@tpsdev-ai/flair 0.44.13 → 0.46.0

package/dist/rem/snapshot.js

@@ -20,6 +20,7 @@ import { mkdirSync, writeFileSync, statSync, chmodSync, rmSync, existsSync, read
 import { resolve } from "node:path";
 import { homedir } from "node:os";
 import { create as tarCreate, extract as tarExtract, list as tarList } from "tar";
+import { validateSnapshotArchive } from "../lib/safe-snapshot-extract.js";
 export const SNAPSHOT_ROOT = resolve(homedir(), ".flair", "snapshots");
 /** Validates the agent id and returns its snapshot directory. */
 export function remSnapshotDir(agent) {
@@ -133,20 +134,20 @@ export async function extractSnapshot(opts) {
     if (existsSync(targetDir)) {
         throw new Error(`target directory already exists: ${targetDir}`);
     }
+    // flair#903 — fail CLOSED on a tampered archive. node-tar's defaults below
+    // do contain malicious entries (leading "/" stripped, ".." entries dropped,
+    // no writing through symlinks — verified on the pinned tar against all four
+    // vectors), but they discard those entries SILENTLY: the restore reported
+    // success minus the parts it never mentioned, and the operator held a
+    // partial restore they believed was complete. Validation runs BEFORE the
+    // target directory is even created: a tampered snapshot aborts the whole
+    // restore, names the offending entry, and writes nothing (same posture as
+    // the data-dir restore's extractSnapshotSafely). The default extract flags
+    // are kept as containment defense-in-depth — deliberately NOT
+    // preservePaths; if that flag is ever added here, this call MUST move to
+    // extractSnapshotSafely (see src/lib/safe-snapshot-extract.ts).
+    await validateSnapshotArchive({ file: opts.snapshotPath, targetDir });
     mkdirSync(targetDir, { recursive: true, mode: 0o700 });
-    // Deliberately NOT preservePaths, and deliberately NOT routed through
-    // src/lib/safe-snapshot-extract.ts. The snapshot path comes from the
-    // operator, so provenance here is no more controlled than the data-dir
-    // restore's — the difference is the flag, not the trust. With node-tar's
-    // defaults its own containment applies: it strips a leading "/" from entry
-    // paths, drops ".." entries, and refuses to write through a symlink,
-    // including one created earlier in the same archive. Verified against the
-    // pinned tar (7.5.20) on all four cases — absolute path, ".." traversal,
-    // in-archive symlink, pre-existing symlink in the target — each contained,
-    // with a benign control entry landing to prove the archives were valid.
-    // If `preservePaths` is ever added here, that containment is gone and this
-    // call MUST move to extractSnapshotSafely, which is why the data-dir
-    // restore needs the wrapper and this does not.
     await tarExtract({ file: opts.snapshotPath, cwd: targetDir });
     return { targetDir, entries };
 }

