@tpsdev-ai/flair 0.18.0 → 0.20.0

package/dist/resources/MemoryBootstrap.js

@@ -3,6 +3,7 @@ import { allowVerified } from "./agent-auth.js";
 import { getEmbedding } from "./embeddings-provider.js";
 import { wrapUntrusted } from "./content-safety.js";
 import { isTeammate, formatTeamLine } from "./memory-bootstrap-lib.js";
+import { resolveReadScope } from "./memory-read-scope.js";
 /**
  * POST /MemoryBootstrap
  *
@@ -12,11 +13,18 @@ import { isTeammate, formatTeamLine } from "./memory-bootstrap-lib.js";
  *   2. Permanent memories (safety rules, core principles)
  *   3. Recent memories (adaptive window)
  *   4. Task-relevant memories (semantic search if currentTask provided)
+ *   4b. Teammate findings relevant to your task (flair#550 — the SAME scored
+ *      task-relevant set as #4, split by origin: a grant-visible teammate's
+ *      SHARED memory that scores against currentTask lands here instead of
+ *      #4, attributed via "[via <agentId>]". Presentation only — what's
+ *      readable is entirely Layer 1's resolveReadScope()/ops-2dm3; this only
+ *      changes how an already-read cross-agent record is formatted/sectioned)
  *   5. Relationship context (active relationships for mentioned entities)
  *   6. Predicted context (based on channel/surface/subject hints)
  *   7. Team roster (other active agents in this office + a search-first nudge —
- *      bootstrap only ever loads the caller's own memories, so this is the one
- *      place agents learn teammates' findings exist without a separate call)
+ *      bootstrap loads the caller's own memories plus any granted owner's
+ *      SHARED memories (ops-2dm3 Layer 1, never their private ones), so this
+ *      section nudges toward memory_search for anything beyond that window)
  *
  * Prediction: when context signals (channel, surface, subjects) are provided,
  * the bootstrap loads more aggressively — Flair is fast enough that the
@@ -33,12 +41,23 @@ import { isTeammate, formatTeamLine } from "./memory-bootstrap-lib.js";
 function estimateTokens(text) {
     return Math.ceil(text.length / 4);
 }
-function formatMemory(m, supersedes) {
+// `agentId` is the BOOTSTRAPPING agent (the caller) — used only to decide
+// whether to annotate attribution, never to change what's read (that
+// boundary is resolveReadScope()'s job, upstream of this function). A
+// cross-agent record always carries `_source` (set once, above, when the
+// record's own agentId differs from the bootstrapping agent — see the
+// allMemories loop), so `m._source !== agentId` is the "is this a
+// teammate's finding" check; own memories never carry `_source` at all.
+function formatMemory(m, agentId) {
     const tag = m.durability === "permanent" ? "🔒" : m.durability === "persistent" ? "📌" : "📝";
     const date = m.createdAt ? ` (${m.createdAt.slice(0, 10)})` : "";
     const chain = m.supersedes ? " [supersedes earlier decision]" : "";
-    const base = `${tag} ${m.content}${date}${chain}`;
-    // Wrap flagged memories in safety delimiters
+    const attribution = m._source && m._source !== agentId ? `[via ${m._source}] ` : "";
+    const base = `${tag} ${attribution}${m.content}${date}${chain}`;
+    // Wrap flagged memories in safety delimiters — composes with attribution
+    // above (attribution is baked into `base` before wrapping, so a flagged
+    // teammate memory renders with BOTH the "[via <agent>]" tag and the
+    // untrusted-content wrapper).
     if (m._safetyFlags && Array.isArray(m._safetyFlags) && m._safetyFlags.length > 0) {
         return wrapUntrusted(base, m._source);
     }
@@ -90,6 +109,7 @@ export class BootstrapMemories extends Resource {
             predicted: [],
             relationships: [],
             relevant: [],
+            teammate: [],
             events: [],
         };
         let tokenBudget = maxTokens;
@@ -178,12 +198,13 @@ export class BootstrapMemories extends Resource {
             }
         }
         // --- 1c. Team roster + cross-agent search nudge ---
-        // Bootstrap only ever loads the caller's OWN soul/memories (every query
-        // below filters record.agentId === agentId). Nothing here tells the agent
-        // that teammates exist or that their findings are one memory_search away
-        // — so agents never think to check before re-investigating something a
-        // teammate already solved. This section is fixed-cost (no query text to
-        // format per agent) so it's cheap enough to always include, not budgeted.
