@tpsdev-ai/flair 0.34.0 → 0.36.0

package/dist/resources/Credential.js

@@ -1,6 +1,7 @@
 import { databases } from "harper";
 import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
+import { stampAttribution, UNAUTH } from "./record-type-kit.js";
 /**
  * Credential resource — authentication surfaces for Principals.
  *
@@ -23,6 +24,50 @@ export class Credential extends databases.flair.Credential {
      * top of this for the paths they do see.
      */
     allowRead() { return allowVerified(this.getContext?.()); }
+    /**
+     * Self-authorize creation (same posture as allowRead).  Without this gate
+     * Harper routes POST /Credential to the base class's post() — which has
+     * no cross-principal check — letting an unauthenticated caller create
+     * credentials for any principal.
+     */
+    allowCreate() { return allowVerified(this.getContext?.()); }
+    /**
+     * Create a credential.  No-forge attribution via stampAttribution
+     * ("stamp-default" mode): a non-admin agent's credential is ALWAYS
+     * attributed to the authenticated identity — we never trust
+     * content.principalId from the body.  An admin may create on behalf of
+     * another principal (content.principalId honored if present, else
+     * defaults to the admin's own id).  Internal in-process callers keep
+     * whatever principalId they pass.
+     *
+     * Previously Credential had no post() override — the base class's post()
+     * ran with no cross-principal check, so any verified caller could create
+     * a credential for any principal by setting principalId in the body.
+     */
+    async post(content) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        // No-forge attribution: stamp principalId from the authenticated
+        // identity.  "stamp-default" unconditionally overwrites for non-admin;
+        // admin may supply their own value (defaults to admin's id if absent).
+        stampAttribution(auth, content, "principalId", "stamp-default", "forbidden: unreachable for stamp-default");
+        const rl = checkRateLimit(auth.kind === "agent" ? auth.agentId : "internal");
+        if (!rl.allowed)
+            return rateLimitResponse(rl.retryAfterMs, "credential");
+        // Validate kind
+        const validKinds = ["webauthn", "bearer-token", "ed25519", "idp"];
+        if (!content.kind || !validKinds.includes(content.kind)) {
+            return new Response(JSON.stringify({ error: `kind must be one of: ${validKinds.join(", ")}` }), {
+                status: 400, headers: { "content-type": "application/json" },
+            });
+        }
+        const now = new Date().toISOString();
+        content.status = content.status || "active";
+        content.createdAt = content.createdAt || now;
+        content.updatedAt = now;
+        return super.post(content);
+    }
     async search(query) {
         const auth = await resolveAgentAuth(this.getContext?.());
         // Anonymous HTTP must NOT read credentials. (Previously `!authAgent` was
@@ -71,22 +116,19 @@ export class Credential extends databases.flair.Credential {
         return safe;
     }
     async put(content) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        if (!authAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        if (auth.kind === "anonymous") {
             return new Response(JSON.stringify({ error: "authentication required" }), {
                 status: 401, headers: { "content-type": "application/json" },
             });
         }
-        // Only admins can create credentials for other principals
-        if (!isAdminAgent && content.principalId && content.principalId !== authAgent) {
+        // Only admins can update credentials for other principals
+        if (auth.kind === "agent" && !auth.isAdmin && content.principalId && content.principalId !== auth.agentId) {
             return new Response(JSON.stringify({ error: "only admin principals can manage other principals' credentials" }), {
                 status: 403, headers: { "content-type": "application/json" },
             });
         }
-        const rl = checkRateLimit(authAgent);
+        const rl = checkRateLimit(auth.kind === "agent" ? auth.agentId : "internal");
         if (!rl.allowed)
             return rateLimitResponse(rl.retryAfterMs, "credential");
         // Validate kind
@@ -97,25 +139,22 @@ export class Credential extends databases.flair.Credential {
             });
         }
         const now = new Date().toISOString();
-        content.principalId = content.principalId || authAgent;
+        content.principalId = content.principalId || (auth.kind === "agent" ? auth.agentId : content.principalId);
         content.status = content.status || "active";
         content.createdAt = content.createdAt || now;
         content.updatedAt = now;
         return super.put(content);
     }
     async delete(_) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        if (!authAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        if (auth.kind === "anonymous") {
             return new Response(JSON.stringify({ error: "authentication required" }), {
                 status: 401, headers: { "content-type": "application/json" },
             });
         }
-        if (!isAdminAgent) {
+        if (auth.kind === "agent" && !auth.isAdmin) {
             const existing = await super.get();
-            if (existing?.principalId && existing.principalId !== authAgent) {
+            if (existing?.principalId && existing.principalId !== auth.agentId) {
                 return new Response(JSON.stringify({ error: "only admin principals can revoke other principals' credentials" }), {
                     status: 403, headers: { "content-type": "application/json" },
                 });

