@tpsdev-ai/flair 0.20.1 → 0.21.0

package/dist/resources/Federation.js

@@ -1,16 +1,41 @@
 import { Resource, databases, server } from "@harperfast/harper";
 import { randomBytes } from "node:crypto";
 import nacl from "tweetnacl";
-import { canonicalize, signBody, verifyBodySignature, signBodyFresh, verifyBodySignatureFresh, createNonceStore, generateNonce, } from "./federation-crypto.js";
+import { canonicalize, signBody, verifyBodySignature, signBodyFresh, verifyBodySignatureFresh, generateNonce, } from "./federation-crypto.js";
 import { initFederationCleanup } from "./federation-cleanup.js";
+import { createPersistentNonceStore, initNonceStoreCleanup } from "./federation-nonce-store.js";
 import { classifyRecord } from "./federation-classify.js";
 export { classifyRecord } from "./federation-classify.js";
 // Module-level nonce store for federation anti-replay.
 // Shared across FederationPair + FederationSync — nonces are globally unique
 // (generated by signBodyFresh per request with 128-bit random nonces).
-const federationNonceStore = createNonceStore();
+//
+// Backed by the `Nonce` table (federation-edge-hardening slice 4) so a
+// process restart doesn't wipe recently-seen nonces within the ±30s
+// freshness window — see federation-nonce-store.ts for the full design.
+// The NonceStore interface (has/set/evict) stays synchronous, so this swap
+// requires NO change to verifyBodySignatureFresh or its 2 call sites below.
+const federationNonceStore = createPersistentNonceStore();
 // Re-export for consumers that import from Federation.ts
 export { canonicalize, signBody, verifyBodySignature, signBodyFresh, verifyBodySignatureFresh, generateNonce };
+// ─── Per-record signature enforcement mode (federation-edge-hardening slice 3b) ──
+/**
+ * Whether FederationSync.post requires EVERY record to carry a valid
+ * per-record signature (§3a), skipping unsigned ones (`missing_signature`),
+ * vs. the default "verify-if-present" mode where an unsigned record still
+ * merges (relying on the batch-level signature already verified above it).
+ *
+ * Default OFF (verify-if-present) — pre-3a spokes don't sign individual
+ * records yet, and their batch is already authenticated. Turning this ON
+ * is an OPERATOR decision, never auto-flipped by this code: flip it only
+ * once every paired peer has been confirmed sending per-record signatures
+ * (e.g. by checking SyncLog for unsigned records / peer versions). Flipping
+ * it before every peer has upgraded silently starts dropping that peer's
+ * records instead of merging them.
+ */
+function requireRecordSignatures() {
+    return (process.env.FLAIR_FEDERATION_REQUIRE_RECORD_SIGNATURES ?? "").toLowerCase() === "true";
+}
 // ─── Conflict resolution ─────────────────────────────────────────────────────
 /**
  * Field-level Last-Write-Wins merge.
@@ -293,6 +318,61 @@ export class FederationSync extends Resource {
                     recordSkip(decision.reason);
                     continue;
                 }
+                // ── Per-record signature verification (federation-edge-hardening slice 3b) ──
+                // classifyRecord's "merge" verdict above only proves the record is
+                // STRUCTURALLY eligible (known table, self-originated OR the sender
+                // is a hub, not stale, not a no-op) — that hub bypass trusts the
+                // BATCH-level signature (verifyBodySignatureFresh above, verified
+                // against the SENDER's pinned key). It does NOT prove the record's
+                // *claimed* originator actually produced it — a hub relaying on
+                // behalf of many spokes could otherwise forge a record under any
+                // originatorInstanceId it likes, and the receiver had no way to
+                // tell. This gate closes that hole: verify the record's own
+                // signature (§3a, set at push-time by the ORIGINATOR, never by
+                // whoever relayed it) against the ORIGINATOR's pinned instance key
+                // — never the sender's key.
+                //
+                // A bad/unverifiable signature skips ONLY this record, never the
+                // batch — rejecting the whole batch on one bad record would be a
+                // DoS vector (one forged/garbled record could blackhole every other
+                // legitimate record riding along in the same POST).
