@tpsdev-ai/flair 0.22.0 → 0.23.0

package/dist/doctor-client.js

@@ -135,6 +135,37 @@ function scanCodexFlairBlock(raw) {
     const flairUrl = urlMatch?.[1] || undefined;
     return { present: !!agentId && !!flairUrl, agentId, flairUrl };
 }
+// ── check 2: FLAIR_URL to use when (re-)wiring a client (flair#727) ────────
+/**
+ * Pick the FLAIR_URL to feed a wire() call when `doctor --fix` re-wires a
+ * client whose block was judged "not present" (readClientMcpBlock — missing
+ * FLAIR_AGENT_ID and/or FLAIR_URL). A pre-existing config can still carry a
+ * `flairUrl` fragment (e.g. `present:false` because FLAIR_AGENT_ID is empty,
+ * but FLAIR_URL scanned fine) — and that fragment can itself be malformed: a
+ * bare host with no scheme/port (`"127.0.0.1"`), left over from an older
+ * Flair version or a hand-edited config. Blindly reusing it perpetuates the
+ * corruption into the freshly suggested block (flair#727 — a real dogfood
+ * run printed exactly `FLAIR_URL = "127.0.0.1"`, unusable if pasted).
+ *
+ * Only trust `existingFlairUrl` when it parses as an absolute http(s) URL;
+ * otherwise fall back to `baseUrl` — the live, authoritative URL `doctor`
+ * already computed from the same port source as its "Config: ... (port:
+ * NNNNN)" line (resolveHttpPort / readPortFromConfig, with live-port
+ * discovery layered on top).
+ */
+export function resolveWireFlairUrl(existingFlairUrl, baseUrl) {
+    if (existingFlairUrl) {
+        try {
+            const parsed = new URL(existingFlairUrl);
+            if (parsed.protocol === "http:" || parsed.protocol === "https:")
+                return existingFlairUrl;
+        }
+        catch {
+            // Not an absolute URL (e.g. a bare host like "127.0.0.1") — fall through.
+        }
+    }
+    return baseUrl;
+}
 /**
  * Pass when EITHER the project-scoped `${cwd}/CLAUDE.md` or the user-level
  * `~/.claude/CLAUDE.md` contains the bootstrap marker — Claude Code loads
@@ -310,3 +341,148 @@ export function applyOrReportSessionStartHook(homeDir, agentId, skip) {
     const fix = fixSessionStartHook(homeDir, agentId);
     return { applied: fix.ok, ok: fix.ok, message: fix.message, hint: fix.ok ? undefined : hint };
 }
+// ── check 5: per-agent iteration for verified-read sections (flair#722) ────
+//
+// `doctor`'s Fleet presence and Migrations sections need a signed (Ed25519)
+// request to reveal server-verified fields (flairVersion/harperVersion,
+// migration state) — previously that meant passing --agent explicitly, even
+// though doctor already enumerates every key in ~/.flair/keys (the "Keys
+// found: N agent(s)" line above). A real dogfood run found the #720
+// halted-migration warning visible via `flair status --agent local` but
+// invisible in the default `doctor` run the same user ran minutes later.
+//
+// These two functions are the pure decision logic for iterating and
+// rendering per agent — no fs, no network, no crypto — so they're
+// unit-testable the same way as the rest of this module. The actual signed
+// fetches (which reuse authFetch/checkAgentRegistered, private to cli.ts)
+// stay in src/cli.ts and call these to decide who to iterate and how a given
+// agent's registration-gate outcome should render.
+/**
+ * Decide which agent ids the verified-read sections should iterate over.
+ *   - `agentFlag` given -> exactly that one id (a plain filter — unchanged
+ *     pre-#722 semantics: doctor still tries a single signed identity, it
+ *     just doesn't widen to "every key"). Doesn't require the id to already
+ *     have a key on disk; the registration gate reports "no local key" for
+ *     that case rather than silently expanding the search.
+ *   - no `agentFlag` -> every id in `keyAgentIds` (the ~/.flair/keys
+ *     enumeration doctor's own "Keys found" check already did), sorted for
+ *     deterministic, reproducible output across runs.
