@tpsdev-ai/flair 0.35.0 → 0.36.0

package/dist/resources/Credential.js

@@ -1,6 +1,7 @@
 import { databases } from "harper";
 import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
+import { stampAttribution, UNAUTH } from "./record-type-kit.js";
 /**
  * Credential resource — authentication surfaces for Principals.
  *
@@ -23,6 +24,50 @@ export class Credential extends databases.flair.Credential {
      * top of this for the paths they do see.
      */
     allowRead() { return allowVerified(this.getContext?.()); }
+    /**
+     * Self-authorize creation (same posture as allowRead).  Without this gate
+     * Harper routes POST /Credential to the base class's post() — which has
+     * no cross-principal check — letting an unauthenticated caller create
+     * credentials for any principal.
+     */
+    allowCreate() { return allowVerified(this.getContext?.()); }
+    /**
+     * Create a credential.  No-forge attribution via stampAttribution
+     * ("stamp-default" mode): a non-admin agent's credential is ALWAYS
+     * attributed to the authenticated identity — we never trust
+     * content.principalId from the body.  An admin may create on behalf of
+     * another principal (content.principalId honored if present, else
+     * defaults to the admin's own id).  Internal in-process callers keep
+     * whatever principalId they pass.
+     *
+     * Previously Credential had no post() override — the base class's post()
+     * ran with no cross-principal check, so any verified caller could create
+     * a credential for any principal by setting principalId in the body.
+     */
+    async post(content) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        // No-forge attribution: stamp principalId from the authenticated
+        // identity.  "stamp-default" unconditionally overwrites for non-admin;
+        // admin may supply their own value (defaults to admin's id if absent).
+        stampAttribution(auth, content, "principalId", "stamp-default", "forbidden: unreachable for stamp-default");
+        const rl = checkRateLimit(auth.kind === "agent" ? auth.agentId : "internal");
+        if (!rl.allowed)
+            return rateLimitResponse(rl.retryAfterMs, "credential");
+        // Validate kind
+        const validKinds = ["webauthn", "bearer-token", "ed25519", "idp"];
+        if (!content.kind || !validKinds.includes(content.kind)) {
+            return new Response(JSON.stringify({ error: `kind must be one of: ${validKinds.join(", ")}` }), {
+                status: 400, headers: { "content-type": "application/json" },
+            });
+        }
+        const now = new Date().toISOString();
+        content.status = content.status || "active";
+        content.createdAt = content.createdAt || now;
+        content.updatedAt = now;
+        return super.post(content);
+    }
     async search(query) {
         const auth = await resolveAgentAuth(this.getContext?.());
         // Anonymous HTTP must NOT read credentials. (Previously `!authAgent` was
@@ -71,22 +116,19 @@ export class Credential extends databases.flair.Credential {
         return safe;
     }
     async put(content) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        if (!authAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        if (auth.kind === "anonymous") {
             return new Response(JSON.stringify({ error: "authentication required" }), {
                 status: 401, headers: { "content-type": "application/json" },
             });
         }
-        // Only admins can create credentials for other principals
-        if (!isAdminAgent && content.principalId && content.principalId !== authAgent) {
+        // Only admins can update credentials for other principals
+        if (auth.kind === "agent" && !auth.isAdmin && content.principalId && content.principalId !== auth.agentId) {
             return new Response(JSON.stringify({ error: "only admin principals can manage other principals' credentials" }), {
                 status: 403, headers: { "content-type": "application/json" },
             });
         }
-        const rl = checkRateLimit(authAgent);
+        const rl = checkRateLimit(auth.kind === "agent" ? auth.agentId : "internal");
         if (!rl.allowed)
             return rateLimitResponse(rl.retryAfterMs, "credential");
         // Validate kind
@@ -97,25 +139,22 @@ export class Credential extends databases.flair.Credential {
             });
         }
         const now = new Date().toISOString();
-        content.principalId = content.principalId || authAgent;
+        content.principalId = content.principalId || (auth.kind === "agent" ? auth.agentId : content.principalId);
         content.status = content.status || "active";
         content.createdAt = content.createdAt || now;
         content.updatedAt = now;
         return super.put(content);
     }
     async delete(_) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        if (!authAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        if (auth.kind === "anonymous") {
             return new Response(JSON.stringify({ error: "authentication required" }), {
                 status: 401, headers: { "content-type": "application/json" },
             });
         }
-        if (!isAdminAgent) {
+        if (auth.kind === "agent" && !auth.isAdmin) {
             const existing = await super.get();
-            if (existing?.principalId && existing.principalId !== authAgent) {
+            if (existing?.principalId && existing.principalId !== auth.agentId) {
                 return new Response(JSON.stringify({ error: "only admin principals can revoke other principals' credentials" }), {
                     status: 403, headers: { "content-type": "application/json" },
                 });