+        // Soul is still caller-own-only (unaffected here). Memory loading below
+        // (step 2) now also includes granted owners' SHARED memories (ops-2dm3
+        // Layer 1) — but this section stays: memory_search/SemanticSearch remains
+        // the deliberate, query-driven way to find a teammate's finding, vs.
+        // bootstrap's fixed recent/permanent window. This section is fixed-cost
+        // (no query text to format per agent) so it's cheap enough to always
+        // include, not budgeted.
         //
         // Permissive kind/status checks are DELIBERATE: Agent.ts registration
         // defaults both (`kind ||= "agent"`, `status ||= "active"`), so pre-1.0
@@ -204,13 +225,39 @@ export class BootstrapMemories extends Resource {
             // Agent table may not exist in older / standalone deployments
         }
         // --- 2. Permanent memories (always included, highest priority) ---
+        // Read-scope: own (any visibility) + granted owners' SHARED memories only
+        // (ops-2dm3 Layer 1 — never a granted owner's private ones). Centralized
+        // in resolveReadScope(): the condition is pushed into the Harper query
+        // (so the table itself never returns an out-of-scope row), and
+        // `scope.isAllowed` re-checks in-process as defense-in-depth (same
+        // belt-and-suspenders discipline as SemanticSearch's BM25 pre-fusion
+        // filter) — this is the #550 foundation: bootstrap can now safely expand
+        // beyond own-only without a parallel scoping rule.
+        const scope = await resolveReadScope(agentId);
         const allMemories = [];
-        for await (const record of databases.flair.Memory.search()) {
-            if (record.agentId !== agentId)
+        for await (const record of databases.flair.Memory.search({ conditions: [scope.condition] })) {
+            if (!scope.isAllowed(record))
                 continue;
             if (record.expiresAt && Date.parse(record.expiresAt) < Date.now())
                 continue;
-            allMemories.push(record);
+            // ops-hesq: a past validTo ALWAYS means the record has been closed out
+            // (server supersede path — Memory.ts closeSupersededRecord — sets
+            // validTo without necessarily setting `archived`), same root cause and
+            // fix as ops-9rc6's SemanticSearch/bm25-filter exclusion. Unconditional
+            // so a server-superseded record can't resurface in bootstrap just
+            // because its successor isn't co-present in this result set (the
+            // supersededIds filter further down only catches co-presence). A
+            // record with no validTo, or a future validTo, is unaffected.
+            if (record.validTo && Date.parse(record.validTo) < Date.now())
+                continue;
+            // Attribution for cross-agent (granted-owner) records — same convention
+            // SemanticSearch.ts already uses: formatMemory() below only USES this
+            // when the record also carries _safetyFlags (labels the untrusted-data
+            // wrapper with whose memory it is), it never forces wrapping on its own.
+            // Real Harper's search() results are non-extensible objects — mutating
+            // `record._source = ...` directly throws ("object is not extensible");
+            // shallow-copy instead of mutating in place.
+            allMemories.push(record.agentId !== agentId ? { ...record, _source: record.agentId } : record);
         }
         memoriesAvailable = allMemories.length;
         // Build superseded set: exclude memories that have been replaced by newer ones
@@ -220,9 +267,18 @@ export class BootstrapMemories extends Resource {
                 supersededIds.add(m.supersedes);
         }
         const activeMemories = allMemories.filter((m) => !supersededIds.has(m.id));
-        const permanent = activeMemories.filter((m) => m.durability === "permanent");
+        // #550 design boundary: the permanent / recent / predicted sections are the
+        // agent's OWN working context — own-only, always. Post-Layer-1
+        // `activeMemories` also carries grant-visible teammate records (`_source`
+        // set), but grant-visibility exists to feed the task-relevant "Teammate
+        // findings" surfacing (#550) below, NOT to blend a teammate's memories into
+        // the reader's recent/permanent/predicted view. So these three sections
+        // filter to own (`!m._source`); team knowledge surfaces only when
+        // task-relevant (the teammate section) or via an explicit memory_search.
