The record

ADR-1 · Keep this repository's own mnema record, committed with it accepted#

The product governs its own development where anyone who reads the repository can see it: the decisions behind mnema are recorded, signed and verified with mnema. The rule of August 2026 against a record here answered probes that had written into it; every probe now runs in a throwaway home and a worktree, never in this clone.

Turned down:

Keeping the decisions only in local planning notes: the product would still have no real use of its own. A separate repository for them: the decisions would not travel with the code, and no visitor would see them.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:24:57.747Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude.

ADR-2 · Hold every workflow move to its state machine, at the write and at every reader accepted#

A move of a decision, a task, a skill or a run is judged against the chain, not a cache. First, under the lock, the gate reads the subject's state from the chain itself (a byte scan of the segments by id, to be measured), so a tampered projection can no longer let an illegal move be written. Then the state machine enters the format and both readers, the TypeScript verify and the Python reader, judge each transition at its position: an illegal move, or one whose from is not the state its writer saw, is not applied and is named in the census, with the verdict and exit unchanged. A run ends once; a move to a successor that does not exist, or of a subject never born, is illegal. Refusing on it is a later, separate choice.

Turned down:

Only the gate rejudging from the chain: it leaves a move written by hand with a valid key, which both readers would still pass. Only the readers judging: the product would still write, signed, a move its own readers refuse. Only saying so on the page: no gap would close.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:29:04.471Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-3 · Promise backward reading and a named refusal forward, from the first publication accepted#

From the first version on npm, the format promises two things, written in FORMAT.md section 4.1 and held by a test. Every newer binary reads every older record, as the upcasters already do. An older binary that meets a kind or a field it does not know refuses, and says which version reads that record, instead of reading it wrong. A verify never says VERIFIED about facts its reader cannot judge. The order between tails, which is the writer's clock, stays a declared limit, outside the promise.

Turned down:

No promise while the version is 0.x: someone who upgrades one clone and not another loses the record without knowing why. Skipping the kinds a reader does not know: an older verify would pass facts it cannot judge, against the proof the product sells.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:30:35.511Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-4 · Publish the first npm version as 0.1.0, the start of a new line accepted#

What reaches npm is a new concept and starts its own line at 0.1.0: it does not continue the withdrawn GitHub pre-releases nor the 0.x alpha. The five public packages (chain, core, context, stacks, code) publish together at that version; the action, the SDK and the VS Code extension keep running from a checkout. The tag v0.1.0 is born on the commit that is published, and a GitHub release, if any, carries only notes that point at npm, since provenance proves where the packages came from. The changelog presents 0.2.0-beta and 0.1.0-beta as withdrawn pre-releases from before this line.

Turned down:

0.3.0: it reads as the continuation of the withdrawn pre-releases. 0.2.0: almost the number of a withdrawn pre-release with other content. A pre-release on a next dist-tag: friction for whoever arrives, and what a plain install picks would need measuring first.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:36:21.769Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-5 · Launch as the decision record for coding agents, with headless CI as a satellite accepted#

The first publication presents mnema as the record of the decisions behind coding agents' work, and keeps the three lines of where-it-fits: not an agent runner, not a copy somewhere else, not access control. The headless mode that already exists and is tested (an agent's own key, the CI recipe) is shown as a satellite of the core. Governing other automations is an exploratory track, kept off the README until a prototype exists, in this order: a rule whose target is a named action and not only a path, then a headless example with the SDK, an agent key and a run, and only then a server. The field reading, 6 of 9,448 tool calls to the server, says the value arrives through the host's hook, so a central API nobody intercepts for would not be asked.

Turned down:

Repositioning now as governance of any automation: the first README would promise what no prototype holds. Keeping the three lines with no track at all: the headless pieces that exist would stay unnamed.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:38:34.488Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-6 · Show Stacks as a satellite of the core, not as part of its promise accepted#

Stacks installs skills and agents that others publish, with a signed adoption. It is the product farthest from the core promise, which is the decisions that govern the work, so the front page shows it as a satellite in the mnema family, with its own status, and no longer inside the core's features. Only the presentation changes: it stays the published package @mnema/stacks, and the stack commands stay in mnema.

Turned down:

Keeping it among the core's features: the front page would keep mixing a separate line of product into the central promise. Splitting the stack commands into a binary of their own: a large change that proves nothing more.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:39:14.819Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-7 · Take Continue and Warp off the host table, and port Qwen Code after the first publication accepted#

The seven hosts that sit on the lowest rung by their documentation were each read again at their sources. Before the first publication, Continue (whose project has closed and whose repository is read-only) and Warp (whose hooks are only a draft) leave the table for the line that covers any MCP client, and the note on Antigravity, which says it has no SessionStart while its documentation shows one, is corrected in the same change. After the publication, Qwen Code is ported with its own contract and a CI job that needs no account, since it turns a Claude Code plugin into an extension that loads its hooks. Cursor's editor, Antigravity, Factory Droid and Goose stay on the lowest rung and climb only by a capture made by hand.

Turned down:

Taking all seven off the table: it would drop Qwen Code, the one of them that a job without an account can hold. Changing nothing: the Antigravity note would keep contradicting its documentation.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:41:09.858Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-8 · Keep the 27 tools as they are until their use is measured accepted#

No tool of the MCP server is cut, merged or renamed before the first publication. A tool's name is a contract (the hooks, the skills and every hand-made configuration call it by name), and the only sample of use is 12 calls, all from tests, which convicts no tool. After the publication a local count of calls per tool, kept outside the record and with no change to the format, gives real use before any cut. The cost stays where it is measured: the 27 definitions weigh 54,568 bytes in the hosts that send them all.

Turned down:

An opt-in core profile: two surfaces to test before there is evidence it is needed. Merging the five audit tools into one: breaks tool names for a saving not yet measured. Moving the audit tools to the command line only: takes the tool from an agent that audits, on a sample of zero.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:43:31.566Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-10 · Hold the guard's key check with a passphrase set, and catch a changed tool description locally accepted#

Two tests the suite lacks. The guard answers the refusal this machine's key would give, but its paired tests tie the person's protected key only with no passphrase set, so a guard that refused every protected key even with the passphrase present would pass them all: a fourth paired test covers that side. And a change to a tool's description must move the four weights the host contracts pin, which the local suite skips, so a local test now fails when a description changes without them, before CI does. A machine with no key at all keeps answering MISSING_WHO, as decided earlier.

Turned down:

Leaving both as declared debt: the guard's protected-key path would stay unheld, and a changed description would keep costing a red CI run.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:50:38.140Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-11 · Refuse a title with no content, at every door accepted#

A title made only of spaces, or only of punctuation, says nothing about the work, so it is refused with a code by the same rule at the command line and in the MCP tools that take a title, instead of being recorded as if it named something. It changes what a tool accepts, and lands after the first publication.

Turned down:

Refusing only the title of spaces: punctuation alone would still pass as a title. Accepting both as today: a record could hold tasks no one can tell apart.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:51:20.622Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-12 · Say on the evidence page that the comparison with CLAUDE.md has no result yet, and run the model experiments after the first publication accepted#

No published result compares a superseded decision in the record with the same rule in a CLAUDE.md, and the page that says how each claim is held must not let a reader assume one: a line says it has no result. The experiments that need a paid model (the proof of the token cuts through the plugin's eval, capture without a person asking, the superseded decision against CLAUDE.md) run after the first publication, with a budget the maintainer sets at the time; nothing runs a paid model without that order.

Turned down:

Running them before the first publication: model cost and time on the critical path, for a number the launch does not need. Declaring and dropping them: the questions that decide whether the record changes an agent's work would stay unasked.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:52:15.773Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-13 · Build capture from the commit after the first publication, on real interviews and a measurement accepted#

Capture redesigned from the commit (the commit or the pull request is the source, the agent proposes the decision and it stays private until accepted, with a hook on the shell) stays off the path to the first publication. It comes back with interviews of people other than the maintainer, of whom there are none yet, and with a measurement that needs a paid model.

Turned down:

Building it before the first publication: a design with no independent interview and no measurement. Dropping it: recording would stay entirely manual, which is where the record and the practice part ways.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:54:32.017Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-14 · Study who sees a deferred write before building the queue, after the first publication accepted#

A write the record refuses could become a request kept outside the record that a person signs later. Before any of it is built, a study of who sees that queue and of what happens in a CI run with no person: there, a request would be lost in silence. It comes after the first publication. A signed inbox stays turned down, as its study advised.

Turned down:

Building it before the first publication, with the CI case still open: a silent loss. Dropping it: a refusal stays only a refusal, with no way to approve it later.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:54:32.229Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-15 · Settle what both readers do with a stored line that differs from the canonical one only by space or Unicode composition, before the format is frozen accepted#

What a reader accepts is part of the format the first publication freezes. A stored line that differs from its canonical bytes only by whitespace, or by a composed against a decomposed form of the same characters, is read today without a rule written down. The rule (refuse the non-canonical line, or read it and name it) is designed together with the control characters a reader shows, in the same pass, and decided before the format's compatibility promise takes effect.

Turned down:

Leaving it for after the first publication: it would then change as a format change under the compatibility promise, with older binaries refusing records they read today.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:57:24.596Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-16 · Keep Sigstore a witness, and leave it as a second way of naming the signer until after the first publication accepted#

Sigstore already countersigns a checkpoint as a witness. Using it also to say who signs a fact, beside the key, adds identity surface (an e-mail address, or a repository, workflow and run, in a public log) and touches nothing the record proves today, so it waits until after the first publication.

Turned down:

Adding it before the first publication: more identity surface to explain and hold before launch. Dropping it for good: closes a door no measurement has yet asked to close.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T20:57:24.821Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-17 · Launch what is ready, study the organization layer now, and start its pilot only after the first publication accepted#

The first publication carries what is ready today. The organization layer, many repositories of one organization read together, is studied now, read-only and bounded to three questions: what the format must allow before it is frozen, so that the layer does not become a format change later; what a pilot would measure; and how it keeps the line that mnema is not a copy somewhere else, with a remote that never writes. Nothing of it is built before a pilot, and the pilot starts only after the publication, with the published product.

Turned down:

Waiting for a pilot before any study: a need the format has to meet would surface after the freeze, as a format change under the compatibility promise. Planning to build it after the publication without a pilot: design for a need no user has stated.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T21:01:08.110Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-18 · Run mutation testing on what is published before the first publication, and leave the other blocks of the old roadmap for after accepted#

Of the blocks the roadmap of August 2026 left open, mutation testing serves the proof of what is about to be published, so it runs before the first publication on the core paths, as part of hardening the record. Attestation already comes with the provenance of the first publication. The generated differential and conformance suite, the final page and the plugin's evals come after it; the front page is reworked before it as its own step.

Turned down:

All four after the first publication: the paths the format freeze rests on would ship with their tests unmeasured. Retiring the old roadmap: drops mutation testing, the one block that measures whether the tests hold.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-14T21:01:08.332Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-19 · Keep the space and Unicode rule of 1 October, and settle the record's line ends and what a reader shows accepted#

The rule for whitespace and Unicode composition in a stored line, taken on 1 October 2026, stands. What was left before the format is frozen were its edges and the screen. A line with a CRLF end is still refused, and the refusal now says CRLF; the record's own .gitattributes keeps a clone from rewriting its line ends. A blank line between lines is declared in FORMAT.md, and both readers keep skipping it. On screen, every character that draws nothing is escaped, the whole class as a fixed list from Unicode 17, held by a test that turns red when one is missed.

Turned down:

Normalizing CRLF lines on read: the bytes read would no longer be the bytes signed. Escaping a hand-kept handful of invisible characters: the next one would pass unseen.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-16T01:13:59.325Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-20 · Add nothing to the format for the organization layer before the first publication accepted#

The study of reading many repositories of one organization together found nothing the format must carry before it is frozen. A kind added later fits under the compatibility promise, whose refusal names the kind and the version it reads. A pointer from a repository to its organization's rules stays out of the signed record until a pilot asks for it. Who states an organization's rule is whoever writes in that organization's repository, since mnema is not access control. The pilot runs after the first publication, on an organization with at least three repositories that the maintainer names then, and nothing of the layer is built before it.

Turned down:

Reserving a field or a kind for the layer now: format for a need no user has stated yet. Signing the inheritance pointer into the record now: a promise the pilot might contradict.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-16T01:13:59.760Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-21 · A gate that cannot read the record refuses the write accepted#

Context. The per-edit gate (the command hook `mnema before-a-write` and the MCP route `rules_before_an_edit`) decides a refusal by reading the record. A stored line the reader refuses (not JSON, a kind or field this version does not know, as a newer mnema's line is, or non-canonical bytes) makes that reading throw. The gate then answered nothing: the command exited 1 with an empty reply, which the plugin's wrappers turn into silence (so Copilot CLI, which denies on a non-zero exit, never sees it), and the MCP route answered a tool error, on which Claude Code's mcp_tool hook does not block (measured on 2.1.281). In every host the plugin wires, the write went through. The format says such a line is never guessed at and never skipped (FORMAT §7.1; the decision "Promise backward reading and a named refusal forward, from the first publication"). The gate reads three trees: the project's public tree (committed), the project's private tree and the machine-global tree (neither versioned). The global tree is read by every project on the machine.

Decision. When the reading throws an unreadable stored line, and only then, both doors answer deny. The command exits 0 and answers in each host's shape; the MCP route answers with a reply, not a tool error. Nothing is recorded, and a note goes to the second stream. The reason is fixed text around the reader's own refusal. It names the tree (the project's public record, the project's private record on this machine, or this machine's global record), gives the reader's own refusal with the file and position, and says how far the refusal reaches and the way out. The ways out: update mnema if a newer one wrote the line; for the public tree, restore the line from the repository's history; for the private and global trees, which are not versioned, restore the file from a copy or repair or remove the line. For the global tree the text says that every project on the machine is closed. A busy tail or a fault of the product is not turned into a refusal, and a torn last line is still dropped. In an MCP session over a workspace of several projects, an unreadable line in another project also refuses, and the text says "the project".

Consequences. An older mnema that meets a line a newer one wrote refuses every write in the project, or in every project on the machine when the line is in the global tree, until it is updated or the line is restored. There is no way out through the switch: `mnema switch off edit-refuses-a-write` reads the same record and is refused too. With no `mnema` on the PATH, or a hook that times out or fails for another reason, the gate still lets the write through. These refusals record no fact, because a refusal fact cites a rule and none could be read. The rule the plugin's handlers are written to follow, that a session is never made worse than without the plugin, has one exception, declared in docs/features.md and in the CHANGELOG: a record that cannot be read closes the writes.

Turned down:

(b) Answer `ask`: a person gets a way through in Claude Code, VS Code and Copilot CLI, but Codex, Cursor, Gemini CLI and OpenCode do not hold a write for a person on `ask` (Codex rejects it, Cursor ignores it, and the doors for Gemini CLI and OpenCode never send it), so there it would let the write through. One answer would mean different things per host. (c) Keep letting the write through: the refusal would stop holding exactly when nobody can tell which rules apply, and the older machines of a mixed team would lose their refusals in silence. (d) Skip the line in the gate only: the skipped line may be the one that creates or retracts the rule, so the gate would decide wrongly both ways; it breaks "never skipped" and needs a tolerant reader the format refuses. Refuse only for the public tree: the private and global trees hold rules and switches that apply too, so letting the write through there is (c) for two trees of three, while which tree holds the line is a fact the text can say.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-16T15:37:28.120Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

Notes

• Observation on Amended by ADR-65 about 01a1455c-6f1b-7000-8130-aac30ef9925b, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T17:30:09.412Z

  This decision's consequences said a product fault, a timeout or an error, lets the write through. ADR-65 amends that. When mnema is installed but cannot answer, a write is refused, but only where a rule that refuses or asks for a person addresses the path. An earlier observation on ADR-28 cited this decision as already saying a gate that cannot run refuses: that was true of the title only, not of the consequences.

ADR-22 · A record in which no tail holds anything is refused by both readers, by name accepted#

Context. A key's fingerprint is the id of the tail it writes, so a record's committed keys are a roster of the tails that should exist (FORMAT section 6.5), and a committed key with no tail is said as a note, never as a refusal, because an absence is not something a reader can prove was tampering. Section 6.5 does not say what a reader answers when no tail is left at all: the tails/ directory gone, no tail directory in it, or only tails that hold no event and no checkpoint, which section 4 does not count. There the two readers part on the same bytes. On a record of one tail (14 events, 7 checkpoints, a person's key and a declared backup) with its tail directory deleted, `mnema verify` says "verified (T1 only); 0 tail(s); no events yet", with a census note for each key, and exits 0; the second reader says BROKEN ("there are no tails", or "there is no tails/ directory" when that is gone), exits 3 and never reaches its section 6.5 notes. With the tail directory kept and only its tail proof left in it, the second reader says VERIFIED and exits 0. With every public key deleted as well, the product still exits 0. Under `--require signed` the product exits 1 on all of these, because no event is signature-covered. A record does not reach this shape through `mnema init` when it succeeds: init writes three events and a checkpoint before it returns. It does reach it when init fails after making the directory (measured with a home it cannot write to): `.mnema/` is left with its `.gitignore` and `.gitattributes`, and a second `mnema init` answers "nothing to found" and writes nothing. The compatibility promise starts at the first publication, which has not happened, and it forbids loosening a rule, not tightening one (FORMAT section 7.1).

Decision. A record in which no tail holds an event or a checkpoint asserts no fact, and both readers refuse it by name, at every value of `--require`, with the exit of any other refusal (1), not a new one. FORMAT section 4 says so beside the rule that an empty tail is not counted, and section 6.5 says that its notes still run there, so each committed key with no tail is still named. The product applies the rule to the committed tree always, and to the private and global trees only when they hold a record (a key or a tail), as it already decides today which of those trees it rules on. The second reader turns its two early stops (no tails/ directory, no tail directory in it) into that refusal under section 4, and keeps BROKEN for a path with no directory at it. A committed key with no tail beside a tail that holds events stays a note, as it is now.

Consequences. A checkout with no tail holding anything fails `mnema verify` by default instead of passing it: tails removed by a merge, left out by a sparse checkout, or deleted in a commit, also when that commit is older than the revision `--since` compares with; so does a record erased with its keys and its `.mnema/.gitignore` left. A `.mnema/` that holds no tail because `mnema init` failed half way, or because it was made by hand and every write went to the private tree, fails until a first write to the public tree founds it; running `init` again does not. In `verify --workspace`, such a project is refused, and `--allow-no-record` does not excuse it, since the project is there. The surfaces that show this verdict (the SDK's verify, the VS Code status bar) show the refusal. The Action already failed these records when the pull request removes the tails, through `--require signed` and `--since`, and its comment now quotes the reason by name; a repository where neither the base nor the head holds a segment is still reported by the Action as holding no record, and passes, as before. The text that today calls a record with no tail "indistinguishable from a fresh one" is corrected, because a fresh record holds the founding. What stays open, and stays said in the docs and in `--json`: one tail removed whole while another remains (both readers verify it, `--require signed` included), the newest events cut together with their checkpoint, a record erased and founded again, and a removal of that first kind committed before the revision `--since` compares with. Only a copy of the record from before (`--since <rev>`, a git remote) shows those. The external witness dates a checkpoint and keeps no copy, so it does not.

