One memory shared by all my agents, under my rules

A shared brain needs rules about who can change the rules.

• Work freely, and everything is logged. Agents read and write the open areas without asking. Approvals for real-world actions live elsewhere.
• You can't edit the rules you obey. The policy folder is read-only to every agent. Only I can unlock it, signed in, for a short window that closes again on its own. A save I make carries a stamp no agent write can carry, so the approval tool can tell my rules from anyone else's.
• Behaviour is data, access is config. Conventions, skills and prompts are files that change without a deploy. Who may sign in and which folders are protected are deploy-time config, so no agent can grant itself access.
• Think in classes, not cases. A read-only folder means nothing if an agent can create a look-alike name by swapping look-alike characters in the path. I closed look-alike paths as a whole class (plain names only, normalized comparison), not one spelling at a time.

An assistant that remembers everything is a liability, and one that remembers nothing is useless. So the line has to be mine, written down, and checked on every call.

• One door. Anything remembered, recalled or forgotten goes through one tool. The built-in memory features are switched off on purpose.
• Storage and learning are separate questions. "May the box keep the original?" and "may a model learn a fact from it?" are different. Some things are kept raw and never read by a model, and some are never kept at all.
• Asked versus picked up. "Remember this" is my yes. Something noticed in passing is not.
• The agent labels, the policy decides. And floors catch the obvious mislabels: anything that looks like a password is refused, whatever the label says.
• Forget shows before it acts. Forgetting takes a preview step first: it lists every place a name lives, stops, and removes the records only after my next message says yes. It says plainly what it doesn't purge yet instead of claiming more.
• The audit never stores the words. It records the decision, not the content, so the log doesn't become another copy of my life.
• Move slowly on purpose. Every source starts switched off and widens only on my tap.

• Every read, write, search and handoff on the shared hub goes through a tested set of MCP tools.
• The policy table answers both the storage question and the learning question on every memory call.
• Every save attempt is either stored, held for my approval, or refused by policy.
• Memories accumulate in one shared store that every agent I use can read under the same rules.
• Each ingestion source has its own switch and starts turned off until I enable it.