package/dist/resources/Memory.js

@@ -7,7 +7,7 @@ import { scanFields, isStrictMode } from "./content-safety.js";
 import { invalidEntitiesResponse } from "./entity-vocab.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
 import { DEDUP_COSINE_THRESHOLD_DEFAULT, DEDUP_LEXICAL_THRESHOLD_DEFAULT, DEDUP_MIN_CONTENT_LENGTH, computeMatchConfidence, cosineSimilarity, isConservativeMatch, } from "./dedup.js";
-import { buildProvenance, makeAuthGate, makeReadScope, makeByIdReadGate, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
+import { buildProvenance, makeAuthGate, makeReadScope, makeByIdReadGate, makeScopedSearch, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
 import { RECORD_TYPES } from "./record-types.js";
 import { attachTrust } from "./trust-block.js";
 import { recordCitations } from "./usage-recording.js";
@@ -53,6 +53,7 @@ function wantsTrust(target, opts) {
  */
 export const memoryReadScope = makeReadScope(RECORD_TYPES.Memory.readScope, RECORD_TYPES.Memory.ownerField);
 const memoryByIdReadGate = makeByIdReadGate(memoryReadScope);
+const memoryScopedSearch = makeScopedSearch(memoryReadScope);
 // See makeAuthGate's doc (record-type-kit.ts): must be wired as a genuine
 // prototype method below, never a class-field assignment — Harper's
 // relationship-traversal RBAC path reads allowRead off the prototype.
@@ -540,25 +541,12 @@ export class Memory extends databases.flair.Memory {
         // from RECORD_TYPES.Memory — see this file's header — delegating
         // "open-within-org" to memory-read-scope.ts's resolveReadScope()
         // unchanged) so get() above and search() here cannot drift.
-        const scope = await memoryReadScope(gate.agentId);
-        const agentIdCondition = scope.condition;
-        // Harper passes `query` as a RequestTarget (extends URLSearchParams) or a
-        // conditions array. For URL-based GET /Memory?... calls, URL params are no
-        // longer translated to conditions here — callers should use
-        // POST /Memory/search_by_conditions with an explicit conditions array.
-        // For programmatic calls with a conditions array, we wrap with the agentId scope.
-        if (query && typeof query === "object" && !Array.isArray(query)) {
-            if (Array.isArray(query.conditions) && query.conditions.length > 0) {
-                query.conditions = [agentIdCondition, ...query.conditions];
-                return withDetachedTxn(ctx, () => super.search(query));
-            }
-            // Fallback: no conditions array present — just scope and pass through
-        }
-        // Fallback: plain array or no query (internal calls)
-        const conditions = Array.isArray(query) && query.length > 0
-            ? [agentIdCondition, ...query]
-            : [agentIdCondition];
-        return withDetachedTxn(ctx, () => super.search(conditions));
+        //
+        // The scope condition is nested as the outermost AND block via
+        // makeScopedSearch (record-type-kit.ts) — same correct composition
+        // MemoryCandidate.search() already applies — so a caller-supplied
+        // `operator: "or"` cannot boolean-inject past the owner scope.
+        return memoryScopedSearch(gate.agentId, query, (q) => withDetachedTxn(ctx, () => super.search(q)));
     }
     async post(content, context) {
         // Rate limiting — use authenticated agent ID, not client-supplied body field