+                const originator = decision.originator;
+                if (record.signature) {
+                    const originatorPublicKey = originator === instanceId
+                        ? peer.publicKey
+                        : (await databases.flair.Peer.get(originator))?.publicKey;
+                    if (!originatorPublicKey) {
+                        recordSkip("unknown_originator_key");
+                        continue;
+                    }
+                    // CONTRACT — must match src/cli.ts runFederationSyncOnce's signing
+                    // payload byte-for-byte: keys { v, table, id, data, updatedAt,
+                    // originatorInstanceId }. canonicalize() sorts keys, so field ORDER
+                    // doesn't matter, but the field SET and values do. `v: 1` versions
+                    // the canonical form itself — bump it on BOTH sides together if the
+                    // signed field set ever changes, so an old signature fails closed
+                    // instead of silently mis-verifying under a new form.
+                    const signatureValid = verifyBodySignature({
+                        v: 1,
+                        table: record.table,
+                        id: record.id,
+                        data: record.data,
+                        updatedAt: record.updatedAt,
+                        originatorInstanceId: originator,
+                        signature: record.signature,
+                    }, originatorPublicKey);
+                    if (!signatureValid) {
+                        recordSkip("invalid_signature");
+                        continue;
+                    }
+                }
+                else if (requireRecordSignatures()) {
+                    // require-mode: unsigned records are no longer trusted on
+                    // batch-level auth alone. Default mode (verify-if-present) falls
+                    // through here and merges — see requireRecordSignatures() above.
+                    recordSkip("missing_signature");
+                    continue;
+                }
                 const mergedData = mergeRecord(local, record);
                 mergedData._originatorInstanceId = decision.originator;
                 mergedData._syncedFrom = instanceId;
@@ -405,5 +485,21 @@ if (typeof setTimeout !== "undefined") {
             // Swallow — in test/resource-env the Harper databases may not be bound.
             // In production, initFederationCleanup handles its own error paths.
         });
+        // Nonce store hydration (slice 4) — load nonces persisted by a previous
+        // process (if any) before this instance starts guarding live traffic.
+        // Runs on the same deferred tick as the cleanup sweep above; there is a
+        // narrow window between process start and hydration completing during
+        // which a pre-restart nonce isn't yet visible — an accepted tradeoff
+        // consistent with this file's existing deferred-init pattern (see the
+        // cleanup sweep comment above).
+        federationNonceStore.hydrate().catch((err) => {
+            // Swallow — in test/resource-env the Harper databases may not be bound.
+        });
+        // Nonce table eviction sweep — runs on every instance (both hub and
+        // spoke can be the receiving/verifying side of a signed federation
+        // request), unlike PairingToken cleanup which is hub-only.
+        initNonceStoreCleanup().catch((err) => {
+            // Swallow — in test/resource-env the Harper databases may not be bound.
+        });
     }, 0);
 }

package/dist/resources/IngestEvents.js

@@ -64,7 +64,7 @@ export class IngestEvents extends Resource {
     }
     async post(body, context) {
         // Harper v5 does not populate this.request on Resource subclasses —
-        // getContext() is the only reliable path (ops-sal4: the previous
+        // getContext() is the only reliable path (the previous
         // `(this as any).request` read was always undefined, so authHeader was
         // always undefined and every request 401'd before reaching the office
         // Ed25519 signature check below).

