@tpsdev-ai/flair 0.20.1 → 0.21.0

package/dist/resources/OAuth.js

@@ -35,6 +35,27 @@ function nowISO() {
 function futureISO(ms) {
     return new Date(Date.now() + ms).toISOString();
 }
+/**
+ * 302 redirect — deliberately NOT `Response.redirect()`.
+ *
+ * FOUND while writing the real-Harper integration test for #604 (this exact
+ * gap is why the coverage doc above calls OAuthAuthorize.post() untestable
+ * without a running Harper instance — no test had ever hit this path over
+ * real HTTP before). Pre-existing on main, unrelated to the #604 auth fix:
+ * per the Fetch spec, `Response.redirect(url, status)` constructs a Response
+ * whose Headers guard is set to "immutable". Harper's own HTTP response
+ * pipeline mutates the handler's returned Response's headers afterward (e.g.
+ * CORS/instrumentation headers) — against an immutable-guarded Headers this
+ * throws `TypeError: immutable`, turning EVERY real POST /OAuthAuthorize
+ * (both "deny" and "approve") into a 500, verified via curl against a built
+ * origin/main with no other changes. A manually-constructed Response with
+ * the same status/Location header has the default (mutable) "response"
+ * guard, so Harper's later mutation succeeds — identical bytes on the wire,
+ * no behavior change, just a mutable Headers object underneath.
+ */
+function redirectTo(url, status = 302) {
+    return new Response(null, { status, headers: { Location: url } });
+}
 // ─── Discovery metadata ──────────────────────────────────────────────────────
 export class OAuthMetadata extends Resource {
     // OAuth discovery metadata is intentionally public — RFC 8414 § 3 requires
@@ -123,7 +144,7 @@ export class OAuthAuthorize extends Resource {
         // In 1.0, this returns a simple HTML consent page.
         // The user (Nathan) approves or denies, which POSTs back.
         // Harper v5 does not populate this.request on Resource subclasses —
-        // getContext() is the only reliable path (ops-sal4: the previous
+        // getContext() is the only reliable path (the previous
         // `(this as any).request` read was always undefined, so query params were
         // always empty).
         const ctx = this.getContext?.();
@@ -197,13 +218,13 @@ ${scope.split(" ").map((s) => `<div class="scope">${s}</div>`).join("")}
         }
         if (action === "deny") {
             const params = new URLSearchParams({ error: "access_denied", state });
-            return Response.redirect(`${redirectUri}?${params}`, 302);
+            return redirectTo(`${redirectUri}?${params}`);
         }
         // Determine authenticated principal. Harper v5 does not populate
         // this.request on Resource subclasses, so `(this as any).request?.tpsAgent`
         // was always undefined and this ALWAYS fell back to the hardcoded "admin" —
         // every approved consent grant was minted for the admin principal
-        // regardless of who actually approved it (ops-sal4 identity spoof).
+        // regardless of who actually approved it (identity spoof).
         // resolveAgentAuth(getContext()) resolves Basic super_user/admin auth to
         // { kind: "agent", agentId: username, isAdmin: true } (see agent-auth.ts).
         // We do NOT silently fall back to "admin" on an unresolved principal — if
@@ -215,6 +236,42 @@ ${scope.split(" ").map((s) => `<div class="scope">${s}</div>`).join("")}
         // admin, or should any verified (non-admin) agent be able to approve its
         // own consent grant? The previous code always resolved to "admin" for
         // every caller, so this is a genuine policy decision, not just a bug fix.
+        //
+        // SECURITY FIX (#604 — authorizeLocal escalation): resolveAgentAuth's
+        // `context.user` fallback (agent-auth.ts, the super_user / username
+        // branches) ALSO matches Harper's `authorizeLocal` (config true) ambient
+        // super_user injection for ANY credential-less LOOPBACK request.
+        // /OAuthAuthorize sits on auth-middleware.ts's public early-return
+        // passthrough (any method), so a bare local POST never gets OUR
+        // middleware's tpsAgent/tpsAnonymous annotation either — resolveAgentAuth
+        // falls straight through to Harper's raw `context.user`, which
+        // authorizeLocal can forge with NO signature and NO password. A
+        // credential-less loopback POST therefore resolved to
+        // { kind: "agent", agentId: "admin", isAdmin: true } and minted a REAL
+        // admin authorization code, exchangeable at OAuthToken for a Bearer
+        // token — full local privilege escalation with zero credentials.
+        // authorizeLocal injects request.user=super_user ONLY when there is NO
+        // Authorization header present (see Presence.ts's get() doc for the
+        // fuller writeup of this exact mechanism) — a genuinely
+        // password-verified Basic admin/super_user, or a genuinely
+        // Ed25519-signed agent request, both carry a real header. Requiring one
+        // be present before trusting resolveAgentAuth's verdict closes the
+        // forged-approver path without touching resolveAgentAuth itself (the
+        // root-cause fix is a separate, larger follow-up — see #604): a
+        // credential-less local caller now gets 401 and no code is minted; a
+        // genuinely-authenticated approver (real Basic password, or a real
+        // TPS-Ed25519 signature verified by resolveAgentAuth's own fallback) is
+        // unaffected.
+        const ctx = this.getContext?.();
+        const request = ctx?.request ?? ctx;
+        const authHeader = request?.headers?.get?.("authorization") ??
+            request?.headers?.asObject?.authorization ??
+            "";
+        if (!authHeader) {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "content-type": "application/json" },
+            });
+        }
         const auth = await resolveAgentAuth(this.getContext?.());
         if (auth.kind !== "agent") {
             return new Response(JSON.stringify({ error: "authentication required" }), {
@@ -238,7 +295,7 @@ ${scope.split(" ").map((s) => `<div class="scope">${s}</div>`).join("")}
             createdAt: now,
         });
         const params = new URLSearchParams({ code, state });
-        return Response.redirect(`${redirectUri}?${params}`, 302);
+        return redirectTo(`${redirectUri}?${params}`);
     }
 }
 // ─── Token endpoint ──────────────────────────────────────────────────────────

