@tpsdev-ai/flair 0.11.0 → 0.12.0

package/dist/resources/MemoryGrant.js

@@ -0,0 +1,79 @@
+import { databases } from "@harperfast/harper";
+import { resolveAgentAuth } from "./agent-auth.js";
+const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
+const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+/**
+ * MemoryGrant — an agent (ownerId) grants another (granteeId) scoped access to its
+ * memories. Self-authorizes now that the global gate is non-rejecting (previously a
+ * pure @table protected only by the gate → anonymous could read/write any grant).
+ *
+ * Write: non-admin agents may only create/modify/delete grants they OWN
+ *        (ownerId === self) — you can only share your own memories.
+ * Read:  non-admin agents see grants where they are owner OR grantee.
+ * Internal calls (e.g. Memory.search's grant lookup) and admins pass unfiltered.
+ */
+export class MemoryGrant extends databases.flair.MemoryGrant {
+    _auth() {
+        return resolveAgentAuth(this.getContext?.());
+    }
+    async search(query) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.search(query);
+        }
+        // owner OR grantee
+        const scope = {
+            operator: "or",
+            conditions: [
+                { attribute: "ownerId", comparator: "equals", value: auth.agentId },
+                { attribute: "granteeId", comparator: "equals", value: auth.agentId },
+            ],
+        };
+        if (query && typeof query === "object" && !Array.isArray(query)) {
+            const existing = query.conditions ?? [];
+            query.conditions = Array.isArray(existing) ? [scope, ...existing] : [scope, existing];
+            return super.search(query);
+        }
+        const conditions = Array.isArray(query) && query.length > 0 ? [scope, ...query] : [scope];
+        return super.search(conditions);
+    }
+    async post(content, context) {
+        const denied = await this._enforceOwnerWrite(content);
+        if (denied)
+            return denied;
+        content.createdAt ||= new Date().toISOString();
+        return super.post(content, context);
+    }
+    async put(content, context) {
+        const denied = await this._enforceOwnerWrite(content);
+        if (denied)
+            return denied;
+        return super.put(content, context);
+    }
+    async delete(id, context) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.delete(id, context);
+        }
+        const record = await this.get(id);
+        if (!record)
+            return super.delete(id, context);
+        if (record.ownerId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot delete a grant owned by another agent");
+        }
+        return super.delete(id, context);
+    }
+    async _enforceOwnerWrite(content) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content?.ownerId && content.ownerId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot grant access to another agent's memories");
+        }
+        return null;
+    }
+}

package/dist/resources/MemoryMaintenance.js

@@ -17,7 +17,7 @@
  * to gate auth correctly.
  */
 import { Resource, databases } from "@harperfast/harper";
-import { isAdmin } from "./auth-middleware.js";
+import { isAdmin } from "./agent-auth.js";
 export class MemoryMaintenance extends Resource {
     /** POST requires auth — either an agent acting on its own memories, or admin. */
     allowCreate() {

package/dist/resources/MemoryReflect.js

@@ -20,7 +20,7 @@
  *   count          number     — number of memories included
  */
 import { Resource, databases } from "@harperfast/harper";
-import { isAdmin } from "./auth-middleware.js";
+import { isAdmin, allowVerified } from "./agent-auth.js";
 import { patchRecordSilent } from "./table-helpers.js";
 const FOCUS_PROMPTS = {
     lessons_learned: "Review these memories and identify concrete lessons learned. For each lesson: what happened, what you learned, and how it should change future behavior. Write atomic memories with durability=persistent.",
@@ -29,6 +29,12 @@ const FOCUS_PROMPTS = {
     errors: "Extract errors, bugs, and failures. For each: what failed, root cause, and fix applied. These are high-value persistent memories.",
 };
 export class ReflectMemories extends Resource {
+    // Self-authorize via the Ed25519 agent verify (auth reshape removes the gate's
+    // admin elevation). Any verified agent may reflect; the isAdmin checks in post()
+    // handle finer-grained authorization.
+    async allowCreate() {
+        return allowVerified(this.getContext?.());
+    }
     async post(data) {
         const { agentId: bodyAgentId, scope = "recent", since, maxMemories = 50, focus = "lessons_learned", tag, } = data || {};
         // Authenticated identity comes from getContext().request, not this.request

