@tpsdev-ai/flair 0.11.0 → 0.12.0

package/dist/cli.js

@@ -736,25 +736,30 @@ export async function provisionFabric(target, opsTarget, clusterAdminUser, clust
 // FederationPair resource handler.  The role carries no table permissions itself
 // — the resource's own allowCreate bypass handles route-level access once the
 // request gets through the auth gate.
-/** Canonical permission spec for flair_pair_initiator. */
+/**
+ * Canonical permission spec for flair_pair_initiator.
+ *
+ * The role intentionally carries NO table permissions — its only job is to exist
+ * so bootstrap credentials can pass Harper platform auth before reaching the
+ * FederationPair resource handler (the resource's own allowCreate bypass handles
+ * route-level access). A bare role with both flags false is valid, grants nothing,
+ * and is exactly that intent.
+ *
+ * This previously carried an all-false `flair.tables` block, but Harper's add_role
+ * REJECTED the whole spec with a 400 (verified live against a spawned Harper):
+ *   - `cluster_user` is not a recognized top-level key — Harper reads unknown keys
+ *     as database names ("database 'cluster_user' does not exist");
+ *   - the table names were the logical shorthand, not the real @table names
+ *     ("Table 'flair.Workspace' does not exist" — it's WorkspaceState; "Event" is
+ *     OrgEvent; "OAuth" is OAuthClient);
+ *   - each grant omitted the required `attribute_permissions` array.
+ * The all-false block granted nothing anyway, so dropping it loses no capability
+ * and unbreaks fresh hub provisioning (where add_role runs and the 400 aborted
+ * `flair init --remote`). Only top-level booleans Harper recognizes remain.
+ */
 const PAIR_INITIATOR_PERMISSION = {
     super_user: false,
-    cluster_user: false,
     structure_user: false,
-    flair: {
-        tables: {
-            Memory: { read: false, insert: false, update: false, delete: false },
-            Soul: { read: false, insert: false, update: false, delete: false },
-            Agent: { read: false, insert: false, update: false, delete: false },
-            Workspace: { read: false, insert: false, update: false, delete: false },
-            Event: { read: false, insert: false, update: false, delete: false },
-            OAuth: { read: false, insert: false, update: false, delete: false },
-            Instance: { read: false, insert: false, update: false, delete: false },
-            Peer: { read: false, insert: false, update: false, delete: false },
-            PairingToken: { read: false, insert: false, update: false, delete: false },
-            SyncLog: { read: false, insert: false, update: false, delete: false },
-        },
-    },
 };
 /**
  * Idempotently ensures the `flair_pair_initiator` role exists on the Harper
@@ -805,6 +810,174 @@ export async function ensureFlairPairInitiatorRole(opsUrl, adminUser, adminPass)
     }, adminUser, adminPass);
     console.log(`Role '${ROLE_NAME}' updated ✓`);
 }
+// ─── flair_agent role ────────────────────────────────────────────────────────
+//
+// The auth reshape replaces the global gate's "verified agent borrows admin
+// super_user" elevation with a real, least-privilege Harper role. After an
+// agent's Ed25519 signature verifies, resources resolve the request to the
+// shared `flair_agent`-roled user instead of admin — so agents get exactly the
+// table CRUD below and nothing more. Critically: with no `super_user` and no
+// operations grants, /sql and /graphql become NATIVELY 403 for agents (the
+// raw-query block the gate hand-rolled is now enforced by Harper itself).
+//
+// Row-level ownership (an agent touches only its OWN memories/soul/events) is
+// NOT expressible in Harper's role model — it stays in each resource's allow*,
+// keyed on the Ed25519-verified agentId. So these per-table grants are the
+// coarse CRUD envelope; allow* is the ownership boundary inside it.
+//
+// VALIDATION GATES (must confirm against a live Harper before this role goes
+// live — flagged for Sherlock + the PR, not assumed):
+//   1. HNSW/vector search (SemanticSearch over Memory) works with table `read`
+//      alone — the old elevation comment claimed admin perms were needed for
+//      "HNSW-capable" access; confirm `read` suffices or widen precisely.