package/dist/resources/OrgEventCatchup.js

@@ -23,7 +23,7 @@ export class OrgEventCatchup extends Resource {
     async get(pathInfo) {
         // Harper v5 does not populate this.request on Resource subclasses —
         // getContext() is the only reliable path to the gate's tpsAgent/
-        // tpsAgentIsAdmin annotations (ops-sal4: the previous `(this as
+        // tpsAgentIsAdmin annotations (the previous `(this as
         // any).request` read was always undefined, so the ownership check below
         // never ran — fail-open cross-agent read).
         const auth = await resolveAgentAuth(this.getContext?.());

package/dist/resources/Presence.js

@@ -8,6 +8,8 @@
  *
  * Auth:
  *   GET  — public (returns only allowlisted fields; safe for public renderer).
+ *          currentTask is additionally content-gated to verified agents only
+ *          (#592) — anonymous callers get the roster with currentTask=null.
  *   POST — Ed25519 agent credential (TPS-Ed25519 header). Agent writes only its
  *          own record; cross-agent writes are rejected (403).
  *
@@ -15,9 +17,17 @@
  *   - Write: per-agent Ed25519 auth. Cross-agent → 403.
  *   - Read: field-allowlisted to public-safe set. No secrets, no admin data.
  *   - currentTask is agent-authored free text → cap length, escape on render.
+ *   - currentTask CONTENT gate (#592): the roster (id/displayName/role/
+ *     runtime/activity/presenceStatus/lastHeartbeatAt) is genuinely
+ *     public-safe and stays world-readable, but currentTask is free text that
+ *     the coordination convention (`presence set --task "investigating
+ *     <host>: <symptom>"`) has put customer names and preprod hostnames in.
+ *     sanitizeCurrentTask() only trims/caps length — it does not redact
+ *     content. get() additionally gates currentTask itself to verified
+ *     in-org agents only; see get()'s inline comment.
  */
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth } from "./agent-auth.js";
+import { resolveAgentAuth, verifyAgentRequest } from "./agent-auth.js";
 import { WINDOW_MS, isNonceReplay, recordNonce, importEd25519Key, b64ToArrayBuffer } from "./ed25519-auth.js";
 // ─── Constants ────────────────────────────────────────────────────────────────
 const CURRENT_TASK_MAX_LENGTH = 200;
@@ -32,7 +42,7 @@ function offlineThresholdMs() {
 }
 // ─── Nonce replay + crypto helpers ─────────────────────────────────────────────
 // WINDOW_MS, isNonceReplay/recordNonce (the ONE shared nonce store), and
-// importEd25519Key all live in ./ed25519-auth.ts (bd ops-c4op) — the single
+// importEd25519Key all live in ./ed25519-auth.ts — the single
 // shared implementation imported by auth-middleware.ts, agent-auth.ts, and
 // Presence.ts so a nonce recorded via any one of the three call sites is
 // visible to the other two, and the crypto/decoder logic can't drift.
@@ -98,8 +108,47 @@ export class Presence extends databases.flair.Presence {
      *
      * Joins Presence records with Agent metadata and derives presenceStatus.
      * Only allowlisted fields are returned (no secrets, no admin data).
+     *
+     * currentTask CONTENT gate (#592): Harper routes every GET — collection
+     * (`GET /Presence`) AND single-record (`GET /Presence/<id>`) — through this
+     * SAME method (REST.js: `resource.get(target, request)`, one call site for
+     * both; this override ignores `target` and always returns the full roster
+     * array), so gating once here, before the loop, covers every read path with
+     * no separate return site to miss.
+     *
+     * The gate keys off a valid TPS-Ed25519 SIGNATURE (verifyAgentRequest),
+     * NOT resolveAgentAuth()/allowVerified — and that distinction is the whole
+     * fix. /Presence is a public-passthrough in auth-middleware.ts: the
+     * middleware early-returns WITHOUT annotating tpsAgent/tpsAnonymous, so a
+     * resource-level resolver never sees a gate annotation for this path. Worse,
+     * Harper's `authorizeLocal` (config default true) auto-authorizes any
+     * *credential-less* loopback request as super_user — it injects request.user
+     * ONLY "when there is no Authorization header" (node .../server/http.js). So a
+     * bare, unauthenticated `GET /Presence` from loopback (exactly the anonymous
+     * caller the issue is about, and what the integration test exercises against
+     * a real spawned Harper) arrives with request.user = super_user and NO
+     * signature. resolveAgentAuth() would classify that as `kind:"agent"` (its
+     * super_user branch) and leak currentTask — which it did, against real
+     * Harper, even though mocked unit tests using tpsAgent annotations passed.
+     * A TPS-Ed25519 signature, by contrast, cannot be manufactured by
+     * authorizeLocal (it requires the Authorization header, which suppresses the
+     * super_user injection), so verifyAgentRequest() cleanly separates a real
+     * in-org agent from an anonymous/loopback/Basic-admin caller. Only a valid
+     * agent signature gets currentTask; everything else (anonymous, loopback
+     * super_user, Basic-admin, internal in-process) gets currentTask=null.
+     * allowRead() is UNCHANGED (still `true`) — the roster itself stays public;
+     * only the free-text field is gated, per the issue's field-level option.
      */
     async get() {
+        // Extract the raw request the same way post() does (getContext().request
+        // is populated for GET; fall back to the context itself). verifyAgentRequest
+        // returns the agent for a valid TPS-Ed25519 signature, else null — see the
+        // gate rationale above. Memoized per-request, so this is a no-op if any
+        // other path already verified the same request.
+        const ctx = this.getContext?.();
+        const request = ctx?.request ?? ctx;
+        const agentAuth = request ? await verifyAgentRequest(request) : null;
+        const includeCurrentTask = agentAuth !== null;
         const now = Date.now();
         const idleThreshold = idleThresholdMs();
         const offlineThreshold = offlineThresholdMs();
@@ -124,7 +173,10 @@ export class Presence extends databases.flair.Presence {
                     presenceStatus: derivePresenceStatus(now, typeof row?.lastHeartbeatAt === "number"
                         ? row.lastHeartbeatAt
                         : Number(row?.lastHeartbeatAt ?? 0), idleThreshold, offlineThreshold),
-                    currentTask: sanitizeCurrentTask(row?.currentTask),
+                    // Anonymous/unverified readers get `null` here (key stays present,
+                    // schema-stable) instead of the sanitized task text — see the
+                    // currentTask CONTENT gate doc above get().
+                    currentTask: includeCurrentTask ? sanitizeCurrentTask(row?.currentTask) : null,
                     lastHeartbeatAt: typeof row?.lastHeartbeatAt === "number"
                         ? row.lastHeartbeatAt
                         : Number(row?.lastHeartbeatAt ?? 0),