package/dist/resources/Memory.js

@@ -7,7 +7,7 @@ import { scanFields, isStrictMode } from "./content-safety.js";
 import { invalidEntitiesResponse } from "./entity-vocab.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
 import { DEDUP_COSINE_THRESHOLD_DEFAULT, DEDUP_LEXICAL_THRESHOLD_DEFAULT, DEDUP_MIN_CONTENT_LENGTH, computeMatchConfidence, cosineSimilarity, isConservativeMatch, } from "./dedup.js";
-import { buildProvenance, makeAuthGate, makeReadScope, makeByIdReadGate, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
+import { buildProvenance, makeAuthGate, makeReadScope, makeByIdReadGate, makeScopedSearch, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
 import { RECORD_TYPES } from "./record-types.js";
 import { attachTrust } from "./trust-block.js";
 import { recordCitations } from "./usage-recording.js";
@@ -53,6 +53,7 @@ function wantsTrust(target, opts) {
  */
 export const memoryReadScope = makeReadScope(RECORD_TYPES.Memory.readScope, RECORD_TYPES.Memory.ownerField);
 const memoryByIdReadGate = makeByIdReadGate(memoryReadScope);
+const memoryScopedSearch = makeScopedSearch(memoryReadScope);
 // See makeAuthGate's doc (record-type-kit.ts): must be wired as a genuine
 // prototype method below, never a class-field assignment — Harper's
 // relationship-traversal RBAC path reads allowRead off the prototype.
@@ -540,25 +541,12 @@ export class Memory extends databases.flair.Memory {
         // from RECORD_TYPES.Memory — see this file's header — delegating
         // "open-within-org" to memory-read-scope.ts's resolveReadScope()
         // unchanged) so get() above and search() here cannot drift.
-        const scope = await memoryReadScope(gate.agentId);
-        const agentIdCondition = scope.condition;
-        // Harper passes `query` as a RequestTarget (extends URLSearchParams) or a
-        // conditions array. For URL-based GET /Memory?... calls, URL params are no
-        // longer translated to conditions here — callers should use
-        // POST /Memory/search_by_conditions with an explicit conditions array.
-        // For programmatic calls with a conditions array, we wrap with the agentId scope.
-        if (query && typeof query === "object" && !Array.isArray(query)) {
-            if (Array.isArray(query.conditions) && query.conditions.length > 0) {
-                query.conditions = [agentIdCondition, ...query.conditions];
-                return withDetachedTxn(ctx, () => super.search(query));
-            }
-            // Fallback: no conditions array present — just scope and pass through
-        }
-        // Fallback: plain array or no query (internal calls)
-        const conditions = Array.isArray(query) && query.length > 0
-            ? [agentIdCondition, ...query]
-            : [agentIdCondition];
-        return withDetachedTxn(ctx, () => super.search(conditions));
+        //
+        // The scope condition is nested as the outermost AND block via
+        // makeScopedSearch (record-type-kit.ts) — same correct composition
+        // MemoryCandidate.search() already applies — so a caller-supplied
+        // `operator: "or"` cannot boolean-inject past the owner scope.
+        return memoryScopedSearch(gate.agentId, query, (q) => withDetachedTxn(ctx, () => super.search(q)));
     }
     async post(content, context) {
         // Rate limiting — use authenticated agent ID, not client-supplied body field