package/dist/resources/MemoryReindex.js

@@ -24,8 +24,14 @@
  * This endpoint is idempotent: running it again finds zero drift.
  */
 import { Resource, databases } from "@harperfast/harper";
-import { isAdmin } from "./auth-middleware.js";
+import { isAdmin, allowAdmin } from "./agent-auth.js";
 export class MemoryReindex extends Resource {
+    // Admin-only: permit verified ADMIN agents (Basic-admin is super_user and
+    // bypasses allow*); non-admin agents denied. Mirrors the handler's admin gate
+    // but is the real authorization now that the gate no longer elevates agents.
+    async allowCreate() {
+        return allowAdmin(this.getContext?.());
+    }
     async post(data) {
         const ctx = this.getContext?.();
         const request = ctx?.request ?? ctx ?? this.request;

package/dist/resources/OAuthClient.js

@@ -0,0 +1,15 @@
+import { databases } from "@harperfast/harper";
+import { allowAdmin } from "./agent-auth.js";
+/**
+ * OAuthClient holds registered OAuth client records (incl. secrets) — admin/system
+ * only, no agent grant. OAuth endpoints (OAuthRegister/Authorize/Token) read+write
+ * clients via internal calls (allowAdmin permits internal), so the OAuth flows keep
+ * working; direct anonymous table access is denied. Self-authorizes now that the
+ * global gate is non-rejecting.
+ */
+export class OAuthClient extends databases.flair.OAuthClient {
+    allowRead() { return allowAdmin(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/ObsAgentSnapshot.js

@@ -0,0 +1,13 @@
+import { databases } from "@harperfast/harper";
+import { allowVerified, allowAdmin } from "./agent-auth.js";
+/**
+ * ObsAgentSnapshot — observatory per-agent snapshot read-model. Writes are
+ * system-driven (internal sync); agents may read. See ObsOffice for the
+ * allowRead=allowVerified security default (flag for Sherlock).
+ */
+export class ObsAgentSnapshot extends databases.flair.ObsAgentSnapshot {
+    allowRead() { return allowVerified(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/ObsEventFeed.js

@@ -0,0 +1,13 @@
+import { databases } from "@harperfast/harper";
+import { allowVerified, allowAdmin } from "./agent-auth.js";
+/**
+ * ObsEventFeed — observatory event-feed read-model. Writes are system-driven
+ * (internal sync); agents may read. See ObsOffice for the allowRead=allowVerified
+ * security default (flag for Sherlock).
+ */
+export class ObsEventFeed extends databases.flair.ObsEventFeed {
+    allowRead() { return allowVerified(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/ObsOffice.js

@@ -0,0 +1,19 @@
+import { databases } from "@harperfast/harper";
+import { allowVerified, allowAdmin } from "./agent-auth.js";
+/**
+ * ObsOffice — observatory office-layout read-model. Writes are system-driven
+ * (internal sync); agents may read. Self-authorizes now that the global gate is
+ * non-rejecting.
+ *
+ * SECURITY DEFAULT (flag for Sherlock): allowRead is allowVerified (anonymous
+ * denied). The ObservationCenter HTML shell is public but its data API calls
+ * authenticate (admin-pass). If the public Office Space renderer needs anonymous
+ * Obs reads, relax to allowRead=true WITH field-allowlisting (as Presence.get does)
+ * — do NOT expose raw rows publicly.
+ */
+export class ObsOffice extends databases.flair.ObsOffice {
+    allowRead() { return allowVerified(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/OrgEvent.js

