@tpsdev-ai/flair 0.20.0 → 0.21.0

package/dist/resources/MemoryBootstrap.js

@@ -14,17 +14,19 @@ import { resolveReadScope } from "./memory-read-scope.js";
  *   3. Recent memories (adaptive window)
  *   4. Task-relevant memories (semantic search if currentTask provided)
  *   4b. Teammate findings relevant to your task (flair#550 — the SAME scored
- *      task-relevant set as #4, split by origin: a grant-visible teammate's
- *      SHARED memory that scores against currentTask lands here instead of
- *      #4, attributed via "[via <agentId>]". Presentation only — what's
- *      readable is entirely Layer 1's resolveReadScope()/ops-2dm3; this only
- *      changes how an already-read cross-agent record is formatted/sectioned)
+ *      task-relevant set as #4, split by origin: any other in-org agent's
+ *      NON-PRIVATE memory that scores against currentTask lands here instead
+ *      of #4, attributed via "[via <agentId>]" — no MemoryGrant required
+ *      (open-within-org read, per #578). Presentation only — what's readable
+ *      is entirely resolveReadScope()'s job; this only changes how an
+ *      already-read cross-agent record is formatted/sectioned)
  *   5. Relationship context (active relationships for mentioned entities)
  *   6. Predicted context (based on channel/surface/subject hints)
  *   7. Team roster (other active agents in this office + a search-first nudge —
- *      bootstrap loads the caller's own memories plus any granted owner's
- *      SHARED memories (ops-2dm3 Layer 1, never their private ones), so this
- *      section nudges toward memory_search for anything beyond that window)
+ *      bootstrap loads the caller's own memories plus every other in-org
+ *      agent's non-private memories (open-within-org read, never anyone's
+ *      private ones), so this section nudges toward memory_search for
+ *      anything beyond that window)
  *
  * Prediction: when context signals (channel, surface, subjects) are provided,
  * the bootstrap loads more aggressively — Flair is fast enough that the
@@ -199,9 +201,10 @@ export class BootstrapMemories extends Resource {
         }
         // --- 1c. Team roster + cross-agent search nudge ---
         // Soul is still caller-own-only (unaffected here). Memory loading below
-        // (step 2) now also includes granted owners' SHARED memories (ops-2dm3
-        // Layer 1) — but this section stays: memory_search/SemanticSearch remains
-        // the deliberate, query-driven way to find a teammate's finding, vs.
+        // (step 2) now also includes every other in-org agent's non-private
+        // memories (open-within-org read, no MemoryGrant needed — #578) — but
+        // this section stays: memory_search/SemanticSearch remains the
+        // deliberate, query-driven way to find a teammate's finding, vs.
         // bootstrap's fixed recent/permanent window. This section is fixed-cost
         // (no query text to format per agent) so it's cheap enough to always
         // include, not budgeted.
@@ -225,14 +228,18 @@ export class BootstrapMemories extends Resource {
             // Agent table may not exist in older / standalone deployments
         }
         // --- 2. Permanent memories (always included, highest priority) ---
-        // Read-scope: own (any visibility) + granted owners' SHARED memories only
-        // (ops-2dm3 Layer 1 — never a granted owner's private ones). Centralized
-        // in resolveReadScope(): the condition is pushed into the Harper query
-        // (so the table itself never returns an out-of-scope row), and
-        // `scope.isAllowed` re-checks in-process as defense-in-depth (same
-        // belt-and-suspenders discipline as SemanticSearch's BM25 pre-fusion
-        // filter) — this is the #550 foundation: bootstrap can now safely expand
-        // beyond own-only without a parallel scoping rule.
+        // Read-scope: own (any visibility) + every OTHER in-org agent's
+        // non-private memory — open-within-org read (#578), no MemoryGrant
+        // consulted at all. Centralized in resolveReadScope(): the condition is
+        // pushed into the Harper query (so the table itself never returns an
+        // out-of-scope row), and `scope.isAllowed` re-checks in-process as
+        // defense-in-depth (same belt-and-suspenders discipline as
+        // SemanticSearch's BM25 pre-fusion filter) — this is the #550 foundation:
+        // bootstrap can now safely expand beyond own-only without a parallel
+        // scoping rule, and that rule tracks resolveReadScope()'s model
+        // automatically (grant-gated when #568 first built this, open-within-org
+        // now that #578 has landed — this file never re-implements the rule, so
+        // it never has to change when the rule does).
         const scope = await resolveReadScope(agentId);
         const allMemories = [];
         for await (const record of databases.flair.Memory.search({ conditions: [scope.condition] })) {
@@ -240,18 +247,19 @@ export class BootstrapMemories extends Resource {
                 continue;
             if (record.expiresAt && Date.parse(record.expiresAt) < Date.now())
                 continue;
