hippo-memory 1.49.0 → 1.51.0

package/dist/search.js

@@ -3,7 +3,7 @@
  * Zero external dependencies when embeddings are not available.
  */
 import { estimateTokens } from './token-ledger.js';
-import { calculateStrength, netWrong } from './memory.js';
+import { calculateStrength, netWrong, CHURN_STALE_TAG } from './memory.js';
 import { isOutcomeFastAblated, isRecallBoostAblated, isRecencyAblated, evalRecencyScaleDays, evalNow } from './ablation.js';
 import { extractPathTags, pathBoostMultiplier } from './path-context.js';
 import { detectScope, scopeMatch } from './scope.js';
@@ -16,6 +16,10 @@ import { openHippoDb, closeHippoDb } from './db.js';
 import { rrfFuse } from './rrf.js';
 import { graphRankStream, selectGraphSeeds, DEFAULT_GRAPH_SEED_COUNT } from './graph-stream.js';
 import { compareEntryIdentity, compareScoredResults } from './compare.js';
+export const CHURN_STALE_RANK_MULTIPLIER = 0.5; // SHORTCUT: untuned; FE3 measures before any default.
+export function churnStaleFactor(entry) {
+    return entry.tags.includes(CHURN_STALE_TAG) ? CHURN_STALE_RANK_MULTIPLIER : 1.0;
+}
 // ---------------------------------------------------------------------------
 // Tokenizer
 // ---------------------------------------------------------------------------
@@ -368,6 +372,8 @@ export async function hybridSearch(query, entries, options = {}) {
         // Decision-tagged memories get a 1.2x recall boost
         const decisionBoost = entries[i].tags.includes('decision') ? 1.2 : 1.0;
         compositeScore *= decisionBoost;
+        const churnStaleMultiplier = churnStaleFactor(entries[i]);
+        compositeScore *= churnStaleMultiplier;
         // Path-based boost: memories tagged with matching path segments get up to 1.3x
         const pathBoost = pathBoostMultiplier(entries[i].tags, currentPathTags);
         compositeScore *= pathBoost;
@@ -424,6 +430,7 @@ export async function hybridSearch(query, entries, options = {}) {
                 scopeBoost,
                 sourceBump: 1,
                 outcomeBoost,
+                churnStaleMultiplier,
                 matchedTerms,
                 final: compositeScore,
                 ageDays,
@@ -476,7 +483,7 @@ export async function hybridSearch(query, entries, options = {}) {
         for (const child of childEntriesAsync) {
             if (!scoredDeduped.some((r) => r.entry.id === child.id)) {
                 const parentResult = scoredDeduped.find((r) => r.entry.id === child.dag_parent_id);
-                const childScore = parentResult ? parentResult.score * 0.9 : 0;
+                const childScore = parentResult ? parentResult.score * 0.9 * churnStaleFactor(child) : 0;
                 scoredDeduped.push({
                     entry: child,
                     score: childScore,
@@ -700,7 +707,8 @@ export async function physicsSearch(query, entries, options = {}) {
                     freshnessMultiplier = summaryFreshnessMultiplier(entry, now);
                 }
             }
-            const finalScore = s.finalScore * summaryDeboostMultiplier * freshnessMultiplier;
+            const churnStaleMultiplier = churnStaleFactor(entry);
+            const finalScore = s.finalScore * summaryDeboostMultiplier * freshnessMultiplier * churnStaleMultiplier;
             if (finalScore <= 0)
                 continue;
             const result = {
@@ -726,6 +734,7 @@ export async function physicsSearch(query, entries, options = {}) {
                     scopeBoost: 1,
                     sourceBump: 1,
                     outcomeBoost: 1,
+                    churnStaleMultiplier,
                     matchedTerms: [],
                     final: finalScore,
                     ageDays,
@@ -768,8 +777,9 @@ export async function physicsSearch(query, entries, options = {}) {
 }
 /** Normalize two score pools to [0,1] and combine. */
 function mergeScorePools(poolA, poolB) {
-    const maxA = poolA.reduce((m, r) => Math.max(m, r.score), 1e-9);
-    const maxB = poolB.reduce((m, r) => Math.max(m, r.score), 1e-9);
+    const unpenalised = (r) => r.score / churnStaleFactor(r.entry);
+    const maxA = poolA.reduce((m, r) => Math.max(m, unpenalised(r)), 1e-9);
+    const maxB = poolB.reduce((m, r) => Math.max(m, unpenalised(r)), 1e-9);
     const merged = [];
     for (const r of poolA) {
         merged.push({ ...r, score: r.score / maxA });
@@ -842,6 +852,7 @@ export function search(query, entries, options = {}) {
         // Decision-tagged memories get a 1.2x recall boost
         const decisionBoost = entries[i].tags.includes('decision') ? 1.2 : 1.0;
         composite *= decisionBoost;
+        composite *= churnStaleFactor(entries[i]);
         // Path-based boost: memories tagged with matching path segments get up to 1.3x
         composite *= pathBoostMultiplier(entries[i].tags, currentPathTagsSync);
         // Scope boost (sync path)
@@ -883,7 +894,7 @@ export function search(query, entries, options = {}) {
         for (const child of childEntries) {
             if (!dedupedSync.some((r) => r.entry.id === child.id)) {
                 const parentResult = dedupedSync.find((r) => r.entry.id === child.dag_parent_id);
-                const childScore = parentResult ? parentResult.score * 0.9 : 0;
+                const childScore = parentResult ? parentResult.score * 0.9 * churnStaleFactor(child) : 0;
                 dedupedSync.push({
                     entry: child,
                     score: childScore,

