Fix/recall and live cleanup

.agents/skills/fabric-recall/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: fabric-recall
+description: Find current Fabric notes, tasks, decisions, and unresolved direction without starting or synchronizing a work session. Use when the user asks what they needed to do, asks to check Fabric notes or memory, or wants to inspect live, candidate, or durable direction.
+---
+
+# Recall Fabric Notes
+
+Answer repository-memory questions directly and keep the workflow read-only.
+
+1. Run `fabric list --durability live --json` when the user asks about local notes or tasks.
+2. Use `--candidate` or `--durable` only through the equivalent `--durability` filter when the request names those classes. Add issue, PR, area, or path filters when known.
+3. Summarize actionable records first. Use `fabric list --status inactive --json` only when the user asks about history, rejected paths, or resolved work.
+4. Do not run status, start a thread, preflight, sync, or read generated checkpoint files merely to recall notes.
+5. Explain when no matching direction exists. Never search arbitrary repository files as a substitute for Fabric notes unless the user also asks for a general codebase search.

.agents/skills/fabric-recall/agents/openai.yaml

@@ -0,0 +1,6 @@
+interface:
+  display_name: "Recall Fabric Notes"
+  short_description: "Find current repository notes and tasks"
+  default_prompt: "Use $fabric-recall to inspect current Fabric notes without starting a work session."
+policy:
+  allow_implicit_invocation: true

.agents/skills/fabric-session/SKILL.md

@@ -1,18 +1,20 @@
 ---
 name: fabric-session
-description: Initialize, resume, and synchronize Fabric agent threads. Use before starting repository work, resuming a PR or issue, changing approach, opening a PR, or checking for new project direction shared by other threads and worktrees.
+description: Prepare and synchronize Fabric threads for substantive, multi-step repository changes that may depend on shared direction. Use when beginning or resuming implementation, changing an implementation approach, continuing review-driven code work, or when the user explicitly asks to synchronize Fabric. Do not use for read-only inspection, simple questions, release or tag creation, one-off git or gh commands, or routine status checks.
 ---
 
 # Fabric Session
 
-Use Fabric as the repository decision protocol before acting.
+Use Fabric when the work can create or consume repository direction. Skip this
+workflow entirely for read-only inspection and one-off operational commands. A
+stale or unknown current-thread pointer alone is not a reason to create a thread.
 
-1. Run fabric status. If sandbox policy blocks access to .git/fabric, request scoped approval for the fabric command and retry. Do not use another runtime store.
-2. If there is no suitable current thread, run fabric thread start with the known PR, issue, and areas.
-3. Run fabric preflight with the task and the same scope. Use --json when a provider adapter needs the projection ID. Read .fabric/generated/TASK_DIRECTION.md.
+1. For substantive work, run fabric status once. If sandbox policy blocks access to .git/fabric, request scoped approval for that command and retry. Do not use another runtime store.
+2. If the ongoing implementation needs shared state and there is no suitable thread, run fabric thread start with the known issue, PR, areas, and paths.
+3. Run fabric preflight "<task>" with matching --issue, --pr, --area, and --path flags before implementation. Use --json only when an adapter needs the projection ID. Read .fabric/generated/TASK_DIRECTION.md.
 4. Follow active direction. If the planned approach conflicts, use $fabric-record-direction to record a challenge instead of silently diverging.
 5. After projected records actually enter model context, use $fabric-provenance to acknowledge exposure. Delivery alone is not exposure.
-6. Before changing approach, opening a PR, or resuming later, run fabric sync and read .fabric/generated/SYNC_DELTA.md.
-7. When continuing PR or issue work, run fabric continue and read .fabric/generated/CONTINUATION_CONTEXT.md.
+6. Run fabric sync before a meaningful implementation checkpoint, approach change, or explicit handoff. Do not sync after every command. Read .fabric/generated/SYNC_DELTA.md.
+7. Use fabric continue only when resuming interrupted or review-driven PR/issue implementation. Read .fabric/generated/CONTINUATION_CONTEXT.md.
 