+//   2. Role table keys must EXACTLY match the @table names (Memory, OrgEvent,
+//      WorkspaceState, OAuthClient — NOT the logical Memory/Event/Workspace/OAuth
+//      shorthand the flair_pair_initiator spec used, which was harmless only
+//      because every grant there is false).
+//   3. Obs* writes: if the presence-emitter writes ObsAgentSnapshot AS the agent
+//      it needs insert/update — currently read-only here; confirm the writer's
+//      identity (system vs agent) and widen only if it's the agent.
+// Harper 5.0.21 add_role requires an `attribute_permissions` array on EVERY table
+// grant (empty = no attribute-level restriction, so the table-level CRUD applies);
+// omitting it makes add_role reject the whole spec ("Missing 'attribute_permissions'
+// array"). Validated live against a spawned Harper. This helper guarantees the
+// array is never forgotten. Also: `cluster_user` is NOT a valid top-level key —
+// Harper reads unrecognized top-level keys as database names ("database
+// 'cluster_user' does not exist"); only super_user / structure_user are recognized.
+const grant = (read, insert, update, del) => ({ read, insert, update, delete: del, attribute_permissions: [] });
+/** Canonical permission spec for flair_agent (least-privilege; real @table names). */
+const FLAIR_AGENT_PERMISSION = {
+    super_user: false,
+    structure_user: false,
+    flair: {
+        tables: {
+            // Core agent-owned data — CRUD envelope; ownership enforced in allow*.
+            Memory: grant(true, true, true, true),
+            MemoryCandidate: grant(true, true, true, true),
+            MemoryGrant: grant(true, true, true, true),
+            Soul: grant(true, true, true, false),
+            OrgEvent: grant(true, true, true, true),
+            WorkspaceState: grant(true, true, true, true),
+            Relationship: grant(true, true, true, true),
+            Integration: grant(true, true, true, true),
+            Credential: grant(true, true, true, true),
+            Presence: grant(true, true, true, false),
+            // Agent: read for discovery, update own card; creation/removal is admin.
+            Agent: grant(true, false, true, false),
+            // Read-only reference data.
+            Instance: grant(true, false, false, false),
+            // Observatory read-models — public reads; writes are system-driven (gate 3).
+            ObsOffice: grant(true, false, false, false),
+            ObsAgentSnapshot: grant(true, false, false, false),
+            ObsEventFeed: grant(true, false, false, false),
+            // Federation / OAuth / IdP / internal — system + admin only; agents get none.
+            Peer: grant(false, false, false, false),
+            PairingToken: grant(false, false, false, false),
+            SyncLog: grant(false, false, false, false),
+            OAuthClient: grant(false, false, false, false),
+            OAuthToken: grant(false, false, false, false),
+            OAuthAuthCode: grant(false, false, false, false),
+            IdpConfig: grant(false, false, false, false),
+            IdJagReplay: grant(false, false, false, false),
+        },
+    },
+};
+/**
+ * Idempotently ensures the `flair_agent` role exists on the Harper instance at
+ * `opsUrl` with the canonical least-privilege spec. Same list/add/alter shape as
+ * ensureFlairPairInitiatorRole.
+ *
+ * - absent → `add_role`
+ * - exists with different permissions → `alter_role`
+ * - already matches → no-op
+ */
+export async function ensureFlairAgentRole(opsUrl, adminUser, adminPass) {
+    const ROLE_NAME = "flair_agent";
+    let roles = [];
+    try {
+        const result = await callOpsApi(opsUrl, { operation: "list_roles" }, adminUser, adminPass);
+        roles = Array.isArray(result) ? result : [];
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`ensureFlairAgentRole: list_roles failed: ${msg}`);
+    }
+    const existing = roles.find((r) => r.role === ROLE_NAME || r.name === ROLE_NAME);
+    if (!existing) {
+        console.log(`Creating role '${ROLE_NAME}'...`);
+        await callOpsApi(opsUrl, {
+            operation: "add_role",
+            role: ROLE_NAME,
+            permission: FLAIR_AGENT_PERMISSION,
+        }, adminUser, adminPass);
+        console.log(`Role '${ROLE_NAME}' created ✓`);