-            // ops-hesq: a past validTo ALWAYS means the record has been closed out
+            // A past validTo ALWAYS means the record has been closed out
             // (server supersede path — Memory.ts closeSupersededRecord — sets
             // validTo without necessarily setting `archived`), same root cause and
-            // fix as ops-9rc6's SemanticSearch/bm25-filter exclusion. Unconditional
+            // fix as SemanticSearch.ts's unconditional past-validTo/bm25-filter
+            // exclusion. Unconditional
             // so a server-superseded record can't resurface in bootstrap just
             // because its successor isn't co-present in this result set (the
             // supersededIds filter further down only catches co-presence). A
             // record with no validTo, or a future validTo, is unaffected.
             if (record.validTo && Date.parse(record.validTo) < Date.now())
                 continue;
-            // Attribution for cross-agent (granted-owner) records — same convention
-            // SemanticSearch.ts already uses: formatMemory() below only USES this
+            // Attribution for cross-agent (any other in-org agent's) records — same
+            // convention SemanticSearch.ts already uses: formatMemory() below only USES this
             // when the record also carries _safetyFlags (labels the untrusted-data
             // wrapper with whose memory it is), it never forces wrapping on its own.
             // Real Harper's search() results are non-extensible objects — mutating
@@ -268,11 +276,12 @@ export class BootstrapMemories extends Resource {
         }
         const activeMemories = allMemories.filter((m) => !supersededIds.has(m.id));
         // #550 design boundary: the permanent / recent / predicted sections are the
-        // agent's OWN working context — own-only, always. Post-Layer-1
-        // `activeMemories` also carries grant-visible teammate records (`_source`
-        // set), but grant-visibility exists to feed the task-relevant "Teammate
-        // findings" surfacing (#550) below, NOT to blend a teammate's memories into
-        // the reader's recent/permanent/predicted view. So these three sections
+        // agent's OWN working context — own-only, always. `activeMemories` also
+        // carries every other in-org agent's non-private records (`_source` set,
+        // open-within-org read — no grant involved), but that cross-agent
+        // visibility exists to feed the task-relevant "Teammate findings"
+        // surfacing (#550) below, NOT to blend a teammate's memories into the
+        // reader's recent/permanent/predicted view. So these three sections
         // filter to own (`!m._source`); team knowledge surfaces only when
         // task-relevant (the teammate section) or via an explicit memory_search.
         const ownMemories = activeMemories.filter((m) => !m._source);
@@ -419,13 +428,14 @@ export class BootstrapMemories extends Resource {
                     .filter((s) => s.score > 0.3)
                     .sort((a, b) => b.score - a.score);
                 // #550: split the scored, task-relevant set by origin. Own findings
-                // go to `relevant` as before; a teammate's (grant-visible, already
-                // read-scoped by Layer 1 — `m._source` is only ever set for a
-                // cross-agent record, see the allMemories loop above) go to the new
-                // `teammate` section so the agent can tell it apart at a glance.
-                // Both draw from the SAME `tokenBudget` in one score-ordered pass —
-                // highest-relevance memories win the remaining budget regardless of
-                // which section they land in, so neither section double-spends.
+                // go to `relevant` as before; any other in-org agent's non-private
+                // record — already read-scoped by resolveReadScope(), no grant
+                // required (`m._source` is only ever set for a cross-agent record,
+                // see the allMemories loop above) — goes to the new `teammate`
+                // section so the agent can tell it apart at a glance. Both draw from
+                // the SAME `tokenBudget` in one score-ordered pass — highest-relevance
+                // memories win the remaining budget regardless of which section they
+                // land in, so neither section double-spends.
                 for (const { memory: m } of scored) {
                     const line = formatMemory(m, agentId);
                     const cost = estimateTokens(line);
@@ -499,7 +509,7 @@ export class BootstrapMemories extends Resource {
         }
         // #550: teammate findings relevant to the current task — right after the
         // agent's own task-relevant knowledge. Empty section renders nothing
-        // (no header) so a bootstrap with no grant-visible teammate findings for
+        // (no header) so a bootstrap with no task-relevant teammate findings for
         // this task looks exactly as it did before this feature.
         if (sections.teammate.length > 0) {
             parts.push("## Teammate findings relevant to your task\n" + sections.teammate.join("\n"));

