@ijfw/memory-server 1.4.4 → 1.5.1

package/src/memory/embedding-cache.js

@@ -0,0 +1,136 @@
+// v1.5.0 audit MED #7 (memory-engine.md F-PRF-4): persistent embedding
+// cache. Thin read/write surface over the memory_entry_vectors table
+// (migration 005). All functions are sync to match the rest of the
+// memory tier (better-sqlite3 is synchronous) and tolerate a db that
+// hasn't reached schema v5 -- callers see "miss" rather than a throw,
+// so hybrid rerank degrades to live re-embed without flooding stderr.
+//
+// v1.5.0 wire-W1.C: PK is content-hash (sha256(text)) so the cache
+// works for ANY repeated snippet, not just rows that carry a stable
+// memory_entry id. The high-level helpers `cacheKeyFor(text)`,
+// `getCachedEmbedding(db, key, modelId)`, and `setCachedEmbedding(...)`
+// are the production wire surface for search-hybrid's
+// maybeRerankWithVectors path.
+//
+// Format: Float32Array <-> Buffer at the SQLite boundary. Each float
+// is 4 bytes little-endian. Decode is endian-agnostic via DataView.
+
+import { createHash } from 'node:crypto';
+
+/**
+ * Stable content-hash key for the cache. Lowercase hex sha256 over the
+ * literal snippet bytes. Whitespace and case are preserved -- the caller
+ * is expected to pass the same exact text on every lookup.
+ *
+ * @param {string} text
+ * @returns {string|null}   null when text is not a non-empty string
+ */
+export function cacheKeyFor(text) {
+  if (typeof text !== 'string' || text.length === 0) return null;
+  return createHash('sha256').update(text, 'utf8').digest('hex');
+}
+
+/**
+ * encodeVector(vec) -- Float32Array | number[] -> Buffer
+ * Returns null on bad input.
+ */
+export function encodeVector(vec) {
+  if (!vec || typeof vec.length !== 'number' || vec.length === 0) return null;
+  const buf = Buffer.alloc(vec.length * 4);
+  for (let i = 0; i < vec.length; i++) {
+    buf.writeFloatLE(Number(vec[i]) || 0, i * 4);
+  }
+  return buf;
+}
+
+/**
+ * decodeVector(buf) -- Buffer | Uint8Array -> number[]
+ * Returns null when the input length is not a multiple of 4.
+ */
+export function decodeVector(buf) {
+  if (!buf || typeof buf.length !== 'number' || buf.length === 0) return null;
+  if (buf.length % 4 !== 0) return null;
+  const n = buf.length / 4;
+  const out = Array.from({ length: n });
+  // Work via DataView so we accept Uint8Array (better-sqlite3 BLOB return)
+  // and a plain Buffer interchangeably.
+  const view = ArrayBuffer.isView(buf)
+    ? new DataView(buf.buffer, buf.byteOffset, buf.byteLength)
+    : new DataView(buf);
