The user's own record comes first — install inside the investing folder, quote it as theirs, let the engine check the pick (refs #844)

[atomchung]

User outcome

A user who keeps their own investing notes installs the skill inside that folder. When they bring a decision, the answer's deciding reason engages what they already wrote about the names in play — thesis, falsifiers, open questions, prior decisions, stated stances — quoted as their record with the note and its date. The engine's consequence and rule collisions check the pick instead of leading it by default. A status field a tool maintains about the user is read as the tool's note, not as the user's belief. Nothing read is written anywhere.

Owner ruling 2026-09-02 (#844): 「不讀私人 repo」只是產品開發上的限制，實體使用就應該要讀私人 repo；「我自己的預期其實是用戶應該是在自己的投資 folder 裡面會增加 fomo kernel」.

Current behavior / evidence

• In the owner's private four-lane evaluation the skill lane already runs inside a frozen copy of the notes folder with full read access; in the mid-August cash-deployment scene it cited the owner's notes more than any other lane and still ranked last, because the answer led with book structure and listed each candidate's gate without a thesis-level reason for the name ([design·M1] The user's own investing folder is the evidence for why a name — install inside it, read it as the user's record, let the engine check the pick #844, de-identified).
• The skill's own contract named the user's notes once (evidence_refs may be "a note of their own"); the answer-provenance schema had three claim classes and none for the user's own record, so a quoted note under --agent-case had to be mislabelled or dropped.
• The owner's ten-decision replay found context won only on the user's own countable actions and verbatim words, and lost on AI-maintained status fields — the boundary this change encodes.

Change

• Entry and install. SKILL.md gains "The user's own record comes first" (where the folder is, and that a quoted note is stored only inside a consideration's own recorded case, on this machine) and its description says so; README.md / README.zh-TW.md / README.zh-CN.md install the skill under <your investing folder>/.claude/skills/ with one chained, re-runnable line (cd … && mkdir -p … && ln -sfn …), carry the positioning in the lede, and say what is read there (the global symlink remains the no-folder fallback). .claude-plugin/plugin.json mirrors the description; the GitHub repository description carries the positioning too.
• Boundaries. references/agent-boundaries.md: one may (read and quote the record as theirs) and one may not (relabel it as a public fact, an engine fact, the agent's judgment, or a category a status field assigned). AGENTS.md boundary 2 gains one clause; the floor stays inside its byte budget (7,860 of 8,192).
• Provenance. A fourth claim class user_record (source + as_of, nothing else): review.AGENT_CASE_PROVENANCE ↔ answer_provenance.PROVENANCE + one _check_sourced_claim shared with public_fact ↔ schemas/answer-provenance.schema.json userRecordClaim ↔ docs/expression-contract.md C1 ("four provenances") ↔ references/trade-consequence.md "The recommendation case" and its --agent-case bullets. as_of must match the schema's date shape exactly (the bare fromisoformat accepted 20260730). Case 8 runs in both directions: the user's --decision-context words may become neither a public fact nor a dated note they never wrote. The recommendation itself still may not be a user_record.
• Exemplar on the generation path. consider_three_way_comparison — the owner-approved comparison references/trade-consequence.md opens with — is revised in place: its deciding reason is now the user's own recorded condition and stances, quoted as theirs with each note's date, and the engine's consequence is the check on the pick. Its [design·M1] Owner-live: answers exceed the reading budget — verbosity is the next usefulness bottleneck after #827 #830 shape, its scene id and the [implementation·skill] Put one canonical exemplar into each surface's generation path — examples-first, closing #832's residual force #834 pairing are unchanged; the pre-[design·M1] The user's own investing folder is the evidence for why a name — install inside it, read it as the user's record, let the engine check the pick #844 text is in git history; the clearance scene stays in the corpus. Every note quoted is invented with the issuers. The reference's --agent-case example now quotes the number its anchor needs and passes the validator.
• Records. docs/maintainer-guide.md mirrored-surfaces row; CHANGELOG.md Unreleased entry.

Scope / non-goals

No engine ingestion of the folder, no new store, no crawling; the private-data boundary is unchanged and no note content appears in any public artifact. Review flows are untouched — their thesis questions could later read the same record, which is a follow-up, not this slice.

Acceptance

• tests/test_answer_provenance.py 50/50 (nine new: acceptance, missing source/as_of, non-date as_of, the schema's exact date shape for both citing classes, an anchor on a record is refused, schema shape, the recommendation may not be a record, the user's live statement may not be relabelled a record).
• tests/test_expression_contract.py 24/24 and tests/agent/check_expression.py PASS: the new scene passes E-5 through E-8, the reference/corpus copies are byte-identical, consider carries five positives.
• tests/test_installed_skill_tree.py 7/7, tests/test_doc_language.py 38/38 (two new: the user's-record rule pinned in both entry points with mutation proof; README bash blocks now compared across all three languages; SKILL.md 10,313 of 12,288 bytes), tests/test_consider.py 207/207 (its provenance map carries the fourth class), tests/test_evaluation_challenge.py 41/41, tests/test_repo_hygiene.py green.
• python3 tests/run_all.py --group product — 49/49 suites pass locally.
• Not yet done, needs the owner: the old-vs-new blind pairwise comparison on the private four-lane harness runs on the next natural decision ([design·M1] The user's own investing folder is the evidence for why a name — install inside it, read it as the user's record, let the engine check the pick #844 item 5). This PR does not claim product improvement.

Review

A ten-angle review plus a sweep (second commit) found fifteen items, all addressed: the two validator gaps above; the doc example that the validator refused; the install line's re-run behaviour and unchained placeholder cd; the storage over-claim in SKILL.md and CHANGELOG.md; the exemplar swap that would have left the maintainer guide's #834 row stale and dropped the only no-end-block consider witness (now revised in place instead); the duplicated citation checker and constant; the missing user_record entry in test_consider.py's provenance map; the README bash gate that skipped zh-CN; the unpinned SKILL.md ↔ agent-boundaries mirror; the lede and repository description; and the two cited docs (decision-fomo-kernel-shape.md §3, expression-contract.md C1 registers) that still listed three labels.

Privacy / rollout / recovery

All exemplar issuers, notes and dates are synthetic. Reversible by restoring the previous fence, the previous scene, and the three-class vocabulary; no migration, no state change.

Refs #844 (owner design ruling recorded there; the issue stays open for the harness evidence). Supersedes the Phase 1/2 "private-repository" wording in #475 as read at runtime — reading is declared, not silent, and nothing is imported into the engine.

🤖 Generated with Claude Code