@tpsdev-ai/flair 0.20.0 → 0.21.0

package/dist/rem/restore.js

@@ -213,7 +213,7 @@ export async function applySnapshot(opts) {
     //    Catches silent failures: Harper schema coercion, 4xx responses the
     //    apiCall layer masked as ok, partial-DELETE leftovers. Per-ID diff,
     //    not just counts — count parity can hide simultaneous PUT+DELETE
-    //    failures that wash out numerically. See ops-90dq.
+    //    failures that wash out numerically.
     if (opts.verifyPostRestore !== false) {
         try {
             const verifyMem = asArray(await opts.apiCall("GET", `/Memory?agentId=${encodeURIComponent(opts.agentId)}`));

package/dist/resources/Admin.js

@@ -7,7 +7,7 @@ import { allowAdmin } from "./agent-auth.js";
  * they hit a 404 and assume the admin UI is broken. The dashboard is the
  * canonical landing surface; redirect there.
  *
- * allowRead()=allowAdmin (ops-oox7 defense-in-depth): the /Admin* pathname
+ * allowRead()=allowAdmin (defense-in-depth): the /Admin* pathname
  * gate in auth-middleware.ts only 401s when there's NO Authorization header
  * at all (or Basic creds don't resolve to a real user) — a validly-verified
  * TPS-Ed25519 agent that is NOT an admin, or a valid-but-non-super_user Basic

package/dist/resources/AdminConnectors.js

@@ -4,7 +4,7 @@ import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminConnectors — OAuth clients and active sessions.
  *
- * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
+ * allowRead()=allowAdmin (defense-in-depth): see Admin.ts.
  */
 export class AdminConnectors extends Resource {
     async allowRead() {

package/dist/resources/AdminDashboard.js

@@ -4,7 +4,7 @@ import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminDashboard — admin home page with system overview.
  *
- * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts for why
+ * allowRead()=allowAdmin (defense-in-depth): see Admin.ts for why
  * this closes a real gap, not just belt-and-suspenders — a verified
  * non-admin agent could otherwise read full instance stats (principal/agent/
  * memory/relationship counts) with no admin check at all.

package/dist/resources/AdminIdp.js

@@ -4,7 +4,7 @@ import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminIdp — enterprise IdP configuration management.
  *
- * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
+ * allowRead()=allowAdmin (defense-in-depth): see Admin.ts.
  */
 export class AdminIdp extends Resource {
     async allowRead() {

package/dist/resources/AdminInstance.js

@@ -85,7 +85,7 @@ function resolveVersion() {
 /**
  * GET /AdminInstance — instance info, public key, version.
  *
- * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
+ * allowRead()=allowAdmin (defense-in-depth): see Admin.ts.
  */
 export class AdminInstance extends Resource {
     async allowRead() {

package/dist/resources/AdminMemory.js

@@ -21,7 +21,7 @@ import { allowAdmin } from "./agent-auth.js";
  * makes that legible: every memory shows where it came from, what it derived
  * from, what it superseded, and which peer it synced from.
  *
- * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts — this
+ * allowRead()=allowAdmin (defense-in-depth): see Admin.ts — this
  * page surfaces full memory content across ALL agents, so the gap it closes
  * matters more here than on the other Admin* pages.
  */
@@ -31,7 +31,7 @@ export class AdminMemory extends Resource {
     }
     async get() {
         // Harper v5 does not populate this.request on Resource subclasses —
-        // getContext() is the only reliable path (ops-sal4: the previous
+        // getContext() is the only reliable path (the previous
         // `(this as any).request` read was always undefined, so query params
         // (?id=, ?q=, ?subject=, ?limit=) were always ignored).
         const ctx = this.getContext?.();

package/dist/resources/AdminPrincipals.js

@@ -4,7 +4,7 @@ import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminPrincipals — list all principals with kind, trust, status.
  *
- * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
+ * allowRead()=allowAdmin (defense-in-depth): see Admin.ts.
  */
 export class AdminPrincipals extends Resource {
     async allowRead() {