+        return;
+    }
+    const existingPerm = existing.permission ?? existing.role?.permission;
+    const canonicalStr = JSON.stringify(FLAIR_AGENT_PERMISSION);
+    const existingStr = JSON.stringify(existingPerm);
+    if (existingStr === canonicalStr) {
+        console.log(`Role '${ROLE_NAME}' already exists with correct permissions — skipping`);
+        return;
+    }
+    console.log(`Role '${ROLE_NAME}' exists but permissions differ — updating...`);
+    await callOpsApi(opsUrl, {
+        operation: "alter_role",
+        role: ROLE_NAME,
+        permission: FLAIR_AGENT_PERMISSION,
+    }, adminUser, adminPass);
+    console.log(`Role '${ROLE_NAME}' updated ✓`);
+}
+/**
+ * Shared Harper user that verified Ed25519 agents are resolved to.
+ * MUST match FLAIR_AGENT_USERNAME in resources/agent-auth.ts (the gate side).
+ * Not imported from there because cli.ts is standalone and that module pulls in
+ * Harper's native bindings — kept as a cross-referenced literal instead.
+ */
+export const FLAIR_AGENT_USERNAME = "flair-agent";
+/**
+ * Idempotently ensures the shared `flair-agent` Harper user exists with the
+ * `flair_agent` role. Verified Ed25519 agents are resolved to THIS user
+ * (`getUser("flair-agent", null)` — no password check, identity already proven
+ * cryptographically), replacing the old `getUser("admin")` super_user elevation.
+ *
+ * The password is random and never used for authentication: the agent path
+ * resolves the user without it, and the auth gate's Basic path only accepts
+ * super_user / pair-bootstrap (a flair_agent Basic login is rejected there), so
+ * a Basic login as this user can't reach anything. Random + unused = safe.
+ *
+ * Row-level ownership stays in each resource's allow* (keyed on the verified
+ * agentId); this shared user only carries the flair_agent role's table grants.
+ */
+export async function ensureFlairAgentUser(opsUrl, adminUser, adminPass) {
+    const unusedPassword = randomBytes(32).toString("base64url");
+    try {
+        await callOpsApi(opsUrl, {
+            operation: "add_user",
+            username: FLAIR_AGENT_USERNAME,
+            password: unusedPassword,
+            role: "flair_agent",
+            active: true,
+        }, adminUser, adminPass);
+        console.log(`User '${FLAIR_AGENT_USERNAME}' created ✓`);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes("already exists") || msg.includes("duplicate")) {
+            // Idempotent: ensure the role is correct without churning the password.
+            await callOpsApi(opsUrl, {
+                operation: "alter_user",
+                username: FLAIR_AGENT_USERNAME,
+                role: "flair_agent",
+                active: true,
+            }, adminUser, adminPass);
+            console.log(`User '${FLAIR_AGENT_USERNAME}' already exists — role ensured ✓`);
+        }
+        else {
+            throw err;
+        }
+    }
+}
 // ─── Upgrade presence probes ──────────────────────────────────────────────────
 //
 // `flair upgrade` previously called `npm list -g <pkg>` to detect the installed
@@ -1126,6 +1299,16 @@ program
             if (opts.remote) {
                 await ensureFlairPairInitiatorRole(opsUrl, DEFAULT_ADMIN_USER, flairAdminPass);
             }
+            // Every flair instance has agents, so provision the least-privilege
+            // flair_agent role (idempotent, harmless until a user is assigned to it).
+            await ensureFlairAgentRole(opsUrl, DEFAULT_ADMIN_USER, flairAdminPass);
+            // THE FLIP (auth-rbac): provision the shared least-privilege flair-agent user.
+            // This ACTIVATES the gate's per-agent de-elevation (verified non-admin agents
+            // resolve to flair-agent instead of admin super_user). Safe now: #487 gave
+            // every agent-facing resource its own allow* + resolveAgentAuth, so they no
+            // longer rely on the admin super_user bypass. The gate also falls back to
+            // admin if this user is ever absent, so de-elevation degrades gracefully.
+            await ensureFlairAgentUser(opsUrl, DEFAULT_ADMIN_USER, flairAdminPass);
         }
         else {
             // ── Existing behavior: --admin-pass required for already-running Flair ──