+ */
+export function planAgentIterations(keyAgentIds, agentFlag) {
+    if (agentFlag)
+        return [agentFlag];
+    return [...keyAgentIds].sort();
+}
+/**
+ * Render decision for one agent's registration-gate outcome, ahead of a
+ * verified-read section (Fleet presence / Migrations). Returns null when the
+ * agent is registered — the caller should proceed with its actual signed
+ * read for that agent. Otherwise returns the finding to print for THAT
+ * agent's subsection; the caller must still move on to the next agent
+ * (failure isolation, flair#722) rather than aborting the whole section.
+ */
+export function describeAgentGateFinding(agentId, state, detail) {
+    switch (state) {
+        case "registered":
+            return null;
+        case "no-key":
+            return {
+                icon: "warn",
+                message: `no local key for '${agentId}' — skipping${detail ? ` (${detail})` : ""}`,
+                isIssue: false,
+            };
+        case "not-registered":
+            return {
+                icon: "error",
+                message: `agent '${agentId}' has a local key but is NOT registered on this Flair instance`,
+                // Two ways out, both actionable — register it if it should exist, or
+                // (flair#734) clean it up if it's a stale/leftover key. `flair keys
+                // prune` never touches a key that IS registered, so it's always a
+                // safe suggestion here even when the right fix is actually `agent add`.
+                fixHint: `flair agent add ${agentId} (if it should be registered) — or flair keys prune (if it's a stale/leftover key)`,
+                isIssue: true,
+            };
+        case "unreachable":
+            return {
+                icon: "warn",
+                message: `could not verify agent '${agentId}' registration${detail ? ` (${detail})` : ""}`,
+                isIssue: false,
+            };
+    }
+}
+// ── check 6: `flair keys prune` classification (flair#734) ─────────────────
+//
+// Follow-up to #731's doctor agent-iteration, which made previously-invisible
+// stale keys visible (each renders as a "not registered" gate finding, check
+// 5 above) but shipped no command to act on it — every doctor run just
+// re-reported the same noise. `flair keys prune` (src/cli.ts) walks the key
+// dir and moves anything it can positively classify as prunable into
+// `<keysDir>/.pruned/<date>/` — never deletes. The network-dependent half
+// (is this agentId actually registered?) reuses checkAgentRegistered
+// (src/cli.ts), the exact same signed GET /Agent/:id check 5's gate uses.
+// This module only owns the PURE decision — given a file's seed-validity and
+// (if checked) registration state, what class is it and why — plus two
+// path/naming helpers pure enough to live here (no crypto, no network).
+/** Name of the archive subdirectory prune moves prunable files into —
+ *  `<keysDir>/.pruned/<date>/`. Also the one directory name the scanner
+ *  itself must skip when walking the key dir (never re-classify prune's own
+ *  archive as a candidate). */
+export const PRUNED_DIR_NAME = ".pruned";
+/** `YYYY-MM-DD`, UTC — the `<date>` component of the archive path. UTC (not
+ *  local time) so a single prune run always lands in exactly one date
+ *  bucket regardless of the host's timezone. */
+export function pruneDateStamp(now = new Date()) {
+    return now.toISOString().slice(0, 10);
+}
+/**
+ * Pick a collision-free destination filename for a move into an archive
+ * directory that may already hold a file of the same name (e.g. two prune
+ * runs on the same UTC day). Preserves the original name whenever possible;
+ * on collision appends `.2`, `.3`, ... until free. Pure — the caller supplies
+ * the set of names already present (or about to be present, within the same
+ * run) at the destination; no fs access happens here.
+ */
+export function resolveCollisionSafeName(existingNames, filename) {
+    const existing = existingNames instanceof Set ? existingNames : new Set(existingNames);
+    if (!existing.has(filename))
+        return filename;
+    let n = 2;
+    while (existing.has(`${filename}.${n}`))
+        n++;
+    return `${filename}.${n}`;
+}
+/**
+ * Classify one `.key` file given whether its seed parsed (`seedValid`) and,
+ * if it did, the registration-gate result checkAgentRegistered (src/cli.ts)
+ * returned for it — the SAME check doctor's "not registered" finding above
+ * is built from. Pure — no fs/crypto/network; the caller (classifyKeysDir,
+ * src/cli.ts) does the actual file read, seed parse, and signed registration
+ * check, and only calls this to decide what the result means.
+ *
+ * `registration` is ignored (pass null) when `seedValid` is false — an
+ * unparseable seed can't be signed with, so it was never checked against the
+ * instance, regardless of what agentId its filename implies.
