Update Cargo.lock with 40 changed files (#2679)

[rysweet]

Summary

Concise workflow-generated PR for Cargo.lock.

Issue

Closes #2679

Changed files

• Cargo.lock
• Cargo.toml
• docs/architecture/distillation-semantic-handoff.md
• docs/architecture/episode-distillation.md
• docs/concepts/brain-relative-ooda-cycle-counter.md
• docs/concepts/e2big-elimination.md
• docs/concepts/journal-report-tone-contract.md
• docs/dashboard.md
• docs/design/creative-ideas-thread.md
• docs/howto/add-a-safe-agent-spawn-site.md
• docs/howto/configure-creative-ideas-thread.md
• docs/howto/inspect-the-ooda-cycle-counter.md
• docs/howto/verify-the-distillation-semantic-handoff.md
• docs/index.md
• docs/reference/creative-ideas-api.md
• docs/reference/dashboard-activity-cycle-reports.md
• docs/reference/dashboard-chat-multiline-input.md
• docs/reference/dashboard-chat.md
• docs/reference/dashboard-goal-hierarchy-priority.md
• docs/reference/dashboard-overview-health-and-live-memory.md
• docs/reference/distill-write-boundary-gate.md
• docs/reference/durable-ooda-cycle-counter.md
• docs/reference/large-payload-spawn-api.md
• docs/reference/simard-memory-remember-cli.md
• docs/reference/telemetry-metrics.md
• docs/research/coin-benchmark-and-skwaq-study.md
• mkdocs.yml
• prompt_assets/simard/recipes/distill-episodes.yaml
• scripts/simard-ooda.service
• src/base_type_copilot/mod.rs
• src/bin/simard_engineer_loop_recipe.rs
• src/bin/simard_self_improve_recipe.rs
• src/cognitive_memory/creative_idea.rs
• src/cognitive_memory/library_adapter.rs
• src/cognitive_memory/mod.rs
• src/cognitive_threads/threads/creative_ideas.rs
• src/cognitive_threads/threads/mod.rs
• src/creative_ideas/mod.rs
• src/engineer_loop/agent_spawn.rs
• src/engineer_loop/tests_goal_records_migration.rs

Diff stat

 ...still-parser-launch-banner-pretty-envelope.yaml |  107 -
 .../distill-parser-outer-envelope-banner.yaml      |   90 -
 .../distill-parser-unbalanced-brace-prose.yaml     |  118 -
 tests/gadugi/distill-reliability.yaml              |  104 -
 tests/gadugi/distill-semantic-handoff.yaml         |  134 ++
 tests/journal_report_tone_contract.rs              |  212 --
 tests/meeting_e2big_transport.rs                   |  144 --
 tests/meeting_goals.rs                             |    2 -
 tests/memory_consolidation_lifecycle.rs            |    2 -
 tests/ooda.rs                                      |    1 -
 tests/ooda_daemon.rs                               |    3 -
 tests/overseer_launch_e2big_transport.rs           |  144 --
 .../distill-ansi-step-output-parse.yaml            |   66 -
 ...still-pretty-fact-launcher-substring-parse.yaml |   83 -
 .../qa-scenarios/distill-trailing-comma-parse.yaml |   89 -
 tests/recipe_ooda_step_parity.rs                   |    1 -
 tests/self_improve_e2big_transport.rs              |  109 -
 tests/signal_e2big_transport.rs                    |  148 --
 tests/spawn_payload_facade.rs                      |  295 ---
 147 files changed, 4816 insertions(+), 13410 deletions(-)

Behavior

Implemented behavior through these branch commits:
8e18de7 feat: Delete the brittle JSON extraction/deserialization gate from Simard's di
ea0a652 perf(distill): trim redundant work on the per-fact write-boundary gate
6207b8b refactor(distill): consolidate the write-boundary gate into one shared function
9735567 wip: checkpoint after implementation (steps 7-8)

Validation

ℹ NODE_OPTIONS=--max-old-space-size=32768 (saved preference). To change: /home/azureuser/.amplihack/config
I'll start by understanding the current state of the repository and the changes made.