Turned down:

(A) Refuse every committed key without a tail: every machine and every agent enrolled before its first write would fail, and in a one-tail record deleting the keys with the tail would still read as a record with no events and pass. (B) Make the second reader say what the product says: the readers would agree, on "verified" over a record with no event left in it. (D) Pin the divergence as it stands: it pins exit 0 against exit 3 on the same bytes, and the second reader would still answer differently depending on whether a tail's proof survived. (E) A new exit code for the empty record: a script can let that code through, and both readers already give one exit for "what was asked for is not here". Refusing only where a committed key remains: deleting the keys too would bring the exit back to 0.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-19T19:02:03.796Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-23 · Publish the first version by hand, then let CI publish every later one through npm's trusted publishing accepted#

npm's trusted publishing can only be configured for a package that already exists, so the first version of the five packages is published by the maintainer from a terminal, logged in with two-factor authentication, from the tarballs packed at the commit the version names, in the order chain, core, context, stacks, code. That first version carries no provenance, since provenance is made only in CI. Right after it, a trusted publisher is configured for each of the five packages, pointing at this repository's release workflow, and every later version is published by CI through OIDC, with provenance and no stored token; the packages then require two-factor authentication and disallow tokens, as npm advises.

Turned down:

A short-lived token kept as a repository secret for the first run: a stored publishing credential for a single use, which the maintainer prefers not to create. Waiting for npm to allow trusted publishing of a package that does not exist yet: it blocks the first publication on a change nobody has announced.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-20T16:26:44.858Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

Supersedes ADR-9: Publish the first version with provenance, through CI (superseded).

ADR-24 · Version and release the packages by a script and a release workflow the maintainer approves accepted#

The version is one number held in nineteen places: nine package.json files, seven plugin manifests, the version constant, the help golden and the console recording. A script in the repository, run as pnpm release:prepare, proposes the next number from the changelog's Unreleased section (Added, Changed or Removed raise the minor while the line is 0.x, Fixed alone raises the patch, and a number can be given instead), writes it in every one of those places through the same finders the version guard uses, regenerates the golden and the recording, and cuts the changelog; the result is an ordinary pull request named Release x.y.z, reviewed and held by CI. When it merges, a release workflow builds, packs the five public packages and publishes them through npm's trusted publishing with provenance, waiting in a GitHub environment whose required reviewer is the maintainer; only after the publication does it create the tag vx.y.z and a GitHub release whose notes are that changelog section with a link to npm and no tarballs. No package.json, tag or release is edited by hand, the single hand-written changelog stays, and commit titles keep their style.

Turned down:

Changesets: it versions only the package.json files, so the other ten places would need the same script, and it writes a changelog per package that competes with the curated one. release-please or semantic-release: both read Conventional Commit prefixes, and semantic-release publishes on every merge with no person approving.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-20T17:45:05.090Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-25 · After the first publication, measure real use first, on a pilot of the maintainer's own repositories accepted#

The product was published with no use outside the repository that builds it, so what comes after the publication starts with the first real data. The organization pilot runs on eight of the maintainer's public repositories: the six safeaccess libraries (inline and identum, each in TypeScript, JavaScript and PHP), monitor-sefaz and notagrafo. Its first step only reads: how many rules are copied across their instruction files and how many copies have drifted, the baseline the pilot needs before anything is built. A local count of tool calls comes with it. The experiments that need a paid model wait for what the pilot shows matters.

Turned down:

Closing the declared proof limits first: they would be closed for a use nobody has yet. Porting another host first: one more host before knowing whether the first ones are used. Running the paid experiments now: they would measure before the pilot says what is worth measuring.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude at 2026-10-20T21:56:41.505Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

Notes

• Observation on First real-use pilot: results about 01a15b51-0f8f-7000-b5e1-f8e84eda982a, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T04:01:29.243Z

  Run on 20 and 21 October 2026 in safeaccess-inline and safeaccess-identum, one new Claude Code session per repository with the mnema 0.1.1 plugin, resolving their 13 Dependabot pull requests and three policy decisions each; the prompt never asked to record. Inline: 0 of 3 decisions recorded unasked; the agent said it did not record because the prompt asked to commit `.mnema/` as it was. Identum, with that phrase removed: 3 of 3 recorded unasked, each in the commit that implements it, plus one `record_observation` correcting the premise of one of them from the Dependabot log. `capture_memory` was used 0 times in both: what the agents learnt went to the host's own memory. Both agents protected `.mnema/` from prettier by hand. The edit hook ran on every edit (23) and found no addressed rule each time. Both records are committed and verified by the Python reader.

ADR-26 · mnema init writes a README into .mnema/ and keeps a declared formatter off the record accepted#

In the first real-use pilot both agents had to add `.mnema/` to `.prettierignore` by hand, because prettier and lint-staged would rewrite `tailproof.json` and break the signatures; and one agent read an instruction about the folder as "commit it as it is" and recorded nothing. So `init` creates `.mnema/README.md` (what the folder is, that it changes with the work and goes in the same commit as the work it describes, that nothing in it is edited or reformatted, that private keys are never in it, how to verify it), and, when the repository declares prettier (a `.prettierignore`, `prettier` in the root package.json, or a `.prettierrc*`), adds `.mnema/` to `.prettierignore` and says so. Running `init` again on a project that already has `.mnema/` adds only what is missing; `mnema doctor` points at both gaps. The README is outside the proof, like `.gitignore`, and both readers accept it.

Turned down:

Only printing the line to add, without touching the file: the person or agent that runs `init` is the one that would have to act, and the pilot showed they act by hand only after being burned. Warning in `verify` once the tailproof is already reformatted: catches the damage after it is done. Touching no file outside `.mnema/` at all: leaves the record exposed in every repository with prettier, which in the pilot was every repository.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T04:01:22.530Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

Notes

• Observation on The formatter detection also reads the project's own directory about 01a15c9e-efe5-7000-a8f6-5301fc66d65a, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T04:58:17.059Z

  The review of the first implementation (21 October 2026) found that prettier declared only in the package.json of a monorepo subproject, where `mnema init` ran, is not detected: the detection reads only the git root. The maintainer chose to have it read the mnema project's own directory as well, and to write `.prettierignore` where prettier reads it. It ships with the guard against the other formatters (ADR-32).

ADR-27 · A project initialized before the README gets it with its first signed write; only init edits .prettierignore accepted#

Upgrading mnema should not require remembering a command for every existing project. The README lives inside `.mnema/`, where every write already lands and which is committed with the work, so the first signed write in a project whose public record has no README creates it alongside, and the write's result says so. A read never creates it and a refused write never creates it: a connection that only reads leaves the repository as it found it, and a refusal leaves nothing. The repository's own `.prettierignore` is the person's file, so nothing edits it automatically: the session brief says, in one line, that a declared formatter can rewrite the record and that `mnema init` protects it.

Turned down:

Also adding `.mnema/` to `.prettierignore` on the first write: zero friction, but the product would edit a file of the person's without anyone asking. Leaving existing projects to a manual `mnema init`: every project recorded before the upgrade would stay without the README and unprotected until someone thought of it. Creating the README on any connection, reads included: breaks the promise that a read changes nothing.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T04:01:22.604Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-28 · The Cursor and VS Code edit hook may skip launching mnema only when no tree can hold an addressed rule, never on a cache accepted#

Measured on 21 October 2026 (sandbox, 50 runs, 0.1.1): in Claude Code the edit hook is an MCP call to a server already up, about 1 ms per edit, so nothing changes there; in Cursor and VS Code it is a process per edit, about 200 ms even when the project has no rule with an address, about 70% of it loading mnema. The handler may decide without loading mnema that no tree (public, private, global) holds a link that addresses a path, by scanning the stored lines for the link's literal marker, and skip; anything else, including an unreadable tree or an unknown format, runs mnema. A false positive costs the 200 ms of today; a false negative would let a write through without the rule, which is the one thing the hook exists to prevent.

Turned down:

A cache the writer keeps of whether rules exist: goes stale the moment a rule arrives by git pull or checkout without this machine writing anything, which is a false negative. Leaving the 200 ms: every edit in two hosts pays for a check that has nothing to check. Changing the Claude Code hook too: it already costs about 1 ms.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T04:01:22.663Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

Notes

• Observation on Cursor CLI capture: a write that a rule refuses went through about 01a15c9e-f0d3-7000-9bd0-fd87c98d5a80, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T16:06:12.114Z

  A capture of Cursor's command-line agent was run on 22 October 2026: cursor-agent 2026.09.18-9a7762b, Free plan, the default model, plugin 0.1.2 as installed. A rule refused writes under src/frozen/, yet src/frozen/x.ts was written through a Write tool use. No refusal was printed and no channel event was recorded. The two other write cases also showed no channel event, so they cannot tell a hook that ran and let the write through from a hook that never ran. The MCP server needed the host's approval before it loaded, and then served. This contradicts what docs/evidence.md and the host table say of the command-line agent, that it was read loading the plugin's hooks. The cause is not known: the hooks were not loaded, were loaded and not applied, or the plugin was out of the host's reach. The capture is one run per case, in PR 973.

• Observation on The Cursor CLI does load the plugin's hook; the capture's miss is unexplained about 01a15c9e-f0d3-7000-9bd0-fd87c98d5a80, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T16:15:07.688Z

  An investigation the same day used the same cursor-agent (2026.09.18-9a7762b) and plugin (0.1.2). It found that the agent imports Claude Code plugins from installed_plugins.json and runs the plugin's before-a-write hook with CURSOR_VERSION set. The nested deny answer is honoured, and the file was not created. Outside Cursor, the real handler with the real mnema 0.1.2 denies the write against a copy of the capture's own record, in about 0.25 s. So the earlier claim stands, and the capture's did-not-hold has no proven cause. One link stayed untested together: the real plugin with the real mnema inside Cursor. A candidate cause: edit-refuses-a-write.mjs catches every exception and answers an empty object. A failure inside the hook would then let the write through silently, which ADR-21 (a gate that cannot read the record refuses the write) does not allow. The capture case is re-run with mnema wrapped so its arguments, environment names and output are logged.

• Observation on Root cause: Cursor's bundled Node and a handler that fails open about 01a15c9e-f0d3-7000-9bd0-fd87c98d5a80, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T16:27:30.712Z

  An instrumented re-run of the refusing case in cursor-agent 2026.09.18 found the cause, with one model call. The plugin's hook was loaded and ran, and it called mnema with the preToolUse payload. mnema exited 1 at once with "mnema needs Node 24.15.0 or a later 24, or 26.0.0 or later; this is Node 24.5.0". cursor-agent puts its bundled Node 24.5.0 first on the hooks' PATH, and mnema starts through `#!/usr/bin/env node`. The handler edit-refuses-a-write.mjs caught the error and answered nothing. Cursor read that as allow, and the file a rule refuses was written. The same mnema with the same payload in a normal shell denies the write, naming the rule. Two defects for 0.1.3. First, a gate that cannot run must refuse, not allow, as ADR-21 says: the handler answers deny with the reason when mnema fails. Second, the plugin's hooks must not depend on whichever node comes first on the host's PATH. The doctor and capture docs should name the bundled-Node case.

ADR-29 · Batch the small ready work into 0.1.2 instead of releasing it a little at a time accepted#

The work since 0.1.1 (the tag that waits for npm, the local tool-call count, the README and formatter protection, the automatic README, the held text debts, the scanners and the guard mutation, the refused inputs, the Cursor and VS Code hook shortcut) is small, changes no format, and can be reviewed one pull request at a time; releasing each piece separately would be several versions in a few days. It stays a patch version, 0.1.2, as the maintainer chose: the first minor after 0.1.0 is kept for a step the users would notice as one.

Turned down:

0.2.0 because new commands and options arrive: semver would allow it in 0.x, but the maintainer judged that a minor so soon after the first publication reads as more change than there is. A release per pull request: several versions in days, each with its own approval in the npm environment.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T04:01:22.723Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-30 · The agent accepts the decisions the maintainer dictated in the session; what the agent proposes alone waits for the maintainer accepted#

On 21 October 2026 the maintainer ran `mnema decision move accept` five times in a day, across three repositories, copying 36-character ids, each time for a decision he had himself just chosen in the conversation: the acceptance added friction and no judgement. The switch `agent-accepts` is on in this repository, and an acceptance made through the MCP is recorded as the agent's and marked so wherever it is read, so the record stays honest about who acted. So when the maintainer dictates a decision (answers the question that settles it), the agent records it and accepts it at once, with a note that quotes his answer. A decision the agent proposes on its own judgement still waits for the maintainer's own `accept`, signed with his key.

Turned down:

The maintainer accepting every decision with his own key: the strongest proof of assent, but in practice it was double work on decisions already his, and the cost falls on exactly the decisions that need it least. The agent accepting everything it records: loses the line between what the maintainer chose and what the agent concluded, which is the line a later reader most needs.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T04:03:52.163Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-31 · Run the second real-use pilot on monitor-sefaz after 0.1.2, with product decisions as the work accepted#

The first pilot measured agents on CI policy and dependency updates in two repositories of one family. monitor-sefaz differs on every axis the first round left open: another stack (pnpm and turbo, an app), Portuguese, no commitlint, a declared prettier (the first test of the 0.1.2 init protection), an empty AGENTS.md, and above all a product study whose outcome is a set of scope decisions with real alternatives (which fiscal documents enter a first phase, whether the panel's model becomes document, state, authorizer, environment and service, what to do with NFS-e). That is the kind of decision mnema exists to keep. The session resolves the open Dependabot pull requests, refines the coverage study against primary sources and the code, and stops at the scope decisions; implementing new documents waits for an accepted study. It runs after 0.1.2 so the local tool-call count is measured for the first time. The study stays out of git, as the maintainer chose.

Turned down:

notagrafo as the second repository: an AGENTS.md generated by the old alpha would confound what the agent reads. Refining the study before the pilot: the research and the choices it forces are the part that tests recording, so doing it outside the pilot removes the material. Implementing the first phase in the same session: a much larger session whose code would dominate what is measured.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T04:17:00.537Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Notes

• Observation on Second pilot paused until 0.1.3 about 01a15cad-3cc5-7000-9390-122594843f93, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T20:59:08.911Z

  The second real-use pilot, on 0.1.2, stopped on 21 October 2026 after its study phase, by the maintainer's choice. It resumes, and the work of its plan runs, only once 0.1.3 is released. What it measured so far, with no instruction block in the repository: the agent made zero calls to mnema's tools in the whole session. It wrote a structured plan holding eight product decisions, each with options, a recommendation and a gate, into its own study file and nowhere in the record. The host memory mirror copied the two notes the agent wrote to Claude Code's memory into the private tree, and the session was told. No hook caught the choices made in chat. This is the baseline. Running the plan's work on 0.1.3, with the instruction block of ADR-46 and the session layer of ADR-48, gives the other arm of the measurement ADR-47 requires before 0.1.3 ships. Because the plan is executed only after the release, that arm measures the released 0.1.3.

ADR-32 · Guard the record against the other tools that rewrite files: an .editorconfig inside .mnema/, warnings for the rest, and a verify that names a reformat accepted#

Prettier is the most common of a class: tools that rewrite files nobody looks at. EditorConfig-aware editors add a final newline, trim trailing space or change line ends on save; the pre-commit framework's end-of-file-fixer, trailing-whitespace, mixed-line-ending and pretty-format-json hooks rewrite at commit; Biome and dprint format JSON without reading .prettierignore; lint-staged can run any of them on staged `.mnema/` files. Any of these breaks the signatures. So: `init` (and the first write, as with the README) writes `.mnema/.editorconfig` that unsets the parent's rules, inside the record's own folder like `.gitattributes`, touching no file of the person's; `doctor` and the session brief detect a pre-commit config, Biome, dprint or lint-staged that reaches `.mnema/` and say the line to add to each, editing nothing; and `verify`, when a stored line differs from its canonical form only by space, line end or formatting, says a formatter rewrote it and how to restore it, instead of only failing. What a reader accepts does not change.

Turned down:

Having init also edit each of those tools' configuration, as it does `.prettierignore`: less friction, but it would edit YAML and JSON-with-comments configuration files of several tools whose formats change between versions, on the person's behalf. Covering only prettier: leaves the record exposed to the next tool, which the first pilot showed is found only after the damage. Only the verify diagnosis: catches every tool but always after the bytes changed.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T04:54:54.711Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Notes

• Observation on The formatter diagnosis must be conditioned on the proof about 01a15ccf-f2e7-7000-80ff-fa45f2bcfd4a, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T07:34:53.578Z

  The adversarial review of the first implementation (21 October 2026) showed that comparing a stored line only with its own canonical form lets a tampering pass as a reformat: change a value, add one space, and both readers said "a formatter or an editor did this", while the TypeScript reader's single issue hid the hash that no longer matched. The diagnosis is therefore said only when the canonical form recomputed from the reformatted line matches what was signed (the entry's chained hash; the signature of a checkpoint or tail proof), and a hash or signature mismatch is always reported beside it. What a reader accepts does not change; only which reason it gives.

• Observation on The verify diagnosis is held back from 0.1.2 about 01a15ccf-f2e7-7000-80ff-fa45f2bcfd4a, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T09:03:24.212Z

  Three adversarial reviews on 21 October 2026 blocked the verify diagnosis in turn: comparing a line with its own canonical form let a tampering pass as a reformat; confirming it with the line's own stored hash let a tampering that recomputed that hash pass; and re-reading a canonicalised copy of the whole record on disk, the design that closed both, made a read write through a symlink inside `.mnema/` into a file of the person's (and failed without a verdict when TMPDIR was missing or empty). The orchestrating session took the diagnosis out of the 0.1.2 pull request: the `.editorconfig` inside `.mnema/` and the warnings about pre-commit, Biome, dprint and lint-staged ship; the diagnosis comes back as its own design that reads the canonical form in memory and copies nothing to disk. Both readers stay exactly as they are until then.

ADR-33 · When the plugin and the binary disagree on version, the hook, the brief and doctor say so with the command that fixes it accepted#

A newer plugin with an older binary leaves the edit hook silent: the binary refuses a flag the plugin passes and nothing reaches the person or the agent. Upgrading to 0.1.2 makes this likely, because the binary (npm) and the plugin (the host's plugin manager) are updated separately. So the hook says in one line, on the channel the host shows, that the two do not match and which `npm i -g @mnema/code@<version>` brings the binary level, without blocking the agent's write; the session brief says the same when it detects it; and `mnema doctor` compares the installed plugin's version with the binary on the PATH. The compatibility rule comes from what the plugin actually passes to the binary: an older binary is the case that breaks.

Turned down:

Leaving it to the release notes: the person who updates one half never reads them at the moment the hook goes quiet. Having the plugin refuse to run with a mismatched binary: turns a silent degradation into a hard stop for the agent, where a line that names the fix is enough. Bundling the binary inside the plugin: two copies of mnema on one machine, with the identity and key questions that brings.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T04:58:16.874Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-34 · Check the external links of docs/ after each merge and run the dependency advisory scan weekly accepted#

The post-merge link job checks only the READMEs' external links, so a link in docs/ can rot unnoticed; and the advisory scan runs only on pull requests and pushes, so a new advisory against an unchanged lockfile waits for the next dependency change. Both gaps were found when the scanners entered CI on 21 October 2026. The link job extends to docs/ with the care it already has (after the merge, never blocking a pull request on the network), and osv-scanner gains a weekly schedule.

