@askexenow/exe-os 0.9.115 → 0.9.117

package/dist/bin/cli.js

@@ -291,8 +291,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -7316,10 +7316,11 @@ async function cloudPull(sinceVersion, config) {
         continue;
       }
     }
+    const finalMaxVersion = maxReadableVersion;
     if (skippedBlobs > 0) {
-      logError(`[cloud-sync] PULL skipped ${skippedBlobs} undecryptable blob(s); pull cursor advanced only to last readable version ${maxReadableVersion}`);
+      logError(`[cloud-sync] PULL skipped ${skippedBlobs} undecryptable blob(s); cursor advancing to ${finalMaxVersion} (last readable: ${maxReadableVersion})`);
     }
-    return { records: allRecords, maxVersion: maxReadableVersion };
+    return { records: allRecords, maxVersion: finalMaxVersion };
   } catch (err) {
     logError(`[cloud-sync] PULL FAILED: ${err instanceof Error ? err.message : String(err)}`);
     return { records: [], maxVersion: sinceVersion };
@@ -8961,7 +8962,16 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
     "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
-    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT",
+    // Temporal validity (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN valid_from TEXT",
+    "ALTER TABLE memories ADD COLUMN invalid_at TEXT",
+    // Multi-agent visibility (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN visibility TEXT DEFAULT 'private'",
+    // Procedure binding (AFM-3, must match database.ts)
+    "ALTER TABLE memories ADD COLUMN procedure_for TEXT",
+    // Memory strength scoring — Ebbinghaus decay (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN strength REAL DEFAULT 1.0"
   ]) {
     try {
       await client.execute(col);
@@ -9226,7 +9236,7 @@ var init_platform_procedures = __esm({
         title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
         domain: "identity",
         priority: "p0",
-        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
       },
       {
         title: "Single dispatch path \u2014 create_task only",
@@ -14188,6 +14198,27 @@ var init_plan_limits = __esm({
   }
 });
 
+// src/lib/agent-context.ts
+var agent_context_exports = {};
+__export(agent_context_exports, {
+  getAgentContext: () => getAgentContext,
+  runWithAgent: () => runWithAgent
+});
+import { AsyncLocalStorage } from "async_hooks";
+function runWithAgent(ctx, fn) {
+  return agentStore.run(ctx, fn);
+}
+function getAgentContext() {
+  return agentStore.getStore();
+}
+var agentStore;
+var init_agent_context = __esm({
+  "src/lib/agent-context.ts"() {
+    "use strict";
+    agentStore = new AsyncLocalStorage();
+  }
+});
+
 // src/lib/task-scope.ts
 var task_scope_exports = {};
 __export(task_scope_exports, {
@@ -15835,7 +15866,9 @@ async function storeBehavior(opts) {
     const { loadEmployeesSync: loadEmployeesSync2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
     const roster = loadEmployeesSync2();
     if (roster.length > 0 && !roster.some((e) => e.name === opts.agentId)) {
-      throw new Error(`Agent "${opts.agentId}" not found in roster. Cannot store behavior for unregistered agent.`);
+      if (process.env.NODE_ENV !== "test") {
+        console.warn(`[behaviors] Agent "${opts.agentId}" not found in roster \u2014 storing anyway.`);
+      }
     }
   } catch (e) {
     if (e instanceof Error && e.message.includes("not found in roster")) throw e;
@@ -16876,15 +16909,37 @@ function getDispatchedBy(sessionKey) {
   }
 }
 function resolveExeSession() {
-  if (process.env.EXE_SESSION_NAME) {
-    const fromEnv = extractRootExe(process.env.EXE_SESSION_NAME) ?? process.env.EXE_SESSION_NAME;
-    if (fromEnv) return fromEnv;
-  }
   const mySession = getMySession();
+  const fromSessionName = mySession ? extractRootExe(mySession) ?? null : null;
+  const alsHint = (() => {
+    try {
+      const { getAgentContext: getAgentContext2 } = (init_agent_context(), __toCommonJS(agent_context_exports));
+      return getAgentContext2()?.sessionHint ?? "";
+    } catch {
+      return "";
+    }
+  })();
+  const sessionHintRaw = alsHint || process.env.EXE_SESSION_NAME || "";
+  if (sessionHintRaw) {
+    const fromEnv = extractRootExe(sessionHintRaw) ?? sessionHintRaw;
+    if (fromEnv) {
+      if (!mySession) {
+        return fromEnv;
+      }
+      if (fromSessionName && fromEnv !== fromSessionName) {
+        process.stderr.write(
+          `[tmux-routing] WARN: EXE_SESSION_NAME="${fromEnv}" but tmux says "${fromSessionName}". Trusting tmux, correcting env var.
+`
+        );
+        process.env.EXE_SESSION_NAME = fromSessionName;
+      } else {
+        return fromEnv;
+      }
+    }
+  }
   if (!mySession) {
     return null;
   }
-  const fromSessionName = extractRootExe(mySession);
   let candidate = null;
   try {
     const key = getSessionKey();
@@ -17068,6 +17123,21 @@ function isExeSession(sessionName) {
 }
 function sendIntercom(targetSession) {
   const transport = getTransport();
+  try {
+    const callerScope = resolveExeSession();
+    if (callerScope && isExeSession(callerScope) && targetSession.includes("-")) {
+      const targetScope = extractRootExe(targetSession);
+      if (targetScope && targetScope !== callerScope) {
+        logIntercom(`BLOCKED \u2192 ${targetSession} (scope violation: caller=${callerScope}, target=${targetScope})`);
+        process.stderr.write(
+          `[intercom] BLOCKED: cross-session intercom from ${callerScope} to ${targetSession}. Session isolation enforced.
+`
+        );
+        return "failed";
+      }
+    }
+  } catch {
+  }
   if (isExeSession(targetSession)) {
     logIntercom(`SKIP_COORDINATOR \u2192 ${targetSession} (coordinator sessions use prompt-submit hook)`);
     return "skipped_exe";
@@ -17442,8 +17512,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   }
   if (!useExeAgent && !useCodex && !useOpencode && !useBinSymlink) {
     if (agentRtConfig.runtime === "claude" && agentRtConfig.model) {
-      const { normalizeCcModelName: normalizeCcModelName2 } = (init_agent_config(), __toCommonJS(agent_config_exports));
-      const ccModel = normalizeCcModelName2(agentRtConfig.model);
+      const ccModel = normalizeCcModelName(agentRtConfig.model);
       envPrefix = `${envPrefix} ANTHROPIC_MODEL=${ccModel}`;
     }
   }
@@ -17848,19 +17917,6 @@ var init_messaging = __esm({
   }
 });
 