● Get branch name, status, and recent commits (shell)
│ cd /home/azureuser/src/Simard/worktrees/feat/issue-2679-delete-the-brittle-json-extractiondeseri
│ alization && git branch --show-current && echo "---STATUS---" && git status && echo "---LOG---"
│ && git --no-pager log --oneline -15
└ 24 lines…

Let me look at the changes made in the 3 commits ahead of origin.

● Show file-level diff stats against origin (shell)

Risk

No high-risk subsystem pattern detected from changed paths.

Checklist

• Branch has 4 commit(s) ahead of main
• Code review completed
• Philosophy check passed

---

This PR was created as a draft for review before merging.

---

Step 16b: Outside-In Testing Results

Tested the PR branch from the user/consumer boundary as an external user would drive it.

Detected toolchain

• Language / package manager: Rust + Cargo (Cargo.toml at repo root, crate simard v0.28.0).
• Entry point / user boundary: the real simard binary, specifically the new simard memory remember / simard memory remember-procedure write tools the distiller agent drives during a semantic-handoff pass (SIMARD_MEMORY_SOCKET).
• Dependency: amplihack-memory pinned via git rev e005a596… (memory-engine logic lives in amplihack-memory-lib, per the G2 constraint — no new fork depth in src/memory_consolidation).

Chosen strategy

Per the qa-team skill's repo-type detection, a Rust CLI repo uses cargo test as the outside-in harness (no gadugi framework required). Ran one simple happy-path scenario at the true process boundary (spawned binary) plus several edge/integration scenarios, including the headline #2679 regression (noisy/trailing-comma agent stdout must no longer be able to fail the pipeline because it is no longer parsed).

Scenarios

#	Type	Scenario	Command	Result	Key output
1	Simple	Grounded fact written by the real spawned binary clears the gate and is retrievable from semantic memory — no document parsed anywhere	cargo test --test bin_simard_memory_remember_cli remember_cli_stores_grounded_fact_end_to_end	✅ pass	stored concept=bug-pattern; fact present via search_facts
2	Edge	Headline #2679 regression: exit-0 recipe emitting launcher banner + ANSI + tracing lines + a trailing-comma-malformed {"facts":[…],} on stdout is SUCCESS (stdout is never parsed)	cargo test --lib sec_t6_noisy_trailing_comma_stdout_is_not_parsed_and_does_not_fail	✅ pass	precondition asserts stdout is strict-invalid JSON; interpret_recipe_exit returns Ok
3	Edge	Empty stdout on exit-0 is success (result is in memory, not stdout)	cargo test --lib sec_t6_empty_stdout_on_exit_zero_is_success_not_parse_failure	✅ pass	interpret_recipe_exit(exit 0, "") → Ok
4	Edge	Non-zero recipe exit is the only surfaced terminal failure (no silent success, no parse_fail class)	cargo test --lib nonzero_exit_is_a_surfaced_terminal_failure	✅ pass	RpcError naming distill + exited
5	Integration	Ungrounded fact (cites non-existent episode) is quarantined at the process boundary; nothing leaks into memory	cargo test --test bin_simard_memory_remember_cli remember_cli_quarantines_ungrounded_fact	✅ pass	exit 4, stderr quarantined, search_facts empty
6	Integration	No reachable daemon → exit 3 (no un-gated on-disk fallback)	cargo test --test bin_simard_memory_remember_cli remember_cli_no_daemon_exits_3	✅ pass	exit 3, stderr no reachable memory daemon
7	Integration	Missing required --content → usage error (exit 2), never reaches daemon	cargo test --test bin_simard_memory_remember_cli remember_cli_missing_required_flag_exits_2	✅ pass	exit 2, stderr missing required --content
8	Integration	Companion procedure write commits through the same live socket (recurring-procedure half of the handoff)	cargo test --test bin_simard_memory_remember_cli remember_procedure_cli_stores_end_to_end	✅ pass	exit 0, stored name=fix-and-verify

