still unit-tested); only the runtime selection is gh-only.
+- `recipes/eidetic-memory/check.sh` version preflight is now end-anchored (`…"$`), matching `rollout/core/bump.py`’s `_LINE_RE` exactly (Qodo review). The old grep accepted `version = "1.2.3"  # comment` (or trailing whitespace), so `plan` could classify a repo `ok`/`done` and then `apply` would fail at the version-bump step; preflight is now a strict subset of what the bumper accepts.
+- `eidetic-memory` wrappers (`remember.sh` / `recall.sh`, bundled + rollout-cli’s own copies): corrected stale header/usage comments that still described a **private** default after the policy flip to public (Qodo review) — the code already injected `--visibility public` and warned on a suffixless fallback, but the prose said "PRIVATE by default", contradicting the behavior. Comment-only; no behavior change.
+
 ## [0.6.0] - 2026-06-23
 
 ### Added
 
-- remember / recall skills — vendored directly from eidetic-cli (cite-don't-import), the write/read halves of eidetic's shared ~/.eidetic/memory surface. `remember` wraps `eidetic remember` (idempotent JSON object or NDJSON-batch upsert by id); `recall` wraps `eidetic recall` with four search modes (exact / approximate / keyword / hybrid). The `.sh` wrappers are byte-verbatim; each SKILL.md is localized only in the illustrative `--scope rollout-cli` scope examples (Provenance keeps "First-party to eidetic-cli"). docs/skill-sources.md gains the two provenance rows (origin = eidetic-cli, vendored direct, not via guildmaster). Runtime dep: the `eidetic` CLI on PATH (else a local eidetic-cli checkout + uv).
+- remember / recall skills — vendored directly from eidetic-cli (cite-don't-import), the write/read halves of eidetic's shared `$HOME/.eidetic/memory` surface. `remember` wraps `eidetic remember` (idempotent JSON object or NDJSON-batch upsert by id); `recall` wraps `eidetic recall` with four search modes (exact / approximate / keyword / hybrid). The `.sh` wrappers are byte-verbatim; each SKILL.md is localized only in the illustrative `--scope rollout-cli` scope examples (Provenance keeps "First-party to eidetic-cli"). docs/skill-sources.md gains the two provenance rows (origin = eidetic-cli, vendored direct, not via guildmaster). Runtime dep: the `eidetic` CLI on PATH (else a local eidetic-cli checkout + uv).
 
 ## [0.5.1] - 2026-06-18
 

{rollout_cli-0.6.0 → rollout_cli-0.7.0}/CLAUDE.md

@@ -81,3 +81,31 @@ check whether the *target file path* is already ignored —
 Note: `devex`'s own self-heal (`devex overview`/`devex init`) bootstraps `.devex/`
 only — it will **not** restore an `.agex/.gitignore`, so for `.agex` repos the
 file must be supplied verbatim.
+
+## Conventions and workflow
+
+**Memory discipline — recall before, remember after.** This repo keeps its
+eidetic memory **in-repo and public**: records resolve to
+`<repo-root>/.eidetic/memory` — committed, and shared with the team and mesh
+peers (the `claude` and `colleague` backends both read the same `rollout-cli`
+scope), so memory travels with the repo, not a private home-dir store. Make it
+a per-task habit:
+
+- **`/recall` before you start.** Search the store for the area you're about
+  to touch — prior decisions, gotchas, "have we done this before?" — so you
+  build on what's already known instead of re-deriving it. Do this before
+  non-trivial tasks, not just when asked.
+- **`/remember` when something worth keeping surfaces.** A non-obvious
+  decision and its rationale, a constraint, a fix and *why* it was needed, a
+  gotcha that cost time, a fact the next session would otherwise re-learn.
+  Capture it as it happens, not at the end when it's faded.
+
+A plain `/remember` lands the note in `./.eidetic/memory` in this repo — no
+flag needed (the wrappers here default to `--visibility public`; in-repo
+routing needs `eidetic >= 0.10.0`, older CLIs keep records in `$HOME`). Keep
+something out of the committed store only by passing `--visibility private`
+(routes to `$HOME/.eidetic/memory`, never committed); `/recall` reads both
+stores and merges. Don't store what the repo already records (code structure,
+git history, what's already in this file or `CHANGELOG.md`) — store what you'd
+have to re-derive. These are the `recall`/`remember` skills (`.claude/skills/`),
+backed by the `eidetic` store.