package/dist/resources/Relationship.js

@@ -1,6 +1,7 @@
 import { databases } from "@harperfast/harper";
 import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
+import { localInstanceId } from "./instance-identity.js";
 const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
 /**
  * Relationship resource — entity-to-entity relationships with temporal validity.
@@ -16,7 +17,7 @@ const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { s
 export class Relationship extends databases.flair.Relationship {
     /**
      * Self-authorize now that the global gate is non-rejecting (memory-soul-
-     * read-gate family fix, ops-oox7 — same pattern as Memory.ts/Soul.ts/
+     * read-gate family fix — same pattern as Memory.ts/Soul.ts/
      * WorkspaceState.ts). Closes the same P0 leak: Harper routes
      * `GET /Relationship/<id>` to get() and the collection describe
      * (`GET /Relationship`) outside search(), so neither was gated before this
@@ -124,6 +125,14 @@ export class Relationship extends databases.flair.Relationship {
         content.validFrom = content.validFrom || now;
         // validTo left as null/undefined for active relationships
         content.confidence = content.confidence ?? 1.0;
+        // Write-time originatorInstanceId stamp (federation-edge-hardening slice
+        // 1) — see resources/Memory.ts's stampOriginatorInstanceId doc for the
+        // full contract. No-op if already set (never fires for a genuine local
+        // write; a federation-synced record never reaches this method — the
+        // merge path writes via the raw table object, bypassing this class).
+        if (content.originatorInstanceId == null) {
+            content.originatorInstanceId = await localInstanceId();
+        }
         return super.put(content);
     }
     async delete(_) {