package/dist/resources/Integration.js

@@ -15,7 +15,7 @@ export class Integration extends databases.flair.Integration {
     }
     /**
      * Self-authorize now that the global gate is non-rejecting (memory-soul-
-     * read-gate family fix, ops-oox7 — same pattern as Memory.ts/Soul.ts/
+     * read-gate family fix — same pattern as Memory.ts/Soul.ts/
      * WorkspaceState.ts/Relationship.ts). Closes the same P0 leak: Harper
      * routes `GET /Integration/<id>` to get() and the collection describe
      * (`GET /Integration`) outside search(), so neither was gated before this

package/dist/resources/Memory.js

@@ -1,6 +1,7 @@
 import { databases } from "@harperfast/harper";
 import { patchRecord, withDetachedTxn } from "./table-helpers.js";
 import { isAdmin, resolveAgentAuth, allowVerified } from "./agent-auth.js";
+import { localInstanceId } from "./instance-identity.js";
 import { getEmbedding, getModelId } from "./embeddings-provider.js";
 import { scanFields, isStrictMode } from "./content-safety.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
@@ -15,7 +16,7 @@ const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { s
  * live in ./memory-read-scope.ts — the ONE centralized helper every
  * cross-agent Memory read path (search()/get() here, SemanticSearch.ts,
  * MemoryBootstrap.ts, auth-middleware.ts's by-id guard) resolves its scope
- * through, so the scoping rule cannot drift per-path again (ops-nzxa: a
+ * through, so the scoping rule cannot drift per-path again (a
  * SemanticSearch inline `visibility === "office"` OR-clause leaked office
  * memories to any authenticated agent because the rule had scattered). See
  * that module's doc for the migration invariant (no-visibility-field reads
@@ -86,7 +87,7 @@ async function findConservativeDedupMatch(ctx, agentId, contentText, embedding,
         }
         if (!top)
             return null;
-        // ─── ops-ume4: Harper's cosine-sort query omits $distance for a SINGLETON
+        // ─── Harper's cosine-sort query omits $distance for a SINGLETON
         // result set ─────────────────────────────────────────────────────────────
         // Initial working theory was a per-agentId HNSW "cold-start" (first-ever
         // query cold, second query warm) and the initially-recommended fix was a
@@ -133,7 +134,7 @@ async function findConservativeDedupMatch(ctx, agentId, contentText, embedding,
             cosine = 1 - top.$distance;
         }
         else {
-            console.error("Memory.findConservativeDedupMatch: $distance undefined on a singleton cosine result (ops-ume4) — " +
+            console.error("Memory.findConservativeDedupMatch: $distance undefined on a singleton cosine result — " +
                 "falling back to a manual cosine computation from the candidate's stored embedding", { agentId, candidateId: top.id });
             const fullCandidate = await withDetachedTxn(ctx, () => databases.flair.Memory.get(top.id));
             const candidateEmbedding = Array.isArray(fullCandidate?.embedding) ? fullCandidate.embedding : [];
@@ -209,7 +210,7 @@ function buildWriteResponse(content, result, dedupMatch) {
  * detachment discipline as findConservativeDedupMatch (each discrete Harper
  * call individually wrapped — see withDetachedTxn's doc for why a single
  * wrap around a multi-await async function would not protect the later
- * call). Does NOT swallow failures (ops-a4t5 fix) — throws so the caller can
+ * call). Does NOT swallow failures — throws so the caller can
  * log it. Never called before the new record is already written.
  */
 async function closeSupersededRecord(ctx, oldId, patch) {
@@ -273,7 +274,7 @@ async function validateAndAuthorizeSupersedes(content, auth) {
 }
 /**
  * Close the superseded record — called AFTER the new record has already been
- * written (write-new-BEFORE-close-old, ops-a4t5 fix). Safe failure state is
+ * written (write-new-BEFORE-close-old). Safe failure state is
  * two active records (recoverable), never a tombstoned-old-with-lost-new.
  * Failure is logged (observable), never silently swallowed. No-op if
  * `content.supersedes` is not set.
@@ -293,11 +294,11 @@ async function closeSupersededIfNeeded(ctx, content, methodLabel) {
         // `err` arg) would let an id containing %s/%o consume/hide the real error
         // (semgrep unsafe-formatstring). Keep all dynamic values in the data object.