{rollout_cli-0.6.0 → rollout_cli-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rollout-cli
-Version: 0.6.0
+Version: 0.7.0
 Summary: Cross-repo propagation workflow built on refactor-cli — apply a transformation across many repos at once.
 Project-URL: Homepage, https://github.com/agentculture/rollout-cli
 Project-URL: Issues, https://github.com/agentculture/rollout-cli/issues

{rollout_cli-0.6.0 → rollout_cli-0.7.0}/docs/skill-sources.md

@@ -115,6 +115,12 @@ ledger of who those consumers are — is owned by the
 [`ask-colleague-revendor`](../recipes/ask-colleague-revendor/README.md) rollout
 recipe (rollout-cli#3).
 
+Likewise, broadcasting the eidetic-origin `remember` / `recall` skills **out to
+the AgentCulture mesh** — and the ledger of which repos consume them — is owned
+by the [`eidetic-memory`](../recipes/eidetic-memory/README.md) rollout recipe.
+Re-vendor *this* repo's own copy from `../eidetic-cli` directly (the `.sh`
+wrappers verbatim; localize only the illustrative `--scope rollout-cli` examples).
+
 ## Tooling prerequisites
 
 - **`devex`** (>=0.21) on PATH — `cicd` delegates the PR lifecycle to `devex pr`.

{rollout_cli-0.6.0 → rollout_cli-0.7.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rollout-cli"
-version = "0.6.0"
+version = "0.7.0"
 description = "Cross-repo propagation workflow built on refactor-cli — apply a transformation across many repos at once."
 readme = "README.md"
 license = "Apache-2.0"