-Treat shared findings, rationale, rejected paths, and preferred paths as inputs to the current thread, not as optional background.
+Keep user updates proportional to the task; do not narrate routine Fabric plumbing. Treat shared findings, rationale, rejected paths, and preferred paths as inputs to substantive work.

.agents/skills/fabric-session/agents/openai.yaml

@@ -1,6 +1,6 @@
 interface:
   display_name: "Fabric Session"
-  short_description: "Start and synchronize Fabric agent sessions"
-  default_prompt: "Use $fabric-session to prepare this repository task with the current Fabric direction."
+  short_description: "Sync direction for substantive repository work"
+  default_prompt: "Use $fabric-session to prepare this multi-step repository implementation with shared Fabric direction."
 policy:
-  allow_implicit_invocation: true
+  allow_implicit_invocation: false

.github/pull_request_template.md

@@ -0,0 +1,21 @@
+## Why
+
+<!-- What problem does this solve, and why does it belong in Fabric? -->
+
+## Protocol impact
+
+<!-- Note behavior, schema, compatibility, trust, or provenance changes. Write "None" when not applicable. -->
+
+## Verification
+
+<!-- List the commands or scenarios used to verify this change. -->
+
+## Direction changes
+
+<!-- List committed Fabric records or lifecycle changes. Write "None" when this PR changes no reusable direction. -->
+
+## Checklist
+
+- [ ] I kept unrelated changes out of this PR.
+- [ ] I updated protocol docs, schemas, and fixtures when required.
+- [ ] I preserved immutable event and provider-neutral behavior.

.github/workflows/ci.yml

@@ -0,0 +1,56 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Install evaluation tools
+        run: sudo apt-get update && sudo apt-get install -y jq ripgrep
+
+      - name: Check formatting
+        shell: bash
+        run: |
+          unformatted="$(gofmt -l $(git ls-files '*.go'))"
+          if [[ -n "${unformatted}" ]]; then
+            printf 'Run gofmt on:\n%s\n' "${unformatted}"
+            exit 1
+          fi
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...
+
+      - name: Test with race detector
+        run: go test -race ./...
+
+      - name: Run Local V1 evaluation
+        run: ./evals/run-local-v1.sh
+
+      - name: Verify root installation
+        shell: bash
+        run: |
+          GOBIN="${RUNNER_TEMP}/bin" go install .
+          "${RUNNER_TEMP}/bin/fabric" version --json

.gitignore

@@ -12,3 +12,6 @@
 # shared mirror out of Git.
 .fabric/active/
 .fabric/generated/
+
+# Local IDE state.
+.idea/

AGENTS.md

@@ -3,15 +3,17 @@
 
 Fabric is the repository decision and provenance protocol for agent threads and worktrees. The CLI manages the protocol; agents are its primary clients.
 
-- Before work, run fabric status and fabric preflight, then read .fabric/generated/TASK_DIRECTION.md.
-- Before changing approach, opening a PR, or resuming work, run fabric sync and read .fabric/generated/SYNC_DELTA.md.
+- Before substantive multi-step implementation, use $fabric-session to inspect shared direction.
+- Skip session setup for read-only inspection, simple questions, release or tag creation, and one-off git or gh commands.
+- Before a meaningful implementation checkpoint, approach change, or handoff, run fabric sync and read .fabric/generated/SYNC_DELTA.md.
 - When corrected by a human, preserve the direction and rationale with Fabric.
 - Never silently violate active direction; align, ask for an exception, or record a challenge.
 - Treat .fabric/ledger/events/ and the shared .git/fabric runtime as shared repository state.
 - If sandbox policy blocks .git/fabric, request scoped approval for the fabric command and retry. Do not create a fallback store.
 
