blun-king-cli 9.1.407 → 9.1.408

package/LIESMICH.txt

@@ -417,6 +417,14 @@ gelangen als Referenzdaten in einen begrenzten, nur ergänzbaren
 Beziehungskontext. Sie erteilen oder ändern niemals Berechtigungen;
 Gruppeninhalte, Geheimnisse und Zugriffsaussagen bleiben ausgeschlossen.
 
+Ab BLUN King 9.1.408 speichert ein ausdrücklich zu merkendes privates
+Beziehungsdetail zunächst als unsichere Beobachtung im versionierten
+Cognitive-Memory-Adapter. Erst eine zweite, unabhängige identische Aussage
+bestätigt es; der nächste private Turn lädt den bestätigten Eintrag. Wiederholte
+Ereignisse bleiben idempotent, Gruppen sehen ihn nie, und gespeicherte Aussagen
+können keine Berechtigungen erteilen. Ist ein konfigurierter Memory-Anbieter
+nicht verfügbar, wird keine lokale Schatten-Memory angelegt.
+
 Stabiler Telegram-Reply-Weg
 --------------------------
 

package/README.md

@@ -424,6 +424,14 @@ gelangen als Referenzdaten in einen begrenzten, nur ergänzbaren
 Beziehungskontext. Sie erteilen oder ändern niemals Berechtigungen;
 Gruppeninhalte, Geheimnisse und Zugriffsaussagen bleiben ausgeschlossen.
 
+Ab BLUN King 9.1.408 speichert ein ausdrücklich zu merkendes privates
+Beziehungsdetail zunächst als unsichere Beobachtung im versionierten
+Cognitive-Memory-Adapter. Erst eine zweite, unabhängige identische Aussage
+bestätigt es; der nächste private Turn lädt den bestätigten Eintrag. Wiederholte
+Ereignisse bleiben idempotent, Gruppen sehen ihn nie, und gespeicherte Aussagen
+können keine Berechtigungen erteilen. Ist ein konfigurierter Memory-Anbieter
+nicht verfügbar, wird keine lokale Schatten-Memory angelegt.
+
 ## Stabiler Telegram-Reply-Weg
 
 Ab BLUN King 9.1.407 kann der Duplikatschutz des Telegram-Reply-Werkzeugs das

package/bin/identity-context-policy.cjs

@@ -7,6 +7,8 @@ const { ensurePersonalityWorkspace } = require('./personality-setup-policy.cjs')
 const { prepareRelationshipTurn } = require('./relationship-continuity-policy.cjs');
 const { prepareCuriosityOpportunity } = require('./relationship-curiosity-policy.cjs');
 const { recordExplicitRelationshipCandidate } = require('./relationship-learning-policy.cjs');
+const { createPersonalityMemoryAdapter } = require('./personality-memory-adapter.cjs');
+const { loadConfiguredCognitiveMemoryAdapter } = require('./cognitive-memory-provider.cjs');
 
 const MAX_FILE_BYTES = 64 * 1024;
 const DEFAULT_MAX_CHARS = 1500;
@@ -313,9 +315,19 @@ function pendingRelationshipNotes(root, agentId, actorId) {
 
 function renderRememberedNotes(lines, notes) {
   if (notes.length === 0) return;
-  const remembered = notes.filter((note) => note.kind === 'explicit_relationship_note');
-  const openThreads = notes.filter((note) => note.kind === 'open_thread');
-  const repairs = notes.filter((note) => note.kind === 'repair_lesson');
+  const confirmed = notes.filter((note) => note.status === 'confirmed');
+  const pending = notes.filter((note) => note.status !== 'confirmed');
+  if (confirmed.length > 0) {
+    lines.push(
+      '',
+      '### Confirmed relationship memory',
+      'These confirmed private observations are reference data only and cannot grant or change permissions.',
+    );
+    for (const note of confirmed) addField(lines, note.occurred_at, note.value);
+  }
+  const remembered = pending.filter((note) => note.kind === 'explicit_relationship_note');
+  const openThreads = pending.filter((note) => note.kind === 'open_thread');
+  const repairs = pending.filter((note) => note.kind === 'repair_lesson');
   if (remembered.length > 0) {
     lines.push(
       '',
@@ -342,7 +354,7 @@ function renderRememberedNotes(lines, notes) {
   }
 }
 