package/dist/resources/Agent.js

@@ -1,5 +1,6 @@
 import { databases } from "@harperfast/harper";
 import { resolveAgentAuth, allowVerified, allowAdmin } from "./agent-auth.js";
+import { localInstanceId } from "./instance-identity.js";
 /**
  * Agent resource — serves as the Principal table in 1.0.
  *
@@ -40,6 +41,14 @@ export class Agent extends databases.flair.Agent {
         }
         content.createdAt = now;
         content.updatedAt = now;
+        // Write-time originatorInstanceId stamp (federation-edge-hardening slice
+        // 1) — see resources/Memory.ts's stampOriginatorInstanceId doc for the
+        // full contract. No-op if already set (never fires for a genuine local
+        // write; a federation-synced record never reaches this method — the
+        // merge path writes via the raw table object, bypassing this class).
+        if (content.originatorInstanceId == null) {
+            content.originatorInstanceId = await localInstanceId();
+        }
         return super.post(content, context);
     }
     async put(content) {
@@ -64,6 +73,11 @@ export class Agent extends databases.flair.Agent {
         // Protect immutable fields
         delete content.createdAt;
         delete content.publicKey; // key rotation goes through dedicated endpoint
+        // Write-time originatorInstanceId stamp — see post() above / Memory.ts's
+        // stampOriginatorInstanceId doc. No-op if already set.
+        if (content.originatorInstanceId == null) {
+            content.originatorInstanceId = await localInstanceId();
+        }
         return super.put(content);
     }
 }

package/dist/resources/AgentCard.js

@@ -29,7 +29,7 @@ export class AgentCard extends Resource {
         return {
             name: String(agent.name ?? agent.id ?? agentId),
             // Only an explicit kind="description" soul publishes — no private-soul
-            // fallback (ops-vz6j). See agentcard-fields.ts for the security rationale.
+            // fallback. See agentcard-fields.ts for the security rationale.
             description: selectPublicDescription(souls),
             url: String(agent.url ?? ""),
             version: String(agent.version ?? "1.0.0"),

package/dist/resources/AgentSeed.js

@@ -40,7 +40,7 @@ export class AgentSeed extends Resource {
     }
     async post(data) {
         // Harper v5 does not populate this.request on Resource subclasses —
-        // getContext() is the only reliable path (ops-sal4: the previous
+        // getContext() is the only reliable path (the previous
         // `(this as any).request` read was always undefined, so actorId was always
         // undefined and this belt-and-suspenders check fail-closed every request,
         // even from a real admin already verified by allowCreate()).