package/dist/resources/MemoryFeed.js

@@ -1,16 +1,51 @@
 import { Resource, databases } from "harper";
-import { allowVerified } from "./agent-auth.js";
+import { allowVerified, resolveAgentAuth } from "./agent-auth.js";
 import { computeContentHash, findExistingMemoryByContentHash } from "./memory-feed-lib.js";
+import { FORBIDDEN, UNAUTH, stampAttribution } from "./record-type-kit.js";
 export class FeedMemories extends Resource {
     // Self-authorize via the Ed25519 agent verify (the auth reshape removes the
-    // gate's admin elevation). NOTE: post() trusts content.agentId from the body —
-    // closing that create-spoofing gap is tracked with the table-resource
-    // create-ownership work (Memory.allowCreate), not in this auth-coverage pass.
+    // gate's admin elevation).
     async allowCreate() {
         return allowVerified(this.getContext?.());
     }
     async post(content) {
-        const agentId = String(content?.agentId ?? "");
+        const ctx = this.getContext?.();
+        const auth = await resolveAgentAuth(ctx);
+        // Anonymous HTTP must NOT write.
+        if (auth.kind === "anonymous") {
+            return UNAUTH();
+        }
+        // No-forge attribution: use the kit's stampAttribution to stamp agentId
+        // from the authenticated principal, never from the body.
+        //
+        // Mode choice: stamp-strict (reject 403 on mismatch) over stamp-default
+        // (silent overwrite). This endpoint is the ingestion path — callers are MCP
+        // clients and agent-side tool calls. The defect this fix addresses was
+        // trusting a body-supplied identity; the correction is to always stamp from
+        // the authenticated principal.
+        //
+        // Deciding point (adjudicated on PR #1071): a silent overwrite means a
+        // buggy client never learns it is buggy — it keeps sending the wrong
+        // agentId and keeps getting 200. A strict rejection surfaces the mismatch
+        // so the caller can fix it. The concern about breaking callers that
+        // harmlessly echo agentId back was checked: a full search of the repo and
+        // workspace for FeedMemories and /FeedMemories returns only the resource
+        // definition and its own tests — no SDK wrappers, no CLI commands, no
+        // internal callers construct requests with a body-supplied agentId. A
+        // caller echoing the correct agentId (matching the principal) passes
+        // through stamp-strict unchanged; a caller echoing a wrong one is exactly
+        // the bug this slice exists to prevent.
+        const attr = stampAttribution(auth, content, 'agentId', 'stamp-strict', 'forbidden: cannot attribute a feed memory to another agent');
+        if (attr.denied)
+            return attr.denied;
+        // Guard against body-supplied id targeting another agent's record.
+        if (content?.id) {
+            const existingRecord = await databases.flair.Memory.get(content.id);
+            if (existingRecord && existingRecord.agentId !== content.agentId) {
+                return FORBIDDEN("forbidden: cannot write a feed memory owned by another agent");
+            }
+        }
+        const agentId = content.agentId;
         const body = String(content?.content ?? "");
         if (!agentId || !body) {
             return new Response(JSON.stringify({ error: "agentId and content are required" }), {

package/dist/resources/Presence.js

@@ -31,7 +31,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createRequire } from "node:module";
-import { resolveAgentAuth, verifyAgentRequest } from "./agent-auth.js";
+import { resolveAgentAuth, verifyAgentRequest, isPrincipalDeactivated } from "./agent-auth.js";
 import { agentRecordIsAdmin } from "./agent-admin.js";
 import { WINDOW_MS, isNonceReplay, recordNonce, importEd25519Key, b64ToArrayBuffer, parseTpsEd25519Header } from "./ed25519-auth.js";
 // ─── Constants ────────────────────────────────────────────────────────────────
@@ -449,6 +449,13 @@ export class Presence extends databases.flair.Presence {
                 return new Response(JSON.stringify({ error: "signature_verification_failed", detail: e?.message }), { status: 401, headers: { "Content-Type": "application/json" } });
             }
             recordNonce(headerAgentId, nonce, ts);
+            // Deactivation guard — same predicate as the middleware Basic branches.
+            // A deactivated principal must not be allowed to heartbeat, even when
+            // the Ed25519 signature is valid.
+            const agentRecord = await databases.flair.Agent.get(headerAgentId).catch(() => null);
+            if (isPrincipalDeactivated(agentRecord)) {
+                return new Response(JSON.stringify({ error: "principal_deactivated" }), { status: 401 });
+            }
             agentId = headerAgentId;
         }
         // ── Validate body ────────────────────────────────────────────────────────

