Design a presentation seam for framing/neutralise (ADR 0014)

[TBarregren]

Problem

ADR 0014's rule — every surface that re-presents stored memory must neutralise the leaves and frame the whole — is enforced per caller, not at a seam. Three output surfaces each hand-wire frame(neutralise(...)): the snapshot assembly (snapshot.py), recall's rendering (RecallResult.rendered, recall.py) and the management surface's Concept printing (manage.py). A fourth surface that displays stored memory (say, a future mimer-manage show <slug>) must re-derive the rule or it silently re-presents memory as instructions — the same smeared-invariant shape the write seam had before the redaction-at-the-seam work, and the Visible-seam work for enumeration, in this series.

This came out of the 2026-07-13 architecture review ("Noted, not carded": framing/neutralise per-surface). It was deliberately left uncarded — smaller stakes than its siblings — and no interface has been designed.

What is needed before this is ready for an agent

A design session settling:

• The interface shape — a present_memory(text) -> str helper, or something surface-aware; whether the frame's citation/age annotations vary per surface (snapshot vs recall vs management listing) and how that variation enters the interface without widening it back into per-caller assembly.
• Whether ingest-side neutralisation joins the seam — the digest neutralises on the way in (digest.py); that call serves a different guarantee and probably stays, but the design should say so explicitly.
• The ADR 0014 constraint — the seam must make bypass impossible (or loudly greppable), not merely centralise the calls into one skippable helper; the sibling ADR 0020 (redaction at the write seam) is the pattern to mirror, including keeping any defence-in-depth.
• Whether a grep/source-scan guard (like the write-seam's living test) is proportionate here.

Acceptance criteria (for the design session, not the build)

• The interface is settled and recorded in this issue; the ticket is then relabelled ready-for-agent with the settled shape inlined
• The decision on ingest-side neutralisation is explicit either way

Blocked by

None logically — but not ready for an agent until the design session above has settled the interface.

[TBarregren]

Interaction with the "focusing" rework (issues #60–#70)

The five-requirements focusing rework was just carded as #60–#70. It reshapes several of the presentation surfaces this issue names, and — more importantly — adds two new ones the proposed seam would naturally own. Recording it here so the design session is settled against the final surface set, not today's.

New surfaces the seam should cover

• Read-only interactive CLI browser (mimer-browse) #67 — mimer-browse, the read-only CLI browser. This is exactly the "fourth surface that displays stored memory" this issue anticipates. But it is human-facing (a terminal), not agent-facing, so it sharpens the open interface question: the seam must be surface-aware by audience — an agent-context surface gets frame + neutralise; a human-terminal surface arguably wants neither (a human is not injection-vulnerable, and the data-frame header is just noise on screen). A single present_memory(text) helper is therefore probably two audiences, not one.
• SessionStart: sensitive-promotion consent question and native-memory warning #68 — the SessionStart sensitive-promotion consent question. It presents a held Concept's identity into the agent's SessionStart context to ask for consent (ADR 0027). Being agent-facing, it must frame/neutralise like the rest of the snapshot — a new agent surface the seam should enforce.

Reshaped surfaces to design against, not around

• Session-boundary pass: detached, distils from the raw record, no intermediate digest #63 folds the digest into the detached session-boundary pass. The ingest-side neutralise this issue flags (digest bullets, refreshed short-term) survives, but now lives on the boundary module. The open "does ingest-side neutralisation join the seam?" question is unchanged; only its home moves.
• SessionStart: sensitive-promotion consent question and native-memory warning #68 touches the snapshot / SessionStart assembly; mimer-manage: disable-native-memory and "distill now" #69/Memory skill and documentation reconciliation #70 touch the management-surface Concept printing and the memory-skill/doc wording. These are among the per-caller frame(neutralise(...)) sites this issue wants to converge.

Recommendation

• Keep this in needs-triage (design first); do not mark ready-for-agent yet. The problem is real and unresolved — the rework does not fix it (framing/neutralise stays per-caller) and mildly raises the stakes by adding surfaces.
• Sequence the design session and build after the rework lands (after Memory skill and documentation reconciliation #70). This is a cross-cutting refactor over exactly the surfaces the rework rewrites; running it concurrently means avoidable churn on the same modules (the worktree-rebase hazard). And the seam should be designed against the settled surface set.
• When picked up, refresh the scope to include Read-only interactive CLI browser (mimer-browse) #67 (the human-vs-agent audience distinction) and SessionStart: sensitive-promotion consent question and native-memory warning #68 (the consent question) as surfaces the seam must handle.