package/dist/resources/Federation.js

@@ -1,16 +1,41 @@
 import { Resource, databases, server } from "@harperfast/harper";
 import { randomBytes } from "node:crypto";
 import nacl from "tweetnacl";
-import { canonicalize, signBody, verifyBodySignature, signBodyFresh, verifyBodySignatureFresh, createNonceStore, generateNonce, } from "./federation-crypto.js";
+import { canonicalize, signBody, verifyBodySignature, signBodyFresh, verifyBodySignatureFresh, generateNonce, } from "./federation-crypto.js";
 import { initFederationCleanup } from "./federation-cleanup.js";
+import { createPersistentNonceStore, initNonceStoreCleanup } from "./federation-nonce-store.js";
 import { classifyRecord } from "./federation-classify.js";
 export { classifyRecord } from "./federation-classify.js";
 // Module-level nonce store for federation anti-replay.
 // Shared across FederationPair + FederationSync — nonces are globally unique
 // (generated by signBodyFresh per request with 128-bit random nonces).
-const federationNonceStore = createNonceStore();
+//
+// Backed by the `Nonce` table (federation-edge-hardening slice 4) so a
+// process restart doesn't wipe recently-seen nonces within the ±30s
+// freshness window — see federation-nonce-store.ts for the full design.
+// The NonceStore interface (has/set/evict) stays synchronous, so this swap
+// requires NO change to verifyBodySignatureFresh or its 2 call sites below.
+const federationNonceStore = createPersistentNonceStore();
 // Re-export for consumers that import from Federation.ts
 export { canonicalize, signBody, verifyBodySignature, signBodyFresh, verifyBodySignatureFresh, generateNonce };
+// ─── Per-record signature enforcement mode (federation-edge-hardening slice 3b) ──
+/**
+ * Whether FederationSync.post requires EVERY record to carry a valid
+ * per-record signature (§3a), skipping unsigned ones (`missing_signature`),
+ * vs. the default "verify-if-present" mode where an unsigned record still
+ * merges (relying on the batch-level signature already verified above it).
+ *
+ * Default OFF (verify-if-present) — pre-3a spokes don't sign individual
+ * records yet, and their batch is already authenticated. Turning this ON
+ * is an OPERATOR decision, never auto-flipped by this code: flip it only
+ * once every paired peer has been confirmed sending per-record signatures
+ * (e.g. by checking SyncLog for unsigned records / peer versions). Flipping
+ * it before every peer has upgraded silently starts dropping that peer's
+ * records instead of merging them.
+ */
+function requireRecordSignatures() {
+    return (process.env.FLAIR_FEDERATION_REQUIRE_RECORD_SIGNATURES ?? "").toLowerCase() === "true";
+}
 // ─── Conflict resolution ─────────────────────────────────────────────────────
 /**
  * Field-level Last-Write-Wins merge.
@@ -293,6 +318,61 @@ export class FederationSync extends Resource {
                     recordSkip(decision.reason);
                     continue;
                 }
+                // ── Per-record signature verification (federation-edge-hardening slice 3b) ──
+                // classifyRecord's "merge" verdict above only proves the record is
+                // STRUCTURALLY eligible (known table, self-originated OR the sender
+                // is a hub, not stale, not a no-op) — that hub bypass trusts the
+                // BATCH-level signature (verifyBodySignatureFresh above, verified
+                // against the SENDER's pinned key). It does NOT prove the record's
+                // *claimed* originator actually produced it — a hub relaying on
+                // behalf of many spokes could otherwise forge a record under any
+                // originatorInstanceId it likes, and the receiver had no way to
+                // tell. This gate closes that hole: verify the record's own
+                // signature (§3a, set at push-time by the ORIGINATOR, never by
+                // whoever relayed it) against the ORIGINATOR's pinned instance key
+                // — never the sender's key.
+                //
+                // A bad/unverifiable signature skips ONLY this record, never the
+                // batch — rejecting the whole batch on one bad record would be a
+                // DoS vector (one forged/garbled record could blackhole every other
+                // legitimate record riding along in the same POST).
+                const originator = decision.originator;
+                if (record.signature) {
+                    const originatorPublicKey = originator === instanceId
+                        ? peer.publicKey
+                        : (await databases.flair.Peer.get(originator))?.publicKey;
+                    if (!originatorPublicKey) {
+                        recordSkip("unknown_originator_key");
+                        continue;
+                    }
+                    // CONTRACT — must match src/cli.ts runFederationSyncOnce's signing
+                    // payload byte-for-byte: keys { v, table, id, data, updatedAt,
+                    // originatorInstanceId }. canonicalize() sorts keys, so field ORDER
+                    // doesn't matter, but the field SET and values do. `v: 1` versions
+                    // the canonical form itself — bump it on BOTH sides together if the
+                    // signed field set ever changes, so an old signature fails closed
+                    // instead of silently mis-verifying under a new form.
+                    const signatureValid = verifyBodySignature({
+                        v: 1,
+                        table: record.table,
+                        id: record.id,
+                        data: record.data,
+                        updatedAt: record.updatedAt,
+                        originatorInstanceId: originator,
+                        signature: record.signature,
+                    }, originatorPublicKey);
+                    if (!signatureValid) {
+                        recordSkip("invalid_signature");
+                        continue;
+                    }
+                }
+                else if (requireRecordSignatures()) {
+                    // require-mode: unsigned records are no longer trusted on
+                    // batch-level auth alone. Default mode (verify-if-present) falls
+                    // through here and merges — see requireRecordSignatures() above.
+                    recordSkip("missing_signature");
+                    continue;
+                }
                 const mergedData = mergeRecord(local, record);
                 mergedData._originatorInstanceId = decision.originator;
                 mergedData._syncedFrom = instanceId;
@@ -405,5 +485,21 @@ if (typeof setTimeout !== "undefined") {
             // Swallow — in test/resource-env the Harper databases may not be bound.
             // In production, initFederationCleanup handles its own error paths.
         });
+        // Nonce store hydration (slice 4) — load nonces persisted by a previous
+        // process (if any) before this instance starts guarding live traffic.
+        // Runs on the same deferred tick as the cleanup sweep above; there is a
+        // narrow window between process start and hydration completing during
+        // which a pre-restart nonce isn't yet visible — an accepted tradeoff
+        // consistent with this file's existing deferred-init pattern (see the
+        // cleanup sweep comment above).
+        federationNonceStore.hydrate().catch((err) => {
+            // Swallow — in test/resource-env the Harper databases may not be bound.
+        });
+        // Nonce table eviction sweep — runs on every instance (both hub and
+        // spoke can be the receiving/verifying side of a signed federation
+        // request), unlike PairingToken cleanup which is hub-only.
+        initNonceStoreCleanup().catch((err) => {
+            // Swallow — in test/resource-env the Harper databases may not be bound.
+        });
     }, 0);
 }