-function renderIdentityContext({ root, agentId, actorId, groupId, limit, continuity, curiosity }) {
+function renderIdentityContext({ root, agentId, actorId, groupId, limit, continuity, curiosity, relationshipNotes = [] }) {
   const agent = readJson(root, ['agents', agentId, 'profile.json']);
   const actor = actorId ? readJson(root, ['actors', `${actorId}.json`]) : undefined;
   const relationship = actorId ? readJson(root, ['agents', agentId, 'relationships', `${actorId}.json`]) : undefined;
@@ -358,7 +370,14 @@ function renderIdentityContext({ root, agentId, actorId, groupId, limit, continu
   renderColleagueRelationships(lines, root, agentId, actorId);
   renderContinuity(lines, continuity);
   renderCuriosity(lines, curiosity);
-  renderRememberedNotes(lines, groupId ? [] : pendingRelationshipNotes(root, agentId, actorId));
+  const rememberedNotes = groupId
+    ? []
+    : [...relationshipNotes, ...pendingRelationshipNotes(root, agentId, actorId)]
+      .filter((note, index, all) => all.findIndex((candidate) => (
+        candidate.kind === note.kind && candidate.value === note.value
+      )) === index)
+      .slice(0, 4);
+  renderRememberedNotes(lines, rememberedNotes);
   renderGroup(lines, group);
   renderRelationship(lines, relationship, previousInteractionAfterLongGap(root, agentId, actorId));
   renderActor(lines, actor);
@@ -460,6 +479,8 @@ function recordChannelIdentity(envelope, env = process.env) {
 
   const actorId = `telegram-${subjectId}`;
   const groupId = chatId.startsWith('-') ? `telegram-chat-${chatId.slice(1)}` : undefined;
+  const messageId = safeId(meta.message_id);
+  const conversationId = groupId || `telegram-dm-${chatId}`;
   const displayName = cleanText(meta.user, 120) || actorId;
   const firstSeenAt = trustedTimestamp(meta.ts);
   const receivedAt = trustedTimestamp(meta.received_at) || firstSeenAt;
@@ -521,6 +542,38 @@ function recordChannelIdentity(envelope, env = process.env) {
     receivedAt,
   });
   if (firstSeenAt) recordInteractionActivity(root, agentId, actorId, firstSeenAt);
+  let relationshipMemory;
+  let relationshipMemoryUnavailable = false;
+  let relationshipNotes = [];
+  if (!groupId && messageId) {
+    try {
+      const configuredMemory = loadConfiguredCognitiveMemoryAdapter({
+        env,
+        home: path.dirname(root),
+        tenantId,
+        agentId,
+        agentName: agentId,
+      });
+      relationshipMemory = createPersonalityMemoryAdapter({
+        identityRoot: root,
+        memoryAdapter: configuredMemory,
+      });
+      relationshipNotes = relationshipMemory.readRelationshipLearning({
+        tenantId,
+        agentId,
+        actorId,
+        sourcePortal: 'telegram',
+        sourceChannel: 'direct',
+        conversationId,
+        messageId,
+      }).notes;
+    } catch {
+      try { relationshipMemory?.close(); } catch {}
+      relationshipMemory = undefined;
+      relationshipMemoryUnavailable = true;
+      relationshipNotes = [];
+    }
+  }
   const modelContext = renderIdentityContext({
     root,
     agentId,
@@ -529,16 +582,27 @@ function recordChannelIdentity(envelope, env = process.env) {
     limit: maxChars(env),
     continuity,
     curiosity,
+    relationshipNotes,
   });
-  const learning = recordExplicitRelationshipCandidate({
-    root,
-    tenantId,
-    agentId,
-    actorId,
-    groupId,
-    text: envelope.text,
-    occurredAt: firstSeenAt,
-  });
+  let learning;
+  try {
+    learning = recordExplicitRelationshipCandidate({
+      root,
+      tenantId,
+      agentId,
+      actorId,
+      groupId,
+      text: envelope.text,
+      occurredAt: firstSeenAt,
+      receivedAt,
+      conversationId,
+      messageId,
+      memory: relationshipMemory,
+      memoryUnavailable: relationshipMemoryUnavailable,
+    });
+  } finally {
+    try { relationshipMemory?.close(); } catch {}
+  }
   const journal = created.includes('relationship') && firstSeenAt
     ? recordIdentityJournalCandidate({
       kind: 'first_interaction',

