[entelecheia]

Refs #40

Agents can propose a structured fail or an exact-entry correction through MCP; only the person can accept it into curated memory. Goal completion offers linked short-note promotion candidates instead of promoting automatically. amem decay previews old notes and applies only after a fresh revision review and explicit confirmation.

F8: remember keeps its legacy text shape and explicit kind, and adds the complete structured fail shape. New amem_correct binds the visible exact id and current revision in the host. Policy screens the proposal plus target before/after awaits; model parameters cannot select a home, project, actor or revision.

F9: promotion is machine-local candidate metadata, accepted through existing store.promote with canonical identity and original attribution. Goal links and about goal/task nodes select notes without a live board; repeated bounded offers skip retained pending/decided receipts. Existing retention still applies, so a rejected note can be offered again once its receipt expires. Decay defaults to live long notes strictly older than 90 days, protected by open/active/blocked goals. Retained positive citations only exempt (delivery time cannot date a later citation); unknown remains unknown. Demote is default; forget requires --forget each run and a confirmation explicitly naming forgetting. Every selected revision and current eligibility is checked before any effect. Shared-v1 schema, hashing and operation vocabulary are unchanged.

Scope and ceilings are in docs/contracts.md: 64 selected notes/5000 scanned rows bound asynchronous work, while core list/get still materialize the corpus; older/raw writers retain the existing mutation-fence ceiling; a filesystem failure after preflight can leave an append-only partial batch. A completed goal remains done if subsequent candidate offering fails. Interrupted acceptance needs person inspection.

Approved existing-test spec changes (agent-mem#40 F8/F9 replaces the #15 deferrals):

• test/shard-review-cli.test.ts, old test "design: per-project shards and user-level catalog for amem memory, solving claude-mem's scale, identity and sync problems #15 split-home candidate acceptance refuses before touching the sidecar or legacy logs": old assertion review accept rejects with "shard-aware", sidecar pending. New "plan: standalone amem feature set for daily use without agent-hub (onboarding, write loop, recall quality, lifecycle) #40 split-home person acceptance writes the bound shard and preserves legacy logs": receipt resolves a fail/long/person note in the selected shard, candidate accepted, original legacy log/local bytes unchanged.
• test/generation-cli.test.ts, "generation CLI dry-run is readonly; migrate/prune apply/resume/deactivate select one profile": old assertion review --json rejects with "not yet integrated". New assertion returns [] in the current generation and preserves all JSONL bytes.
• Neighboring actor/TTY/policy/stale-target/realm safety controls stay; new cross-profile CLI tests cover shared-v1, generation and split homes.

Spec-driven tool-count changes: src/mcp.ts adds amem_correct; test/mcp.test.ts (3 lengths and title), test/mcp-cli.test.ts and scripts/measure-mcp-budget.ts move 9 to 10. Every count also checks the exact full tool-name list including amem_correct, so swaps cannot hide behind the count. All budget limits are unchanged.

Round 1 review repairs:

• DecayApplyError exposes applied/failed/remaining ids, completion expiry and an explicit uncertain-target warning. Human errors and standalone JSON (failedMayHaveChanged:true) preserve the report; a failed target may have appended before throwing, and no remaining target is attempted. CLI errors exit unsuccessfully. Both before-append and after-append EIO regressions cover this.
• MCP corrections now require the bound project, matching amem_show/amem_search. The new PR test formerly named "public shared-source correction retains source project, scope and person-only acceptance" now reads "foreign shared-source correction refuses generically like show and search without candidate or curated writes". Foreign shared ids and missing ids have the same generic refusal and cannot create a candidate or supersede another project's note.
• Proposal and acceptance share the exact correction body builder. 4000 characters including provenance headers/reason is accepted;4001 is refused at proposal. Removing the proposal guard makes the regression fail.
• Any retained positive citation exempts, including a late citation on an older delivery. Unknown telemetry remains unknown. Days require positive decimal syntax, rejecting exponent/hex/whitespace forms.
• Confirmation pins the exact short-tier expiry (default14days); the written demotion and receipt use it. A spent confirmation deadline refuses before effects. Forget explicitly warns that matching hidden claude-mem-imported copies require separate review; expanded groups are refused.
• Bot P1 legacy-copy expansion: decay checks every actual forget group before confirmation and again before the first batch effect, refusing all multi-entry expansions. The core exact-only guard repeats that check immediately before append. A deduped hidden copy protected by an open goal and an earlier unrelated target both remain unchanged; removing whole-batch preflight makes the prefix-preservation test fail. Ordinary person forget retains its existing separate group operation. Duplicate-group decay forgetting is an explicit ceiling pending a per-copy group-aware review.
• CHANGELOG/contracts warn that amem0.6.0 and older candidate listings fail on promotion rows: all readers/writers of the machine-local sidecar must upgrade before using goal-done offers. No curated shared-v1 change.

Expiry-bound follow-up: core demote and decay whole-batch preflight share assertDemotionExpiry. An explicit deadline must be canonical future UTC and no later than the configured short-tier TTL (14days by default) plus one hour from now. Past/noncanonical and one millisecond beyond the cap refuse without writes; the exact upper boundary and a custom TTL are tested. A forged overlong plan refuses before any demote attempt, rather than only failing the first effect. Focused12pass/0fail,87assertions; removing either the core cap or batch preflight makes its regression fail. Only store.ts,decay-review.ts,its test and contracts change after3741581.

Latest validation at9de2df68523debb98069b4efe88e9847a8609ef9, on fresh mainf2bcf5b2ce28104e0d123863b0846dda736ef3d9:

• Pinned Bun1.4.2 frozen install, TypeScript, boundary:OK75 source files.
• Full suite1371 pass,2 skip,0 fail (1373 tests,139 files,228.37s); npm pack dry-run83 files. /tmp/amem419-expiry-final.log, admission exit0.
• Native hooks R1/R2 pass, maxp9551.77ms/peak78.61MB, zero stalls/retained processes. MCP R1/R3 pass, idle45.44MB/peak169.59MB and EOF child reaped. No budget/retry change.
• Core expiry-cap and batch-preflight removal mutants go red; all prior correction/partial/hidden-copy regressions remain in the full run.
• Fresh-main own23-file/clean-tree guards, OCR rules and delta review pass; #435 doctor/sync/CLI paths were not changed by this four-file delta. Existing bot P1 thread is answered/resolved.

Exact-head Ubuntu/macOS CI and the installed-artifact smoke remain required. No local Linux or additional artifact smoke was run for this delta. No publish, merge or real-home mutation.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T15:07:36.142204Z	75459bf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 75459bf352

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".