rollout_cli-0.7.0/recipes/eidetic-memory/README.md

@@ -0,0 +1,161 @@
+# eidetic-memory
+
+Propagate eidetic-cli's first-party **`remember`** + **`recall`** memory skills
+to every AgentCulture repo that vendors a `.claude/skills/` kit — add them fresh
+wherever they are absent, refresh the wrappers wherever they are stale — and wire
+a per-task **memory-discipline convention** into each repo's `CLAUDE.md` so the
+skills are actually used, not just present.
+
+`remember` / `recall` are first-party to **eidetic-cli** (it owns its memory
+surface); downstream repos vendor them **cite-don't-import**. eidetic-cli's own
+skill ledger anticipated this broadcast: *"Broadcast to the mesh via
+steward/guildmaster is for later, if other agents want it."* This recipe is that
+broadcast, driven through rollout-cli (the propagation tool) rather than forced
+into the origin repo.
+
+## What it does
+
+For each target repo, `apply.sh` lays down both skills:
+
+- **`scripts/<skill>.sh`** — always overwritten from the bundled snapshot. The
+  wrapper resolves the `eidetic` CLI (`PATH` first, else `uv run` from a
+  checkout) and reads the `suffix` from `culture.yaml` at runtime, so the same
+  bytes are correct in every consumer. The snapshot is eidetic-cli **0.10.0**
+  verbatim **except one documented recipe-level policy override**: the injected
+  default visibility is flipped from eidetic's `private` to **`public`** (a
+  single line in each wrapper, plus a `POLICY OVERRIDE` comment). With
+  eidetic 0.10.0's project-local store, a PUBLIC record inside a git repo
+  resolves to `<repo-root>/.eidetic/memory` (committed, team-shared) while a
+  PRIVATE one goes to `$HOME/.eidetic/memory` (uncommitted) — so defaulting to
+  public means a plain `/remember` keeps memory **in the repo**. Pass
+  `--visibility private` to opt a record back out to `$HOME`.
+- **`SKILL.md`** — written **only when absent** (fresh add), substituting the
+  target's nick (`culture.yaml` `suffix`, else repo basename) into the
+  illustrative `--scope <nick>` examples via the `__REPO_NICK__` token in
+  `files/SKILL.md.<skill>.tmpl`. An existing `SKILL.md` is never clobbered (a
+  downstream may have localized or diverged it). The Provenance line always
+  cites **"First-party to eidetic-cli"**.
+
+Then, once, into `CLAUDE.md`:
+
+- **Memory-discipline section** — a "Conventions and workflow" block
+  (*recall-before / remember-after*) rendered from `files/CLAUDE.snippet.tmpl`
+  with the same `__REPO_NICK__` nick substituted into the scope reference.
+  Inserted **only when its marker is absent** (idempotent): slotted under an
+  existing `## Conventions and workflow` heading when the repo already has one,
+  otherwise appended as a fresh section (and `CLAUDE.md` is created if the repo
+  has none). This makes the skills load-bearing — the agent is told to `/recall`
+  before non-trivial work and `/remember` what it would otherwise re-derive.
+
+`apply` also bumps the target's version (`minor`) and prepends a CHANGELOG entry
+— required because AgentCulture's org-wide CI rule fails any PR that does not
+bump the version. `check.sh` classifies a repo `done` (both wrappers byte-match
+the snapshot **and** `CLAUDE.md` already carries the section), `ok`
+(wrapper missing/stale or section absent → apply), or `needs-attention` (no
+quoted-semver `pyproject.toml`, no `CHANGELOG.md`, or no `.claude/skills/` kit).
+
+## Run it
+
+Operate on **fresh clones** in a scratch base dir (never live agent checkouts):
+
+```bash
+# Dry-run classification across consumers (zero outward effect):
+uv run rollout plan eidetic-memory --repos <slugs> --base <clones-dir>
+
+# Apply — branch, lay down skills, bump version, open one PR per repo
+# (the operator squash-merges; rollout never merges):
+uv run rollout apply eidetic-memory --repos <slugs> --base <clones-dir> --yes
+```
+
+## Downstream-consumer ledger
+
+Origin: **eidetic-cli** (`agentculture/eidetic-cli`,
+`.claude/skills/{remember,recall}/`). Consumers = every non-archived
+AgentCulture repo with a `.claude/skills/` kit + a version-bumpable
+`pyproject.toml`, discovered 2026-06-23 (57 repos):
+
+```text
+agenda agentculture-cli agentfront agentirc agent-lifecycle agtag
+amazing-hand-cli antoine appsec arm101-cli arxivist auntiepypi climate-cli
+cloudai-cli code-lens-cli coherence-cli colleague culture cultureagent