package/dist/resources/WorkspaceState.js

@@ -10,7 +10,7 @@
 import { databases } from "harper";
 import { resolveAgentAuth } from "./agent-auth.js";
 import { invalidEntitiesResponse } from "./entity-vocab.js";
-import { makeAuthGate, makeReadScope, makeByIdReadGate, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
+import { makeAuthGate, makeReadScope, makeByIdReadGate, makeScopedSearch, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
 import { RECORD_TYPES } from "./record-types.js";
 // Parameterized from RECORD_TYPES.WorkspaceState (record-types slice 2,
 // flair#520) rather than a hand-typed "owner-only" literal — the registry is
@@ -21,6 +21,7 @@ import { RECORD_TYPES } from "./record-types.js";
 // runtime consumer.
 export const workspaceReadScope = makeReadScope(RECORD_TYPES.WorkspaceState.readScope, RECORD_TYPES.WorkspaceState.ownerField);
 const workspaceByIdReadGate = makeByIdReadGate(workspaceReadScope);
+const workspaceScopedSearch = makeScopedSearch(workspaceReadScope);
 // See makeAuthGate's doc (record-type-kit.ts): must be wired as a genuine
 // prototype method below, never a class-field assignment — Harper's
 // relationship-traversal RBAC path reads allowRead off the prototype.
@@ -78,21 +79,11 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
             return gate.response;
         if (gate.kind === "unfiltered")
             return super.search(query);
-        const scope = await workspaceReadScope(gate.agentId);
-        const agentIdCondition = scope.condition;
-        // Harper passes `query` as a request target object (pathname, id, isCollection…).
-        // Inject the scope condition into its `.conditions` array.
-        if (query && typeof query === "object" && !Array.isArray(query)) {
-            const existing = query.conditions ?? [];
-            query.conditions = Array.isArray(existing)
-                ? [agentIdCondition, ...existing]
-                : [agentIdCondition, existing];
-            return super.search(query);
-        }
-        const conditions = Array.isArray(query) && query.length > 0
-            ? [agentIdCondition, ...query]
-            : [agentIdCondition];
-        return super.search(conditions);
+        // Non-admin agent: scope to own records only.  The scope condition is
+        // nested as the outermost AND block via makeScopedSearch (record-type-kit.ts)
+        // — same correct composition MemoryCandidate.search() already applies — so a
+        // caller-supplied `operator: "or"` cannot boolean-inject past the owner scope.
+        return workspaceScopedSearch(gate.agentId, query, (q) => super.search(q));
     }
     async post(content) {
         const auth = await this._auth();