package/dist/resources/Agent.js

@@ -1,4 +1,5 @@
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth, allowVerified, allowAdmin } from "./agent-auth.js";
 /**
  * Agent resource — serves as the Principal table in 1.0.
  *
@@ -16,6 +17,14 @@ import { databases } from "@harperfast/harper";
  *   - subjects: soul-level subject interests
  */
 export class Agent extends databases.flair.Agent {
+    // Self-authorize now that the global gate is non-rejecting. Verified agents read
+    // the principal table for discovery; an agent updates only its OWN record (put
+    // handler enforces ownership). Creating/deleting principals is admin-only
+    // (flair_agent grant: insert=false, delete=false). Anonymous denied throughout.
+    allowRead() { return allowVerified(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowVerified(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
     async post(content, context) {
         const now = new Date().toISOString();
         // Backward compat: set type for legacy code
@@ -34,14 +43,18 @@ export class Agent extends databases.flair.Agent {
         return super.post(content, context);
     }
     async put(content) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        // Only admin principals can modify other principals
-        if (authAgent && !isAdminAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous denied (defense-in-depth alongside allowUpdate; the old check read
+        // tpsAgent and treated a missing agent as trusted, so anonymous slipped through).
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "content-type": "application/json" },
+            });
+        }
+        // Only admin principals can modify OTHER principals; an agent updates its own.
+        if (auth.kind === "agent" && !auth.isAdmin) {
             const existing = await super.get();
-            if (existing && existing.id !== authAgent) {
+            if (existing && existing.id !== auth.agentId) {
                 return new Response(JSON.stringify({ error: "only admin principals can modify other principals" }), {
                     status: 403, headers: { "content-type": "application/json" },
                 });

package/dist/resources/AgentCard.js

@@ -1,6 +1,12 @@
 import { Resource, databases } from "@harperfast/harper";
 import { selectPublicDescription, selectPublicSkills } from "./agentcard-fields.js";
 export class AgentCard extends Resource {
+    // Public discovery metadata (per A2A spec, agent cards are intentionally
+    // public). Self-gates as public so it survives the global gate's removal — and
+    // its get() already returns only field-allowlisted public-safe data.
+    allowRead() {
+        return true;
+    }
     async get(pathInfo) {
         const agentId = (typeof pathInfo === "string" ? pathInfo : null) ??
             this.getId?.() ??

package/dist/resources/AgentSeed.js

@@ -17,7 +17,7 @@
  * Auth: admin only.
  */
 import { Resource, databases } from "@harperfast/harper";
-import { isAdmin } from "./auth-middleware.js";
+import { isAdmin, allowAdmin } from "./agent-auth.js";
 const DEFAULT_SOUL_KEYS = (agentId, displayName, role, now) => ({
     name: displayName,
     role,
@@ -32,6 +32,12 @@ const DEFAULT_MEMORIES = (agentId, now) => [
     },
 ];
 export class AgentSeed extends Resource {
+    // Admin-only: permit verified ADMIN agents (Basic-admin is super_user and
+    // bypasses allow*); non-admin agents denied. Real authorization now that the
+    // gate no longer elevates agents to admin.
+    async allowCreate() {
+        return allowAdmin(this.getContext?.());
+    }
     async post(data) {
         const actorId = this.request?.tpsAgent;
         if (!actorId || !(await isAdmin(actorId))) {