package/dist/resources/IngestEvents.js

@@ -64,7 +64,7 @@ export class IngestEvents extends Resource {
     }
     async post(body, context) {
         // Harper v5 does not populate this.request on Resource subclasses —
-        // getContext() is the only reliable path (ops-sal4: the previous
+        // getContext() is the only reliable path (the previous
         // `(this as any).request` read was always undefined, so authHeader was
         // always undefined and every request 401'd before reaching the office
         // Ed25519 signature check below).

package/dist/resources/Integration.js

@@ -15,7 +15,7 @@ export class Integration extends databases.flair.Integration {
     }
     /**
      * Self-authorize now that the global gate is non-rejecting (memory-soul-
-     * read-gate family fix, ops-oox7 — same pattern as Memory.ts/Soul.ts/
+     * read-gate family fix — same pattern as Memory.ts/Soul.ts/
      * WorkspaceState.ts/Relationship.ts). Closes the same P0 leak: Harper
      * routes `GET /Integration/<id>` to get() and the collection describe
      * (`GET /Integration`) outside search(), so neither was gated before this

package/dist/resources/Memory.js

@@ -1,6 +1,7 @@
 import { databases } from "@harperfast/harper";
 import { patchRecord, withDetachedTxn } from "./table-helpers.js";
 import { isAdmin, resolveAgentAuth, allowVerified } from "./agent-auth.js";
+import { localInstanceId } from "./instance-identity.js";
 import { getEmbedding, getModelId } from "./embeddings-provider.js";
 import { scanFields, isStrictMode } from "./content-safety.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
@@ -15,7 +16,7 @@ const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { s
  * live in ./memory-read-scope.ts — the ONE centralized helper every
  * cross-agent Memory read path (search()/get() here, SemanticSearch.ts,
  * MemoryBootstrap.ts, auth-middleware.ts's by-id guard) resolves its scope
- * through, so the scoping rule cannot drift per-path again (ops-nzxa: a
+ * through, so the scoping rule cannot drift per-path again (a
  * SemanticSearch inline `visibility === "office"` OR-clause leaked office
  * memories to any authenticated agent because the rule had scattered). See
  * that module's doc for the migration invariant (no-visibility-field reads
@@ -86,7 +87,7 @@ async function findConservativeDedupMatch(ctx, agentId, contentText, embedding,
         }
         if (!top)
             return null;
-        // ─── ops-ume4: Harper's cosine-sort query omits $distance for a SINGLETON
+        // ─── Harper's cosine-sort query omits $distance for a SINGLETON
         // result set ─────────────────────────────────────────────────────────────
         // Initial working theory was a per-agentId HNSW "cold-start" (first-ever
         // query cold, second query warm) and the initially-recommended fix was a
@@ -133,7 +134,7 @@ async function findConservativeDedupMatch(ctx, agentId, contentText, embedding,
             cosine = 1 - top.$distance;
         }
         else {
-            console.error("Memory.findConservativeDedupMatch: $distance undefined on a singleton cosine result (ops-ume4) — " +
+            console.error("Memory.findConservativeDedupMatch: $distance undefined on a singleton cosine result — " +
                 "falling back to a manual cosine computation from the candidate's stored embedding", { agentId, candidateId: top.id });
             const fullCandidate = await withDetachedTxn(ctx, () => databases.flair.Memory.get(top.id));
             const candidateEmbedding = Array.isArray(fullCandidate?.embedding) ? fullCandidate.embedding : [];
@@ -209,7 +210,7 @@ function buildWriteResponse(content, result, dedupMatch) {
  * detachment discipline as findConservativeDedupMatch (each discrete Harper
  * call individually wrapped — see withDetachedTxn's doc for why a single
  * wrap around a multi-await async function would not protect the later
- * call). Does NOT swallow failures (ops-a4t5 fix) — throws so the caller can
+ * call). Does NOT swallow failures — throws so the caller can
  * log it. Never called before the new record is already written.
  */
 async function closeSupersededRecord(ctx, oldId, patch) {
@@ -273,7 +274,7 @@ async function validateAndAuthorizeSupersedes(content, auth) {
 }
 /**
  * Close the superseded record — called AFTER the new record has already been
- * written (write-new-BEFORE-close-old, ops-a4t5 fix). Safe failure state is