package/dist/resources/MemoryFeed.js

@@ -1,16 +1,51 @@
 import { Resource, databases } from "harper";
-import { allowVerified } from "./agent-auth.js";
+import { allowVerified, resolveAgentAuth } from "./agent-auth.js";
 import { computeContentHash, findExistingMemoryByContentHash } from "./memory-feed-lib.js";
+import { FORBIDDEN, UNAUTH, stampAttribution } from "./record-type-kit.js";
 export class FeedMemories extends Resource {
     // Self-authorize via the Ed25519 agent verify (the auth reshape removes the
-    // gate's admin elevation). NOTE: post() trusts content.agentId from the body —
-    // closing that create-spoofing gap is tracked with the table-resource
-    // create-ownership work (Memory.allowCreate), not in this auth-coverage pass.
+    // gate's admin elevation).
     async allowCreate() {
         return allowVerified(this.getContext?.());
     }
     async post(content) {
-        const agentId = String(content?.agentId ?? "");
+        const ctx = this.getContext?.();
+        const auth = await resolveAgentAuth(ctx);
+        // Anonymous HTTP must NOT write.
+        if (auth.kind === "anonymous") {
+            return UNAUTH();
+        }
+        // No-forge attribution: use the kit's stampAttribution to stamp agentId
+        // from the authenticated principal, never from the body.
+        //
+        // Mode choice: stamp-strict (reject 403 on mismatch) over stamp-default
+        // (silent overwrite). This endpoint is the ingestion path — callers are MCP
+        // clients and agent-side tool calls. The defect this fix addresses was
+        // trusting a body-supplied identity; the correction is to always stamp from
+        // the authenticated principal.
+        //
+        // Deciding point (adjudicated on PR #1071): a silent overwrite means a
+        // buggy client never learns it is buggy — it keeps sending the wrong
+        // agentId and keeps getting 200. A strict rejection surfaces the mismatch
+        // so the caller can fix it. The concern about breaking callers that
+        // harmlessly echo agentId back was checked: a full search of the repo and
+        // workspace for FeedMemories and /FeedMemories returns only the resource
+        // definition and its own tests — no SDK wrappers, no CLI commands, no
+        // internal callers construct requests with a body-supplied agentId. A
+        // caller echoing the correct agentId (matching the principal) passes
+        // through stamp-strict unchanged; a caller echoing a wrong one is exactly
+        // the bug this slice exists to prevent.
+        const attr = stampAttribution(auth, content, 'agentId', 'stamp-strict', 'forbidden: cannot attribute a feed memory to another agent');
+        if (attr.denied)
+            return attr.denied;
+        // Guard against body-supplied id targeting another agent's record.
+        if (content?.id) {
+            const existingRecord = await databases.flair.Memory.get(content.id);
+            if (existingRecord && existingRecord.agentId !== content.agentId) {
+                return FORBIDDEN("forbidden: cannot write a feed memory owned by another agent");
+            }
+        }
+        const agentId = content.agentId;
         const body = String(content?.content ?? "");
         if (!agentId || !body) {
             return new Response(JSON.stringify({ error: "agentId and content are required" }), {

package/dist/resources/Presence.js

@@ -31,7 +31,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createRequire } from "node:module";
-import { resolveAgentAuth, verifyAgentRequest } from "./agent-auth.js";
+import { resolveAgentAuth, verifyAgentRequest, isPrincipalDeactivated } from "./agent-auth.js";
 import { agentRecordIsAdmin } from "./agent-admin.js";
 import { WINDOW_MS, isNonceReplay, recordNonce, importEd25519Key, b64ToArrayBuffer, parseTpsEd25519Header } from "./ed25519-auth.js";
 // ─── Constants ────────────────────────────────────────────────────────────────
@@ -449,6 +449,13 @@ export class Presence extends databases.flair.Presence {
                 return new Response(JSON.stringify({ error: "signature_verification_failed", detail: e?.message }), { status: 401, headers: { "Content-Type": "application/json" } });
             }
             recordNonce(headerAgentId, nonce, ts);
+            // Deactivation guard — same predicate as the middleware Basic branches.
+            // A deactivated principal must not be allowed to heartbeat, even when
+            // the Ed25519 signature is valid.
+            const agentRecord = await databases.flair.Agent.get(headerAgentId).catch(() => null);
+            if (isPrincipalDeactivated(agentRecord)) {
+                return new Response(JSON.stringify({ error: "principal_deactivated" }), { status: 401 });
+            }
             agentId = headerAgentId;
         }
         // ── Validate body ────────────────────────────────────────────────────────