package/dist/resources/Credential.js

@@ -1,4 +1,5 @@
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth } from "./agent-auth.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
 /**
  * Credential resource — authentication surfaces for Principals.
@@ -13,15 +14,21 @@ import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
  */
 export class Credential extends databases.flair.Credential {
     async search(query) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        if (!authAgent || isAdminAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous HTTP must NOT read credentials. (Previously `!authAgent` was
+        // treated as trusted/unfiltered — which leaked every credential to an
+        // unauthenticated caller once the gate stopped rejecting.)
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "content-type": "application/json" },
+            });
+        }
+        // Trusted internal call or admin agent → unfiltered.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.search(query);
         }
-        // Non-admin: scope to own credentials
-        const condition = { attribute: "principalId", comparator: "equals", value: authAgent };
+        // Non-admin agent: scope to own credentials.
+        const condition = { attribute: "principalId", comparator: "equals", value: auth.agentId };
         if (!query?.conditions) {
             return super.search({ conditions: [condition], ...(query || {}) });
         }
@@ -35,12 +42,16 @@ export class Credential extends databases.flair.Credential {
         const result = await super.get();
         if (!result)
             return result;
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        // Non-admin can only see their own credentials
-        if (authAgent && !isAdminAgent && result.principalId !== authAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous HTTP must NOT read a credential (previously it fell through the
+        // ownership check and returned the record sans tokenHash — a metadata leak).
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "forbidden" }), {
+                status: 403, headers: { "content-type": "application/json" },
+            });
+        }
+        // Non-admin agent can only see their own credentials. (Internal + admin pass.)
+        if (auth.kind === "agent" && !auth.isAdmin && result.principalId !== auth.agentId) {
             return new Response(JSON.stringify({ error: "forbidden" }), {
                 status: 403, headers: { "content-type": "application/json" },
             });

package/dist/resources/IngestEvents.js

@@ -55,6 +55,13 @@ function verifyEd25519Signature(publicKeyHex, authHeader, officeId) {
     }
 }
 export class IngestEvents extends Resource {
+    // Public POST by design: the handler self-verifies the OFFICE's Ed25519
+    // signature against ObsOffice.publicKey (not an agent identity), so it can't use
+    // agent auth. allowCreate=true lets the request reach post() where that
+    // verification happens — same self-gating pattern as FederationPair/FederationSync.
+    allowCreate() {
+        return true;
+    }
     async post(body, context) {
         const request = this.request;
         const authHeader = request?.headers?.get?.("authorization") ?? request?.headers?.authorization;

package/dist/resources/Instance.js

@@ -0,0 +1,13 @@
+import { databases } from "@harperfast/harper";
+import { allowVerified, allowAdmin } from "./agent-auth.js";
+/**
+ * Instance is read-only reference data for agents (flair_agent grant: read only).
+ * Verified agents + admin may read; writes are admin/internal only. Self-authorizes
+ * now that the global gate is non-rejecting (anonymous denied).
+ */
+export class Instance extends databases.flair.Instance {
+    allowRead() { return allowVerified(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/Integration.js

@@ -1,6 +1,40 @@
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth } from "./agent-auth.js";
+const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
+const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+/**
+ * Integration records are agent-owned. Auth: the non-rejecting gate annotates the
+ * request; this resource self-enforces (resolveAgentAuth → internal/agent/anonymous).
+ * Anonymous HTTP is denied on every path; non-admin agents are scoped to their own
+ * agentId. Mirrors the WorkspaceState pattern.
+ */
 export class Integration extends databases.flair.Integration {
+    _auth() {
+        return resolveAgentAuth(this.getContext?.());
+    }
+    async search(query) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.search(query);
+        }
+        const agentIdCondition = { attribute: "agentId", comparator: "equals", value: auth.agentId };
+        if (query && typeof query === "object" && !Array.isArray(query)) {
+            const existing = query.conditions ?? [];
+            query.conditions = Array.isArray(existing) ? [agentIdCondition, ...existing] : [agentIdCondition, existing];
+            return super.search(query);
+        }
+        const conditions = Array.isArray(query) && query.length > 0 ? [agentIdCondition, ...query] : [agentIdCondition];
+        return super.search(conditions);
+    }
     async post(content, context) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot write integration for another agent");
+        }
         // S31-A: API never accepts plaintext credentials.
         if (typeof content?.credential === "string" || typeof content?.token === "string") {
             return new Response(JSON.stringify({ error: "plaintext_credentials_forbidden" }), {
@@ -10,4 +44,34 @@ export class Integration extends databases.flair.Integration {
         }
         return super.post(content, context);
     }
+    async put(content, context) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot write integration for another agent");
+        }
+        if (typeof content?.credential === "string" || typeof content?.token === "string") {
+            return new Response(JSON.stringify({ error: "plaintext_credentials_forbidden" }), {
+                status: 400,
+                headers: { "Content-Type": "application/json" },
+            });
+        }
+        return super.put(content, context);
+    }
+    async delete(id) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.delete(id);
+        }
+        const record = await this.get(id);
+        if (!record)
+            return super.delete(id);
+        if (record.agentId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot delete integration for another agent");
+        }
+        return super.delete(id);
+    }
 }

