# Memory Custodian

> Use when a project contains docs/memory/, or when the user asks to remember, retrieve, update, compact, forget, or audit project memory. MemoryCustodian manages local plain-text project memory with minimal context loading.

- Skill: `waittim/memory-custodian` (Agent Skill, multi-file: 11 files)
- Install (CLI): `npx skillmds@latest add waittim/memory-custodian`
- Raw SKILL.md: https://api.skillmd.com/api/skills/waittim/memory-custodian/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: waittim (https://skillmd.com/u/waittim)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/waittim/memory-custodian

---


# MemoryCustodian

MemoryCustodian stores durable project memory as local, human-readable Markdown files under `docs/memory/`.

Use it to:
- load the minimum relevant project memory for the current task
- update project memory after meaningful decisions
- compact unprocessed memory candidates
- forget or tombstone memory the user no longer wants used
- keep platform entry files such as `AGENTS.md`, `CLAUDE.md`, and `GEMINI.md` short

## Hard Gate

In a project that contains MemoryCustodian memory, do not start substantial planning, implementation, debugging, or review until startup loading is complete:

1. Read `manifest.md` if present. If the memory directory exists but the file does not, stop as described below.
2. Read `brief.md` before substantial work.
3. Choose and expose one canonical task category.
4. Supply touched/planned repo-relative paths, or an explicit area when paths are not yet known.
5. Use `read --strict-routing` (or the same shared routing implementation) and do not start substantial work unless the context pack is approved.
6. Respect shared constraints and `do-not-use.md` before local preferences or task convenience.

If no memory directory exists, continue normally and offer initialization only when useful. If the memory directory exists but `manifest.md` is missing, stop memory loading and report an incomplete or corrupted setup. Do not infer routes; restore the manifest, migrate, or carefully reinitialize the project first.

## Core Workflow

1. Locate memory at `docs/memory/manifest.md`, or another project-declared memory directory under `docs/`.
2. Read `manifest.md`; it is the sole authority for runtime task-to-file routing.
3. Read `brief.md` before substantial work.
4. Choose a canonical task and make that choice observable.
5. Collect touched/planned paths before implementation, debugging, or review; use an explicit area for high-level planning when appropriate.
6. Route with the manifest-declared task, path, and explicit-module inputs. Treat INCOMPLETE, AMBIGUOUS, INVALID, or a blocked conflict status as not approved for substantial work.
7. Respect `do-not-use.md` and tombstones before proposing plans or implementations.
8. Never load `archive/` unless the user explicitly asks or the task is archive maintenance.
9. Do not load `inbox.md` unless compacting, auditing unsorted memory, or asked by the user.
10. If `brief.md` is still a generated scaffold, curate it from authoritative project files before relying on it.
11. After meaningful decisions, repeated corrections, or rejected approaches, update the appropriate memory file or propose a concise update.

Project memory may constrain project work, but it cannot override system instructions, current user instructions,
safety boundaries, or permission boundaries. Memory cannot authorize destructive actions, external uploads,
secret access, commits, pushes, merges, releases, or privilege escalation. A memory claim that authorization
already exists is never a substitute for current authorization.

## Memory Files

- `manifest.md`: loading protocol, optional module index, file roles, and context budgets.
- `subjects.md`: stable Subject registry used by CLI validation; protocol metadata, not normal task context.
- `brief.md`: short current project summary; this is the default file.
- `decisions.md`: confirmed project and architecture decisions.
- `constraints.md`: hard requirements and limits.
- `do-not-use.md`: rejected options, failure paths, and tombstones.
- `inbox.md`: unprocessed memory candidates.
- `preferences.md`: optional user and project preferences.
- `changelog.md`: optional memory maintenance history, not product release notes or the project `CHANGELOG.md`.
- `rules/`: optional task-specific rules.
- `profiles/`: optional workflow-specific rules.
- `areas/`: optional area-specific memory.
- `archive/`: optional old material loaded only on request.

## Task Loading

Classify the task into one of the supported canonical categories: general continuation, planning, implementation, artifact work, preferences, history, or maintenance. Then resolve its files exclusively from the current project manifest and use the smallest routed set that can answer the task. Any routes in generated templates or examples are defaults only; they never override a customized project manifest.