package/dist/resources/MemoryGrant.js

@@ -19,7 +19,7 @@ export class MemoryGrant extends databases.flair.MemoryGrant {
     }
     /**
      * Self-authorize now that the global gate is non-rejecting (memory-soul-
-     * read-gate family fix, ops-oox7 — same pattern as Memory.ts/Soul.ts/
+     * read-gate family fix — same pattern as Memory.ts/Soul.ts/
      * WorkspaceState.ts/Relationship.ts/Integration.ts). Closes the same P0
      * leak: Harper routes `GET /MemoryGrant/<id>` to get() and the collection
      * describe (`GET /MemoryGrant`) outside search(), so neither was gated

package/dist/resources/OAuth.js

@@ -35,6 +35,27 @@ function nowISO() {
 function futureISO(ms) {
     return new Date(Date.now() + ms).toISOString();
 }
+/**
+ * 302 redirect — deliberately NOT `Response.redirect()`.
+ *
+ * FOUND while writing the real-Harper integration test for #604 (this exact
+ * gap is why the coverage doc above calls OAuthAuthorize.post() untestable
+ * without a running Harper instance — no test had ever hit this path over
+ * real HTTP before). Pre-existing on main, unrelated to the #604 auth fix:
+ * per the Fetch spec, `Response.redirect(url, status)` constructs a Response
+ * whose Headers guard is set to "immutable". Harper's own HTTP response
+ * pipeline mutates the handler's returned Response's headers afterward (e.g.
+ * CORS/instrumentation headers) — against an immutable-guarded Headers this
+ * throws `TypeError: immutable`, turning EVERY real POST /OAuthAuthorize
+ * (both "deny" and "approve") into a 500, verified via curl against a built
+ * origin/main with no other changes. A manually-constructed Response with
+ * the same status/Location header has the default (mutable) "response"
+ * guard, so Harper's later mutation succeeds — identical bytes on the wire,
+ * no behavior change, just a mutable Headers object underneath.
+ */
+function redirectTo(url, status = 302) {
+    return new Response(null, { status, headers: { Location: url } });
+}
 // ─── Discovery metadata ──────────────────────────────────────────────────────
 export class OAuthMetadata extends Resource {
     // OAuth discovery metadata is intentionally public — RFC 8414 § 3 requires
@@ -123,7 +144,7 @@ export class OAuthAuthorize extends Resource {
         // In 1.0, this returns a simple HTML consent page.
         // The user (Nathan) approves or denies, which POSTs back.
         // Harper v5 does not populate this.request on Resource subclasses —
-        // getContext() is the only reliable path (ops-sal4: the previous
+        // getContext() is the only reliable path (the previous
         // `(this as any).request` read was always undefined, so query params were
         // always empty).
         const ctx = this.getContext?.();
@@ -197,13 +218,13 @@ ${scope.split(" ").map((s) => `<div class="scope">${s}</div>`).join("")}
         }
         if (action === "deny") {
             const params = new URLSearchParams({ error: "access_denied", state });
-            return Response.redirect(`${redirectUri}?${params}`, 302);
+            return redirectTo(`${redirectUri}?${params}`);
         }
         // Determine authenticated principal. Harper v5 does not populate
         // this.request on Resource subclasses, so `(this as any).request?.tpsAgent`
         // was always undefined and this ALWAYS fell back to the hardcoded "admin" —
         // every approved consent grant was minted for the admin principal
-        // regardless of who actually approved it (ops-sal4 identity spoof).
+        // regardless of who actually approved it (identity spoof).
         // resolveAgentAuth(getContext()) resolves Basic super_user/admin auth to
         // { kind: "agent", agentId: username, isAdmin: true } (see agent-auth.ts).
         // We do NOT silently fall back to "admin" on an unresolved principal — if
@@ -215,6 +236,42 @@ ${scope.split(" ").map((s) => `<div class="scope">${s}</div>`).join("")}
         // admin, or should any verified (non-admin) agent be able to approve its
         // own consent grant? The previous code always resolved to "admin" for
         // every caller, so this is a genuine policy decision, not just a bug fix.
+        //
+        // SECURITY FIX (#604 — authorizeLocal escalation): resolveAgentAuth's
+        // `context.user` fallback (agent-auth.ts, the super_user / username
+        // branches) ALSO matches Harper's `authorizeLocal` (config true) ambient
+        // super_user injection for ANY credential-less LOOPBACK request.
+        // /OAuthAuthorize sits on auth-middleware.ts's public early-return
+        // passthrough (any method), so a bare local POST never gets OUR
+        // middleware's tpsAgent/tpsAnonymous annotation either — resolveAgentAuth
+        // falls straight through to Harper's raw `context.user`, which
+        // authorizeLocal can forge with NO signature and NO password. A
+        // credential-less loopback POST therefore resolved to
+        // { kind: "agent", agentId: "admin", isAdmin: true } and minted a REAL
+        // admin authorization code, exchangeable at OAuthToken for a Bearer
+        // token — full local privilege escalation with zero credentials.
+        // authorizeLocal injects request.user=super_user ONLY when there is NO
+        // Authorization header present (see Presence.ts's get() doc for the
+        // fuller writeup of this exact mechanism) — a genuinely
+        // password-verified Basic admin/super_user, or a genuinely
+        // Ed25519-signed agent request, both carry a real header. Requiring one
+        // be present before trusting resolveAgentAuth's verdict closes the
+        // forged-approver path without touching resolveAgentAuth itself (the
+        // root-cause fix is a separate, larger follow-up — see #604): a
+        // credential-less local caller now gets 401 and no code is minted; a
+        // genuinely-authenticated approver (real Basic password, or a real
+        // TPS-Ed25519 signature verified by resolveAgentAuth's own fallback) is
+        // unaffected.
+        const ctx = this.getContext?.();
+        const request = ctx?.request ?? ctx;
+        const authHeader = request?.headers?.get?.("authorization") ??
+            request?.headers?.asObject?.authorization ??
+            "";
+        if (!authHeader) {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "content-type": "application/json" },
+            });
+        }
         const auth = await resolveAgentAuth(this.getContext?.());
         if (auth.kind !== "agent") {
             return new Response(JSON.stringify({ error: "authentication required" }), {
@@ -238,7 +295,7 @@ ${scope.split(" ").map((s) => `<div class="scope">${s}</div>`).join("")}
             createdAt: now,
         });
         const params = new URLSearchParams({ code, state });
-        return Response.redirect(`${redirectUri}?${params}`, 302);
+        return redirectTo(`${redirectUri}?${params}`);
     }
 }
 // ─── Token endpoint ──────────────────────────────────────────────────────────

