Cortex across machines and people: remote reads + publish, over MCP

[rsmets]

PiSync.sh copies the system prompt, AGENTS.md, and every skill into ~/.pi/agent/. It copies no memory. So a second runtime already has Kai's identity and skills and cannot read one byte of Cortex.

I want Cortex to work across machines and across people. The hard part is not the network. It is that the write path assumes a single writer: set-overwrite has a whole-file blast radius, and the shrink and erosion guards are computed in-lock against the just-read prior state. Mount MEMORY on NFS or SMB and that guarantee quietly stops holding. #1702 is the Syncthing-flavored preview of the same thing.

So do not share storage. Share at the read and publish boundary:

• The local tree stays canonical and single-writer. Never mounted, never written by anyone else. Every existing guard keeps working untouched.
• Remote brains become additional read sources. BM25 unions them at query time. Every card already carries source and session provenance, so a remote record is always distinguishable from yours.
• Sync is one-way publish. lifeos-cortex-export/v1 already serializes records deterministically. You publish yours, others read them. No merge, no conflict, no distributed locking.
• Inbound writes are proposals, not writes. A remote item lands in pending-proposals.jsonl and goes through Tier C. That machinery already exists for exactly this trust level.

MCP is the transport. By the CliFirstArchitecture.md test this is serve, not consume: the callers are other runtimes and other people's DAs, not this harness.

This does contradict two lines in CortexContract.md's non-claims ("no MCP server or network API", "no cross-device or cloud synchronization"), so it is a scope question rather than a patch. If the answer is no, that is a clear answer and this ends here. If it is interesting, I will build a reference implementation.

Disclosure: I work on a permissioned multi-tenant context store, so I have direct commercial interest here. That is also why I would rather propose the boundary than the backend.

[danielmiessler]

Read this properly. It cuts across two lines in the Cortex contract, so it's a scope call rather than a patch, and I want to think about it before answering. Thanks for the disclosure up front.