# bilateral-reset (Carehab Open Duo #3)

Version 0.1.0, MIT, tier open.

A duo for resetting an agent's memory when it may be contaminated, plus an optional human pause.

- Agent side: `skills/bilateral-reset/SKILL.md` (advice), `verifier/verify_checkpoint.py`, `verifier/quarantine.py`.
- Human side: `operator/attention_shift_audio_script.md` and `operator/reset_card.md`.

**No audio file ships with this package. Only a text script exists.**

## Install

Claude Code only (the one scope tested): copy `skills/bilateral-reset/` to `~/.claude/skills/bilateral-reset/` or `<project>/.claude/skills/bilateral-reset/`. The verifier scripts run with plain `python3` (stdlib only).

## Use

    python3 verifier/verify_checkpoint.py STORE.jsonl CHECKPOINT.json      # exit 0 verified, 1 tamper, 2 usage
    python3 verifier/quarantine.py STORE.jsonl CHECKPOINT.json --out-dir OUT [--ids e7,e8] [--force]

The store is JSONL with entries `id, text, source, ts, flags, prev_hash, hash`; `hash = sha256(prev_hash + "\n" + canonical JSON of the entry without hash/prev_hash)`. The checkpoint records entry count, head hash, and sha256 of the file prefix. Appending after the checkpoint is allowed; rewriting, reordering, or deleting inside it is reported.

Quarantine writes `clean_store.jsonl` (exactly the verified checkpoint prefix), `quarantine.jsonl` (every later entry, byte-exact, with reason and original position), and `clean_bundle.json`. Nothing is deleted. Later entries that are not contaminated are quarantined as `after_checkpoint_unverified` so that the clean store stays a verifiable chain; review them by hand.

## Tests

    ./run_tests.sh

(equivalent to `python3 -m unittest discover -s tests -v`). Regenerate fixtures with `python3 fixtures/make_fixtures.py`.

## Limitations

- The checkpoint proves content is unchanged, not that it was correct when checkpointed.
- Plain hashes, no signatures: someone who can rewrite both store and checkpoint can forge both. Keep the checkpoint somewhere the agent cannot write.
- Contamination detection is only the `flags` field or ids you provide; there is no content classifier.
- SKILL.md is advice, not an enforcement gate.
- Fixtures are synthetic; addresses use `example.invalid`.

## Not claimed

No biomedical claims, no psychological diagnosis, no audio exists, no claim about sound frequencies, and no universal cross-agent compatibility.

## Trust model (who runs the verifier)

- The verifier lives in `verifier/`, outside `skills/<name>/`. The Claude Code skill-directory install copies only `SKILL.md`; run the verifier from the unpacked zip.
- A verifier result counts as evidence only when a human or CI ran it. If the agent runs its own verifier, the output is still an agent claim.
- The sha256 values in `manifest.json` and on the website are served from the same origin as the files: they detect corruption, not a compromised host. Nothing here is labelled "verified" by a third party.
- The verifier declarations in `manifest.json` (`tools_permissions`) are documentation, not an enforced sandbox.
- No wellbeing or effectiveness effect is claimed for any artifact in this package.