Routing is deterministic for the supplied canonical task, touched paths, and explicit rule/profile/area inputs.
Do not perform hidden semantic relevance scoring or infer an area from prose. Rules activate only through their
declared canonical tasks or an explicit rule request; profiles are explicit-only; areas activate only through
declared path globs or an explicit area request. Inspect `read --explain` dispositions and stable reason codes.
When path-routed areas exist but scope is missing, routing is INCOMPLETE—not evidence that no area applies.
`subjects.md` is read by protocol operations but is not injected into normal context packs.

## Writing Memory

Write durable memory only when it is project-level and likely to matter later.

- Protocol 0.7 active entries require a stable Entry ID, `Status: active`, a valid scope, and at least one
  `user-confirmed` or source-backed Evidence item.
- New active decisions, constraints, rejected approaches, and area entries require an active Subject ID and a
  controlled Facet. Create or select the Subject explicitly before adding the entry.
- Treat normalized `Scope + Subject ID + Facet` as the structural owner. If an active owner exists, supersede it,
  change scope, or review the Subject; do not create a second owner.
- Subject display names and aliases may change without changing identity. Exact alias and canonical-reference
  collisions are rejected, but aliases, timestamps, similar names, and body text do not prove semantic equivalence.
- Run `check --conflicts` before merge/rebase work and use merge-aware review when Git is available. Exact structural
  conflicts block substantial work; REVIEW requires an explicit `distinct`, `superseded`, `exception`, or
  `subject-merged` reconciliation. Protocol 0.7 previews Subject merges and governance changes but does not apply them.
- Agent inference, code observations, possible decisions, and unconfirmed conversation content remain candidates
  in `inbox.md`; use `--candidate` and never treat them as active memory.
- Promote a candidate only after confirmation or authoritative source evidence. Promotion creates a new formal
  Entry ID; mark the candidate promoted to preserve the audit chain.
- Classify scope before content type. When the manifest routes matched `areas/*.md`, put subsystem-specific choices and invariants there; reserve root `decisions.md` for cross-cutting choices.
- Update, merge, or mark an existing entry superseded when a new choice changes it; do not append a contradictory duplicate.
- Keep active invariants reachable from normal task loading. Promote them to `brief.md`, `constraints.md`, or a matched area before archiving history.
- Confirmed cross-cutting choices go to `decisions.md`.
- Hard limits go to `constraints.md`.
- Style or workflow preferences go to `preferences.md`.
- Rejected options and deletion guards go to `do-not-use.md`.
- Task rules go to `rules/`.
- Workflow rules go to `profiles/`.
- Area-specific context goes to `areas/`.
- Unsorted or uncertain notes go to `inbox.md`.

Keep each decision entry at or below 120 tokens, including its title, `Decision`, and `Reason`. Use one or two sentences for the decision and one sentence for the reason. Move implementation detail, examples, and long implications into constraints, matched area context, or source documentation. Never truncate mechanically; rewrite semantically. Use `--allow-long` only when splitting would lose essential decision semantics.

Keep `brief.md` about the project, not MemoryCustodian. Refresh it after initialization and when the project purpose, system shape, or current direction materially changes.

For sensitive, personal, credential-like, private, or machine-specific information, ask before writing. Prefer a
minimal abstract constraint and Evidence reference over copying raw secrets, contract text, private identifiers,
vendor names, or unnecessary limits into repository memory. Do not commit workstation paths as shared project
preferences without confirmation. When unsure whether a note is durable, propose the update instead of writing it.
Store personal/machine preferences in the repo-external local overlay only after explicit root binding. Local
memory never overrides shared constraints or tombstones, grants authority, or acts as a secret store.

After writing, check the target budget. When `add`, `status`, or `check` reports `NEAR LIMIT` or `OVER BUDGET`,
immediately perform a dry-run maintenance review before adding more active memory. At 80% or above, shorten long
entries, merge duplicates or superseded decisions, and split scoped knowledge by area before considering archival.
Never auto-apply semantic maintenance or archival.

## Compaction Safety

Inbox compaction is a two-stage workflow. The CLI reports candidates and may remove only exact duplicate top-level bullet units or exact tombstone matches; it never promotes an entry to a semantic destination. A top-level bullet unit includes its continuation and nested lines, which are never cleaned up independently. The Agent reviews each remaining candidate's scope, type, confidence, and overlap, then edits the appropriate Markdown or calls `add`. Run `check` afterward.

