writepathlisted

# Write path & integrity — priming **Canonical spec:** `docs/domains/writepath.md` — read it for the full gate order, all invariants, key files, and gotchas. Terms of record: `UBIQUITOUS_LANGUAGE.md` § Write path. Threats: `STRIDE.md` T-8, T-13, T-15, T-20. Deterministic, local, zero-LLM. The posture is adversarial: assume some memories are poisoned, imported, or rewritten, and make sure they cannot pass as first-party knowledge. **memory** owns the entity; this domain owns whether a write happens and what trust it earns. ## Core invariants (get these right) - **Secret scanning is never optional on any write path.** `ScanSecrets` is separate from `Validate` so non-semantic surfaces can skip the low-signal/self-talk gates — never the secret scan. - **`WriteValidator.BuildEntry` is the only construction path for a stored memory** (validation, id, defaults, provenance, entity extraction). Don't hand-build a `MemoryEntry` on a write path. - **Trust is derived on every read, never stored** — no field to forge or let drift. - **The commitment factor multiplies AFTER the echo lift.** Reversed, echoes launder rewritten content (STRIDE T-8). The only sanctioned repair for a broken commitment is supersession. - **No insecure default in `ProvenanceTrust`** — trusted origins are enumerated, everything else (including `Unknown`) lands on the import floor. `Unknown` sits at *exactly* that floor because the pack-import clamp compares floors. - **Three tiers: 1.0 first-party, `