+culture-agent-template culture-core cultureflare culture-tools data-refinery-cli
+devague devex dgx-spark-cli discord-bot-cli dominion-breaker ec2bedrock-cli
+ec2-cli ghafi grant guildmaster identity-cli irc-lens jetson jetson-ai-lab-cli
+katvan knowledgebase-cli lecodeur lobes-cli office-agent operator-cli prove-cli
+qodo-cli reachy-mini-cli reachy-mini-mcp reduce-cli refactor-cli reterminal-cli
+rtx-spark-cli steward telek tensor-cli tipalti unsloth-cli
+```
+
+Excluded as non-targets (no `.claude/skills/` kit): `antigravityd`, `codexd`,
+`kirod`, `landing-page`. `eidetic-cli` is the origin (already has them);
+`rollout-cli` is self (carries its own localized copy + this recipe).
+
+Eight consumers have **no `culture.yaml` suffix** (`agentirc`, `cultureagent`,
+`cultureflare`, `ghafi`, `grant`, `irc-lens`, `office-agent`, `tipalti`) — their
+fresh-add `SKILL.md` falls back to the repo basename in the scope example; the
+wrapper itself falls back to the CLI default scope at runtime, so they still
+work. Keep this table current when a consumer is added or dropped.
+
+## Reconciliation procedure (when eidetic-cli changes a wrapper)
+
+1. Refresh the snapshot from the origin checkout, then **re-apply the
+   public-default policy override** (the wrappers are origin-verbatim *except*
+   that one line — `cp` re-introduces eidetic's `private`, so the `sed` must
+   flip it back to `public`):
+
+   ```bash
+   O=../eidetic-cli/.claude/skills
+   D=recipes/eidetic-memory/files/scripts
+   cp "$O/remember/scripts/remember.sh" "$D/"
+   cp "$O/recall/scripts/recall.sh"     "$D/"
+   # POLICY OVERRIDE: default visibility private -> public (keeps memory in-repo).
+   # Re-add the POLICY OVERRIDE comment by hand if a future eidetic release moves
+   # the line; the marker to find is `SCOPE_ARGS+=(--visibility private)`.
+   sed -i 's/SCOPE_ARGS+=(--visibility private)/SCOPE_ARGS+=(--visibility public)/' \
+       "$D/remember.sh" "$D/recall.sh"
+   # SKILL.md templates — re-tokenize the illustrative scope examples:
+   sed -e 's/--scope eidetic-cli/--scope __REPO_NICK__/g' \
+       -e 's/(here, `eidetic-cli`)/(here, `__REPO_NICK__`)/g' \
+       "$O/remember/SKILL.md" > recipes/eidetic-memory/files/SKILL.md.remember.tmpl
+   sed -e 's/--scope eidetic-cli/--scope __REPO_NICK__/g' \
+       "$O/recall/SKILL.md" > recipes/eidetic-memory/files/SKILL.md.recall.tmpl
+   ```
+
+   Note: the vendored `SKILL.md` text still describes eidetic's upstream
+   `private` default (it is documentation from the origin). The operative
+   override to `public` lives in the wrapper + the `CLAUDE.md` convention this
+   recipe writes; keep those two authoritative.
+
+2. Dry-run, then apply (see "Run it"). The wrapper is always re-vendored; an
+   existing downstream `SKILL.md` is left untouched, so a doc-only upstream
+   change must be re-broadcast deliberately (delete the downstream `SKILL.md`
+   first, or extend `apply.sh`).
+
+The `CLAUDE.md` memory-discipline section (`files/CLAUDE.snippet.tmpl`) is
+rollout-cli-authored, **not** vendored from eidetic-cli, so a wrapper refresh
+does not touch it. It is gated on its marker phrase the same way: once a target
+carries the section, a re-apply leaves it alone; to re-broadcast an edited
+snippet, remove the marker line downstream first.
+
+## Re-broadcasting: the work-branch collision
+
+The engine names the work branch `rollout/<recipe-name>` — for this recipe,
+`rollout/eidetic-memory` — and the `apply` CLI has **no `--branch` flag**. So a
+*second* broadcast collides with the first round's branch wherever it still
+exists (merged-but-not-deleted, or an open round-1 PR): the push is rejected and
+that repo lands a `needs-attention` row. Deleting sibling branches in bulk is
+also (rightly) refused by the agent's safety classifier. The clean fix is a
+**fresh, unique branch name** per round — drive the engine directly:
+
+```python
+# round-2 used branch="rollout/eidetic-memory-0.10" over fresh clones:
+orchestrate.apply_one(clone_path, rec, branch="rollout/eidetic-memory-0.10",
+                      repo_slug=slug, date=today, pr_opener=opener)
+```
+
+A unique branch never collides and deletes nothing. (Round-2, 2026-06-24, opened
+57/57 this way; `colleague`'s still-open round-1 PR became a harmless duplicate
+to close.)
+
+Refs: eidetic-cli skill ledger (`docs/skill-sources.md`), rollout-cli
+`docs/skill-sources.md` (provenance rows for `remember` / `recall`).