         console.error("Memory.closeSuperseded: failed to close superseded record after writing new record " +
-            "(ops-a4t5 — observable, not silent; new record is safely written, old record remains active until retried)", { method: methodLabel, supersededId: content.supersedes, newRecordId: content.id, err });
+            "(observable, not silent; new record is safely written, old record remains active until retried)", { method: methodLabel, supersededId: content.supersedes, newRecordId: content.id, err });
     }
 }
 /**
- * ─── Durability-keyed default visibility (ops-2dm3 Layer 1, part A) ─────────
+ * ─── Durability-keyed default visibility (Layer 1, part A) ─────────────────
  *
  * Writer intent: an explicit `visibility` on the write ALWAYS overrides this
  * (callers check `content.visibility == null` before calling this). When
@@ -310,6 +311,89 @@ async function closeSupersededIfNeeded(ctx, content, methodLabel) {
 function defaultVisibilityForDurability(durability) {
     return durability === "permanent" || durability === "persistent" ? "shared" : "private";
 }
+/**
+ * ─── Write-time provenance stamp (memory-provenance slice 1) ────────────────
+ *
+ * Foundational capture for an emergent-trust model: every Memory write gets a
+ * structured, versioned `provenance` JSON blob recording what the server can
+ * actually VERIFY about the write, plus (optionally) what the caller merely
+ * CLAIMS. Deliberately minimal — verified fields only:
+ *
+ *   { v: 1,
+ *     verified: { agentId: <string|null>, timestamp: <ISO string> },
+ *     claimed?: { model: <string> } }
+ *
+ * - `verified.agentId` comes from the ALREADY-RESOLVED auth verdict
+ *   (resolveAgentAuth) — never from anything the caller can forge on the
+ *   request body. `kind: "agent"` → the Ed25519-verified agentId. Any other
+ *   verdict (in practice only `kind: "internal"` — a trusted in-process call
+ *   with no per-agent identity to attribute) stamps `null` rather than
+ *   throwing; `kind: "anonymous"` never reaches here — both post()/put()
+ *   already 401 it before this point.
+ * - `verified.timestamp` reuses the server-clock `createdAt` the caller has
+ *   already computed by this point (never client-suppliable) — the same
+ *   "stamp a dynamic attribute the server controls" mechanism as the existing
+ *   `embeddingModel = getModelId()` stamp elsewhere in this file. NOTE: the
+ *   *signed* Ed25519 request timestamp is also available (it's verified in
+ *   auth-middleware) but currently discarded there rather than threaded
+ *   through to resource methods — a future slice can carry it alongside (or
+ *   instead of) this server-clock timestamp without changing this shape's
+ *   `v: 1` contract. Not done here to keep auth-middleware untouched.
+ * - `claimed.model` is an OPTIONAL, UNVERIFIED passthrough: included only
+ *   when the incoming write payload itself already carries a non-empty
+ *   string `model` field. No client/CLI sets one today — this just means the
+ *   server won't discard it if/when a future write path does. Never
+ *   invented, never defaulted, and the `claimed` key is omitted entirely
+ *   (not stamped as `{}`) when absent.
+ *
+ * Deliberately NOT implemented in this slice: a context-fingerprint field —
+ * bootstrap doesn't return the IDs a fingerprint would need, so it requires
+ * client cooperation that's out of scope here.
+ */
+function buildProvenance(auth, createdAt, content) {
+    const provenance = {
+        v: 1,
+        verified: {
+            agentId: auth.kind === "agent" ? auth.agentId : null,
+            timestamp: createdAt,
+        },
+    };
+    if (typeof content?.model === "string" && content.model.length > 0) {
+        provenance.claimed = { model: content.model };
+    }
+    return JSON.stringify(provenance);
+}
+/**
+ * ─── Write-time originatorInstanceId stamp (federation-edge-hardening slice 1) ──
+ *
+ * Stamps this instance's own federation identity (resources/instance-
+ * identity.ts's localInstanceId(), cached — never a DB read per write) onto
+ * every LOCAL write. Deliberately a no-op when `content.originatorInstanceId`
+ * already carries a non-null value: this is the anti-clobber rule that keeps
+ * a federation-synced record's true origin intact.
+ *
+ * Why this can never clobber a synced record: FederationSync.post()
+ * (resources/Federation.ts) merges incoming records via the RAW table object
+ * (`(databases as any).flair.Memory.put(mergedData)`) — Harper's static
+ * table-level put, not this Resource subclass's instance put() below. The
+ * merge path never runs this function at all, so a record arriving from
+ * instance B keeps whatever `originatorInstanceId` it already carried in
+ * `mergedData` (that instance's own write-time stamp, carried through in the
+ * synced row) with no risk of this instance overwriting it with its own id.