package/dist/resources/Memory.js

@@ -6,7 +6,7 @@ import { getEmbedding, getModelId } from "./embeddings-provider.js";
 import { scanFields, isStrictMode } from "./content-safety.js";
 import { invalidEntitiesResponse } from "./entity-vocab.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
-import { assertValidVisibility } from "./memory-visibility.js";
+import { assertValidVisibility, assertVisibilityAllowedForDurability } from "./memory-visibility.js";
 import { assertValidDurability } from "./memory-durability.js";
 import { DEDUP_COSINE_THRESHOLD_DEFAULT, DEDUP_LEXICAL_THRESHOLD_DEFAULT, DEDUP_MIN_CONTENT_LENGTH, computeMatchConfidence, cosineSimilarity, isConservativeMatch, } from "./dedup.js";
 import { buildProvenance, makeAuthGate, makeReadScope, makeByIdReadGate, makeScopedSearch, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
@@ -641,6 +641,20 @@ export class Memory extends databases.flair.Memory {
                 return new Response(JSON.stringify({ error: "invalid_visibility", message: visibilityError }), { status: 400, headers: { "content-type": "application/json" } });
             }
         }
+        // ── flair#1257: ephemeral memories are private-only (hard precondition) ──
+        // The durability-keyed default below sends ephemeral to "private", but a
+        // default is not a constraint — an explicit visibility:"shared" here would
+        // make continuity-journal entries org-readable AND federation-pushed.
+        // Refused at the server so the boundary holds for every caller, not just
+        // the hooks that promise to send "private". content.durability is already
+        // defaulted ("standard" when absent) and enum-validated above, so this
+        // sees the row's effective durability.
+        {
+            const tierError = assertVisibilityAllowedForDurability(content.durability, content.visibility);
+            if (tierError) {
+                return new Response(JSON.stringify({ error: "invalid_visibility_for_durability", message: tierError }), { status: 400, headers: { "content-type": "application/json" } });
+            }
+        }
         if (content.visibility === undefined || content.visibility === null) {
             content.visibility = defaultVisibilityForDurability(content.durability);
         }
@@ -853,6 +867,23 @@ export class Memory extends databases.flair.Memory {
                 return new Response(JSON.stringify({ error: "invalid_visibility", message: visibilityError }), { status: 400, headers: { "content-type": "application/json" } });
             }
         }
+        // ── flair#1257: ephemeral memories are private-only (hard precondition) ──
+        // Same rule as post(), with one PUT-specific wrinkle: an update payload
+        // may omit durability entirely (put() stamps no durability default), so
+        // `PUT /Memory/<id> {"visibility":"shared"}` against a stored ephemeral
+        // row names no durability of its own — the EFFECTIVE durability is the
+        // pre-existing row's, and the flip must refuse just like a fresh
+        // ephemeral+shared create. An explicit durability on the write wins: a
+        // write that promotes the row OUT of ephemeral (e.g. distillation lifting
+        // it to persistent, #1205) while sharing it is a legitimate promotion,
+        // not an ephemeral share. preExisting was fetched above.
+        {
+            const effectiveDurability = content.durability ?? preExisting?.durability;
+            const tierError = assertVisibilityAllowedForDurability(effectiveDurability, content.visibility);
+            if (tierError) {
+                return new Response(JSON.stringify({ error: "invalid_visibility_for_durability", message: tierError }), { status: 400, headers: { "content-type": "application/json" } });
+            }
+        }
         if (!preExisting && (content.visibility === undefined || content.visibility === null)) {
             content.visibility = defaultVisibilityForDurability(content.durability);
         }