+  for (let i = 0; i < n; i++) out[i] = view.getFloat32(i * 4, /*LE*/ true);
+  return out;
+}
+
+/** True iff the memory db has migration 005 applied (table exists). */
+export function hasVectorCache(db) {
+  if (!db || typeof db.prepare !== 'function') return false;
+  try {
+    const row = db.prepare(
+      "SELECT 1 FROM sqlite_master WHERE type='table' AND name='memory_entry_vectors'"
+    ).get();
+    return !!row;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * getCachedEmbedding(db, cacheKey, modelId) -> number[] | null
+ * Returns the stored embedding for the (cache_key, model_id) pair, or
+ * null on miss / when the table is absent / when cacheKey is invalid.
+ */
+export function getCachedEmbedding(db, cacheKey, modelId) {
+  if (!hasVectorCache(db)) return null;
+  if (typeof cacheKey !== 'string' || cacheKey.length === 0) return null;
+  if (typeof modelId !== 'string' || modelId.length === 0) return null;
+  try {
+    const row = db.prepare(
+      'SELECT embedding FROM memory_entry_vectors WHERE cache_key = ? AND model_id = ?'
+    ).get(cacheKey, modelId);
+    if (!row || !row.embedding) return null;
+    return decodeVector(row.embedding);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * setCachedEmbedding(db, cacheKey, modelId, vec) -> boolean (success).
+ * INSERT OR REPLACE so re-embed after a model change overwrites the
+ * stale row. No-op if the table is missing or the vector encoding fails.
+ */
+export function setCachedEmbedding(db, cacheKey, modelId, vec) {
+  if (!hasVectorCache(db)) return false;
+  if (typeof cacheKey !== 'string' || cacheKey.length === 0) return false;
+  if (typeof modelId !== 'string' || modelId.length === 0) return false;
+  const blob = encodeVector(vec);
+  if (!blob) return false;
+  try {
+    db.prepare(
+      'INSERT OR REPLACE INTO memory_entry_vectors(cache_key, model_id, embedding) VALUES (?, ?, ?)'
+    ).run(cacheKey, modelId, blob);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * countCachedVectors(db, modelId?) -> number
+ * Debug helper; tests assert that re-running search doesn't re-write rows.
+ */
+export function countCachedVectors(db, modelId) {
+  if (!hasVectorCache(db)) return 0;
+  try {
+    if (modelId) {
+      const row = db.prepare(
+        'SELECT COUNT(*) AS n FROM memory_entry_vectors WHERE model_id = ?'
+      ).get(modelId);
+      return row ? Number(row.n) : 0;
+    }
+    const row = db.prepare('SELECT COUNT(*) AS n FROM memory_entry_vectors').get();
+    return row ? Number(row.n) : 0;
+  } catch {
+    return 0;
+  }
+}