package/dist/resources/OrgEventCatchup.js

@@ -23,7 +23,7 @@ export class OrgEventCatchup extends Resource {
     async get(pathInfo) {
         // Harper v5 does not populate this.request on Resource subclasses —
         // getContext() is the only reliable path to the gate's tpsAgent/
-        // tpsAgentIsAdmin annotations (ops-sal4: the previous `(this as
+        // tpsAgentIsAdmin annotations (the previous `(this as
         // any).request` read was always undefined, so the ownership check below
         // never ran — fail-open cross-agent read).
         const auth = await resolveAgentAuth(this.getContext?.());

package/dist/resources/Presence.js

@@ -8,6 +8,8 @@
  *
  * Auth:
  *   GET  — public (returns only allowlisted fields; safe for public renderer).
+ *          currentTask is additionally content-gated to verified agents only
+ *          (#592) — anonymous callers get the roster with currentTask=null.
  *   POST — Ed25519 agent credential (TPS-Ed25519 header). Agent writes only its
  *          own record; cross-agent writes are rejected (403).
  *
@@ -15,9 +17,17 @@
  *   - Write: per-agent Ed25519 auth. Cross-agent → 403.
  *   - Read: field-allowlisted to public-safe set. No secrets, no admin data.
  *   - currentTask is agent-authored free text → cap length, escape on render.
+ *   - currentTask CONTENT gate (#592): the roster (id/displayName/role/
+ *     runtime/activity/presenceStatus/lastHeartbeatAt) is genuinely
+ *     public-safe and stays world-readable, but currentTask is free text that
+ *     the coordination convention (`presence set --task "investigating
+ *     <host>: <symptom>"`) has put customer names and preprod hostnames in.
+ *     sanitizeCurrentTask() only trims/caps length — it does not redact
+ *     content. get() additionally gates currentTask itself to verified
+ *     in-org agents only; see get()'s inline comment.
  */
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth } from "./agent-auth.js";
+import { resolveAgentAuth, verifyAgentRequest } from "./agent-auth.js";
 import { WINDOW_MS, isNonceReplay, recordNonce, importEd25519Key, b64ToArrayBuffer } from "./ed25519-auth.js";
 // ─── Constants ────────────────────────────────────────────────────────────────
 const CURRENT_TASK_MAX_LENGTH = 200;
@@ -32,7 +42,7 @@ function offlineThresholdMs() {
 }
 // ─── Nonce replay + crypto helpers ─────────────────────────────────────────────
 // WINDOW_MS, isNonceReplay/recordNonce (the ONE shared nonce store), and
-// importEd25519Key all live in ./ed25519-auth.ts (bd ops-c4op) — the single
+// importEd25519Key all live in ./ed25519-auth.ts — the single
 // shared implementation imported by auth-middleware.ts, agent-auth.ts, and
 // Presence.ts so a nonce recorded via any one of the three call sites is
 // visible to the other two, and the crypto/decoder logic can't drift.
@@ -98,8 +108,47 @@ export class Presence extends databases.flair.Presence {
      *
      * Joins Presence records with Agent metadata and derives presenceStatus.
      * Only allowlisted fields are returned (no secrets, no admin data).
+     *
+     * currentTask CONTENT gate (#592): Harper routes every GET — collection
+     * (`GET /Presence`) AND single-record (`GET /Presence/<id>`) — through this
+     * SAME method (REST.js: `resource.get(target, request)`, one call site for
+     * both; this override ignores `target` and always returns the full roster
+     * array), so gating once here, before the loop, covers every read path with
+     * no separate return site to miss.
+     *
+     * The gate keys off a valid TPS-Ed25519 SIGNATURE (verifyAgentRequest),
+     * NOT resolveAgentAuth()/allowVerified — and that distinction is the whole
+     * fix. /Presence is a public-passthrough in auth-middleware.ts: the
+     * middleware early-returns WITHOUT annotating tpsAgent/tpsAnonymous, so a
+     * resource-level resolver never sees a gate annotation for this path. Worse,
+     * Harper's `authorizeLocal` (config default true) auto-authorizes any
+     * *credential-less* loopback request as super_user — it injects request.user
+     * ONLY "when there is no Authorization header" (node .../server/http.js). So a
+     * bare, unauthenticated `GET /Presence` from loopback (exactly the anonymous
+     * caller the issue is about, and what the integration test exercises against
+     * a real spawned Harper) arrives with request.user = super_user and NO
+     * signature. resolveAgentAuth() would classify that as `kind:"agent"` (its
+     * super_user branch) and leak currentTask — which it did, against real
+     * Harper, even though mocked unit tests using tpsAgent annotations passed.
+     * A TPS-Ed25519 signature, by contrast, cannot be manufactured by
+     * authorizeLocal (it requires the Authorization header, which suppresses the
+     * super_user injection), so verifyAgentRequest() cleanly separates a real
+     * in-org agent from an anonymous/loopback/Basic-admin caller. Only a valid
+     * agent signature gets currentTask; everything else (anonymous, loopback
+     * super_user, Basic-admin, internal in-process) gets currentTask=null.
+     * allowRead() is UNCHANGED (still `true`) — the roster itself stays public;
+     * only the free-text field is gated, per the issue's field-level option.
      */
     async get() {
+        // Extract the raw request the same way post() does (getContext().request
+        // is populated for GET; fall back to the context itself). verifyAgentRequest
+        // returns the agent for a valid TPS-Ed25519 signature, else null — see the
+        // gate rationale above. Memoized per-request, so this is a no-op if any
+        // other path already verified the same request.
+        const ctx = this.getContext?.();
+        const request = ctx?.request ?? ctx;
+        const agentAuth = request ? await verifyAgentRequest(request) : null;
+        const includeCurrentTask = agentAuth !== null;
         const now = Date.now();
         const idleThreshold = idleThresholdMs();
         const offlineThreshold = offlineThresholdMs();
@@ -124,7 +173,10 @@ export class Presence extends databases.flair.Presence {
                     presenceStatus: derivePresenceStatus(now, typeof row?.lastHeartbeatAt === "number"
                         ? row.lastHeartbeatAt
                         : Number(row?.lastHeartbeatAt ?? 0), idleThreshold, offlineThreshold),
-                    currentTask: sanitizeCurrentTask(row?.currentTask),
+                    // Anonymous/unverified readers get `null` here (key stays present,
+                    // schema-stable) instead of the sanitized task text — see the
+                    // currentTask CONTENT gate doc above get().
+                    currentTask: includeCurrentTask ? sanitizeCurrentTask(row?.currentTask) : null,
                     lastHeartbeatAt: typeof row?.lastHeartbeatAt === "number"
                         ? row.lastHeartbeatAt
                         : Number(row?.lastHeartbeatAt ?? 0),

