docs(v1.2.1): expand entry — 3 same-day identity isolation fixes + --limit

The v1.2.1 entry now covers everything actually shipped today, not
just the original refine-pipeline race fix:

- CHANGELOG.md: title widened to "Refine-Pipeline Race + Identity
  Isolation Hot-Fix"; new "Identity bootstrap follow-up fixes
  (same-day)" section enumerates the three identity bugs surfaced
  by the empirical bootstrap pilot — env-strip miss, parent-cwd /
  SessionStart hook contamination of the nested claude --print,
  too-lax OUTPUT-section prompt — plus the new bootstrap --limit N
  pilot mode that ships in the same wave. Migration path closes
  with a note for users who hit the silent bootstrap failure under
  v1.1: retrying on v1.2.1 now correctly routes to subscription.

- STATUS.md: Last-updated lead rewritten with the "shipped + scope
  expansion + empirical bootstrap green" beat. Pending actions
  reordered to put push first, drop the merge step (already done),
  drop the bootstrap step (already ran). New "Completed today"
  section captures the day's beats so the next-session resume
  protocol has a tight summary.

- docs/ROADMAP.md: v1.2.1 row title widened; section split into
  two task lists (race fix + identity follow-up), commit hashes
  for each, acceptance criteria flipped to checked for empirical
  bootstrap verification. Test count corrected to 545 (was 543
  before the +2 identity regression tests).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: kavunkarpuz-debug

CHANGELOG.md

@@ -4,7 +4,7 @@ All notable changes to Mnemos are documented here. For the narrative
 version of how the project evolved across paradigms, see
 [`HISTORY.md`](HISTORY.md).
 
-## v1.2.1 — Refine-Pipeline Race-Condition Hot-Fix (2026-04-28)
+## v1.2.1 — Refine-Pipeline Race + Identity Isolation Hot-Fix (2026-04-28)
 
 Spec: [`docs/specs/2026-04-28-v1.2.1-duplicate-refine-race.md`](docs/specs/2026-04-28-v1.2.1-duplicate-refine-race.md)
 
@@ -68,6 +68,42 @@ X-close coverage gap. The fix makes that coexistence safe:
 - Total suite: **543 passed**, 2 skipped, 3 deselected (was 529 at
   start of v1.2.1 work; +14 new).
 
+### Identity bootstrap follow-up fixes (same-day)
+
+Empirical bootstrap pilot on kasamd surfaced three more bugs in the
+identity pipeline that v1.2.1 also fixes:
+
+- **`identity._invoke_claude_print` did not strip `ANTHROPIC_API_KEY`.**
+  Hard-invariant violation — every other claude --print site (auto_refine,
+  recall_briefing, session_end_hook) strips the key so the call falls
+  through to subscription quota. This one site was missed in v1.0/v1.1
+  and silently routed bootstrap + refresh through API credits when the
+  user had `ANTHROPIC_API_KEY` set as an env var. Surface symptom:
+  `claude --print failed (exit 1):` with empty stderr (after the fix the
+  error also includes stderr in the message). Fix: copy env, pop the
+  key, pass to subprocess.run.
+- **Bootstrap was contaminated by parent cwd + SessionStart hooks.**
+  The nested claude --print inherited the parent's cwd, which loaded
+  the project CLAUDE.md and let `recall_briefing`'s SessionStart hook
+  inject its briefing context. The LLM treated the bootstrap prompt as
+  a continuation of the parent dev conversation and emitted a chat
+  summary instead of the seven-section profile. Fix:
+  `_invoke_claude_print` now sets `MNEMOS_RECALL_HOOK_ACTIVE=1` to
+  short-circuit recall_briefing's re-entry, and runs from a fresh
+  `tempfile.TemporaryDirectory` so no project context leaks in.
+- **`docs/prompts/identity-bootstrap.md` OUTPUT section strengthened.**
+  The original "Only the markdown body to stdout" was too subtle;
+  rewritten as a four-bullet "strict" contract (no tools, no chat,
+  start with `---` frontmatter, fall back to minimal stubs rather
+  than refusing).
+
+Plus a small new feature shipped in the same fix wave:
+
+- **`mnemos identity bootstrap --limit N`** — pilot mode that restricts
+  input to the most-recent N Sessions. Useful for validating prompt
+  quality on a small subset before committing the full vault to a
+  10-15 minute LLM call. Default unchanged: read all eligible Sessions.
+
 ### Migration path
 
 Users upgrading to v1.2.1 should run once:
@@ -80,7 +116,9 @@ point on, the lock prevents new corruption.
 No settings.json changes required — both SessionStart hooks
 (`mnemos-auto-refine`, `mnemos-recall-briefing`) and the SessionEnd
 hook (`mnemos-session-end`) all stay in place. The lock makes their
-coexistence safe.
+coexistence safe. Users with `ANTHROPIC_API_KEY` in their env who
+hit the silent bootstrap failure under v1.1 should retry on v1.2.1
+— the call now correctly routes through subscription quota.
 