package/dist/resources/agent-auth.js

@@ -25,6 +25,33 @@ import { ADMIN_ROLE, agentRecordIsAdmin } from "./agent-admin.js";
  * provisions it (ensureFlairAgentUser); they MUST agree on the name.
  */
 export const FLAIR_AGENT_USERNAME = "flair-agent";
+// ─── Principal deactivation guard (authz hardening slice 1) ─────────────────
+//
+// ONE predicate, called from BOTH verify paths (Ed25519 in doVerify + the
+// gate's own verify, and Basic/agent-auth in resolveAgentAuth) so the
+// deactivation check cannot drift between them.  Two independent checks would
+// inevitably diverge — one path tightened, the other forgotten — and this is
+// exactly the kind of control that must not.
+//
+// KNOWN LIMIT (slice 1b, NOT this slice): Harper's Bearer validation never
+// calls Agent.get(principalId), so already-issued Bearer tokens SURVIVE
+// deactivation.  This slice buys "deactivation stops new authentications" and
+// nothing more.  Existing tokens live until expiry or explicit revocation.
+// Do not read this as "deactivation now works" — it works for NEW auth only.
+/**
+ * Single shared predicate: is this principal deactivated?
+ *
+ * Called from BOTH verify paths (Ed25519 and Basic/agent-auth) so the
+ * deactivation check cannot drift.  A nonexistent agent is not "deactivated" —
+ * it will fail on other checks (missing publicKey, unknown user, etc.).
+ */
+export function isPrincipalDeactivated(agent) {
+    if (agent == null)
+        return false;
+    if (agent.status === undefined)
+        return false;
+    return agent.status !== "active";
+}
 // ─── Crypto + replay-guard helpers ────────────────────────────────────────────
 // WINDOW_MS, isNonceReplay/recordNonce (the ONE shared nonce store), and
 // importEd25519Key all live in ./ed25519-auth.ts — the single
@@ -103,6 +130,10 @@ async function doVerify(request) {
     const agent = await databases.flair.Agent.get(agentId).catch(() => null);
     if (!agent?.publicKey)
         return null;
+    // Deactivation guard — ONE predicate, same check as the Basic/agent-auth path
+    // in resolveAgentAuth below.  A deactivated principal cannot authenticate.
+    if (isPrincipalDeactivated(agent))
+        return null;
     // Canonical signed payload: id:ts:nonce:METHOD:pathname+search (must match the
     // TPS CLI signer exactly — changing this breaks every agent's auth).
     const url = new URL(request.url, "http://localhost");
@@ -310,10 +341,18 @@ export async function resolveAgentAuth(context) {
     const credentialed = hasCredentialEvidence(c);
     const user = context?.user ?? c.user;
     if (credentialed && user?.role?.permission?.super_user === true) {
-        return { kind: "agent", agentId: String(user.username ?? "admin"), isAdmin: true };
+        const agentId = String(user.username ?? "admin");
+        const agent = await databases.flair.Agent.get(agentId).catch(() => null);
+        if (isPrincipalDeactivated(agent))
+            return { kind: "anonymous" };
+        return { kind: "agent", agentId, isAdmin: true };
     }
     if (credentialed && user?.username && user.username !== FLAIR_AGENT_USERNAME) {
-        return { kind: "agent", agentId: String(user.username), isAdmin: false };
+        const agentId = String(user.username);
+        const agent = await databases.flair.Agent.get(agentId).catch(() => null);
+        if (isPrincipalDeactivated(agent))
+            return { kind: "anonymous" };
+        return { kind: "agent", agentId, isAdmin: false };
     }
     // A raw request with headers is present → verify it; an HTTP request that
     // yields no agent is anonymous (NOT internal).