Broader affected-module sweep (single command):

cargo test --lib -- distillation_semantic_handoff fact_reliability memory_ipc::tests_gated_write_2679 memory_consolidation::distillation
# result: ok. 49 passed; 0 failed

Process-boundary suite:

cargo test --test bin_simard_memory_remember_cli
# result: ok. 5 passed; 0 failed

Constraint verification

• ✅ No extract_json_payload / balanced_objects / serde_json::from_str gate remains in the distillation result path — the trailing-comma/noisy-stdout failure mode is now structurally impossible (there is no parse to fail). Remaining extract_json_payload callers are only in src/ooda_brain/recipe_brain.rs (verdict paths), filed as follow-ons.
• ✅ parse_fail failure class is no longer reachable; the only result-path failure is a non-zero recipe exit.
• ✅ Additive/back-compatible: legacy DistillRecipeRunner::run stub keeps working (default run_agentic commits its facts through the in-process gated sink).
• ✅ No new stray println!/eprintln! in prod hot paths — the CLI's stdout/stderr are its intentional, test-asserted user contract.
• ✅ No new Bridge identifier introduced — bridge is a pre-existing SimardError field (used across rpc.rs, gym_client.rs, etc.); only new usages were added, tracked by follow-on Pre-existing 'bridge' identifier leaks into the new 'simard memory remember' error output (#2679 follow-on) #2735.
• ✅ Follow-on issues filed for the other agent→agent stdout-scrape sites: Semantic handoff for the OODA brain decide/orient verdict: stop scraping extract_json_payload from recipe stdout #2715 (OODA brain decide/orient verdict), Semantic handoff for the merge-readiness judge verdict: stop scraping extract_verdict from recipe stdout #2716 (merge-readiness judge verdict), Pre-existing 'bridge' identifier leaks into the new 'simard memory remember' error output (#2679 follow-on) #2735 (pre-existing bridge identifier leak in remember error output).

Fix count

0 — all 8 outside-in scenarios (and the full 54-test affected-module sweep) passed on the first run; no diagnose/fix/commit iterations were required.

[rysweet]

HIGH — pass_id never reaches the agent, so the real-path fact count is always 0.

invoke_recipe exports SIMARD_DISTILL_PASS_ID here and also passes -c pass_id=…, but nothing consumes either:

• simard memory remember (run_remember_fact) reads the pass id only from the --pass-id flag — it never reads SIMARD_DISTILL_PASS_ID.
• distill-episodes.yaml never declares pass_id in context, never references {{pass_id}}, and never tells the agent to pass --pass-id.

So every agent-issued remember runs with an empty pass_id; the server no-ops the ledger for an empty id (ledger_record_stored early-returns), and run_agentic → drain_pass_ledger(pass_id) returns 0. Net effect on the production subprocess path: facts are stored correctly, but DistillCommit.facts == 0 always, so DistillReport.fact_count, the simard.distill.facts counter, the distill_success_rate fact_count, and reduction_pct (always 100%) are all wrong. This defeats acceptance criterion #9 ("fact count sourced from successful remember writes").

Every test passes --pass-id explicitly (see tests_gated_write_2679.rs, bin_simard_memory_remember_cli.rs), which is exactly why the suite is green and misses this.

Suggested fix (matches the already-exported env var): in run_remember_fact/run_remember_procedure, fall back to the env var when the flag is absent:

let pass_id = parsed.pass_id.clone()
    .or_else(|| std::env::var("SIMARD_DISTILL_PASS_ID").ok())
    .unwrap_or_default();

Add a test that drives the real path (no explicit --pass-id, env set) and asserts a non-zero drained count.