package/dist/resources/SemanticSearch.js

@@ -11,7 +11,7 @@ import { isRerankEnabled, getRerankTopN, getRerankBudgetMs, getRerankMinCandidat
 // relevance floor) lives in ./scoring.ts — a Harper-free module so it can be
 // unit-tested directly (see test/unit/temporal-scoring.test.ts).
 import { compositeScore } from "./scoring.js";
-// BM25 + union-RRF hybrid retrieval (ops-i39b / FLAIR-BM25-HYBRID-RETRIEVAL).
+// BM25 + union-RRF hybrid retrieval (FLAIR-BM25-HYBRID-RETRIEVAL).
 // Harper-free modules so the BM25 scoring, the candidate-union RRF, and the
 // SECURITY conditions-filter are unit-tested against the shipped code.
 import { buildBM25, fuseRrfNormalized, hybridEnabled, SEM_LIMIT } from "./bm25.js";
@@ -81,10 +81,10 @@ export class SemanticSearch extends Resource {
             ? authenticatedAgent
             : bodyAgentId;
         // Read-scope: own (any visibility) + granted owners' SHARED memories only
-        // (ops-2dm3 Layer 1). Centralized in resolveReadScope() — this used to be
+        // (Layer 1). Centralized in resolveReadScope() — this used to be
         // an inline grant-resolution loop here PLUS a `visibility === "office"`
         // global OR-clause below that leaked ANY authenticated agent's read of
-        // ANY other agent's office-visible memories (ops-nzxa). Both are gone;
+        // ANY other agent's office-visible memories. Both are gone;
         // this is the ONE scoping resolution for this endpoint now.
         const scope = agentId ? await resolveReadScope(agentId) : null;
         // Generate query embedding
@@ -162,13 +162,13 @@ export class SemanticSearch extends Resource {
         // from CANDIDATE_MULTIPLIER so composite re-ranking keeps its existing
         // headroom. Scoped to the legacy (non-hybrid) vector path below — the
         // hybrid path's candidate pool is already governed by CANDIDATE_MULTIPLIER
-        // (semantic leg) + SEM_LIMIT (BM25 leg) via RRF union (ops-i39b); the
+        // (semantic leg) + SEM_LIMIT (BM25 leg) via RRF union; the
         // reranker still applies to its output further down regardless of which
         // path produced `filteredResults`.
         const rerankOn = isRerankEnabled();
         const rerankTopN = getRerankTopN();
         if (hybrid) {
-            // ─── BM25 + union-RRF hybrid path (ops-i39b) ─────────────────────────
+            // ─── BM25 + union-RRF hybrid path ────────────────────────────────────
             // 1. Semantic candidates via HNSW (unchanged fetch). 2. BM25 lexical pass
             //    over the SCOPED corpus. 3. SECURITY: the BM25 candidate set is filtered
             //    by the SAME conditions[] + temporal filters BEFORE fusion (the corpus
@@ -206,7 +206,7 @@ export class SemanticSearch extends Resource {
                         continue;
                     if (asOf && record.validTo && record.validTo <= asOf)
                         continue;
-                    // ops-9rc6: unconditional past-validTo exclusion (see legacy HNSW
+                    // Unconditional past-validTo exclusion (see legacy HNSW
                     // loop below for the full rationale) — applies regardless of asOf.
                     if (record.validTo && Date.parse(record.validTo) < Date.now())
                         continue;
@@ -315,7 +315,7 @@ export class SemanticSearch extends Resource {
                     continue;
                 if (asOf && record.validTo && record.validTo <= asOf)
                     continue;
-                // ops-9rc6: a past validTo ALWAYS means the record has been closed out
+                // A past validTo ALWAYS means the record has been closed out
                 // (server supersede path — Memory.ts closeSupersededRecord — sets
                 // validTo without necessarily setting `archived`). Unconditional, not
