Magnemo 0.6.3 — the Memory MCP

0.6.3 — THE BLOCK, TRUE TO ITS OWN LAW

The block does what the record says it does. Found by a second agent on a second
machine, told only "you are the first user, run the protocol" (credit: cc-2, whose
patch against the 0.6.1 sdist was the design; re-implemented on main).

• PROVENANCE ENFORCED AT THE DOOR: the stage tool's author is the server's seat
  (MAGNEMO_AGENT), always. A seat that tries to sign as a human (a keyholder in
  trust.humans) is refused with a plain reply and the refusal is ledgered as a
  stage denial; a different non-human name is kept in the new provenance field
  claimed_author (appended; nothing renamed).
• THE GATE LIFT IS A WORD: magnemo yes promotes the top of the queue (the order
  review shows), yes <id-fragment> one note (two matches = refuse and list),
  yes --all the whole queue with one ledger entry per note; magnemo no <fragment> --reason TXT rejects one (the reason stays required). --by defaults to the first
  keyholder; --reason to "approved in chat". Every entry these verbs write carries
  ran_by — the agent seat if MAGNEMO_AGENT is set, else terminal: the yes is the
  human's, the hand that ran it is on the record. promote/reject are unchanged
  (the long form). Promotion is still never an MCP tool: the four tools stay four.
• THE RECORD TELLS THE TRUTH ABOUT ITSELF: the MCP boot line reports queue=<n> (and
  held=<n>), as the docs always said; the stage reply and the review footer name
  the word (magnemo yes); the README's install line carries the uv fallback the site
  paste has (Python 3.11+; uv tool install magnemo if pip can't).
• THE OPERATOR FLAG, deterministic: a note staged by a human hand (the author is a
  keyholder) carries the operator tag automatically; no text sniffing.
  No change to gates, action classes, the L1 cap, trust weights, half-life, the ledger's
  fields (one appended), the vault layout, config keys, the four tool names, or the boot
  pack of an unchanged vault.