+ * The `content.originatorInstanceId == null` guard below is still applied —
+ * defense-in-depth for any future path that might route a synced payload
+ * through this class's post()/put() — so the invariant holds even if that
+ * assumption ever changes.
+ *
+ * `localInstanceId()` resolves to null on an instance that has never been
+ * federation-bootstrapped (no Instance row yet) — the field is nullable by
+ * design, so this stamps null rather than inventing an id.
+ */
+async function stampOriginatorInstanceId(content) {
+    if (content.originatorInstanceId == null) {
+        content.originatorInstanceId = await localInstanceId();
+    }
+}
 export class Memory extends databases.flair.Memory {
     /**
      * Self-authorize now that the global gate is non-rejecting. Closes the P0
@@ -360,8 +444,8 @@ export class Memory extends databases.flair.Memory {
             return super.get(target);
         }
         // Non-admin agent: only its own memories (any visibility), or a granted
-        // owner's SHARED memories — never that owner's private ones (ops-2dm3
-        // Layer 1 private-exclusion). Centralized in resolveReadScope() so this
+        // owner's SHARED memories — never that owner's private ones (Layer 1
+        // private-exclusion). Centralized in resolveReadScope() so this
         // and search() below cannot drift.
         const record = await super.get(target);
         if (!record)
@@ -397,7 +481,7 @@ export class Memory extends databases.flair.Memory {
             return super.search(query);
         }
         // Non-admin agent: scope to own (any visibility) + granted owners' SHARED
-        // memories only (ops-2dm3 Layer 1 private-exclusion). Centralized in
+        // memories only (Layer 1 private-exclusion). Centralized in
         // resolveReadScope() so get() above and search() here cannot drift.
         const authAgent = auth.agentId;
         const scope = await resolveReadScope(authAgent);
@@ -450,7 +534,7 @@ export class Memory extends databases.flair.Memory {
         content.createdAt = new Date().toISOString();
         content.updatedAt = content.createdAt;
         content.archived = content.archived ?? false;
-        // ─── Default visibility (durability-keyed) — ops-2dm3 Layer 1, part A ────
+        // ─── Default visibility (durability-keyed) — Layer 1, part A ────────────
         // post() only ever creates a NEW record — patchRecord/supersede-close/
         // retrievalCount bumps all route through put() instead (see put()'s
         // pre-existing-record guard below), so there is no "don't overwrite an
@@ -488,7 +572,7 @@ export class Memory extends databases.flair.Memory {
             content.expiresAt = new Date(Date.now() + ttlHours * 3600_000).toISOString();
         }
         // Content safety scan — covers content + summary (defense-in-depth for
-        // agent-set summaries, ops-i2jb).
+        // agent-set summaries).
         if (content.content || content.summary) {
             const safety = scanFields(content, ["content", "summary"]);
             if (!safety.safe) {
@@ -525,9 +609,17 @@ export class Memory extends databases.flair.Memory {
                 content.embeddingModel = getModelId();
             }
         }
+        // Write-time provenance stamp (memory-provenance slice 1) — see
+        // buildProvenance's doc above. Stamped last, right before persist, so it
+        // reflects the final resolved `content.createdAt`.
+        content.provenance = buildProvenance(auth, content.createdAt, content);
+        // Write-time originatorInstanceId stamp (federation-edge-hardening slice
+        // 1) — see stampOriginatorInstanceId's doc above. No-op if already set
+        // (never fires for a genuine local write — no client sets this field).
+        await stampOriginatorInstanceId(content);
         // ── Write the new record FIRST ──────────────────────────────────────────
         const result = await super.post(content);
-        // ── THEN close the superseded record (ops-a4t5 fix) ─────────────────────
+        // ── THEN close the superseded record ────────────────────────────────────
         // Write-new-BEFORE-close-old: the previous order (close-old via a fire-
         // and-forget `.catch(()=>{})` BEFORE the new write) could tombstone the
         // old record and then lose the new one if the write failed afterward.