package/src/memory/fact-extractor.js

@@ -0,0 +1,168 @@
+/**
+ * H5.5 — Heuristic fact extraction at ingest time.
+ *
+ * Competitors (mem0, Zep, Letta) extract structured facts from raw memory at
+ * ingest so retrieval can match on subject/predicate/object as well as on raw
+ * content. IJFW historically stored raw markdown only -- this module closes
+ * that gap without an LLM round-trip.
+ *
+ * Output shape: array of { subject, predicate, object, confidence } where
+ * confidence ∈ [0,1] reflects pattern specificity (anchored patterns score
+ * higher than catch-alls). Empty input or no matches → [].
+ *
+ * Design constraints:
+ *  - Zero LLM calls (deterministic, runs inline in handleStore).
+ *  - Zero deps -- pure JS regexes over already-sanitized text.
+ *  - Conservative: prefer "miss" over false-positive; we'd rather record
+ *    nothing than poison the facts.jsonl stream with garbage.
+ *  - Output is structural, not semantic -- consumers can post-process.
+ */
+
+// Cap per-call output so a 100KB pasted memory doesn't blow up facts.jsonl.
+const MAX_FACTS_PER_CALL = 64;
+// Cap on each field length so a runaway match doesn't write a 10KB JSON line.
+const MAX_FIELD_LEN = 240;
+
+function clean(s) {
+  if (typeof s !== 'string') return '';
+  // Single-line, trimmed, length-capped. Already sanitized upstream but we
+  // still strip newlines so each fact is a single JSONL line at write time.
+  return s.replace(/\s+/g, ' ').trim().slice(0, MAX_FIELD_LEN);
+}
+
+function add(facts, subject, predicate, object, confidence) {
+  const s = clean(subject);
+  const p = clean(predicate);
+  const o = clean(object);
+  if (!s || !p || !o) return;
+  // Cheap intra-call dedup so the same fact extracted by overlapping patterns
+  // doesn't write twice. Keyed on lowercase triple.
+  const key = `${s.toLowerCase()}|${p.toLowerCase()}|${o.toLowerCase()}`;
+  if (facts._seen.has(key)) return;
+  facts._seen.add(key);
+  facts.push({ subject: s, predicate: p, object: o, confidence });
+}
+
+/**
+ * extractFacts(content)
+ *
+ * @param {string} content - already-sanitized markdown text
+ * @returns {Array<{subject:string, predicate:string, object:string, confidence:number}>}
+ */
+export function extractFacts(content) {
+  const facts = [];
+  facts._seen = new Set();
+  if (typeof content !== 'string' || !content.trim()) {
+    return [];
+  }
+
+  // Process line-by-line. Many of our patterns are anchored to clause shape,
+  // and pasted memories usually have one fact per line. Also split on the
+  // " | " separator that sanitizer.js inserts when collapsing newlines --
+  // store callers send multi-line markdown, sanitizer flattens it before we
+  // see it, so the original line boundaries are encoded as " | ".
+  const lines = content.split(/\r?\n|\s\|\s/);
+  for (const rawLine of lines) {
+    if (facts.length >= MAX_FACTS_PER_CALL) break;
+    const line = rawLine.trim();
+    if (!line) continue;
+
+    // ---- Pattern: "ship date: <date>" / "release date: <date>" / "due: <date>"
+    //              Confidence 0.95 (very specific keyword + colon).
+    {
+      const m = line.match(/^\s*(ship\s+date|release\s+date|launch\s+date|due\s+date|due|deadline)\s*:\s*(.+)$/i);
+      if (m) {
+        add(facts, 'project', m[1].toLowerCase().replace(/\s+/g, '_'), m[2], 0.95);
+        continue;
+      }
+    }
+
+    // ---- Pattern: "owner: <name>" / "assignee: <name>" / "lead: <name>"
+    //              Confidence 0.95.