package/dist/resources/Memory.js

@@ -1,6 +1,6 @@
 import { databases } from "@harperfast/harper";
 import { patchRecord, withDetachedTxn } from "./table-helpers.js";
-import { isAdmin } from "./auth-middleware.js";
+import { isAdmin, resolveAgentAuth } from "./agent-auth.js";
 import { getEmbedding, getModelId } from "./embeddings-provider.js";
 import { scanFields, isStrictMode } from "./content-safety.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
@@ -16,16 +16,22 @@ export class Memory extends databases.flair.Memory {
      * Non-admin calls also check MemoryGrant to include granted memories.
      */
     async search(query) {
-        // Access request context via Harper's Resource instance context
+        // Access request context via Harper's Resource instance context.
         const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        // No auth context (internal admin call) or admin agent — unfiltered
-        if (!authAgent || isAdminAgent) {
+        const auth = await resolveAgentAuth(ctx);
+        // Anonymous HTTP must NOT read memories. (Previously `!authAgent` was treated
+        // as unfiltered — the anonymous-read leak once the gate stops rejecting.)
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "content-type": "application/json" },
+            });
+        }
+        // Trusted internal call (no request context) or admin agent — unfiltered.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.search(query);
         }
-        // Collect agentIds this agent may read: own + any granted owners
+        // Non-admin agent: scope to own + granted owners.
+        const authAgent = auth.agentId;
         const allowedOwners = [authAgent];
         try {
             for await (const grant of databases.flair.MemoryGrant.search({
@@ -68,6 +74,26 @@ export class Memory extends databases.flair.Memory {
             if (!rl.allowed)
                 return rateLimitResponse(rl.retryAfterMs, "write");
         }
+        // Create ownership: a non-admin agent may only write memories it owns. Use
+        // resolveAgentAuth (reads the gate's tpsAgent annotation) — NOT context.user
+        // .username, which is the fallback "admin" super_user while de-elevation is
+        // dormant and would wrongly 403 every agent's own write. internal/admin → pass.
+        {
+            const auth = await resolveAgentAuth(ctx);
+            // Anonymous HTTP must NOT write. Pre-flip the global gate rejected no-auth
+            // upstream; with the non-rejecting gate, each write path self-enforces (same
+            // rule search() applies to reads).
+            if (auth.kind === "anonymous") {
+                return new Response(JSON.stringify({ error: "authentication required" }), {
+                    status: 401, headers: { "Content-Type": "application/json" },
+                });
+            }
+            if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
+                return new Response(JSON.stringify({ error: "forbidden: cannot write memory owned by another agent" }), {
+                    status: 403, headers: { "Content-Type": "application/json" },
+                });
+            }
+        }
         content.durability ||= "standard";
         content.createdAt = new Date().toISOString();
         content.updatedAt = content.createdAt;
@@ -151,6 +177,25 @@ export class Memory extends databases.flair.Memory {
             delete content._reindex;
             return super.put(content);
         }
+        // Create/update ownership (same rule as post): a non-admin agent may only
+        // write memories it owns, via resolveAgentAuth (gate annotation), not
+        // context.user.username (the dormant-de-elevation fallback is "admin").
+        // The _reindex admin path above bypasses this.
+        {
+            const octx = this.getContext?.();
+            const auth = await resolveAgentAuth(octx);
+            // Anonymous HTTP must NOT write (non-rejecting gate → self-enforce here).
+            if (auth.kind === "anonymous") {
+                return new Response(JSON.stringify({ error: "authentication required" }), {
+                    status: 401, headers: { "Content-Type": "application/json" },
+                });
+            }
+            if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
+                return new Response(JSON.stringify({ error: "forbidden: cannot write memory owned by another agent" }), {
+                    status: 403, headers: { "Content-Type": "application/json" },
+                });
+            }
+        }
         const now = new Date().toISOString();
         content.updatedAt = now;
         // Set defaults that post() sets — put() is also used for new records via CLI