+        const ownMemories = activeMemories.filter((m) => !m._source);
+        const permanent = ownMemories.filter((m) => m.durability === "permanent");
         for (const m of permanent) {
-            const line = formatMemory(m);
+            const line = formatMemory(m, agentId);
             const cost = estimateTokens(line);
             if (cost <= tokenBudget) {
                 sections.permanent.push(line);
@@ -236,7 +292,7 @@ export class BootstrapMemories extends Resource {
         // --- 3. Recent memories (adaptive window) ---
         // Start with 48h. If nothing found, widen to 7d, then 30d.
         // This prevents empty recent sections for agents that were idle.
-        const nonPermanent = activeMemories
+        const nonPermanent = ownMemories
             .filter((m) => m.durability !== "permanent" && m.createdAt)
             .sort((a, b) => (b.createdAt || "").localeCompare(a.createdAt || ""));
         let effectiveSince;
@@ -258,7 +314,7 @@ export class BootstrapMemories extends Resource {
         const recentBudget = Math.floor(tokenBudget * 0.4);
         let recentSpent = 0;
         for (const m of recent) {
-            const line = formatMemory(m);
+            const line = formatMemory(m, agentId);
             const cost = estimateTokens(line);
             if (recentSpent + cost > recentBudget) {
                 memoriesTruncated++;
@@ -282,7 +338,7 @@ export class BootstrapMemories extends Resource {
                 ...permanent.map((m) => m.id),
                 ...recent.filter((_, i) => i < sections.recent.length).map((m) => m.id),
             ]);
-            const subjectMemories = activeMemories
+            const subjectMemories = ownMemories
                 .filter((m) => !includedIds.has(m.id) &&
                 m.subject &&
                 predictedSubjects.includes(m.subject.toLowerCase()) &&
@@ -292,7 +348,7 @@ export class BootstrapMemories extends Resource {
             const predictedBudget = Math.floor(tokenBudget * 0.3);
             let predictedSpent = 0;
             for (const m of subjectMemories) {
-                const line = formatMemory(m);
+                const line = formatMemory(m, agentId);
                 const cost = estimateTokens(line);
                 if (predictedSpent + cost > predictedBudget) {
                     memoriesTruncated++;
@@ -362,12 +418,25 @@ export class BootstrapMemories extends Resource {
                 })
                     .filter((s) => s.score > 0.3)
                     .sort((a, b) => b.score - a.score);
+                // #550: split the scored, task-relevant set by origin. Own findings
+                // go to `relevant` as before; a teammate's (grant-visible, already
+                // read-scoped by Layer 1 — `m._source` is only ever set for a
+                // cross-agent record, see the allMemories loop above) go to the new
+                // `teammate` section so the agent can tell it apart at a glance.
+                // Both draw from the SAME `tokenBudget` in one score-ordered pass —
+                // highest-relevance memories win the remaining budget regardless of
+                // which section they land in, so neither section double-spends.
                 for (const { memory: m } of scored) {
-                    const line = formatMemory(m);
+                    const line = formatMemory(m, agentId);
                     const cost = estimateTokens(line);
                     if (cost > tokenBudget)
                         continue;
-                    sections.relevant.push(line);
+                    if (m._source) {
+                        sections.teammate.push(line);
+                    }
+                    else {
+                        sections.relevant.push(line);
+                    }
                     tokenBudget -= cost;
                     memoriesIncluded++;
                 }
@@ -428,6 +497,13 @@ export class BootstrapMemories extends Resource {
         if (sections.relevant.length > 0) {
             parts.push("## Relevant Knowledge\n" + sections.relevant.join("\n"));
         }
+        // #550: teammate findings relevant to the current task — right after the
+        // agent's own task-relevant knowledge. Empty section renders nothing
+        // (no header) so a bootstrap with no grant-visible teammate findings for
+        // this task looks exactly as it did before this feature.