@@ -1,42 +1,58 @@
 /**
  * OrgEvent.ts — Harper table resource for org-wide activity events.
  *
- * Auth: Ed25519 middleware sets request.tpsAgent.
- * Write: authorId must match authenticated agent (or admin).
- * Read: any authenticated participant can read (org-scoped).
+ * Auth (self-enforced now that the global gate is non-rejecting):
+ *   Read  — any verified agent/admin (org-scoped); anonymous denied.
+ *   Write — authorId must match the authenticated agent (or admin); anonymous denied.
+ *
+ * The previous version read context.request.tpsAgent and treated a MISSING agent
+ * as trusted (`if (agentId && …)` / `if (!agentId) super.delete`), so anonymous
+ * requests slipped through once the gate stopped rejecting. resolveAgentAuth
+ * distinguishes internal/agent/anonymous explicitly.
  */
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
+const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
+const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
 export class OrgEvent extends databases.flair.OrgEvent {
-    async post(content, context) {
-        const agentId = context?.request?.tpsAgent;
-        // authorId must match authenticated agent (unless admin)
-        if (agentId && !context?.request?.tpsAgentIsAdmin && content.authorId !== agentId) {
-            return new Response(JSON.stringify({ error: "forbidden: authorId must match authenticated agent" }), { status: 403, headers: { "Content-Type": "application/json" } });
-        }
-        // Generate composite ID if not provided
-        if (!content.id) {
-            content.id = `${content.authorId}-${Date.now()}`;
+    allowRead() { return allowVerified(this.getContext?.()); }
+    _auth() {
+        return resolveAgentAuth(this.getContext?.());
+    }
+    async post(content) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content.authorId !== auth.agentId) {
+            return FORBIDDEN("forbidden: authorId must match authenticated agent");
         }
+        if (!content.id)
+            content.id = `${content.authorId}-${new Date().toISOString()}`;
         content.createdAt = new Date().toISOString();
-        // Harper 5: table resources use put() for create/upsert (post() removed)
+        // Harper 5: table resources use put() for create/upsert (post() removed).
         return databases.flair.OrgEvent.put(content);
     }
-    async put(content, context) {
-        const agentId = context?.request?.tpsAgent;
-        if (agentId && !context?.request?.tpsAgentIsAdmin && content.authorId !== agentId) {
-            return new Response(JSON.stringify({ error: "forbidden: authorId must match authenticated agent" }), { status: 403, headers: { "Content-Type": "application/json" } });
+    async put(content) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content.authorId !== auth.agentId) {
+            return FORBIDDEN("forbidden: authorId must match authenticated agent");
         }
         return databases.flair.OrgEvent.put(content);
     }
     async delete(id, context) {
-        const agentId = context?.request?.tpsAgent;
-        if (!agentId)
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.delete(id, context);
+        }
         const record = await this.get(id);
         if (!record)
             return super.delete(id, context);
-        if (!context?.request?.tpsAgentIsAdmin && record.authorId !== agentId) {
-            return new Response(JSON.stringify({ error: "forbidden: cannot delete events authored by another agent" }), { status: 403, headers: { "Content-Type": "application/json" } });
+        if (record.authorId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot delete events authored by another agent");
         }
         return super.delete(id, context);
     }

package/dist/resources/OrgEventCatchup.js

@@ -10,7 +10,15 @@
  * Limit 50 events max.
  */
 import { Resource, databases } from "@harperfast/harper";
+import { allowVerified } from "./agent-auth.js";
 export class OrgEventCatchup extends Resource {
+    // Self-authorize via the Ed25519 agent verify (auth reshape removes the gate's
+    // admin elevation). Any verified agent may catch up; participant scoping is in
+    // get(). Uses getContext().request — the reliable v5 path (this.request is not
+    // populated on Harper v5 Resources).
+    async allowRead() {
+        return allowVerified(this.getContext?.());
+    }
     // HarperDB calls get(pathInfo, context) where pathInfo is the URL segment after /OrgEventCatchup/
     async get(pathInfo) {
         const request = this.request;