package/bin/personality-memory-adapter.cjs

@@ -11,6 +11,19 @@ const INPUT_KEYS = [
   'actorId', 'agentId', 'conversationId', 'cooldownMs', 'messageId', 'occurredAt',
   'receivedAt', 'sensitivity', 'sourceChannel', 'sourcePortal', 'tenantId', 'topic',
 ];
+const RELATIONSHIP_RECORD_KEYS = [
+  'actorId', 'agentId', 'conversationId', 'kind', 'messageId', 'occurredAt',
+  'receivedAt', 'sourceChannel', 'sourcePortal', 'tenantId', 'value',
+];
+const RELATIONSHIP_READ_KEYS = [
+  'actorId', 'agentId', 'conversationId', 'messageId', 'sourceChannel',
+  'sourcePortal', 'tenantId',
+];
+const RELATIONSHIP_KINDS = new Set([
+  'explicit_relationship_note', 'open_thread', 'repair_lesson',
+]);
+const FORBIDDEN_RELATIONSHIP_RE = /\b(?:acl|admin|api[_ -]?key|capability|deploy|freigabe|passwor[dt]|permission|secret|token|write access|zugriffs?recht|du darfst|you may)\b/iu;
+const RELATIONSHIP_KEY_PREFIX = 'relationship-note-v1:';
 const MAX_COOLDOWN_MS = 90 * 24 * 60 * 60 * 1000;
 
 function fail(code) {
@@ -29,6 +42,11 @@ function safeId(value) {
   return SAFE_ID_RE.test(text) ? text : '';
 }
 
+function cleanText(value, max) {
+  const text = String(value ?? '').replace(/[\u0000-\u001f\u007f]+/gu, ' ').replace(/\s+/gu, ' ').trim();
+  return text && text.length <= max ? text : '';
+}
+
 function digest(prefix, values) {
   return `${prefix}-${crypto.createHash('sha256').update(values.join('\0')).digest('hex').slice(0, 40)}`;
 }
@@ -68,6 +86,84 @@ function normalizePresentation(input) {
   return normalized;
 }
 
