Roadmap: Person memory

The phases land in order. PRs inside a phase can run in parallel unless one depends on another.

Phase 0: two sweep fixes

Both are independent of the rest and can go upstream now.

• The context trim drops by priority (retrieval order, round-robin across targets) instead of popping the tail of the sorted list. The wire order stays the same.
• The extraction packet stops showing profile values whose evidence the same run is retracting. A failing test comes first, and the fix ships only if that test fails on main.

Phase 1: foundations, with no model calls

Unlocks: owner-written memory, review and healing, proven before any model writes to it.

• Observations. Atomic free-text statements about one person, stored beside the fact ledger and never written into profile fields. Each machine-written one cites a verbatim quote inside an existing evidence row. Levels are explicit, deductive, inductive and contradiction.
• Healing. When a cited message is deleted, edited, unlinked or reassigned, the ledger's existing evidence status events recompute support in the same transaction. No support left means unsupported; support back means active again. Derived rows follow their premises through the whole graph.
• Merges and splits. A person merge carries owner observations, decisions and rejections to the survivor, and an exact split restores them.
• Owner surface. Add your own observations, then confirm, pin, mark unsure or reject any row from the CLI and API. A rejection suppresses by content hash, so the same text doesn't come back.
• Stability rule. Attributes and observations get a stability class: fixed, durable, volatile or episodic. It tunes the resolver's freshness and staleness per class. It doesn't change the apply threshold, and pins still win.
• Standing instructions. A ledger for rules a person stated about how they want to be addressed or contacted, like "call me Vee", stored with the quote. An instruction can only narrow behavior. It never authorizes a send, a recipient or an address. Owner-only in this phase.
• Novelty building blocks. Batch vector reads, the scoring kernel, anchors and selection records.
• One combined migration, plus per-person memory state and the rule that decides when a person is due.
• personality and contact_frequency leave automatic extraction. Self-descriptions become explicit observations, and personality is written by the owner or promoted from an accepted tendency. This changes shipped behavior.

Phase 2: observations from the sweep

Unlocks: the sweep keeps what typed fields miss.

• A new observation pass proposes explicit observations and instruction candidates from what the person wrote, each with its quote. It runs on its own claim after extraction. The extraction program and its fingerprint don't change, so existing consent stays valid.
• It gets its own provider profile and consent, off by default.
• Context citations: a third-party report, or an owner proposal the person agreed to, is stored as context and never counted as the person's own words.
• Novelty-ranked evidence selection, behind the current recency default. When there's more evidence than budget, keep the newest first, then spend the rest on messages least like what the ledger already cites for that person. It scores exact cosine in Go over the message vectors that already exist on this machine, so there's no new egress. When vectors are missing, partial or stale, it falls back to today's recency order exactly. Ships with a preview command and an offline eval.

Phase 3: sweep memory and behavioral tendencies

Unlocks: conclusions that span many messages, held to evidence the owner can check.

• Sweep memory. Per-person state carried between runs: a code-written cursor over what a run was shown, pending rechecks, and open hypotheses that didn't have enough evidence yet. Notes start in shadow mode.
• Deduction, then induction. Two bounded, single-shot programs per pass, with no tool loop. Deduction finds knowledge updates, implications and contradictions. Induction finds tendencies.
• Tendencies read as evidence, not labels: "In your archive, alice tends to reply with one or two lines." Code renders the sentence from a fixed frame (tends to, often, usually, has repeatedly, seems to prefer) and rejects absolute words, clinical or personality-type labels, guesses about motive, and moral judgments.
• Code decides trust. Support is counted from messages the person wrote, across independent conversations and calendar months. The lowest band needs at least 3 contexts over 2 months and 30 days. Below that, the result is an open hypothesis, not a conclusion.
• Never inferred from special categories. Behavior never leads to a conclusion about health, sexuality, religion, politics or the other special categories, whatever the owner opts into. The only path near them is deduction from what the person said about themselves, behind a separate per-category opt-in that's off by default, with a per-person deny list.
• Owner-reviewed, owner-only, never auto-applied. Every tendency starts as a proposal. Only the owner can accept one, so MCP clients and delegated tokens can't. Tendencies never reach CardDAV, and reading them needs its own permission.
• Its own consent purpose, person_trait_inference, with per-person enrollment. Off by default.
• CLI and API, then TUI and Web, each with a drill-down from a tendency to its premises and quotes.

Phase 4: readers and polish

• Rebuild requests for briefs and instructions after their support goes away.
• MCP reads: list_person_observations, confirmed instructions, and get_person_traits.
• Person card blocks for stable markers, instructions and tendencies.
• Observation-text embeddings under their own purpose, off by default, and semantic merge.
• Sweep notes on.
• Novelty becomes the default, only after it meets its eval bar.
• A live eval harness for tendencies.

What stays the same

• Evidence first. Every machine-written statement cites a verbatim archive quote, and loses support when its source goes away. Derived rows cite the observations they come from.
• Consent-gated. Each new model program has its own consent, off by default. Typed extraction and briefs keep today's people_inference consent and fingerprint. Novelty selection reads only local vectors.
• Owner-only where it matters. Owner decisions and pins win. Automatic paths never change a confirmed or pinned row; they flag it. Instructions reach MCP clients only once the owner confirms them, as attributed data, never inside a system prompt.
• Exclusions apply everywhere. Drafts and unsent messages, hidden-text messages, list mail, automated senders, owner identities, cold rooms and quarantined messages never count as evidence.
• SQLite and PostgreSQL behave the same. No query scans message_bodies. Fixtures use synthetic people.

Questions for review

• When a recheck never gets a model answer, should a confirmed row go to an owner queue while a proposed row is downgraded?
• Is 365 days the right default history window for the first observation pass when a profile sets none?
• How much of the budget should novelty selection keep for the newest messages before it picks the rest?