package/dist/resources/Relationship.js

@@ -1,6 +1,7 @@
 import { databases } from "@harperfast/harper";
 import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
+import { localInstanceId } from "./instance-identity.js";
 const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
 /**
  * Relationship resource — entity-to-entity relationships with temporal validity.
@@ -16,7 +17,7 @@ const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { s
 export class Relationship extends databases.flair.Relationship {
     /**
      * Self-authorize now that the global gate is non-rejecting (memory-soul-
-     * read-gate family fix, ops-oox7 — same pattern as Memory.ts/Soul.ts/
+     * read-gate family fix — same pattern as Memory.ts/Soul.ts/
      * WorkspaceState.ts). Closes the same P0 leak: Harper routes
      * `GET /Relationship/<id>` to get() and the collection describe
      * (`GET /Relationship`) outside search(), so neither was gated before this
@@ -124,6 +125,14 @@ export class Relationship extends databases.flair.Relationship {
         content.validFrom = content.validFrom || now;
         // validTo left as null/undefined for active relationships
         content.confidence = content.confidence ?? 1.0;
+        // Write-time originatorInstanceId stamp (federation-edge-hardening slice
+        // 1) — see resources/Memory.ts's stampOriginatorInstanceId doc for the
+        // full contract. No-op if already set (never fires for a genuine local
+        // write; a federation-synced record never reaches this method — the
+        // merge path writes via the raw table object, bypassing this class).
+        if (content.originatorInstanceId == null) {
+            content.originatorInstanceId = await localInstanceId();
+        }
         return super.put(content);
     }
     async delete(_) {