package/dist/resources/auth-middleware.js

@@ -1,7 +1,7 @@
 import { patchRecord } from "./table-helpers.js";
 import { server, databases } from "harper";
 import { getEmbedding } from "./embeddings-provider.js";
-import { isAdmin, FLAIR_AGENT_USERNAME } from "./agent-auth.js";
+import { isAdmin, isPrincipalDeactivated, FLAIR_AGENT_USERNAME } from "./agent-auth.js";
 import { WINDOW_MS, isNonceReplay, recordNonce, importEd25519Key, b64ToArrayBuffer, parseTpsEd25519Header } from "./ed25519-auth.js";
 import { resolveReadScope } from "./memory-read-scope.js";
 import { isForbiddenOwnerMutation, resolveGuardedRecord } from "./record-owner-guard.js";
@@ -163,15 +163,24 @@ server.http(async (request, nextLayer) => {
     // ambient elevation alone. (The root-cause gate lives in resolveAgentAuth; see
     // agent-auth.ts hasCredentialEvidence.)
     if (header && request.user?.role?.permission?.super_user === true) {
-        request.tpsAgent = request.user.username ?? "admin";
-        request.tpsAgentIsAdmin = true;
-        try {
-            request.headers.set("x-tps-agent", request.tpsAgent);
-            if (request.headers.asObject)
-                request.headers.asObject["x-tps-agent"] = request.tpsAgent;
+        const username = request.user.username ?? "admin";
+        // Deactivation guard — same predicate as the Ed25519 path.
+        // A deactivated principal must not receive a tpsAgent annotation, even
+        // when Harper's ambient auth already verified the credential.
+        const agentRecord = await databases.flair.Agent.get(username).catch(() => null);
+        if (!isPrincipalDeactivated(agentRecord)) {
+            request.tpsAgent = username;
+            request.tpsAgentIsAdmin = true;
+            try {
+                request.headers.set("x-tps-agent", request.tpsAgent);
+                if (request.headers.asObject)
+                    request.headers.asObject["x-tps-agent"] = request.tpsAgent;
+            }
+            catch { /* frozen headers — annotation on request object still applies */ }
+            return nextLayer(request);
         }
-        catch { /* frozen headers — annotation on request object still applies */ }
-        return nextLayer(request);
+        // Deactivated — fall through. The request continues through the
+        // middleware chain (Basic block → Ed25519 → anonymous) without tpsAgent.
     }
     // Skip re-entry: if we already swapped auth to Basic, pass through
     if (request._tpsAuthVerified)
@@ -191,18 +200,23 @@ server.http(async (request, nextLayer) => {
             // with exact HDB_ADMIN_PASSWORD. Non-match falls through to Path 2.
             const adminPass = getAdminPass();
             if (adminPass !== null && user === "admin" && pass === adminPass) {
-                // Mark as verified and set Harper user directly
-                request._tpsAuthVerified = true;
-                try {
-                    request.user = await server.getUser("admin", null, request);
+                // Deactivation guard — same predicate, called before tpsAgent is stamped.
+                const agentRecord = await databases.flair.Agent.get("admin").catch(() => null);
+                if (!isPrincipalDeactivated(agentRecord)) {
+                    // Mark as verified and set Harper user directly
+                    request._tpsAuthVerified = true;
+                    try {
+                        request.user = await server.getUser("admin", null, request);
+                    }
+                    catch { /* fallback: let original Basic header pass through */ }
+                    request.headers.set("x-tps-agent", "admin");
+                    if (request.headers.asObject)
+                        request.headers.asObject["x-tps-agent"] = "admin";
+                    request.tpsAgent = "admin";
+                    request.tpsAgentIsAdmin = true;
+                    return nextLayer(request);
                 }
-                catch { /* fallback: let original Basic header pass through */ }
-                request.headers.set("x-tps-agent", "admin");
-                if (request.headers.asObject)
-                    request.headers.asObject["x-tps-agent"] = "admin";
-                request.tpsAgent = "admin";
-                request.tpsAgentIsAdmin = true;
-                return nextLayer(request);
+                // Deactivated — fall through to anonymous (end of Basic block).
             }
             // Path 2: Harper super_user check — any user with super_user:true
             let harperUser = null;
@@ -211,14 +225,19 @@ server.http(async (request, nextLayer) => {
             }
             catch { /* fall through — invalid creds, non-existent user, etc. */ }
             if (harperUser?.role?.permission?.super_user === true) {
-                request._tpsAuthVerified = true;
-                request.user = harperUser;
-                request.headers.set("x-tps-agent", user);
-                if (request.headers.asObject)
-                    request.headers.asObject["x-tps-agent"] = user;
-                request.tpsAgent = user;
-                request.tpsAgentIsAdmin = true;
-                return nextLayer(request);
+                // Deactivation guard — same predicate, called before tpsAgent is stamped.
+                const agentRecord = await databases.flair.Agent.get(user).catch(() => null);
+                if (!isPrincipalDeactivated(agentRecord)) {
+                    request._tpsAuthVerified = true;
+                    request.user = harperUser;
+                    request.headers.set("x-tps-agent", user);
+                    if (request.headers.asObject)
+                        request.headers.asObject["x-tps-agent"] = user;
+                    request.tpsAgent = user;
+                    request.tpsAgentIsAdmin = true;
+                    return nextLayer(request);
+                }
+                // Deactivated — fall through to anonymous (end of Basic block).
             }
             // Path 3: flair_pair_initiator — restricted to /FederationPair only.
             // Bootstrap credentials (pair-bootstrap-<id>) may only be used on this
@@ -231,14 +250,19 @@ server.http(async (request, nextLayer) => {
                 catch { /* fall through */ }
                 if (pairUser?.role?.role === "flair_pair_initiator" &&
                     pairUser?.active === true) {
-                    request._tpsAuthVerified = true;
-                    request.user = pairUser;
-                    request.headers.set("x-tps-agent", user);
-                    if (request.headers.asObject)
-                        request.headers.asObject["x-tps-agent"] = user;
-                    request.tpsAgent = user;
-                    request.tpsAgentIsAdmin = false;
-                    return nextLayer(request);
+                    // Deactivation guard — same predicate, called before tpsAgent is stamped.
+                    const agentRecord = await databases.flair.Agent.get(user).catch(() => null);
+                    if (!isPrincipalDeactivated(agentRecord)) {
+                        request._tpsAuthVerified = true;
+                        request.user = pairUser;
+                        request.headers.set("x-tps-agent", user);
+                        if (request.headers.asObject)
+                            request.headers.asObject["x-tps-agent"] = user;
+                        request.tpsAgent = user;
+                        request.tpsAgentIsAdmin = false;
+                        return nextLayer(request);
+                    }
+                    // Deactivated — fall through to anonymous (end of Basic block).
                 }
             }
         }
@@ -297,6 +321,11 @@ server.http(async (request, nextLayer) => {
     const agent = await databases.flair.Agent.get(agentId);
     if (!agent)
         return new Response(JSON.stringify({ error: "unknown_agent" }), { status: 401 });
+    // Deactivation guard — same predicate as the per-resource verify path in
+    // agent-auth.ts.  A deactivated principal cannot authenticate.
+    if (isPrincipalDeactivated(agent)) {
+        return new Response(JSON.stringify({ error: "principal_deactivated" }), { status: 401 });
+    }
     try {
         const payload = `${agentId}:${tsRaw}:${nonce}:${request.method}:${url.pathname}${url.search}`;
         const key = await importEd25519Key(agent.publicKey);