-// src/mcp/agent-context.ts
-import { AsyncLocalStorage } from "async_hooks";
-function getAgentContext() {
-  return agentStore.getStore();
-}
-var agentStore;
-var init_agent_context = __esm({
-  "src/mcp/agent-context.ts"() {
-    "use strict";
-    agentStore = new AsyncLocalStorage();
-  }
-});
-
 // src/lib/active-agent.ts
 var active_agent_exports = {};
 __export(active_agent_exports, {
@@ -20575,33 +20631,6 @@ exec "${exeStartDst}" "$0" "$@"
         writeWrapper(path40.join(globalBinDir, `${emp.name}${n}`), wrapperContent);
       }
       created++;
-      writeWrapper(path40.join(binDir, `${emp.name}${n}-codex`), wrapperContent);
-      if (globalBinDir) {
-        writeWrapper(path40.join(globalBinDir, `${emp.name}${n}-codex`), wrapperContent);
-      }
-      created++;
-    }
-  }
-  const codexLauncherCandidates = [
-    path40.join(packageRoot, "dist", "bin", "exe-start-codex.js"),
-    path40.join(packageRoot, "src", "bin", "exe-start-codex.ts")
-  ];
-  let codexLauncher = null;
-  for (const c of codexLauncherCandidates) {
-    if (existsSync34(c)) {
-      codexLauncher = c;
-      break;
-    }
-  }
-  if (codexLauncher) {
-    for (const emp of employees) {
-      const wrapperPath = path40.join(binDir, `${emp.name}-codex`);
-      const content = `#!/bin/bash
-exec node "${codexLauncher}" --agent ${emp.name} "$@"
-`;
-      writeFileSync24(wrapperPath, content);
-      chmodSync4(wrapperPath, 493);
-      created++;
     }
   }
   const pathConfigured = ensurePath(home, binDir);
@@ -37342,7 +37371,8 @@ function summarizeChunk(chunk, filePath) {
   }
 }
 function isChunkable(filePath) {
-  return Boolean(languageForFile(filePath));
+  const lang = languageForFile(filePath);
+  return lang === "typescript" || lang === "javascript";
 }
 var LANGUAGE_BY_EXTENSION, TEXT_LIKE_LANGUAGES;
 var init_code_chunker = __esm({