+ *
+ * Deliberately has no case for "unreachable": classifyKeysDir aborts the
+ * WHOLE run before classifying anything once the instance is confirmed
+ * unreachable (never classify offline) — this function is only ever called
+ * once that's already been ruled out.
+ */
+export function classifyKeyFile(agentId, seedValid, registration, baseUrl) {
+    if (!seedValid) {
+        return { class: "invalid", reason: "not a parseable Ed25519 private key seed" };
+    }
+    if (registration?.state === "registered") {
+        return { class: "keep", reason: `agent '${agentId}' is registered on ${baseUrl} — never pruned` };
+    }
+    // "not-registered", "no-key", or (defensively) no registration result at
+    // all — every one of those means we could not confirm this agent is
+    // registered, so it's prunable. "no-key" is not expected in practice here
+    // (the file we just parsed a valid seed FROM is itself the key
+    // checkAgentRegistered would sign with), but is handled the same way
+    // rather than left as an unclassified gap.
+    return {
+        class: "stale",
+        reason: `agent '${agentId}' is not registered on ${baseUrl}${registration?.detail ? ` (${registration.detail})` : ""}`,
+    };
+}

package/dist/install/clients.js

@@ -110,15 +110,22 @@ function flairMcpEntry(env) {
     return {
         command: "npx",
         args: ["-y", "@tpsdev-ai/flair-mcp"],
-        env: { FLAIR_AGENT_ID: env.FLAIR_AGENT_ID, FLAIR_URL: env.FLAIR_URL },
+        env: {
+            FLAIR_AGENT_ID: env.FLAIR_AGENT_ID,
+            FLAIR_URL: env.FLAIR_URL,
+            // flair#718 — only present when the caller set it; absent = omitted,
+            // not written as FLAIR_CLIENT: undefined.
+            ...(env.FLAIR_CLIENT ? { FLAIR_CLIENT: env.FLAIR_CLIENT } : {}),
+        },
     };
 }
 /** Pretty-printed JSON `mcpServers.flair` snippet for copy-paste fallbacks. */
 function jsonSnippet(env) {
     return JSON.stringify({ mcpServers: { flair: flairMcpEntry(env) } }, null, 2);
 }
-/** TOML `[mcp_servers.flair]` snippet (Codex format). */
-function tomlSnippet(env) {
+/** TOML `[mcp_servers.flair]` snippet (Codex format). Exported for tests
+ * (flair#727 — asserts the rendered template carries a full scheme+port URL). */
+export function tomlSnippet(env) {
     return [
         `[mcp_servers.flair]`,
         `command = "npx"`,
@@ -127,8 +134,32 @@ function tomlSnippet(env) {
         `[mcp_servers.flair.env]`,
         `FLAIR_AGENT_ID = "${env.FLAIR_AGENT_ID}"`,
         `FLAIR_URL = "${env.FLAIR_URL}"`,
+        // flair#718 — only present when the caller set it (same rule as flairMcpEntry above).
+        ...(env.FLAIR_CLIENT ? [`FLAIR_CLIENT = "${env.FLAIR_CLIENT}"`] : []),
     ].join("\n");
 }
+/**
+ * True when `raw` TOML content already has a `[mcp_servers.flair]` header —
+ * the same detection scanCodexFlairBlock (src/doctor-client.ts) uses to
+ * decide whether the block is present. Pure string scan; no TOML parser
+ * (see the comment on _wireCodex below for why).
+ */
+export function codexConfigHasFlairSection(raw) {
+    return /^\[mcp_servers\.flair\]\s*$/m.test(raw);
+}
+/**
+ * Pure merge: append the Flair TOML snippet to existing raw config.toml
+ * content. Callers MUST first confirm codexConfigHasFlairSection(raw) is
+ * false — appending a second `[mcp_servers.flair]` table would shadow/
+ * duplicate the first (TOML doesn't merge repeated table headers), so this
+ * function does not re-check; it just appends safely with a newline
+ * separator (mirrors fixClaudeMdBootstrap's separator logic in
+ * src/doctor-client.ts — never runs the new block into the prior line).