package/dist/resources/OrgEventMaintenance.js

@@ -5,7 +5,14 @@
  * Auth: admin only.
  */
 import { Resource, databases } from "@harperfast/harper";
+import { allowAdmin } from "./agent-auth.js";
 export class OrgEventMaintenance extends Resource {
+    // Admin-only: permit verified ADMIN agents (Basic-admin is super_user and
+    // bypasses allow*); non-admin agents denied. Real authorization now that the
+    // gate no longer elevates agents to admin.
+    async allowCreate() {
+        return allowAdmin(this.getContext?.());
+    }
     async post(_data, context) {
         // Admin-only
         if (!context?.request?.tpsAgentIsAdmin) {

package/dist/resources/PairingToken.js

@@ -0,0 +1,14 @@
+import { databases } from "@harperfast/harper";
+import { allowAdmin } from "./agent-auth.js";
+/**
+ * PairingToken holds one-time federation pairing secrets — admin/system only,
+ * no agent grant. The FederationPair endpoint consumes tokens via internal calls
+ * (allowAdmin permits internal), so dedicated flows keep working; direct anonymous
+ * table access is denied. Self-authorizes now that the global gate is non-rejecting.
+ */
+export class PairingToken extends databases.flair.PairingToken {
+    allowRead() { return allowAdmin(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/Peer.js

@@ -0,0 +1,15 @@
+import { databases } from "@harperfast/harper";
+import { allowAdmin } from "./agent-auth.js";
+/**
+ * Peer holds federation peer records (URLs + credentials) — system/admin data,
+ * no agent grant. Before the auth flip the global gate was its only protection;
+ * the non-rejecting gate means it must self-authorize. Admin/internal only on
+ * every path. (Federation pairing/sync use dedicated endpoints — FederationPair,
+ * FederationSync — not direct Peer table access.)
+ */
+export class Peer extends databases.flair.Peer {
+    allowRead() { return allowAdmin(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/Presence.js

@@ -17,6 +17,7 @@
  *   - currentTask is agent-authored free text → cap length, escape on render.
  */
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth } from "./agent-auth.js";
 // ─── Constants ────────────────────────────────────────────────────────────────
 const WINDOW_MS = 30_000;
 const CURRENT_TASK_MAX_LENGTH = 200;
@@ -267,4 +268,33 @@ export class Presence extends databases.flair.Presence {
             return new Response(JSON.stringify({ error: "presence_write_failed", detail: e?.message }), { status: 500, headers: { "Content-Type": "application/json" } });
         }
     }
+    /**
+     * PUT/DELETE are not part of the agent heartbeat contract (writes go through
+     * POST, which carries its own Ed25519 auth). GET is intentionally public and
+     * allowCreate=true lets POST self-auth — but those bypasses must NOT extend to
+     * PUT/DELETE. The non-rejecting gate would otherwise let anonymous PUT/DELETE
+     * straight to Harper's default handler (the leak this closes). Require a verified
+     * non-anonymous principal, scoped to the agent's own record (Presence is keyed
+     * by agentId).
+     */
+    async put(content, context) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+        }
+        if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
+            return new Response(JSON.stringify({ error: "forbidden: cannot write presence for another agent" }), { status: 403, headers: { "Content-Type": "application/json" } });
+        }
+        return super.put(content, context);
+    }
+    async delete(id) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+        }
+        if (auth.kind === "agent" && !auth.isAdmin && id != null && String(id) !== auth.agentId) {
+            return new Response(JSON.stringify({ error: "forbidden: cannot delete presence for another agent" }), { status: 403, headers: { "Content-Type": "application/json" } });
+        }
+        return super.delete(id);
+    }
 }