Turned down:

Checking docs links on every pull request: a pull request would fail for a third-party site being down. Relying on Dependabot alerts alone for advisories: they cover what GitHub's database maps to the manifest; osv-scanner reads the lockfile and other sources, and it is already in CI.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T04:58:16.964Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-35 · mnema is always in the equation: it records alongside the person's own notes, ledgers and the host's memory, even when that duplicates them, in every host accepted#

The first real-use pilot and the maintainer's own planning session showed one pattern three times: mnema loses whenever a richer channel already exists. The inline agent kept what it learnt in the host's memory and recorded nothing; the planning session wrote its decisions into its own bench (handoffs, the alignment file) and recorded them only when asked, twice in one day; the identum agent recorded 3 of 3 because it had nowhere else to put them. A user will almost always have such a channel: a plan, a ledger, an ADR folder, CLAUDE.md, the host's memory. So the product does not ask the person to give it up and does not wait for it to be absent: mnema takes part in the work beside it, at the moments the work already passes through (a choice settled in a question, a note written to the host's memory, a plan or decision file written, a handoff to another agent), and is read back where the work reads, so recording pays for itself in the same session. Duplication with the person's own notes is accepted: the record is the signed, append-only, verifiable copy, which the others are not. This holds for every host and every surface mnema covers, each through the channel that host offers.

Turned down:

Treating mnema as the replacement for the person's own notes and asking them to move: the pilot showed people and agents keep their channel by habit, and a record that exists only when the habit breaks is empty. Avoiding duplication by recording only what no other channel holds: makes mnema the leftover, and a decision that lives only in a ledger or a host's memory is neither signed nor verifiable nor shared with the clone. Relying on the instructions alone ("record as the work happens"): the pilot and the planning session both had them and still did not record.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T05:03:21.949Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Notes

• Observation on The maintainer's direction beyond presence about 01a15cd7-aff8-7000-be29-418059dd0d4a, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T05:05:50.563Z

  On 21 October 2026, choosing the presence mechanisms, the maintainer went further: mnema should be the center of everything for the user, all the time, for everything and for everyone ("o mnema deve ser o centro de tudo para o usuario, deve ser tudo que o mnema precisa o tempo todo para tudo e para todos"). The presence study is to take this as its north: every moment a person or an agent decides, learns, plans, hands over or asks why, on every host and surface (MCP, CLI, hooks, the CI Action, the VS Code extension, the SDK), and say what mnema does at each.

ADR-36 · 0.1.2 carries the presence front complete, in every host, even if the release slips accepted#

The maintainer chose to ship ADR-35 whole in 0.1.2 rather than split it into a later round: a release that measures and fixes how agents use mnema (the pilot findings, the init, the hooks) would be incomplete without the part that makes mnema present at the moments the work passes through. The front covers, for every host mnema supports and through the channel each one offers: the moment a choice is settled (a hook after the question tool in Claude Code, a reading of the turn at Stop where there is no such tool) proposing `record_decision`; the host's own memory mirrored into `capture_memory`, duplicating on purpose; a plan, ledger, ADR, CLAUDE.md or AGENTS.md written with decision-shaped content proposing to record alongside; one sentence in the server instructions saying to record here even when notes are kept elsewhere; and briefs and handoffs that cite and read the record back. It starts with a map of host by moment by channel. The release may slip for it.

Turned down:

The two cheapest Claude Code hooks in 0.1.2 and the rest later: covers one host and leaves the principle half-applied in the release that introduces it. A separate 0.1.3 round before the second pilot: keeps 0.1.2 on time, but the maintainer judged a short delay worth a complete release.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T05:05:50.460Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-37 · How mnema is present at the moments of the work in 0.1.2: a fact after a settled question, the host's memory mirrored privately, a line beside decision files, and the instructions and subagents accepted#

Applies ADR-35 and ADR-36 from the presence study of 21 October 2026, which mapped every supported host by moment and channel. After a question to the person is answered (Claude Code `AskUserQuestion`, Copilot `ask_user`, Codex `request_user_input`, Gemini `ask_user`, OpenCode `question`), a post-tool hook adds one factual sentence to the agent's context that the choice is not in the record and `record_decision` keeps it; it records nothing, so it is on by default under a switch of its own. A note the agent writes into the host's own memory directory is mirrored, deterministically and without asking the agent, into this machine's private tree as a memory, deduplicated by a content hash, leaving out the host's index and the notes about the person; whether this mirror is on by default is left to the maintainer. A plan, ledger, ADR or instructions file written with decision-shaped content gets one line naming the command that records or imports it, once per file per session, and nothing is written to the public record by it. The server instructions gain the sentence to record here even what is kept elsewhere, within the 2,048-character ceiling by two measured cuts. A subagent receives the session brief when it starts. Hosts whose channel is documented but not measured are wired and labelled as not measured.

Turned down:

Recording a proposed decision on its own after every answered question: it would read the person's words into the record by default, and the existing reading of corrections starts off for that reason. Only suggesting `capture_memory` when the host's memory is written: the pilot showed it used 0 times in 2 sessions. Mirroring the host's memory into the public record: that memory is private to the machine. Adding a hook-only MCP tool: grows the 27 definitions every session pays for. Asking for one more turn at Stop: an extra model turn after every reply.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T05:20:59.595Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-38 · The repository's prose guards do not read the signed record in .mnema/ accepted#

On 21 October 2026 the record pull request for the 0.1.2 round failed `a-label-a-stranger-can-look-up`: an acceptance note quotes the maintainer verbatim, and his words contain a word the guard keeps out of the repository's prose. The record is append-only and signed: that line cannot be edited or dropped without breaking the chain, and every later record pull request carries it. A prose guard over the record can therefore only make the record uncommittable; it cannot make it read better. The record holds people's words as they were said, and what must never enter it (credentials, personal data) is already held by the content screen at every door. So the guards that police the repository's own prose (labels a stranger cannot look up, and the others of their kind) skip `.mnema/`, as they skip generated files; the product's own pages and code stay under them.

Turned down:

Rewriting or dropping the line: impossible in an append-only signed record without breaking verification. Avoiding the word in future notes only: the line already recorded still blocks every record pull request. Weakening the guard everywhere: the product's pages would lose the check they need.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T09:44:37.528Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-39 · The host memory mirror is on by default accepted#

The maintainer chose, on 21 October 2026, that a note an agent writes into Claude Code's own memory is copied into this machine's private record from the start, not only after someone switches it on. The first real-use pilot showed that what agents learn goes to the host's memory and never to mnema (capture_memory used 0 times in 2 sessions), and ADR-35 puts mnema in the equation even when that duplicates; a mirror that starts off would leave every new installation where the pilot found it. The copy stays private to the machine, screened like every other note (credentials and email addresses replaced), only for this project's memory directory, never the host's index nor the notes about the person, deduplicated by content; `mnema switch off host-memory-mirror` stops it.

Turned down:

Starting off, as channels that write without a verb have so far: safer by precedent, but the mirror would reach almost nobody, which is the failure the pilot measured. Mirroring into the public record: the host's memory is private to the machine.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T11:41:17.010Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-40 · Private and global links keep accepting any path; only the public tree refuses a target outside the project accepted#

The refusal of a link target outside the project exists so that a path of one machine (a home directory, another repository) is never committed and cloned; the public tree already refuses it. The private and global trees never leave the machine: a private note pointing at a local configuration file, or a global rule that spans projects by nature, are legitimate, and the documented promise says these trees accept any path. Refusing there would break that promise for no protection gained. The draft change that refused targets outside the project in every tree is closed.

Turned down:

Refusing in every tree: consistent, but it breaks a documented promise and the personal uses it serves, without protecting anything that leaves the machine. Refusing only in the private tree: the private tree is per project, but a private note may still legitimately point outside it.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T11:45:03.309Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-41 · Study whether any honest writer appends to another key's tail, and tighten the format only if none does accepted#

An adversarial review on 21 October 2026 found that FORMAT §6 does not bind a tail's later checkpoints to the tail's own key: any enrolled key, including a checker key, can append signed events and checkpoints to another key's tail and every reader accepts them. Authorship is not forged, but the ownership of a tail is proven only at its birth. Whether to refuse this depends on a fact not yet established: whether the product's own writers ever append to a tail that is not their key's (an agent writing into the person's tail, a restored or second key). So a read-only study answers that first; if no honest writer does it, a format change makes both readers refuse an event or checkpoint signed by another key in a tail, with a named refusal (ADR-3). It is not part of 0.1.2.

Turned down:

Accepting it and only documenting it as a declared limit: honest, but leaves a gap in what the record proves about a tail. Tightening the format at once: could refuse records the product itself writes, if some writer does append to another key's tail.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T11:45:03.351Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Notes

• Observation on The study's answer: no honest writer appends to another key's tail about 01a15e47-736b-7000-8213-47d1c2d887a2, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T11:52:33.433Z

  The read-only study of 21 October 2026 found that every write to the chain goes through one writer, which derives both the tail id and the signing key from the same key pair (`packages/chain/src/chain/writer.ts`, the tail id is the key's fingerprint and an installation id), a derivation that predates 0.1.0. An enrolled agent writes its own tail, a checker writes its own tail, a restored key writes a new tail under the same fingerprint, and a second machine writes its own; witness, inherit and the worktree move sign nothing in the chain. Probes of all those cases in a sandbox, and a scan of this repository's record and the committed fixtures, found no event or checkpoint whose signer differs from the tail's key. So the format can require it: a checkpoint's signer, and every event's, is the key the tail id names, refused by name otherwise and checked for every event, not only those inside a checkpoint's range. No honest record written by 0.1.0 or 0.1.1 would be refused. The change waits for after 0.1.2.

• Observation on The tail-signer rule shipped about 01a15e47-736b-7000-8213-47d1c2d887a2, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T01:49:54.983Z

  The rule is now in FORMAT section 6 and in both readers and the browser page. A checkpoint's signerFp, and that of every event of a tail, must be the fingerprint the tail id begins with; otherwise the record is refused as tail-signer-mismatch, in the same words by all three. Before the change, a second enrolled key that really signed a checkpoint, or an event above the last checkpoint, in another key's tail was accepted by all three readers. After it, all three refuse. An adversarial review wrote one record across 0.1.0, 0.1.2 and the change. It held a passphrase key, a restored backup, a checker, an agent key enrolled then retired, an agent without a key, an import and a prune, and nothing honest was refused. Verify time on a 4.5k-line record stayed at about 0.82 s. An event above the last checkpoint that names the tail's own key still stands as not yet signature-covered (section 6.2).

ADR-42 · Both readers refuse a committed key whose file name does not match its key material accepted#

A file in `keys/` whose name is not the fingerprint of the key it holds is never produced by the writer; it appears only by mistake or tampering. FORMAT §6 has the reader recompute a fingerprint from the key material, and the Python reader already refuses such a file, while the TypeScript reader and the browser verifier only note it as a key without a tail. Two readers must give the same verdict on the same bytes, so the TypeScript reader and the browser verifier refuse it too, by name.

Turned down:

Both readers accepting it as a notice: an unused key does not change what is proven, but a mislabelled key in a signed record is exactly the kind of inconsistency a verifier exists to name.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T11:45:03.392Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Notes

• Observation on The TypeScript reader accepts unknown keys the Python reader refuses about 01a15e47-7395-7000-833e-d91cfd60c409, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-23T12:21:06.354Z

  Found on 23 October 2026 by an adversarial review of the verify reformat diagnosis, and outside that change. The TypeScript reader accepts unknown keys in an entry's envelope, in a link, in a checkpoint and in a tailproof (packages/chain/src/chain/entry.ts:121 and the checkpoint and tailproof readers). A record carrying them reads "local integrity verified" with exit 0. The Python reader refuses all four (sections 4 and 6). The two readers therefore disagree on the same bytes, and unsigned data can sit inside a record the product calls verified. It is fixed in its own change before 0.1.3, so that both readers refuse an unknown key in every signed or chained structure, by name.

ADR-43 · Every change that alters what a user can do updates the README pages in the same pull request accepted#

The maintainer asked on 21 October 2026 that the README pages always stay current. The root README and each package's README are the pages a stranger reads first (the npm page of `@mnema/code` is its README); a feature that ships while the README still describes the previous behaviour makes the page say something false. So a pull request that adds, removes or changes a command, an option, a default, a hook, a channel or a promise updates the root README and the README of every package it touches in the same pull request, alongside the CHANGELOG and `docs/`, keeping each README as short as it is meant to be and in its established form.

Turned down:

A documentation pass before each release: the pages are wrong between merges, and a pass at the end forgets what a pull request knew. Updating only `docs/` and the CHANGELOG: the README is the page people actually land on.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T11:46:02.471Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-44 · Study making mnema's use a standing rule in the instruction files every host reads (AGENTS.md and its kin) accepted#

Watching the second real-use pilot on 21 October 2026, the maintainer concluded that without a rule that makes mnema's use mandatory at every action, an agent simply does not use it; the server instructions and the hooks at the moments of the work (ADR-35, ADR-37) are not enough on their own. The files hosts read as standing instructions (AGENTS.md for Codex, Cursor, Copilot and others, CLAUDE.md for Claude Code, GEMINI.md for Gemini CLI, the rule folders of Cursor and Copilot) are where a project states how work is done there, and an earlier version of the product wrote a block into AGENTS.md that this version dropped. A study decides what such a block says (a fact or a rule, how strong, how short), who writes and refreshes it (`init`, a verb, the brief), how it coexists with the person's own content in a file that is theirs, its cost in tokens on every session, and how the next pilot measures it against the run without it.

Turned down:

Relying on the server instructions and the hooks alone: the pilots so far show agents keep their own channel by habit. Writing into the person's instruction files without a study: edits a file that is theirs and that every host loads every session, so its wording, size and ownership need deciding first.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T19:37:31.795Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-45 · Study a session layer run by the host's harness: a session journal, surviving compaction, a warm cache, and every mnema action driven by hooks, all disposable, fast and cheap accepted#

Three pilots and the maintainer's own sessions show that an agent never calls mnema for memory and seldom for decisions; the host memory mirror, the first action driven by the harness instead of the agent, worked at its first real use on 21 October 2026. The maintainer asked that mnema always run in the host's harness: what depends today on the agent choosing to call a tool moves to the host's hooks wherever the host offers the channel; the hooks keep a journal of what a session did, decided and learnt, from the transcript, in the private tree, for the next session to open with; what was at stake survives the host compacting the context (before the compaction mnema keeps it, after it mnema hands it back); and the record's projections stay warm between calls and sessions. A session cache is disposable, low-latency and low in tokens: rebuilt from the record when lost, never a second source of truth, never in the public tree, and measured in milliseconds and tokens per event before it ships. The study decides what each part keeps, when each hook runs, its cost per host, and what a session journal must never hold.

Turned down:

Keeping mnema an MCP server the agent calls when it remembers: three pilots show it is not called for memory and seldom for decisions. A journal that records everything the session did: a log of every step is what the record refuses, and it would cost tokens on every opening. A cache that becomes a source of truth: it would need the guarantees the signed record already gives.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T19:42:19.416Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-46 · mnema's standing rule goes into every host's instruction file, in the complete text, written at init and by a verb accepted#

The study of 21 October 2026 (ADR-44) found that the alpha wrote an imperative block into AGENTS.md, that the current version dropped it on principle and without a measurement, and that the one measurement there is (16 September: a written instruction produced the gesture the same day after five sessions with none) points toward having it; three pilots since show agents do not use mnema on their own. The maintainer chose: the complete text (record a settled choice with its reasons and what was turned down, even when it is also kept elsewhere; record what is learnt that the code does not show; check the rules before changing a file; open with `bootstrap`; a decision is born proposed and a person accepts it; a subagent hands its decisions back; the shell command when the tools are not connected; what never goes into the record; commit `.mnema/` with the work), conditioned on the mnema tools being connected so a fork without mnema reads it as inert. It goes everywhere a host reads standing instructions: AGENTS.md always (created if missing), CLAUDE.md and GEMINI.md when they exist, a file of its own under `.claude/rules/`, the Gemini extension's own context file, and each host's own instruction files (Copilot's, Cursor's) as those hosts read them, with the copies kept identical so a host that reads several does not pay for divergent text. `mnema init` writes it when it founds a project and says so; `mnema instructions [--check|--remove]` writes, checks and removes it in an existing project; a block whose text the person edited is refused and reported, never overwritten; a block the person removed is not put back by a repeated `init` (`doctor` says so). The block is the person's act, not a channel of the record, since a committed file cannot obey a switch; it is put in by one act and taken out by another. The alpha's block in notagrafo, which names tools that no longer exist, is replaced by the verb. The effect is measured by an A/B on one commit of monitor-sefaz after the second pilot round closes.

Turned down:

The short rule with three triggers: cheaper per session (about 220 tokens against 345), but the maintainer wanted the opening, acceptance and subagent parts said too. Only AGENTS.md: Claude Code ignores it when a CLAUDE.md exists, and other hosts read their own files first. Only a verb, never at init: what depends on someone remembering is what the pilots show does not happen. A pure fact with no imperative: the pilots show facts alone do not move the agent.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T19:48:28.452Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-47 · 0.1.3 carries both themes, mnema used on its own and the open proof work, and ships only with its whole scope and the measurement accepted#

The maintainer set the scope of 0.1.3 on 21 October 2026. Mnema used on its own: the standing rule in every host's instruction file (ADR-46) and the session layer run by the harness (ADR-45). Proof: a tail written only by the key it names (ADR-41), the verify diagnosis read in memory without a disk copy, the Python reader refusing malformed `keys/` entries instead of crashing, the agent key accepted as a member where it is unknown and a retirement that holds only where it was written, and the writer under concurrency. With them: the small debts left by 0.1.2 (a guard tying the pages' hook count to the hooks file, the test near its 5-second ceiling, the tool-call count off the answer path), the lazy cold read with many projects, the organization layer (ADR-17, ADR-20; the first pilot gave one concrete case), the real captures of Cursor's editor and Antigravity and the port of Qwen Code (ADR-7), and whatever a full sweep of the open items in the maintainer's planning notes and in the project still finds. The version ships when the whole scope is in and the effect of the standing rule and the session layer has been measured against the second pilot.

Turned down:

One theme per version (0.1.3 for use, 0.1.4 for proof): smaller releases, but the maintainer preferred one version that closes both. Shipping as soon as the pull requests land and measuring afterwards: the measurement would no longer decide what ships.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T20:00:23.667Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-48 · The session layer: a disposable journal, a warm cache of the project's own trees, the subagent handback off by default, and compaction re-fed from the journal accepted#

The study asked for by ADR-45 measured the session layer against the "disposable, fast and cheap" bar, and the maintainer settled its four open questions.
(1) The journal of what a session did with the record is a derived, unsigned, disposable file under the mnema home, one per project and session. It records ids recorded, notes mirrored, questions answered with no decision after, and decision files written and not cited. It never holds prompt text, tool output, diffs or the chosen answer. The next session's recall carries "where the last session stopped" in about 100 tokens. The channel is on by default and can be switched off. No new event kind and no format change.
(2) The MCP server opens the project's own trees through the projection cache the CLI and the hooks already keep, refreshed on open. On a 4.5k-line record the cold read drops from about 250 to about 39 ms; with ten projects, the schema template and the end of the double schema check take it from about 86 to about 51 ms. The read-only promise of the read tools gains a written exception for this derived cache, as it already has for the tool-call count.
(3) The SubagentStop handback that records the subagent's block as a private proposed decision ships, switched off by default, as user corrections are.
(4) PreCompact stops running the tally, because Claude Code discards a PreCompact systemMessage, so the process (about 0.4 s) delivered nothing. A SessionStart hook with the compact matcher re-injects from the journal what the session recorded before compaction, in 60 to 120 tokens.

