[maksymhryzodub-prog]

Stacked on #27 (lean context) → #26 → #25 → #24. US3 of specs/001-ecc-agent-principles, tasks T045–T062, plus the second security-review fix for US1.

What

• agent/instinct slice — a learned behaviour is one markdown file in .agent/memory/instincts/: trigger, action, confidence, source, evidence refs, pinned, reinforced. Starting confidence by source: explicit admin rule 0.9 (pinned, core), correction 0.6, error-resolution / repetition 0.5. reinforce +0.05 (cap 0.95), correct −0.2 (floor 0.1), decay −0.05 per decayDays without reinforcement (pinned exempt), once a day on the heartbeat. Bands suggested 0.3 / apply 0.5 / core 0.8; prune removes unpinned behaviours below suggested for > 2×decayDays. A contradicting pair keeps the higher confidence in the prompt and lists the conflict.
• Review retargeted — the aux-model review answers in JSON: facts for MEMORY.md ## Learned plus instincts to create / reinforce / correct, with session:<id>#<eventId> evidence. Malformed output teaches nothing. The same trigger learned again reinforces instead of duplicating (stable id = slug + hash).
• Prompt — core behaviours render under ## Standing rules, apply-band under ## Learned behaviours, capped by maxInjected; new instincts section in the breakdown.
• Operator — /learned (by band, evidence counts, conflicts), show, pin/unpin, prune [id], promote <id…> (writes skills/learned-<slug>/SKILL.md for review, reloads skills), export. agent_status.learned.
• Invariant (FR-016) — instincts only ever reach the prompt; the guard never reads them.

Plan deviation

T056 ("reinforce on use") is implemented through the review pass's reinforce items rather than by crediting every rendered behaviour after every turn — the latter would push everything to core within a handful of turns regardless of whether the trigger ever occurred. The curator is asked to report reinforce only when the conversation actually applied the behaviour without complaint.

Security-review fix (US1)

Persisted tool_call params and tool_result payloads are credential-masked as well, not only the model's copy — the transcript syncs to S3. The size cap keeps its CLEAN-124 full-on-disk / trimmed-in-context split.

Tests / evals

• bun test: 279 pass (+25: instinct service 15, gateway 4, memory review 3, loop persisted-redaction 1, …), 1 pre-existing Windows-only failure.
• bun run eval: guardrails 31/31, skill-selection 96/100, corrections 13/13 — one instinct at 0.6 rendered, the next matching message follows it (SC-004).
• tsc --noEmit: clean apart from the pre-existing bridleAttachments.spec.ts.

Jira: https://dreamvention.atlassian.net/browse/CLEAN-154

🤖 Generated with Claude Code