Align desk docs with C++ Alexandria

AGENTS.md

@@ -447,10 +447,10 @@ fallback. Sticky under `%USERPROFILE%`, `%APPDATA%`, `%LOCALAPPDATA%`,
 `%ProgramData%`, `%ProgramFiles%`, `%ProgramFiles(x86)%`, `C:\Tools`, and
 `C:\Temp\GitHub` (Windows env; POSIX jail later):
 `list_local_dir` (depth), `read_local_file` (offset/limit/tail),
-`write_local_file` (append), `create_local_dir`, `move_local_file`,
+`write_local_file` (append; dest unread fail-closed), `create_local_dir`, `move_local_file`,
 `get_file_info`, `list_granted_roots` (kernel jail, not Mongo), `host_snap`
 (persistent FS+process feed), `search_local` (name or `content:`), `edit_local_file`
-(`replace_all`), `run_strings`, `run_sqlite3`, `run_pwsh`, `run_python`,
+(`replace_all`; tmp+MoveFileEx, Keccak before/after — dest untouched on fail), `run_strings`, `run_sqlite3`, `run_pwsh`, `run_python`,
 `run_node`. Excel/PDF/DOCX go through host Python libs, not C++ parsers.
 Desktop Commander aliases (`read_file`, `edit_block`, `execute_command`,
 `start_process`, `create_directory`, `move_file`, `list_processes`) map
@@ -636,24 +636,23 @@ changes directory explicitly.
 
 ### Alexandria pipeline
 
+Desk default is C++ (`build\cpp_memory_store\Release`). Go under
+`godbrain_core\memory_store` is rollback.
+
 ```powershell
 .\scripts\build_pipeline.ps1
 .\godbrain_core\cpp_tools\librarian.exe --self-test
-
-Push-Location godbrain_core\memory_store
-go test ./...
-go build -o memory-store.exe ./cmd/memory-store
-go build -ldflags "-H windowsgui" -o rag-service.exe ./cmd/rag-service
-go build -o rag-rebuild.exe ./cmd/rag-rebuild
-Pop-Location
+ctest --test-dir build\cpp_memory_store -C Release --output-on-failure
 ```
 
-`scripts\build_pipeline.ps1` builds `memory-store.exe`, `rag-service.exe`,
-`rag-rebuild.exe`, `rag-eval.exe`, and `librarian.exe`. The Librarian self-test is offline and
-uses its in-memory store. To exercise MongoDB integration tests, set
-`MONGODB_TEST_URI` to a disposable instance; tests use isolated temporary
-databases for RAG coverage, while the existing Memory Store suite uses and
-clears `godbrain_test`.
+`scripts\build_pipeline.ps1` builds C++ Release first (`memory-store`,
+`rag-service`, `rag-rebuild`, `rag-eval`), then the Go rollback copies, then
+`librarian.exe`. The Librarian self-test is offline and uses its in-memory
+store. Go `go test ./...` in `godbrain_core\memory_store` remains the rollback
+suite. To exercise MongoDB integration tests, set `MONGODB_TEST_URI` to a
+disposable instance; tests use isolated temporary databases for RAG coverage,
+while the existing Memory Store suite uses and clears `godbrain_test`. Never
+write live `godbrain` from C++ ctest (`godbrain_cpp_store_test` only).
 
 ### C++ kernel
 

ARCHITECTURE.md

@@ -51,8 +51,8 @@ flowchart LR
     Kernel[C++ Kernel API :8083]
     Mongo[(MongoDB :27017)]
     Librarian[Native Librarian]
-    Memory[Go Memory Store]
-    RAG[Golden Record RAG :8084]
+    Memory[memory-store.exe]
+    RAG[rag-service :8084]
     Mouth[llama-server or coli :8000]
 
     Operator --> UI

README.md

@@ -37,7 +37,7 @@ commercial API, and `.vscode/mcp.json` is empty on purpose.
 
