Use producer-owned material identity for attention replay

.github/workflows/ci.yml

@@ -13,6 +13,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5

AGENTS.md

@@ -1,29 +1,32 @@
-# Agent Sensorium Development Notes
+# Agent Sensorium development
 
-This repo is the development source for the Agent Sensorium Hermes plugin.
+Develop in an isolated checkout. Installed plugin code, private configuration, bindings, accounting and runtime records are separate owners and must remain untouched unless an operator separately authorizes adoption.
 
-## Guardrails
+## Scope and safeguards
 
-- Build in this repo first; do not edit `~/.hermes/plugins/agent-sensorium/` directly unless installing a tested snapshot.
-- MVP must remain pull-based and local-only.
-- **Repair posture:** a host agent who is patching the Sensorium plugin itself (in this repo or in the live `~/.hermes/plugins/agent-sensorium/` install) must do it via an async worker lane unless the change is ≤3 tool calls, reversible, and mostly judgment/synthesis. See the `agent-sensorium` bundled skill's *Repair posture* section and `lead-orchestrator-posture` § *Sensorium repair preflight*.
-- No proactive Discord/DM delivery in MVP.
-- No model-backed Subconscious pass until the deterministic spine is verified.
-- Runtime state must live outside the repo unless tests use temp dirs.
-- Keep enhancement proposals separate from accepted MVP scope.
+- Keep ordinary Sensorium pull-based and local-first; no unsolicited outbound delivery or external task creation.
+- Validate canonical instance/owner and closed sensitivity/surface boundaries before effects. Preserve exact leases, source replay, presentation and source-bound outbox owners.
+- Advisory confidence routes attention; it cannot authorize durable memory, tasks, artifacts or delivery. Model-backed advisory stays explicitly opt-in.
+- Runtime state belongs outside reusable source; tests use isolated synthetic stores. Never embed real identities, conversations, host locations, account configuration or private receipts in source, fixtures, docs or packages. Preserve public license attribution.
+- Bound changes by file ownership. For substantial repair, use an isolated worker/worktree and independent review; do not overwrite another contributor's work, require a private orchestration framework or patch live state during diagnosis.
+- Keep proposed behavior separate from implemented guarantees. Do not install clocks/services, migrate real accounting, run providers or publish as an incidental development step.
+
+## Documentation and status
+
+Read [architecture](docs/attention-and-workroom/architecture.md), [rationale](docs/attention-and-workroom/design-rationale.md), [migration](docs/attention-and-workroom/migration.md) and [change scope](docs/attention-and-workroom/change-scope.md). Producer material replay, multi-record bounded progress and optional latent metadata are implemented with focused regressions and independent source review; bind complete-suite and privacy evidence to the exact source before adoption. Native/workroom/owner/transport are proposals, not a synthetic substitute framework or live capability proof. Request-time quota, failed-read preconsumption, journal/migration, lifetime continuation and whole-tree/active cancellation are proposed strengthenings. Gateway compatibility and Wiki security remain held.
+
+The [bundled skill](skills/agent-sensorium/SKILL.md#development-and-repair) separates ordinary use, admin and repair. The [documentation index](docs/README.md) links existing canonical contracts.
 
 ## Verification
 
-Run before committing code changes:
+Prefer small reviewable changes and tests first for pure store/gate/dispatcher logic. Keep core stdlib-only and handlers directly callable without a live host. Use synthetic offline fakes for proposed native/provider/process contracts; actual model, memory and service-manager proofs need separate authorization.
+
+Development commands (not an execution receipt):
 
 ```bash
+python -m pip install -e ".[test]"
 python -m pytest tests -q
 python -m py_compile agent_sensorium/*.py scripts/*.py
 ```
 
-## Implementation style
-
-- Small commits per phase.
-- Tests first for pure store/gate/dispatcher logic.
-- Prefer stdlib-only for MVP.
-- Tool handlers must be callable directly in tests without a live Hermes runtime.
+Run relevant checks and a complete suite against the frozen source before acceptance. Preserve failures/skips as evidence, not automatic fixture obsolescence. Validate relative documentation links and inspect the full source and built distributions for privacy separately. Installation, real migration, activation, commits and publication require their own authority; a focused green test set is not release readiness.

