Post-substrate canary pack for the D-139 engagement evidence substrate per spec § P6.B. Privacy-tier separated from the deterministic `crm-engagement-augmentation` pack (P6.A): this pack reads mail bodies + calendar descriptions + memory entries + per-type CRM engagement bodies to extract commitments people made ("you said you'd send X by Friday") and tracks follow-through. Installs one Layer-1 silent producer (`commitment-tracker-producer`) wrapping the AI-surface `commitment_tracker` topic + one Layer-2 visible alert (`notify-commitment-due-soon`) that fires when a pending commitment's `due_at` falls within the next 24h. Authorship-filtered (extracts ONLY from `'user'` / `'crm_user'` / `'unknown'` rows — automation/system_process rows can't make commitments). Body-state acceptance is tighter than P5 AI-surface canaries: requires `'inline_body'` (full-context required for accurate extraction; truncated previews skipped). Dedupe acceptance `'exact_only'` so probable-twin emails extract as TWO separate commitments rather than collapsing into one. Manual trust default per D-132 — user must promote at MANUAL_RUN_THRESHOLD before the substrate fires. Free-pool first per spec — commitment text generation is bounded, low-token; routing through the user's free-tier pool keeps the pack cost-neutral by default. Pack install carries an implicit MCP body-content permission grant for `data.contact.engagements.body_content` per spec § A.9.5 — without it the AI would have nothing to extract from. The grant is pack-scoped: installing the deterministic `crm-engagement-augmentation` pack does NOT carry a body-content grant. Status: post-substrate canary — graduated from launch-flag gating; marketplace listing surfaces unconditionally. Independent install gate from the deterministic pack — installs without `crm-engagement-augmentation`, vice versa, no implicit pack dependency.