[TBarregren]

Design settled — the presentation seam (present)

Settled in a grilling session on 2026-07-14. The full rationale is ADR 0029 (docs/adr/0029-framing-at-the-presentation-seam.md); the glossary now carries the term Present (CONTEXT.md).

The interface

One operation is the single path every surface that shows stored memory routes through:

present(segments, *, audience) -> str

• segments — an ordered assembly that distinguishes trusted chrome from untrusted leaves (a tagged list [chrome(str) | leaf(str), …], or an equivalent small builder). Chrome is Mimer's own text — labels, headings, citation brackets, age annotations. A leaf is any stored-derived value, including the source and heading interpolated into a citation tag.
• audience — AGENT or HUMAN.
  • AGENT: every leaf is neutralised, then the whole is framed (data-frame header + nonce fence).
  • HUMAN: leaves and chrome are shown verbatim — no neutralise, no frame (a human is not injection-vulnerable; the frame is screen noise and neutralising would corrupt their own Markdown).

Leaves are neutralised, never the assembled whole. neutralise strips every line-leading heading, so neutralising the whole payload would strip Mimer's own ## Profile / ### title chrome. The leaf/whole split is load-bearing and cannot collapse into a single frame(neutralise(text)).

Audience is fixed per surface (not detected at runtime)

Surface	Audience
snapshot (build_snapshot)	AGENT
recall (RecallResult.rendered)	AGENT
management listing (_print_concepts)	AGENT
SessionStart consent question (#68)	AGENT
mimer-browse (#67)	HUMAN

A terminal command cannot reliably tell whether a human or the agent invoked it, so each command has one fixed behaviour. For a clean human view, use mimer-browse; the agent-oriented commands keep the frame even when a human runs one.

Enforcement — bypass is loudly greppable (ADR 0020 parity)

frame and neutralise become internal to the seam. A living source-scan guard (the sibling of tests/test_source_scan.py) fails any use of the raw primitives outside the seam module. Two documented exemptions:

• the session-boundary pass's clean-at-rest neutralise (ingest-side, see below);
• the digest prompt's fence_transcript.

Not a type barrier. An Untrusted-wrapper type (reads return a value only the seam can render) was considered and rejected as disproportionate for this issue's smaller stakes — it would thread a wrapper through every read path unrelated to presentation. The guard clears the "not a skippable helper" bar without it. The type barrier is recorded in the ADR as the available heavier option should the stakes rise.

Ingest-side neutralisation — the explicit decision (#59 asks for it either way)

It stays, as defence-in-depth — the same stance ADR 0020 takes on keeping the sink redaction calls. It is a distinct guarantee (clean-at-rest: the stored artefact is defanged regardless of which surface later shows it), not the seam's dependency: the seam re-neutralises at show-time and is self-sufficient. When #63 folds the digest into the session-boundary pass, this neutralisation's home moves onto the boundary module; the stays-or-goes decision is unchanged, only the home moves.

What this closes

The latent gap that proves the issue's thesis: build_snapshot currently places the manifest headlines and the distilled-since titles inside the frame, un-neutralised, and frame does not strip line-leading headings (only neutralise does). A Concept titled # … could ride into the agent's framed payload as a live heading. Routing those leaves through the seam closes it by construction. Also: Mimer's own narration moves outside the frame uniformly (the snapshot is brought into line with recall and the management listing), so only stored memory is labelled "data, not instructions".

Status / sequencing

Kept needs-triage for now. The design — the only thing that was blocking it — is done; the remaining blocker is sequencing. This is a cross-cutting refactor over exactly the surfaces #63 / #67 / #68 / #69 / #70 rewrite, so build it after #70 lands, not concurrently (semantic-rebase hazard on shared modules). Relabel to ready-for-agent by hand once the rework is in.

Glossary note for the build: the Visible entry keeps its "presentation predicate" wording, with a cross-reference added so "presentation" reads as the umbrella (Visible = which memory may show; Present = how it is framed). If the umbrella reading proves confusing, retuning Visible to "visibility filter" is an option — but that touches test_docs_truthfulness.py::test_context_carries_the_visible_glossary_entry, so it is a build-time change, deliberately not made in this design pass.