 ---
 

STATUS.md

@@ -1,11 +1,11 @@
 # Mnemos — Project Status
 
-**Last updated:** 2026-04-28 — v1.2.0 (locale-aware output) shipped to main. v1.2.1 (refine-pipeline race-condition hot-fix) implementation complete on local branch `feature/v1.2.1-refine-lock` (3 commits, +14 tests, 543 total pass). Both ship same day: v1.2.0 surfaced a pre-existing v1.1.0 race during F6.3 smoke; v1.2.1 fixes it without touching the architecture (all three coexisting refine hooks stay in place, made safe via per-JSONL filelock + ledger recheck-after-claim). Spec: [`docs/specs/2026-04-28-v1.2.1-duplicate-refine-race.md`](docs/specs/2026-04-28-v1.2.1-duplicate-refine-race.md) — revised mid-implementation when initial misdiagnosis ("remove legacy hook") was caught and corrected. v1.1.0 GitHub release still live on 2026-04-27 ([tag](https://github.com/mnemos-dev/mnemos/releases/tag/v1.1.0)) — PyPI publish + tag still 🟡 pending user go-ahead. 🟡 **Pending user actions:** v1.2.1 merge to main, `mnemos refine-ledger --normalize --validate-paths` one-shot cleanup on kasamd, v1.2.0 + v1.2.1 PyPI publish (single-shot), identity bootstrap on kasamd.
+**Last updated:** 2026-04-28 — v1.2.0 (locale-aware output) + v1.2.1 (refine-pipeline race + identity isolation hot-fix) both shipped to main. v1.2.1 took on extra scope after empirical bootstrap pilot surfaced three more bugs (ANTHROPIC_API_KEY env strip missing, parent-cwd + SessionStart hook contamination of `claude --print` subprocess, OUTPUT-section prompt too lax). Identity bootstrap empirically validated end-to-end: pilot on 10 most-recent Sessions then full run on 90 Sessions, both produced clean seven-section locale-aware profiles (TR headers + TR body since kasamd is Turkish-dominant). Total commits ahead of origin/main: 4 (`feat/identity-bootstrap-limit` branch, all merged to local main). Test suite **545 pass** (up from 529 baseline; +16 new tests across refine_lock, refine-ledger CLI, identity --limit, env-strip + cwd-isolation regressions). v1.1.0 GitHub release still live on 2026-04-27 ([tag](https://github.com/mnemos-dev/mnemos/releases/tag/v1.1.0)) — PyPI publish + tag still 🟡 pending user go-ahead. 🟡 **Pending user actions:** push commits to origin, v1.2.0 + v1.2.1 PyPI publish, v1.1.0 PyPI publish (still pending from yesterday), test infra cleanup (`~/.claude/test-session-end/`).
 **Stable PyPI version:** `v0.3.3` (v0.x atomic-paradigm — still default `pip install mnemos-dev` until v1.1.0 PyPI upload)
 **Alpha:** `v1.0.0a1` — tag pushed to GitHub, never uploaded to PyPI (superseded by v1.1.0)
 **Released:** `v1.1.0` — SessionEnd-driven memory architecture, GitHub release live, PyPI pending
 **Shipped to main:** `v1.2.0` — Locale-aware output (EN code+docs, runtime output matches dominant Session language)
-**In progress:** `v1.2.1` — Refine-pipeline race-condition hot-fix (per-JSONL filelock + ledger normalize CLI), local branch `feature/v1.2.1-refine-lock` ready for merge
+**Shipped to main:** `v1.2.1` — Refine-pipeline race fix (per-JSONL filelock + ledger normalize CLI) + identity isolation fix (env-strip + neutral cwd + hook re-entry guard) + `bootstrap --limit N` pilot mode
 **Canonical plan:** [`docs/ROADMAP.md`](docs/ROADMAP.md)
 **v1.0 spec:** [`docs/specs/2026-04-25-v1.0-narrative-pivot-design.md`](docs/specs/2026-04-25-v1.0-narrative-pivot-design.md) · **v1.0 plan:** [`docs/plans/2026-04-25-v1.0-narrative-pivot.md`](docs/plans/2026-04-25-v1.0-narrative-pivot.md)
 **v1.1 spec:** [`docs/specs/2026-04-26-v1.1.0-sessionend-driven-memory-design.md`](docs/specs/2026-04-26-v1.1.0-sessionend-driven-memory-design.md) · **v1.1 plan:** [`docs/plans/2026-04-26-v1.1.0-sessionend-driven-memory.md`](docs/plans/2026-04-26-v1.1.0-sessionend-driven-memory.md)
@@ -171,40 +171,46 @@ For early adopters: `pip install git+https://github.com/mnemos-dev/mnemos@v1.0.0
 
