@tpsdev-ai/flair 0.4.15 → 0.5.0

package/README.md

@@ -1,6 +1,7 @@
 # 🎖️ Flair
 
 [![CI](https://github.com/tpsdev-ai/flair/actions/workflows/test.yml/badge.svg)](https://github.com/tpsdev-ai/flair/actions/workflows/test.yml)
+[![Docker Test](https://github.com/tpsdev-ai/flair/actions/workflows/docker-test.yml/badge.svg)](https://github.com/tpsdev-ai/flair/actions/workflows/docker-test.yml)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 
 **Identity, memory, and soul for AI agents. Runs standalone or as part of a [TPS](https://tps.dev) office.**
@@ -63,12 +64,36 @@ Not all memories are equal:
 | `standard` | ✅ Allowed | None | Working memory (default) |
 | `ephemeral` | ✅ Allowed | 24h | Scratch space, temp context |
 
+### Temporal Validity
+Memories can be time-bounded with `validFrom` and `validTo` fields. Expired memories are excluded from search and bootstrap automatically — no manual cleanup.
+
+### Relationship Graph
+Entity-to-entity triples with temporal bounds. Model structured knowledge — "Flint works-with Anvil since 2024-01-01" — queryable alongside semantic memory.
+
 ### Real-Time Feeds
 Subscribe to memory or soul changes via WebSocket/SSE. Useful for dashboards, cross-agent sync, or audit trails.
 
 ### Multi-Agent
 One Flair instance serves any number of agents. Each agent has its own keys, memories, and soul. Agents can't read each other's data without explicit access grants.
 
+### OAuth 2.1 Authorization Server
+Built-in OAuth 2.1 server with PKCE, dynamic client registration, and a standards-compliant token endpoint. Agents and services can delegate auth to Flair without a separate IdP.
+
+### XAA (Enterprise-Managed Authorization)
+IdP integration for Google Workspace, Azure AD, and Okta. Bind agent identities to enterprise accounts — access follows your org's user lifecycle.
+
+### Web Admin
+Server-rendered admin UI for managing principals, connectors, IdPs, and instance configuration. No separate dashboard service.
+
+### Federation
+Hub-and-spoke sync between Flair instances using signed requests and pairing tokens. Originator enforcement prevents replay across federated nodes. Share memories across offices without giving any node raw access.
+
+### Predictive Bootstrap
+Context-signal-aware preloading. Bootstrap reads active project context, recent activity, and agent role to select the most relevant memories — not just the most recent ones.
+
+### Auto Entity Detection
+Passive extraction of entities from memory content on write. Entities are indexed automatically — no tagging required. Feeds the relationship graph without agent intervention.
+
 ## Quick Start
 
 ### Prerequisites
@@ -296,6 +321,22 @@ bun test             # Run unit + integration tests
 
 Integration tests spin up a real Harper instance on a random port, run the test suite, and tear down. No mocks for the database layer.
 
+### Test Coverage
+
+**203+ unit tests** across 19 test files, covering 7 CI checks on every commit.
+
+| Category | Tests | What's covered |
+|----------|-------|----------------|
+| **Auth & Identity** | auth-middleware, auth-scoping, key-paths-and-rotation | Ed25519 signature verification, agent isolation, key rotation |
+| **Memory** | data-scoping, backup-restore, agent-remove-and-grants | Cross-agent access denied, data durability, grant lifecycle |
+| **Content Safety** | content-safety | Prompt injection detection, identity hijacking, format injection, exfiltration patterns |
+| **Search** | temporal-scoring, embeddings | Temporal decay, relevance scoring, embedding generation |
+| **Rate Limiting** | rate-limiter | Per-agent rate limiting, bucket isolation |
+| **Integration** | smoke, durability-guard | End-to-end write/search/bootstrap, durability tier enforcement |
+| **CLI** | cli-v2, cli-api, first-run-soul | Full CLI command coverage, API layer, soul onboarding |
+
+CI pipeline: unit tests, integration tests, type check, dependency audit, Semgrep SAST, CodeQL SAST, Docker from-scratch validation.
+
 ## Status
 
 > **Note:** Flair uses [Harper v5](https://harper.fast), currently in beta. We run it in production daily and track upstream closely. Pin your Harper version.
@@ -312,6 +353,14 @@ Flair is in active development and daily use. We dogfood it — the agents that
 - ✅ Real-time feeds (WebSocket/SSE)
 - ✅ Agent-scoped data isolation
 - ✅ Cold start bootstrap with adaptive time window
+- ✅ Predictive bootstrap (context-signal-aware preloading)
+- ✅ Temporal validity (`validFrom`/`validTo` on memories)
+- ✅ Relationship graph (entity-to-entity triples with temporal bounds)
+- ✅ Auto entity detection (passive extraction from memory content)
+- ✅ OAuth 2.1 authorization server (PKCE, dynamic client registration, token endpoint)
+- ✅ XAA enterprise authorization (Google Workspace, Azure AD, Okta)
+- ✅ Web admin UI (principals, connectors, IdPs, instance config)
+- ✅ Federation (hub-and-spoke sync with signed requests and pairing tokens)
 - ✅ OpenClaw memory plugin
 - ✅ MCP server for Claude Code / Cursor / Windsurf
 - ✅ Lightweight client library (`@tpsdev-ai/flair-client`)