package/dist/bin/customer-readiness.js

@@ -174,7 +174,7 @@ test("Support intake \u2014 API health route and cloud-sync license fallback exi
 });
 test("CLI/MCP parity \u2014 customer ops wrappers are registered", () => {
   const registry = readSrc("src/mcp/register-tools.ts");
-  const gates = readSrc("src/mcp/tool-gates.ts");
+  const gates = readSrc("src/lib/tool-gates.ts");
   const parity = readSrc("src/mcp/tools/cli-parity.ts");
   const requiredTools = [
     "healthcheck",

package/dist/bin/exe-agent-config.js

@@ -85,8 +85,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,

package/dist/bin/exe-agent.js

@@ -69,8 +69,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -1362,7 +1362,7 @@ var PLATFORM_PROCEDURES = [
     title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
     domain: "identity",
     priority: "p0",
-    content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+    content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
   },
   {
     title: "Single dispatch path \u2014 create_task only",

package/dist/bin/exe-assign.js

@@ -214,8 +214,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -3522,7 +3522,16 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
     "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
-    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT",
+    // Temporal validity (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN valid_from TEXT",
+    "ALTER TABLE memories ADD COLUMN invalid_at TEXT",
+    // Multi-agent visibility (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN visibility TEXT DEFAULT 'private'",
+    // Procedure binding (AFM-3, must match database.ts)
+    "ALTER TABLE memories ADD COLUMN procedure_for TEXT",
+    // Memory strength scoring — Ebbinghaus decay (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN strength REAL DEFAULT 1.0"
   ]) {
     try {
       await client.execute(col);
@@ -3787,7 +3796,7 @@ var init_platform_procedures = __esm({
         title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
         domain: "identity",
         priority: "p0",
-        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
       },
       {
         title: "Single dispatch path \u2014 create_task only",

package/dist/bin/exe-boot.js

@@ -291,8 +291,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -3757,7 +3757,7 @@ var init_platform_procedures = __esm({
         title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
         domain: "identity",
         priority: "p0",
-        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
       },
       {
         title: "Single dispatch path \u2014 create_task only",
@@ -4902,7 +4902,16 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
     "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
-    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT",
+    // Temporal validity (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN valid_from TEXT",
+    "ALTER TABLE memories ADD COLUMN invalid_at TEXT",
+    // Multi-agent visibility (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN visibility TEXT DEFAULT 'private'",
+    // Procedure binding (AFM-3, must match database.ts)
+    "ALTER TABLE memories ADD COLUMN procedure_for TEXT",
+    // Memory strength scoring — Ebbinghaus decay (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN strength REAL DEFAULT 1.0"
   ]) {
     try {
       await client.execute(col);
@@ -6291,6 +6300,27 @@ var init_agent_symlinks = __esm({
   }
 });
 