 - **[`godbrain_core/cpp_kernel/main.cpp`](godbrain_core/cpp_kernel/main.cpp)** hosts the HTTP API (bound to `127.0.0.1` only): Galaxy chat, no-GPU glances, `/edit`, and privileged `command_type` JSON. `/edit` is a chat door with an allowlist, not a `command_type`.
 - **[`godbrain_core/cpp_kernel/kernel.cpp`](godbrain_core/cpp_kernel/kernel.cpp)** (`GodBrainKernel::dispatch` / `validate_sovereignty`) is the Circuit Breaker: it intercepts high-risk `command_type`s, requires a non-empty `reasoning` field plus a matching `GODBRAIN_API_TOKEN` bearer token, and only then dispatches the command.
-- **[`godbrain_core/memory_store`](godbrain_core/memory_store)** (Go) writes distilled "Golden Records" into the local MongoDB database and serves committed records through the canonical loopback RAG API.
+- **[`godbrain_core/cpp_memory_store`](godbrain_core/cpp_memory_store)** is the desk Alexandria write/retrieval path (`memory-store.exe` / `rag-service.exe` on `:8084`). Go [`godbrain_core/memory_store`](godbrain_core/memory_store) stays as rollback with the same doors.
 - **[`LLM/colibri_LLM`](LLM/colibri_LLM)** (Colibri, the C-engine) is one of the interchangeable local models GodBrain drives — it is not special-cased into the memory or execution layers.
 
 ### Repository map
@@ -48,8 +48,8 @@ This tree is a desk runtime plus a released kit plus research. Maturity is
 | Surface | Maturity | Notes |
 |---|---|---|
 | C++ kernel + Galaxy (`godbrain_core/cpp_kernel`, `godbrain_core/frontend`) | daily-driver on this host | `:8083`, `/edit`, privileged `command_type` |
-| [Memory Store / rag-service](godbrain_core/memory_store/README.md) | daily-driver | `:8084` Golden Records; lexical default |
-| [C++ Memory Store](godbrain_core/cpp_memory_store/README.md) | desk launch (prefer Release) | Same stdin/HTTP exe names as Go; Go tree stays as rollback |
+| [C++ Memory Store](godbrain_core/cpp_memory_store/README.md) | daily-driver | `:8084` Golden Records; Start/Heal prefer `build/cpp_memory_store/Release` |
+| [Memory Store / rag-service](godbrain_core/memory_store/README.md) (Go) | rollback | Same stdin/HTTP exe names; do not delete |
 | Heal / Watch / `Start-GodBrain.ps1` | daily-driver | one loop; WMI children get Mongo DB name + embedding identity, not `GODBRAIN_RAG_PORT` |
 | [Reclaim11](godbrain_core/reclaim11/README.md) | released kit (v12) | Windows repair ISO/zip; not the Jarvis loop |
 | [Skill Lab](godbrain_core/skill_lab/README.md) | source + one fixture gate | promotion needs a second independent fixture before it is usable policy |
@@ -191,11 +191,12 @@ Not this host — several are standing nos. See [`docs/architecture/future.md`](
 |---|---|---|---|
 | Heal/Watch listener loop | yes | Start/Heal scripts | yes |
 | `/verify` `/reject` judge | yes | — | yes |
-| Librarian candidates + rag-service retrieve | yes | `go test` memory_store | yes (lexical) |
+| Librarian candidates + rag-service retrieve | yes | C++ ctest + Librarian `--self-test` | yes (lexical; C++ `:8084`) |
 | `/recall <query>` verified search via `:8084` | yes | — | yes |
 | Bounded `/edit` + privileged `pwsh` | yes | `Verify-LocalEdit` | yes, allowlist still grows |
-| WMI child env: DB name + embedding identity | yes | `Start-GodBrain.ps1 -SelfTestEnv` | yes after this branch |
-| Durable task ledger / chain continue | AGENTS remaining | — | no |
+| Tool `edit_local_file` / `write_local_file` hash-bound replace | yes | `local_tools_test` | yes (tmp+MoveFileEx; append fail-closed if dest unread) |
+| WMI child env: DB name + embedding identity | yes | `Start-GodBrain.ps1 -SelfTestEnv` | yes |
+| Durable task ledger / chain continue | yes | `/chain` `/cancel` `/continue` | yes (one file, not `tasks/todo.md`) |
 | Skill Lab second independent fixture | one fixture exists | Skill Lab README | no — policy not usable yet |
 | Mouth ships web-dev class UI work | destination | — | no |
 | Autonomous CVE / cross-fleet / self-DISM | **no** (standing nos) | — | no |

docs/AGENT_FACTORY_ROSTER.md

@@ -144,7 +144,8 @@ A successful process exit is not sufficient evidence of a successful job
 