package/dist/resources/Relationship.js

@@ -1,4 +1,5 @@
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth } from "./agent-auth.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
 /**
  * Relationship resource — entity-to-entity relationships with temporal validity.
@@ -13,15 +14,20 @@ import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
  */
 export class Relationship extends databases.flair.Relationship {
     async search(query) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        if (!authAgent || isAdminAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous HTTP must NOT read relationships (previously `!authAgent` was
+        // treated as unfiltered — the anonymous-read leak).
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "content-type": "application/json" },
+            });
+        }
+        // Trusted internal call or admin agent → unfiltered.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.search(query);
         }
-        // Non-admin: scope to own relationships
-        const agentCondition = { attribute: "agentId", comparator: "equals", value: authAgent };
+        // Non-admin agent: scope to own relationships.
+        const agentCondition = { attribute: "agentId", comparator: "equals", value: auth.agentId };
         if (!query?.conditions) {
             return super.search({ conditions: [agentCondition], ...(query || {}) });
         }

package/dist/resources/SemanticSearch.js

@@ -1,4 +1,5 @@
 import { Resource, databases } from "@harperfast/harper";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 import { getEmbedding, getMode } from "./embeddings-provider.js";
 import { patchRecord, withDetachedTxn } from "./table-helpers.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
@@ -45,6 +46,15 @@ function distanceToSimilarity(distance) {
 // so composite re-ranking has enough headroom to reorder results.
 const CANDIDATE_MULTIPLIER = 5;
 export class SemanticSearch extends Resource {
+    // Self-authorize via the Ed25519 agent verify instead of relying on the auth
+    // gate's admin super_user elevation (removed in the auth reshape). Any
+    // cryptographically-verified agent may search; per-agent RESULT scoping is
+    // enforced in post() below (an agent only sees its own + office-visible +
+    // granted memories). Without this, Harper's default denies the POST for the
+    // least-privilege flair_agent role (AccessViolation 403).
+    async allowCreate() {
+        return allowVerified(this.getContext?.());
+    }
     async post(data) {
         const { agentId: bodyAgentId, q, queryEmbedding, tag, subject, subjects, limit = 10, includeSuperseded = false, scoring = "composite", minScore = 0, since, asOf } = data || {};
         // Authenticated identity lives on the Harper Resource context (getContext().request).
@@ -52,11 +62,18 @@ export class SemanticSearch extends Resource {
         // silently returned undefined and the defense-in-depth scope check below
         // was bypassed, letting a non-admin agent read another agent's memories
         // by putting the victim's id in the body.
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authenticatedAgent = request?.tpsAgent ?? request?.headers?.get?.("x-tps-agent");
-        const callerIsAdmin = request?.tpsAgentIsAdmin === true;
-        // Rate limiting — use authenticated agent ID, not client-supplied body
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous HTTP must NOT search. Previously the no-auth path fell through to
+        // honoring the body-supplied agentId (line below), so an unauthenticated
+        // caller could read any agent's memories by putting that id in the body.
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "Content-Type": "application/json" },
+            });
+        }
+        const authenticatedAgent = auth.kind === "agent" ? auth.agentId : undefined;
+        const callerIsAdmin = auth.kind === "agent" && auth.isAdmin;
+        // Rate limiting — use authenticated agent ID (internal calls have none).
         if (authenticatedAgent) {
             const bucket = q && !queryEmbedding ? "embedding" : "general";
             const rl = checkRateLimit(authenticatedAgent, bucket);
@@ -70,14 +87,14 @@ export class SemanticSearch extends Resource {
                 : null;
         // Enforce agentId = authenticated agent for non-admins. A mismatched body
         // agentId is a cross-agent read attempt — reject outright. Admins can query
-        // any agentId (needed for bootstrap / consolidation scripts).
+        // any agentId (bootstrap / consolidation).
         if (authenticatedAgent && !callerIsAdmin && bodyAgentId && bodyAgentId !== authenticatedAgent) {
             return new Response(JSON.stringify({
                 error: "forbidden: agentId must match authenticated agent",
             }), { status: 403, headers: { "Content-Type": "application/json" } });
         }
-        // Scope search to the authenticated agent (own + granted). For admins or
-        // unauthenticated internal calls, honor the body-supplied agentId.
+        // Scope: non-admin agent → own (+ granted). Admin agent or trusted internal
+        // call (no request) → honor the body-supplied agentId.
         const agentId = (authenticatedAgent && !callerIsAdmin)
             ? authenticatedAgent
             : bodyAgentId;