 Use the repository skills for detailed workflows:
 
+- $fabric-recall
 - $fabric-session
 - $fabric-provenance
 - $fabric-record-direction

CONTRIBUTING.md

@@ -0,0 +1,43 @@
+# Contributing to Fabric
+
+Fabric welcomes focused bug fixes, protocol improvements, provider adapters,
+documentation, and executable scenarios.
+
+## Development
+
+Fabric requires Go 1.22 or newer. Clone the repository, then run:
+
+```bash
+go test ./...
+go test -race ./...
+./evals/run-local-v1.sh
+```
+
+Before opening a pull request, also run:
+
+```bash
+gofmt -w $(git ls-files '*.go')
+go vet ./...
+go install .
+```
+
+## Protocol changes
+
+Treat `PROTOCOL.md` as normative. A wire-contract change should update the
+public Go types and validation, corresponding JSON Schemas, conformance
+fixtures, and protocol documentation together. Preserve unknown extensions and
+provider-neutral semantics.
+
+Do not rewrite immutable ledger events or commit runtime state from
+`.fabric/active/`, `.fabric/generated/`, or `.git/fabric/`.
+
+## Pull requests
+
+Keep pull requests narrowly scoped and explain why the change is needed. Use
+Conventional Commit messages such as `fix(cli): ...`, `feat(protocol): ...`, or
+`docs: ...`. Include tests proportional to the behavior and call out breaking
+or migration-sensitive changes explicitly.
+
+Fabric direction should remain sparse. Commit candidate or durable records only
+when they capture reusable repository guidance, not routine implementation
+notes.

README.md

@@ -342,4 +342,6 @@ go test -race ./...
 ```
 
 Schemas live in `schemas/v1/`, fixtures in `conformance/`, and the public Go
-protocol package in `protocol/`.
+protocol package in `protocol/`. See [CONTRIBUTING.md](CONTRIBUTING.md) for the
+development and protocol-change workflow, and [SECURITY.md](SECURITY.md) for
+private vulnerability reporting.

SECURITY.md

@@ -0,0 +1,20 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes target the latest released version of Fabric. Upgrade to the
+latest release before reporting behavior that may already be fixed.
+
+## Reporting a vulnerability
+
+Do not open a public issue for a suspected vulnerability. Report it privately
+through a GitHub security advisory for this repository, or email
+`lfaddourado@gmail.com` if private reporting is unavailable.
+
+Include the affected version, impact, reproduction steps, and any suggested
+mitigation. Do not include real repository credentials, private source code,
+prompts, transcripts, or decrypted Fabric payloads.
+
+Fabric Local V1 trust claims are declarative rather than cryptographic. Reports
+should distinguish a documented trust limitation from an implementation flaw
+that violates the protocol or exposes data unexpectedly.

internal/cli/agent_skills_test.go

@@ -27,6 +27,7 @@ func TestGeneratedAgentSkillsHaveMetadataAndFocusedWorkflows(t *testing.T) {
 	mustRun(t, "init")
 
 	expected := []string{
+		"fabric-recall",
 		"fabric-session",
 		"fabric-provenance",
 		"fabric-record-direction",
@@ -61,6 +62,9 @@ func TestGeneratedAgentSkillsHaveMetadataAndFocusedWorkflows(t *testing.T) {
 	assertContains(t, session, "stale or unknown current-thread pointer alone is not a reason")
 	assertContains(t, session, "Do not sync after every command")
 	assertContains(t, mustRead(t, ".agents/skills/fabric-session/agents/openai.yaml"), "allow_implicit_invocation: false")
+	recall := mustRead(t, ".agents/skills/fabric-recall/SKILL.md")
+	assertContains(t, recall, "fabric list --durability live --json")
+	assertContains(t, recall, "Do not run status, start a thread, preflight, sync")
 	provenance := mustRead(t, ".agents/skills/fabric-provenance/SKILL.md")
 	assertContains(t, provenance, "context acknowledge")
 	assertContains(t, provenance, "informed_by")