feat: add comprehensive documentation for AI Workspace, including architecture, memory model, profiles, services, and security guidelines

docs/memory-model.md

@@ -0,0 +1,69 @@
+# Memory Model
+
+AI Workspace separates memory by purpose so that human-readable knowledge, raw evidence, agent behavior, and derived indexes do not collapse into one opaque store.
+
+## Memory Layers
+
+| Layer | Purpose | Examples | Canonical? |
+|---|---|---|---|
+| Canonical project memory | Durable project facts for humans and AI | current work, work items, people, decisions, daily notes | yes |
+| Raw evidence | Captured data before curation | Mattermost mirror, photos, archives | no |
+| Agent operating memory | Rules for agent behavior and workflows | promotion rules, communication style, verification rules | yes for agent behavior |
+| Derived index | Fast retrieval over canonical memory | `.aiw/indexes/<profile>/` | no |
+| External agent memory | Optional cross-agent recall | mem9, tool auto-memory | no for project truth |
+
+## Canonical Markdown
+
+The project knowledge vault should be readable without any AI tool:
+
+```text
+project-knowledge/
+  00-start/
+  01-current/
+  02-work-items/
+  03-context/
+  04-people/
+  05-decisions/
+  06-daily/
+  07-maps/
+  08-bases/
+  09-templates/
+```
+
+For future multi-profile setups, this same structure should live under a profile-specific workspace path.
+
+## Evidence Promotion
+
+Connectors write evidence. They do not decide what becomes memory.
+
+Promotion flow:
+
+```text
+inbox evidence → verified fact → smallest correct Markdown file
+```
+
+Do not promote:
+
+- secrets;
+- sync status;
+- generic chatter;
+- unverified guesses;
+- raw transcripts without curation.
+
+## Local Index
+
+The local RAG index is derived from canonical Markdown. It helps AI clients find relevant snippets quickly, but it is not the source of truth.
+
+If index output conflicts with Markdown, Markdown wins.
+
+## mem9 And Similar Memory Systems
+
+mem9 can be useful as an optional cross-agent recall layer for preferences, reusable workflow habits, and non-sensitive operational memory. It should not replace the project knowledge vault.
+
+Recommended stance:
+
+```text
+project-knowledge/ wins over mem9, vector stores, and chat memory.
+```
+
+For sensitive or corporate projects, avoid cloud memory ingestion unless the data policy is explicit and approved.