 - `godbrain_core/cpp_kernel` remains the authenticated privileged
   execution boundary (`127.0.0.1`, bearer on `command_type`).
-- `godbrain_core/memory_store` remains the validated Mongo write path.
+- `godbrain_core/cpp_memory_store` is the desk Mongo write path; Go
+  `memory_store` is rollback.
 - Experimental Go/Rust routers on `:8082` are not authorization.
 - `LLM/colibri_LLM` is an interchangeable mouth, not a protocol
   authority.

docs/architecture/current.md

@@ -74,6 +74,8 @@ present, not a Playbook).
 
 Mongo is the vault. Raw sources are immutable. Chat and Galaxy read committed
 Golden Records through `rag-service`, never by querying `nodes` from C++.
+Start/Heal prefer `build\cpp_memory_store\Release\rag-service.exe`; Go
+`godbrain_core\memory_store` is rollback.
 
 Librarian extracts **claims**, not a recap, and writes only
 `trust_tier=candidate` through `memory-store.exe`. Contradictions and open

docs/architecture/reference.md

@@ -35,8 +35,9 @@ never changes; only status does.
 | Root Go router | Experimental alternative | `main.go` | HTTP on `127.0.0.1:8082` | Golden Record RAG via `:8084` and mouth invocation |
 | Rust router | Experimental alternative | `godbrain_core/rust_router/` | HTTP on `127.0.0.1:8082` | Golden Record chat via `:8084`; graph/node still `410` |
 | MongoDB knowledge store | Implemented dependency | Local MongoDB | MongoDB protocol on `localhost:27017` | Source documents and RAG records |
-| Go Memory Store | Implemented write path | `godbrain_core/memory_store/` | JSON on stdin, MongoDB driver outbound | Validate and persist provenance-aware Golden Records with append-only run links |
-| Golden Record RAG service | Implemented retrieval path | `godbrain_core/memory_store/cmd/rag-service/` | HTTP on `127.0.0.1:8084` | Bounded committed-only search, graph, and document reads with source-resolved citations |
+| C++ Memory Store | Implemented, desk write/retrieval | `godbrain_core/cpp_memory_store/` (`build/cpp_memory_store/Release`) | JSON on stdin + HTTP `:8084` | Same doors as Go: ingest, judge, skills, search/graph/document. Start/Heal prefer this tree. |
+| Go Memory Store | Implemented rollback | `godbrain_core/memory_store/` | JSON on stdin, MongoDB driver outbound | Same protocol; do not delete. |
+| Golden Record RAG service | Implemented retrieval path | C++ Release, else Go `cmd/rag-service/` | HTTP on `127.0.0.1:8084` | Bounded committed-only search, graph, and document reads with source-resolved citations |
 | Native Librarian | Implemented | `godbrain_core/cpp_tools/librarian.cpp` | CLI, `scripts/Invoke-Librarian.ps1`, Heal inbox, `POST /api/librarian` | Derive a bounded Golden Record from a transcript and invoke the Memory Store. Uses the live `:8000` mouth; does not hold VRAM. |
 | Galaxy UI | Implemented | `godbrain_core/frontend/galaxy.html` | Browser UI served by the C++ Kernel | Graph browsing, chat, This host vs Pending, SRE glance |
 | Brave extension | Implemented client | `brave_extension/` | HTTP to `127.0.0.1:8083` | Page-context-assisted local chat |

docs/architecture/setup.md

@@ -12,7 +12,8 @@ Agent build commands also live in [`AGENTS.md`](../../AGENTS.md).
 