package/dist/resources/MemoryBootstrap.js

@@ -15,6 +15,7 @@ import { buildCollisionEntries, buildEntityMatchCondition, freshPresenceByAgent,
 // retrievalCount hit-tracking side effects (see resources/
 // semantic-retrieval-core.ts's module doc for the full boundary).
 import { retrieveCandidates, DEFAULT_SELECT } from "./semantic-retrieval-core.js";
+import { hybridEnabled } from "./bm25.js";
 import { buildTrustBlock } from "./trust-block.js";
 import { bestSemanticSimilarity, evaluateAbstention } from "./abstention.js";
 import { estimateTokens } from "./token-estimate.js";
@@ -51,8 +52,9 @@ import { estimateTokens } from "./token-estimate.js";
  *      (no new embedding code — Memory is the semantic surface, WorkspaceState/
  *      OrgEvent are the entity surface, per the K&S verdict). Gated on
  *      freshness (Presence, via the SAME internal roster path, never the raw
- *      table) and #550's existing relevance floor. See resources/
- *      collision-lib.ts for the pure join/rank/format logic.
+ *      table); drawn from #550's fused-rank scored pool (flair#1246 — no
+ *      relevance floor). See resources/collision-lib.ts for the pure
+ *      join/rank/format logic.
  *
  * Prediction: when context signals (channel, surface, subjects) are provided,
  * the bootstrap loads more aggressively — Flair is fast enough that the
@@ -128,9 +130,12 @@ import { estimateTokens } from "./token-estimate.js";
  *   memoriesAvailable` — included and truncated are disjoint sets of UNIQUE own
  *   memories (a memory budget-skipped in one section but admitted in another counts
  *   as included, never both). `teammateFindingsMatched` is the teammate match pool
- *   that cleared the relevance floor; `teammateFindingsIncluded +
- *   teammateFindingsTruncated == teammateFindingsMatched`, so "truncated" means
- *   "relevant but no budget," not "every candidate not selected."
+ *   that entered the scored candidate set — since flair#1246 that is the
+ *   K-bounded fused-rank retrieval pool (no relevance floor; the historical
+ *   `_score > 0.3` gate was measured inert and removed); `teammateFindingsIncluded
+ *   + teammateFindingsTruncated == teammateFindingsMatched` (the #1199 contract,
+ *   unchanged), so "truncated" means "retrieved but no budget," not "every
+ *   candidate not selected."
  *   `predictedHint` is present only when subjects were provided but `predicted`
  *   came back empty.
  */
@@ -204,10 +209,18 @@ const OWN_NONPERMANENT_FETCH_LIMIT = 500;
 const AVG_LINE_TOKEN_ESTIMATE = 60;
 const MIN_CANDIDATE_POOL = 50;
 const MAX_CANDIDATE_POOL = 100;
-// Bootstrap's own historical relevance floor (distinct from SemanticSearch's
-// `minScore` request param) — preserved verbatim from the original raw
-// JS dot-product scan's `.filter((s) => s.score > 0.3)`.
-const TASK_RELEVANCE_FLOOR = 0.3;
+// flair#1246 — the historical TASK_RELEVANCE_FLOOR (`_score > 0.3`, carried
+// verbatim from the original raw JS dot-product scan) is REMOVED, not
+// recalibrated: a 6-variant measurement on the shipped embedding model proved
+// it inert (126 records across field-analog/nonce/contamination/control/
+// max-dilution/scattered-senses shapes — nothing scored under ~0.44, so the
+// floor cut zero records and never delivered "show nothing when nothing's
+// relevant" either; fully-unrelated bland noise sits 0.44–0.63). Selection on
+// the task-relevant surface is fused retrieval rank + the token budget. Do
+// not reintroduce a constant floor — an absolute bar tight enough to exclude
+// bland noise (max-dilution noise cosine 0.6086) also excludes the
+// pathological on-task case (0.5656); a real relevance gate would need a
+// corpus-relative instrument, which is a new feature, not a constant.
 // flair#1207 — the per-item structured-payload overhead that #1199 charged
 // against the content-selection budget (a `+ STRUCT_ITEM_OVERHEAD_TOKENS = 70`
 // added to every item's cost, PLUS a `structOverheadReserve` pre-deducted from
@@ -364,9 +377,10 @@ export class BootstrapMemories extends Resource {
         // is what let one client see included(9) > available(3).
         let teammateFindingsIncluded = 0;
         // flair#1207 — teammate findings SKIPPED for size in the task-relevant
-        // packing loop (cleared the relevance floor but didn't fit the BUDGET).
-        // Reported ALONGSIDE `teammateFindingsMatched` (the whole floor-clearing pool
-        // considered), so "truncated" unambiguously means "relevant-but-no-budget",
+        // packing loop (entered the scored retrieval pool but didn't fit the
+        // BUDGET; flair#1246 — the pool is the K-bounded fused-rank candidate
+        // set, no relevance floor). Reported ALONGSIDE `teammateFindingsMatched`
+        // (the whole scored pool considered), so "truncated" unambiguously means "relevant-but-no-budget",
         // NOT "every candidate not selected" — 0.44.9's `truncated:89` beside
         // `included:4` read as "89 relevant findings cut" with no pool to anchor it
         // (heskew's #1207 nit). Both are disjoint-and-exhaustive over the matched
@@ -876,12 +890,13 @@ export class BootstrapMemories extends Resource {
             }
         }
         // Collision surfacing's semantic-match candidates (flair#681) — the
-        // BEST (highest-scoring) cross-agent memory per teammate from #550's
+        // BEST (top fused-rank) cross-agent memory per teammate from #550's
         // `scored` list below, captured here (before that list's tokens get
         // spent on the relevant/teammate sections) so the collision block can
-        // reuse the IDENTICAL scored+floor-gated set without recomputing or
-        // re-embedding anything. Stays empty when there's no currentTask (no
-        // `scored` list is ever built) or no cross-agent hits.