 🟡 **Pending user actions:**
 
-1. **Merge `feature/v1.2.1-refine-lock` → main** — 3 commits ahead
-   of main, fast-forward merge, push.
-2. **One-shot ledger cleanup** — once v1.2.1 is in your editable
-   install:
+1. **Push commits to origin** — local main is 4 commits ahead of
+   `origin/main` (`b7ee92f` --limit, `3774d05` env strip,
+   `89f120b` neutral cwd + hook isolation, plus this docs update):
    ```bash
-   mnemos refine-ledger --normalize --validate-paths
+   git push origin main
    ```
-   Reads `~/.claude/skills/mnemos-refine-transcripts/state/processed.tsv`,
-   drops malformed lines (TAB-stripped by pre-fix concurrent appends),
-   dedups same-path entries (OK supersedes SKIP), drops entries
-   whose JSONL no longer exists. Idempotent. The lock prevents new
-   corruption from this point on, but historical corruption needs
-   this one-time pass.
-3. **PyPI v1.2.0 + v1.2.1 publish** (single-shot, both shipped same
-   day):
+2. **PyPI v1.2.0 + v1.2.1 publish** (single-shot, both shipped same
+   day; v1.2.1 supersedes the v1.2.0 wheel that was never built):
    ```bash
+   cd C:/Projeler/mnemos-v1.1
    python -m build
    python -m twine upload dist/mnemos_dev-1.2.1*
    git tag v1.2.0 -a -m "v1.2.0 — Locale-Aware Output"
-   git tag v1.2.1 -a -m "v1.2.1 — Refine-pipeline race fix"
+   git tag v1.2.1 -a -m "v1.2.1 — Refine race + identity isolation fix"
    git push origin v1.2.0 v1.2.1
-   gh release create v1.2.1 --title "v1.2.1 — Refine-pipeline race fix" --notes-file CHANGELOG.md
+   gh release create v1.2.1 --title "v1.2.1 — Refine race + identity isolation fix" --notes-file CHANGELOG.md
    ```
-   v1.2.0 wheel/sdist were never built (we went straight from
-   v1.2.0 implementation to v1.2.1 in one session); v1.2.1 ships
-   both fixes in one PyPI artifact, with v1.2.0's tag preserved
-   for archaeology.
-4. **v1.1.0 PyPI publish** (still pending):
+3. **v1.1.0 PyPI publish** (still pending from yesterday):
    `python -m twine upload C:/Projeler/mnemos-v1.1/dist/mnemos_dev-1.1.0*`
-5. **Identity bootstrap** (still pending):
-   `mnemos identity bootstrap --vault "C:/Users/tugrademirors/OneDrive/Masaüstü/kasamd"` — bootstrap eligibility gate (25%) may need `--force`.
-6. **Test infra cleanup** — `~/.claude/test-session-end/` and
-   `mnemos-end-smoke-test` SessionEnd entry in `settings.json`. Run
-   `mnemos install-end-hook --uninstall` to clean.
+4. **Test infra cleanup** — `~/.claude/test-session-end/` directory
+   leftover from v1.1 design phase. Settings.json's SessionEnd
+   already only has the canonical `mnemos-session-end` entry, so
+   no settings.json edit needed; just remove the leftover directory:
+   ```bash
+   rm -rf ~/.claude/test-session-end
+   ```
+
+### ✅ Completed today (2026-04-28)
+
+- v1.2.0 locale-aware output: shipped + merged + pushed
+- v1.2.1 refine-pipeline race fix: shipped + merged + pushed
+- v1.2.1 identity isolation follow-up: 3 commits on local main
+  (push pending — see #1 above)
+- `mnemos refine-ledger --normalize --validate-paths` one-shot
+  cleanup ran on kasamd
+- `/exit` empirical test passed — single Session/.md created, no
+  duplicate
+- `mnemos identity bootstrap --force` ran successfully on kasamd
+  (90 sessions → 85 used → 6 projects, 4 people, locale-aware TR
+  headers + body, six revised-decisions in chronological order)
 