+        if (sections.teammate.length > 0) {
+            parts.push("## Teammate findings relevant to your task\n" + sections.teammate.join("\n"));
+        }
         if (sections.events.length > 0) {
             parts.push("## Recent Org Events\n" + sections.events.join("\n"));
         }
@@ -445,6 +521,7 @@ export class BootstrapMemories extends Resource {
                 predicted: sections.predicted.length,
                 relationships: sections.relationships.length,
                 relevant: sections.relevant.length,
+                teammate: sections.teammate.length,
                 events: sections.events.length,
             },
             tokenEstimate: soulTokens + memoryTokens,

package/dist/resources/MemoryGrant.js

@@ -1,7 +1,8 @@
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth } from "./agent-auth.js";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
 const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
 /**
  * MemoryGrant — an agent (ownerId) grants another (granteeId) scoped access to its
  * memories. Self-authorizes now that the global gate is non-rejecting (previously a
@@ -16,6 +17,52 @@ export class MemoryGrant extends databases.flair.MemoryGrant {
     _auth() {
         return resolveAgentAuth(this.getContext?.());
     }
+    /**
+     * Self-authorize now that the global gate is non-rejecting (memory-soul-
+     * read-gate family fix, ops-oox7 — same pattern as Memory.ts/Soul.ts/
+     * WorkspaceState.ts/Relationship.ts/Integration.ts). Closes the same P0
+     * leak: Harper routes `GET /MemoryGrant/<id>` to get() and the collection
+     * describe (`GET /MemoryGrant`) outside search(), so neither was gated
+     * before this fix — an anonymous caller got a 200 with full grant content.
+     * Per-record owner/grantee scoping happens in get() below; the collection
+     * scope is still in search().
+     */
+    allowRead() { return allowVerified(this.getContext?.()); }
+    /**
+     * Override get() to scope by-id reads the same way search() scopes
+     * collection reads (memory-soul-read-gate family fix). A grant is visible
+     * to either party (ownerId OR granteeId), mirroring search()'s owner-OR-
+     * grantee scope. Never distinguishes "doesn't exist" from "exists but not
+     * yours" — both return 404, never 403, so a denied caller can't use get()
+     * to enumerate other agents' grant ids.
+     */
+    async get(target) {
+        // Collection / query reads arrive as a RequestTarget with
+        // `isCollection === true`, and are governed by search() (same owner/
+        // grantee scoping). Only a genuine by-id get is ownership-checked below
+        // — see Memory.ts's get() for the full rationale (same bug class).
+        if (!target || (typeof target === "object" && target.isCollection)) {
+            return this.search(target);
+        }
+        const auth = await this._auth();
+        // Anonymous by-id read is already blocked at the allowRead() gate (403);
+        // this is defense-in-depth if get() is ever reached directly.
+        if (auth.kind === "anonymous") {
+            return NOT_FOUND();
+        }
+        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.get(target);
+        }
+        // Non-admin agent: visible if it's the owner OR the grantee (parity with
+        // search()'s owner-OR-grantee scope).
+        const record = await super.get(target);
+        if (!record)
+            return NOT_FOUND();
+        if (record.ownerId !== auth.agentId && record.granteeId !== auth.agentId)
+            return NOT_FOUND();
+        return record;
+    }
     async search(query) {
         const auth = await this._auth();
         if (auth.kind === "anonymous")
@@ -59,7 +106,13 @@ export class MemoryGrant extends databases.flair.MemoryGrant {
         if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.delete(id, context);
         }
-        const record = await this.get(id);
+        // Use super.get(id), NOT this.get(id): the new get() override above 404s
+        // (a truthy Response) for a non-owner/non-grantee id, which would
+        // otherwise defeat the `if (!record)` check below and mis-route a
+        // genuinely-missing record into the FORBIDDEN branch instead of a clean
+        // super.delete(id, context) no-op. Mirrors Memory.ts's delete() — same
+        // rationale, same fix.
