feat: team memory — ledger merge/blame/query, attribution, per-author trust (substrate-v2 P2)

[CodeWithJuber]

What & why

Phase P2 of the substrate-v2 plan (#24; P1 = #25/#26): the PCM ledger becomes team memory. Spec: docs/plans/substrate-v2/02-team-memory.md.

• forge ledger merge <path> — the conflict-free semilattice merge of any other on-disk ledger (a teammate's checkout, a worktree, a backup). Idempotent and order-independent by the CRDT property; identical knowledge minted independently by two people converges to one claim with every author preserved in its provenance log. The P2 acceptance gate from the plan — on-disk cross-merge convergence (A←B, then B←A, then a third replica merging in the opposite order, all canonically identical) — is a test.
• forge ledger blame <id> — the accountability view: every mint (all authors via the provenance log), every oracle outcome, every retraction, plain val vs trust-weighted val, and each participant's earned trust. This is the paper's 17:36 audit-trail obligation made a command.
• forge ledger query "<text>" — Eq. 3 retrieval (α·rel + β·rec + γ·val) over live claims, the first read-path surface on the ledger.
• Attribution — every claim, evidence record, and tombstone now carries the git identity (gitAuthor() in src/util.js: FORGE_AUTHOR env override → git config → ""; cached per process; best-effort by design).
• Per-author trust — authorTrust() computes u(author) ∈ [0.5, 1] from the oracle track record of the claims an author minted: Beta-smoothed so a no-history teammate starts at 1.0 (never punish the newcomer), floored at 0.5 (never silence anyone), and an author's own evidence on their own claims is excluded (the C12 self-preference discipline). val() accepts a trust map so a repeatedly-contradicted author's evidence moves confidence less.
• forge doctor — two new checks: the union-merge driver is present in .gitattributes (a populated ledger without it will conflict on the first concurrent append) and the ledger passes normal-form verification.

Smoke-tested live: two "teammates" with separate repos each learned the same fact plus one unique fact; after forge ledger merge, the shared fact is one claim with both mints in provenance, blame shows both authors with earned trust, and doctor flags the missing merge driver in the un-inited repo.

Checklist

• npm test passes (274/274 — new: on-disk cross-merge convergence, blame view, authorTrust bootstrap/floor/self-exclusion, trust-weighted val)
• npm run check passes on changed files
• New public functions have a test (authorTrust, mergeDirs, blame, gitAuthor exercised via bridge attribution)
• Conventional commit message (feat:)
• CHANGELOG.md updated under ## [Unreleased]
• No new runtime dependency
• Substrate/docs updated — implements 02-team-memory.md §2–§3 (CLI surface, attribution, trust weighting)

Risk & rollback

• Risk level: low — additive CLI subcommands + optional val parameter; attribution fields ride in append-only logs (never in claim ids), so existing ledgers stay valid
• Rollback plan: revert the commit; ledgers written with attribution remain readable by prior code (extra record fields are ignored)

Extra checks (tick if applicable)

• npm run typecheck passes
• Input validated at boundaries (merge refuses missing paths; blame requires a ≥2-char prefix)
• Logs contain no secrets/PII (author strings are git identities the user already publishes in commits)
• If AI-assisted: I understand it, verified the package APIs, and it has tests

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fc2MvWJbQ1cyNQ76ymv4hs

---

Generated by Claude Code