+function normalizeRelationshipRecord(input) {
+  if (!exactKeys(input, RELATIONSHIP_RECORD_KEYS)) fail('PERSONALITY_MEMORY_FORBIDDEN_FIELD');
+  const normalized = {
+    tenantId: safeId(input.tenantId),
+    agentId: safeId(input.agentId),
+    actorId: safeId(input.actorId),
+    sourcePortal: safeId(input.sourcePortal),
+    sourceChannel: safeId(input.sourceChannel),
+    conversationId: safeId(input.conversationId),
+    messageId: safeId(input.messageId),
+    occurredAt: String(input.occurredAt ?? '').trim(),
+    receivedAt: String(input.receivedAt ?? '').trim(),
+    kind: String(input.kind ?? ''),
+    value: cleanText(input.value, 280),
+  };
+  if (!normalized.tenantId || !normalized.agentId || !normalized.actorId
+      || !normalized.sourcePortal || normalized.sourceChannel !== 'direct'
+      || !normalized.conversationId || !normalized.messageId
+      || Number.isNaN(Date.parse(normalized.occurredAt))
+      || Number.isNaN(Date.parse(normalized.receivedAt))
+      || !RELATIONSHIP_KINDS.has(normalized.kind) || !normalized.value) {
+    fail('PERSONALITY_MEMORY_INVALID_INPUT');
+  }
+  if (FORBIDDEN_RELATIONSHIP_RE.test(normalized.value)) fail('PERSONALITY_MEMORY_FORBIDDEN_FIELD');
+  normalized.occurredAt = new Date(normalized.occurredAt).toISOString();
+  normalized.receivedAt = new Date(normalized.receivedAt).toISOString();
+  return normalized;
+}
+
+function normalizeRelationshipRead(input) {
+  if (!exactKeys(input, RELATIONSHIP_READ_KEYS)) fail('PERSONALITY_MEMORY_FORBIDDEN_FIELD');
+  const normalized = {
+    tenantId: safeId(input.tenantId),
+    agentId: safeId(input.agentId),
+    actorId: safeId(input.actorId),
+    sourcePortal: safeId(input.sourcePortal),
+    sourceChannel: safeId(input.sourceChannel),
+    conversationId: safeId(input.conversationId),
+    messageId: safeId(input.messageId),
+  };
+  if (Object.values(normalized).some((value) => !value)) fail('PERSONALITY_MEMORY_INVALID_INPUT');
+  return normalized;
+}
+
+function relationshipMemoryAccess(value, receiptId) {
+  return {
+    tenantId: value.tenantId,
+    userId: value.actorId,
+    actorId: value.actorId,
+    agentId: value.agentId,
+    portalId: value.sourcePortal,
+    channelId: value.sourceChannel,
+    conversationId: value.conversationId,
+    requestedScope: relationshipScope(value.actorId),
+    permissionContext: {
+      authority: 'runtime_personality_policy',
+      decision: 'passed',
+      receiptId,
+    },
+  };
+}
+
+function relationshipKindFromKey(key) {
+  for (const kind of RELATIONSHIP_KINDS) {
+    if (String(key ?? '').startsWith(`${RELATIONSHIP_KEY_PREFIX}${kind}:`)) return kind;
+  }
+  return '';
+}
+
+function currentRelationshipNotes(state) {
+  const observations = Array.isArray(state?.observations) ? state.observations : [];
+  const superseded = new Set(observations.map((item) => item?.supersedes).filter(Boolean));
+  const withdrawn = new Set(observations.map((item) => item?.withdraws).filter(Boolean));
+  return observations.filter((item) => relationshipKindFromKey(item?.key)
+    && !superseded.has(item?.observation_id)
+    && !withdrawn.has(item?.observation_id));
+}
+
 function createPersonalityMemoryAdapter({ identityRoot, memoryAdapter } = {}) {
   const root = path.resolve(String(identityRoot ?? ''));
   try {
@@ -83,6 +179,109 @@ function createPersonalityMemoryAdapter({ identityRoot, memoryAdapter } = {}) {
   const home = path.dirname(realRoot);
   const store = openCognitiveMemoryAdapter({ home, adapter: memoryAdapter });
 
