@ixo/oracle-runtime-workers 0.23.0 → 0.25.0

package/src/plugins/memory/memory.plugin.ts

@@ -14,12 +14,16 @@ import {
   fetchMemoryTools,
   type MemoryMcpFactory,
 } from './memory-tools';
+import { oracleEntityDidSchema } from './memory-entity';
 
 const configSchema = z.object({
   MEMORY_MCP_URL: z.string().url('MEMORY_MCP_URL must be a valid HTTP(S) URL.'),
   MEMORY_ENGINE_URL: z
     .string()
     .url('MEMORY_ENGINE_URL must be a valid HTTP(S) URL.'),
+  // The Memory Engine keys every space by the oracle's domain entity; an
+  // oracle without one gets no memory at all, so it fails at boot instead.
+  ORACLE_ENTITY_DID: oracleEntityDidSchema,
 });
 
 const manifest: PluginManifest = {
@@ -51,9 +55,11 @@ const manifest: PluginManifest = {
 export interface MemoryPluginOptions {
   /**
    * Override the MCP-tools factory. Defaults to an HTTP MCP client against
-   * `MEMORY_MCP_URL` authenticated with a per-request UCAN invocation.
+   * `MEMORY_MCP_URL` authenticated with a per-request UCAN invocation and
+   * the oracle's domain entity (`ORACLE_ENTITY_DID`, the engine's
+   * `x-oracle-entity-did` header).
    */
-  mcpFactory?: (memoryMcpUrl: string) => MemoryMcpFactory;
+  mcpFactory?: (memoryMcpUrl: string, entityDid: string) => MemoryMcpFactory;
   /**
    * Filter the upstream tool surface. Defaults to {@link DEFAULT_MEMORY_TOOLS}
    * (search + add + add-oracle-knowledge + delete-episode + clear). Pass an
@@ -62,9 +68,15 @@ export interface MemoryPluginOptions {
   selectedTools?: readonly string[];
 }
 
-function resolveMemoryUrl(config: MergedConfig): string {
+function resolveMemoryConfig(config: MergedConfig): {
+  memoryMcpUrl: string;
+  entityDid: string;
+} {
   const parsed = configSchema.parse(config);
-  return parsed.MEMORY_MCP_URL;
+  return {
+    memoryMcpUrl: parsed.MEMORY_MCP_URL,
+    entityDid: parsed.ORACLE_ENTITY_DID,
+  };
 }
 
 /**
@@ -90,7 +102,10 @@ export class MemoryPlugin extends OraclePlugin {
 
   override readonly autoDetectHint = 'MEMORY_MCP_URL';
 
-  private readonly mcpFactory: (memoryMcpUrl: string) => MemoryMcpFactory;
+  private readonly mcpFactory: (
+    memoryMcpUrl: string,
+    entityDid: string,
+  ) => MemoryMcpFactory;
 
   private readonly selectedTools: readonly string[];
 
@@ -107,8 +122,8 @@ export class MemoryPlugin extends OraclePlugin {
   }
 
   override async getRequestTools(rtCtx: RuntimeContext): Promise<PluginTool[]> {
-    const memoryUrl = resolveMemoryUrl(rtCtx.config);
-    const factory = this.mcpFactory(memoryUrl);
+    const { memoryMcpUrl, entityDid } = resolveMemoryConfig(rtCtx.config);
+    const factory = this.mcpFactory(memoryMcpUrl, entityDid);
     return fetchMemoryTools(rtCtx, factory, this.selectedTools);
   }
 

package/src/shell/app.ts

@@ -78,22 +78,7 @@ import {
 } from '../feedback/submit';
 import { z } from 'zod';
 import { parseOutcome } from '@ixo/action-protocol';
-
-async function equalOutcomeKeys(
-  provided: string | null,
-  expected: string | undefined,
-): Promise<boolean> {
-  if (!provided || !expected || expected.length < 32 || provided.length > 512)
-    return false;
-  const digest = async (value: string) =>
-    new Uint8Array(
-      await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value)),
-    );
-  const [a, b] = await Promise.all([digest(provided), digest(expected)]);
-  let difference = 0;
-  for (let i = 0; i < a.length; i++) difference |= (a[i] ?? 0) ^ (b[i] ?? 0);
-  return difference === 0;
-}
+import { verifyHubOutcomeCallback } from '../hub-actions/outcome-signature';
 
 const DebugEventBody = z.object({
   type: z
@@ -217,6 +202,22 @@ export const BYO_LLM_BODY_BYTES = 64 * 1024;
 export const DEBUG_BODY_BYTES = 64 * 1024;
 
 /** A body cap enforced before the body is buffered: over it, 413 and the handler never runs. */
+/**
+ * The audience a signed Hub outcome callback must be signed for: the origin
+ * of `ORACLE_PUBLIC_URL` when it is set, else the origin of the request URL.
+ * An unparsable public URL yields '' (which never verifies).
+ */
+export function callbackAudience(
+  publicUrl: string | undefined,
+  requestUrl: string,
+): string {
+  try {
+    return new URL(publicUrl || requestUrl).origin;
+  } catch {
+    return '';
+  }
+}
+
 function limitBody(maxSize: number) {
   return bodyLimit({
     maxSize,
@@ -455,17 +456,32 @@ export function createShell(
   });
 
   app.use('/api/internal/actions/outcomes', limitBody(64 * 1024));
+  // Auth Hub's signed outcome callbacks: on whenever Hub actions are
+  // configured. The signature is checked against the Hub's own did:web key
+  // (from AUTH_HUB_URL) for this oracle's origin, then the owner object
+  // confirms the outcome through Auth Hub's authenticated status API.
   app.post('/api/internal/actions/outcomes', async (c) => {
     if (
       c.env.HUB_ACTIONS_ENABLED !== 'true' ||
-      !(await equalOutcomeKeys(
-        c.req.header('x-auth-hub-outcome-key') ?? null,
-        c.env.AUTH_HUB_ACTION_OUTCOME_KEY,
-      ))
+      !c.env.AUTH_HUB_URL ||
+      !c.env.AUTH_HUB_CHANNEL_SERVICE_KEY
     )
       return c.json({ code: 'unauthorized' }, 401);
     const body = await c.req.raw.text();
     if (body.length > 64_000) return c.json({ code: 'request_too_large' }, 413);
+    if (
+      !(await verifyHubOutcomeCallback({
+        hubUrl: c.env.AUTH_HUB_URL,
+        rawBody: body,
+        headers: c.req.raw.headers,
+        // The origin the Hub signs for: the configured public URL when
+        // set (a Worker reachable under several hostnames), else the
+        // origin this request came in on.
+        audience: callbackAudience(c.env.ORACLE_PUBLIC_URL, c.req.url),
+        ...(c.env.AUTH_HUB ? { fetcher: c.env.AUTH_HUB } : {}),
+      }))
+    )
+      return c.json({ code: 'unauthorized' }, 401);
     try {
       const outcome = parseOutcome(JSON.parse(body));
       await userStub(c.env, outcome.ownerDid).recordHubActionOutcome(outcome);