package/dist/resources/SemanticSearch.js

@@ -11,7 +11,7 @@ import { isRerankEnabled, getRerankTopN, getRerankBudgetMs, getRerankMinCandidat
 // relevance floor) lives in ./scoring.ts — a Harper-free module so it can be
 // unit-tested directly (see test/unit/temporal-scoring.test.ts).
 import { compositeScore } from "./scoring.js";
-// BM25 + union-RRF hybrid retrieval (ops-i39b / FLAIR-BM25-HYBRID-RETRIEVAL).
+// BM25 + union-RRF hybrid retrieval (FLAIR-BM25-HYBRID-RETRIEVAL).
 // Harper-free modules so the BM25 scoring, the candidate-union RRF, and the
 // SECURITY conditions-filter are unit-tested against the shipped code.
 import { buildBM25, fuseRrfNormalized, hybridEnabled, SEM_LIMIT } from "./bm25.js";
@@ -81,10 +81,10 @@ export class SemanticSearch extends Resource {
             ? authenticatedAgent
             : bodyAgentId;
         // Read-scope: own (any visibility) + granted owners' SHARED memories only
-        // (ops-2dm3 Layer 1). Centralized in resolveReadScope() — this used to be
+        // (Layer 1). Centralized in resolveReadScope() — this used to be
         // an inline grant-resolution loop here PLUS a `visibility === "office"`
         // global OR-clause below that leaked ANY authenticated agent's read of
-        // ANY other agent's office-visible memories (ops-nzxa). Both are gone;
+        // ANY other agent's office-visible memories. Both are gone;
         // this is the ONE scoping resolution for this endpoint now.
         const scope = agentId ? await resolveReadScope(agentId) : null;
         // Generate query embedding
@@ -162,13 +162,13 @@ export class SemanticSearch extends Resource {
         // from CANDIDATE_MULTIPLIER so composite re-ranking keeps its existing
         // headroom. Scoped to the legacy (non-hybrid) vector path below — the
         // hybrid path's candidate pool is already governed by CANDIDATE_MULTIPLIER
-        // (semantic leg) + SEM_LIMIT (BM25 leg) via RRF union (ops-i39b); the
+        // (semantic leg) + SEM_LIMIT (BM25 leg) via RRF union; the
         // reranker still applies to its output further down regardless of which
         // path produced `filteredResults`.
         const rerankOn = isRerankEnabled();
         const rerankTopN = getRerankTopN();
         if (hybrid) {
-            // ─── BM25 + union-RRF hybrid path (ops-i39b) ─────────────────────────
+            // ─── BM25 + union-RRF hybrid path ────────────────────────────────────
             // 1. Semantic candidates via HNSW (unchanged fetch). 2. BM25 lexical pass
             //    over the SCOPED corpus. 3. SECURITY: the BM25 candidate set is filtered
             //    by the SAME conditions[] + temporal filters BEFORE fusion (the corpus
@@ -206,7 +206,7 @@ export class SemanticSearch extends Resource {
                         continue;
                     if (asOf && record.validTo && record.validTo <= asOf)
                         continue;
-                    // ops-9rc6: unconditional past-validTo exclusion (see legacy HNSW
+                    // Unconditional past-validTo exclusion (see legacy HNSW
                     // loop below for the full rationale) — applies regardless of asOf.
                     if (record.validTo && Date.parse(record.validTo) < Date.now())
                         continue;
@@ -315,7 +315,7 @@ export class SemanticSearch extends Resource {
                     continue;
                 if (asOf && record.validTo && record.validTo <= asOf)
                     continue;
-                // ops-9rc6: a past validTo ALWAYS means the record has been closed out
+                // A past validTo ALWAYS means the record has been closed out
                 // (server supersede path — Memory.ts closeSupersededRecord — sets
                 // validTo without necessarily setting `archived`). Unconditional, not