                 // gated on `asOf`, so a server-superseded record can't resurface in
@@ -330,9 +330,9 @@ export class SemanticSearch extends Resource {
                     semanticScore = distanceToSimilarity(record.$distance);
                 }
                 else {
-                    // ─── ops-syzm: Harper's cosine-sort query omits $distance for a
+                    // ─── Harper's cosine-sort query omits $distance for a
                     // SINGLETON post-filter result set — the SAME quirk root-caused and
-                    // fixed for the dedup path in ops-ume4 (resources/Memory.ts
+                    // fixed for the dedup path (resources/Memory.ts
                     // findConservativeDedupMatch / resources/dedup.ts cosineSimilarity).
                     // Sort ORDER is still correct; only the numeric `$distance`
                     // annotation is missing on that one record, regardless of the
@@ -340,7 +340,7 @@ export class SemanticSearch extends Resource {
                     // just limit=1 — the trigger is the post-filter MATCH COUNT, not the
                     // requested limit).
                     //
-                    // ops-2dm3 Layer 1 made this common: the no-grants agent scope used
+                    // Layer 1 made this common: the no-grants agent scope used
                     // to ALWAYS be a compound `{operator:"or", conditions:[{agentId},
                     // {visibility=="office"}]}` condition; resolveReadScope() now emits
                     // a PLAIN single `{agentId==X}` condition for the common (no-grants)
@@ -354,8 +354,8 @@ export class SemanticSearch extends Resource {
                     //
                     // Fix: point-lookup the record by id (a plain get(), unaffected by
                     // the sort-query quirk — selecting "embedding" directly on the SAME
-                    // sort-by-embedding query comes back as a bare scalar per ops-ume4's
-                    // findings) and compute cosine similarity ourselves in JS from its
+                    // sort-by-embedding query comes back as a bare scalar, per the same
+                    // investigation above) and compute cosine similarity ourselves in JS from its
                     // real stored `embedding` vector against this query's `qEmb`, via
                     // the same math as the ume4 fallback (dedup.ts's cosineSimilarity).
                     // Only done on this (rare) undefined-$distance branch — never adds
@@ -405,7 +405,7 @@ export class SemanticSearch extends Resource {
                     continue;
                 if (asOf && record.validTo && record.validTo <= asOf)
                     continue;
-                // ops-9rc6: unconditional past-validTo exclusion (see legacy HNSW
+                // Unconditional past-validTo exclusion (see legacy HNSW
                 // loop above for the full rationale) — applies regardless of asOf.
                 if (record.validTo && Date.parse(record.validTo) < Date.now())
                     continue;
@@ -449,7 +449,7 @@ export class SemanticSearch extends Resource {
         // Re-scores query+candidate TOGETHER (cross-attention the pooled embedding
         // can't do) and reorders before the final slice. Reorders whatever
         // `filteredResults` the retrieval stage above produced — legacy HNSW-only
-        // OR the BM25+union-RRF hybrid path (ops-i39b) — since both converge into
+        // OR the BM25+union-RRF hybrid path — since both converge into
         // the same `results`/`filteredResults` shape before this point; hybrid
         // retrieves+fuses, the reranker only reorders the fused set. Still gated
         // on `qEmb` (an embedding was actually generated); the pure keyword-only