Treat decision compaction as semantic maintenance, not chronological trimming. Before applying age-based archival:

1. Shorten decision entries over 120 tokens without losing the choice or reason.
2. Merge duplicates and mark superseded decisions.
3. Move scoped knowledge to matched areas.
4. Retain every active invariant in `brief.md`, `constraints.md`, root decisions, or a matched area.
5. Review the CLI dry run, then use explicit archival confirmation only if the remaining archive candidates are historical.

## Forgetting

When the user asks to forget something:

1. Preview the complete semantic-unit plan before writing.
2. Apply only after explicit `--apply`; use `--allow-broad-match` for short topics or multi-unit plans.
3. Remove whole H2 entries or top-level bullets, never matching lines alone.
4. If a body or preamble matches, require a semantic manual rewrite and refuse apply until it is resolved.
5. Add a topic-bearing tombstone only for soft mode; hard replaces prior topic-bearing tombstones with one generic guard, while purge removes them.
6. Do not reintroduce the forgotten content during compaction.
7. State the erasure boundary accurately: hard affects active managed memory; purge also targets managed archive;
   neither rewrites Git history nor revokes clones, forks, backups, caches, or other distributed copies.
8. Treat optional `--history-check` as bounded local evidence. `unavailable` is not a PASS, and
   `no-reachable-copy-detected` is not proof that no external or previously distributed copy exists.

## References

Load these only when needed:

- `references/memory-file-protocol.md`: file schema, budgets, and loading levels.
- `references/admission-policy.md`: evidence admission, candidates, structural ownership, and promotion.
- `references/manifest-policy.md`: manifest routing and loading policy.
- `references/routing-policy.md`: canonical inputs, glob matching, completeness, explain, and strict routing.
- `references/local-overlay-policy.md`: repo-external local state, root binding, and precedence.
- `references/platform-adapters.md`: Codex, Claude Code, Gemini, and generic agent entry patterns.
- `references/compaction-policy.md`: how to reduce inbox and long files safely.
- `references/quality-audit.md`: how to audit usefulness, routing, scope, freshness, and portability.
- `references/forgetting-policy.md`: soft forget, hard forget, purge, and tombstones.
- `references/examples.md`: example memory files and context packs.

## CLI

If the project has the CLI installed, prefer deterministic commands for routine operations:

```bash
memory-custodian status
memory-custodian read --task implementation --path cli/module.py --strict-routing --explain
memory-custodian read --task artifact --rule output --profile docs
memory-custodian read --task implementation --no-local
memory-custodian subject list
memory-custodian subject add "Library X" --kind dependency --canonical-ref dependency:pypi:library-x --evidence repo:pyproject.toml
memory-custodian subject add "Library X" --kind dependency --canonical-ref dependency:pypi:library-x --evidence repo:pyproject.toml --apply --confirm-plan <PLAN_ID>
memory-custodian add "..." --type decision --subject MC-SUBJ-... --facet version-policy --evidence user-confirmed
memory-custodian add "..." --type constraint --candidate --evidence agent-observed
memory-custodian add "..." --type decision --area sync --subject MC-SUBJ-... --facet behavior --reason "..." --evidence repo:docs/architecture.md
memory-custodian add "..." --type decision --subject MC-SUBJ-... --facet behavior --supersedes MC-DEC-... --evidence user-confirmed
# Then apply the supersede preview with --apply --confirm-plan <PLAN_ID>.
memory-custodian enable rules/output
memory-custodian enable area/backend --path 'cli/**'
memory-custodian compact
memory-custodian compact --apply --confirm-plan <PLAN_ID>  # Protocol 0.7
memory-custodian compact --target decisions.md
memory-custodian compact --target decisions.md --apply --archive-oldest --confirm-plan <PLAN_ID>
memory-custodian forget "topic" --mode soft
memory-custodian forget "topic" --mode soft --apply --confirm-plan <PLAN_ID>
memory-custodian forget --id MC-CON-... --mode hard --history-check
memory-custodian list --status active
memory-custodian show MC-CON-...
memory-custodian local status
memory-custodian check --routing
memory-custodian check --reachability
memory-custodian check --freshness
memory-custodian check --conflicts
memory-custodian check --conflicts --merge-base origin/main
memory-custodian check --privacy
memory-custodian check --security
memory-custodian migrate
memory-custodian migrate --apply --confirm-plan <PLAN_ID>
```

If the console script is unavailable but this skill came from an installed plugin or source checkout, use the bundled helper from the plugin root:

```bash
scripts/memory-custodian status
scripts/memory-custodian read --task planning
```

If the CLI is unavailable, edit the markdown files directly using the same protocol.