package/dist/server.js

@@ -22,7 +22,7 @@ export function __resetSessionRecallHistoryHttp() {
 import { PACKAGE_VERSION } from './version.js';
 import { validateApiKey } from './auth.js';
 import { createRateLimiter } from './rate-limit.js';
-import { remember, retrieve, RecallContractError, ForbiddenError, drillDown, assemble, forget, promote, supersede, archiveRaw, authCreate, authList, authRevoke, auditList, outcome, outcomeForLastRecall, getContext, sleep, adminActor, recordTokens, } from './api.js';
+import { remember, retrieve, RecallContractError, ForbiddenError, drillDown, assemble, forget, promote, supersede, archiveRaw, authCreate, authList, authRevoke, auditList, outcome, outcomeForLastRecall, getContext, sleep, adminActor, recordTokens, quarantineList, quarantineApprove, quarantineReject, } from './api.js';
 import { buildGraphModel } from './graph-view.js';
 import { MAX_ENTITY_NAME_LEN } from './graph.js';
 import { savePrediction, closePrediction, loadPredictionById, loadPredictionsByClass, loadOpenPredictions, computePredictionBaserate, VALID_CLOSURE_STATES, } from './predictions.js';
@@ -118,6 +118,9 @@ const VALID_AUDIT_OPS = new Set([
     'dormant_restore', // Dormant memories — emitted by api.restoreDormant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
     'auth_grant', // EI2: emitted by api.authGrant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
     'auth_ungrant', // EI2: emitted by api.authUngrant; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
+    'quarantine', // CD5: emitted by recordQuarantine; lockstep with AuditOp union + cli.ts VALID_AUDIT_OPS
+    'quarantine_approve', // CD5: emitted by api.quarantineApprove; lockstep
+    'quarantine_reject', // CD5: emitted by api.quarantineReject; lockstep
 ]);
 // Cap on GET /v1/audit?limit=. Matches docs/api.md (when written) and is large
 // enough to dump a small deployment's full audit log without paginating, but
@@ -1163,6 +1166,61 @@ async function handleRequest(req, res, opts, startedAt, limiter) {
         sendJson(res, 200, result);
         return;
     }
+    // GET /v1/quarantine?status=: CD5 review queue. quarantineList carries no role gate itself, so it's checked here.
+    if (method === 'GET' && path === '/v1/quarantine') {
+        const ctx = buildContextWithAuth(req, opts.hippoRoot);
+        if (ctx.actor.role !== 'admin') {
+            throw new HttpError(403, '/v1/quarantine requires admin role');
+        }
+        const statusRaw = query.get('status');
+        let status = 'pending';
+        if (statusRaw !== null) {
+            if (statusRaw !== 'pending' && statusRaw !== 'approved' && statusRaw !== 'rejected' && statusRaw !== 'all') {
+                throw new HttpError(400, 'status must be one of: pending | approved | rejected | all');
+            }
+            status = statusRaw;
+        }
+        sendJson(res, 200, { quarantine: quarantineList(ctx, { status }) });
+        return;
+    }
+    // POST /v1/quarantine/:id/approve: admin only; ForbiddenError falls through to mapApiError's 403.
+    const quarantineApproveMatch = matchPath('/v1/quarantine/:id/approve', path);
+    if (method === 'POST' && quarantineApproveMatch) {
+        validateIdSegment(quarantineApproveMatch.id, 'memory id');
+        const ctx = buildContextWithAuth(req, opts.hippoRoot);
+        try {
+            quarantineApprove(ctx, quarantineApproveMatch.id);
+            sendJson(res, 200, { approved: quarantineApproveMatch.id });
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            if (msg.includes('not quarantined'))
+                throw new HttpError(404, msg);
+            if (msg.includes('is already') || msg.includes('scope changed'))
+                throw new HttpError(409, msg);
+            throw e;
+        }
+        return;
+    }
+    // POST /v1/quarantine/:id/reject: admin only; ForbiddenError falls through to mapApiError's 403.
+    const quarantineRejectMatch = matchPath('/v1/quarantine/:id/reject', path);
+    if (method === 'POST' && quarantineRejectMatch) {
+        validateIdSegment(quarantineRejectMatch.id, 'memory id');
+        const ctx = buildContextWithAuth(req, opts.hippoRoot);
+        try {
+            quarantineReject(ctx, quarantineRejectMatch.id);
+            sendJson(res, 200, { rejected: quarantineRejectMatch.id });
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            if (msg.includes('not quarantined'))
+                throw new HttpError(404, msg);
+            if (msg.includes('is already'))
+                throw new HttpError(409, msg);
+            throw e;
+        }
+        return;
+    }
     // GET /v1/audit?op=&since=&limit= — read audit events. All three filters
     // validated at the route boundary so an invalid value lands a 400 before
     // we hit the DB.