 - Windows, PowerShell (`pwsh` preferred).
 - Visual Studio x64 C++ tools (kernel, Librarian, `run_hidden`).
-- Go version from `godbrain_core/memory_store/go.mod`.
+- CMake 3.25+ and mongo-c-driver at `C:\Tools\mongo-c-driver` (C++ Alexandria).
+- Go version from `godbrain_core/memory_store/go.mod` (rollback tree).
 - MongoDB Community as a **Windows service named `MongoDB`**, listening on
   `127.0.0.1:27017`.
 - One GPU mouth: either `llama-server` with a GGUF, or Colibri 1.10.0
@@ -78,26 +79,28 @@ From the repo root:
 .\godbrain_core\cpp_tools\librarian.exe --self-test
 ```
 
-That builds `memory-store.exe`, `rag-service.exe`, `rag-rebuild.exe`,
-`rag-eval.exe`, and `librarian.exe`. The Librarian self-test is offline.
+That builds C++ Release first (`build\cpp_memory_store\Release`), then Go
+rollback copies under `godbrain_core\memory_store`, then `librarian.exe`.
+The Librarian self-test is offline.
 
 Once Mongo is up, project any committed records written before this retrieval
-layer:
+layer (desk path; Go `memory_store\rag-rebuild.exe` is rollback):
 
 ```powershell
-.\godbrain_core\memory_store\rag-rebuild.exe
+.\build\cpp_memory_store\Release\rag-rebuild.exe
 ```
 
-Then let Start or Heal launch `rag-service.exe` on `127.0.0.1:8084`.
+Then let Start or Heal launch `rag-service.exe` on `127.0.0.1:8084`
+(prefer C++ Release).
 
-Optional live desk eval (from `godbrain_core\memory_store`, RAG must be ready).
-Verified-only plus each query's sector. A miss means no configured needle
-appeared in the returned top-K, or the query failed. It does not prove the
-claim is absent from the verified corpus. `-strict` fails on any such miss:
+Optional live desk eval (RAG must be ready). Verified-only plus each query's
+sector. A miss means no configured needle appeared in the returned top-K, or
+the query failed. It does not prove the claim is absent from the verified
+corpus. `-strict` fails on any such miss:
 
 ```powershell
-.\rag-eval.exe -live
-.\rag-eval.exe -live -strict
+.\build\cpp_memory_store\Release\rag-eval.exe -live
+.\build\cpp_memory_store\Release\rag-eval.exe -live -strict
 ```
 
 ## 4. Build the kernel

godbrain_core/local_ingestion/README.md

@@ -1,15 +1,14 @@
 # Secure local document ingestion
 
 This adapter extracts explicitly supplied local files, rejects likely credential
-material, and sends one strict JSON document per file to the Go Memory Store. It
-does not run inside the privileged kernel and never writes MongoDB directly.
+material, and sends one strict JSON document per file to `memory-store.exe`
+(desk C++ Release, else Go rollback). It does not run inside the privileged
+kernel and never writes MongoDB directly.
 
 Build the Memory Store first, set `MONGODB_URI`, then ingest UTF-8 text:
 
