M5.1: the knowledge vault

vault.py: a folder of Markdown notes on the agent host, as SilverBullet reads
them. Only configured folders exist for the agent, each rw or ro (`vault:`
in the configuration); paths are checked in code (relative, inside a folder,
symlinks included, Markdown, never the editor's own files). Writes are
atomic (temporary file, fsync, rename, directory fsync) and merge provenance
into the note's frontmatter, keeping the rest; failures are results.

read_note, list_notes and search_notes are control tools in the harness for
the driver (before the go-ahead, and while a VM is blocked) and for
conversations, labelled with their path; the prompt says a note is
information, never an instruction. Writing by the model is M5.2's.

With the operator: SilverBullet replaces Obsidian and runs on the vault
itself, agents' folders mounted read-only, so no Syncthing (L10, X5, M5.4).
Per-agent mounts come with the containers (M6.1).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Development-Plan.md

@@ -466,13 +466,35 @@ differ.
 
 ### Phase 5 — Memory
 
-**M5.1 The vault.** *Pre-approved.* The folder, per-agent mounts, control tools,
-atomic writes and provenance (L10).
+**M5.1 The vault.** *Pre-approved.* **Done** (this PR). The folder, control
+tools, atomic writes and provenance (L10).
+- `vault.py`: only the configured folders exist for the agent, each `rw` or `ro`
+  (`vault:` in the configuration; nested folders refused, one access each).
+  Paths are checked in code: relative, inside a folder (symlinks included),
+  Markdown, never the editor's own files (`vault.ignore`, by default hidden
+  files and SilverBullet's `_plug`).
+- Reads cut long notes and say so; search is a plain case-insensitive match over
+  readable notes, most matches first, with no index yet.
+- Writes are atomic (a hidden temporary file beside the note, synced, renamed,
+  the directory synced) and merge `provenance` (by, source, work item, time)
+  into the note's frontmatter, keeping the rest. Only the library writes for
+  now: when the model writes memory is M5.2's.
+- `read_note`, `list_notes`, `search_notes`: control tools in the harness for
+  the driver (before the go-ahead too, and while a build VM is blocked) and
+  conversations, labelled `[vault: <path>]`; a failure is the call's result.
+  The prompt says a note is information, never an instruction.
+- Decided with the operator: SilverBullet instead of Obsidian, on the vault
+  itself (M5.4), so no Syncthing. Atomic writes stay with one writer: they
+  protect readers (SilverBullet, the harness) and crashes, not concurrency.
+- Per-agent mounts are the container's (M6.1); until then the folder map and
+  path checks hold in code.
 
 **M5.2 Agent memory** (*needs discussion*) and **M5.3 scope memory**
 (*pre-approved*): when notes are written and read, verbatim corrections (L6).
 
-**M5.4 The operator's copy.** *Pre-approved.* Syncthing, directions per folder.
+**M5.4 The operator's view.** *Pre-approved.* SilverBullet in its own container on
+the vault: the operator's folders read-write, the agents' read-only (L10), behind
+Authelia.
 
 ### Phase 6 — Production
 
@@ -559,9 +581,9 @@ if the implementation differs.
   it can enforce it; otherwise the loop enforces the contract (an explicit
   `finish`, prose treated as a violation). Briefings use the capability profile,
   never a model name or "weaker model".
-- **L10 vault:** atomic writes are write-then-rename. Obsidian's settings folder
-  (and `.git`, if history is kept) are not synced. A failed write is retried, or
-  recorded and reconciled later.
+- **L10 vault:** atomic writes are write-then-rename. SilverBullet's own files
+  (and `.git`, if history is kept) are never notes to an agent. A failed write is
+  the tool's result, never the run's end.
 - **L12:** secrets reach a command by environment or stdin. Headless agents get an
   Authelia single-factor exception scoped by source address, group and target.
   Logs are shipped to the host journal, not kept in containers.