package/dist/resources/mcp-oauth.js

@@ -20,6 +20,46 @@
 import * as harper from "harper";
 import { mcpOAuthEnabled, mcpAuthConfig } from "./mcp-oauth-flag.js";
 import { checkMcpRateLimit } from "./rate-limit.js";
+/**
+ * Boot guard (flair#1021): when FLAIR_MCP_OAUTH is on, the @harperfast/oauth
+ * component MUST be declared in config.yaml. Without it the authorization
+ * server's routes never mount — discovery, authorize, token, JWKS all 404.
+ * The /mcp route would still register, but every request fails closed against
+ * a non-existent auth server. This guard fails loudly so the operator sees the
+ * error at boot instead of a silently broken deployment.
+ *
+ * The error names the actor (the operator who set the flag), the state
+ * (component absent from config.yaml), and the remedy (add the declaration).
+ * It does NOT suggest a concrete issuer — the issuer is derived at runtime
+ * from FLAIR_MCP_ISSUER / FLAIR_PUBLIC_URL and must not be hardcoded.
+ */
+export function assertHarperOAuthComponentDeclared(harperNs) {
+    // Harper exposes parsed config via its runtime namespace. We check for the
+    // @harperfast/oauth key; absence means the component's routes were never
+    // registered.
+    const h = harperNs ?? harper;
+    const hc = h.app?.config ?? h.config;
+    const component = hc?.get?.("@harperfast/oauth") ?? hc?.["@harperfast/oauth"];
+    if (!component) {
+        throw new Error("FLAIR_MCP_OAUTH is enabled but the @harperfast/oauth component is not declared in config.yaml. " +
+            "The authorization server cannot start without it — discovery, authorize, token, and JWKS endpoints will all 404, " +
+            "and /mcp will reject every request.\n" +
+            "Add this entry to your config.yaml:\n" +
+            "\n" +
+            '  "@harperfast/oauth":\n' +
+            "    providers:\n" +
+            '      default:\n' +
+            '        authorizationEndpoint: "/OAuthAuthorize"\n' +
+            '        tokenEndpoint: "/OAuthToken"\n' +
+            '        revocationEndpoint: "/OAuthRevoke"\n' +
+            '        registrationEndpoint: "/OAuthRegister"\n' +
+            '        jwksUri: "/.well-known/jwks.json"\n' +
+            '        discoveryEndpoint: "/.well-known/oauth-authorization-server"\n' +
+            "\n" +
+            "Then set FLAIR_MCP_ISSUER (or FLAIR_PUBLIC_URL) to your instance's public origin " +
+            "and add the corresponding mcp.* block to the component config.");
+    }
+}
 /**
  * Initial value: no route has been registered yet, which is literally true until
  * `registerMcpOAuthRoute` runs — a reader between module load and registration
@@ -86,6 +126,13 @@ export async function registerMcpOAuthRoute(deps = {}) {
             reason: "Set FLAIR_MCP_OAUTH=1 (and an issuer) to serve MCP over HTTP.",
         });
     }
+    // Boot guard (flair#1021): fail loudly if the operator enabled the flag but
+    // the @harperfast/oauth component is absent from config.yaml. Without it the
+    // authorization server's routes never mount — discovery, authorize, token,
+    // JWKS all 404 — and the /mcp guard has nothing to validate against.
+    if (!deps.skipComponentGuard) {
+        assertHarperOAuthComponentDeclared(deps.harper);
+    }
     const config = mcpAuthConfig();
     if (!config) {
         // Flag on but issuer unset → we cannot safely pin iss/aud. Do NOT mount an