README.md

@@ -4,7 +4,9 @@ An environment-reactive attention substrate for Hermes agents. Agent Sensorium c
 
 **Authority boundary.** Agent Sensorium is an attention substrate, not an outbound automation switch. It does not send messages, create tasks, or reach out on any platform without explicit operator configuration and a conscious-tier receipt from the agent. Sensitivity tuning, surface gating, and action policies are recorded in operator-controlled configuration files so the runtime boundary stays auditable.
 
-**Repair posture (host-agent note).** Sensorium is local code, but a host agent repairing its own attention substrate from the foreground is a self-referential hazard: the very attention it is using to fix the substrate gets re-shaped mid-repair. Host agents and their leads must apply the delegate-vs-foreground gate from `lead-orchestrator-posture` before patching anything in this repo, the installed `~/.hermes/plugins/agent-sensorium/` tree, or the gateway/cron that drives it. The bundled `agent-sensorium` skill has the *Repair posture* section. Inline repair is reserved for ≤3 tool-call reversible judgment/synthesis slices.
+**Development and repair.** Work in an isolated checkout, preserve installed runtime and state, and validate a frozen snapshot before any separately authorized installation. Keep diagnosis, source edits and live adoption separate. For substantial repairs, use a bounded worker or worktree with explicit file ownership and independent review; no particular agent framework is required. See the [bundled skill](skills/agent-sensorium/SKILL.md#development-and-repair) and [developer instructions](AGENTS.md).
+
+**Implementation status.** Producer-owned material replay/coalescing, multi-record bounded index progress and optional read-only held/dormant metadata are implemented with synthetic regression coverage and independent source review. Native sessions, finite workrooms, persistent accounting and choice transport are **proposed**, not installed features. Gateway compatibility and Wiki security remain held. Exact-source test and package/privacy receipts, host integration, installation and publication are separate gates; this documentation is not a release or deployment receipt. See [architecture](docs/attention-and-workroom/architecture.md), [rationale](docs/attention-and-workroom/design-rationale.md), [migration](docs/attention-and-workroom/migration.md) and [complete change scope](docs/attention-and-workroom/change-scope.md).
 
 ---
 
@@ -46,7 +48,7 @@ Core pieces:
 
 - **Plugin registration (`agent_sensorium/plugin.py`)** — registers one live tool, the admin toolset, two `pre_llm_call` hooks, and the bundled skill.
 - **Profile state (`agent_sensorium/store.py`, `config.py`)** — stores signals, events, candidates, threads, decisions, artifacts, and per-profile config under `~/.hermes/agent-sensorium/<profile>/`.
-- **Gate and promotion pipeline (`gate.py`, `attention.py`, `threads.py`)** — normalizes salience, applies sensitivity/surface policy, and builds candidate/thread state.
+- **Gate and promotion pipeline (`gate.py`, `attention.py`, `tools.py`)** — normalizes salience, applies sensitivity/surface policy, and builds candidate/thread state.
 - **Memory Volunteering Protocol (`docs/memory-volunteering-protocol.md`)** — formalizes the evidence-cited capsule → transparent confidence proposal → Conscious authorization sequence for any Subconscious/Sensorium path that wants to volunteer memory, insight, or offer candidates.
 - **Pre-LLM hooks (`pointers.py`, `pre_llm_salience.py`)** — inject compact reminders/pointers before model calls without mutating state.
 - **Deterministic tick scripts (`scripts/sensorium_tick.py`)** — run heartbeat/pressure sensors, compaction, and thread service from cron or manual smoke tests.