+ * written (write-new-BEFORE-close-old). Safe failure state is
  * two active records (recoverable), never a tombstoned-old-with-lost-new.
  * Failure is logged (observable), never silently swallowed. No-op if
  * `content.supersedes` is not set.
@@ -293,11 +294,11 @@ async function closeSupersededIfNeeded(ctx, content, methodLabel) {
         // `err` arg) would let an id containing %s/%o consume/hide the real error
         // (semgrep unsafe-formatstring). Keep all dynamic values in the data object.
         console.error("Memory.closeSuperseded: failed to close superseded record after writing new record " +
-            "(ops-a4t5 — observable, not silent; new record is safely written, old record remains active until retried)", { method: methodLabel, supersededId: content.supersedes, newRecordId: content.id, err });
+            "(observable, not silent; new record is safely written, old record remains active until retried)", { method: methodLabel, supersededId: content.supersedes, newRecordId: content.id, err });
     }
 }
 /**
- * ─── Durability-keyed default visibility (ops-2dm3 Layer 1, part A) ─────────
+ * ─── Durability-keyed default visibility (Layer 1, part A) ─────────────────
  *
  * Writer intent: an explicit `visibility` on the write ALWAYS overrides this
  * (callers check `content.visibility == null` before calling this). When
@@ -310,6 +311,89 @@ async function closeSupersededIfNeeded(ctx, content, methodLabel) {
 function defaultVisibilityForDurability(durability) {
     return durability === "permanent" || durability === "persistent" ? "shared" : "private";
 }
+/**
+ * ─── Write-time provenance stamp (memory-provenance slice 1) ────────────────
+ *
+ * Foundational capture for an emergent-trust model: every Memory write gets a
+ * structured, versioned `provenance` JSON blob recording what the server can
+ * actually VERIFY about the write, plus (optionally) what the caller merely
+ * CLAIMS. Deliberately minimal — verified fields only:
+ *
+ *   { v: 1,
+ *     verified: { agentId: <string|null>, timestamp: <ISO string> },
+ *     claimed?: { model: <string> } }
+ *
+ * - `verified.agentId` comes from the ALREADY-RESOLVED auth verdict
+ *   (resolveAgentAuth) — never from anything the caller can forge on the
+ *   request body. `kind: "agent"` → the Ed25519-verified agentId. Any other
+ *   verdict (in practice only `kind: "internal"` — a trusted in-process call
+ *   with no per-agent identity to attribute) stamps `null` rather than
+ *   throwing; `kind: "anonymous"` never reaches here — both post()/put()
+ *   already 401 it before this point.
+ * - `verified.timestamp` reuses the server-clock `createdAt` the caller has
+ *   already computed by this point (never client-suppliable) — the same
+ *   "stamp a dynamic attribute the server controls" mechanism as the existing
+ *   `embeddingModel = getModelId()` stamp elsewhere in this file. NOTE: the
+ *   *signed* Ed25519 request timestamp is also available (it's verified in
+ *   auth-middleware) but currently discarded there rather than threaded
+ *   through to resource methods — a future slice can carry it alongside (or
+ *   instead of) this server-clock timestamp without changing this shape's
+ *   `v: 1` contract. Not done here to keep auth-middleware untouched.
+ * - `claimed.model` is an OPTIONAL, UNVERIFIED passthrough: included only
+ *   when the incoming write payload itself already carries a non-empty
+ *   string `model` field. No client/CLI sets one today — this just means the
+ *   server won't discard it if/when a future write path does. Never
+ *   invented, never defaulted, and the `claimed` key is omitted entirely
+ *   (not stamped as `{}`) when absent.
+ *
+ * Deliberately NOT implemented in this slice: a context-fingerprint field —
+ * bootstrap doesn't return the IDs a fingerprint would need, so it requires
+ * client cooperation that's out of scope here.
+ */
+function buildProvenance(auth, createdAt, content) {
+    const provenance = {
+        v: 1,
+        verified: {
+            agentId: auth.kind === "agent" ? auth.agentId : null,
+            timestamp: createdAt,
+        },
+    };
+    if (typeof content?.model === "string" && content.model.length > 0) {
+        provenance.claimed = { model: content.model };
+    }
+    return JSON.stringify(provenance);
+}
+/**
+ * ─── Write-time originatorInstanceId stamp (federation-edge-hardening slice 1) ──