package/dist/resources/Soul.js

@@ -1,5 +1,6 @@
 import { databases } from "@harperfast/harper";
 import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
+import { localInstanceId } from "./instance-identity.js";
 const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
 const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
 /**
@@ -37,6 +38,14 @@ export class Soul extends databases.flair.Soul {
         content.durability ||= "permanent";
         content.createdAt = new Date().toISOString();
         content.updatedAt = content.createdAt;
+        // Write-time originatorInstanceId stamp (federation-edge-hardening slice
+        // 1) — see resources/Memory.ts's stampOriginatorInstanceId doc for the
+        // full contract. No-op if already set (never fires for a genuine local
+        // write; a federation-synced record never reaches this method — the
+        // merge path writes via the raw table object, bypassing this class).
+        if (content.originatorInstanceId == null) {
+            content.originatorInstanceId = await localInstanceId();
+        }
         return super.post(content, context);
     }
     async put(content, context) {
@@ -44,6 +53,11 @@ export class Soul extends databases.flair.Soul {
         if (denied)
             return denied;
         content.updatedAt = new Date().toISOString();
+        // Write-time originatorInstanceId stamp — see post() above / Memory.ts's
+        // stampOriginatorInstanceId doc. No-op if already set.
+        if (content.originatorInstanceId == null) {
+            content.originatorInstanceId = await localInstanceId();
+        }
         return super.put(content, context);
     }
 }

package/dist/resources/WorkspaceLatest.js

@@ -16,7 +16,7 @@ export class WorkspaceLatest extends Resource {
     async get(pathInfo) {
         // Harper v5 does not populate this.context / this.request on Resource
         // subclasses — getContext() is the only reliable path to the gate's
-        // tpsAgent/tpsAgentIsAdmin annotations (ops-sal4: the previous
+        // tpsAgent/tpsAgentIsAdmin annotations (the previous
         // `(this as any).context?.request ?? (this as any).request` read was always
         // undefined, so the ownership check below never ran — fail-open cross-agent
         // read).

package/dist/resources/WorkspaceState.js

@@ -20,7 +20,7 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
     }
     /**
      * Self-authorize now that the global gate is non-rejecting (memory-soul-
-     * read-gate family fix, ops-oox7 — applying the Memory.ts/Soul.ts pattern
+     * read-gate family fix — applying the Memory.ts/Soul.ts pattern
      * to WorkspaceState/Relationship/Integration/MemoryGrant). Closes the same
      * P0 leak: Harper routes `GET /WorkspaceState/<id>` to get() and the
      * collection describe (`GET /WorkspaceState`) to a path outside search(),

package/dist/resources/agent-auth.js

@@ -26,7 +26,7 @@ import { WINDOW_MS, isNonceReplay, recordNonce, importEd25519Key, b64ToArrayBuff
 export const FLAIR_AGENT_USERNAME = "flair-agent";
 // ─── Crypto + replay-guard helpers ────────────────────────────────────────────
 // WINDOW_MS, isNonceReplay/recordNonce (the ONE shared nonce store), and
-// importEd25519Key all live in ./ed25519-auth.ts (bd ops-c4op) — the single
+// importEd25519Key all live in ./ed25519-auth.ts — the single
 // shared implementation imported by auth-middleware.ts, agent-auth.ts, and
 // Presence.ts so a nonce recorded via any one of the three call sites is
 // visible to the other two, and the crypto/decoder logic can't drift.