@@ -582,7 +674,7 @@ export class Memory extends databases.flair.Memory {
         // visibility stamped) or an update/patch (dedup-bypassed, visibility left
         // untouched). See the dedup-gate block further down for why an existing
         // id skips the gate; the SAME "does a record already exist" check gates
-        // the visibility default (ops-2dm3 Layer 1 part A): patchRecord/supersede-
+        // the visibility default (Layer 1 part A): patchRecord/supersede-
         // close/retrievalCount bumps all route through put() with a MERGED
         // `{...existing, ...patch}` payload, and must never have their stored
         // visibility overwritten by a default recomputed from that merged content
@@ -590,7 +682,7 @@ export class Memory extends databases.flair.Memory {
         const preExisting = content.id
             ? await databases.flair.Memory.get(content.id).catch(() => null)
             : null;
-        // ─── Default visibility (durability-keyed) — ops-2dm3 Layer 1, part A ────
+        // ─── Default visibility (durability-keyed) — Layer 1, part A ────────────
         // Explicit visibility on the write ALWAYS overrides; only stamp the
         // default when the caller left it unset AND this is a fresh record.
         // permanent|persistent → shared; standard|ephemeral|absent → private.
@@ -607,7 +699,7 @@ export class Memory extends databases.flair.Memory {
         if (content.supersedes && !content.validFrom) {
             content.validFrom = content.createdAt;
         }
-        // Content safety scan on updated content + summary (ops-i2jb).
+        // Content safety scan on updated content + summary.
         if (content.content || content.summary) {
             const safety = scanFields(content, ["content", "summary"]);
             if (!safety.safe) {
@@ -674,9 +766,23 @@ export class Memory extends databases.flair.Memory {
         if (content.promotionStatus === "approved") {
             content.durability = "permanent";
         }
+        // Write-time provenance stamp (memory-provenance slice 1) — see
+        // buildProvenance's doc above post(). Applies to every put() (fresh
+        // create AND update/patch) — never gated on preExisting, so an update
+        // always gets a freshly-stamped provenance reflecting the CURRENT
+        // authenticated actor performing this write.
+        content.provenance = buildProvenance(auth, content.createdAt, content);
+        // Write-time originatorInstanceId stamp (federation-edge-hardening slice
+        // 1) — see stampOriginatorInstanceId's doc above post(). No-op if
+        // already set: an update/patch of an existing local record carries its
+        // own already-stamped originatorInstanceId forward unchanged (the
+        // `{...existing, ...patch}` merge pattern every put() caller uses), and a
+        // federation-synced record never reaches this method at all (see that
+        // function's doc for why the merge path can't clobber it here either).
+        await stampOriginatorInstanceId(content);
         // ── Write the new/updated record FIRST ──────────────────────────────────
         const result = await super.put(content);
-        // ── THEN close the superseded record (ops-a4t5 fix; see post()) ────────
+        // ── THEN close the superseded record (see post()) ───────────────────────
         await closeSupersededIfNeeded(ctx, content, "put");
         return buildWriteResponse(content, result, dedupMatch);
     }

package/dist/resources/MemoryBootstrap.js

@@ -14,17 +14,19 @@ import { resolveReadScope } from "./memory-read-scope.js";
  *   3. Recent memories (adaptive window)
  *   4. Task-relevant memories (semantic search if currentTask provided)
  *   4b. Teammate findings relevant to your task (flair#550 — the SAME scored
- *      task-relevant set as #4, split by origin: a grant-visible teammate's
- *      SHARED memory that scores against currentTask lands here instead of
- *      #4, attributed via "[via <agentId>]". Presentation only — what's
- *      readable is entirely Layer 1's resolveReadScope()/ops-2dm3; this only
- *      changes how an already-read cross-agent record is formatted/sectioned)
+ *      task-relevant set as #4, split by origin: any other in-org agent's
+ *      NON-PRIVATE memory that scores against currentTask lands here instead
+ *      of #4, attributed via "[via <agentId>]" — no MemoryGrant required
+ *      (open-within-org read, per #578). Presentation only — what's readable
+ *      is entirely resolveReadScope()'s job; this only changes how an
+ *      already-read cross-agent record is formatted/sectioned)
  *   5. Relationship context (active relationships for mentioned entities)
  *   6. Predicted context (based on channel/surface/subject hints)
  *   7. Team roster (other active agents in this office + a search-first nudge —
- *      bootstrap loads the caller's own memories plus any granted owner's
- *      SHARED memories (ops-2dm3 Layer 1, never their private ones), so this
- *      section nudges toward memory_search for anything beyond that window)
+ *      bootstrap loads the caller's own memories plus every other in-org
+ *      agent's non-private memories (open-within-org read, never anyone's
+ *      private ones), so this section nudges toward memory_search for
+ *      anything beyond that window)
  *
  * Prediction: when context signals (channel, surface, subjects) are provided,
  * the bootstrap loads more aggressively — Flair is fast enough that the
@@ -199,9 +201,10 @@ export class BootstrapMemories extends Resource {
         }
         // --- 1c. Team roster + cross-agent search nudge ---
         // Soul is still caller-own-only (unaffected here). Memory loading below
-        // (step 2) now also includes granted owners' SHARED memories (ops-2dm3
-        // Layer 1) — but this section stays: memory_search/SemanticSearch remains
-        // the deliberate, query-driven way to find a teammate's finding, vs.