+    {
+      const m = line.match(/^\s*(owner|assignee|lead|maintainer|author)\s*:\s*(.+)$/i);
+      if (m) {
+        add(facts, 'project', m[1].toLowerCase(), m[2], 0.95);
+        continue;
+      }
+    }
+
+    // ---- Pattern: "<key>: <value>" — generic key/value declarations.
+    //              Lower confidence (0.6). Only fires for short, single-token-ish keys
+    //              so prose colons ("for example:") don't trip it.
+    //              Skips known-noise keys (http, https, file paths).
+    {
+      const m = line.match(/^\s*([A-Z][A-Za-z0-9_-]{1,30})\s*:\s*(\S.{0,200})$/);
+      if (m && !/^https?$/i.test(m[1]) && m[2].length >= 2) {
+        add(facts, 'project', m[1].toLowerCase(), m[2], 0.60);
+        continue;
+      }
+    }
+
+    // ---- Pattern: "decided to <verb> [obj]" / "decision: <text>"
+    //              Confidence 0.85.
+    {
+      // eslint-disable-next-line security/detect-unsafe-regex -- bounded {0,12} quantifier on internal markdown line, not network input
+      const m = line.match(/\bdecided\s+to\s+(\w+(?:\s+\S+){0,12})/i);
+      if (m) {
+        add(facts, 'team', 'decided_to', m[1], 0.85);
+        continue;
+      }
+      const m2 = line.match(/^\s*decision\s*:\s*(.+)$/i);
+      if (m2) {
+        add(facts, 'team', 'decision', m2[1], 0.90);
+        continue;
+      }
+    }
+
+    // ---- Pattern: "<Name> uses <Tool>" — capitalised subject + uses + capitalised obj.
+    //              Confidence 0.80. Both ends Title-Case to avoid matching prose like
+    //              "the team uses redis" (which would be too noisy).
+    {
+      // eslint-disable-next-line security/detect-unsafe-regex -- bounded {1,40} quantifiers on internal markdown line, not network input
+      const m = line.match(/\b([A-Z][A-Za-z0-9_-]{1,40}(?:\s+[A-Z][A-Za-z0-9_-]{1,40})?)\s+uses\s+([A-Z][A-Za-z0-9_.+-]{1,40}(?:\s+[A-Za-z0-9_.+-]{1,40})?)/);
+      if (m) {
+        add(facts, m[1], 'uses', m[2], 0.80);
+        continue;
+      }
+    }
+
+    // ---- Pattern: "<X> is <Y>" — copular sentences, capitalised subject.
+    //              Confidence 0.70. Anchor on capital S so we don't extract
+    //              "it is fine" / "this is broken" noise.
+    //              Cap object phrase at 6 words to keep facts terse.
+    {
+      // eslint-disable-next-line security/detect-unsafe-regex -- bounded {1,40} and {0,5} quantifiers on internal markdown line, not network input
+      const m = line.match(/^\s*([A-Z][A-Za-z0-9_.-]{1,40}(?:\s+[A-Za-z0-9_.-]{1,40})?)\s+is\s+((?:[\w-]+(?:\s+[\w-]+){0,5}))[.!?]?\s*$/);
+      if (m) {
+        // Skip pronouns and bare articles disguised as subjects.
+        const subj = m[1];
+        if (!/^(It|This|That|There|Here|He|She|They|We|I)$/i.test(subj)) {
+          add(facts, subj, 'is', m[2], 0.70);
+          continue;
+        }
+      }
+    }
+  }
+
+  // Strip the internal _seen marker before returning so JSON.stringify is clean.
+  delete facts._seen;
+  return facts;
+}
+
+/**
+ * factToJsonl(fact, meta)
+ *
+ * Serialize one fact as a JSONL line, adding source metadata (timestamp,
+ * memory_id) so the facts stream is self-contained and joinable back to the
+ * journal entry it came from.
+ */
+export function factToJsonl(fact, meta = {}) {
+  const line = {
+    ts: meta.ts || new Date().toISOString(),
+    memory_id: meta.memory_id || null,
+    source: meta.source || 'memory_store',
+    ...fact,
+  };
+  return JSON.stringify(line);
+}