+        // reuse the IDENTICAL scored set (flair#1246 — fused retrieval rank, no
+        // floor gate) without recomputing or re-embedding anything. Stays empty
+        // when there's no currentTask (no `scored` list is ever built) or no
+        // cross-agent hits.
         const semanticTeammateMatches = [];
         // --- 4. Task-relevant memories (semantic search) ---
         if (currentTask && tokenBudget > 200) {
@@ -915,12 +930,27 @@ export class BootstrapMemories extends Resource {
                     queryEmbedding,
                     conditions: [scope.condition],
                     limit: candidatePoolK,
-                    // HNSW-leg pushdown ONLY (K&S verdict): no BM25 fusion for
-                    // bootstrap — a different cost profile, since BM25 over the org
-                    // corpus for a one-shot session-load could be MORE expensive than
-                    // HNSW-only unless cached across sessions. Turning it on is an
-                    // explicit opt-in follow-on, gated on its own harness run.
-                    hybrid: false,
+                    // flair#1246 — ONE RANKER, ONE SCALE: this pass now invokes the
+                    // core in the SAME mode memory_search does (hybrid + q via the
+                    // shared hybridEnabled() selector, so the FLAIR_HYBRID_RETRIEVAL
+                    // kill-switch moves BOTH surfaces together — a split mode IS the
+                    // #1246 bug). HNSW-only here was an accident of early code, and it
+                    // made bootstrap's teammate picks diverge from search on the same
+                    // store+query: a record whose task-relevance is LEXICAL (exact task
+                    // terms in semantically-atypical prose) ranks BELOW bland-generic
+                    // noise on pure cosine (measured at N=21: on-task 0.5656 vs noise
+                    // 0.6086 — HNSW rank 6 while search fused it to rank 1), and at
+                    // field scale (corpus >> candidatePoolK) that inversion becomes
+                    // exclusion from the K-bounded pool entirely. The BM25 leg is the
+                    // rescue: it admits the record at lexical rank 1 and union-RRF
+                    // fusion carries it to the top, same as search. Perf (Kern-ratified
+                    // trade): the BM25 corpus scan this adds to the bootstrap path is
+                    // the same per-call scan every memory_search request already runs.
+                    hybrid: hybridEnabled(),
+                    // The lexical leg — same query text the embedding was computed
+                    // from, so both legs rank the same question (parity with search,
+                    // where `q` drives BM25 and the keyword bump).
+                    q: currentTask,
                     // Per-set (this K-bounded pool only, never cross-applied to the
                     // permanent/recent/predicted sets above) — see this function's
                     // supersededIds docs above and resources/
@@ -960,30 +990,32 @@ export class BootstrapMemories extends Resource {
                 });
                 // flair#744 slice 2: the best-match confidence for the abstention
                 // decision — the max absolute cosine across the retrieved pool, read
-                // ONLY from `_semSimilarity` (never any principal/authority field). Note
-                // this floor (ABSTENTION_THRESHOLD ≈ 0.15) sits BELOW bootstrap's own
-                // long-standing TASK_RELEVANCE_FLOOR (0.3) that gates `scored` below, so
-                // an abstaining task (bestSim < 0.15) already has no candidate passing
-                // the floor — abstention only ADDS an explicit "nothing covered this"
-                // signal, it never removes a memory the reader would otherwise have seen.
+                // ONLY from `_semSimilarity` (never any principal/authority field).
+                // Abstention is unaffected by #1246's floor removal: it only ADDS an
+                // explicit "nothing covered this" signal against its own GLOBAL
+                // threshold (resources/abstention.ts), it never removes a memory the
+                // reader would otherwise have seen.
                 if (abstain)
                     taskBestSimilarity = bestSemanticSimilarity(candidates);
-                // Preserve the ORIGINAL score > 0.3 floor exactly (bootstrap's own
-                // historical relevance floor — distinct from SemanticSearch's
-                // `minScore` request param — strict inequality, applied client-side;
-                // `candidates` are already `_score`-sorted best-first, so filtering
-                // preserves that order). `retrieveCandidates()`'s cosine similarity
-                // replaces the raw JS dot product as the ranking signal (HNSW-only,
-                // no BM25) — the K&S-ratified, closest-to-a-wash choice; the
-                // recall harness gates any regression from this ranking-signal
-                // change (magnitude-sensitive dot product → normalized cosine).
+                // flair#1246 — selection is FUSED RETRIEVAL RANK + the token budget
+                // in the packing loop below; there is NO score floor (see the
+                // TASK_RELEVANCE_FLOOR removal note by the pool constants above —
+                // measured inert on the shipped embedding model). `candidates` arrive
+                // best-first on the same ranking memory_search uses (fused RRF order
+                // under hybrid; see retrieveCandidates), so this filter+map preserves
+                // that order. `score` carries `_score` — the honest absolute cosine
+                // (+ legacy keyword bump) per #985/#1267 — for display/reporting;
+                // ORDER and score can legitimately disagree (a BM25 rank-1 rescue