[rysweet]

HIGH (same root cause). pass_id defaults to empty whenever --pass-id is absent, which is the production case (the distiller agent is never instructed to pass it). Combined with the dead SIMARD_DISTILL_PASS_ID env export in invoke_recipe, the write ledger is never populated on the real path and the drained fact count is always 0. Prefer reading SIMARD_DISTILL_PASS_ID here as a fallback so the count works without relying on the LLM remembering a flag. Same applies to run_remember_procedure (line ~470).

[rysweet]

MEDIUM — procedures bypass the write-boundary gate entirely. StoreProcedureProvenance stores unconditionally: no grounding check against source_episode_ids, no reliability score, no dedup (same in InProcessFactSink::commit_procedure and the remember-procedure CLI). The recipe prompt promises "a fact whose id is not in the batch is quarantined by the server," but a procedure citing fabricated/nonexistent episode ids is persisted with no such guard. If suppressing ungrounded records is a goal of #2679, this is an open door. At minimum ground the procedure (require ≥1 source_episode_id to resolve via episode_exists) or document the intentional asymmetry.

[rysweet]

MEDIUM (perf) — episode_exists materializes the entire episode set on every call. get_episodes(usize::MAX, true) loads all episodes (including compressed) into a Vec, then linear-scans. In gated_fact_write this runs per cited episode-id per fact (source_episode_ids.iter().any(episode_exists)). For a pass writing N facts against a store of E episodes that is O(N·E) with a full materialization each call — a real cost on the hot write path for a long-lived store. Consider a targeted existence lookup, or have the server resolve/caches the batch episode-id set once per pass_id.

[rysweet]

LOW — dedup recall is capped at 5. search_facts(concept, 5, confidence) only inspects the top 5 same-concept facts, so an equal-or-stronger true duplicate ranked beyond position 5 is not detected and a near-duplicate can be stored. Dedup is best-effort, but the magic 5 silently bounds it; a brief comment on why 5 suffices (or keying the search more tightly than the concept label) would help.

[rysweet]

Step 17b — Comprehensive Code Review (#2679: delete the brittle distillation JSON parse gate)

Verdict: request changes (posted as a comment — gh is authed as the PR author, so the formal Request changes state is unavailable). The core architecture is sound and well-documented, but there is one HIGH functional defect that the current tests structurally cannot catch, plus a few medium/low items.

What's good

• The central goal is achieved. The distillation result path no longer parses any agent-authored document: interpret_recipe_exit decides success from exit status alone, parse_fail/ParseFailure is genuinely unreachable and removed, and a noisy/trailing-comma stdout can no longer discard a batch. Shared extract helpers are left intact for out-of-scope callers.
• Gate consolidation is clean. fact_reliability::commit_gated_fact is the single shared score→threshold→dedup→persist core; both seams (IPC StoreFactGated, in-process InProcessFactSink) defer to it, so they cannot drift. Good doc comments and unit coverage.
• Solid socket hardening. MAX_FRAME cap enforced before allocation, 0700 parent dir / 0600 socket perms, fail-closed grounding, per-field length caps, and the server never trusts the client confidence hint.
• Retry-safety preserved: on runner failure no episode is marked, so the batch stays fully retry-eligible.

HIGH — real-path fact count is always 0 (pass_id never reaches the agent)

invoke_recipe exports SIMARD_DISTILL_PASS_ID and passes -c pass_id=…, but nothing consumes either:

• simard memory remember reads the pass id only from --pass-id; it never reads the env var.
• distill-episodes.yaml never declares pass_id, never uses {{pass_id}}, and never tells the agent to pass --pass-id.

So every agent remember runs with an empty pass_id → ledger_record_stored no-ops → drain_pass_ledger returns 0 → DistillCommit.facts == 0 on the production subprocess path. Facts are still stored, but DistillReport.fact_count, the simard.distill.facts counter, the distill_success_rate fact_count, and reduction_pct (pinned at 100%) are all wrong — defeating acceptance criterion #9. Every test passes --pass-id explicitly, which is precisely why the suite is green and misses this. Fix: fall back to SIMARD_DISTILL_PASS_ID in the CLI when the flag is absent, and add a real-path test (env set, no flag) asserting a non-zero drained count. (Inline on distillation.rs:767 and operator_cli/memory.rs:366.)