+        const record = await super.get(id);
         if (!record)
             return super.delete(id, context);
         if (record.ownerId !== auth.agentId) {

package/dist/resources/Presence.js

@@ -18,9 +18,8 @@
  */
 import { databases } from "@harperfast/harper";
 import { resolveAgentAuth } from "./agent-auth.js";
-import { b64ToArrayBuffer } from "./b64.js";
+import { WINDOW_MS, isNonceReplay, recordNonce, importEd25519Key, b64ToArrayBuffer } from "./ed25519-auth.js";
 // ─── Constants ────────────────────────────────────────────────────────────────
-const WINDOW_MS = 30_000;
 const CURRENT_TASK_MAX_LENGTH = 200;
 const VALID_ACTIVITIES = new Set(["coding", "reviewing", "planning", "idle"]);
 function idleThresholdMs() {
@@ -31,36 +30,12 @@ function offlineThresholdMs() {
     const env = process.env.PRESENCE_OFFLINE_THRESHOLD_MS;
     return env ? Number(env) || 600_000 : 600_000;
 }
-// ─── Nonce replay protection ──────────────────────────────────────────────────
-const nonceSeen = new Map();
-function pruneNonces() {
-    const now = Date.now();
-    for (const [k, ts] of nonceSeen.entries()) {
-        if (now - ts > WINDOW_MS)
-            nonceSeen.delete(k);
-    }
-}
-// ─── Crypto helpers ───────────────────────────────────────────────────────────
-// b64ToArrayBuffer lives in ./b64.ts (shared with auth-middleware.ts + agent-auth.ts
-// so the base64/base64url decoder can't drift across the three auth call sites).
-const keyCache = new Map();
-async function importEd25519Key(publicKeyStr) {
-    if (keyCache.has(publicKeyStr))
-        return keyCache.get(publicKeyStr);
-    let raw;
-    if (/^[0-9a-f]{64}$/i.test(publicKeyStr)) {
-        const bytes = new Uint8Array(32);
-        for (let i = 0; i < 32; i++)
-            bytes[i] = parseInt(publicKeyStr.slice(i * 2, i * 2 + 2), 16);
-        raw = bytes.buffer;
-    }
-    else {
-        raw = b64ToArrayBuffer(publicKeyStr);
-    }
-    const key = await crypto.subtle.importKey("raw", raw, { name: "Ed25519" }, false, ["verify"]);
-    keyCache.set(publicKeyStr, key);
-    return key;
-}
+// ─── Nonce replay + crypto helpers ─────────────────────────────────────────────
+// WINDOW_MS, isNonceReplay/recordNonce (the ONE shared nonce store), and
+// importEd25519Key all live in ./ed25519-auth.ts (bd ops-c4op) — the single
+// shared implementation imported by auth-middleware.ts, agent-auth.ts, and
+// Presence.ts so a nonce recorded via any one of the three call sites is
+// visible to the other two, and the crypto/decoder logic can't drift.
 // ─── Status derivation (pure — exported for unit testing) ─────────────────────
 export function derivePresenceStatus(now, lastHeartbeatAt, idleMs, offlineMs) {
     const idle = idleMs ?? idleThresholdMs();
@@ -195,9 +170,7 @@ export class Presence extends databases.flair.Presence {
             if (!Number.isFinite(ts) || Math.abs(now - ts) > WINDOW_MS) {
                 return new Response(JSON.stringify({ error: "timestamp_out_of_window" }), { status: 401, headers: { "Content-Type": "application/json" } });
             }
-            pruneNonces();
-            const nonceKey = `${headerAgentId}:${nonce}`;
-            if (nonceSeen.has(nonceKey)) {
+            if (isNonceReplay(headerAgentId, nonce, now)) {
                 return new Response(JSON.stringify({ error: "nonce_replay_detected" }), { status: 401, headers: { "Content-Type": "application/json" } });
             }
             const agent = await databases.flair.Agent.get(headerAgentId).catch(() => null);
@@ -219,7 +192,7 @@ export class Presence extends databases.flair.Presence {
             catch (e) {
                 return new Response(JSON.stringify({ error: "signature_verification_failed", detail: e?.message }), { status: 401, headers: { "Content-Type": "application/json" } });
             }
-            nonceSeen.set(nonceKey, ts);
+            recordNonce(headerAgentId, nonce, ts);
             agentId = headerAgentId;
         }
         // ── Validate body ────────────────────────────────────────────────────────

package/dist/resources/Relationship.js

@@ -1,6 +1,7 @@
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth } from "./agent-auth.js";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
+const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
 /**
  * Relationship resource — entity-to-entity relationships with temporal validity.