+        // (step 2) now also includes every other in-org agent's non-private
+        // memories (open-within-org read, no MemoryGrant needed — #578) — but
+        // this section stays: memory_search/SemanticSearch remains the
+        // deliberate, query-driven way to find a teammate's finding, vs.
         // bootstrap's fixed recent/permanent window. This section is fixed-cost
         // (no query text to format per agent) so it's cheap enough to always
         // include, not budgeted.
@@ -225,14 +228,18 @@ export class BootstrapMemories extends Resource {
             // Agent table may not exist in older / standalone deployments
         }
         // --- 2. Permanent memories (always included, highest priority) ---
-        // Read-scope: own (any visibility) + granted owners' SHARED memories only
-        // (ops-2dm3 Layer 1 — never a granted owner's private ones). Centralized
-        // in resolveReadScope(): the condition is pushed into the Harper query
-        // (so the table itself never returns an out-of-scope row), and
-        // `scope.isAllowed` re-checks in-process as defense-in-depth (same
-        // belt-and-suspenders discipline as SemanticSearch's BM25 pre-fusion
-        // filter) — this is the #550 foundation: bootstrap can now safely expand
-        // beyond own-only without a parallel scoping rule.
+        // Read-scope: own (any visibility) + every OTHER in-org agent's
+        // non-private memory — open-within-org read (#578), no MemoryGrant
+        // consulted at all. Centralized in resolveReadScope(): the condition is
+        // pushed into the Harper query (so the table itself never returns an
+        // out-of-scope row), and `scope.isAllowed` re-checks in-process as
+        // defense-in-depth (same belt-and-suspenders discipline as
+        // SemanticSearch's BM25 pre-fusion filter) — this is the #550 foundation:
+        // bootstrap can now safely expand beyond own-only without a parallel
+        // scoping rule, and that rule tracks resolveReadScope()'s model
+        // automatically (grant-gated when #568 first built this, open-within-org
+        // now that #578 has landed — this file never re-implements the rule, so
+        // it never has to change when the rule does).
         const scope = await resolveReadScope(agentId);
         const allMemories = [];
         for await (const record of databases.flair.Memory.search({ conditions: [scope.condition] })) {
@@ -240,18 +247,19 @@ export class BootstrapMemories extends Resource {
                 continue;
             if (record.expiresAt && Date.parse(record.expiresAt) < Date.now())
                 continue;
-            // ops-hesq: a past validTo ALWAYS means the record has been closed out
+            // A past validTo ALWAYS means the record has been closed out
             // (server supersede path — Memory.ts closeSupersededRecord — sets
             // validTo without necessarily setting `archived`), same root cause and
-            // fix as ops-9rc6's SemanticSearch/bm25-filter exclusion. Unconditional
+            // fix as SemanticSearch.ts's unconditional past-validTo/bm25-filter
+            // exclusion. Unconditional
             // so a server-superseded record can't resurface in bootstrap just
             // because its successor isn't co-present in this result set (the
             // supersededIds filter further down only catches co-presence). A
             // record with no validTo, or a future validTo, is unaffected.
             if (record.validTo && Date.parse(record.validTo) < Date.now())
                 continue;
-            // Attribution for cross-agent (granted-owner) records — same convention
-            // SemanticSearch.ts already uses: formatMemory() below only USES this
+            // Attribution for cross-agent (any other in-org agent's) records — same
+            // convention SemanticSearch.ts already uses: formatMemory() below only USES this
             // when the record also carries _safetyFlags (labels the untrusted-data
             // wrapper with whose memory it is), it never forces wrapping on its own.