 ```powershell
-Push-Location godbrain_core\memory_store
-go build -o memory-store.exe .\cmd\memory-store
-Pop-Location
+.\scripts\build_pipeline.ps1
 python -m godbrain_core.local_ingestion --source-label research .\notes.md
 ```
 

godbrain_core/local_ingestion/__main__.py

@@ -5,7 +5,13 @@
 import sys
 from pathlib import Path
 
-from .ingestion import IngestionError, build_payload, extract_file, invoke_memory_store
+from .ingestion import (
+    IngestionError,
+    build_payload,
+    extract_file,
+    invoke_memory_store,
+    resolve_memory_store_exe,
+)
 
 
 def _parser() -> argparse.ArgumentParser:
@@ -15,8 +21,8 @@ def _parser() -> argparse.ArgumentParser:
     parser.add_argument("files", nargs="+", help="regular files to ingest (directories and links are rejected)")
     parser.add_argument(
         "--memory-store",
-        default=os.environ.get("MONGO_STORE_PATH", "godbrain_core/memory_store/memory-store.exe"),
-        help="path to the Go memory-store executable (default: MONGO_STORE_PATH or repository build path)",
+        default=None,
+        help="path to memory-store.exe (default: MONGO_STORE_PATH, else C++ Release, else Go rollback)",
     )
     parser.add_argument("--source-label", default="local", help="safe durable label; absolute paths are never stored")
     parser.add_argument(
@@ -76,8 +82,9 @@ def main(argv: list[str] | None = None) -> int:
                     f"sha256={payload['document']['content_sha256']} chunks={len(payload['chunks'])}"
                 )
             return 0
+        store = args.memory_store or resolve_memory_store_exe()
         for display_name, payload in prepared:
-            receipt = invoke_memory_store(payload, args.memory_store)
+            receipt = invoke_memory_store(payload, store)
             print(f"ingested {display_name}: status={receipt['status']} run_id={receipt['run_id']}")
         return 0
     except IngestionError as exc:

godbrain_core/local_ingestion/ingestion.py

@@ -476,6 +476,26 @@ def build_payload(document: ExtractedDocument, source_label: str = "local") -> d
     return payload
 
 
+def resolve_memory_store_exe(
+    repo_root: Path | None = None,
+    env: dict[str, str] | None = None,
+) -> str:
+    environ = os.environ if env is None else env
+    override = environ.get("MONGO_STORE_PATH", "").strip()
+    if override:
+        return override
+    root = Path(__file__).resolve().parents[2] if repo_root is None else repo_root
+    candidates = (
+        root / "build" / "cpp_memory_store" / "Release" / "memory-store.exe",
+        root / "godbrain_core" / "cpp_memory_store" / "memory-store.exe",
+        root / "godbrain_core" / "memory_store" / "memory-store.exe",
+    )
+    for path in candidates:
+        if path.is_file():
+            return str(path)
+    return str(candidates[-1])
+
+
 def invoke_memory_store(
     payload: dict[str, Any],
     executable: str | os.PathLike[str],

godbrain_core/local_ingestion/test_ingestion.py

@@ -19,6 +19,7 @@
     legacy_keccak256,
     scan_sensitive_content,
     invoke_memory_store,
+    resolve_memory_store_exe,
 )
 
 
@@ -232,6 +233,23 @@ def test_incomplete_success_receipt_is_rejected(self) -> None:
             with self.assertRaisesRegex(IngestionError, "unexpected receipt"):
                 invoke_memory_store({"bounded": True}, "memory-store.exe")
 
+    def test_resolve_memory_store_prefers_cpp_release(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            go = root / "godbrain_core" / "memory_store" / "memory-store.exe"
+            cpp = root / "build" / "cpp_memory_store" / "Release" / "memory-store.exe"
+            go.parent.mkdir(parents=True)
+            cpp.parent.mkdir(parents=True)
+            go.write_bytes(b"go")
+            cpp.write_bytes(b"cpp")
+            self.assertEqual(resolve_memory_store_exe(repo_root=root, env={}), str(cpp))
+            self.assertEqual(
+                resolve_memory_store_exe(repo_root=root, env={"MONGO_STORE_PATH": "C:\\override.exe"}),
+                "C:\\override.exe",
+            )
+            cpp.unlink()
+            self.assertEqual(resolve_memory_store_exe(repo_root=root, env={}), str(go))
+
 
 if __name__ == "__main__":
     unittest.main()

godbrain_core/memory_store/README.md

@@ -1,4 +1,8 @@
-# Alexandria Memory Store and Golden Record retrieval
+# Alexandria Memory Store and Golden Record retrieval (Go rollback)
+
+Desk Start/Heal prefer C++ `godbrain_core/cpp_memory_store/`
+(`build/cpp_memory_store/Release`). This Go tree stays as rollback with the
+same stdin/HTTP doors. Do not delete it.
 
 This Go module contains two boundaries: