@tpsdev-ai/flair 0.20.1 → 0.21.0

package/schemas/federation.graphql

@@ -39,6 +39,18 @@ type Peer @table(database: "flair") @export {
   updatedAt: String
 }
 
+# Anti-replay nonce store (federation-edge-hardening slice 4).
+# Persists nonces recorded by verifyBodySignatureFresh (federation-crypto.ts)
+# so an instance restart doesn't wipe recently-seen nonces — closes the
+# ±30s freshness-window replay gap a restart would otherwise reopen. Nonces
+# are already globally unique (128-bit random, generated per request by
+# signBodyFresh), so the nonce string itself is the primary key — no scope
+# prefix needed. Internal bookkeeping only: never served, never replicated.
+type Nonce @table(database: "flair") {
+  id: ID @primaryKey               # the nonce string (base64url, 128-bit random)
+  seenAt: Int! @indexed            # ms-epoch when first recorded — eviction cutoff
+}
+
 # Sync log — audit trail for federation operations.
 type SyncLog @table(database: "flair") {
   id: ID @primaryKey

package/schemas/memory.graphql

@@ -31,6 +31,16 @@ type Memory @table(database: "flair") {
   validFrom: String @indexed   # ISO timestamp — when this fact became true
   validTo: String @indexed     # ISO timestamp — when this fact stopped being true (null = still valid)
   _safetyFlags: [String]       # content safety flags from scanContent()
+  provenance: String           # JSON blob (memory-provenance slice 1): { v, verified: { agentId, timestamp }, claimed?: { model } }
+                               # Nullable by design — existing rows read back provenance = null, unchanged behavior (clean-upgrade-path gate).
+                               # Same idiom as Soul.metadata below. Stamped server-side in resources/Memory.ts; never client-writable.
+  originatorInstanceId: String @indexed  # federation-edge-hardening slice 1: WRITE-TIME instance identity, stamped server-side in
+                               # resources/Memory.ts from resources/instance-identity.ts's localInstanceId() — never client-writable.
+                               # Nullable (existing rows read null = clean upgrade). Distinct from the legacy _originatorInstanceId
+                               # (Federation.ts's mergeRecord — stamped by the RECEIVER at merge time, forgeable/lossy); this field is
+                               # stamped by the ORIGINATING instance itself and preserved (never re-stamped) as the record flows through
+                               # sync merges. @indexed for the later sync push-query filter (per-record signature verification and the
+                               # classifier org-gate are separate, later slices — not built here).
 }
 
 # Explicit entity-to-entity relationships with temporal validity.
@@ -48,6 +58,9 @@ type Relationship @table(database: "flair") {
   source: String                   # where this was learned (memory ID, conversation, etc.)
   createdAt: String! @indexed
   updatedAt: String
+  originatorInstanceId: String @indexed  # federation-edge-hardening slice 1 — see Memory.originatorInstanceId's doc above
+                                    # for the full contract (write-time stamp, nullable, preserved across sync merges).
+                                    # Stamped server-side in resources/Relationship.ts's put().
 }
 
 type Soul @table(database: "flair") {
@@ -60,6 +73,9 @@ type Soul @table(database: "flair") {
   durability: String @indexed
   createdAt: String!
   updatedAt: String
+  originatorInstanceId: String @indexed  # federation-edge-hardening slice 1 — see Memory.originatorInstanceId's doc above
+                                    # for the full contract (write-time stamp, nullable, preserved across sync merges).
+                                    # Stamped server-side in resources/Soul.ts's post()/put().
 }
 
 type MemoryGrant @table(database: "flair") @export {