package/dist/resources/agentcard-fields.js

@@ -9,7 +9,7 @@
 //
 // Kept free of any @harperfast/harper import so the real logic is unit-testable
 // without spinning up Harper (avoids the simulator-pattern that let the
-// description-fallback leak ship untested — ops-vz6j).
+// description-fallback leak ship untested).
 export function readSoulKind(entry) {
     return String(entry.kind ?? entry.key ?? "").trim().toLowerCase();
 }
@@ -20,7 +20,7 @@ export function readSoulContent(entry) {
  * The public description is ONLY an explicit `kind="description"` soul.
  *
  * There is deliberately no fallback to "the first soul with any content": that
- * was the ops-vz6j leak — an agent with no description soul would publish an
+ * was the description-fallback leak — an agent with no description soul would publish an
  * arbitrary private soul on the unauthenticated card. Absent an explicit
  * description, publish nothing.
  */

package/dist/resources/auth-middleware.js

@@ -38,7 +38,7 @@ function getAdminPass() {
 // an admin — one implementation guarantees they can't diverge.
 // ─── Crypto + replay-guard helpers ────────────────────────────────────────────
 // WINDOW_MS, isNonceReplay/recordNonce (the ONE shared nonce store), and
-// importEd25519Key all live in ./ed25519-auth.ts (bd ops-c4op) — the single
+// importEd25519Key all live in ./ed25519-auth.ts — the single
 // shared implementation imported by auth-middleware.ts, agent-auth.ts, and
 // Presence.ts so a nonce recorded via any one of the three call sites is
 // visible to the other two, and the crypto/decoder logic can't drift.
@@ -97,9 +97,28 @@ server.http(async (request, nextLayer) => {
         // instances (rockit-local works only because authorizeLocal=true).
         url.pathname === "/ObservationCenter" ||
         // Presence roster is public-safe (field-allowlisted); GET serves the
-        // Office Space renderer without auth. POST handles Ed25519 auth internally
-        // (allowCreate=true on the Resource).
-        url.pathname === "/Presence")
+        // Office Space renderer without auth. Scoped to GET only (#604): the
+        // exact-path match used to match ANY method, so a bare `PUT /Presence`
+        // (collection-level, no id — Harper routes it to the same .put() as
+        // by-id PUT) early-returned here too, skipping this middleware entirely.
+        // A credential-less loopback PUT then reached Presence.put()'s
+        // resolveAgentAuth() call with NO tpsAnonymous/tpsAgent annotation, which
+        // fell through to raw `context.user` — populated by Harper's
+        // `authorizeLocal` (config true) ambient super_user injection for ANY
+        // credential-less loopback request — so the ownership check saw an
+        // "admin" caller (isAdmin=true) and let the write through unauthenticated
+        // (`super.put()`, no signature, no password). Mirrors the A2A GET-only
+        // pattern above: POST/PUT/DELETE now always transit the general
+        // middleware path below, which marks a genuinely headerless request
+        // tpsAnonymous BEFORE Harper's ambient elevation lands (resolveAgentAuth
+        // checks tpsAnonymous first — see agent-auth.ts's resolution order), so
+        // the ownership check in Presence.put()/delete() correctly denies it.
+        // POST (the heartbeat) is unaffected in practice: it already prefers
+        // request.tpsAgent when the middleware set it, and falls back to its own
+        // Ed25519 header parse otherwise — transiting the general path now just
+        // means a genuinely headerless POST gets marked anonymous (still 401)
+        // instead of skipping straight to that fallback parse.
+        (request.method === "GET" && url.pathname === "/Presence"))
         return nextLayer(request);
     // If Harper has already authorized this request (e.g. Basic admin, or
     // authorizeLocal=true on localhost), trust Harper's auth decision and pass
@@ -477,7 +496,7 @@ server.http(async (request, nextLayer) => {
                 if (memId) {
                     const record = await databases.flair.Memory.get(memId);
                     if (record && record.agentId && record.agentId !== agentId) {
-                        // Centralized read-scope (ops-2dm3 Layer 1): a grant only covers
+                        // Centralized read-scope (Layer 1): a grant only covers
                         // the owner's SHARED memories, never their private ones. This
                         // used to be a `visibility === "office"` bypass (any authenticated
                         // agent, no grant needed) — that's gone; the private-exclusion is