+ */
+export function appendCodexFlairBlock(raw, env) {
+    const separator = raw.length === 0 ? "" : raw.endsWith("\n\n") ? "" : raw.endsWith("\n") ? "\n" : "\n\n";
+    return raw + separator + tomlSnippet(env) + "\n";
+}
 /**
  * Merge the Flair MCP server into a JSON config file with an `mcpServers` map.
  * Creates the file (and parent dir) if absent; preserves existing servers and
@@ -211,18 +242,22 @@ function _wireClaudeCode(env) {
 }
 function _wireCodex(env) {
     // Codex uses TOML with a [mcp_servers.flair] table. We don't carry a TOML
-    // parser, and blind text-appending risks corrupting/duplicating an existing
-    // table — so we only auto-write when the file does NOT yet exist (clean
-    // create), otherwise emit the exact TOML block to paste.
+    // parser, but appending a new top-level table at EOF is safe TOML when the
+    // exact header isn't already present (flair#727) — so an existing file only
+    // forces the manual-print fallback when it's genuinely unreadable/
+    // unwritable (permissions, I/O error), never merely "exists". A file that
+    // already has the section is reported already-wired, matching the JSON
+    // clients' idempotency (wireJsonMcp above).
     const path = codexConfigPath();
     const display = "~/.codex/config.toml";
     try {
         if (existsSync(path)) {
-            return {
-                ok: false,
-                message: `Codex: manual wiring needed — ${display} already exists.\n` +
-                    `   Add this block to ${display}:\n${indent(tomlSnippet(env))}`,
-            };
+            const raw = readFileSync(path, "utf-8");
+            if (codexConfigHasFlairSection(raw)) {
+                return { ok: true, message: `Codex: already wired in ${display}` };
+            }
+            writeFileSync(path, appendCodexFlairBlock(raw, env));
+            return { ok: true, message: `Codex: wired ${display} (restart Codex to pick it up)` };
         }
         mkdirSync(dirname(path), { recursive: true });
         writeFileSync(path, tomlSnippet(env) + "\n");

package/dist/probe.js

@@ -64,27 +64,40 @@ export async function probeInstance(baseUrl, opts = {}) {
             version: null,
             versionMatch: null,
             ok: false,
+            authFailureKind: null,
             error: `instance did not answer ${base}/Health within ${timeoutMs}ms` +
                 (lastHealthError ? ` (last error: ${lastHealthError})` : ""),
         };
     }
     if (!authedGet) {
-        return { healthy: true, authenticated: null, version: null, versionMatch: null, ok: true };
+        return { healthy: true, authenticated: null, version: null, versionMatch: null, ok: true, authFailureKind: null };
     }
     let version = null;
     let authError;
+    let authFailureKind = null;
     try {
         const body = await authedGet(versionPath);
         version = typeof body?.version === "string" ? body.version : null;
     }
     catch (err) {
         authError = err?.message ?? String(err);
+        // flair#741: classify the failure so callers can tell "server responded,
+        // credentials rejected" (liveness proven) from "can't tell what state
+        // this instance is in". Duck-typed on `.status` — any authedGet
+        // implementation can opt in by throwing an error with a numeric status;
+        // api() (src/cli.ts) does via ApiHttpError. No recognizable status (a
+        // plain network error, or an authedGet that doesn't set one) stays
+        // conservative and lands in "server".
