M5.1: the knowledge vault

vault.py: a folder of Markdown notes on the agent host, as SilverBullet reads
them. Only configured folders exist for the agent, each rw or ro (`vault:`
in the configuration); paths are checked in code (relative, inside a folder,
symlinks included, Markdown, never the editor's own files). Writes are
atomic (temporary file, fsync, rename, directory fsync) and merge provenance
into the note's frontmatter, keeping the rest; failures are results.

read_note, list_notes and search_notes are control tools in the harness for
the driver (before the go-ahead, and while a VM is blocked) and for
conversations, labelled with their path; the prompt says a note is
information, never an instruction. Writing by the model is M5.2's.

With the operator: SilverBullet replaces Obsidian and runs on the vault
itself, agents' folders mounted read-only, so no Syncthing (L10, X5, M5.4).
Per-agent mounts come with the containers (M6.1).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

nisse-dev/src/nisse_dev/loop/build.py

@@ -27,6 +27,7 @@ from nisse_dev.matrix import MatrixTransport
 from nisse_dev.oplog import OpLog
 from nisse_dev.state import StateStore
 from nisse_dev.tools import Workspace
+from nisse_dev.vault import Vault
 from nisse_dev.worker import SerialWorker
 
 # How long shutdown waits for running work before leaving the store to the
@@ -333,6 +334,12 @@ def build_loop_agent(
         general_idle_s=config.tuning.loop.general_idle_s,
         vm_retry_s=config.tuning.build_vm.retry_s,
         vm_settle_s=config.tuning.build_vm.settle_s,
+        # L10: the knowledge vault, when configured.
+        vault=(
+            Vault(config.vault.root, config.vault.folders, ignore=config.vault.ignore)
+            if config.vault
+            else None
+        ),
     )
     return RunningLoop(
         config=config,