MEDIUM

• Procedures bypass the gate entirely — no grounding, no reliability score, no dedup in StoreProcedureProvenance, commit_procedure, or the remember-procedure CLI. A procedure citing fabricated episode ids is persisted unconditionally, unlike facts. Ground it or document the asymmetry. (Inline on server.rs:234.)
• episode_exists perf — materializes the full episode set (get_episodes(usize::MAX, true)) and linear-scans on every call; invoked per cited id per fact on the hot write path → O(N·E) per pass. Use a targeted existence lookup or cache the batch's id set per pass. (Inline on library_adapter.rs:1183.)

LOW

• Dedup recall capped at 5 (search_facts(concept, 5, confidence)): an equal-or-stronger duplicate beyond the top 5 slips through. Best-effort, but worth a note or tighter keying. (Inline on fact_reliability.rs:224.)
• pass_ledger only shrinks on drain — an undrained pass_id leaks for the daemon's lifetime. Bounded by pass count; add a size/TTL cap once the HIGH item is fixed (until then the ledger stays empty anyway).
• Exit-code overload: run_remember_fact returns 3 for both "no daemon" and a gated-write transport error, but the help text documents 3 as "no daemon" only. Minor diagnosability nit.

Checklist

• Code quality/standards: ✅ good structure, strong docs, no new stray println!/eprintln! in hot paths (CLI stdout/stderr is the intentional contract).
• Test coverage: ⚠️ adequate for the gate/parse-removal, but has a blind spot — no test drives the real recipe path without an explicit --pass-id, which hides the HIGH defect. Procedure grounding is untested.
• No TODOs/stubs/swallowed exceptions: ✅ (best-effort telemetry paths intentionally swallow and are documented).
• No unimplemented functions: ✅.
• Logic correctness: ❌ the pass_id/ledger wiring is broken end-to-end on the production path (HIGH).
• Edge-case handling: ✅ empty/oversized/ungrounded facts handled; ⚠️ ungrounded procedures are not.

Recommendation: fix the HIGH pass_id wiring (+ real-path test) before merge; address procedure grounding and episode_exists cost as fast-follows if not in this PR.

[rysweet]

Step 17c — Security Review (#2679: delete the brittle distillation JSON-parse gate)

Read-only security specialist traced every attacker-controlled input source (IPC socket bytes, CLI argv, env vars, untrusted episode/agent content) to each sink (allocation, deserialization, subprocess spawn, filesystem, socket bind).

Verdict: ✅ PASS — no exploitable vulnerability introduced by this PR

No CRITICAL/HIGH/MEDIUM finding meets the reporting bar: no injection, no unsafe deserialization, no panic reachable from network/CLI input, no privilege-boundary crossing, no secret leak.

Verified safe (checks that passed)