+                // outranks higher-cosine bland hits, which is the recall win).
                 const scored = candidates
-                    .filter((m) => !includedIds.has(m.id) && m._score > TASK_RELEVANCE_FLOOR)
+                    .filter((m) => !includedIds.has(m.id))
                     .map((m) => ({ memory: m, score: m._score }));
                 // flair#681: the collision block's semantic surface — one candidate
-                // per teammate (the highest-scoring hit; `scored` is already sorted
-                // desc, so the first occurrence of a given `_source` IS the best
-                // one). `m._source` is only ever set for a cross-agent record (see
+                // per teammate (`scored` is sorted best-first by the fused retrieval
+                // rank, so the first occurrence of a given `_source` IS that
+                // teammate's best-ranked hit; its `score` field reports the honest
+                // absolute cosine, which per #985/#1267 can disagree with rank).
+                // `m._source` is only ever set for a cross-agent record (see
                 // retrieveCandidates()'s `_source` tagging) — an own memory never
                 // contributes here.
                 const seenCollisionAgents = new Set();
@@ -1077,7 +1109,8 @@ export class BootstrapMemories extends Resource {
         //   - Entity overlap (WorkspaceState + OrgEvent): exact vocabulary-string
         //     match, high-precision, no separate relevance score needed.
         //   - Semantic match (Memory, via #550/4 above): `semanticTeammateMatches`,
-        //     already floor-gated (score > 0.3) — reused as-is, no new scoring.
+        //     each teammate's best-ranked hit from the fused retrieval pool
+        //     (flair#1246 — no score floor) — reused as-is, no new scoring.
         // Gated on freshness (Presence, via the internal roster path) — a
         // teammate absent from the roster, or whose presenceStatus is "offline",
         // never surfaces regardless of how strong the entity/semantic match is.
@@ -1311,9 +1344,10 @@ export class BootstrapMemories extends Resource {
             if (!includedOwnIds.has(id))
                 memoriesTruncatedUnique++;
         memoriesTruncated = memoriesTruncatedUnique;
-        // flair#1207 — the teammate MATCH POOL considered (cleared the relevance
-        // floor, drawn from the bounded candidate pool): every matched teammate
-        // finding is EITHER included OR budget-truncated, so this equals their sum.
+        // flair#1207 — the teammate MATCH POOL considered (flair#1246: the
+        // cross-agent records that entered the scored set — drawn from the
+        // K-bounded fused-rank candidate pool, no relevance floor): every matched
+        // teammate finding is EITHER included OR budget-truncated, so this equals their sum.
         // Reporting it anchors `teammateFindingsTruncated` as "relevant-but-no-budget"
         // rather than an unexplained large number beside a small `included`.
         const teammateFindingsMatched = teammateFindingsIncluded + teammateFindingsTruncated;
@@ -1455,16 +1489,18 @@ export class BootstrapMemories extends Resource {
                 + "after zero-row no-op auto-heal filtering. This container is present-but-empty by design, not dropped."
             : undefined;
         // teammateFindings: [] — name WHICH legitimate empty this is (no task → no
-        // retrieval; matched-but-budget-truncated; or nothing cleared the relevance
-        // floor), so it never reads as a silent drop.
+        // retrieval; matched-but-budget-truncated; or no cross-agent record entered
+        // the task-relevant retrieval pool at all — flair#1246: there is no
+        // relevance floor, so "empty" means empty retrieval, never a score cut),
+        // so it never reads as a silent drop.
         const teammateFindingsHint = includedTeammateFindings.length === 0
             ? (!taskProvided
                 ? "No teammateFindings: cross-agent findings are retrieved against your currentTask, and none was provided. "
                     + "Pass currentTask to populate this."
                 : teammateFindingsTruncated > 0
                     ? `No teammateFindings fit the token budget: ${teammateFindingsTruncated} relevant cross-agent finding(s) `
-                        + "cleared the relevance floor but were budget-truncated. Raise maxTokens to include them."
-                    : "No cross-agent (teammate) memory cleared the task-relevance floor for this currentTask. "
+                        + "were retrieved but budget-truncated. Raise maxTokens to include them."
+                    : "No cross-agent (teammate) memory entered the task-relevant retrieval pool for this currentTask. "
                         + "This container is present-but-empty by design, not dropped.")
             : undefined;
         const responseBody = {
@@ -1532,8 +1568,9 @@ export class BootstrapMemories extends Resource {
             // size-skip self-describing: "a relevant teammate finding didn't fit" is
             // now distinguishable from "no relevant teammate finding".
             teammateFindingsTruncated,
-            // flair#1207 — the teammate match POOL considered (cleared the relevance
-            // floor). teammateFindingsIncluded + teammateFindingsTruncated ==
+            // flair#1207 — the teammate match POOL considered (flair#1246: entered
+            // the scored fused-rank retrieval set; no relevance floor).
+            // teammateFindingsIncluded + teammateFindingsTruncated ==
             // teammateFindingsMatched, so "truncated" reads as "relevant-but-no-budget"
             // against a stated pool, not an unanchored large number.
             teammateFindingsMatched,