+ *
+ * Stamps this instance's own federation identity (resources/instance-
+ * identity.ts's localInstanceId(), cached — never a DB read per write) onto
+ * every LOCAL write. Deliberately a no-op when `content.originatorInstanceId`
+ * already carries a non-null value: this is the anti-clobber rule that keeps
+ * a federation-synced record's true origin intact.
+ *
+ * Why this can never clobber a synced record: FederationSync.post()
+ * (resources/Federation.ts) merges incoming records via the RAW table object
+ * (`(databases as any).flair.Memory.put(mergedData)`) — Harper's static
+ * table-level put, not this Resource subclass's instance put() below. The
+ * merge path never runs this function at all, so a record arriving from
+ * instance B keeps whatever `originatorInstanceId` it already carried in
+ * `mergedData` (that instance's own write-time stamp, carried through in the
+ * synced row) with no risk of this instance overwriting it with its own id.
+ * The `content.originatorInstanceId == null` guard below is still applied —
+ * defense-in-depth for any future path that might route a synced payload
+ * through this class's post()/put() — so the invariant holds even if that
+ * assumption ever changes.
+ *
+ * `localInstanceId()` resolves to null on an instance that has never been
+ * federation-bootstrapped (no Instance row yet) — the field is nullable by
+ * design, so this stamps null rather than inventing an id.
+ */
+async function stampOriginatorInstanceId(content) {
+    if (content.originatorInstanceId == null) {
+        content.originatorInstanceId = await localInstanceId();
+    }
+}
 export class Memory extends databases.flair.Memory {
     /**
      * Self-authorize now that the global gate is non-rejecting. Closes the P0
@@ -360,8 +444,8 @@ export class Memory extends databases.flair.Memory {
             return super.get(target);
         }
         // Non-admin agent: only its own memories (any visibility), or a granted
-        // owner's SHARED memories — never that owner's private ones (ops-2dm3
-        // Layer 1 private-exclusion). Centralized in resolveReadScope() so this
+        // owner's SHARED memories — never that owner's private ones (Layer 1
+        // private-exclusion). Centralized in resolveReadScope() so this
         // and search() below cannot drift.
         const record = await super.get(target);
         if (!record)
@@ -397,7 +481,7 @@ export class Memory extends databases.flair.Memory {
             return super.search(query);
         }
         // Non-admin agent: scope to own (any visibility) + granted owners' SHARED
-        // memories only (ops-2dm3 Layer 1 private-exclusion). Centralized in
+        // memories only (Layer 1 private-exclusion). Centralized in
         // resolveReadScope() so get() above and search() here cannot drift.
         const authAgent = auth.agentId;
         const scope = await resolveReadScope(authAgent);
@@ -450,7 +534,7 @@ export class Memory extends databases.flair.Memory {
         content.createdAt = new Date().toISOString();
         content.updatedAt = content.createdAt;
         content.archived = content.archived ?? false;
-        // ─── Default visibility (durability-keyed) — ops-2dm3 Layer 1, part A ────
+        // ─── Default visibility (durability-keyed) — Layer 1, part A ────────────
         // post() only ever creates a NEW record — patchRecord/supersede-close/
         // retrievalCount bumps all route through put() instead (see put()'s
         // pre-existing-record guard below), so there is no "don't overwrite an
@@ -488,7 +572,7 @@ export class Memory extends databases.flair.Memory {
             content.expiresAt = new Date(Date.now() + ttlHours * 3600_000).toISOString();
         }
         // Content safety scan — covers content + summary (defense-in-depth for
-        // agent-set summaries, ops-i2jb).
+        // agent-set summaries).
         if (content.content || content.summary) {
             const safety = scanFields(content, ["content", "summary"]);
             if (!safety.safe) {
@@ -525,9 +609,17 @@ export class Memory extends databases.flair.Memory {
                 content.embeddingModel = getModelId();
             }
         }
+        // Write-time provenance stamp (memory-provenance slice 1) — see
+        // buildProvenance's doc above. Stamped last, right before persist, so it
+        // reflects the final resolved `content.createdAt`.