• Unix socket connect authZ — spawn_server binds <state_root>/memory.sock, then sets socket 0600 and parent dir 0700 (src/memory_ipc/server.rs:40, :62). connect() to an AF_UNIX socket needs the write bit, so owner-only mode restricts connection to the owning user. chmods are best-effort (let _ =), but the kernel-default socket mode (0777 & ~umask → typically 0755) still withholds group/other write, so a chmod failure does not open the socket to other local users.
• Socket bind / symlink-TOCTOU — remove_file(&socket_path) precedes UnixListener::bind (server.rs:52-53); a pre-planted symlink is unlinked, then a fresh socket bound. bind does not follow/reuse an attacker file; the daemon holds the listening fd.
• Frame length / unbounded-alloc — read_frame validates the 4-byte length against MAX_FRAME (8 MiB) before vec![0u8; len] (src/memory_ipc/mod.rs:319-329, :302). A hostile length prefix cannot force a giant allocation.
• Deserialization of client bytes — serde_json::from_slice::<MemoryRequest> is error-mapped with ?, not unwrap (server.rs:129-130); a malformed message ends only that one connection thread. No unwrap/expect/index/panic! added on parsed client data.
• Per-field input caps — gated_fact_write enforces non-empty + MAX_CONCEPT_LEN 256 / MAX_CONTENT_LEN 64 KiB before storing (server.rs:368-381).
• Confidence not trusted from client — StoreFactGated binds confidence: _client_hint and re-derives the score server-side (server.rs:196-198, src/fact_reliability.rs:210).
• Subprocess spawn — no command injection — RecipeRunnerSubprocess::invoke_recipe uses Command::new("recipe-runner-rs") with pure argv + .env(...); no sh -c/bash -c; untrusted episode text delivered via file channel + JSON, never interpolated into a shell string (src/memory_consolidation/distillation.rs:757-777).
• Temp file creation — ContextFile::write uses tempfile::Builder…tempdir() (unique 0700 dir); no predictable/world-writable path; Debug omits the payload (src/recipe_context_file.rs:55-92).
• CLI argument handling — parse_remember_fact_args handles only scalar --flag/--flag=value tokens (src/operator_cli/memory.rs:273-331); no shelling out, --confidence parsed as f64 with error handling.
• Sensitive-data logging — success/quarantine logs emit concept= + numeric confidence, never fact --content, tokens, or credentials (operator_cli/memory.rs:380-396); server logs only connection errors.

Defense-in-depth notes (NOT vulnerabilities — all within the same-user trust boundary)

1. Un-gated MemoryRequest::StoreFact remains dispatchable on the same socket (server.rs:183-192), bypassing the grounding/scoring/dedup gate that StoreFactGated applies. Not an authN/authZ issue (reaching the socket already requires the owning local user) — a data-quality boundary. Consider removing or gating the un-gated variant so the write path has a single hardened entry point.
2. SIMARD_MEMORY_SOCKET / SIMARD_DISTILL_PASS_ID env-var trust (mod.rs:86-95, distillation.rs:764-767): redirecting these requires control of the process environment (same-user), so out of the threat model — noted for awareness only.
3. episode_exists scans get_episodes(usize::MAX, true) per grounding check (cognitive_memory/library_adapter.rs): resource/DoS concern over the store's own data (same-user), not a security boundary — see the Step 17b review's MEDIUM note.
4. XPIA via untrusted episode content → distiller LLM: content is framed as data to distill; the exposed tool surface is the gated simard memory remember only (grounding requires a real in-batch episode id), and the spawn path uses argv not a shell. Bounded impact, no high-confidence exploit path.

Security checklist: ✅ security requirements met · ✅ no new vulnerabilities · ✅ sensitive-data handling clean · ✅ authZ = same-user socket boundary (adequate) · ✅ no injection (argv-only spawn, size-bounded/error-mapped deserialization).

[rysweet]

Step 17d — Philosophy Guardian Review (#2679: delete the brittle distillation JSON parse gate)

Evaluated against PHILOSOPHY.md (ruthless simplicity, brick philosophy, Zero-BS, proportionality, error visibility).

Compliance checklist

Principle	Verdict	Notes
Ruthless simplicity achieved	✅ PASS	Net ~−4.4k lines. Deletes the whole family of brittle JSON extraction/parse-tolerance scenarios and the parse gate; result path is genuinely parse-free. Textbook "code you don't write has no bugs" and "easier to remove complexity than add it."
Bricks & studs pattern followed	⚠️ PARTIAL	InProcessFactSink, the shared gate fn, and the remember CLI have clear contracts. But there's a broken stud: the runner exports SIMARD_DISTILL_PASS_ID / -c pass_id=… yet no consumer exists — a connector wired to nothing. Two divergent write paths (facts gated vs. procedures ungated) is a boundary inconsistency.
Zero-BS implementation	❌ FAIL	See below — silent metric degradation + non-functional plumbing. This is the blocking finding.
No over-engineering	✅ PASS	Change is subtractive. Minor arbitrary constants only (dedup cap = 5, overloaded exit code 3). Proportional.
Clean module boundaries	⚠️ PARTIAL	Broken runner→CLI boundary (dead env/context var); pass_id swallowed via unwrap_or_default() at the server boundary.