package/dist/resources/bm25-filter.js

@@ -72,7 +72,7 @@ export function passesRecordFilters(record, f = {}) {
         return false;
     if (f.asOf && record?.validTo && record.validTo <= f.asOf)
         return false;
-    // ops-9rc6: a past validTo ALWAYS means the record has been closed out —
+    // A past validTo ALWAYS means the record has been closed out —
     // either by the server supersede path (Memory.ts closeSupersededRecord sets
     // validTo without necessarily setting `archived`) or any other writer. This
     // is unconditional (not gated on `f.asOf`) so a server-superseded record

package/dist/resources/bm25.js

@@ -1,5 +1,5 @@
 // ─── BM25 + union-RRF hybrid retrieval (Harper-free, unit-testable) ──────────
-// Per spec FLAIR-BM25-HYBRID-RETRIEVAL (Kern-approved, ops-i39b). This module is
+// Per spec FLAIR-BM25-HYBRID-RETRIEVAL (Kern-approved). This module is
 // deliberately Harper-free — same rationale as ./scoring.ts — so the BM25
 // scoring, the candidate-union RRF fusion, and the security conditions-filter
 // can be unit-tested directly against the SHIPPED code without a live Harper.

package/dist/resources/dedup.js

@@ -30,10 +30,10 @@ export const DEDUP_MIN_CONTENT_LENGTH = 20;
  * Cosine similarity of two equal-length embedding vectors, computed directly
  * in JS. Used as a fallback for Harper's HNSW cosine-sort query omitting a
  * computed `$distance` on its top candidate when the query's post-filter
- * result set contains exactly ONE matching record (ops-ume4, found in
+ * result set contains exactly ONE matching record (found in
  * resources/Memory.ts's findConservativeDedupMatch; the identical quirk is
  * also fixed in resources/SemanticSearch.ts's scoring loop for the same
- * reason — see ops-syzm there). A mismatched length, empty vector, or
+ * reason). A mismatched length, empty vector, or
  * zero-magnitude side yields 0 (no signal, never treated as "identical" by a
  * degenerate computation).
  */

package/dist/resources/ed25519-auth.js

@@ -11,8 +11,8 @@
  * `importEd25519Key`. Three independent replay windows meant a nonce
  * recorded as "seen" via one path was invisible to the other two — a
  * defense-in-depth gap, and a drift hazard (any future fix to one copy
- * silently didn't apply to the other two). bd ops-c4op consolidates all
- * three into this one module so there is exactly ONE replay guard and ONE
+ * silently didn't apply to the other two). Consolidating all three into
+ * this one module means there is exactly ONE replay guard and ONE
  * key-import implementation, imported by all 3 sites.
  *
  * `b64ToArrayBuffer` was already unified into resources/b64.ts in a prior

package/dist/resources/embeddings-provider.js

@@ -65,7 +65,7 @@ async function ensureInit() {
         // Not initialized — init with modelsDir pointing at a USER-WRITABLE
         // location. On a sudo/root-owned global install the Flair package dir
         // (process.cwd()) is root-owned, so a model download into <cwd>/models
-        // fails with EACCES and semantic search silently dies (ops-am0v). The
+        // fails with EACCES and semantic search silently dies. The
         // model — and everything else Flair writes — must live under ~/.flair.
         //
         // NOTE: import.meta.dirname and __dirname are both undefined in Harper v5's