sharinglisted

# Sharing (layers & packs) — priming **Canonical spec:** `docs/domains/sharing.md` — read it for the layer model, the pack format, all invariants, key files, and gotchas. Terms of record: `UBIQUITOUS_LANGUAGE.md` § Namespacing & layers, Sharing. Threat: `STRIDE.md` T-7. Layers stack namespaces (Local rw on top; Shared/Base ro below) and resolve into the recall scope. Packs are the human-readable transport that auto-mounts as a layer on import. ## Core invariants (get these right) - **Writes always land in the Local layer** — Shared/Base contribute to recall but never accept writes. - **Clamp declared provenance on import.** A poisoned pack can write `provenance=userStated`; anything above the `Pack` trust floor is clamped back down (T-7). Lower-or-equal origins pass through. - **`Unknown` provenance never crosses the wire** — omit it on export so a foreign install applies its own default and the clamp holds it at the pack floor. - **`LayerScope` is resolved once at the boundary** and is immutable; the read pipeline never learns about mounting. - **Applicability has three routes**: universal (empty `ApplicableRepos`), explicit repo, or package-dependency match (the auto-mount path). - **The pack format is a published contract** (ScribeGate + plain markdown viewers): every field must round-trip and defaults are omitted. A new `MemoryEntry` field needs a wire decision. - **Mounting is idempotent**, and a legacy `bundle:` layer id is reused rather than forked. - **L