+        const status = typeof err?.status === "number" ? err.status : null;
+        authFailureKind = status === 401 || status === 403 ? "credentials" : "server";
     }
     const authenticated = authError === undefined;
     let versionMatch = null;
     if (authenticated && expectVersion !== undefined) {
         versionMatch = version === expectVersion;
     }
+    if (authenticated)
+        authFailureKind = null;
     const ok = healthy && authenticated && versionMatch !== false;
     let error;
     if (!authenticated) {
@@ -93,5 +106,5 @@ export async function probeInstance(baseUrl, opts = {}) {
     else if (versionMatch === false) {
         error = `version mismatch: expected ${expectVersion}, instance reports ${version ?? "unknown"}`;
     }
-    return { healthy, authenticated, version, versionMatch, ok, error };
+    return { healthy, authenticated, version, versionMatch, ok, error, authFailureKind };
 }

package/dist/resources/Memory.js

@@ -1,29 +1,44 @@
 import { databases } from "@harperfast/harper";
 import { patchRecord, withDetachedTxn } from "./table-helpers.js";
-import { isAdmin, resolveAgentAuth, allowVerified } from "./agent-auth.js";
+import { isAdmin, resolveAgentAuth } from "./agent-auth.js";
 import { localInstanceId } from "./instance-identity.js";
 import { getEmbedding, getModelId } from "./embeddings-provider.js";
 import { scanFields, isStrictMode } from "./content-safety.js";
 import { invalidEntitiesResponse } from "./entity-vocab.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
-import { resolveReadScope } from "./memory-read-scope.js";
 import { DEDUP_COSINE_THRESHOLD_DEFAULT, DEDUP_LEXICAL_THRESHOLD_DEFAULT, DEDUP_MIN_CONTENT_LENGTH, computeMatchConfidence, cosineSimilarity, isConservativeMatch, } from "./dedup.js";
-import { buildProvenance } from "./provenance.js";
-const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
-const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
-const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
+import { buildProvenance, makeAuthGate, makeReadScope, makeByIdReadGate, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
+import { RECORD_TYPES } from "./record-types.js";
 /**
- * Owner ids a non-admin agent may READ (resolveAllowedOwners) and the full
- * read-scope condition + private-exclusion predicate (resolveReadScope) now
- * live in ./memory-read-scope.ts — the ONE centralized helper every
- * cross-agent Memory read path (search()/get() here, SemanticSearch.ts,
- * MemoryBootstrap.ts, auth-middleware.ts's by-id guard) resolves its scope
- * through, so the scoping rule cannot drift per-path again (a
- * SemanticSearch inline `visibility === "office"` OR-clause leaked office
- * memories to any authenticated agent because the rule had scattered). See
- * that module's doc for the migration invariant (no-visibility-field reads
- * as "shared", never "private").
+ * Owner ids a non-admin agent may READ (resolveAllowedOwners) live in
+ * ./memory-read-scope.ts — still exported/used elsewhere (admin tooling).
+ * The full read-scope condition + private-exclusion predicate is now
+ * consumed through ./record-type-kit.ts's makeReadScope(), parameterized
+ * from RECORD_TYPES.Memory (record-types slice 2, flair#520) rather than a
+ * hand-typed "open-within-org" literal — the registry is now the single
+ * source of truth this class draws its read-scope mode from. makeReadScope
+ * delegates "open-within-org" to ./memory-read-scope.ts's resolveReadScope()
+ * UNCHANGED — the ONE centralized helper every cross-agent Memory read path
+ * (search()/get() here, SemanticSearch.ts, MemoryBootstrap.ts, auth-
+ * middleware.ts's by-id guard) resolves its scope through, so the scoping
+ * rule cannot drift per-path again (a SemanticSearch inline
+ * `visibility === "office"` OR-clause leaked office memories to any
+ * authenticated agent because the rule had scattered). See memory-read-
+ * scope.ts's doc for the migration invariant (no-visibility-field reads as
+ * "shared", never "private").
+ *
+ * Exported (not just a module-local const) solely so
+ * test/unit/record-types-registry.test.ts's drift tripwire can introspect
+ * the composed resolver's tagged `.mode`/`.ownerField` (see makeReadScope's
+ * doc in record-type-kit.ts) against RECORD_TYPES.Memory — not for any
+ * other runtime consumer.
  */
+export const memoryReadScope = makeReadScope(RECORD_TYPES.Memory.readScope, RECORD_TYPES.Memory.ownerField);
+const memoryByIdReadGate = makeByIdReadGate(memoryReadScope);
+// See makeAuthGate's doc (record-type-kit.ts): must be wired as a genuine
+// prototype method below, never a class-field assignment — Harper's
+// relationship-traversal RBAC path reads allowRead off the prototype.