package/dist/resources/WorkspaceState.js

@@ -10,7 +10,7 @@
 import { databases } from "harper";
 import { resolveAgentAuth } from "./agent-auth.js";
 import { invalidEntitiesResponse } from "./entity-vocab.js";
-import { makeAuthGate, makeReadScope, makeByIdReadGate, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
+import { makeAuthGate, makeReadScope, makeByIdReadGate, makeScopedSearch, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
 import { RECORD_TYPES } from "./record-types.js";
 // Parameterized from RECORD_TYPES.WorkspaceState (record-types slice 2,
 // flair#520) rather than a hand-typed "owner-only" literal — the registry is
@@ -21,6 +21,7 @@ import { RECORD_TYPES } from "./record-types.js";
 // runtime consumer.
 export const workspaceReadScope = makeReadScope(RECORD_TYPES.WorkspaceState.readScope, RECORD_TYPES.WorkspaceState.ownerField);
 const workspaceByIdReadGate = makeByIdReadGate(workspaceReadScope);
+const workspaceScopedSearch = makeScopedSearch(workspaceReadScope);
 // See makeAuthGate's doc (record-type-kit.ts): must be wired as a genuine
 // prototype method below, never a class-field assignment — Harper's
 // relationship-traversal RBAC path reads allowRead off the prototype.
@@ -78,21 +79,11 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
             return gate.response;
         if (gate.kind === "unfiltered")
             return super.search(query);
-        const scope = await workspaceReadScope(gate.agentId);
-        const agentIdCondition = scope.condition;
-        // Harper passes `query` as a request target object (pathname, id, isCollection…).
-        // Inject the scope condition into its `.conditions` array.
-        if (query && typeof query === "object" && !Array.isArray(query)) {
-            const existing = query.conditions ?? [];
-            query.conditions = Array.isArray(existing)
-                ? [agentIdCondition, ...existing]
-                : [agentIdCondition, existing];
-            return super.search(query);
-        }
-        const conditions = Array.isArray(query) && query.length > 0
-            ? [agentIdCondition, ...query]
-            : [agentIdCondition];
-        return super.search(conditions);
+        // Non-admin agent: scope to own records only.  The scope condition is
+        // nested as the outermost AND block via makeScopedSearch (record-type-kit.ts)
+        // — same correct composition MemoryCandidate.search() already applies — so a
+        // caller-supplied `operator: "or"` cannot boolean-inject past the owner scope.
+        return workspaceScopedSearch(gate.agentId, query, (q) => super.search(q));
     }
     async post(content) {
         const auth = await this._auth();