package/src/memory/fts5.js

@@ -36,6 +36,8 @@ import {
 } from './migration-runner.js';
 import { autoIndexGraphFromMemoryBody } from '../compute/graph-auto-index.js';
 import { redactSecrets } from '../redactor.js';
+import { indexObsidianRelations } from './obsidian-parser.js';
+import { autoLink } from './auto-linker.js';
 
 // D-PILLAR-SPEC section 12 ingest scrub gate. Default-on; the only escape hatch
 // is the IJFW_INGEST_SCRUB=0 env var, used for local debugging only and
@@ -232,6 +234,43 @@ export function indexEntry(db, entry) {
   });
   tx();
 
+  // v1.5.0 memory-moat M1 (INT.1): write Obsidian-grade indexing rows
+  // ([[wikilinks]], #nested/tags, [key:: value] inline metadata) into
+  // memory_links / memory_tags / memory_meta. Best-effort: a missing
+  // migration-006 schema or a parse failure must never block ingest.
+  try {
+    if (inserted && inserted.id != null) {
+      indexObsidianRelations(db, String(inserted.id), row.body);
+    }
+  } catch (e) {
+    try { console.error('[fts5] indexObsidianRelations failed:', e?.message || e); } catch { /* never throw */ }
+  }
+
+  // v1.5.0 memory-moat M2 (INT.2): fire A-Mem-style auto-linker. Asks the
+  // LLM (Claude Haiku 4.5 by default, env-gated) for (classification,
+  // link-proposals, neighbor-edits) over top-k lexical neighbors, then
+  // applies the proposal to memory_links + memory_tags atomically.
+  //
+  // Fire-and-forget — the indexEntry contract stays synchronous, and any
+  // failure (parse, budget, network, no key) returns skipped from autoLink
+  // without writes. IJFW_AUTOLINK_OFF=1 is the kill switch.
+  if (inserted && inserted.id != null) {
+    try {
+      // Don't await — let the LLM round-trip happen in the background.
+      // Capture for diagnostic visibility only.
+      const p = autoLink(db, {
+        id: inserted.id,
+        body: row.body,
+      }).catch((e) => {
+        try { console.error('[fts5] autoLink failed:', e?.message || e); } catch { /* never throw */ }
+      });
+      // expose for tests that want to await deterministic completion
+      indexEntry.__lastAutoLinkPromise = p;
+    } catch (e) {
+      try { console.error('[fts5] autoLink dispatch failed:', e?.message || e); } catch { /* never throw */ }
+    }
+  }
+
   // GA-B3: fire D2 graph auto-population on memory ingest. The graph
   // lives in the compute db at the same projectRoot, so we open compute
   // on demand. Async-but-fire-and-forget: the indexEntry contract stays
@@ -243,8 +282,33 @@ export function indexEntry(db, entry) {
     const ts = row.created_at;
     const sessionId = row.session_id;
     const body = row.body;
+    // v1.5.0 audit-LOW-memory-#14: dead-letter receipt for auto-index failures.
+    // Fire-and-forget was already swallowed silently; now we append an
+    // append-only JSONL receipt so silent indexer breakage is detectable in
+    // post-mortems. Best-effort: file write failures themselves are swallowed
+    // because indexEntry must never throw on diagnostic-write failure.
     const p = autoIndexGraphFromMemoryBody({ memoryDb: db, body, sessionId, ts })
-      .catch(() => null);
+      .catch((err) => {
+        try {
+          // Lazy import; node:fs/promises is always available.
+          import('node:fs/promises').then(({ appendFile, mkdir }) => {
+            try {
+              const indexDir = '.ijfw/index';
+              return mkdir(indexDir, { recursive: true })
+                .then(() => appendFile(
+                  `${indexDir}/graph-errors.jsonl`,
+                  JSON.stringify({
+                    ts: new Date().toISOString(),
+                    session_id: sessionId || null,
+                    err: err && err.message ? String(err.message) : String(err),
+                  }) + '\n',
+                ))
+                .catch(() => {});
+            } catch { /* swallow */ }
+          }).catch(() => {});
+        } catch { /* swallow */ }
+        return null;
+      });
     __lastAutoIndexPromise = p;
   } catch {
     // never throw out of indexEntry due to auto-index

package/src/memory/migration-runner.js

@@ -29,7 +29,12 @@ export class SchemaVersionError extends Error {
 // Discover and load every migration module under ./migrations/, sorted by
 // numeric prefix ascending. Each module must export VERSION (integer),
 // DESCRIPTION (string), and up(db) (function).
-async function loadMigrations() {
+//
+// Exported (v1.5.1 W3.B) so search.js (and any other consumer that needs
+// the sync migration pipeline) can reuse the SAME discovery path instead
+// of maintaining a parallel hardcoded list. Single source of truth: drop
+// a new NNN-name.js into ./migrations/ and every consumer sees it.
+export async function loadMigrations() {
   let files;
   try {
     files = readdirSync(MIGRATIONS_DIR);