                 // gated on `asOf`, so a server-superseded record can't resurface in
@@ -330,9 +330,9 @@ export class SemanticSearch extends Resource {
                     semanticScore = distanceToSimilarity(record.$distance);
                 }
                 else {
-                    // ─── ops-syzm: Harper's cosine-sort query omits $distance for a
+                    // ─── Harper's cosine-sort query omits $distance for a
                     // SINGLETON post-filter result set — the SAME quirk root-caused and
-                    // fixed for the dedup path in ops-ume4 (resources/Memory.ts
+                    // fixed for the dedup path (resources/Memory.ts
                     // findConservativeDedupMatch / resources/dedup.ts cosineSimilarity).
                     // Sort ORDER is still correct; only the numeric `$distance`
                     // annotation is missing on that one record, regardless of the
@@ -340,7 +340,7 @@ export class SemanticSearch extends Resource {
                     // just limit=1 — the trigger is the post-filter MATCH COUNT, not the
                     // requested limit).
                     //
-                    // ops-2dm3 Layer 1 made this common: the no-grants agent scope used
+                    // Layer 1 made this common: the no-grants agent scope used
                     // to ALWAYS be a compound `{operator:"or", conditions:[{agentId},
                     // {visibility=="office"}]}` condition; resolveReadScope() now emits
                     // a PLAIN single `{agentId==X}` condition for the common (no-grants)
@@ -354,8 +354,8 @@ export class SemanticSearch extends Resource {
                     //
                     // Fix: point-lookup the record by id (a plain get(), unaffected by
                     // the sort-query quirk — selecting "embedding" directly on the SAME
-                    // sort-by-embedding query comes back as a bare scalar per ops-ume4's
-                    // findings) and compute cosine similarity ourselves in JS from its
+                    // sort-by-embedding query comes back as a bare scalar, per the same
+                    // investigation above) and compute cosine similarity ourselves in JS from its
                     // real stored `embedding` vector against this query's `qEmb`, via
                     // the same math as the ume4 fallback (dedup.ts's cosineSimilarity).
                     // Only done on this (rare) undefined-$distance branch — never adds
@@ -405,7 +405,7 @@ export class SemanticSearch extends Resource {
                     continue;
                 if (asOf && record.validTo && record.validTo <= asOf)
                     continue;
-                // ops-9rc6: unconditional past-validTo exclusion (see legacy HNSW
+                // Unconditional past-validTo exclusion (see legacy HNSW
                 // loop above for the full rationale) — applies regardless of asOf.
                 if (record.validTo && Date.parse(record.validTo) < Date.now())
                     continue;
@@ -449,7 +449,7 @@ export class SemanticSearch extends Resource {
         // Re-scores query+candidate TOGETHER (cross-attention the pooled embedding
         // can't do) and reorders before the final slice. Reorders whatever
         // `filteredResults` the retrieval stage above produced — legacy HNSW-only
-        // OR the BM25+union-RRF hybrid path (ops-i39b) — since both converge into
+        // OR the BM25+union-RRF hybrid path — since both converge into
         // the same `results`/`filteredResults` shape before this point; hybrid
         // retrieves+fuses, the reranker only reorders the fused set. Still gated
         // on `qEmb` (an embedding was actually generated); the pure keyword-only