package/dist/resources/agent-auth.js

@@ -25,6 +25,33 @@ import { ADMIN_ROLE, agentRecordIsAdmin } from "./agent-admin.js";
  * provisions it (ensureFlairAgentUser); they MUST agree on the name.
  */
 export const FLAIR_AGENT_USERNAME = "flair-agent";
+// ─── Principal deactivation guard (authz hardening slice 1) ─────────────────
+//
+// ONE predicate, called from BOTH verify paths (Ed25519 in doVerify + the
+// gate's own verify, and Basic/agent-auth in resolveAgentAuth) so the
+// deactivation check cannot drift between them.  Two independent checks would
+// inevitably diverge — one path tightened, the other forgotten — and this is
+// exactly the kind of control that must not.
+//
+// KNOWN LIMIT (slice 1b, NOT this slice): Harper's Bearer validation never
+// calls Agent.get(principalId), so already-issued Bearer tokens SURVIVE
+// deactivation.  This slice buys "deactivation stops new authentications" and
+// nothing more.  Existing tokens live until expiry or explicit revocation.
+// Do not read this as "deactivation now works" — it works for NEW auth only.
+/**
+ * Single shared predicate: is this principal deactivated?
+ *
+ * Called from BOTH verify paths (Ed25519 and Basic/agent-auth) so the
+ * deactivation check cannot drift.  A nonexistent agent is not "deactivated" —
+ * it will fail on other checks (missing publicKey, unknown user, etc.).
+ */
+export function isPrincipalDeactivated(agent) {
+    if (agent == null)
+        return false;
+    if (agent.status === undefined)
+        return false;
+    return agent.status !== "active";
+}
 // ─── Crypto + replay-guard helpers ────────────────────────────────────────────
 // WINDOW_MS, isNonceReplay/recordNonce (the ONE shared nonce store), and
 // importEd25519Key all live in ./ed25519-auth.ts — the single
@@ -103,6 +130,10 @@ async function doVerify(request) {
     const agent = await databases.flair.Agent.get(agentId).catch(() => null);
     if (!agent?.publicKey)
         return null;
+    // Deactivation guard — ONE predicate, same check as the Basic/agent-auth path
+    // in resolveAgentAuth below.  A deactivated principal cannot authenticate.
+    if (isPrincipalDeactivated(agent))
+        return null;
     // Canonical signed payload: id:ts:nonce:METHOD:pathname+search (must match the
     // TPS CLI signer exactly — changing this breaks every agent's auth).
     const url = new URL(request.url, "http://localhost");
@@ -310,10 +341,18 @@ export async function resolveAgentAuth(context) {
     const credentialed = hasCredentialEvidence(c);
     const user = context?.user ?? c.user;
     if (credentialed && user?.role?.permission?.super_user === true) {
-        return { kind: "agent", agentId: String(user.username ?? "admin"), isAdmin: true };
+        const agentId = String(user.username ?? "admin");
+        const agent = await databases.flair.Agent.get(agentId).catch(() => null);
+        if (isPrincipalDeactivated(agent))
+            return { kind: "anonymous" };
+        return { kind: "agent", agentId, isAdmin: true };
     }
     if (credentialed && user?.username && user.username !== FLAIR_AGENT_USERNAME) {
-        return { kind: "agent", agentId: String(user.username), isAdmin: false };
+        const agentId = String(user.username);
+        const agent = await databases.flair.Agent.get(agentId).catch(() => null);
+        if (isPrincipalDeactivated(agent))
+            return { kind: "anonymous" };
+        return { kind: "agent", agentId, isAdmin: false };
     }
     // A raw request with headers is present → verify it; an HTTP request that
     // yields no agent is anonymous (NOT internal).