❌ Zero-BS violation (blocking) — silent degradation of the metrics path

PHILOSOPHY.md is explicit on exactly this scenario:

• "No swallowed exceptions: Handle errors transparently and ensure they are visible during development."
• "Optional host-tool work must skip visibly with an explicit note instead of silently degrading; strict workflow work must fail loudly with an actionable message."
• Areas to embrace complexity → Error visibility: make problems obvious and diagnosable.

The runner exports SIMARD_DISTILL_PASS_ID and passes -c pass_id=…, but nothing reads either — the CLI only reads --pass-id, and the recipe never tells the agent to pass it. parsed.pass_id.clone().unwrap_or_default() then silently defaults to an empty string, so the pass ledger no-ops and drain_pass_ledger returns 0. Facts store correctly, but fact_count, simard.distill.facts, and reduction_pct are always wrong (0 / 100%) with no error surfaced. That is precisely the "faked-looking API / swallowed error / silent degradation" anti-pattern the philosophy forbids, and it defeats the change's own acceptance criterion for reporting. All tests pass --pass-id explicitly, masking the production gap.

Required to reach compliance: wire a real consumer (env-var fallback in the CLI or --pass-id in the recipe), replace the silent unwrap_or_default() with a loud failure/warning when the pass id is missing on the distill path, and add a real-path test that does not pass --pass-id explicitly.

Non-blocking philosophy notes

• Boundary consistency (MEDIUM): procedures bypass grounding/reliability/dedup — either document this as intended asymmetry or route both through the shared gate. episode_exists materializing the full episode set per call on the hot write path is an error-visibility-neutral perf smell, not a philosophy blocker.
• Magic constants (LOW): dedup cap of 5 and overloaded exit code 3 — name/justify them.

Verdict

NEEDS CHANGES. Strong simplification win (this is the right architectural direction), but it does not pass the Zero-BS / error-visibility gate: the metrics path silently degrades and dead env-var plumbing looks functional while doing nothing. Fix the pass-id propagation (loud failure + real-path test) before merge; the remaining notes are non-blocking.

Posted as a comment: gh is authenticated as the PR author, so a formal request-changes state is unavailable.

[rysweet]

Step 17e — Blocking issue addressed (commit e375b1a)

The HIGH / blocking finding from the code review (16b) and philosophy review (16d) — the SIMARD_DISTILL_PASS_ID pass-id never reaching the remember CLI, so drain_pass_ledger always returned 0 and every distill pass silently reported fact_count = 0 / reduction_pct = 100% (acceptance criterion #9) — is now fixed.

Root cause (confirmed)

The runner exported SIMARD_DISTILL_PASS_ID and passed a dead -c pass_id, but nothing consumed either: the CLI only read the --pass-id flag and the recipe never told the agent to pass it → unwrap_or_default() emptied the pass id → the server's ledger_record_stored no-ops on an empty id. Only tests (which pass --pass-id explicitly) exercised the ledger, hiding the production breakage.