package/dist/shared.js

@@ -13,6 +13,7 @@ import { search, hybridSearch } from './search.js';
 import { evalNow } from './ablation.js';
 import { deriveOriginProject, classifyOriginProject, resolveGlobalRootDir } from './project-identity.js';
 import { detectSecret } from './secret-detect.js';
+import { isQuarantineScope } from './quarantine.js';
 import { RejectedValueError } from './rejection.js';
 import { embedMemory, embedAll } from './embeddings.js';
 /**
@@ -46,6 +47,10 @@ export function promoteToGlobal(localRoot, id, opts) {
     const entry = readEntry(localRoot, id, opts?.tenantId);
     if (!entry)
         throw new Error(`Memory not found: ${id}`);
+    // CD5: same veto as shareMemory; a promoted copy would have no quarantine record to review.
+    if (isQuarantineScope(entry.scope)) {
+        throw new Error(`Refusing to promote ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
+    }
     // v39 S4 producer veto: promote is a producer path to the global store
     // exactly like shareMemory - same hard rule (codex gating review P2).
     const promoteSecret = detectSecret(entry);
@@ -272,6 +277,10 @@ export function shareMemory(localRoot, id, options = {}) {
         throw new Error(`Refusing to share ${id} to the global store: content matches secret material (${secret.reason}). ` +
             `Secrets stay in their owning project's store.`);
     }
+    // CD5: a quarantined row is unreviewed input, not a lesson; sharing it would spread poison globally.
+    if (isQuarantineScope(entry.scope)) {
+        throw new Error(`Refusing to share ${id}: it is quarantined pending review. Approve it first via 'hippo quarantine approve ${id}'.`);
+    }
     const score = transferScore(entry);
     if (score < 0.3 && !options.force)
         return null;
@@ -385,6 +394,9 @@ export function autoShare(localRoot, options = {}) {
     // Build set of global content hashes to avoid duplicates
     const globalContentSet = new Set(globalEntries.map((e) => e.content.toLowerCase().trim().slice(0, 200)));
     const candidates = localEntries.filter((entry) => {
+        // CD5: shareMemory refuses quarantined rows; filtering here keeps sleep from aborting on one.
+        if (isQuarantineScope(entry.scope ?? null))
+            return false;
         const score = transferScore(entry);
         if (score < minScore)
             return false;

package/dist/version.d.ts

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export declare const PACKAGE_VERSION = "1.49.0";
+export declare const PACKAGE_VERSION = "1.51.0";
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export declare function compareSemver(a: string, b: string): number;
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -16,7 +16,7 @@
  * an ESM `import` can resolve cleanly, and a hardcoded constant survives
  * any packager that drops .json files.
  */
-export const PACKAGE_VERSION = '1.49.0';
+export const PACKAGE_VERSION = '1.51.0';
 /** Compares plain x.y.z versions, positive if a > b; tags throw so the rollback guard never misfires silently. */
 export function compareSemver(a, b) {
     const parse = (v) => {

package/extensions/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Biologically-inspired memory for AI agents. Decay by default, retrieval strengthening, sleep consolidation.",
-  "version": "1.49.0",
+  "version": "1.51.0",
 
   "configSchema": {
     "type": "object",

package/extensions/openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.49.0",
+  "version": "1.51.0",
   "type": "module",
   "description": "Hippo Memory plugin for OpenClaw - biologically-inspired agent memory",
   "main": "index.ts",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "hippo-memory",
   "name": "Hippo Memory",
   "description": "Biologically-inspired memory for AI agents. Decay by default, retrieval strengthening, sleep consolidation.",
-  "version": "1.49.0",
+  "version": "1.51.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hippo-memory",
-  "version": "1.49.0",
+  "version": "1.51.0",
   "description": "Biologically-inspired memory for AI agents. Zero runtime deps, SQLite, MCP server, and an opt-in hosted TypeSafe Jev reranker. Decay, retrieval strengthening, consolidation.",
   "mcpName": "io.github.kitfunso/hippo-memory",
   "type": "module",