package/dist/resources/MemoryFeed.js

@@ -2,6 +2,8 @@ import { Resource, databases } from "harper";
 import { allowVerified, resolveAgentAuth } from "./agent-auth.js";
 import { computeContentHash, findExistingMemoryByContentHash } from "./memory-feed-lib.js";
 import { FORBIDDEN, UNAUTH, stampAttribution } from "./record-type-kit.js";
+import { assertValidVisibility, assertVisibilityAllowedForDurability, PRIVATE_VISIBILITY } from "./memory-visibility.js";
+import { assertValidDurability } from "./memory-durability.js";
 export class FeedMemories extends Resource {
     // Self-authorize via the Ed25519 agent verify (the auth reshape removes the
     // gate's admin elevation).
@@ -53,6 +55,46 @@ export class FeedMemories extends Resource {
                 headers: { "Content-Type": "application/json" },
             });
         }
+        // ── Write-side durability/visibility validation (#1009/#1238/#1257) ─────
+        // This endpoint writes via the RAW table object below — NOT the exported
+        // Memory resource — so it inherits NONE of Memory.post()/put()'s write
+        // guards (Sherlock's #1261 review: ephemeral+shared, and any invalid
+        // visibility or durability, landed through POST /FeedMemories untouched).
+        // The three guards are applied here in the same order as Memory.post().
+        //
+        // Placed BEFORE the content-hash dedup early-return, deliberately: a
+        // refused combination must refuse deterministically, not return 200 with
+        // the existing record whenever a duplicate happens to exist.
+        //
+        // The effective durability for the tier rule is the one the record below
+        // actually stamps — `content.durability ?? "standard"`. A raw table put
+        // REPLACES the row, so even an update-in-place that omits durability
+        // produces a "standard" row regardless of what it replaces; the stored
+        // row's tier is decided entirely by this payload.
+        const durability = content.durability ?? "standard";
+        {
+            const durabilityError = assertValidDurability(content.durability);
+            if (durabilityError) {
+                return new Response(JSON.stringify({ error: "invalid_durability", message: durabilityError }), {
+                    status: 400,
+                    headers: { "Content-Type": "application/json" },
+                });
+            }
+            const visibilityError = assertValidVisibility(content.visibility);
+            if (visibilityError) {
+                return new Response(JSON.stringify({ error: "invalid_visibility", message: visibilityError }), {
+                    status: 400,
+                    headers: { "Content-Type": "application/json" },
+                });
+            }
+            const tierError = assertVisibilityAllowedForDurability(durability, content.visibility);
+            if (tierError) {
+                return new Response(JSON.stringify({ error: "invalid_visibility_for_durability", message: tierError }), {
+                    status: 400,
+                    headers: { "Content-Type": "application/json" },
+                });
+            }
+        }
         const now = new Date().toISOString();
         const contentHash = computeContentHash(agentId, body);
         const existing = await findExistingMemoryByContentHash(databases.flair.Memory.search(), agentId, contentHash);
@@ -64,11 +106,24 @@ export class FeedMemories extends Resource {
             agentId,
             content: body,
             contentHash,
-            durability: content.durability ?? "standard",
+            durability,
             createdAt: content.createdAt ?? now,
             updatedAt: content.updatedAt ?? now,
             archived: content.archived ?? false,
         };
+        // flair#1257, omission leak: this endpoint stamps NO durability-keyed
+        // visibility default (unlike Memory.post/put — Layer 1), so an ephemeral
+        // feed write with visibility omitted would land with no visibility field
+        // at all, which the read side resolves to NON-private (the migration
+        // invariant). The refusal guard above cannot see an omission, so the
+        // private-only tier invariant is closed here by stamping "private" on
+        // exactly the ephemeral case. Deliberately NOT the general durability-
+        // keyed default: stamping it for standard/persistent/permanent would flip
+        // the visibility of every existing feed caller's writes — a behavioural
+        // change this fix must not smuggle in.
+        if (record.durability === "ephemeral" && (record.visibility === undefined || record.visibility === null)) {
+            record.visibility = PRIVATE_VISIBILITY;
+        }
         await databases.flair.Memory.put(record);
         return record;
     }