  *
@@ -13,6 +14,53 @@ import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
  * Admin agents can query across all agents.
  */
 export class Relationship extends databases.flair.Relationship {
+    /**
+     * Self-authorize now that the global gate is non-rejecting (memory-soul-
+     * read-gate family fix, ops-oox7 — same pattern as Memory.ts/Soul.ts/
+     * WorkspaceState.ts). Closes the same P0 leak: Harper routes
+     * `GET /Relationship/<id>` to get() and the collection describe
+     * (`GET /Relationship`) outside search(), so neither was gated before this
+     * fix — an anonymous caller got a 200 with full record content. Per-record
+     * ownership scoping happens in get() below; the collection scope is still
+     * in search().
+     */
+    allowRead() { return allowVerified(this.getContext?.()); }
+    /**
+     * Override get() to scope by-id reads the same way search() scopes
+     * collection reads (memory-soul-read-gate family fix). Never distinguishes
+     * "doesn't exist" from "exists but not yours" — both return 404, never
+     * 403, so a denied caller can't use get() to enumerate other agents'
+     * relationship ids.
+     */
+    async get(target) {
+        // Collection / query reads arrive as a RequestTarget with
+        // `isCollection === true`, and are governed by search() (same owner
+        // scoping). Only a genuine by-id get is ownership-checked below — see
+        // Memory.ts's get() for the full rationale (same bug class: without this
+        // guard, a query's RequestTarget would flow into super.get(), return the
+        // whole result set, and the single-record ownership check below would
+        // find no `.agentId` on it).
+        if (!target || (typeof target === "object" && target.isCollection)) {
+            return this.search(target);
+        }
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous by-id read is already blocked at the allowRead() gate (403);
+        // this is defense-in-depth if get() is ever reached directly.
+        if (auth.kind === "anonymous") {
+            return NOT_FOUND();
+        }
+        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.get(target);
+        }
+        // Non-admin agent: only its own relationships.
+        const record = await super.get(target);
+        if (!record)
+            return NOT_FOUND();
+        if (record.agentId !== auth.agentId)
+            return NOT_FOUND();
+        return record;
+    }
     async search(query) {
         const auth = await resolveAgentAuth(this.getContext?.());
         // Anonymous HTTP must NOT read relationships (previously `!authAgent` was

package/dist/resources/SemanticSearch.js

@@ -4,6 +4,8 @@ import { getEmbedding, getMode } from "./embeddings-provider.js";
 import { patchRecord, withDetachedTxn } from "./table-helpers.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
 import { wrapUntrusted } from "./content-safety.js";
+import { resolveReadScope } from "./memory-read-scope.js";
+import { cosineSimilarity } from "./dedup.js";
 import { isRerankEnabled, getRerankTopN, getRerankBudgetMs, getRerankMinCandidates, rerankCandidates, } from "./rerank-provider.js";
 // Temporal decay + relevance scoring (incl. the OPS-AYGD retrievalBoost cap +
 // relevance floor) lives in ./scoring.ts — a Harper-free module so it can be
@@ -28,8 +30,9 @@ export class SemanticSearch extends Resource {
     // Self-authorize via the Ed25519 agent verify instead of relying on the auth
     // gate's admin super_user elevation (removed in the auth reshape). Any
     // cryptographically-verified agent may search; per-agent RESULT scoping is
-    // enforced in post() below (an agent only sees its own + office-visible +
-    // granted memories). Without this, Harper's default denies the POST for the
+    // enforced in post() below (an agent only sees its own memories, any
+    // visibility, plus granted owners' SHARED memories — never their private
+    // ones). Without this, Harper's default denies the POST for the
     // least-privilege flair_agent role (AccessViolation 403).
