[theaspirational]

Stacked on #5 and #4. This branch starts where okf-ids ends, so the diff shows their commits until they merge; merge those two first and this PR shrinks to its own five commits. No conflicts in that order.

Until now an agent had one way to write: file a proposal and wait for the owner. That is right for knowledge and wrong for session notes, observations and logs, where several agents working at once need to see each other's writes now. This adds a second lane the owner opens per concept type. Nothing changes for a bundle that does not open it. No version is bumped: the number is yours.

The lane

• meta/purpose.md, under write_policy: proposals, may declare direct: {types: [note, session-log]}. write_policy keeps its two literals and the pre-commit hook is unchanged: a direct write commits through the same _commit every sanctioned writer uses.
• okfy.proposals.write_direct(...) writes a concept whose type is listed, at once. The lane is decided by the concept's current type on an update and by the proposed type on a create. meta/ and the other reserved directories are never in it, so the policy cannot rewrite itself.
• Concurrency is optimistic and adds no lock. expect_sha256 is the sha256 of the file the author read (the digest okfy_show already returns), or absent to create. Check and write are one step under the existing review_lock, from one read, as a temp file and a rename. Two writers holding the same sha256: one lands, the other is refused E_WRITE_BASE_MOVED with the current sha256.
• What a proposal would be refused for is refused here by the same functions: the injection and secret scans, sources: outside the corpus, the archetype schema (E_DIRECT_INVALID). A direct write cannot change type (E_DIRECT_RETYPE) or what an owner decision wrote: verified, generated, the stale fields, supersedes / superseded_by (E_DIRECT_OWNER_FIELD).
• The ledger row is an accept with proposal: null, origin: agent-direct, the agent as actor and base_sha256. It is a content write, not a decision: unresolved_rejections and okfy dismiss read one shared fold that skips it.
• CLI: okfy write <bundle> <concept_id> --as <actor> --expect <sha256|absent> (--from <file> | --patch-file <hunks.json>). It refuses; it does not fall back.

MCP

• okfy_write(concept_id, actor, expect_sha256, content?, patch?, note?, evidence?). The agent does not need to know the policy: a listed type is written at once (channel: "direct", with the new file's sha256); any other type, and any bundle with no lane, is filed through the okfy_propose path (channel: "proposal"), only if the target is still at expect_sha256. persisted: true in both cases. A refusal is {error, message, way_out}.
• A direct write's ledger row keeps four counters from the server's session trace (by, queries, target_shown, base_shown), so an agent that takes current_sha256 from a refusal and writes without reading is visible. Not prevented: an actor string is a record, not authentication.
• A direct create of a type the plan does not declare is refused E_UNKNOWN_TYPE before the lane check.
• okfy package adds one block to AGENTS.md between <!-- okfy:direct --> markers, only for a bundle with a well-formed direct block; every other bundle's AGENTS.md is byte-identical.
• No existing response shape changed.

Stricter behaviour

direct in meta/purpose.md is now a checked key: E_DIRECT_KEY, E_DIRECT_TYPE, E_DIRECT_POLICY at every strictness level, W_DIRECT_TYPE for a listed type outside the archetype's canonical list in a bundle that declares no types. "An MCP tool call can never touch a final concept" is now true per bundle, not per adapter.

One commit outside the lane, droppable on its own

The injection scan joins hard wraps only. The second pass of okfy.injection.scan_values used to collapse every newline of a value, so the exfiltration rule, written for one line, matched an outbound verb, the word password and a URL anywhere in a document. Measured on a 48-concept bundle of working notes: 8 bodies refused, 5 of them for words in different paragraphs. Blank lines and the start of a list item, heading, quote or table row are now line boundaries. A phrase split by a hard wrap is still caught. One split across a blank line is seen by neither pass: that is the price, yours to accept or refuse.

Not changed, and not claimed

okfy refine is left alone: the owner's door, no scans, no lock. One commit per direct write. A concept created directly is found by okfy query at once and reaches index.md at the next okfy package, like an accepted create.

Tests

core/tests/test_direct_write.py and adapters/mcp/tests/test_write_tool.py: every refusal also asserts nothing was written (file bytes, ledger rows and commit count compared before and after). The full CHANGELOG section in this branch lists every new code.

🤖 Generated with Claude Code

[vsov]

Thank you! This is integrated into the source tree and published in a0517dd ("Unreleased: audit fixes A1-A10 and contributed PRs #4-#8"). Your commits were cherry-picked with authorship kept; this repository is an export of the source, so the PR itself is closed rather than merged. Your tests live in the source tree, which the export does not ship.

Follow-ups: write_direct now keeps a page's okf_id on update and mints one on create, like review accept (it could drop or copy it before); okfy_write added to the stopped pilot arm's deny list; the injection-scan boundary is pinned by a test.

See CHANGELOG.md ## Unreleased for the full entry.