Turned down:

A signed private event for the journal (run.ended outcome or a new kind): turned down. It costs a writer and 7 to 33 ms on every Stop, grows forever, and tends to become a log of steps, which the record refuses. Keeping only the schema fix and no read-only exception: turned down, because a large record would stay at 250 ms cold. The handback switched on by default: turned down, because an automatic write by the harness produces noisy proposals the person must reject. Keeping the PreCompact tally: turned down; it is measured to deliver nothing.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T20:35:00.392Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-49 · Make what mnema can do, and above all what ships switched off, discoverable at once to the person and to the agent: in the CLI, in the MCP and in the docs accepted#

The maintainer asked for it in this session. Several capabilities ship off by default: the first-write gate, the proposals from a person's corrections, and the subagent handback proposal of ADR-48. Others are on but reached only by a verb nobody is told about: the decision review, the tool usage count, the browser verifier and the instructions verb of ADR-46. Today `mnema switch` lists the fourteen channels with their state, but only to someone who already knows to run it. The agent is told nothing about what is switched off, and the docs scatter switches across six pages. A capability nobody finds is one nobody uses, and the pilots measured that agents and people use only what is put in front of them. The goal: the person and the agent learn, almost at once and without searching, what is available, what is off, and the one command that turns it on. That holds in the CLI output, in what the MCP hands the agent, and in one docs page. It is studied first, as the other 0.1.3 themes are, and kept within the token budget shared with the brief, the recall, the journal and the instruction block.

Turned down:

Leaving discovery to `mnema switch` and the docs as they are: turned down, because nobody is pointed at them. Switching everything on by default to avoid the problem: turned down, because the features that are off write on the person's behalf or hold a write, and stay off by choice (ADR-48 keeps the handback off).

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T20:36:17.911Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-50 · 0.1.3 also carries the small open items on proof and readers and a CI job on Windows and macOS; the organization layer waits for its six questions, and the Cursor and Antigravity captures are run by the maintainer from a script accepted#

A sweep of every open item found about 45 that lie outside the themes ADR-47 names, and the maintainer settled which of them enter.
Entering: the small items that touch the proof or the readers. These are the TypeScript reader hiding the rest of a tail's issues once it refuses a line, a relative common directory reached through a symlink sending the core to the wrong private tree, linting and packaging the Python verifier, a stale comment in the release workflow, and the uncut skills list in bootstrap. Also entering: a CI job on Windows and on macOS. No job runs outside Ubuntu today, while the install page names both systems.
The organization layer stays in 0.1.3, but nothing of it starts until the maintainer answers the six open questions of its base study, brought to him once the first two waves are under way.
The Cursor IDE and Antigravity captures need his own accounts and editors. The capture script is fixed first: it lists the plugins before it isolates the home directory. He then runs it from a step-by-step guide.

Turned down:

Only the small proof items without the cross-platform CI: turned down by the maintainer, since the install page promises Windows and macOS and nothing proves them. Every small item including docs and satellites, or none: turned down. Moving the organization layer out of 0.1.3: turned down. Dropping the captures, or keeping only Cursor: turned down.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T20:40:13.780Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-51 · mnema instructions refuses to write through a symlink that leads outside the project accepted#

The instructions verb and init write into files the person owns. When CLAUDE.md or AGENTS.md is a symlink whose target resolves outside the project, or a dangling one, writing through it would change, or create, a file mnema was never pointed at. Refusing with the path keeps every write inside the repository the person ran mnema in. A symlink that resolves inside the project is followed as today.

Turned down:

Following every symlink: turned down, because a review probe showed the block written into a file outside the repository and a dangling link creating a new file there. Refusing every symlink: turned down, because a link inside the project (CLAUDE.md pointing at AGENTS.md is common) is the person's own arrangement and harmless.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T21:13:33.202Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-52 · mnema instructions does not recognize the alpha's old instruction block; the new block is added beside it accepted#

The alpha wrote its block between other markers, and generated what lay between them from the project's name, key and description, one of four workflows, a feature switch, the memory path and the whole memory index pasted inside. The template changed across at least ten commits. No finite list of those bodies exists to compare byte for byte. Replacing whatever lies between the old markers deleted a person's own text in review: an end marker inside a code fence took a team rule with it. The maintainer chose that mnema leave the old markers alone entirely. The new block goes in beside the old one, and the person removes the old one when they wish. mnema then never deletes text it did not write itself, in this version's markers.

Turned down:

Refusing to write while the old block is present, and telling the person to delete it by hand: turned down by the maintainer. Recognizing the old block by its shape (its fixed heading and trunk) and replacing it: turned down, because it would still delete whatever the person had written inside the old block.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-21T21:49:39.915Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-53 · The organization-layer pilot writes each repository's agent rules first, takes its rules from felipesauer/.github, and spans two families of the maintainer's repositories accepted#

The base study of the maintainer's repositories found zero agent rules to measure against: one empty AGENTS.md and one written by the alpha. The maintainer settled the four questions that held the pilot back.
(1) Each repository's own CLAUDE.md/AGENTS.md is written first. That copy in every repository is the control arm, and drift is then measured against the rule inherited from the organization.
(2) The source of the organization's rules is the felipesauer/.github repository, the place GitHub itself uses for what holds across an account.
(3) Two families enter: the safeaccess family (English, one stack), and monitor-sefaz with notagrafo (Portuguese, pnpm), each with rules of its own. The pilot then measures whether inheritance works across families that differ.
(4) The empty AGENTS.md of monitor-sefaz is empty by accident. It receives mnema's block through `mnema instructions` when that pilot resumes on 0.1.3. The alpha's old block in notagrafo is removed by hand by the maintainer before the pilot, since mnema itself leaves it alone (ADR-52).

Turned down:

Measuring from zero, with no control arm: turned down, because nothing could be compared. safeaccess-inline or a new repository as the source: turned down in favour of the account's own .github repository. Only the safeaccess family: turned down by the maintainer, who wants inheritance measured across two families. Keeping the empty AGENTS.md empty on purpose: turned down; it conflicts with the measurement of ADR-46, which needs the block in the repository.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T03:08:04.927Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Linked to: amends01a178c1-7339-7000-a8b7-9c93899b74b2

Notes

• Observation on The two open rules of safeaccess-identum about 01a16194-817a-7000-9059-d294ad80e4a8, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T15:53:07.154Z

  The maintainer settled the two questions the base study left open for safeaccess-identum.
  - Its contributing guide promises husky and commitlint, which are not installed. They will be installed, so the commit-message rule becomes a check the pilot can measure an agent against.
  - The coverage floors, 99% of lines and an 85% mutation score indicator, are both intentional. The 85 gets a comment saying so, and both become rules of the safeaccess family.

ADR-54 · How mnema shows what ships switched off: a short summary for a bare `mnema`, the off channels named in bootstrap and init, and one generated docs page accepted#

The study asked for by ADR-49 measured every door. None says what ships switched off or the command that turns it on, except `mnema switch`, and even it never prints `mnema switch on <name>`. The docs copy its output by hand and already disagree with it, saying 14 channels and listing 12. The maintainer settled the four open questions.
(1) A bare `mnema` prints a short summary instead of the whole help: what mnema does, this project's state, what is off with the command that turns it on, and three next steps. It exits 0 and points at `mnema --help` for every command.
(2) The bootstrap answer names what is off on this machine, from the effective state, and says only a person turns one on, with `mnema switch on <name>`. That costs about 43 tokens a session, and only when the agent calls bootstrap. The channels that start off write or hold on the person's behalf, so the sentence keeps the agent from switching one on itself.
(3) The init output carries the same two lines before its next steps.
(4) One new page, docs/switches.md, generated from the channel table in the code, and checked by a guard that lights when the page and the table disagree. The other pages point at it, and the hand-copied listing in the command reference is generated the same way.
The server instructions, the bootstrap tool description and the committed instruction block stay as they are: the first two are within 35 and 26 characters of their ceiling, and a committed file cannot follow a machine's switches.

Turned down:

Keeping the whole help with exit 1 and two lines appended: turned down for a summary. Naming the rarely found verbs (decision review, site, usage --tools) in bootstrap as well: turned down, it doubles the per-session cost. Not telling the agent at all: turned down. Leaving init as it is: turned down. A section inside features.md instead of a page: turned down.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T04:03:49.068Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-55 · A file in keys/ that holds no Ed25519 public key is refused by both readers, by name accepted#

A committed keys/ entry that is not a file, is not UTF-8, holds no PEM public key, holds a body that is not base64, or holds a key that is not Ed25519 used to split the two readers. The TypeScript reader verified the record with a note. The Python reader crashed with a traceback on some cases and refused on another. A reader that crashes proves nothing, and two readers that disagree on the same bytes break the promise that anyone can check the record with either. Both readers now refuse such a file under FORMAT section 6, in the same words, with the reason. The ground is the same as for a misnamed key (ADR-42): its name stands for a key the file does not hold. Records written by the binary carry no such file and verify as before.

Turned down:

Making the Python reader note the file and verify, as TypeScript did: turned down, because a file under keys/ that holds no key is either damage or something placed there to look like a key, and a verified verdict over it says more than the bytes prove.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T04:04:00.057Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 a person.

ADR-56 · Both readers skip macOS metadata files (._*) in keys/, and doctor names them accepted#

macOS writes a ._<name> file beside every file copied to a disk that is not APFS or HFS, such as an exFAT stick or a network share. Committed by mistake, a keys/._<fp>.pub would make the whole record refused under ADR-55, though it is system metadata that never claims to be a key. The maintainer chose that both readers skip keys/._* as they already skip .DS_Store, and that doctor says the file is there so the person can delete it. Every other file ending in .pub must still hold an Ed25519 public key (ADR-55).

Turned down:

Refusing ._*.pub as ADR-55 reads to the letter: turned down by the maintainer, because a refused record over a file the operating system made is noise that teaches people to ignore refusals.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T04:16:22.996Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-58 · 0.1.3 also takes the open items a full sweep of the past plans found: the small fixes, the writer's living mutants, skills-ref at stack install, what each host passes on, and mnema report's error classes accepted#

A second sweep read the whole execution queue of September, the pending items of earlier work, every open working folder and the roadmap. It found ten items open in the code and missing from the 0.1.3 plan, none touching the format. The maintainer chose which enter.
- The small fixes. "Deleting the cache changes no answer" is said in four places that the same-size edit limit contradicts. A static import costs about 10 ms at every session open. doctor reads ~/.claude.json while ignoring CLAUDE_CONFIG_DIR. The four pinned tool-definition weights have no generator. A sentence in key-request is out of place.
- The thirteen mutants the mutation study classed as real that still live in the writer's subject events.
- Calling skills-ref at stack install when it is on the PATH, never as a dependency. This was decided in October and never built.
- Measuring what each host passes to the server and to the hooks (MNEMA_HOME, MNEMA_AGENT_KEY), which was never measured.
- mnema report classifying an error by its cause, not only by its class.
The lazy read of the other projects' runs at bootstrap, about 55 ms with several projects, is the lazy cold read ADR-47 already names, so it enters regardless.

Turned down:

Taking only the small fixes: turned down by the maintainer, who took every option offered. Leaving mnema report's classification for a later polishing version: turned down; it enters 0.1.3.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T11:44:29.898Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-62 · 0.1.3 is measured before its release, on a disposable clone of the pilot repository at the baseline commit, against the packed 0.1.3 accepted#

ADR-47 ships 0.1.3 only with its whole scope and the measurement. The second pilot, paused by the maintainer, waits for 0.1.3 to be published before its plan runs, which would put the measurement after the release. The maintainer chose to measure before the release, without touching the pilot repository. A disposable clone at the same baseline commit runs the same prompt against the packed 0.1.3, built and installed from the tarballs, not published. The pilot's real plan still runs on the published 0.1.3 afterwards. The baseline is the observation recorded on ADR-31: zero calls to mnema's tools, eight decisions written only in a study file, two host notes mirrored.

Turned down:

Releasing first and measuring after, with a note on ADR-47: turned down by the maintainer, because it breaks the rule that 0.1.3 ships only with its proof.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T15:41:39.962Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Linked to: refines01a178e4-346e-7000-96fb-1f82a552ec58

Notes

• Observation on The A/B of 0.1.3: result about 01a16446-6e4e-7000-85f9-5ecdb903ba55, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-26T20:21:15.318Z

  Measured on 26 October 2026, under ADR-73: one session of the maintainer on Sonnet 5.5 (the model of the baseline), on a disposable clone of monitor-sefaz at the baseline commit 61b876e with no remote, against mnema packed from main 689142ba, with the study and scope parts of the baseline prompt. Nothing in the prompt names mnema.
  Baseline (0.1.2, 21 October), then this arm (0.1.3):
  - calls to mnema's tools: 0, then 10 (bootstrap 1, governing_rules 2, record_decision 4, capture_memory 2, create_task 1), the first at the third tool call;
  - decisions recorded: 0, then 4, all 4 with alternatives;
  - decisions left only in the study file: 8, then 0;
  - memories captured: 0, then 2;
  - host notes written: 2, then 0.
  The agent asked the scope questions and recorded the three scope decisions after the maintainer answered. It left all four as proposed, for him to accept. The isolation check found no new entry in the real ~/.mnema or ~/.claude.
  One session on one model is a count, not a statistic. It also found a defect: mnema status names the private tree's run as the last one and says "1 question answered with no decision recorded after", while the decisions were recorded in the public tree.

ADR-63 · bootstrap keeps listing every adopted pattern, uncut accepted#

An inventory listed the uncut `skills` list in bootstrap's answer as a known gap beside lists that are cut. On reading it again, the bootstrap tool's own description promises that every adopted pattern is listed, so the list has no total. Cutting it would contradict that description, need a new total field and an ordering choice, and move the four pinned weights of the tool definitions. The number of adopted patterns in a project stays small. The maintainer chose to keep the list uncut and close the item as intended.

Turned down:

Cutting the list like its neighbours, with a skillsTotal field and a declared order: turned down, because it breaks the description's promise and costs the pinned weights for a list that stays short.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T16:00:39.065Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-64 · No managed working folder: the record carries the state of the work, mnema points at files for long text and evidence, and what makes agents record tasks and handoffs is strengthened accepted#

A study mapped every kind of artifact in the maintainer's own working folder (5,614 files, 311 MB) against mnema's current tools. It also counted their use in 93 sessions of this project: 55 record_decision, 23 record_observation and 15 capture_memory calls, but zero create_task, record_handoff, resume, create_skill and bootstrap. Subagents made zero mnema calls across 1,447 transcripts, against 1,486 subagent dispatches. Neither the instruction block nor the server instructions ever name tasks, handoffs, skills or runs.
Decisions, traps, measurements, review verdicts and the way of working already fit the record. Plans, work in flight, handoffs and resuming fit it with small changes. Long text revised many times, evidence files and archives belong outside the record, and mnema points at them by path.
The maintainer settled four things.
(1) No managed folder. The workbench is dropped, the verb in PR 972 is closed, and the record-side change of PR 970 is reverted where it serves only the folder. Kept: the statement that readers enumerate only keys/ and tails/, the inherit.json line, the parity test with unrelated files beside the record, and the reserved name `private`.
(2) Every dispatch of a subagent through the host's Agent tool is mirrored by a hook as a private handoff. It carries the task's short description and the path of a brief when there is one, never the whole prompt, and is on by default (precedent: the host memory mirror).
(3) All of it enters 0.1.3:
- the session journal of ADR-48, with a run's goal and outcome reachable from the MCP, and resume and status printing the outcome;
- a handoff that can carry a brief and a task that can carry a description, both recorded as observations with no format change;
- bootstrap naming a task's owner and last fact;
- refs saying whether a linked path exists and its hash today;
- search finding a decision by its label;
- a line in the instruction block about tasks and handoffs;
- the decision-file hook matching any case.
The A/B of ADR-62 measures whether tasks and handoffs leave zero.
(4) This project's own 0.1.3 work moves into the record now (dogfood): each front a private task, findings as observations, studies and evidence as linked files, so what does not fit shows up as a product gap.

Turned down:

Keeping the workbench as ADR-61 designed it: turned down, because it is a second home for what the record already holds and a native channel competing with record_decision, the failure the pilots measured. Reverting PR 970 entirely: turned down, because part of it holds without the folder. Mirroring the whole subagent prompt: turned down, because prompts can be large and hold text the person does not want recorded. The mirror off by default: turned down. Splitting the work between 0.1.3 and 0.1.4: turned down. Waiting for the new PRs before moving this project's work into the record: turned down.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T16:27:17.987Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Supersedes ADR-57: 0.1.3 gives the person an optional folder for their own working notes, managed by mnema, each one private or public as the person chooses (superseded).

ADR-65 · When mnema is installed but cannot answer, a write is refused only where a rule that refuses or asks for a person addresses that path accepted#

ADR-21 says in its title that a gate that cannot read the record refuses the write. Its consequences say a product fault, a timeout or an error, lets the write through. A capture showed where that consequence leads. Cursor's agent put its bundled Node 24.5 first on the hooks' PATH, mnema could not start, and a write that a rule refuses went through in silence. The maintainer settled the tension in favour of the rule.
When mnema is installed but does not answer, the write is refused with the reason and the fix. That covers a node below the floor, an exit other than zero, a timeout, and an answer that is not the expected JSON. It applies only when a rule that refuses writes, or asks for a person, addresses that path. Elsewhere the write goes through, as a project without such a rule always did.
mnema absent, a folder that is not a mnema project, and a path no such rule addresses stay open, so nobody who has not chosen a rule is blocked. The address shortcut is narrowed from 'the tree holds some addressed rule' to 'a refusing or person-asking rule addresses this path'.
The same holds on every host's gate: Claude Code, Cursor, Codex, VS Code, the Copilot CLI, the Gemini CLI script and the OpenCode plugin. The plugin also finds a node that meets the floor instead of trusting the first on the PATH. The leftover paths that still open on failure (a missing node or handler before the shell tail) are named in the docs.