package/dist/resources/MemoryMaintenance.js

@@ -54,8 +54,14 @@ export class MemoryMaintenance extends Resource {
                 if (targetAgent && record.agentId !== targetAgent)
                     continue;
                 stats.total++;
-                // 1. Delete expired memories
-                if (record.expiresAt && new Date(record.expiresAt) < now) {
+                // 1. Delete expired ephemeral memories. expiresAt is only a reap
+                // signal for the ephemeral tier (docstring + Memory.post() TTL
+                // stamp). A non-ephemeral row that acquired one (bug, import, API
+                // misuse) must survive — missing / unexpected durability is treated
+                // as non-ephemeral so we do not silently reap durable rows.
+                if (record.durability === "ephemeral" &&
+                    record.expiresAt &&
+                    new Date(record.expiresAt) < now) {
                     if (!dryRun) {
                         try {
                             await databases.flair.Memory.delete(record.id);

package/dist/resources/abstention.js

@@ -46,11 +46,13 @@
  * GLOBAL / data-driven, NEVER per-principal (Sherlock binding condition 2).
  *
  * CONSERVATIVE hand-set value (0.15): well below the strong-match band real
- * embeddings produce for genuinely relevant memories, and below bootstrap's
- * own long-standing task-relevance floor (0.3, resources/MemoryBootstrap.ts's
- * TASK_RELEVANCE_FLOOR) — so abstention fires only when there is essentially
- * nothing semantically near the query, erring toward returning results rather
- * than over-abstaining. Promoting abstention to the DEFAULT recall mode, and
+ * embeddings produce for genuinely relevant memories (and below anything the
+ * flair#1246 measurement observed on the shipped model — 126 records across 6
+ * synthetic variants all scored ≥ ~0.44) — so abstention fires only when
+ * there is essentially nothing semantically near the query, erring toward
+ * returning results rather than over-abstaining. (Bootstrap's own
+ * TASK_RELEVANCE_FLOOR, which this comment once referenced, was removed by
+ * flair#1246 — that same measurement proved it inert.) Promoting abstention to the DEFAULT recall mode, and
  * tuning this value on the recall-bench corpus, is a SEPARATE follow-up (see
  * flair#744) — this slice ships the response shape at a safe opt-in floor, not
  * the calibrated default.
@@ -100,10 +102,11 @@ export const STRONG_BAND = 0.55;
  * Reads ONLY the `_semSimilarity` number the retrieval core
  * (resources/semantic-retrieval-core.ts) attaches to each semantic-leg result
  * WHEN abstention is requested — an absolute cosine similarity in [0,1],
- * independent of the RRF normalization that makes the ranking `_score`
- * a *relative* signal (the top RRF-fused result is normalized to 1.0 regardless
- * of how weak the actual match is, so `_score` is unusable as a confidence
- * floor — this is why abstention reads the absolute similarity instead).
+ * independent of the RRF fusion that orders hybrid results. (Historically the
+ * hybrid `_score` was itself RRF rank-normalized — top result pinned at 1.0
+ * however weak the match — which is why this reads the dedicated absolute
+ * field; since flair#985 the raw `_score` is absolute too, and
+ * `_semSimilarity` stays the explicit opt-in confidence channel.)
  *
  * Returns null when NO candidate carries a `_semSimilarity` (no embedding-based
  * match at all — e.g. a keyword-only degraded search, or an empty pool). Per

package/dist/resources/auth-middleware.js

@@ -4,6 +4,7 @@ import { getEmbedding } from "./embeddings-provider.js";
 import { isAdmin, isPrincipalDeactivated, FLAIR_AGENT_USERNAME } from "./agent-auth.js";
 import { WINDOW_MS, isNonceReplay, recordNonce, importEd25519Key, b64ToArrayBuffer, parseTpsEd25519Header } from "./ed25519-auth.js";
 import { resolveReadScope } from "./memory-read-scope.js";
+import { NOT_FOUND } from "./record-type-kit.js";
 import { isForbiddenOwnerMutation, resolveGuardedRecord } from "./record-owner-guard.js";
 import { checkHttpRateLimit } from "./rate-limit.js";
 // --- Admin credentials ---
@@ -638,11 +639,18 @@ server.http(async (request, nextLayer) => {
                         // used to be a `visibility === "office"` bypass (any authenticated
                         // agent, no grant needed) — that's gone; the private-exclusion is
                         // now enforced the same way every other read path enforces it.
+                        //
+                        // Denial is the SAME 404 the resource layer returns (flair#1264):
+                        // Memory.get() deliberately answers NOT_FOUND for a cross-agent
+                        // private id so a denied caller can't distinguish "doesn't exist"
+                        // from "exists but not yours" — a 403 here, worse yet one naming
+                        // the owning agent, confirmed the id exists AND disclosed its
+                        // owner, defeating that anti-enumeration contract one layer up.
+                        // Reuses record-type-kit's NOT_FOUND so the two layers cannot
+                        // drift apart in shape.
                         const scope = await resolveReadScope(agentId);
                         if (!scope.isAllowed(record)) {
-                            return new Response(JSON.stringify({
-                                error: `forbidden: cannot read memory owned by ${record.agentId}`,
-                            }), { status: 403, headers: { "Content-Type": "application/json" } });
+                            return NOT_FOUND();
                         }
                     }
                 }