package/dist/resources/Soul.js

@@ -1,5 +1,6 @@
 import { databases } from "@harperfast/harper";
 import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
+import { localInstanceId } from "./instance-identity.js";
 const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
 const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
 /**
@@ -37,6 +38,14 @@ export class Soul extends databases.flair.Soul {
         content.durability ||= "permanent";
         content.createdAt = new Date().toISOString();
         content.updatedAt = content.createdAt;
+        // Write-time originatorInstanceId stamp (federation-edge-hardening slice
+        // 1) — see resources/Memory.ts's stampOriginatorInstanceId doc for the
+        // full contract. No-op if already set (never fires for a genuine local
+        // write; a federation-synced record never reaches this method — the
+        // merge path writes via the raw table object, bypassing this class).
+        if (content.originatorInstanceId == null) {
+            content.originatorInstanceId = await localInstanceId();
+        }
         return super.post(content, context);
     }
     async put(content, context) {
@@ -44,6 +53,11 @@ export class Soul extends databases.flair.Soul {
         if (denied)
             return denied;
         content.updatedAt = new Date().toISOString();
+        // Write-time originatorInstanceId stamp — see post() above / Memory.ts's
+        // stampOriginatorInstanceId doc. No-op if already set.
+        if (content.originatorInstanceId == null) {
+            content.originatorInstanceId = await localInstanceId();
+        }
         return super.put(content, context);
     }
 }

package/dist/resources/WorkspaceLatest.js

@@ -16,7 +16,7 @@ export class WorkspaceLatest extends Resource {
     async get(pathInfo) {
         // Harper v5 does not populate this.context / this.request on Resource
         // subclasses — getContext() is the only reliable path to the gate's
-        // tpsAgent/tpsAgentIsAdmin annotations (ops-sal4: the previous
+        // tpsAgent/tpsAgentIsAdmin annotations (the previous
         // `(this as any).context?.request ?? (this as any).request` read was always
         // undefined, so the ownership check below never ran — fail-open cross-agent
         // read).

package/dist/resources/WorkspaceState.js

@@ -20,7 +20,7 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
     }
     /**
      * Self-authorize now that the global gate is non-rejecting (memory-soul-
-     * read-gate family fix, ops-oox7 — applying the Memory.ts/Soul.ts pattern
+     * read-gate family fix — applying the Memory.ts/Soul.ts pattern
      * to WorkspaceState/Relationship/Integration/MemoryGrant). Closes the same
      * P0 leak: Harper routes `GET /WorkspaceState/<id>` to get() and the
      * collection describe (`GET /WorkspaceState`) to a path outside search(),

package/dist/resources/agent-auth.js

@@ -26,7 +26,7 @@ import { WINDOW_MS, isNonceReplay, recordNonce, importEd25519Key, b64ToArrayBuff
 export const FLAIR_AGENT_USERNAME = "flair-agent";
 // ─── Crypto + replay-guard helpers ────────────────────────────────────────────
 // WINDOW_MS, isNonceReplay/recordNonce (the ONE shared nonce store), and
-// importEd25519Key all live in ./ed25519-auth.ts (bd ops-c4op) — the single
+// importEd25519Key all live in ./ed25519-auth.ts — the single
 // shared implementation imported by auth-middleware.ts, agent-auth.ts, and
 // Presence.ts so a nonce recorded via any one of the three call sites is
 // visible to the other two, and the crypto/decoder logic can't drift.

package/dist/resources/agentcard-fields.js

@@ -9,7 +9,7 @@
 //
 // Kept free of any @harperfast/harper import so the real logic is unit-testable
 // without spinning up Harper (avoids the simulator-pattern that let the
-// description-fallback leak ship untested — ops-vz6j).
+// description-fallback leak ship untested).
 export function readSoulKind(entry) {
     return String(entry.kind ?? entry.key ?? "").trim().toLowerCase();
 }
@@ -20,7 +20,7 @@ export function readSoulContent(entry) {
  * The public description is ONLY an explicit `kind="description"` soul.
  *
  * There is deliberately no fallback to "the first soul with any content": that
- * was the ops-vz6j leak — an agent with no description soul would publish an
+ * was the description-fallback leak — an agent with no description soul would publish an
  * arbitrary private soul on the unauthenticated card. Absent an explicit
  * description, publish nothing.
  */