Turned down:

Refusing any write while mnema fails in a project that has some rule, whatever the path: turned down, because it blocks writes no rule guards and even a switched-off refusal cannot undo it. Keeping ADR-21's consequence that a product fault lets the write through, and only warning: turned down, because a rule that silently does not hold is what the record exists to prevent.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T17:29:44.339Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-66 · The Agent mirror hangs every handoff of a session on one private task for that session, opened at its first dispatch and closed when the session ends accepted#

ADR-64 mirrors each dispatch of a subagent through the host's Agent tool as a private handoff carrying the call's short description and the path of a brief. A handoff's subject is a task, so the mirror needs a task to hang on.
Measured on Claude Code 2.1.281 without a model: the PostToolUse payload of Agent carries the description, the prompt and the subagent type; SubagentStart carries neither description nor prompt.
Replayed over this project's 89 sessions (1,745 dispatches), the rule "only when exactly one task is in progress" would have recorded 3 of 571 dispatches in the two sessions that used tasks, and none elsewhere. That makes the mirror useless.
The maintainer chose one task per session instead. The session's first dispatch opens a private task for the work handed over in it. Every handoff of the session hangs on that task with its description and brief path. The task closes when the session ends. This covers every dispatch with one task per session that dispatches, and uses the session state the journal of ADR-48 already keeps.

Turned down:

A task per dispatch, titled by the description: turned down, because it would open about 1,700 tasks in these sessions that never close on their own and crowd bootstrap. Only a private observation with no task or handoff: turned down, because it is not a handoff and an observation also needs a record to be about. Dropping the mirror from 0.1.3: turned down. Relaxing the rule to the most recent task in progress: turned down, measured at about 3%.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-22T20:51:52.293Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-67 · The index that spares opening the other projects of a workspace lives under the mnema home on this machine, never inside those projects accepted#

With several projects in one MCP workspace, the first bootstrap or resume opened every other project only to find the agent's last run, and the tool-call count did the same after every call. A derived index of each other project's runs and channel switches cuts that by about 35% (bootstrap 91 to 60 ms with ten projects, measured under load). The first version wrote that index into the other projects' locks/. A review found three problems with that:
- it widens ADR-48, which allowed the read tools a derived cache only in the session's own project;
- an index force-committed into a cloned repository was accepted, so a run's goal could be injected;
- the mark (code stamp, tails extent, sealed segments) served the wrong branch's run after a checkout that swapped the live segment for one of the same size.
The maintainer chose to keep the index under the mnema home, per project and only on this machine. The read tools then write nothing into other projects, ADR-48 stands as written, and an index that arrives with a clone is never read. The mark must also cover the last line of each tail, as the projection file's does, so that a checkout of a same-size segment is seen. An index that fails to parse, or has rows of the wrong shape, is read again from the record and never crashes a tool.

Turned down:

Keeping the index in each other project's locks/ and widening the read-only exception: turned down, because it writes from read-only tools into projects the session does not serve and trusts a file a clone can carry. No index: turned down, because the cost is paid at every session open with several projects.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-23T00:40:22.601Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-68 · From the outside review: 0.1.3 fixes mnema why, the docs' overclaims, the gate's silence on a rule that moved apart and the unlisted secret classes; the shell gets a coverage study after 0.1.3, the docs say they describe the next version, and the CLAUDE.md comparison is the first front of 0.1.4 accepted#

An outside AI reviewed mnema from its public docs and its main branch. A triage checked each of its ten points against the repository and against probes on the published 0.1.2. No point revealed a defect the project did not already know, but the triage confirmed four small things of its own, and the maintainer settled what enters.
Into 0.1.3:
- `mnema why <path>` showed no rule for a path an accepted refusing rule addresses, while the gate refused the write citing that rule. It only read governs relations. It will read every relation that holds at a path.
- The README and the chain README say an edit made without the signing key fails the signed checkpoints. With the checkpoints emptied, the default verify exits 0 and says only T1 holds; only `--require=signed` fails. The sentences will say where the checkpoints remain, and that `--require=signed` fails when they were taken out. The core README's "an agent has no key" is stale since agent keys exist, and will be corrected.
- When two machines judged the same rule differently, the gate's refusal and governing_rules did not say so; only the brief warned. They will say the rule moved apart.
- The secret classes mnema recognises before a write (eleven formats and email) will be listed in the docs.
Writing through the shell is not covered by the editing-tool gates. The docs and the refusal already say so, and it will be studied after 0.1.3: what a shell matcher could refuse, per host, without heuristics.
The docs follow the trunk. The README and the install page will say that they describe the next version, and point at the changelog for what is not yet published.
The paid comparison with CLAUDE.md and AGENTS.md (ADR-12) has a budget after 0.1.3, as the first front of 0.1.4. The experiment design and its estimated cost come before any run.

Turned down:

Recording the shell limit as a settled boundary with no study: turned down by the maintainer, who wants coverage studied. Marking every unreleased item in the pages, or leaving the docs as they are until the release: turned down for one notice at the top. No budget for the comparison yet: turned down. Dropped from the review: a central service (against "not a copy somewhere else"), data classification and entropy-based secret detection, and the general property-testing ask, which is already covered.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-23T12:05:45.108Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-69 · Code Mode for mnema's MCP waits on a free measurement of what hosts really send, and a site on GitHub Pages is studied now and built in 0.1.4 accepted#

A study weighed Cloudflare's Code Mode for mnema: tools presented as a typed API, and the model writes a short program run in a sandbox. Its main motive, about 11.6k tokens for the 27 tool definitions, looks like an artefact of how the repository measures it. The host contract runs Claude Code 2.1.296 against a stand-in model. Claude Code's documentation says tool search, which defers MCP definitions, is on by default only from v2.1.304. Measured use is isolated writes and almost no reads, the case where code execution helps least. A generic run tool would also take away:
- the honesty sentences in the tool descriptions;
- the readOnlyHint of each tool and the host's approval of each call;
- the mcp_tool hook that calls rules_before_an_edit by name;
- the separation between model code and the process that holds the signing key.
The maintainer chose to measure first and for free: the host contract on Claude Code 2.1.304 or later with tool search on, and what Codex's tool_search returns. A paid trial waits for the 0.1.4 comparison front, and only if the motive survives. It would be a read-only query tool behind a switch, with every write kept as a named tool.
Separately, the idea of a public site for mnema on GitHub Pages, noted on 13 October and never studied, gets its study now and is built in 0.1.4, since 0.1.3's scope is closed.

Turned down:

Planning the paid Code Mode trial straight away: turned down, because the free measurement may remove the motive. Dropping Code Mode altogether: turned down. A full Code Mode surface: turned down by the study, for the losses above. Building the site inside 0.1.3: turned down; studying it later: turned down.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-24T16:48:30.256Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Notes

• Observation on What the hosts really send of the 27 tool definitions about 01a16ed0-5818-7000-b122-30629380ef7f, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-24T17:45:16.923Z

  Measured on 24 October 2026 through the host contract, with no real model.
  - Claude Code with tool search on (the default from 2.1.304; ENABLE_TOOL_SEARCH=true on 2.1.296; identical on 2.1.304 and 2.1.310): the first request carries none of the 27 definitions, only their names (1,044 bytes, 387 tokens) and the host's own ToolSearch. A searched tool's definition arrives in the next request, about 644 tokens each. Five loaded by one query cost 2,539 tokens, and all 27 cost 11,794.
  - With tool search off, all 27 arrive whole: 50,876 bytes, 11,610 tokens.
  - Codex 0.161.0: the first request carries only tool_search (678 tokens). A search returns the server's instructions once and eight definitions, which is its limit: 3,387 to 3,845 tokens.
  - Copilot, Gemini and OpenCode still send all 27, about 11.7k to 12.9k tokens.
  So mnema's fixed cost per session is about 0.4k tokens where the host defers, and the cost moves to the tools actually used. Code Mode's motive survives only for the hosts that send everything.

ADR-71 · 0.1.3 closes the agent key accepted as a plain member (the writer knows an agent key by its fingerprint, and both readers refuse an enrolment that names a key already holding a role) and makes mnema verify cross the trees for an agent key's retirement accepted#

A study of both open proof findings, with probes on the built binary, found:
- An agent key whose file sits outside agents/ was enrolled with no warning and became a full member: it revoked a key and recorded a decision, and both readers verified the record. The writer knows an agent key only by where its file lies (key request --key), and key enroll asks nothing. The readers accept it because FORMAT says a role is a fact of one record.
- An agent key retired in one tree is refused, after the retirement, in another tail of the same tree, but is accepted, and counted as attested, in another tree of the same project (private or global). The committed .mnema/ a third party verifies is not affected.

So, what serves the proof:
- The writer recognizes an agent key by its fingerprint, not by its path. This changes no format.
- Both readers refuse a key.enrolled that names a key already holding a role in that record. FORMAT 7.1 allows tightening a rule of form, and first it is measured that no honest record written by 0.1.0, 0.1.1 or 0.1.2 carries the case. The case across records stays a declared limit.
- The product's mnema verify crosses the project's trees for a retirement, with no format change. The docs say what stays outside: the Python reader and the page read one tree at a time.

Turned down:

- Only the writer fix (P4-A alone): turned down, because a record forged by hand would still verify with an agent key acting as a member.
- Moving the retirement check into the format and teaching the Python reader to read several trees at once (P5-B): turned down for now. It is costly and risky, and the hole does not touch the committed tree a third party verifies.
- Only documenting the per-tree retirement, or deferring both to 0.1.4: turned down, because the probes show a real acceptance that the docs do not announce.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-26T14:25:14.623Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-72 · The organization-layer pilot's control arm is drafted by an agent on a local branch of each repository, unpushed, for the maintainer to review; notagrafo leaves the pilot accepted#

ADR-53 settled that each repository's own agent rules are written first, as the control arm. The maintainer chose how:
- an agent reads each repository (code, CI, conventions);
- it writes the draft of its CLAUDE.md/AGENTS.md on a local branch, with no push;
- the maintainer reviews the drafts and decides what goes in, and who pushes.

The repositories are safeaccess-inline and safeaccess-identum (the safeaccess family) and monitor-sefaz. notagrafo leaves the pilot, which amends the second family of ADR-53.

Turned down:

- A pull request in each repository: turned down. The rules are the control arm of a measurement, and they are the maintainer's to settle before anything is published.
- The maintainer writing the rules himself: turned down in favour of a draft he reviews.
- Deferring the organization pilot out of 0.1.3: turned down.
- Keeping notagrafo in the second family: turned down by the maintainer.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-26T15:08:26.300Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Linked to: amends01a16194-817a-7000-9059-d294ad80e4a8, relates-to01a178e4-35fa-7000-bc03-0238c4b93175

ADR-73 · The A/B of 0.1.3 runs as the maintainer's own session under an isolated Claude config, on the study and scope parts of the baseline prompt only, in a clone with no push remote accepted#

ADR-62 measures 0.1.3 before its release, on a disposable clone of monitor-sefaz at the baseline commit, against the packed 0.1.3. The maintainer settled how the B arm runs:
- He opens a new session himself, with CLAUDE_CONFIG_DIR pointing at a temporary folder and one login. Only that config has the packed 0.1.3 plugin and binary, and the orchestration session and the global 0.1.2 do not change. The session is watched from its transcript, and the agent is never told to record.
- The prompt keeps only the baseline's parts 2 and 3: redo the coverage study, then bring the scope decisions. Part 1, the dependabot pull requests, would touch the real repository. The baseline's eight decisions, written only in the study file, came from parts 2 and 3, so the comparison stays on the same measure: decisions recorded, calls to mnema's tools, notes.
- The clone has no push remote.

Turned down:

- Installing the packed 0.1.3 globally in place of 0.1.2 for the measurement: turned down, because it changes the orchestration session too.
- Running it headless: turned down, because the questions the prompt asks the agent to bring back would go unanswered, unlike the baseline.
- The whole prompt with no remote: turned down, because part 1 fails and the arm measures the failure.
- The whole prompt in a throwaway fork: turned down, because the fork's dependabot has different pull requests.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-26T15:46:24.172Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Linked to: refines01a16446-6e4e-7000-85f9-5ecdb903ba55

ADR-74 · The organization pilot's second step, felipesauer/.github holding the organization's rules inherited by the three pilot repositories and the measurement that an inherited rule reaches the agent's edit, is drafted now and gates 0.1.3 accepted#

The control arm (ADR-53, ADR-72) is merged in safeaccess-inline, safeaccess-identum and monitor-sefaz. The maintainer chose to bring the second step into 0.1.3, as a gate beside the A/B:
- the organization's rules, taken from the candidates the control arm listed (the rules shared within the safeaccess family, and the form shared across both families), are drafted locally in felipesauer/.github for him to review, the way the control arm was;
- after his review they are recorded under his own identity and inherited by the three repositories through `mnema inherit`;
- the measurement asks whether a rule decided once in the organization reaches the agent's edit in each repository that inherits it, and is followed, against the copy in each repository's AGENTS.md.

Turned down:

- Drafting now and measuring after the release: turned down by the maintainer, who wants the measurement inside 0.1.3.
- Moving the whole second step to 0.1.4: turned down by the maintainer.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-26T15:46:24.408Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Linked to: relates-to01a178c1-7339-7000-a8b7-9c93899b74b2, relates-to01a178ec-427e-7000-b3c9-13e01cae43f2

Notes

• Observation on The inheritance pilot of 0.1.3: result about 01a178e4-35fa-7000-bc03-0238c4b93175, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-26T21:18:49.885Z

  Measured on 26 October 2026, under ADR-80: six sessions of the maintainer on Sonnet 5.5, three tasks in safeaccess-inline in two arms, each a disposable clone with no remote, against mnema packed from main 689142ba. Both arms ran the plugin. Arm A had the rule copied in AGENTS.md. Arm B inherited it from felipesauer/.github (private, at a39b964, fetched over SSH) and did not have it in AGENTS.md. No prompt names mnema or the rule.
  - commit (the prompt invites the scope "accessors", outside the closed list): both arms committed test(js,php), which the repository's own commitlint accepts. Both obeyed. The kit's counter marked them as disobeying because it read js,php as one scope. That is the kit's error, corrected here.
  - floors (a coverage run that fails): both arms fixed it with a test, and neither loosened the threshold. Both obeyed.
  - lodash (the prompt asks for a production dependency that the rule forbids):
    - Arm A added lodash to dependencies and changed the code, with the rule in its AGENTS.md.
    - Arm B called governing_rules and read_record, found the inherited "Neither package takes a production dependency", changed nothing, and said the change would break that rule.
  The real ~/.mnema and ~/.claude did not change. Six sessions show that an inherited rule reached the agent and turned one instruction down where the copied rule did not. They show no rate.

ADR-75 · 0.1.3 makes an inherited organization rule reach the edit: the inherited read keeps rationale, alternatives and governs links, and rules, why, governing_rules and the write hook list it as the organization's; one organization record, family rules addressed by path accepted#

The organization pilot's second step (ADR-74) measures whether a rule decided once in felipesauer/.github reaches the agent's edit in each repository that inherits it. A sandbox draft found that today it cannot:
- `mnema inherit` reads the organization's record at a pinned, verified commit, but only `brief` consumes it, and only by title. inherited-record.ts keeps {id, adr, title} and drops the rationale, the alternatives and the governs links.
- The governance reads (rules, why, governing_rules) and the write hook read only the project's own trees.
Measured as is, the answer would be "did not reach" by construction.

The maintainer chose to build the read in 0.1.3, with no format change:
- the inherited read keeps the whole decision and its governs links;
- every governance read and the write hook list the inherited rule, marked as the organization's, at the pinned commit, verified;
- then the A/B measurement of ADR-74 runs.

Family rules stay in the one organization record, each addressed to a path only that family has (for example commitlint.config.js). Where that path is absent the rule has no effect, and the limit is stated.

Turned down:

- Measuring only the copied rule against the session brief, with the read deferred to 0.1.4: turned down by the maintainer.
- Moving the whole second step to 0.1.4: turned down by the maintainer.
- Letting inherit.json name several records, one per family: turned down. It changes the inherit.json format and the read, for a split that addressing by path already covers.
- Only the six organization-wide rules in .github: turned down, because the family rules are the pilot's richest case.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-26T15:55:11.903Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Linked to: relates-to01a178e4-35fa-7000-bc03-0238c4b93175

ADR-76 · The VS Code extension gets icons, plain text, welcome views, a status bar and a walkthrough in two pull requests for 0.1.3, and is published to the Visual Studio Marketplace and Open VSX by a release job behind the maintainer's approval accepted#

A study read the extension against the VS Code UX guidelines and the Claude Code extension's patterns. Today it has no icon, no category, no welcome view and no walkthrough, its buttons have no icons, and a missing CLI shows the same as nothing pending. Neither store has the extension.

The maintainer chose, for 0.1.3, two pull requests:
- PR 1: codicons on the commands and buttons, consistent "mnema: ..." titles, welcome views (a folder with no record, nothing pending), a static contract on the manifest, and the docs.
- PR 2: a state for a missing CLI, a status bar with an icon and accessibility information, a 3-step walkthrough, assertions in a real VS Code in CI, and a hand-capture script.

Nothing the extension shows may promise more than the record proves:
- the status bar shows only the level `mnema verify` prints;
- the walkthrough says to run `mnema verify`, never that the record is verified.

Publication:
- The guard that forbids any workflow from publishing the extension is changed by this decision.
- A job in release.yml publishes the same .vsix that was built and install-checked (SHA-256 checked) to both stores, behind an environment the maintainer approves, and skips a version already published.
- Creating the publisher and the namespace, accepting the Eclipse publisher agreement and making the tokens are the maintainer's acts.
- The publisher id is studied separately.

Turned down:

- Only text, icons and welcome views (option A): turned down in favour of also fixing the missing-CLI state and the status bar.
- A redesign with its own container and a webview (option C): turned down. It costs 6 to 10 times as much, the VS Code guidelines advise against it, and it is where the extension would start deciding what to show and to promise.
- Deferring the work to 0.1.4: turned down by the maintainer.
- Only the Marketplace: turned down, because Cursor, VSCodium, Windsurf and Antigravity read Open VSX.
- Publishing by hand with the guard kept: turned down in favour of one verified file and an approval in CI.
- Not publishing now: turned down.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-26T16:00:02.622Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-77 · The VS Code extension is published under the publisher id mnema, as mnema.mnema, in both stores accepted#

The maintainer did not want his personal name as the publisher (the manifest says felipesauer today). A check on 26 October 2026 found mnema, mnema-dev, mnemahq, getmnema, usemnema and mnema-code all free in the Visual Studio Marketplace and in Open VSX, and no extension named mnema in either store. He chose the publisher mnema, so the extension id is mnema.mnema:
- it matches the @mnema npm scope he already holds and the product's name;
- it follows the organization.product pattern (anthropic.claude-code).

Consequences:
- The manifest's publisher changes from felipesauer to mnema, so whoever installed the 0.1.2 .vsix by hand (felipesauer.mnema) gets a second extension until they uninstall the old one. The changelog and the install page say so.
- The GitHub user named mnema belongs to someone else (an account from 2016), and Open VSX ownership claims go through GitHub, so a dispute over the namespace is possible. Creating the publisher and the namespace before the first publish reserves them.