+        content.provenance = buildProvenance(auth, content.createdAt, content);
+        // Write-time originatorInstanceId stamp (federation-edge-hardening slice
+        // 1) — see stampOriginatorInstanceId's doc above. No-op if already set
+        // (never fires for a genuine local write — no client sets this field).
+        await stampOriginatorInstanceId(content);
         // ── Write the new record FIRST ──────────────────────────────────────────
         const result = await super.post(content);
-        // ── THEN close the superseded record (ops-a4t5 fix) ─────────────────────
+        // ── THEN close the superseded record ────────────────────────────────────
         // Write-new-BEFORE-close-old: the previous order (close-old via a fire-
         // and-forget `.catch(()=>{})` BEFORE the new write) could tombstone the
         // old record and then lose the new one if the write failed afterward.
@@ -582,7 +674,7 @@ export class Memory extends databases.flair.Memory {
         // visibility stamped) or an update/patch (dedup-bypassed, visibility left
         // untouched). See the dedup-gate block further down for why an existing
         // id skips the gate; the SAME "does a record already exist" check gates
-        // the visibility default (ops-2dm3 Layer 1 part A): patchRecord/supersede-
+        // the visibility default (Layer 1 part A): patchRecord/supersede-
         // close/retrievalCount bumps all route through put() with a MERGED
         // `{...existing, ...patch}` payload, and must never have their stored
         // visibility overwritten by a default recomputed from that merged content
@@ -590,7 +682,7 @@ export class Memory extends databases.flair.Memory {
         const preExisting = content.id
             ? await databases.flair.Memory.get(content.id).catch(() => null)
             : null;
-        // ─── Default visibility (durability-keyed) — ops-2dm3 Layer 1, part A ────
+        // ─── Default visibility (durability-keyed) — Layer 1, part A ────────────
         // Explicit visibility on the write ALWAYS overrides; only stamp the
         // default when the caller left it unset AND this is a fresh record.
         // permanent|persistent → shared; standard|ephemeral|absent → private.
@@ -607,7 +699,7 @@ export class Memory extends databases.flair.Memory {
         if (content.supersedes && !content.validFrom) {
             content.validFrom = content.createdAt;
         }
-        // Content safety scan on updated content + summary (ops-i2jb).
+        // Content safety scan on updated content + summary.
         if (content.content || content.summary) {
             const safety = scanFields(content, ["content", "summary"]);
             if (!safety.safe) {
@@ -674,9 +766,23 @@ export class Memory extends databases.flair.Memory {
         if (content.promotionStatus === "approved") {
             content.durability = "permanent";
         }
+        // Write-time provenance stamp (memory-provenance slice 1) — see
+        // buildProvenance's doc above post(). Applies to every put() (fresh
+        // create AND update/patch) — never gated on preExisting, so an update
+        // always gets a freshly-stamped provenance reflecting the CURRENT
+        // authenticated actor performing this write.
+        content.provenance = buildProvenance(auth, content.createdAt, content);
+        // Write-time originatorInstanceId stamp (federation-edge-hardening slice
+        // 1) — see stampOriginatorInstanceId's doc above post(). No-op if
+        // already set: an update/patch of an existing local record carries its
+        // own already-stamped originatorInstanceId forward unchanged (the
+        // `{...existing, ...patch}` merge pattern every put() caller uses), and a
+        // federation-synced record never reaches this method at all (see that
+        // function's doc for why the merge path can't clobber it here either).
+        await stampOriginatorInstanceId(content);
         // ── Write the new/updated record FIRST ──────────────────────────────────
         const result = await super.put(content);
-        // ── THEN close the superseded record (ops-a4t5 fix; see post()) ────────
+        // ── THEN close the superseded record (see post()) ───────────────────────
         await closeSupersededIfNeeded(ctx, content, "put");
         return buildWriteResponse(content, result, dedupMatch);
     }