package/src/memory/migrations/004-bitemporal.js

@@ -0,0 +1,91 @@
+// IJFW v1.5.0 -- memory migration 004: Graphiti-style bi-temporal validity edges.
+//
+// Source authority: v1.5.0 audit finding H5.4. Closes the spec-vs-impl gap where
+// the fact stream APPENDED forever -- contradictory facts about the same
+// (subject, predicate) accumulated instead of invalidating priors. After this
+// migration, storing a NEW fact with the same (subject, predicate) but a
+// DIFFERENT object will close the prior fact's valid_to and only the newest
+// becomes "currently valid".
+//
+// Spec called for the migration filename to be "<NNN>-bitemporal.sql". The
+// memory migration runner (./migration-runner.js) only discovers `.js`
+// modules matching /^\d+-.+\.js$/, so the canonical pattern is .js with the
+// SQL embedded. Same effect as a .sql file: the migration runner wraps up()
+// in BEGIN IMMEDIATE, so DDL + INSERT OR IGNORE inside still apply atomically
+// and roll back to user_version 3 on any failure.
+//
+// Adds the `facts` table fresh (no pre-existing facts table to ALTER):
+//   id            INTEGER PRIMARY KEY AUTOINCREMENT
+//   subject       TEXT NOT NULL
+//   predicate     TEXT NOT NULL
+//   object        TEXT NOT NULL
+//   confidence    REAL DEFAULT 1.0
+//   memory_id     TEXT          -- join key back to journal entry
+//   source        TEXT          -- "memory_store:<type>" or test caller
+//   valid_from    TEXT NOT NULL -- ISO-8601 timestamp; default current ts
+//   valid_to      TEXT          -- NULL = currently valid; else when invalidated
+//   created_at    INTEGER NOT NULL -- unix ms wall-clock for ordering
+//
+// Indexes:
+//   facts_current_idx -- (subject, predicate, valid_to) supports the canonical
+//                        "is this (subject, predicate) currently valid?" query
+//                        used by invalidateOlderFacts and getValidAt.
+//   facts_subject_predicate_idx -- (subject, predicate, valid_from) supports
+//                        getHistory's ORDER BY scan.
+//
+// Backwards compat:
+//   - Existing facts.jsonl sidecar continues to be appended-to in handleStore.
+//     Migration 004 is ADDITIVE -- it brings up a SQL twin of the JSONL stream
+//     so getValidAt() / getHistory() can answer point-in-time questions the
+//     JSONL stream cannot answer cheaply.
+//   - For any installation that has facts.jsonl rows from prior versions, the
+//     SQL table starts empty. New stores fill it. Backfill from JSONL is a
+//     separate ops task (out of scope for this migration; spec says "Existing
+//     rows get valid_from=NOW(), valid_to=NULL on migrate" -- since the SQL
+//     table is born empty here, that invariant holds by construction).
+//
+// Crash safety: migration runner wraps up() in BEGIN IMMEDIATE. If any DDL
+// fails the txn rolls back and user_version stays at 3.
+
+export const VERSION = 4;
+export const DESCRIPTION = 'memory v1.5.0 -- bi-temporal facts table (Graphiti-style valid_from/valid_to)';
+
+// SQL DDL stored as a constant so the diff stays readable and the migration
+// runner's BEGIN IMMEDIATE wrapper applies it atomically via the SQLite
+// driver's multi-statement runner. Note: db.exec here is the sqlite driver's
+// SQL exec, not a shell exec; pre-commit hook may flag the verb name.
+const SQL_CREATE_TABLE = (
+  'CREATE TABLE IF NOT EXISTS facts (' +
+    'id INTEGER PRIMARY KEY AUTOINCREMENT,' +
+    'subject TEXT NOT NULL,' +
+    'predicate TEXT NOT NULL,' +
+    'object TEXT NOT NULL,' +
+    'confidence REAL DEFAULT 1.0,' +
+    'memory_id TEXT,' +
+    'source TEXT,' +
+    "valid_from TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))," +
+    'valid_to TEXT,' +
+    "created_at INTEGER NOT NULL DEFAULT (CAST(strftime('%s','now') AS INTEGER) * 1000)" +
+  ')'
+);
+
+const SQL_CURRENT_IDX = (
+  'CREATE INDEX IF NOT EXISTS facts_current_idx ' +
+  'ON facts(subject, predicate, valid_to)'
+);
+
+const SQL_HISTORY_IDX = (
+  'CREATE INDEX IF NOT EXISTS facts_subject_predicate_idx ' +
+  'ON facts(subject, predicate, valid_from)'
+);
+
+export function up(db) {
+  // SQLite's .exec runs multi-statement DDL inside the migration runner's
+  // BEGIN IMMEDIATE transaction. CREATE TABLE IF NOT EXISTS keeps the
+  // migration idempotent for re-application scenarios.
+  db.exec(SQL_CREATE_TABLE);
+  db.exec(SQL_CURRENT_IDX);
+  db.exec(SQL_HISTORY_IDX);
+}
+
+export default { version: VERSION, description: DESCRIPTION, up };