package/dist/resources/Soul.js

@@ -1,17 +1,26 @@
 import { databases } from "@harperfast/harper";
-function enforceAgentScope(self, data) {
-    const authenticatedAgent = self.request?.headers?.get?.("x-tps-agent");
-    const callerIsAdmin = self.request?.tpsAgentIsAdmin === true;
-    if (authenticatedAgent && !callerIsAdmin && data?.agentId && data.agentId !== authenticatedAgent) {
-        return new Response(JSON.stringify({
-            error: "forbidden: agentId must match authenticated agent",
-        }), { status: 403, headers: { "Content-Type": "application/json" } });
+import { resolveAgentAuth } from "./agent-auth.js";
+const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
+const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+/**
+ * Deny anonymous; enforce per-agent write ownership for non-admin agents.
+ * The previous header-based check only fired when an agent WAS present (it read
+ * x-tps-agent), so an anonymous request — which carries no x-tps-agent — slipped
+ * through. With the non-rejecting gate, each write path self-enforces (resolveAgentAuth
+ * distinguishes internal/agent/anonymous). Mirrors the WorkspaceState pattern.
+ */
+async function enforceWriteAuth(self, data) {
+    const auth = await resolveAgentAuth(self.getContext?.());
+    if (auth.kind === "anonymous")
+        return UNAUTH();
+    if (auth.kind === "agent" && !auth.isAdmin && data?.agentId && data.agentId !== auth.agentId) {
+        return FORBIDDEN("forbidden: agentId must match authenticated agent");
     }
     return null;
 }
 export class Soul extends databases.flair.Soul {
     async post(content, context) {
-        const denied = enforceAgentScope(this, content);
+        const denied = await enforceWriteAuth(this, content);
         if (denied)
             return denied;
         content.durability ||= "permanent";
@@ -20,7 +29,7 @@ export class Soul extends databases.flair.Soul {
         return super.post(content, context);
     }
     async put(content, context) {
-        const denied = enforceAgentScope(this, content);
+        const denied = await enforceWriteAuth(this, content);
         if (denied)
             return denied;
         content.updatedAt = new Date().toISOString();

package/dist/resources/SoulFeed.js

@@ -1,5 +1,12 @@
 import { Resource, databases } from '@harperfast/harper';
+import { allowVerified } from './agent-auth.js';
 export class FeedSouls extends Resource {
+    // Self-authorize the subscription via the Ed25519 agent verify (auth reshape
+    // removes the gate's admin elevation). FeedSouls extends Resource (not a Table),
+    // so getContext().request is reachable in allow* — same pattern as SemanticSearch.
+    async allowRead() {
+        return allowVerified(this.getContext?.());
+    }
     async *connect(target, incomingMessages) {
         const subscription = await databases.flair.Soul.subscribe(target);
         if (!incomingMessages) {

package/dist/resources/WorkspaceLatest.js

@@ -5,7 +5,14 @@
  * Auth: requesting agent must match agentId in path (or be admin).
  */
 import { Resource, databases } from "@harperfast/harper";
+import { allowVerified } from "./agent-auth.js";
 export class WorkspaceLatest extends Resource {
+    // Self-authorize via the Ed25519 agent verify (auth reshape removes the gate's
+    // admin elevation). Any verified agent may read; the path-vs-agent ownership
+    // check stays in get().
+    async allowRead() {
+        return allowVerified(this.getContext?.());
+    }
     async get(pathInfo) {
         const request = this.context?.request ?? this.request;
         const callerAgent = request?.tpsAgent;