package/dist/resources/auth-middleware.js

@@ -1,7 +1,7 @@
 import { patchRecord } from "./table-helpers.js";
 import { server, databases } from "harper";
 import { getEmbedding } from "./embeddings-provider.js";
-import { isAdmin, FLAIR_AGENT_USERNAME } from "./agent-auth.js";
+import { isAdmin, isPrincipalDeactivated, FLAIR_AGENT_USERNAME } from "./agent-auth.js";
 import { WINDOW_MS, isNonceReplay, recordNonce, importEd25519Key, b64ToArrayBuffer, parseTpsEd25519Header } from "./ed25519-auth.js";
 import { resolveReadScope } from "./memory-read-scope.js";
 import { isForbiddenOwnerMutation, resolveGuardedRecord } from "./record-owner-guard.js";
@@ -163,15 +163,24 @@ server.http(async (request, nextLayer) => {
     // ambient elevation alone. (The root-cause gate lives in resolveAgentAuth; see
     // agent-auth.ts hasCredentialEvidence.)
     if (header && request.user?.role?.permission?.super_user === true) {
-        request.tpsAgent = request.user.username ?? "admin";
-        request.tpsAgentIsAdmin = true;
-        try {
-            request.headers.set("x-tps-agent", request.tpsAgent);
-            if (request.headers.asObject)
-                request.headers.asObject["x-tps-agent"] = request.tpsAgent;
+        const username = request.user.username ?? "admin";
+        // Deactivation guard — same predicate as the Ed25519 path.
+        // A deactivated principal must not receive a tpsAgent annotation, even
+        // when Harper's ambient auth already verified the credential.
+        const agentRecord = await databases.flair.Agent.get(username).catch(() => null);
+        if (!isPrincipalDeactivated(agentRecord)) {
+            request.tpsAgent = username;
+            request.tpsAgentIsAdmin = true;
+            try {
+                request.headers.set("x-tps-agent", request.tpsAgent);
+                if (request.headers.asObject)
+                    request.headers.asObject["x-tps-agent"] = request.tpsAgent;
+            }
+            catch { /* frozen headers — annotation on request object still applies */ }
+            return nextLayer(request);
         }
-        catch { /* frozen headers — annotation on request object still applies */ }
-        return nextLayer(request);
+        // Deactivated — fall through. The request continues through the
+        // middleware chain (Basic block → Ed25519 → anonymous) without tpsAgent.
     }
     // Skip re-entry: if we already swapped auth to Basic, pass through
     if (request._tpsAuthVerified)
@@ -191,18 +200,23 @@ server.http(async (request, nextLayer) => {
             // with exact HDB_ADMIN_PASSWORD. Non-match falls through to Path 2.
             const adminPass = getAdminPass();
             if (adminPass !== null && user === "admin" && pass === adminPass) {
-                // Mark as verified and set Harper user directly
-                request._tpsAuthVerified = true;
-                try {
-                    request.user = await server.getUser("admin", null, request);
+                // Deactivation guard — same predicate, called before tpsAgent is stamped.
+                const agentRecord = await databases.flair.Agent.get("admin").catch(() => null);
+                if (!isPrincipalDeactivated(agentRecord)) {
+                    // Mark as verified and set Harper user directly
+                    request._tpsAuthVerified = true;
+                    try {
+                        request.user = await server.getUser("admin", null, request);
+                    }
+                    catch { /* fallback: let original Basic header pass through */ }
+                    request.headers.set("x-tps-agent", "admin");
+                    if (request.headers.asObject)
+                        request.headers.asObject["x-tps-agent"] = "admin";
+                    request.tpsAgent = "admin";
+                    request.tpsAgentIsAdmin = true;
+                    return nextLayer(request);
                 }
-                catch { /* fallback: let original Basic header pass through */ }
-                request.headers.set("x-tps-agent", "admin");
-                if (request.headers.asObject)
-                    request.headers.asObject["x-tps-agent"] = "admin";
-                request.tpsAgent = "admin";
-                request.tpsAgentIsAdmin = true;
-                return nextLayer(request);
+                // Deactivated — fall through to anonymous (end of Basic block).
             }
             // Path 2: Harper super_user check — any user with super_user:true
             let harperUser = null;
@@ -211,14 +225,19 @@ server.http(async (request, nextLayer) => {
             }
             catch { /* fall through — invalid creds, non-existent user, etc. */ }
             if (harperUser?.role?.permission?.super_user === true) {
-                request._tpsAuthVerified = true;
-                request.user = harperUser;
-                request.headers.set("x-tps-agent", user);
-                if (request.headers.asObject)
-                    request.headers.asObject["x-tps-agent"] = user;
-                request.tpsAgent = user;
-                request.tpsAgentIsAdmin = true;
-                return nextLayer(request);
+                // Deactivation guard — same predicate, called before tpsAgent is stamped.
+                const agentRecord = await databases.flair.Agent.get(user).catch(() => null);
+                if (!isPrincipalDeactivated(agentRecord)) {
+                    request._tpsAuthVerified = true;
+                    request.user = harperUser;
+                    request.headers.set("x-tps-agent", user);
+                    if (request.headers.asObject)
+                        request.headers.asObject["x-tps-agent"] = user;
+                    request.tpsAgent = user;
+                    request.tpsAgentIsAdmin = true;
+                    return nextLayer(request);
+                }
+                // Deactivated — fall through to anonymous (end of Basic block).
             }
             // Path 3: flair_pair_initiator — restricted to /FederationPair only.
             // Bootstrap credentials (pair-bootstrap-<id>) may only be used on this
@@ -231,14 +250,19 @@ server.http(async (request, nextLayer) => {
                 catch { /* fall through */ }
                 if (pairUser?.role?.role === "flair_pair_initiator" &&
                     pairUser?.active === true) {
-                    request._tpsAuthVerified = true;
-                    request.user = pairUser;
-                    request.headers.set("x-tps-agent", user);
-                    if (request.headers.asObject)
-                        request.headers.asObject["x-tps-agent"] = user;
-                    request.tpsAgent = user;
-                    request.tpsAgentIsAdmin = false;
-                    return nextLayer(request);
+                    // Deactivation guard — same predicate, called before tpsAgent is stamped.
+                    const agentRecord = await databases.flair.Agent.get(user).catch(() => null);
+                    if (!isPrincipalDeactivated(agentRecord)) {
+                        request._tpsAuthVerified = true;
+                        request.user = pairUser;
+                        request.headers.set("x-tps-agent", user);
+                        if (request.headers.asObject)
+                            request.headers.asObject["x-tps-agent"] = user;
+                        request.tpsAgent = user;
+                        request.tpsAgentIsAdmin = false;
+                        return nextLayer(request);
+                    }
+                    // Deactivated — fall through to anonymous (end of Basic block).
                 }
             }
         }
@@ -297,6 +321,11 @@ server.http(async (request, nextLayer) => {
     const agent = await databases.flair.Agent.get(agentId);
     if (!agent)
         return new Response(JSON.stringify({ error: "unknown_agent" }), { status: 401 });
+    // Deactivation guard — same predicate as the per-resource verify path in
+    // agent-auth.ts.  A deactivated principal cannot authenticate.
+    if (isPrincipalDeactivated(agent)) {
+        return new Response(JSON.stringify({ error: "principal_deactivated" }), { status: 401 });
+    }
     try {
         const payload = `${agentId}:${tsRaw}:${nonce}:${request.method}:${url.pathname}${url.search}`;
         const key = await importEd25519Key(agent.publicKey);