package/dist/resources/record-type-kit.js

@@ -211,6 +211,55 @@ export function makeByIdReadGate(readScope) {
         return record;
     };
 }
+// ─── (c) Scoped search — makeScopedSearch ────────────────────────────────
+/**
+ * Produces a scoped search() override that nests the caller's conditions
+ * inside the agent-scope condition as the OUTERMOST `and` block, so a
+ * caller-supplied `operator: "or"` cannot boolean-inject past the owner
+ * scope.
+ *
+ * This is the correct composition that MemoryCandidate.search() already
+ * applies (the only resource that got it right).  Memory.search() and
+ * WorkspaceState.search() both used a flat prepend — `[agentCondition,
+ * ...query.conditions]` — which lets a caller-supplied `query.operator`
+ * survive and turn the scope condition into one OR-branch.
+ *
+ * Every table that composes this gets the correct nesting by default;
+ * a fifth table added later cannot accidentally reintroduce the flat-
+ * prepend bug.
+ *
+ * `superSearch` is a caller-supplied closure so the class's own
+ * `super.search()` (which cannot be referenced from outside the class
+ * body) stays exactly where it was.
+ */
+export function makeScopedSearch(readScope) {
+    return async function scopedSearch(agentId, query, superSearch) {
+        const scope = await readScope(agentId);
+        const agentCondition = scope.condition;
+        // Object with a conditions array — nest caller's conditions inside the
+        // scope condition as the outermost AND block so a caller-supplied
+        // `operator: "or"` cannot boolean-inject past the owner scope.
+        if (query && typeof query === "object" && !Array.isArray(query)) {
+            if (Array.isArray(query.conditions) && query.conditions.length > 0) {
+                return superSearch({
+                    ...query,
+                    conditions: [agentCondition, { conditions: query.conditions, operator: query.operator || "and" }],
+                    operator: "and",
+                });
+            }
+            // No (or empty) conditions array — just scope, preserving other query
+            // properties but NOT a caller-supplied operator (force "and").
+            const { conditions: _c, operator: _o, ...rest } = query;
+            return superSearch({ ...rest, conditions: [agentCondition], operator: "and" });
+        }
+        // Plain array or no query — wrap in an object with operator "and" so
+        // the scope condition is always the outermost AND.
+        const conditions = Array.isArray(query) && query.length > 0
+            ? [agentCondition, { conditions: query, operator: "and" }]
+            : [agentCondition];
+        return superSearch({ conditions, operator: "and" });
+    };
+}
 export function stampAttribution(auth, content, field, mode, forbiddenMessage) {
     if (auth.kind !== "agent")
         return {}; // internal → always passthrough