             // Real Harper's search() results are non-extensible objects — mutating
@@ -268,11 +276,12 @@ export class BootstrapMemories extends Resource {
         }
         const activeMemories = allMemories.filter((m) => !supersededIds.has(m.id));
         // #550 design boundary: the permanent / recent / predicted sections are the
-        // agent's OWN working context — own-only, always. Post-Layer-1
-        // `activeMemories` also carries grant-visible teammate records (`_source`
-        // set), but grant-visibility exists to feed the task-relevant "Teammate
-        // findings" surfacing (#550) below, NOT to blend a teammate's memories into
-        // the reader's recent/permanent/predicted view. So these three sections
+        // agent's OWN working context — own-only, always. `activeMemories` also
+        // carries every other in-org agent's non-private records (`_source` set,
+        // open-within-org read — no grant involved), but that cross-agent
+        // visibility exists to feed the task-relevant "Teammate findings"
+        // surfacing (#550) below, NOT to blend a teammate's memories into the
+        // reader's recent/permanent/predicted view. So these three sections
         // filter to own (`!m._source`); team knowledge surfaces only when
         // task-relevant (the teammate section) or via an explicit memory_search.
         const ownMemories = activeMemories.filter((m) => !m._source);
@@ -419,13 +428,14 @@ export class BootstrapMemories extends Resource {
                     .filter((s) => s.score > 0.3)
                     .sort((a, b) => b.score - a.score);
                 // #550: split the scored, task-relevant set by origin. Own findings
-                // go to `relevant` as before; a teammate's (grant-visible, already
-                // read-scoped by Layer 1 — `m._source` is only ever set for a
-                // cross-agent record, see the allMemories loop above) go to the new
-                // `teammate` section so the agent can tell it apart at a glance.
-                // Both draw from the SAME `tokenBudget` in one score-ordered pass —
-                // highest-relevance memories win the remaining budget regardless of
-                // which section they land in, so neither section double-spends.
+                // go to `relevant` as before; any other in-org agent's non-private
+                // record — already read-scoped by resolveReadScope(), no grant
+                // required (`m._source` is only ever set for a cross-agent record,
+                // see the allMemories loop above) — goes to the new `teammate`
+                // section so the agent can tell it apart at a glance. Both draw from
+                // the SAME `tokenBudget` in one score-ordered pass — highest-relevance
+                // memories win the remaining budget regardless of which section they
+                // land in, so neither section double-spends.
                 for (const { memory: m } of scored) {
                     const line = formatMemory(m, agentId);
                     const cost = estimateTokens(line);
@@ -499,7 +509,7 @@ export class BootstrapMemories extends Resource {
         }
         // #550: teammate findings relevant to the current task — right after the
         // agent's own task-relevant knowledge. Empty section renders nothing
-        // (no header) so a bootstrap with no grant-visible teammate findings for
+        // (no header) so a bootstrap with no task-relevant teammate findings for
         // this task looks exactly as it did before this feature.
         if (sections.teammate.length > 0) {
             parts.push("## Teammate findings relevant to your task\n" + sections.teammate.join("\n"));

package/dist/resources/MemoryGrant.js

@@ -19,7 +19,7 @@ export class MemoryGrant extends databases.flair.MemoryGrant {
     }
     /**
      * Self-authorize now that the global gate is non-rejecting (memory-soul-
-     * read-gate family fix, ops-oox7 — same pattern as Memory.ts/Soul.ts/
+     * read-gate family fix — same pattern as Memory.ts/Soul.ts/
      * WorkspaceState.ts/Relationship.ts/Integration.ts). Closes the same P0
      * leak: Harper routes `GET /MemoryGrant/<id>` to get() and the collection
      * describe (`GET /MemoryGrant`) outside search(), so neither was gated