     async allowCreate() {
         return allowVerified(this.getContext?.());
@@ -77,21 +80,13 @@ export class SemanticSearch extends Resource {
         const agentId = (authenticatedAgent && !callerIsAdmin)
             ? authenticatedAgent
             : bodyAgentId;
-        const searchAgentIds = new Set();
-        if (agentId)
-            searchAgentIds.add(agentId);
-        if (agentId) {
-            try {
-                for await (const grant of databases.flair.MemoryGrant.search({
-                    conditions: [{ attribute: "granteeId", comparator: "equals", value: agentId }],
-                })) {
-                    if (grant.scope === "search" || grant.scope === "read") {
-                        searchAgentIds.add(grant.ownerId);
-                    }
-                }
-            }
-            catch { /* MemoryGrant may not exist */ }
-        }
+        // Read-scope: own (any visibility) + granted owners' SHARED memories only
+        // (ops-2dm3 Layer 1). Centralized in resolveReadScope() — this used to be
+        // an inline grant-resolution loop here PLUS a `visibility === "office"`
+        // global OR-clause below that leaked ANY authenticated agent's read of
+        // ANY other agent's office-visible memories (ops-nzxa). Both are gone;
+        // this is the ONE scoping resolution for this endpoint now.
+        const scope = agentId ? await resolveReadScope(agentId) : null;
         // Generate query embedding
         let qEmb = queryEmbedding;
         if (!qEmb && q) {
@@ -135,21 +130,12 @@ export class SemanticSearch extends Resource {
         }
         // ─── Build conditions for Harper query ──────────────────────────────────
         const conditions = [];
-        // Agent scoping: filter to allowed agent IDs or office-visible memories
-        if (searchAgentIds.size === 1) {
-            const [id] = searchAgentIds;
-            conditions.push({
-                operator: "or",
-                conditions: [
-                    { attribute: "agentId", comparator: "equals", value: id },
-                    { attribute: "visibility", comparator: "equals", value: "office" },
-                ],
-            });
-        }
-        else if (searchAgentIds.size > 1) {
-            const agentConditions = [...searchAgentIds].map(id => ({ attribute: "agentId", comparator: "equals", value: id }));
-            agentConditions.push({ attribute: "visibility", comparator: "equals", value: "office" });
-            conditions.push({ operator: "or", conditions: agentConditions });
+        // Agent scoping: own (any visibility) OR granted-owner's SHARED memories
+        // (private-exclusion) — the centralized read-scope condition. No agentId
+        // → no scoping condition pushed (trusted internal call / admin without a
+        // target agentId — matches the pre-existing unscoped fallback).
+        if (scope) {
+            conditions.push(scope.condition);
         }
         // Exclude archived records. Use "not_equal" (Harper v5 comparator) instead of
         // "equals false" so records without the archived field are included.
@@ -220,6 +206,10 @@ export class SemanticSearch extends Resource {
                         continue;
                     if (asOf && record.validTo && record.validTo <= asOf)
                         continue;
+                    // ops-9rc6: unconditional past-validTo exclusion (see legacy HNSW
+                    // loop below for the full rationale) — applies regardless of asOf.
+                    if (record.validTo && Date.parse(record.validTo) < Date.now())
+                        continue;
                     semRecords.push(record);
                     semIds.push(record.id);
                 }
@@ -325,7 +315,58 @@ export class SemanticSearch extends Resource {
                     continue;
                 if (asOf && record.validTo && record.validTo <= asOf)
                     continue;
-                const semanticScore = distanceToSimilarity(record.$distance ?? 1);
+                // ops-9rc6: a past validTo ALWAYS means the record has been closed out
+                // (server supersede path — Memory.ts closeSupersededRecord — sets
+                // validTo without necessarily setting `archived`). Unconditional, not
+                // gated on `asOf`, so a server-superseded record can't resurface in
+                // the DEFAULT recall path just because its successor isn't
+                // co-present in this result set (the supersededIds filter further
+                // down only catches co-presence). A record with no validTo, or a
+                // future validTo, is unaffected.
+                if (record.validTo && Date.parse(record.validTo) < Date.now())
+                    continue;
+                let semanticScore;
+                if (record.$distance !== undefined) {
+                    semanticScore = distanceToSimilarity(record.$distance);
+                }
+                else {
+                    // ─── ops-syzm: Harper's cosine-sort query omits $distance for a
+                    // SINGLETON post-filter result set — the SAME quirk root-caused and
+                    // fixed for the dedup path in ops-ume4 (resources/Memory.ts
+                    // findConservativeDedupMatch / resources/dedup.ts cosineSimilarity).