package/dist/resources/record-type-kit.js

@@ -211,6 +211,55 @@ export function makeByIdReadGate(readScope) {
         return record;
     };
 }
+// ─── (c) Scoped search — makeScopedSearch ────────────────────────────────
+/**
+ * Produces a scoped search() override that nests the caller's conditions
+ * inside the agent-scope condition as the OUTERMOST `and` block, so a
+ * caller-supplied `operator: "or"` cannot boolean-inject past the owner
+ * scope.
+ *
+ * This is the correct composition that MemoryCandidate.search() already
+ * applies (the only resource that got it right).  Memory.search() and
+ * WorkspaceState.search() both used a flat prepend — `[agentCondition,
+ * ...query.conditions]` — which lets a caller-supplied `query.operator`
+ * survive and turn the scope condition into one OR-branch.
+ *
+ * Every table that composes this gets the correct nesting by default;
+ * a fifth table added later cannot accidentally reintroduce the flat-
+ * prepend bug.
+ *
+ * `superSearch` is a caller-supplied closure so the class's own
+ * `super.search()` (which cannot be referenced from outside the class
+ * body) stays exactly where it was.
+ */
+export function makeScopedSearch(readScope) {
+    return async function scopedSearch(agentId, query, superSearch) {
+        const scope = await readScope(agentId);
+        const agentCondition = scope.condition;
+        // Object with a conditions array — nest caller's conditions inside the
+        // scope condition as the outermost AND block so a caller-supplied
+        // `operator: "or"` cannot boolean-inject past the owner scope.
+        if (query && typeof query === "object" && !Array.isArray(query)) {
+            if (Array.isArray(query.conditions) && query.conditions.length > 0) {
+                return superSearch({
+                    ...query,
+                    conditions: [agentCondition, { conditions: query.conditions, operator: query.operator || "and" }],
+                    operator: "and",
+                });
+            }
+            // No (or empty) conditions array — just scope, preserving other query
+            // properties but NOT a caller-supplied operator (force "and").
+            const { conditions: _c, operator: _o, ...rest } = query;
+            return superSearch({ ...rest, conditions: [agentCondition], operator: "and" });
+        }
+        // Plain array or no query — wrap in an object with operator "and" so
+        // the scope condition is always the outermost AND.
+        const conditions = Array.isArray(query) && query.length > 0
+            ? [agentCondition, { conditions: query, operator: "and" }]
+            : [agentCondition];
+        return superSearch({ conditions, operator: "and" });
+    };
+}
 export function stampAttribution(auth, content, field, mode, forbiddenMessage) {
     if (auth.kind !== "agent")
         return {}; // internal → always passthrough

package/docs/upgrade.md

@@ -78,18 +78,23 @@ actually running:
   instead of retrying in a loop — see [Downgrade](#downgrade) for the
   restore procedure.
 