package/src/memory/migrations/005-vector-cache.js

@@ -0,0 +1,61 @@
+// IJFW v1.5.0 -- memory migration 005: persistent embedding cache.
+//
+// Source authority: v1.5.0 audit MED #7 (memory-engine.md F-PRF-4). The
+// cold-tier hybrid rerank in src/search-hybrid.js was re-embedding every
+// candidate snippet on every query. For repeated queries over a stable
+// corpus this is wasted work: the same (snippet_text, model_id) pair always
+// produces the same vector. This migration adds a `memory_entry_vectors`
+// table so embedding becomes a write-once-per-(content, model) operation.
+//
+// v1.5.0 wire-W1.C key change: PK is content-hash (sha256(snippet)) rather
+// than memory_id. The hybrid rerank's input candidates do not carry a stable
+// memory_entry id (the corpus is built per-query from heterogenous markdown
+// + memory sources), so a content-hash PK is the only key that makes the
+// cache actually wire into production. Migration 005 was new in v1.5.0 and
+// never shipped under the memory_id schema, so the schema change is non-
+// breaking -- no rows to migrate.
+//
+// Schema:
+//   cache_key   TEXT NOT NULL    -- sha256(snippet) in hex, lowercase
+//   model_id    TEXT NOT NULL    -- e.g. 'Xenova/all-MiniLM-L6-v2'
+//   embedding   BLOB NOT NULL    -- Float32Array little-endian, 4B/float
+//   created_at  TEXT NOT NULL    -- ISO 8601 UTC; defaults to "now"
+//   PRIMARY KEY (cache_key, model_id)
+//
+// Indexes:
+//   memory_entry_vectors_model_idx -- supports lookup by model_id during
+//                                     model migrations (rare; ALTER-equiv).
+//
+// Crash safety: migration runner wraps up() in a transaction; a partial
+// CREATE rolls back to user_version=4.
+
+export const VERSION = 5;
+export const DESCRIPTION = 'memory v1.5.0 -- persistent embedding cache (memory_entry_vectors, content-keyed)';
+
+const SQL_CREATE = (
+  'CREATE TABLE IF NOT EXISTS memory_entry_vectors (' +
+    'cache_key TEXT NOT NULL,' +
+    'model_id TEXT NOT NULL,' +
+    'embedding BLOB NOT NULL,' +
+    "created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))," +
+    'PRIMARY KEY (cache_key, model_id)' +
+  ')'
+);
+
+const SQL_MODEL_IDX = (
+  'CREATE INDEX IF NOT EXISTS memory_entry_vectors_model_idx ' +
+  'ON memory_entry_vectors(model_id)'
+);
+
+export function up(db) {
+  // r20-MED fix: drop the table first to handle the case where a developer
+  // machine applied an earlier draft of migration 005 with the old
+  // memory_id-keyed schema. Since 005 was net-new in v1.5.0 (never shipped
+  // to npm), there are no production rows to preserve. The DROP is a no-op
+  // on a fresh db.
+  db.exec('DROP TABLE IF EXISTS memory_entry_vectors');
+  db.exec(SQL_CREATE);
+  db.exec(SQL_MODEL_IDX);
+}
+
+export default { version: VERSION, description: DESCRIPTION, up };

package/src/memory/migrations/006-obsidian-graph.js

@@ -0,0 +1,46 @@
+// IJFW v1.5.0 -- memory migration 006: Obsidian-grade graph indexing.
+//
+// Adds three tables that make IJFW's hot markdown semantically deeper than
+// "Obsidian-readable": backlinks, hierarchical tags, and inline metadata.
+//
+//   memory_links  -- directed edges parsed from [[wikilink]] syntax.
+//                   to_target is the link target as written, normalised
+//                   to lowercase + dash-collapsed. Resolution happens at
+//                   query time so unresolved targets do not break ingest.
+//   memory_tags   -- nested tag mentions. #project/r17/audit splits into
+//                   path + depth; queries can match prefix.
+//   memory_meta   -- Dataview-style inline metadata: [key:: value].
+
+export const VERSION = 6;
+export const DESCRIPTION = 'obsidian-graph — memory_links, memory_tags, memory_meta tables';
+
+export function up(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS memory_links (
+      from_id TEXT NOT NULL,
+      to_target TEXT NOT NULL,
+      line INTEGER,
+      created_at INTEGER NOT NULL DEFAULT (CAST(strftime('%s','now') AS INTEGER)),
+      PRIMARY KEY (from_id, to_target, line)
+    );
+    CREATE INDEX IF NOT EXISTS memory_links_to_idx ON memory_links(to_target);
+
+    CREATE TABLE IF NOT EXISTS memory_tags (
+      memory_id TEXT NOT NULL,
+      tag_path TEXT NOT NULL,
+      depth INTEGER NOT NULL,
+      created_at INTEGER NOT NULL DEFAULT (CAST(strftime('%s','now') AS INTEGER)),
+      PRIMARY KEY (memory_id, tag_path)
+    );
+    CREATE INDEX IF NOT EXISTS memory_tags_path_idx ON memory_tags(tag_path);
+
+    CREATE TABLE IF NOT EXISTS memory_meta (
+      memory_id TEXT NOT NULL,
+      key TEXT NOT NULL,
+      value TEXT NOT NULL,
+      created_at INTEGER NOT NULL DEFAULT (CAST(strftime('%s','now') AS INTEGER)),
+      PRIMARY KEY (memory_id, key, value)
+    );
+    CREATE INDEX IF NOT EXISTS memory_meta_key_idx ON memory_meta(key);
+  `);
+}