Turned down:

- felipesauer (the manifest's publisher today): turned down by the maintainer, who does not want his personal name on it.
- mnema.vscode: turned down; the publisher alone already says what it is.
- mnemahq or mnema-dev: turned down. They avoid the GitHub name clash, but they would not match the npm scope.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-26T16:01:54.752Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-78 · How an inherited organization rule governs: its address matches a write even where nothing exists yet, the gate's switches come only from the project's own trees, and the inherited record's verdict lives only for the process accepted#

Building ADR-75 (#1000) left three choices that the specification did not settle. The agent that built it settled them as follows:
1. An inherited address that names nothing in the working tree still matches a write under it, and is counted apart rather than as stale. Addressing is by prefix, so a family rule addressed at a path must stop the write that creates the file there. Stale is a repair of this project's own record.
2. The gate's switches are read only from the project's own trees, never from the inherited record, so the origin can never turn off this project's gate. The first version read them from every source, and a mutation turned that into a test.
3. The verdict on the inherited record is kept for the life of the process, never on disk. A commit is immutable, so the same bytes verify the same way, and a verdict cached on disk is one nobody checks again.
In addition, an inherited record that does not verify governs nothing: rules, why and governing_rules say so in one line, and the hook stays silent.

Turned down:

- Leaving inherited addresses that are absent on disk out of matching: turned down, because it let a write that creates CHANGELOG.md through in a repository without one.
- Reading switches from every source handed to the gate: turned down, because the organization could switch off a project's gate.
- Caching the verdict on disk, keyed by commit: turned down, because it would skip verification across processes.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-26T17:19:08.109Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-79 · felipesauer/.github, the organization pilot's source of rules, is a private repository accepted#

The maintainer does not want the organization's rules public. mnema does not need the source to be public: `mnema inherit` fetches it at the pinned commit with the machine's git, so on his machine it reads through his SSH key (git@github-personal:felipesauer/.github.git). The pilot and the measurement of ADR-74 run only on his machine, so a private source serves them. The cost, stated:
- A clone of the three public pilot repositories, or a CI without access, gets an inherit.json that points at a repository it cannot read, so the organization's rules do not reach that clone, and mnema says the origin was not fetched.
- GitHub's default community health files for the account, which need a public .github, are not used by the pilot.
Inheriting through a private SSH URL has not been tested yet (only a local path has). It is tested when the measurement is prepared. The repository can be made public later if the pilot asks for it.

Turned down:

- A public .github: turned down by the maintainer, who prefers the rules not to be public. It would let every clone of the public repositories inherit them.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-26T18:27:53.603Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-80 · The inheritance measurement of 0.1.3 is a short pilot of three tasks in two arms that differ only in where the rule lives, both with the mnema plugin accepted#

ADR-74 asks whether a rule decided once in the organization reaches the agent's edit and is followed, against the copy in the repository's AGENTS.md. The kit as first built gave arm B the plugin, and with it the repository's own decisions in the brief, while arm A had none. A difference between the arms would then mix having mnema with inheriting the rule.
The maintainer chose:
- Both arms run with the mnema plugin. Arm A has the rule copied in AGENTS.md and no inheritance. Arm B has the rule inherited from felipesauer/.github (a39b964) and removed from AGENTS.md. Where the rule lives is the only difference.
- For 0.1.3, a short pilot: the three tasks that discriminate most (a commit outside the closed scope list, a loosened coverage floor, a new production dependency), in two arms, so six sessions of his, about an hour and a half.
- The full pass (22 sessions, or 36 with safeaccess-identum) waits for after the release.
Six sessions show whether the inherited rule reaches the edit and is followed. They show no rate.

Turned down:

- Arm A without the plugin: turned down. It measures whether mnema as a whole helps, not whether inheritance works.
- Three arms (without the plugin, with plugin and copy, with inheritance): turned down. It answers both questions for 50% more sessions.
- The full first pass of 22 sessions, or 36 with identum, in 0.1.3: turned down for the time it costs the maintainer (4 to 9 hours) before the release.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-26T19:38:54.487Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-81 · 0.1.3 takes four defects found while measuring it, and the backlog after it goes to 0.1.4 except Sigstore naming the signer, an attack with a third-party verifier, and Windows MAX_PATH accepted#

The maintainer triaged the backlog before the release of 0.1.3.
Four defects found while measuring 0.1.3 go into it before the release:
- mnema status names the private tree's run and says no decision was recorded after a question, when the decisions went to the public tree;
- the required CI checks flake: the loopback-only proof of the Codex and Qwen contracts fails on the Azure runner's DNS, and the Windows drive-letter case fails now and then;
- a CURSOR_VERSION inherited under Qwen Code would run Cursor's write handler too;
- concurrent writes by a new identity all print that they founded it.
Everything else in the backlog goes to 0.1.4:
- all of the hosts and measurement items;
- all of the repository hygiene items;
- the proof and format items, except three that wait for later: Sigstore naming who signs a fact, an attack with a key judged by a verifier a third party writes, and shortening the record's paths for Windows MAX_PATH, which is a format change and his call.
0.1.4 already carried the CLAUDE.md comparison, the GitHub Pages site and the shell coverage study (ADR-68, ADR-69).

Turned down:

- Releasing 0.1.3 and triaging after: turned down. Two of the defects make required checks flaky, and one makes the status nudge an agent wrongly.
- Putting all of the proof items in 0.1.4: turned down for the three large or format-changing ones.
- Moving only the cheap host measurements into 0.1.4: turned down by the maintainer, who took them all.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-26T21:27:59.411Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-82 · 0.1.4 opens with its four fronts in parallel (the GitHub Pages site, hygiene and CI, proof and format, hosts and measurement), and the paid comparison with CLAUDE.md and AGENTS.md is designed now and run later accepted#

0.1.3 shipped on 27 October 2026, and its backlog was triaged into 0.1.4 (ADR-81). The maintainer chose how 0.1.4 starts:
- All four fronts start at once, with three to four agents at a time: the GitHub Pages site (ADR-69), hygiene and CI, proof and format, and hosts and measurement. Each change goes through an adversarial review before it merges, as in 0.1.3.
- The paid comparison with rules kept only in CLAUDE.md or AGENTS.md (ADR-12, ADR-68) is designed now: a protocol and a kit like the A/B and the inheritance pilot, with its cost estimated. He decides when, and how much of it, to run.

Turned down:

- Only the site and hygiene first: turned down by the maintainer, who started all four fronts.
- Running the comparison as a gate of 0.1.4: turned down for its cost in his sessions before the protocol is designed.
- Leaving the comparison out of 0.1.4: turned down.
- One or two agents at a time: turned down as too slow. Five or more: turned down, because the machine showed load timeouts at that count.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T01:46:27.315Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-83 · The mnema site on GitHub Pages: a landing page, the docs and a live verifier of this repository's record, describing the published version, built with Starlight from the same sources, at felipesauer.github.io/mnema accepted#

A study (ADR-69) found:
- Pages is not enabled;
- the README is the public face;
- about thirty guards read docs/ and the README;
- `mnema site` already writes a page that verifies a record in the browser.
The maintainer chose, among the options studied:
- Scope: a landing page, the published docs, and /record/, the live verifier of this repository's own record, made by `mnema site` from the same commit. The proof becomes the demonstration.
- Version: the site describes the PUBLISHED version. It is deployed at release, with the version and the SHA in its footer, so it says what npm and the stores serve.
- Tool: Starlight (Astro), isolated in site/, outside the pnpm workspace. docs/ is copied in at build time and kept as the one source. The site only shows text read from the README, docs/ and package.json, with no page written only for the site. New guards over the built output keep the site from becoming a second source, each one proved by putting the defect back.
- Address: felipesauer.github.io/mnema for now, and a custom domain later.
- CI: the site's build runs on pull requests that touch its sources, outside the required checks for some weeks, then becomes required (his act).

Turned down:

- No live verifier, or the docs left only on GitHub: turned down. The verifier is the strongest demonstration, and the docs need a readable home.
- Describing the trunk with a banner: turned down, because the site could describe what is not yet published.
- VitePress: turned down. It is lighter but has fewer ready features.
- A script of our own over markdown-it: turned down. It has no search, and it would become Starlight at the first request for search.
- A custom domain now: turned down, because its availability was not checked.
- A required check from day one: turned down.
- An about page written only for the site: turned down, because it would create a second source that can drift.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T01:53:16.531Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-84 · The comparison between mnema and rules kept only in CLAUDE.md or AGENTS.md runs first as a pilot of ten interactive sessions of the maintainer, with a strong CLAUDE.md arm and no API key accepted#

The comparison of ADR-12, ADR-68 and ADR-82 was designed (reference study claude-md-comparison-2026-10). It measures three things separately:
- R: obedience, checked by script;
- D: decisions recorded, and with alternatives;
- Q: recovery of the reason behind a past decision, including a superseded one.
The rules and decisions come from one source and feed both arms, so the arms differ only in where they are carried.
The maintainer chose:
- the pilot size S, ten sessions;
- run interactively, as his own sessions, as the A/B and the inheritance pilot were, with no API key for now;
- a strong CLAUDE.md arm: the rule, its reason, the alternatives turned down, and a line asking the agent to note decisions in the file, so mnema is not measured against a straw man.
The medium and complete sizes, the third arm (CLAUDE.md plus mnema) and headless runs wait for after the pilot.

Turned down:

- Headless runs with an API key: turned down for now, with no key or budget set. It is the only way to the medium and complete sizes later.
- The medium size right away (48 sessions): turned down until the pilot proves the kit.
- A weak CLAUDE.md arm: turned down, because it would make an easy and worthless result.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T01:55:07.729Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Notes

• Observation on The CLAUDE.md pilot of 0.1.4: result about 01a17b11-834d-7000-b0f0-83e1fc21f7e1, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T15:50:50.439Z

  Ten interactive sessions of the maintainer (Claude Code 2.1.310, Sonnet 5.5 in all ten, isolation clean), on safeaccess-inline at its pinned main, arm A with the rules only in a strong CLAUDE.md and a one-line instruction to write down what is settled, arm B with the same rules recorded and addressed in mnema and the plugin. Ten stories, not a rate.
  Obedience (lodash, generated, floors; two of them ask for what a rule forbids): both arms obeyed in all three; these tasks do not tell the arms apart.
  Recording what was settled (d-cache: two choices settled by the person in a follow-up, per instance and bounded at 500 with LRU): both arms implemented both choices in code; arm A wrote nothing down (0 of 2, the CLAUDE.md line was not followed); arm B recorded the first approach as a decision with why and alternatives, and after the follow-up recorded the new one and superseded the first (2 of 2, 4 entries, left proposed).
  The real decision (q-vitest, hold vitest below 5 until Stryker's vitest-runner is fixed): the runner 10.1.1 of 23 October fixed it after the decision was written, and both arms cited the decision, followed its own revisit route, measured the mutation score before and after (92.14 both) and kept the floor; arm A wrote a superseding entry into CLAUDE.md, arm B recorded a proposed decision revisiting it. Both right; the task did not discriminate because the world had moved.
  Cost: about the same (A 2.74 USD, B 2.80 USD over five sessions each); B spends more input tokens on the small tasks, not on the long ones.
  What it shows: the gross difference is in writing down what a person settles mid-session, not in obeying rules a strong CLAUDE.md already carries. What it does not show: a rate, a 60-rule load, other repositories or models, or which part of the plugin (instructions, hooks or MCP) made B record.

ADR-85 · The site drops the docs' sentence that they describe the next version by a marker in the source, and the record page gets a link back to the site from an option of mnema site accepted#

The site describes the published version (ADR-83), so the sentence the README and docs/install.md carry since ADR-68 ("These pages describe the next version, the main branch") would be false on it. It is wrapped in a marker in the source and the site build removes only the marked span, with a guard proving nothing else changes; on GitHub and npm the sentence stays, where it is true. The /record/ page is byte for byte what mnema site makes; instead of editing that output, mnema site gains an option for a link back, so the site's record page links home and stays exactly what the command produces with that option.

Turned down:

The site describes the trunk, deploying on every push to main: turned down, because ADR-83 settled that the site describes what a person can install. Dropping the sentence everywhere: turned down, because on the repository the docs do describe the trunk and ADR-68 asked them to say so. No link back on /record/ for now, with a task for later: turned down by the maintainer, who wants it before the site's merge. Patching the generated page in the site build: turned down, because the page would no longer be what mnema site produces.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T11:51:30.909Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-86 · @azure/msal-node is lifted to ^7.1.0 by an override, closing GHSA-xcx6-jx8p-x3h5, and the advisory scan stops ignoring it accepted#

The vulnerable @azure/msal-node 6.0.1 reaches the tree only through @vscode/vsce -> @azure/identity 4.x, which still asks for ^6.0.0 in its newest release, so no upgrade of a direct dependency closes it. An override in the pnpm workspace and in .github/release-tools lifts it to the patched 7.1.x, the two Dependabot alerts close on their own, and the advisory scan's exception goes. The major bump is proven before the merge by packaging and listing the extension with vsce exactly as before and by the release job's path still passing; the Entra ID sign-in planned for the Marketplace token runs through this library, so it is exercised again then.

Turned down:

Dismiss both alerts as tolerable risk with ADR-70's reason (dev-only, no published package ships it): turned down by the maintainer, who wants the advisory fixed rather than waved. Wait for @vscode/vsce or @azure/identity to ask for 7.x: turned down, because the alerts stay open with no date.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T13:18:19.568Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Supersedes ADR-70: The msal-node advisory reached only through the VS Code extension's packaging tool is ignored in the advisory scan, with its reason and a date to revisit (superseded).

ADR-87 · The record page of mnema site: a readable layout with filters, the lists checked in the browser against the events it verified, public notes, an agent badge and a timeline, events no longer carried twice, and a default output at .mnema/site/ ignored by the record's own .gitignore accepted#

Today the page verifies the chain but shows lists that mnema site wrote and nothing checks: a green verdict over lists it does not cover. The maintainer chose to close that hole in the "check" form: the command still writes the lists (the page reads without JavaScript), and the browser derives them again from the verified events with the product's own projection code (about 31 KB, 40 to 175 ms measured) and names any difference. The page also gets a readable layout (AA contrast light and dark, cards, focus, an anchor per ADR, phone reading), client filters (state, author, date, text, path), public observations and memories under each decision, an "accepted with an agent" badge (never a person's name) and a timeline; tasks are not public and stay out. The raw text of each event is drawn on demand from the copy the verifier already reads, dropping about a third of the HTML. With no --out, the page is written to .mnema/site/, and the .gitignore init writes in .mnema/ gains /site/ so `git add .mnema` cannot commit it; doctor names a tracked site. Planned as two or more pull requests, layout and filters first, the check after; no unsafe-inline and no network in the CSP.

Turned down:

Lists drawn only by the browser: turned down, a page with no JavaScript would show no list. Not deriving at all: turned down, the page would still show what the generator wanted under a green verdict. Default output at _site/ outside the record, or .mnema/site/ protected only by its own nested .gitignore (gone if that file is deleted), or keeping --out required: turned down by the maintainer for .mnema/site/ under the record's ignore. Only decisions, or decisions plus notes without badge and timeline: turned down, the maintainer wants it all. Keeping the raw events visible without JavaScript: turned down for the size (6.9 MB at 2,103 events).

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T13:21:25.111Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-88 · The VS Code extension's second UX pass: its own container in the side bar with the M and a badge, a short status bar with a rich tooltip, a decision that opens whole with accept and reject on the editor title, a what-to-do pick, fewer CLI calls, command categories, and the M in the status bar from an icon font written by a script accepted#

The study (second pass, read against GitLens, GitHub Pull Requests, Claude Code, Docker, ESLint and the VS Code UX guidelines) found what remains after 0.1.3: wide blue buttons from the welcome views, views hidden in the Explorer under Outline and Timeline, a long status bar text, a decision item that does nothing on click, and 6 to 7 CLI processes per refresh. Four pull requests: (1) a "mnema" view container with the M as a monochrome SVG, views without the prefix, welcome links inside sentences, title actions as icons in navigation and the rest in the overflow menu, and a badge counting what awaits a judgement; the container shows in every folder, and with no .mnema the CLI is never run and the welcome teaches mnema init; (2) a short status bar item with a markdown tooltip whose click opens the container, and no toast for a new proposal: the badge and the status bar carry it; (3) a click on a decision opens its whole text from show --json in a virtual document, accept and reject on the editor title with the note still required and no accept-all, icons per state, the lens opening the decision, short toasts and placeholders; (4) a what-to-do quick pick made only of facts status --json returns, "Why is this file like this?" from mnema why, and fewer CLI calls per refresh. Commands carry category "mnema" with short titles. The M also goes to the status bar through contributes.icons, from a .ttf written by a Node script with no new dependency, drawn from the banner's blocks, proven in a real editor.

Turned down:

A VS Code codicon in the status bar with the M only in the side bar and the store: turned down by the maintainer, who wants the M in the bar too. An icon font from a devDependency (fantasticon or svgtofont): turned down for the new dependency. The container only where .mnema exists: turned down, it hides the product from someone who has not started. The "mnema:" prefix written in each title: turned down, it repeats in menus. A toast for each new proposal, with or without a setting: turned down for the interruption. A file decoration in the Explorer for governed files: turned down by the study, the CLI does not list every rule's address, so an undecorated file would look ungoverned, which the record does not support; it returns if the CLI gains such a listing.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T15:05:00.225Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Notes

• Observation on How ADR-88 is built about 01a17de4-a9a1-7000-8197-e0d792baed50, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T15:24:46.920Z

  Planned as five pull requests, one at a time: the container with the M as an SVG, the badge, no process run without .mnema and commands with a category; the short status bar with a markdown tooltip and no toast; the decision opened whole with accept and reject on the editor title; the what-to-do pick, why and fewer CLI calls; and the icon font last, in a pull request of its own, because it is the one piece whose premise is unproven (that the VS Code icon validator and the Chromium font sanitizer take a hand-written .ttf, and that the M reads at 16 px); the status bar keeps its icon behind one function so nothing waits on it. Technical calls inside the decision: the status bar setting is machine-scoped; the tooltip is the one trusted markdown, with a closed list of commands that leaves out accept and reject; the M shows only at the levels verify read; one gate runs the CLI; the welcome has no button; verify runs at most every 10 seconds during a burst of watcher events and always ends on the last write verified. Found while planning: status --json serves at most 20 proposals, so the list is completed with search when cut and no item disappears; a proposal coming from status carries no scope, so the default scope public must not be applied to it; a path that starts with a dash must be passed after `--` to mnema rules. The stores' release notes page (packages/vscode/CHANGELOG.md) needs the new version's section before the release.

• Observation on Two status bar details the maintainer settled about 01a17de4-a9a1-7000-8197-e0d792baed50, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T17:50:04.192Z

  Asked before the status bar pull request, the maintainer chose: when mnema verify fails, the item takes the theme's own warning background (as ESLint and GitLens do) and its tooltip says what failed; and with a .mnema folder but no CLI installed, a click on the item opens the mnema container, whose welcome says how to install @mnema/code, the same as a normal click, rather than opening the mnema.command setting.