+const memoryAuthGate = makeAuthGate();
 /**
  * ─── Server-side conservative-duplicate gate (memory-integrity fix) ──────────
  *
@@ -335,14 +350,16 @@ function defaultVisibilityForDurability(durability) {
 /**
  * ─── Write-time provenance stamp (memory-provenance slice 1) ────────────────
  *
- * `buildProvenance` itself now lives in ./provenance.ts (imported above) —
+ * `buildProvenance` itself lives in ./provenance.ts, re-exported unmodified
+ * via ./record-type-kit.ts (imported above) for a single kit import surface —
  * extracted so resources/Relationship.ts's write path can reuse the EXACT
  * same `{v, verified, claimed?}` shape (the relationship-write-path spec's
  * "reuse buildProvenance as-is" contract) instead of a hand-copied format
  * that could drift. See that module for the full field-by-field rationale
  * (verified.agentId from the auth verdict never the body, verified.timestamp
- * = the server-computed createdAt, optional unverified claimed.model
- * passthrough). Deliberately NOT implemented in this slice: a
+ * = the server-computed createdAt, optional unverified claimed.model /
+ * claimed.client passthroughs — the latter added by flair#718 authorship-
+ * provenance). Deliberately NOT implemented in this slice: a
  * context-fingerprint field — bootstrap doesn't return the IDs a fingerprint
  * would need, so it requires client cooperation that's out of scope here.
  */
@@ -394,13 +411,15 @@ export class Memory extends databases.flair.Memory {
      * unverified, risks regressing owner writes/deletes on a P0 security fix
      * that is scoped to the read leak — left as-is on purpose.
      */
-    allowRead() { return allowVerified(this.getContext?.()); }
+    allowRead() { return memoryAuthGate.call(this); }
     /**
      * Override get() to scope by-id reads the same way search() scopes
      * collection reads (memory-soul-read-gate fix). Never distinguishes
      * "doesn't exist" from "exists but not yours" — both return 404, never
      * 403, so a denied caller can't use get() to enumerate other agents'
-     * memory ids.
+     * memory ids. Wired through record-type-kit.ts's makeByIdReadGate, scoped
+     * with Memory's own "open-within-org" read-scope resolver above — same
+     * dispatch shape Relationship.ts/WorkspaceState.ts's get() overrides use.
      */
     async get(target) {
         // Collection / query reads — the `GET /Memory/?<query>` form and the bare
@@ -412,31 +431,13 @@ export class Memory extends databases.flair.Memory {
         // authenticated self-query would 404 (regression caught by the auth-
         // middleware e2e "TPS-Ed25519 on GET /Memory/?agentId=X → 200"). A by-id
         // get (RequestTarget with isCollection false, or a bare id) falls through.
+        // makeByIdReadGate re-applies this same guard internally (delegating to
+        // this.search via `.call(this, ...)`) — kept here too as documentation of
+        // the invariant at the call site, harmless no-op double-check.
         if (!target || (typeof target === "object" && target.isCollection)) {
             return this.search(target);
         }
-        const ctx = this.getContext?.();
-        const auth = await resolveAgentAuth(ctx);
-        // Anonymous by-id read is already blocked at the allowRead() gate (403);
-        // this is defense-in-depth if get() is ever reached directly.
-        if (auth.kind === "anonymous") {
-            return NOT_FOUND();
-        }
-        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
-        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
-            return super.get(target);
-        }
-        // Non-admin agent: only its own memories (any visibility), or a granted
-        // owner's SHARED memories — never that owner's private ones (Layer 1
-        // private-exclusion). Centralized in resolveReadScope() so this
-        // and search() below cannot drift.
-        const record = await super.get(target);
-        if (!record)
-            return NOT_FOUND();
-        const scope = await resolveReadScope(auth.agentId);
-        if (!scope.isAllowed(record))
-            return NOT_FOUND();
-        return record;
+        return memoryByIdReadGate.call(this, target, (t) => super.get(t));
     }
     /**
      * Override search() to scope collection GETs by authenticated agent.
@@ -451,23 +452,24 @@ export class Memory extends databases.flair.Memory {
     async search(query) {
         // Access request context via Harper's Resource instance context.
         const ctx = this.getContext?.();
-        const auth = await resolveAgentAuth(ctx);
         // Anonymous HTTP must NOT read memories. (Previously `!authAgent` was treated
         // as unfiltered — the anonymous-read leak once the gate stops rejecting.)
-        if (auth.kind === "anonymous") {
-            return new Response(JSON.stringify({ error: "authentication required" }), {
-                status: 401, headers: { "content-type": "application/json" },
-            });
-        }
         // Trusted internal call (no request context) or admin agent — unfiltered.
-        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+        // Non-admin agent: scoped below. Dispatch shape shared via
+        // record-type-kit.ts's resolveAuthGate — same three-way branch
+        // Relationship.ts/WorkspaceState.ts's search() use.
