Part of #100 (EPIC). Workstream L. One issue = one PR.
Source: zmem deep audit 2026-09-10 (https://claude.ai/code/artifact/39012f75-25f0-441b-978f-cc90a3bd3a9d) and issue plan v3 (https://claude.ai/code/artifact/59e74242-17da-4416-9b00-0b0cf347837c); dependency DAG computed over all open PRs (edge kinds: Depends on = merged artifact, Schema after = migration lane, Gated on = #100 measurement/decision gate).
Labels: enhancement, severity:medium. Depends on: L-1 (#180) (apply_capture_policy, patterns). Blocks: none.
Design. store.py rescan-secrets --dry-run|--apply walks live rows, redacts through append-only update (lineage kept), reports rows needing review; import-store.py --source hindsight maps world→fact, observation→fact + tag hindsight:observation (until #137), kv/current→fact + tag state-candidate (until K-3 (#174)), event→fact + tag hindsight:event (until K-7 (#178)), always preserving the original kind in tags.
Acceptance criteria. (a) Dry-run on tests/fixtures/secrets/store.sqlite (two credential rows) lists exactly those ids; SHA-256 unchanged. (b) Apply → two update lineages with [REDACTED_SECRET], originals tombstoned. (c) tests/fixtures/hindsight/import.jsonl (10 rows) → expected types and tags, byte-identical. (d) PR body records the operator snapshot SHA-256 and the dry-run result on it (expected: exactly b513b21c).
Part of #100 (EPIC). Workstream L. One issue = one PR.
Source: zmem deep audit 2026-09-10 (https://claude.ai/code/artifact/39012f75-25f0-441b-978f-cc90a3bd3a9d) and issue plan v3 (https://claude.ai/code/artifact/59e74242-17da-4416-9b00-0b0cf347837c); dependency DAG computed over all open PRs (edge kinds: Depends on = merged artifact, Schema after = migration lane, Gated on = #100 measurement/decision gate).
Labels: enhancement, severity:medium. Depends on: L-1 (#180) (
apply_capture_policy, patterns). Blocks: none.Design.
store.py rescan-secrets --dry-run|--applywalks live rows, redacts through append-onlyupdate(lineage kept), reports rows needing review;import-store.py --source hindsightmaps world→fact, observation→fact+ taghindsight:observation(until #137), kv/current→fact+ tagstate-candidate(until K-3 (#174)), event→fact+ taghindsight:event(until K-7 (#178)), always preserving the original kind in tags.Acceptance criteria. (a) Dry-run on
tests/fixtures/secrets/store.sqlite(two credential rows) lists exactly those ids; SHA-256 unchanged. (b) Apply → twoupdatelineages with[REDACTED_SECRET], originals tombstoned. (c)tests/fixtures/hindsight/import.jsonl(10 rows) → expected types and tags, byte-identical. (d) PR body records the operator snapshot SHA-256 and the dry-run result on it (expected: exactlyb513b21c).