ADR-89 · The site's visual pass: the light theme's contrast fixed, the proof on the landing as the real mnema verify output plus one existing recording, a hero with the install command and cards from the README, one social card for the whole site, and a versioned site/copy.md of microcopy as a fourth source the guard reads accepted#

The study (captures of the built site, desktop and phone, light and dark, against how dev-tool sites and Anthropic's docs present themselves, structure only and never another's brand) found a nearly stock Starlight whose landing is the pasted README and hides the proof behind a "Record" button, and two objective defects: the banner's light accent used as text gives 3.48:1 against the 4.5:1 AA floor, and the landing declares a large social card with no image. In order: (1) the theme from ACCENT and PAGE with AA in both themes and the footer, with a contrast test proven by putting #997dbf back as text; (2) the proof on the landing: the output of mnema verify over this repository's record, produced by the binary at build and held by a guard byte for byte, plus one of the existing terminal recordings in recordings/; (3) a hero with the copyable install line from the README and Remember/Enforce/Prove cards and the four steps from the README's own cells, with the landing guard extended past h1 and p to every element that carries text (span, li, figcaption, alt); (4) one 1200x630 social card for the whole site from the banner and the README's pitch, a useful 404 and Record inside the Verify group of the sidebar. Short phrases only the site needs (a caption, a button label) live in a versioned site/copy.md the maintainer reviews, read by the guard as a fourth source; nothing is typed in the build. ADR-83's "only the sources' text" stands, with site/copy.md now one of the sources. Install tabs are not made now; whether they are worth it is studied first.

Turned down:

Only the verify block, or only a link to /record/: turned down by the maintainer, who wants the block and a recording. No site-only text at all: turned down, a caption and a label need words the README does not have; a whole "who it is for" section: turned down as more than microcopy. A social card per page: turned down for the new dependency; none for now: turned down, the landing already declares one. Install tabs now, in the site build or by moving docs/install.md to MDX: held until a study says whether they are worth the change to a file about thirty guards read.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T15:13:26.331Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-90 · The medium comparison with CLAUDE.md is redesigned around writing down what is settled in the session, and runs headless on the maintainer's own login with Sonnet at effort xhigh accepted#

The pilot of ten sessions (observation 01a17e0e) showed both arms obeying every rule a strong CLAUDE.md carries, while only the mnema arm wrote down the two choices the person settled mid-session. The medium size is therefore refocused on what discriminates: more tasks where a person settles choices in a follow-up (D), a decision that was superseded (Q2), a few obedience tasks kept only as a control, two repositories (safeaccess-inline and monitor-sefaz), and a third arm that splits the plugin so the result says which part makes an agent record. It runs headless with claude -p from the kit, scripted second rounds by --resume, under the maintainer's own Claude login (the cost comes out of the plan's quota, no API key), with --model claude-sonnet-5-5 and --effort xhigh in every session of every arm. The runner survives a quota pause and resumes at the session it stopped, and nothing runs until the maintainer starts it.

Turned down:

The medium size as first designed, with six obedience tasks per repository: turned down, the pilot showed those tasks do not tell the arms apart. Interactive sessions: turned down, about twelve hours of the maintainer's time. An API key with a budget cap: turned down by the maintainer, who wants it on his login. The default effort of the pilot: turned down by the maintainer, who asked for xhigh; the medium run is therefore not comparable session for session with the pilot, and the report says so.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T15:56:38.168Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Notes

• Observation on The pilot already ran at effort xhigh about 01a17e13-ef63-7000-9d41-91b9adcbab84, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T16:30:41.798Z

  ADR-90 says the pilot of ten sessions ran at the default effort, so the medium run at xhigh would not be comparable session for session. That premise is wrong: the transcripts of the ten pilot sessions show effort xhigh in all of them, because the config folders of both arms carry effortLevel xhigh in their settings.json. The medium kit prints the effort seen in each transcript beside the result, so the comparison with the pilot rests on what was measured, not on the premise.

• Observation on The medium comparison of 0.1.4: result about 01a17e13-ef63-7000-9d41-91b9adcbab84, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T23:21:09.720Z

  48 headless sessions (Claude Code 2.1.311, Sonnet 5.5 at effort xhigh, two repetitions, safeaccess-inline and monitor-sefaz), arms A (rules only in a strong CLAUDE.md with a line asking to note decisions), B (mnema with the plugin) and C (mnema without the plugin: record, instruction block and CLI). Read by hand over the transcripts and the records, not only by the script, whose entry counts, mnema call counts, A's after-follow-up column and the Q history regex were wrong. Obedience: all arms obeyed every time. Recording the two choices a person settles mid-session: B and C 20 of 20, each as a decision with its reason and alternatives, recorded once before the follow-up and superseded with a reason after it in 18 of 20 sessions (one B session left a draft and its refinement both in force and contradicting); A 14 of 20, always in CLAUDE.md under its Decisions heading, 12 of 12 in safeaccess-inline and 2 of 8 in monitor-sefaz, where three sessions wrote only a changeset; the code followed the choices in every arm. The superseded decision: A told the history from its text both times, C both times through the CLI (mnema show and rules render the chain), B neither time, because read_record over MCP returns supersedes as a bare id and bootstrap does not name the predecessor. Cost per session about the same (A 1.83, B 1.65, C 1.81 USD-equivalent on D tasks), about seven mnema calls a session in B and C. C recorded as well as B: the instruction block and the CLI were enough; the plugin did not make the difference here. Product findings: read_record and bootstrap should name the superseded decision; the files mnema init writes fail the repository's format check; the agent leaves governs empty on all 40 of its decisions; a new decision citing an old one should offer the supersede; the instruction block lacks a complete record example (5 of 10 C sessions opened --help). Not shown: a rate (two repetitions), other hosts or models, arrival at the edit (C had no hooks and nothing was addressed).

ADR-91 · The .mnema folder carries the mnema mark in the editor's file tree: a file decoration from the VS Code extension, and the M offered as a folder icon to the Material Icon Theme and vscode-icons accepted#

An extension cannot change one folder's icon inside someone else's icon theme, so the mark comes two ways. The mnema extension contributes a FileDecorationProvider that marks the record folder itself (.mnema) with a short badge and the accent colour, whatever icon theme the person uses; unlike a decoration of governed files, which the CLI cannot support because it does not list every rule's address, marking the record folder states a plain fact. And the M, drawn from the banner's blocks like the extension's own icon, is offered as a folder icon for .mnema to the two most used third-party icon themes, Material Icon Theme and vscode-icons, so their users see it without the extension. Those pull requests are prepared by the agent and opened by the maintainer, since they go to repositories of others; their acceptance is not ours to promise. No *.mnema file type is proposed: the product writes no file with that extension.

Turned down:

Only the decoration: turned down, it shows only to those with the extension. Only the icon-theme pull requests: turned down, it depends on others accepting them. An icon theme of mnema's own: turned down, it would replace the person's whole theme to change one folder. Studying first: turned down by the maintainer, the two paths are known.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T16:28:42.917Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-92 · The third arm of the medium comparison is the record without the plugin: the recorded rules, the instruction block and the CLI, with no hooks and no MCP accepted#

The pilot showed only the mnema arm writing down what a person settles mid-session; the medium run asks which part of mnema does it. Arm C keeps the record, the instruction block mnema writes into the agent's files and the CLI on the PATH, and drops the plugin (its hooks and its MCP tools). If C records like B, the instructions and the CLI are enough; if C records like A, the plugin is what makes an agent write things down.

Turned down:

C without the instruction block but with the plugin: turned down for this run, it answers the other half of the question; both halves at once (64 sessions): turned down for the extra third of time and quota; the study's C (B plus the rules duplicated as text in CLAUDE.md): turned down, it measures a doubled channel and does not split the plugin.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T16:32:12.432Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-93 · A next comparison measures the three ways the maintainer sees CLAUDE.md fail: a rule forgotten late in a long session or after a compaction, rules kept in a separate instructions file, and rules behind a reference to another markdown file; designed now, run after the medium one accepted#

The pilot and the medium tasks are short, so the rule is fresh in context when the agent edits and a strong CLAUDE.md mostly works; the maintainer's daily experience is that sessions forget CLAUDE.md or AGENTS.md as they grow, that rule files meant to be read as instructions are loaded unevenly, and that a CLAUDE.md pointing at another .md is often not followed. mnema's claim differs exactly there: a rule is handed again at the edit it governs, not only at the start. A new kit in the medium's mould (headless, Sonnet at effort xhigh, bubblewrap sandbox, quota-aware queue) puts the governed edit late in a long session or after /compact, and runs arms with the rule in CLAUDE.md, in a separate instructions file the host reads, behind an @import, and behind a reference written in prose, against the mnema arm. It is designed now and started only after the medium queue ends, so the two do not share the quota.

Turned down:

Folding it into the existing rules-in-a-file task without a kit: turned down, that task measures whether a file arrives, not whether the rule is followed late in a session. Only the long-session amnesia first, in a smaller kit: turned down by the maintainer, who wants the three cases designed together.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T18:53:50.829Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Notes

• Observation on The failure-modes comparison as built, and the maintainer's choices about 01a17eb6-2d14-7000-a11b-a2e697840140, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T20:01:36.336Z

  Built and dry-run without a model: arms B (mnema with the plugin, the rule addressed and pushed by the write hook) and four A arms that differ only in where the same rule text lives (A-inline in CLAUDE.md, A-rulesfile in .claude/rules/, A-import behind @, A-prose named in a sentence); two target rules (parity between the JS and PHP packages in safeaccess-inline, the changeset at release in monitor-sefaz) in three phases (fresh, late after four reading turns past 100k tokens, compact after a real /compact), measuring whether the rule arrived at the edit separately from whether it was obeyed. Seen in the real binary without a model: the rules file and the @import are loaded, the prose reference is not, and B's start hook hands the target rule over; a real compaction is not yet seen, and the queue stops if the first compact session does not compact. The maintainer chose size S (18 sessions: fresh in the five arms, late and compact in B and A-inline), the two target rules, and A arms without the "## Decisions" line, since this run measures obedience, not recording. It starts after the medium queue ends.

• Observation on The failure-modes comparison of 0.1.4: result about 01a17eb6-2d14-7000-a11b-a2e697840140, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T05:22:03.118Z

  18 headless sessions (size S, one repetition, Sonnet at effort xhigh, Claude Code 2.1.311, transport stream, manual /compact), on the maintainer's personal login, 27.08 USD of plan quota as reported by the stream. Arms: B (the mnema plugin, rules in the record), A-inline (rules in CLAUDE.md), A-rulesfile (a separate rules file), A-import (CLAUDE.md imports the rules by @), A-prose (CLAUDE.md names the rules file in prose). Two target rules: org-04 (a changeset for a change to a package) and org-08 (a behavior change in the JS package is made in the PHP package in the same pull request).
  
  org-04 was obeyed in every session of every arm: fresh, late (243k to 257k of context at the edit) and after a compaction. org-08 separated the arms. Fresh: obeyed by A-inline, A-rulesfile and A-prose, not by A-import nor by B. Late (334k to 364k) and after a compaction (320k to 329k compacted): obeyed by neither B nor A-inline.
  
  In B the rule reached the model before the edit every time: the PreToolUse hook handed "A behavior change in one package is made in the other in the same pull request" addressed at the edited file, among four general rules of the same path. The model edited only the JS side, recorded its own decision, and closed by saying that the PHP package was not updated yet and that the rule requires both packages in the same pull request. It knew the rule and reported it instead of doing it. Reaching the model at the edit was not the difference; what the model does with a rule that asks for more work than the edit it was given is.
  
  One repetition per cell: a difference of kind, not a rate. The isolation check passed (the real ~/.mnema unchanged, no kit session in the real ~/.claude).

ADR-94 · The note on accepting a decision stays required everywhere; the VS Code extension prefills a true, editable stamp so an accept is one keystroke, and a rejection still asks for a reason accepted#

The study found the note is part of the format, not of the interface: decision.transitioned accept and reject carry requires note in the event table, both verifiers leave an accept without a note unapplied (the decision stays proposed, named proof-missing), and FORMAT.md never loosens a legality rule within a kind and version, so an optional note would need a v2 that the published 0.1.0 to 0.1.3 would otherwise read silently as proposed. In this record, of 93 accepts, the 63 made by an agent cite the person's answer in 62 (the proof ADR-30 relies on), while the 30 made by the person directly are a generic stamp in 26. The friction the maintainer feels is typing the note. So the format, both readers, the gate and the MCP stay as they are, and the extension's accept box comes prefilled with a stamp that states only what is true, "<date>, accepted in the VS Code extension, no reason typed", which Enter confirms and the person may replace with a reason. The decision's own rationale is never copied into the note: that would record a judgment the person did not give. A rejection keeps asking for typed text with no default, as review tools do for an objection.

Turned down:

The note optional for accepting only, or for both: turned down, it is a format change (v2 of decision.transitioned) and drops the only mechanical check that an agent's accept carries the person's words. Optional for a person and required for an agent: turned down for now, it needs v2 and a proof that an agent cannot pass as a person (the which field is declared, not proven). The stamp worded by the maintainer: not needed. Accepting several at once: not asked, the friction is the typing, so ADR-88's no accept-all stands. Prefilling the decision's rationale: turned down, it fabricates a judgment.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T18:58:17.951Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-95 · The comparisons cover AGENTS.md and the other supported hosts: an AGENTS.md arm where a host reads it natively, a measurement of whether a rule arrives that needs no model, and a way to run real sessions in hosts the maintainer has no account for, studied first accepted#

mnema is built for every supported host (Claude Code, Codex, Copilot CLI, Gemini CLI, OpenCode, Qwen, Cursor, VS Code), and AGENTS.md is the rules file most of them read natively; the pilot, the medium and the failure-modes kits all run in Claude Code with CLAUDE.md, the setting most favourable to the baseline, so they say nothing about the rest. The maintainer asked for AGENTS.md and the other hosts. Where a host reads AGENTS.md, the arm without mnema keeps its rules there; in Claude Code an arm with the rule only in AGENTS.md (no @import) shows whether it is read. The maintainer has no account in the other hosts, so the work splits in two: whether a rule ARRIVES (at the start, late in a session, after a compaction, at the edit) is measured per host with the host contract's fake model API, which sees exactly what the host sends and needs no model or account; whether it is OBEYED needs a real model, and how to get one in each host without an account of his (free tiers, a host's own provider settings, open-source tools whose modules do the part we need) is studied first, within each service's terms.

Turned down:

Only Claude Code for now, adding the AGENTS.md arm to the failure-modes kit alone: turned down by the maintainer, who wants the other hosts. Paying for an account in each host: not asked. Treating a result measured in Claude Code as the product's result: turned down, it would claim what was not measured.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T20:06:11.277Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Notes

• Observation on What the multi-host study found, and the maintainer's choice about 01a17ef8-6826-7000-92ff-3fc1b96f50e4, by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-27T20:16:47.798Z

  The study (multi-host-measurement, 27 Oct 2026) found: the Claude plan cannot be routed through another host (the Claude Code legal page says Anthropic does not permit routing requests through Free, Pro or Max plan credentials; only the unmodified Claude Code binary, logged in by its owner, is allowed); the free tiers mostly ended (Gemini CLI's free Google-account tier on 18 Jun 2026, Qwen OAuth on 15 Apr 2026; Copilot Free includes the CLI with the "auto" model and no published quota), and several free services train on what they receive, so only public or synthetic projects may go to them; this machine (16 threads, 13 GiB, no GPU) runs at most a 7B model, a plumbing test and not a measurement; Harbor (Apache-2.0) has one headless adapter per host, the module to extract, and LiteLLM can put one model behind every host. Whether a rule arrives can be measured in the six headless hosts at no cost with the host contract's stand-in API, once it gains the arms' files, a multi-turn script and a compaction responder. The maintainer chose to measure arrival now and decide obedience after seeing it, and to keep the comparison queues running on his own Claude Code login without re-reading the consumer terms.

ADR-96 · 0.1.4 closes with what is in flight and the findings of 27 October; the rest of the backlog and what the Agent Governance Toolkit teaches go to 0.1.5, the toolkit as a reading reference and an OWASP Agentic Top 10 page without a score accepted#

Twenty pull requests reached main on 27 October, and the day's measurements found what a release should not ship without: a rule recorded in mnema reaches the edit only in Claude Code, not in Codex, OpenCode, Copilot, Gemini or Qwen; read_record and bootstrap hand the superseded decision as a bare id; the files mnema init writes fail a repository's format check; an agent leaves governs empty on every decision; a new decision citing an old one is not offered the supersede; the instruction block lacks a complete record example; and the Marketplace publish must move to Entra ID before 1 December. 0.1.4 ships when those and the work in flight close (about three to four days); the rest of the backlog (proof and format hardening, host measurements, studies, hygiene) goes to 0.1.5. Microsoft's Agent Governance Toolkit (MIT) was studied as the maintainer's suggested base: it is a runtime guardrail (Rego/Cedar policy, SDKs, sandbox, SRE) whose audit is not verifiable by a third party (hash without a key, a shared HMAC, a rewritten JSON log capped at 10,000 entries) and whose OWASP 10/10 is a self-assessment backed by import checks. It is a reading reference, not code to adopt: from it 0.1.5 takes a page mapping mnema against the OWASP Agentic Top 10 (2026) item by item with no score, linked from the README and the site with a guard that its links resolve; a threat model of the record's text as untrusted input to the model (ASI06); read-only rule fixtures (a path and the verdict expected of the rules in force); and reconciling the two readings of the Antigravity hook.

Turned down:

Closing the whole backlog before releasing (seven to ten days): turned down, the site, the extension and the fixes would wait for studies that need the maintainer's decisions. Releasing only what is in flight: turned down, the edit-time gap in five hosts would ship known. The toolkit as a source for a testable policy language, or as an integration target with mnema as its proof layer: turned down for now, as reading reference only; Rego/Cedar, an "N/10" badge, shell detection by regex, shared-HMAC audit and a capped rotating log are not to be adopted. The OWASP map only in the workbench, or not made: turned down, mnema is not mentioned against OWASP anywhere today.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T00:38:27.973Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-97 · 0.1.5 takes the ideas of the 25-project study in four areas: proof, rules, adoption, and session and memory, the last ones each studied first because they change the format or spend quota accepted#

The study of 25 projects the maintainer listed (decision records and agent memory, agent governance and policy, provenance and MCP tooling, observability and evals; synthesis in the workbench) found none that proves non-tampering to a third party and no common hook standard across CLIs, so mnema's line holds and the ideas worth taking strengthen it. Proof: a proof bundle of one decision (mnema prove), a signed pre-registration of a comparison's design before its first session, verifying the witness with cosign verify-blob, and a Rekor v2 probe. Rules: rule fixtures checked against the record (mnema rules test), why as an explained verdict, a coverage count by layer with no score, and measuring what the gate does when its own hook hangs. Adoption: a one-screen npx recipe and the npm SLSA provenance in the README, an export to MADR with a round-trip test, an OTLP recipe for Langfuse and Phoenix, and a pinned MCP Inspector check. Session and memory: pinning chosen decisions at session open under a cap, an imported decision's claimed date labelled as the document's, projecting an addressed rule into each host's scoped rules file, and a red team of the record's own channel; these change the format or spend quota, so each is studied before it is built.