+// src/lib/agent-context.ts
+var agent_context_exports = {};
+__export(agent_context_exports, {
+  getAgentContext: () => getAgentContext,
+  runWithAgent: () => runWithAgent
+});
+import { AsyncLocalStorage } from "async_hooks";
+function runWithAgent(ctx, fn) {
+  return agentStore.run(ctx, fn);
+}
+function getAgentContext() {
+  return agentStore.getStore();
+}
+var agentStore;
+var init_agent_context = __esm({
+  "src/lib/agent-context.ts"() {
+    "use strict";
+    agentStore = new AsyncLocalStorage();
+  }
+});
+
 // src/lib/notifications.ts
 var notifications_exports = {};
 __export(notifications_exports, {
@@ -7962,7 +7992,9 @@ async function storeBehavior(opts) {
     const { loadEmployeesSync: loadEmployeesSync2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
     const roster = loadEmployeesSync2();
     if (roster.length > 0 && !roster.some((e) => e.name === opts.agentId)) {
-      throw new Error(`Agent "${opts.agentId}" not found in roster. Cannot store behavior for unregistered agent.`);
+      if (process.env.NODE_ENV !== "test") {
+        console.warn(`[behaviors] Agent "${opts.agentId}" not found in roster \u2014 storing anyway.`);
+      }
     }
   } catch (e) {
     if (e instanceof Error && e.message.includes("not found in roster")) throw e;
@@ -9003,15 +9035,37 @@ function getDispatchedBy(sessionKey) {
   }
 }
 function resolveExeSession() {
-  if (process.env.EXE_SESSION_NAME) {
-    const fromEnv = extractRootExe(process.env.EXE_SESSION_NAME) ?? process.env.EXE_SESSION_NAME;
-    if (fromEnv) return fromEnv;
-  }
   const mySession = getMySession();
+  const fromSessionName = mySession ? extractRootExe(mySession) ?? null : null;
+  const alsHint = (() => {
+    try {
+      const { getAgentContext: getAgentContext2 } = (init_agent_context(), __toCommonJS(agent_context_exports));
+      return getAgentContext2()?.sessionHint ?? "";
+    } catch {
+      return "";
+    }
+  })();
+  const sessionHintRaw = alsHint || process.env.EXE_SESSION_NAME || "";
+  if (sessionHintRaw) {
+    const fromEnv = extractRootExe(sessionHintRaw) ?? sessionHintRaw;
+    if (fromEnv) {
+      if (!mySession) {
+        return fromEnv;
+      }
+      if (fromSessionName && fromEnv !== fromSessionName) {
+        process.stderr.write(
+          `[tmux-routing] WARN: EXE_SESSION_NAME="${fromEnv}" but tmux says "${fromSessionName}". Trusting tmux, correcting env var.
+`
+        );
+        process.env.EXE_SESSION_NAME = fromSessionName;
+      } else {
+        return fromEnv;
+      }
+    }
+  }
   if (!mySession) {
     return null;
   }
-  const fromSessionName = extractRootExe(mySession);
   let candidate = null;
   try {
     const key = getSessionKey();
@@ -9195,6 +9249,21 @@ function isExeSession(sessionName) {
 }
 function sendIntercom(targetSession) {
   const transport = getTransport();
+  try {
+    const callerScope = resolveExeSession();
+    if (callerScope && isExeSession(callerScope) && targetSession.includes("-")) {
+      const targetScope = extractRootExe(targetSession);
+      if (targetScope && targetScope !== callerScope) {
+        logIntercom(`BLOCKED \u2192 ${targetSession} (scope violation: caller=${callerScope}, target=${targetScope})`);
+        process.stderr.write(
+          `[intercom] BLOCKED: cross-session intercom from ${callerScope} to ${targetSession}. Session isolation enforced.
+`
+        );
+        return "failed";
+      }
+    }
+  } catch {
+  }
   if (isExeSession(targetSession)) {
     logIntercom(`SKIP_COORDINATOR \u2192 ${targetSession} (coordinator sessions use prompt-submit hook)`);
     return "skipped_exe";
@@ -9569,8 +9638,7 @@ function spawnEmployee(employeeName, exeSession, projectDir, opts) {
   }
   if (!useExeAgent && !useCodex && !useOpencode && !useBinSymlink) {
     if (agentRtConfig.runtime === "claude" && agentRtConfig.model) {
-      const { normalizeCcModelName: normalizeCcModelName2 } = (init_agent_config(), __toCommonJS(agent_config_exports));
-      const ccModel = normalizeCcModelName2(agentRtConfig.model);
+      const ccModel = normalizeCcModelName(agentRtConfig.model);
       envPrefix = `${envPrefix} ANTHROPIC_MODEL=${ccModel}`;
     }
   }
@@ -10616,10 +10684,11 @@ async function cloudPull(sinceVersion, config) {
         continue;
       }
     }
+    const finalMaxVersion = maxReadableVersion;
     if (skippedBlobs > 0) {
-      logError(`[cloud-sync] PULL skipped ${skippedBlobs} undecryptable blob(s); pull cursor advanced only to last readable version ${maxReadableVersion}`);
+      logError(`[cloud-sync] PULL skipped ${skippedBlobs} undecryptable blob(s); cursor advancing to ${finalMaxVersion} (last readable: ${maxReadableVersion})`);
     }
-    return { records: allRecords, maxVersion: maxReadableVersion };
+    return { records: allRecords, maxVersion: finalMaxVersion };
   } catch (err) {
     logError(`[cloud-sync] PULL FAILED: ${err instanceof Error ? err.message : String(err)}`);
     return { records: [], maxVersion: sinceVersion };
@@ -12524,16 +12593,11 @@ init_notifications();
 // src/lib/active-agent.ts
 init_config();
 init_session_key();
+init_agent_context();
+init_employees();
 import { readFileSync as readFileSync13, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10, unlinkSync as unlinkSync8, readdirSync as readdirSync5 } from "fs";
 import { execSync as execSync10 } from "child_process";
 import path21 from "path";
-
-// src/mcp/agent-context.ts
-import { AsyncLocalStorage } from "async_hooks";
-var agentStore = new AsyncLocalStorage();
-
-// src/lib/active-agent.ts
-init_employees();
 var CACHE_DIR = path21.join(EXE_AI_DIR, "session-cache");
 var STALE_MS = 24 * 60 * 60 * 1e3;
 function getMarkerPath() {