+                    // Sort ORDER is still correct; only the numeric `$distance`
+                    // annotation is missing on that one record, regardless of the
+                    // query's own `limit` (reproduced here with candidateLimit=50, not
+                    // just limit=1 — the trigger is the post-filter MATCH COUNT, not the
+                    // requested limit).
+                    //
+                    // ops-2dm3 Layer 1 made this common: the no-grants agent scope used
+                    // to ALWAYS be a compound `{operator:"or", conditions:[{agentId},
+                    // {visibility=="office"}]}` condition; resolveReadScope() now emits
+                    // a PLAIN single `{agentId==X}` condition for the common (no-grants)
+                    // case, so a scoped search against an agent with exactly one
+                    // matching memory hits this Harper quirk directly. Before, the OR
+                    // wrap incidentally avoided the singleton shape. The old `?? 1`
+                    // fallback silently collapsed this to similarity 0 — read by
+                    // callers (including the clean-VM CI gate's single-memory init
+                    // probe, #533) as "embeddings not loaded", which is WRONG:
+                    // embeddings ARE loaded, only the score was computed incorrectly.
+                    //
+                    // Fix: point-lookup the record by id (a plain get(), unaffected by
+                    // the sort-query quirk — selecting "embedding" directly on the SAME
+                    // sort-by-embedding query comes back as a bare scalar per ops-ume4's
+                    // findings) and compute cosine similarity ourselves in JS from its
+                    // real stored `embedding` vector against this query's `qEmb`, via
+                    // the same math as the ume4 fallback (dedup.ts's cosineSimilarity).
+                    // Only done on this (rare) undefined-$distance branch — never adds
+                    // a point-lookup to the normal per-record path. If the stored
+                    // embedding is missing/empty (e.g. a legacy pre-embedding record),
+                    // cosineSimilarity returns 0 — the same safe "no match" the old
+                    // `?? 1` fallback produced, never a false-high score.
+                    const full = await withDetachedTxn(ctx, () => databases.flair.Memory.get(record.id));
+                    const storedEmbedding = Array.isArray(full?.embedding) ? full.embedding : [];
+                    semanticScore = cosineSimilarity(qEmb, storedEmbedding);
+                }
                 let keywordHit = false;
                 if (q && String(record.content || "").toLowerCase().includes(String(q).toLowerCase())) {
                     keywordHit = true;
@@ -364,6 +405,10 @@ export class SemanticSearch extends Resource {
                     continue;
                 if (asOf && record.validTo && record.validTo <= asOf)
                     continue;
+                // ops-9rc6: unconditional past-validTo exclusion (see legacy HNSW
+                // loop above for the full rationale) — applies regardless of asOf.
+                if (record.validTo && Date.parse(record.validTo) < Date.now())
+                    continue;
                 let keywordHit = false;
                 if (q && String(record.content || "").toLowerCase().includes(String(q).toLowerCase())) {
                     keywordHit = true;

package/dist/resources/Soul.js

@@ -1,5 +1,5 @@
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth } from "./agent-auth.js";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
 const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
 /**
@@ -19,6 +19,17 @@ async function enforceWriteAuth(self, data) {
     return null;
 }
 export class Soul extends databases.flair.Soul {
+    /**
+     * Self-authorize now that the global gate is non-rejecting. Closes the P0
+     * leak: Harper routes `GET /Soul/<id>` to get() and the collection
+     * describe (`GET /Soul`) to a path outside search()/allow* — neither was
+     * gated before this fix, so an anonymous caller got a 200 with full soul
+     * content. Deliberately NO get() override / per-agent scoping on top of
+     * this: souls are identity/discovery data, intentionally readable by any
+     * verified agent — same posture as Agent.ts's allowRead. Write ownership
+     * is unaffected — enforceWriteAuth() below already gates post()/put().
+     */
+    allowRead() { return allowVerified(this.getContext?.()); }
     async post(content, context) {
         const denied = await enforceWriteAuth(this, content);
         if (denied)