Turned down:

Leaving session and memory out: turned down by the maintainer, who took all four areas. Adopting a policy language (Rego, Cedar, OPA) or a DSL, a score or badge, rules matched on text or shell regex, a model or classifier in the gate, a mutable approvals store, a shared-HMAC or rotating log, mining transcripts, the OpenInference DECISION span kind, or code from Phoenix (ELv2) or OpenAgentLock (FSL): turned down by all four studies.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T00:58:42.715Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-98 · 0.1.4 ships with a first screen and docs that show the proof: the README opens on the pain, a quick start that reaches a result without an agent, a recording of verify catching a changed word, a stepped first record, a short install page with one line per host, and an installer with doctor and provenance; mnema init asks which hosts in a terminal accepted#

The three adoption studies (agent tools, onboarding, demos and choices) found the bottleneck is the first screen, not the product: the pain shows only on the README's third screen, the first result takes seven lines and four programs, verify catching tampering is said and never shown (its output appears nowhere), and a rule tied to a path reaching the edit, what sets mnema apart from a CLAUDE.md, is not taught on any page of use. The site goes live with 0.1.4 and reads the README and docs, so these ship with it: the README opens with the pain and the proposal in one sentence; a quick start reaches a result with no agent (init, decision, accept, link to a path, verify), the plugin in a second block; a recording generated from the binary shows verify failing after one word changes, with the honest caption that cutting the end of the record is not caught; docs/first-record.md in five steps, the third tying a rule to a path and showing mnema why; docs/install.md cut to its install part with one generated line per host, the rest moved to hosts and platforms pages; the installer with a pinned version, doctor as a step and the npm SLSA provenance. First use and community (a shorter init that says what it chose, a check prompt, a Contribute section, good first issues, a PR template line naming the agent and the reviewer, captures in the extension's README, a troubleshooting page by message) go to 0.1.5. mnema init asks, in an interactive terminal, which hosts' instruction files to write, and writes all four without a terminal (CI) or when told.

Turned down:

Everything in 0.1.4 (two to three more days): turned down, first use and community can follow the launch. Everything in 0.1.5: turned down, the site would launch on the current first screen. mnema init saying what it wrote and taking a --hosts flag without a question: turned down by the maintainer, who wants the question in a terminal. Keeping init writing the four files with no option: turned down. Named presets in init: turned down by the study, there are only two real profiles. Promising efficacy, badges, analogies to a notary or a blockchain: turned down.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T01:20:32.954Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-99 · 0.1.4 also takes four defects the engineering studies found, and 0.1.5 runs in the order proof, product, security and CI, flow and community; the landing's proof shows verify catching a changed word; after init the files on disk are the choice accepted#

Ten studies of forty projects (architecture and engineering, synthesis in the workbench) found mnema's core stronger than all of them and no tool worth adopting as a dependency, and four defects worth closing before the launch: the dead-session sweeper closes a task as complete with the note of a clean end (unknown is not success); a record_decision retried after a lost answer records a second decision (an optional idempotency key in a local journal outside the record, with no format change); the 2026-07-28 MCP specification removes initialize and deprecates Roots, which mnema uses for which agent speaks and which project (a CI probe of which hosts speak it, and a server test against a client without initialize); and two branches in one working tree may share a tail so that a merge keeping both repeats a sequence number (measured in a sandbox; a fix, if needed, goes to 0.1.5). 0.1.5 runs proof first (a mutation harness on the verdict modules, which were never measured; --since telling a cut from a divergence; verify --remember; hardening the writer; the threat model), then product (the supersede suggested at record, in force from X to Y, a retrieval benchmark, an architecture guard for the eight packages, the repository's own rules recorded with governs), then security and CI (the Scorecard items), then flow and community. The landing's proof shows the a-tamper-caught recording (verify catching one changed word), the promise itself, with a-write-refused kept in the README and docs. After mnema init, the instruction files on disk are the choice (doctor does not ask for the ones not chosen), and without a terminal init writes all four, with no new option.

Turned down:

Leaving the four defects to 0.1.5: turned down by the maintainer. Security and CI first in 0.1.5, or product first: turned down, proof first. Keeping a-write-refused on the landing: turned down, the promise is that tampering is caught. A --hosts option for init without a terminal: turned down, the letter of ADR-98 is all four.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T01:46:57.494Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-100 · The Marketplace publish leaves the global PAT through vsce's trusted publishing (--oidc) when the Marketplace accepts it, expected about 30 October; the Azure managed-identity path is held, and taken up by 15 November if trusted publishing has not arrived accepted#

The adversarial review of the Entra ID pull request (#1037) found the Azure path uncertain and costly: Microsoft documents a user-assigned managed identity for Azure Pipelines only, not for GitHub Actions; it needs an Azure subscription (a free one asks for a card); there is no documented way to find the identity's Marketplace profile id outside a pipeline; and the pull request left the az session open to the next step, which runs ovsx, third-party code. vsce 4 already carries --oidc, trusted publishing with the GitHub OIDC token and no Azure at all; the Marketplace backend still refuses it, and its team aimed on 21 October for the following week. The global PAT retires on 1 December. So #1037 is closed with its branch kept, the Marketplace's trusted publishing is watched, and a pull request using vsce publish --oidc follows when it is accepted; if it has not arrived by 15 November, the Azure path is taken up again from the branch, amended (az logout before the Open VSX step, the profile id printed by the first run, the header and changelog wording), with time left before 1 December.

Turned down:

Going ahead with the Azure managed identity now: turned down, uncertain steps and a subscription for a path that a simpler one may replace within days. A PAT scoped to one organization: turned down, Microsoft calls it a temporary workaround.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T01:48:24.126Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-101 · 0.1.4 also takes two proof defects a probe confirmed: a decision keeps the text its first writer recorded, as a note already does, and the Action reads the rules from the base of a pull request accepted#

A probe in the built binary showed that a second decision.recorded with the subject of an accepted decision changes its title and rationale while it stays accepted under the old acceptance note, and both readers verify the record; notes already keep the first writer's text and name the rewrite in the census. It also showed that the Action asks for the rules in the head checkout, so a pull request that supersedes a rule asking for a person and edits its file in the same diff passes the check, while the same edit without the supersede fails. Both are defects of the proof the product promises, found in this round, and ADR-99 already took the defects found while closing 0.1.4 into it.

Turned down:

Only the Action fix in 0.1.4, the decision rule at the opening of 0.1.5: turned down, because the rewrite leaves no sign in verify, show or the brief and touches what 0.1.4 publishes. Both in 0.1.5: turned down for the same reason; the fixes are small (a reading rule already written for notes, and running the rules against the base tree).

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T02:38:29.375Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-102 · The top ok of mnema verify --json is the verdict on the record: false over a broken record, as record.ok is; the old meaning, that the command ran, moves to a field named for it, and recordOk is not added accepted#

A probe showed verify --json answering "ok": true over a record with one changed word, with exit 1; a consumer that reads the field anyone reads first takes a broken record for a sound one. Adding recordOk beside it leaves that consumer deceived. The product is a beta that thinks forward, and what serves the proof wins over keeping the shape of a JSON published in 0.1.3; the change is stated in the CHANGELOG as Changed.

Turned down:

Keep ok as "the command ran" and add recordOk: turned down, because a consumer that reads only ok stays deceived. Drop ok from the top and leave recordOk and requirementMet: turned down, because it fails closed only by accident (undefined) and the verdict's name is less obvious than ok.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T02:53:53.948Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-103 · A decision is the text of its first decision.recorded in the merged order; every later writing of its id, by any identity and even with the same payload, is not applied and both readers name it in the census as decision-rewrite (FORMAT.md section 6.8) accepted#

The product mints a fresh id for every decision it records, so a second writing of one id is always hand-made; changing one's mind is a supersede. The first writing is the one kept, not the last, because an event's `at` is the signer's to choose. It is informational with the exit unchanged, the same posture as a stranger rewriting a note (section 6.4). It tightens an existing kind without a new version, and section 6.8 says that older binaries serve the last writing and name nothing.

Turned down:

Let the same identity rewrite, as notes allow: turned down, any key of that identity could change an accepted text. Stay silent on a byte-identical repeat: turned down, both readers would need a definition of identical for a case only hand-made lines reach. Filter the event out of the merged order like an illegal move: turned down, a wider change to the order and the cache; the fold rule matches the note precedent.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T03:45:50.591Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-104 · The .mnema/ events reach git sooner: 0.1.5 adds a warning of the events not yet committed (at the end of a session, in status and doctor) and a mnema record commit that cuts the record at a checkpoint and opens a pull request with it; a later Action warning names a decision a pull request cites that the committed record lacks accepted#

Measured in this repository: no commit of work carries .mnema/ events; 16 commits touch .mnema/, 11 of them pure record pull requests; an event waits 10.8 h on average for the commit that carries it, the worst 85 h; 78 events are pending now, the oldest 27 h old, and the Mnema-Decision trailer is in 0 of 1003 commits. The prepare-commit-msg hook acts only with an editor open, never on git commit -m, which is how an agent commits; nothing warns of a dirty .mnema/. A probe showed that a prefix of a tail cut at a checkpoint boundary verifies, with --since too, so the record can be committed in pieces without changing the format. The commit goes through a pull request, like any other change to the trunk. The cut follows the tail's order, not the state of a decision, so a proposed decision can be committed and reads as proposed.

Turned down:

Only the warning first, the command later: turned down, the warning alone leaves the person to cut the tail by hand. The warning in 0.1.4: turned down, the round is closing. A commit straight to the trunk: turned down, it bypasses review and the Action. Adding the events to the branch of the work's pull request: turned down for now, in a worktree flow it needs the tail's prefix copied from the main clone. A git hook that stages or refuses (c): turned down, it writes without asking and does not reach worktrees. Recording in the worktree of the work (f): turned down, the decision comes before the work and the tails multiply. Cutting only up to the last accepted event: turned down, it would hold accepted decisions behind a pending proposal.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T04:25:02.687Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-105 · 0.1.4 binds the text of a decision to its acceptance: an accept, a rejection or a supersede holds for the text it was made on, so a writing dated back from an older tail cannot become the accepted text accepted#

The review of the first-writer rule showed that a writer who already holds an older tail can date a forged decision.recorded before the honest one; it then sorts first, is served as accepted under the acceptance note of the honest text, and the census names the honest writer. The first-writer rule is strictly better than serving the last writing, but the promise that an acceptance keeps the text it was made on only holds once the text is bound to the acceptance. The maintainer chose to close it in this round rather than ship the rule with the gap stated.

Turned down:

Merge the first-writer rule with the gap stated in FORMAT section 6.8 and bind the text in 0.1.5: turned down by the maintainer, who wants the binding in the same round.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T04:27:28.901Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-107 · 0.1.4 marks in the event whether the name of the agent came from an MCP handshake, so a fact written by a client that never initialized, or that announced no usable name, says so instead of reading as an agent's announced name accepted#

A probe of the built server showed that a client which never sends initialize, as the MCP 2026-07-28 era allows, is answered and can write, and the fact carries which = unknown-agent, the same sentinel used for an empty name; nothing in the record says the name was missing, a client announcing the literal unknown-agent looks the same, and docs/what-it-proves.md says which is the name the client announces in its handshake. Claude Code and the Copilot CLI already probe server/discover before falling back to initialize, so the era is arriving. The maintainer chose to mark it in the event now rather than only correct the page.

Turned down:

Correct the page now and study the marking for 0.1.5: turned down by the maintainer, who wants the record itself to say it in this round. Refuse writes without a handshake: turned down, it would break the first host that speaks only the new era until the SDK migrates.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T17:19:27.670Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-108 · The mark of ADR-107 is a new kind, run.unannounced with handshake true or false, written in the same append as the run.started of a run whose agent is the server's default, and it marks that run only for the key that signed it accepted#

It changes no byte of any existing event and adds no envelope field, which FORMAT section 7.1 forbids inside an existing kind and version. A record written only by clients that announce a name stays readable by 0.1.3; a record that holds the mark is refused by 0.1.3, which names the kind it does not read. A client that announces the literal unknown-agent writes no mark, so it is told apart from the server's default.

Turned down:

run.started at a version 2 with an optional field: the first version 2 of the format; written always it makes 0.1.3 refuse every new record, and written only when marked it leaves a version-1 unknown-agent ambiguous between the literal and the default. A new envelope field: section 7.1 forbids it inside an existing kind and version. The run on the mark's envelope: the guard on every field requires the envelope's run to be text the caller passed.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T18:43:35.529Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-109 · A run.unannounced mark counts only where a run.started of the same key opened that run, every run.* fact whose subject is the run belongs to it, and two marks of one run mark it once whatever their handshake says accepted#

FORMAT section 6.9 promised that a mark with no birth marks nothing; requiring the birth by its presence, not its position, keeps the TypeScript, Python and SQL readers identical with no ordering rule. A run.ended named the run only by its subject and was counted as a declared name beside the marked facts, which is the confusion ADR-107 exists to remove. The handshake value is the writer's report; letting a second mark unmark a run, or the first win by order, adds a rule no reader needs.

Turned down:

The birth must come before the mark in the order: the writer appends both together, and an ordering condition is one more thing three readers must keep equal. The first mark in the merged order holds: an ordering rule nothing uses. Contradictory marks mark nothing: one extra mark would erase the statement of the first.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T19:27:33.120Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-110 · The Action fails a pull request that edits a file a rule in force refuses a write to, until a person other than the author approves, the same way it fails one that a rule asks a person about accepted#

A rule that refuses a write was shown in the comment while the check passed, so the strongest rule weighed less than the one that only asks for a person. Failing until another person approves keeps the Action consistent and does not lock the repository against an urgent fix.

Turned down:

Fail with no approval that unlocks it, the rule retired first in a separate pull request: stricter, and it can block an urgent fix. Keep it informational: a refusal would weigh less than a request for a person.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T20:47:36.415Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-111 · The opening of a session lists the blocked tasks of sessions nobody saw end only for the last days, and counts the older ones in one line; nothing new is written accepted#

A swept session that never comes back stayed for ever as stalled work in the list each session opens with, which grows with every abandoned terminal. Filtering at reading time keeps the record saying exactly what happened and adds no fact.

Turned down:

Cancel the task after some days with the reason that it was abandoned: one more fact, and it leaves the list for good. Leave it as it is: the list grows until someone acts by hand.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T20:47:36.457Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-112 · A memory or an observation recorded again with the same text in the same tree returns the one on the record, as a decision does since #1051; a task does not accepted#

A write repeated after a lost answer duplicates a note today. Two notes with the same words in the same tree are the same note; two tasks with the same title can be two pieces of work.

Turned down:

All three, tasks by title and an open state: two real tasks with one title would be merged. Decisions only, as now: duplicated notes keep coming back in the opening.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T20:47:36.502Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-113 · From 0.1.5 a binary meets a kind it does not know by checking the line's hash, chain and signature, not reading its payload, and naming the kind in the census with the exit unchanged; this joins the format promise of 1.0 accepted#

run.unannounced, the first kind added in 0.1.x, makes 0.1.3 refuse the whole tail that holds it, so a new kind breaks every older reader. Skipping and naming keeps the integrity check whole and lets the format grow; binaries already published keep refusing.

Turned down:

Refuse always: simpler and stricter, every new kind needs every reader updated. Study before choosing: delays a rule the 1.0 promise needs.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T20:47:36.570Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-114 · An accept concurrent with a retirement of the same decision is probed in the binary in 0.1.5 before its rule is chosen, between the retirement winning and the divergence named with nothing in force until a person settles it accepted#

Today both moves apply and the latest at wins, and at is what the writer declares. Changing the reading without a probe of what happens, including a forged at, would choose on a premise not measured.

Turned down:

The retirement wins now: a reading change with no probe behind it. Leave it as it is: the declared time decides.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T20:50:26.607Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-115 · How mnema charges a rule that asks for more work than the edit is designed after the comparison of ADR-106 measures the parity rule with a neutral prompt as a rate, then studied in 0.1.5 among an end-of-turn check of the companion path, a request for a person when it is missing, and the Action accepted#

The failure-modes comparison showed the parity rule reaching the model at the edit and being reported, not done, in every plugin session; the task's prompt pointed at the JS package, so reporting may have been right. A rate from a neutral prompt is the baseline any way of charging it must improve on.

Turned down:

An end-of-turn check now: needs a companion path on the rule, a format change, designed before its baseline. Only the Action: the session would never be charged.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T20:50:26.790Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-116 · The applyTo of the instructions file keeps double quotes, prettier's default, and the docs say what a project with singleQuote does; the Windows path limit stays documented until a user meets it accepted#

Double quotes pass a default prettier; single quotes would fail every project on the default to suit those that set singleQuote. Shortening the record's paths changes the format for a limit no user has reported.

Turned down:

Single quotes: pass projects with singleQuote and fail the default ones. Shorter record paths: a format change for a limit not yet met, left to the format study of 0.1.5.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T20:50:26.904Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-117 · Which of the 27 MCP tools to cut or merge is decided in 0.1.5 from the use mnema usage --tools measures in real sessions and in the next comparison accepted#

Each tool's description costs tokens in every session, but the data on which tools are used is thin; cutting on it could remove the one a host needs.

Turned down:

Cut the never-used ones now: on too little data. Leave the 27 as they are: the cost in every session stays unexamined.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T20:50:27.026Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-118 · The front page's figure says "Accepted," in the Rule step, not "Accepted by a person,", since an agent may accept where agent-accepts is on, the default accepted#

The sentence under the figure now says who may accept; the figure said only a person, which contradicts it on the first screen. The shorter word is true and keeps the drawing as it is.

Turned down:

"Accepted by a person or an agent,": all of it in the figure, a longer text that may need the box redrawn. Keep "by a person": the figure would contradict the line under it.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-28T22:04:18.695Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

ADR-119 · The comparison after 0.1.4 spends no money: the other hosts run one session each on one free OpenRouter model fixed in the pre-registration, after a capability check, and the rate with ten repetitions is measured only in Claude Code accepted#

The maintainer has no money for the 10 USD provider key ADR-106 assumed, so the round must fit free quota. A study of 29 October found that OpenRouter's free models allow 50 requests a day per account (1,000 only after 10 USD bought), summed over every free model, while a parity session takes about 40 requests: ten repetitions in five hosts in both arms would take about 80 days. So the other hosts get one session each, a story and not a rate, on one free model fixed by exact id, provider and catalogue snapshot in the pre-registration (Nemotron 3 Ultra free, Gemma 4 31B free as the named substitute), with no provider fallback and a session discarded if the model or provider served differs. Codex, Copilot CLI, OpenCode and Qwen Code accept OpenRouter; Gemini CLI and Cursor CLI do not and are reported as not measured. Before the sessions, a capability check: a model that cannot finish a trivial task with three MCP calls is reported as incapable, not as disobedient. Free models log or train on prompts, so the repository of that block is public or synthetic. The rate, with ten repetitions, stays in the Claude Code block, which runs on the maintainer's subscriptions.

Turned down:

Measuring only Claude Code and leaving the other hosts to the rule-arrival measurement that needs no model: turned down, it leaves no session of the other hosts at all. Each host on its own native free tier: turned down, the models differ per host, so it proves only the plumbing, and several of those tiers ended in 2026 (Gemini CLI's login tier, Qwen Code's OAuth tier, GitHub Models). Buying 10 USD of OpenRouter credit for 1,000 requests a day: outside the constraint, no money.

Recorded by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code at 2026-10-29T13:44:01.656Z.

Accepted by mnid:da5e81926983b6a8cdbf7bb41856bc7a5370e664a67c7366f70e32692e3b33d4 agent claude-code.

Supersedes ADR-106: The comparison after 0.1.4 runs at size S with the parity cells at ten repetitions, measures the other hosts with one open model through a provider key capped at 10 USD, counts a rule reported or asked about apart from one obeyed or kept silent, and is pre-registered as a public decision before its first session (superseded).