+        const gate = await resolveAuthGate(ctx, UNAUTH());
+        if (gate.kind === "denied")
+            return gate.response;
+        if (gate.kind === "unfiltered")
             return super.search(query);
-        }
         // Non-admin agent: scope to own (any visibility) + granted owners' SHARED
         // memories only (Layer 1 private-exclusion). Centralized in
-        // resolveReadScope() so get() above and search() here cannot drift.
-        const authAgent = auth.agentId;
-        const scope = await resolveReadScope(authAgent);
+        // memoryReadScope (record-type-kit.ts's makeReadScope(), parameterized
+        // from RECORD_TYPES.Memory — see this file's header — delegating
+        // "open-within-org" to memory-read-scope.ts's resolveReadScope()
+        // unchanged) so get() above and search() here cannot drift.
+        const scope = await memoryReadScope(gate.agentId);
         const agentIdCondition = scope.condition;
         // Harper passes `query` as a RequestTarget (extends URLSearchParams) or a
         // conditions array. For URL-based GET /Memory?... calls, URL params are no
@@ -509,9 +511,14 @@ export class Memory extends databases.flair.Memory {
             if (auth.kind === "anonymous") {
                 return UNAUTH();
             }
-            if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
-                return FORBIDDEN("forbidden: cannot write memory owned by another agent");
-            }
+            // No-forge attribution — mode/field drawn from RECORD_TYPES.Memory
+            // (record-types slice 2, flair#520) rather than a hand-typed literal.
+            // "validate-truthy" (see record-type-kit.ts's stampAttribution doc):
+            // reject a PRESENT, mismatched agentId; never stamp when absent (the
+            // caller is expected to have set it).
+            const attr = stampAttribution(auth, content, RECORD_TYPES.Memory.ownerField, RECORD_TYPES.Memory.attribution.post, "forbidden: cannot write memory owned by another agent");
+            if (attr.denied)
+                return attr.denied;
         }
         content.durability ||= "standard";
         content.createdAt = new Date().toISOString();
@@ -605,6 +612,12 @@ export class Memory extends databases.flair.Memory {
         // buildProvenance's doc above. Stamped last, right before persist, so it
         // reflects the final resolved `content.createdAt`.
         content.provenance = buildProvenance(auth, content.createdAt, content);
+        // flair#718 authorship-provenance: `claimedClient` is a WRITE-BODY-ONLY
+        // passthrough — buildProvenance above already folded it into
+        // `provenance.claimed.client` (sanitized/capped). Strip it from the row
+        // itself so it is NEVER persisted as a second, undeclared/unsanitized
+        // top-level field — authorship lives in the provenance JSON only.
+        delete content.claimedClient;
         // Write-time originatorInstanceId stamp (federation-edge-hardening slice
         // 1) — see stampOriginatorInstanceId's doc above. No-op if already set
         // (never fires for a genuine local write — no client sets this field).
@@ -652,9 +665,12 @@ export class Memory extends databases.flair.Memory {
             if (auth.kind === "anonymous") {
                 return UNAUTH();
             }
-            if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
-                return FORBIDDEN("forbidden: cannot write memory owned by another agent");
-            }
+            // No-forge attribution — mode/field drawn from RECORD_TYPES.Memory,
+            // same rule as post(). "validate-truthy" (see record-type-kit.ts's
+            // stampAttribution doc).
+            const attr = stampAttribution(auth, content, RECORD_TYPES.Memory.ownerField, RECORD_TYPES.Memory.attribution.put, "forbidden: cannot write memory owned by another agent");
+            if (attr.denied)
+                return attr.denied;
         }
         const now = new Date().toISOString();
         content.updatedAt = now;
@@ -771,6 +787,10 @@ export class Memory extends databases.flair.Memory {
         // always gets a freshly-stamped provenance reflecting the CURRENT
         // authenticated actor performing this write.
         content.provenance = buildProvenance(auth, content.createdAt, content);
+        // flair#718 authorship-provenance — see post()'s identical comment above:
+        // strip the write-body-only `claimedClient` passthrough now that it's
+        // folded into `provenance.claimed.client`. Never persisted as a row field.
+        delete content.claimedClient;
         // Write-time originatorInstanceId stamp (federation-edge-hardening slice
         // 1) — see stampOriginatorInstanceId's doc above post(). No-op if
         // already set: an update/patch of an existing local record carries its