-### Pre-upgrade snapshot (opt-in)
+### Pre-upgrade snapshot (opt-in for same-engine, unconditional on engine change)
 
 flair#637 added a **physical**, byte-exact snapshot of `~/.flair/data` — the whole
 directory (RocksDB files, keys, config, `admin-pass`), not just the logical records a
-`flair backup` JSON export covers. As of 2026-07-08 this is **opt-in**: pass
-`--snapshot` to `flair upgrade` to take one before the package swap. It's off by
-default — matching how Harper's own upgrade CLI behaves (it recommends a backup before
-proceeding, but never auto-tars your data directory for you) — because the
-tested-downgrade guarantee below already covers the failure mode a snapshot exists
-for, and the old opt-out default meant every upgrade paid the cost (the data dir can
-be 800MB+; keep-last-3 retention meant up to ~2.5GB of snapshots sitting around)
-whether or not you wanted it.
+`flair backup` JSON export covers. As of 2026-07-08 this is **opt-in** for same-engine
+upgrades: pass `--snapshot` to `flair upgrade` to take one before the package swap.
+It's off by default — matching how Harper's own upgrade CLI behaves (it recommends a
+backup before proceeding, but never auto-tars your data directory for you) — because
+the downgrade-boot test (see below) covers same-engine downgrades, and the old opt-out
+default meant every upgrade paid the cost (the data dir can be 800MB+; keep-last-3
+retention meant up to ~2.5GB of snapshots sitting around) whether or not you wanted it.
+
+**When the engine (Harper) version changes** (flair#1047), the snapshot is
+**unconditional** — the tested-downgrade guarantee does not hold across engine version
+boundaries, and the backwards-boot refusal + snapshot recovery path is the invariant
+that applies. Opting out requires `--no-engine-snapshot` and prints what is being
+given up.
 
 ```bash
 flair upgrade --snapshot
@@ -489,6 +494,20 @@ current build, writes a memory and a presence row, stops it *without* wiping the
 directory, then boots the last **npm-published** `@tpsdev-ai/flair` against that exact
 same directory and confirms it comes up healthy and can read both rows back.
 
+**The guarantee is now restated (flair#1050):** there is never a silent bad outcome.
+Either the old binary boots and serves the corpus correctly, **or** it refuses to start
+with a message naming what wrote the store, what is running, and how to recover — and a
+pre-upgrade snapshot exists to recover *from*. The first branch (clean boot) holds for
+same-engine upgrades; the second (refusal + snapshot) applies when the engine version
+changes, which is the case where downgrade was never ours to guarantee.
+
+**First known engine-version break:** Harper 5.1 → 5.2 (2026-08). 5.2.0 creates the
+`hdb_secret` store on first boot against an existing data directory, and the older binary
+will not start against it. Harper's 5.2.0 release notes document no rollback procedure.
+The backwards-boot refusal (flair#1049) catches this: the old binary refuses to start,
+naming both versions and the data directory, with recovery instructions. A pre-upgrade
+snapshot exists at the named path. Restoring it returns the store to a working state.
+
 **As observed when this suite was added (2026-07-08):** the npm-published baseline
 (0.21.0) boots cleanly against data written by a HEAD build roughly 14 commits ahead of
 it (several security-hardening and CLI-behavior changes, no Flair schema migration, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tpsdev-ai/flair",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "packageManager": "bun@1.3.10",
   "description": "Identity, memory, and soul for AI agents. Cryptographic identity (Ed25519), semantic memory with local embeddings, and persistent personality — all in a single process.",
   "type": "module",