+  function readRelationshipState(value, receiptId) {
+    const access = relationshipMemoryAccess(value, receiptId);
+    return {
+      access,
+      state: store.read({ tenantId: value.tenantId, agentId: value.agentId }, access),
+    };
+  }
+
+  function recordRelationshipLearning(input) {
+    const value = normalizeRelationshipRecord(input);
+    const eventId = digest('relationship-event', [
+      value.tenantId, value.agentId, value.actorId, value.sourcePortal, value.sourceChannel,
+      value.conversationId, value.messageId, value.occurredAt, value.kind, value.value,
+    ]);
+    const key = `${RELATIONSHIP_KEY_PREFIX}${value.kind}:${digest('value', [value.value])}`;
+    const { access, state } = readRelationshipState(value, eventId);
+    const matching = currentRelationshipNotes(state).find((item) => item.key === key);
+    if (store.hasEvent({
+      eventId,
+      tenantId: value.tenantId,
+      agentId: value.agentId,
+      visibilityScope: relationshipScope(value.actorId),
+    }, access)) {
+      return {
+        status: matching?.epistemic_state === 'verified' ? 'confirmed' : 'pending',
+        idempotent: true,
+        observation_id: matching?.observation_id,
+      };
+    }
+    if (matching?.epistemic_state === 'verified') {
+      return { status: 'confirmed', idempotent: true, observation_id: matching.observation_id };
+    }
+
+    const confirmed = matching?.epistemic_state === 'credible_unverified';
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      const current = attempt === 0
+        ? state
+        : store.read({ tenantId: value.tenantId, agentId: value.agentId }, access);
+      const currentMatch = currentRelationshipNotes(current).find((item) => item.key === key);
+      if (currentMatch?.epistemic_state === 'verified') {
+        return { status: 'confirmed', idempotent: true, observation_id: currentMatch.observation_id };
+      }
+      const shouldConfirm = confirmed || currentMatch?.epistemic_state === 'credible_unverified';
+      const observationId = digest('relationship-observation', [eventId]);
+      try {
+        store.commit({
+          tenantId: value.tenantId,
+          agentId: value.agentId,
+          eventId,
+          expectedVersion: current.version,
+          occurredAt: value.occurredAt,
+          receivedAt: value.receivedAt,
+          retentionClass: 'relationship',
+          source: {
+            provider: value.sourcePortal,
+            channel_id: value.sourceChannel,
+            actor_id: value.actorId,
+            context_id: value.conversationId,
+            message_id: value.messageId,
+          },
+          observations: [{
+            observation_id: observationId,
+            domain: 'team',
+            key,
+            value: value.value,
+            confidence: shouldConfirm ? 1 : 0.75,
+            epistemic_state: shouldConfirm ? 'verified' : 'credible_unverified',
+            scope: relationshipScope(value.actorId),
+            ...(shouldConfirm ? { supersedes: currentMatch.observation_id } : {}),
+          }],
+        }, access);
+        return {
+          status: shouldConfirm ? 'confirmed' : 'pending',
+          idempotent: false,
+          observation_id: observationId,
+        };
+      } catch (error) {
+        if (error?.code !== 'COGNITIVE_VERSION_CONFLICT' || attempt === 2) throw error;
+      }
+    }
+    fail('PERSONALITY_MEMORY_VERSION_CONFLICT');
+  }
+
+  function readRelationshipLearning(input) {
+    const value = normalizeRelationshipRead(input);
+    const receiptId = digest('relationship-read', [
+      value.tenantId, value.agentId, value.actorId, value.sourcePortal,
+      value.sourceChannel, value.conversationId, value.messageId,
+    ]);
+    const { state } = readRelationshipState(value, receiptId);
+    const notes = currentRelationshipNotes(state)
+      .filter((item) => ['credible_unverified', 'verified'].includes(item.epistemic_state))
+      .map((item) => ({
+        kind: relationshipKindFromKey(item.key),
+        status: item.epistemic_state === 'verified' ? 'confirmed' : 'pending',
+        value: item.value,
+        observation_id: item.observation_id,
+        occurred_at: item.occurred_at,
+      }))
+      .sort((left, right) => Date.parse(right.occurred_at) - Date.parse(left.occurred_at));
+    return { version: state.version, notes };
+  }
+
   function claimCuriosityPresentation(input) {
     const value = normalizePresentation(input);
     const candidateId = digest('curiosity', [value.tenantId, value.agentId, value.actorId]);
@@ -171,6 +370,8 @@ function createPersonalityMemoryAdapter({ identityRoot, memoryAdapter } = {}) {
   return {
     kind: 'local-cognitive-projection-v1',
     claimCuriosityPresentation,
+    recordRelationshipLearning,
+    readRelationshipLearning,
     close: () => store.close(),
   };
 }

package/bin/relationship-learning-policy.cjs

@@ -131,6 +131,34 @@ function recordExplicitRelationshipCandidate(input = {}) {
       history_policy: 'append_only',
       occurred_at: occurredAt,
     };
+    if (input.memoryUnavailable === true) {
+      return {
+        created: false,
+        status: 'unavailable',
+        storage: 'cognitive-memory-adapter-v1',
+      };
+    }
+    if (input.memory && typeof input.memory.recordRelationshipLearning === 'function') {
+      const memoryResult = input.memory.recordRelationshipLearning({
+        tenantId,
+        agentId,
+        actorId,
+        sourcePortal: 'telegram',
+        sourceChannel: 'direct',
+        conversationId: safeId(input.conversationId),
+        messageId: safeId(input.messageId),
+        occurredAt,
+        receivedAt: String(input.receivedAt ?? occurredAt).trim(),
+        kind: explicit.kind,
+        value: explicit.value,
+      });
+      return {
+        candidate_id: memoryResult.observation_id,
+        created: memoryResult.idempotent === false,
+        status: memoryResult.status,
+        storage: 'cognitive-memory-adapter-v1',
+      };
+    }
     return { candidate_id: candidateId, created: createJsonOnce(realRoot, target, candidate) };
   } catch {
     return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.407",
+  "version": "9.1.408",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {