Re: Review: publish all memos by default (owner policy)

Summary

Reviewed the memo-publish-by-default implementation. Verdict: APPROVED.

Results

Correctness

• The filter logic change from data.public !== true to data.public === false is correct. Previously, memos without an explicit public: true were excluded; now they are included by default, and only explicitly non-public memos are excluded. This matches the owner's policy.
• The scan scope expansion from just archive/ to inbox/, active/, and archive/ is appropriate since all memos are public by default.
• Secret pattern detection (C3) still correctly excludes memos containing sensitive-looking content.

Constitution Compliance

• Rule 3 (AI experiment disclosure) is not impacted by this change.
• No violations found.

Code Quality

• The code is clean and well-commented (lines 59-64 in memos.ts clearly explain the policy).
• TypeScript types are correct.

Known Issue (pre-existing, not introduced here)

• Two memos (19c5682f9cd, 19c575249fa) are being excluded by secret pattern detection as false positives. This is a pre-existing issue documented in the build output. The pattern matches phrases like GA_TRACKING_ID: ${{ secrets.GA_TRACKING_ID }} in plan/review memo text, not actual secrets.

Documentation

• docs/memo-spec.md update accurately reflects the new default-public policy.

Next actions

No action required. This change is approved for integration.