Fix (robust, not LLM-dependent)

• operator_cli/memory.rs — new resolve_pass_id(): non-empty --pass-id wins, else fall back to the SIMARD_DISTILL_PASS_ID env var that every remember subprocess inherits. Used by both run_remember_fact and run_remember_procedure. This deliberately does not rely on the agent echoing a flag — that would reintroduce the exact LLM-formatting failure surface distillation parse-failure rate 91% #2679 set out to delete.
• memory_ipc/mod.rs — shared DISTILL_PASS_ID_ENV const (no more stringly-typed drift).
• distillation.rs — use the const; removed the dead -c pass_id plumbing (the "broken stud" the philosophy review flagged).
• distill-episodes.yaml — documents that pass-id flows via env and the agent MUST NOT pass --pass-id.
• Tests — remember_without_flag_tags_ledger_from_env_pass_id: real-path regression driving run_remember_fact with no --pass-id against a live gate, asserting the ledger counts the fact (a 0 here is the regression). Plus resolve_pass_id_prefers_flag_then_env pinning precedence.

Re-review verdicts

• Code review (16b): resolved. The functional bug tests couldn't catch is now covered by a real-path test with no explicit flag.
• Philosophy (16d): resolved. Silent degradation removed — the metrics path now reports true counts; dead runner→CLI plumbing deleted; unwrap_or_default() on the swallowed pass id replaced with an explicit resolution helper.
• Security (16c): still PASS. The env fallback only sources a ledger HashMap key (trimmed, no shell/path/SQL use); removing -c pass_id reduces surface. Same-user env-var trust boundary is unchanged.

Verification

cargo build ✓ · cargo clippy --all-targets --all-features --locked -- -D warnings ✓ · targeted lib tests (remember_tests + tests_gated_write_2679 + distillation) ✓ · pre-push race subset (memory_ipc / memory_consolidation, release) ✓.

The MEDIUM/LOW items (procedure write-path asymmetry, episode_exists full-scan, dedup cap, exit-code 3 overload) remain as noted and are non-blocking.

[rysweet]

Step 18b — Review feedback implemented (commit 3c6db2fe)

All Step 17 review items are now resolved. The sole blocking item (pass-id
never reaching the agent → fact_count always 0) was already fixed in
e375b1af; this commit addresses the remaining non-blocking items:

#	Item (severity)	Resolution
1	pass_id not propagated — HIGH/blocking	✅ already fixed (e375b1af, verified)
2	Procedures bypass the write-boundary gate — MEDIUM	Added a grounding guard: a procedure that cites source episodes none of which resolve is now rejected fail-closed (no dangling PROCEDURE_DERIVES_FROM edges); a procedure citing nothing is unchanged. Documented the fact/procedure symmetry (procedures carry no reliability score).
3	episode_exists full-materializes per call — MEDIUM(perf)	Added batch any_episode_exists: the gate now materializes the episode set once per fact instead of once per cited id (O(cited·episodes) → O(episodes)). Default trait impl falls back to per-id probing; LibraryCognitiveMemory overrides for the hot path.
4	Dedup recall capped at magic 5 — LOW	Extracted DEDUP_PRIOR_SCAN_LIMIT with a justification comment.
5	Exit code 3 overloaded/unnamed — LOW	Named EXIT_STORED/EXIT_USAGE/EXIT_NO_DAEMON/EXIT_QUARANTINED; documented that 3 is intentionally shared for any failed daemon round-trip, distinct from 4 (completed round-trip, gate rejected). Keeps the documented 0/2/3/4 contract stable.
6	Un-gated StoreFact still dispatchable — def-in-depth	store_fact is a broadly-used general API (manual writes, imports, tests), so removing it would break legitimate callers. Documented it as the trusted in-process/same-user direct-write path, distinct from the gated distillation boundary.

Security review (17c) passed with no required changes.

Tests: added regression coverage — ungrounded-procedure rejection and
multi-id batch grounding. cargo fmt, cargo clippy --all-targets -D warnings,
and the pre-push release test subset (cognitive_memory|bootstrap|memory_ipc|memory_consolidation)
are all green.

[github-actions]

📊 Coverage Summary

Generated by cargo llvm-cov --workspace --summary-only (nightly, excluding test files)

Module	Lines	Covered	Coverage
Total	148105	123846	83.6%

_{Coverage data from CI run. Test files matching tests?/ are excluded from line counts.}