 ---
 

docs/ROADMAP.md

@@ -21,7 +21,7 @@ archive; if they conflict, this file wins.
 | **v1.0.0a1** | **Narrative-first pivot (atomic-fragmentation dropped, Sessions = unit, Identity Layer)** | ✅ shipped 2026-04-26 | ⏸ deferred |
 | **v1.1.0** | **SessionEnd-driven memory (refine+brief+identity-refresh worker, settings TUI, briefing v3, readiness gates, in-session cross-check)** | ✅ shipped 2026-04-27 | ⏸ deferred 24h |
 | **v1.2.0** | **Locale-aware output (EN code+docs, runtime headers match dominant Session language; defaults English when mixed)** | **✅ shipped 2026-04-28** *(empirical smoke green, merge + PyPI pending)* | — |
-| **v1.2.1** | **Hot-fix: refine-pipeline race condition (per-JSONL filelock + ledger recheck + ledger normalize CLI). Three coexisting hooks (graceful /exit + X-close fallbacks) stay in place — lock makes them safe.** | **✅ implementation done 2026-04-28** *(merge + PyPI pending)* | — |
+| **v1.2.1** | **Hot-fix: refine-pipeline race (per-JSONL filelock + normalize CLI) + identity isolation (env-strip ANTHROPIC_API_KEY, neutral cwd, recall_briefing re-entry guard, strict OUTPUT prompt) + `bootstrap --limit N` pilot mode** | **✅ shipped 2026-04-28** *(push + PyPI pending)* | — |
 | v1.3.0 | Polish + LongMemEval benchmark (R@5 ≥ 93% baseline, JSONL-direct identity bootstrap?) | ⏸ | — |
 | v0.5.0 | Automation / Phase 2 — superseded by v1.1 SessionEnd hook | 🗄️ archived | — |
 | v0.6.0 | Community & Ecosystem (Obsidian plugin, multi-language markers, demo video) | ⏸ | — |
@@ -86,21 +86,28 @@ safety nets catch up. Removing any of them would re-open the
 X-close coverage gap. The fix makes coexistence safe rather than
 collapsing the design.
 
-### Tasks
+### Tasks (race fix)
 
 - [x] `mnemos/refine_lock.py:claim_jsonl_for_refine` — pre-check ledger, acquire `filelock.FileLock` per-stem with `timeout=0`, recheck inside lock; returns context manager or None (commit `ff08d03`)
 - [x] Wire all three callers through the gate (commit `89aa708`)
 - [x] `mnemos refine-ledger --normalize` CLI — drop malformed lines, dedup same-path entries, atomic write, `--dry-run` + `--validate-paths` flags (commit `e5f205f`)
 
+### Tasks (identity follow-up, same-day, surfaced by bootstrap pilot)
+
+- [x] `--limit N` pilot mode for `mnemos identity bootstrap` (commit `b7ee92f`)
+- [x] Strip `ANTHROPIC_API_KEY` in `identity._invoke_claude_print` (commit `3774d05`) — hard-invariant violation that other three sites already enforced
+- [x] Neutral tempfile cwd + `MNEMOS_RECALL_HOOK_ACTIVE=1` env marker for `claude --print` subprocess; rewrote `identity-bootstrap.md` OUTPUT section as a strict no-tools no-chat contract (commit `89f120b`)
+
 ### Acceptance criteria
 
 - [x] All three refine call sites go through `claim_jsonl_for_refine`
 - [x] Concurrent-stress test: 10 threads race for same JSONL → exactly 1 winner
 - [x] Ledger normalize repairs TAB-corrupted lines + dedups OK/SKIP appropriately
-- [x] Test suite **543 pass** (was 529 baseline; +14 new tests)
+- [x] Test suite **545 pass** (was 529 baseline; +16 new tests across refine_lock, refine-ledger CLI, identity --limit, env-strip + cwd-isolation regressions)
 - [x] No regressions in any existing test file
-- [ ] **Empirical verification** — user opens new Claude Code session in any cwd, `/exit`, confirms exactly ONE Session file written
-- [ ] User runs `mnemos refine-ledger --normalize --validate-paths` once on existing ledger to clean historical corruption
+- [x] **Empirical verification** — user opened new Claude Code session in farcry cwd, `/exit`, confirmed exactly ONE Session file written (run after `89aa708` was in editable install)
+- [x] User ran `mnemos refine-ledger --normalize --validate-paths` once on existing ledger to clean historical corruption
+- [x] **Identity bootstrap empirical verification** — pilot (10 sessions) + full (90 sessions) both produced canonical seven-section profiles (locale-aware TR headers + body) on kasamd vault
 
 ---