package/src/memory/migrations/007-skill-telemetry.js

@@ -0,0 +1,24 @@
+// IJFW v1.5.0 -- memory migration 007: skill telemetry table.
+//
+// Records per-execution skill outcomes so the procedural-memory tier can
+// reorder the skill surface at session start. Wayland pattern.
+
+export const VERSION = 7;
+export const DESCRIPTION = 'memory v1.5.0 -- skill_telemetry table for skills-feedback loop';
+
+export function up(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS skill_telemetry (
+      id          INTEGER PRIMARY KEY AUTOINCREMENT,
+      skill_id    TEXT NOT NULL,
+      session_id  TEXT,
+      outcome     TEXT NOT NULL CHECK (outcome IN ('success','failure','aborted')),
+      latency_ms  INTEGER,
+      created_at  INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS skill_telemetry_aggr_idx
+      ON skill_telemetry(skill_id, outcome, created_at DESC);
+  `);
+}
+
+export default { version: VERSION, description: DESCRIPTION, up };

package/src/memory/migrations/008-write-provenance.js

@@ -0,0 +1,41 @@
+// IJFW v1.5.0 -- memory migration 008: write-origin provenance.
+//
+// Adds `origin` column to memory_entries (Hermes BACKGROUND_REVIEW pattern,
+// see tools/skill_provenance.py in Hermes — the operator's sibling project).
+// Default 'foreground' so existing rows are treated as user-owned.
+//
+// Origin values established by v1.5.0 memory-moat:
+//   'foreground'   user-originated handleStore call (default)
+//   'auto-linker'  A-Mem auto-linker write-time evolution
+//   'dream-cycle'  background consolidation / promotion writes
+//
+// Future curators (v1.6+) should only auto-modify rows whose origin is
+// in {'auto-linker', 'dream-cycle'} to preserve the operator-owned
+// 'foreground' tier.
+
+export const VERSION = 8;
+export const DESCRIPTION =
+  'memory v1.5.0 -- write-origin provenance column on memory_entries';
+
+export function up(db) {
+  // ALTER TABLE ADD COLUMN is idempotent-by-guard since SQLite has no
+  // "IF NOT EXISTS" clause for ALTER. Check PRAGMA table_info first.
+  const cols = db
+    .prepare('PRAGMA table_info(memory_entries)')
+    .all()
+    .map((c) => c.name);
+  if (!cols.includes('origin')) {
+    const ALTER_SQL = (
+      "ALTER TABLE memory_entries " +
+      "ADD COLUMN origin TEXT DEFAULT 'foreground'"
+    );
+    db.prepare(ALTER_SQL).run();
+  }
+  const IDX_SQL = (
+    'CREATE INDEX IF NOT EXISTS memory_entries_origin_idx ' +
+    'ON memory_entries(origin)'
+  );
+  db.prepare(IDX_SQL).run();
+}
+
+export default { version: VERSION, description: DESCRIPTION, up };