package/dist/bin/exe-call.js

@@ -90,8 +90,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -299,7 +299,7 @@ var init_platform_procedures = __esm({
         title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
         domain: "identity",
         priority: "p0",
-        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
       },
       {
         title: "Single dispatch path \u2014 create_task only",

package/dist/bin/exe-cloud.js

@@ -729,8 +729,8 @@ var init_config = __esm({
         rerankerAutoTrigger: {
           enabled: true,
           broadQueryMinCardinality: 5e4,
-          fetchTopK: 200,
-          returnTopK: 20
+          fetchTopK: 150,
+          returnTopK: 5
         }
       },
       graphRagEnabled: true,
@@ -5069,10 +5069,11 @@ async function cloudPull(sinceVersion, config) {
         continue;
       }
     }
+    const finalMaxVersion = maxReadableVersion;
     if (skippedBlobs > 0) {
-      logError(`[cloud-sync] PULL skipped ${skippedBlobs} undecryptable blob(s); pull cursor advanced only to last readable version ${maxReadableVersion}`);
+      logError(`[cloud-sync] PULL skipped ${skippedBlobs} undecryptable blob(s); cursor advancing to ${finalMaxVersion} (last readable: ${maxReadableVersion})`);
     }
-    return { records: allRecords, maxVersion: maxReadableVersion };
+    return { records: allRecords, maxVersion: finalMaxVersion };
   } catch (err) {
     logError(`[cloud-sync] PULL FAILED: ${err instanceof Error ? err.message : String(err)}`);
     return { records: [], maxVersion: sinceVersion };
@@ -6714,7 +6715,16 @@ async function ensureShardSchema(client) {
     "ALTER TABLE memories ADD COLUMN audience TEXT",
     "ALTER TABLE memories ADD COLUMN language_type TEXT",
     "ALTER TABLE memories ADD COLUMN parent_memory_id TEXT",
-    "ALTER TABLE memories ADD COLUMN deleted_at TEXT"
+    "ALTER TABLE memories ADD COLUMN deleted_at TEXT",
+    // Temporal validity (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN valid_from TEXT",
+    "ALTER TABLE memories ADD COLUMN invalid_at TEXT",
+    // Multi-agent visibility (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN visibility TEXT DEFAULT 'private'",
+    // Procedure binding (AFM-3, must match database.ts)
+    "ALTER TABLE memories ADD COLUMN procedure_for TEXT",
+    // Memory strength scoring — Ebbinghaus decay (must match database.ts)
+    "ALTER TABLE memories ADD COLUMN strength REAL DEFAULT 1.0"
   ]) {
     try {
       await client.execute(col);
@@ -6979,7 +6989,7 @@ var init_platform_procedures = __esm({
         title: "Routing slot vs display title \u2014 internal 'coo' is plumbing, not your name",
         domain: "identity",
         priority: "p0",
-        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The routing slot stays `role: coo` for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
+        content: "These procedures reference 'COO' as a shorthand for the coordinator role. This is an INTERNAL routing slot used by exe-os code (chain-of-command checks, dispatch logic, session detection). It is NOT your display title. Your actual title comes from your identity file's `title:` field \u2014 that is what you use externally: introductions, sign-offs, team comms, and any user-facing text. If your identity says `title: AI Chief of Staff`, you are the AI Chief of Staff. The internal routing slot stays unchanged for code compatibility \u2014 never rename it, but also never introduce yourself as 'COO' unless your identity file explicitly says so. The founder chose your title; respect it."
       },
       {
         title: "Single dispatch path \u2014 create_task only",