package/dist/resources/bm25.js

@@ -107,9 +107,13 @@ export function rrfScores(rankings, universe) {
     return score;
 }
 // Fuse semantic + BM25 candidate id-lists via candidate-union RRF and return a
-// per-id score normalized to [0,1] (rrf / max_rrf_in_union). This normalized
-// value is the rawScore fed to compositeScore so durability/recency/rBoost and
-// the RBOOST_RELEVANCE_FLOOR / minScore thresholds still apply unchanged.
+// per-id score normalized to [0,1] (rrf / max_rrf_in_union). The top-ranked id
+// is pinned at exactly 1.0 BY CONSTRUCTION — this is a RANKING value, not a
+// similarity, and must never be reported as one (flair#985: reporting it as
+// `_score` made every stale flair-client dedup gate see a ≥0.95 "similarity"
+// on EVERY store and silently drop the write). semantic-retrieval-core.ts uses
+// it to ORDER hybrid results (and as compositeScore's ranking input); the
+// reported raw `_score` is the absolute cosine, computed separately.
 //
 //   semIds  — semantic candidate ids, best-first (from the HNSW pass).
 //   bm25Ids — BM25 candidate ids, best-first, already sliced to SEM_LIMIT and

package/dist/resources/mcp-oauth-flag.js

@@ -28,6 +28,26 @@
  *
  * Read from `FLAIR_MCP_OAUTH` — truthy values: "1", "true", "yes", "on"
  * (case-insensitive). Anything else (incl. unset / empty) → OFF.
+ *
+ * ASYMMETRY (load-bearing, flair#1152, measured on oauth 2.5.0): config.yaml's
+ * `mcp.enabled: ${FLAIR_MCP_OAUTH}` hands the SAME env var to
+ * @harperfast/oauth, but the two readers accept DIFFERENT vocabularies. The
+ * component's coerceConfigBoolean takes ONLY "true"/"false" and DELETES any
+ * other string (unresolved placeholder, "1", "yes", garbage) so its disabled
+ * default applies; this function takes 1/true/yes/on. Consequences:
+ *   - "true" is the ONE value that enables both sides (`flair mcp enable`
+ *     stages exactly that).
+ *   - "1"/"yes"/"on" turn flair's /mcp handler ON while the component AS
+ *     stays OFF — fail-closed broken-on (every request 401s, no AS
+ *     advertised).
+ *   - garbage (e.g. "maybe") disables BOTH: the component deletes it, this
+ *     stays false, no /mcp handler exists — no data path (flair's own
+ *     discovery documents still serve whenever this flag is off, by design).
+ * If the component's vocabulary ever widens back to truthy-string, a garbage
+ * value would mount a live AS next to an unregistered /mcp — re-derive the
+ * garbage case (test/integration/mcp-oauth-boot-safety.test.ts) before
+ * relying on it, and NEVER let component `enabled` drive flair's handler
+ * registration directly without re-deriving that table.
  */
 export function mcpOAuthEnabled() {
     const raw = (process.env.FLAIR_MCP_OAUTH ?? "").trim().toLowerCase();

package/dist/resources/mcp-oauth.js

@@ -123,7 +123,12 @@ export async function registerMcpOAuthRoute(deps = {}) {
         return decide({
             mounted: false,
             status: "Not enabled",
-            reason: "Set FLAIR_MCP_OAUTH=1 (and an issuer) to serve MCP over HTTP.",
+            // "true" not "1": flair's flag accepts either, but the component's
+            // config-side read of the same var (config.yaml `mcp.enabled:
+            // ${FLAIR_MCP_OAUTH}`, flair#1152) accepts ONLY "true"/"false" — with
+            // "1" the /mcp route registers and every request 401s against a
+            // component that never mounted its AS.
+            reason: "Set FLAIR_MCP_OAUTH=true (and an issuer) to serve MCP over HTTP.",
         });
     }
     // Boot guard (flair#1021): fail loudly if the operator enabled the flag but