package/dist/resources/MemoryBootstrap.js

@@ -1,4 +1,5 @@
 import { Resource, databases } from "@harperfast/harper";
+import { allowVerified } from "./agent-auth.js";
 import { getEmbedding } from "./embeddings-provider.js";
 import { wrapUntrusted } from "./content-safety.js";
 /**
@@ -40,6 +41,13 @@ function formatMemory(m, supersedes) {
     return base;
 }
 export class BootstrapMemories extends Resource {
+    // Self-authorize via the Ed25519 agent verify (the auth reshape removes the
+    // gate's admin super_user elevation, so custom resources must self-gate or
+    // Harper denies them for the least-privilege flair_agent role). Any verified
+    // agent may bootstrap; per-agent scoping is enforced in post() below.
+    async allowCreate() {
+        return allowVerified(this.getContext?.());
+    }
     async post(data, _context) {
         const { agentId: bodyAgentId, currentTask, maxTokens = 4000, includeSoul = true, since, channel, // e.g., "discord", "tps-mail", "claude-code"
         surface, // e.g., "tps-build", "tps-review", "cli-session"

package/dist/resources/MemoryConsolidate.js

@@ -16,7 +16,7 @@
  *   prompt      string
  */
 import { Resource, databases } from "@harperfast/harper";
-import { isAdmin } from "./auth-middleware.js";
+import { isAdmin, allowVerified } from "./agent-auth.js";
 function parseDuration(s) {
     const m = s.match(/^(\d+)([dhm])$/);
     if (!m)
@@ -56,6 +56,12 @@ function evaluate(record, now, olderThanMs) {
     return { memory, suggestion: "keep", reason: `Retrieved ${count} times, ${Math.round(daysSinceRetrieved)} days since last retrieval` };
 }
 export class ConsolidateMemories extends Resource {
+    // Self-authorize via the Ed25519 agent verify (auth reshape removes the gate's
+    // admin elevation). Any verified agent may consolidate; the isAdmin checks in
+    // post() handle finer-grained authorization.
+    async allowCreate() {
+        return allowVerified(this.getContext?.());
+    }
     async post(data) {
         const { agentId: bodyAgentId, scope = "persistent", olderThan = "30d", limit = 20 } = data || {};
         // See SemanticSearch / MemoryBootstrap — `this.request` isn't populated on

package/dist/resources/MemoryFeed.js

@@ -1,6 +1,14 @@
 import { Resource, databases } from "@harperfast/harper";
+import { allowVerified } from "./agent-auth.js";
 import { computeContentHash, findExistingMemoryByContentHash } from "./memory-feed-lib.js";
 export class FeedMemories extends Resource {
+    // Self-authorize via the Ed25519 agent verify (the auth reshape removes the
+    // gate's admin elevation). NOTE: post() trusts content.agentId from the body —
+    // closing that create-spoofing gap is tracked with the table-resource
+    // create-ownership work (Memory.allowCreate), not in this auth-coverage pass.
+    async allowCreate() {
+        return allowVerified(this.getContext?.());
+    }
     async post(content) {
         const agentId = String(content?.agentId ?? "");
         const body = String(content?.content ?? "");