hippo-memory 1.63.1 → 1.64.0

package/dist/api/context.js

@@ -9,20 +9,23 @@ import { loadFreshActiveTaskSnapshot, listSessionEvents, SNAPSHOT_AMBIENT_MAX_AG
 import { loadLatestHandoff } from '../store/handoffs.js';
 import { estimateTokens } from '../token-ledger.js';
 import { markRetrieved, COMPACTION_MEMORY_TAG } from '../memory.js';
-import { isContentWorthStoring } from '../audit.js';
+import { isWorthSurfacing } from '../memory-quality.js';
 import { getGlobalRoot } from '../shared.js';
 import { writeRecallTraceAtRoot } from '../recall-trace.js';
 import { evalNow, isRecallBoostAblated } from '../ablation.js';
 import { dropHeldCopies } from '../same-text.js';
-import { loadConfig } from '../config.js';
+import { BadRequestError } from '../api-errors.js';
+import { isSharedStore, loadConfig } from '../config.js';
+import { log } from '../log.js';
 import { resolveProjectIdentity, classifyOriginProject, isGlobalStoreRoot, projectId, projectNames } from '../project-identity.js';
 import { promptTokens } from '../prompt-recall.js';
 import { detectSecret } from '../secret-detect.js';
 import { isSessionDigestRow } from '../session-digest.js';
 import { addAmbientTallies, ambientStateFromTallies } from '../ambient.js';
 import { loadAmbientTallies } from '../ambient-store.js';
-import { passesScopeFilterForRecall, assertScopeRequestAllowed } from '../recall-scope.js';
+import { passesScopeFilterForRecall, assertScopeRequestAllowed, personalScopeOf } from '../recall-scope.js';
 import { finiteOr, selectBySearch, selectPinned, selectStrongest, } from './context-select.js';
+import { ownerOrSubject } from './types.js';
 export { oneCopyPerMemory } from './context-select.js';
 /**
  * v39: the single ambient-injection admission policy, shared by getContext
@@ -37,10 +40,10 @@ export { oneCopyPerMemory } from './context-select.js';
  * - Origin partition: other-project rows are excluded unless
  *   `includeCrossProject`.
  */
-function ambientAdmitEntry(e, currentProject, includeCrossProject, exactScope) {
+function ambientAdmitEntry(e, currentProject, includeCrossProject, exactScope, own) {
     if (!ambientSecretAdmit(e, currentProject))
         return false;
-    if (!passesScopeFilterForRecall(e.scope ?? null, exactScope))
+    if (!passesScopeFilterForRecall(e.scope ?? null, exactScope, own))
         return false;
     if (includeCrossProject)
         return true;
@@ -61,11 +64,11 @@ export function ambientSecretAdmit(e, currentProject) {
 }
 /** Most rows per store a no-query context reads; past it, ranking and ambientState see the strongest by decay. */
 export const CONTEXT_CANDIDATE_CAP = 2000;
-// The pinned-only branch needs pins and recent-N candidates, not the corpus; `recall` applies there only.
-function loadAmbientEntries(hippoRoot, tenantId, pinnedOnly, includeRecent, admit, window, recall, onQualityDrop) {
+// The pinned-only branch needs pins and recent-N candidates, not the corpus; `recent` and `recall` apply there only.
+function loadAmbientEntries(hippoRoot, tenantId, pinnedOnly, recent, admit, window, recall, onQualityDrop) {
     if (!pinnedOnly) {
         const rows = 'query' in window
-            ? loadRecallSearchEntries(hippoRoot, window.query, DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, window.exactScope, 'exact', false, window.project)
+            ? loadRecallSearchEntries(hippoRoot, window.query, DEFAULT_SEARCH_CANDIDATE_LIMIT, tenantId, window.exactScope, 'exact', false, window.project, window.ownScope)
             : loadContextCandidates(hippoRoot, tenantId, window);
         return { entries: rows.filter(admit) };
     }
@@ -74,12 +77,12 @@ function loadAmbientEntries(hippoRoot, tenantId, pinnedOnly, includeRecent, admi
     const admitAmbient = (e) => {
         if (!admit(e))
             return false;
-        if (e.pinned || isContentWorthStoring(e.content))
+        if (e.pinned || isWorthSurfacing(e))
             return true;
         onQualityDrop?.(e);
         return false;
     };
-    return loadAmbientCandidates(hippoRoot, tenantId, includeRecent, admitAmbient, recall);
+    return loadAmbientCandidates(hippoRoot, tenantId, recent.needed, admitAmbient, recall, recent.origins);
 }
 /**
  * Assemble a context bundle: recalled memories (pinned-only / strength-sorted
@@ -141,20 +144,36 @@ export async function getContext(ctx, opts = {}) {
         ambientState: recorded.ambientState,
     };
 }
+const isolationWarned = new Set();
+/** A laptop config copied onto a team store must not open every member's rows to every prompt, so the flag loses there. */
+function warnIsolationIgnored(hippoRoot) {
+    if (isolationWarned.has(hippoRoot))
+        return;
+    isolationWarned.add(hippoRoot);
+    log.warn(`${hippoRoot}: "contextProjectIsolation": false is ignored on a shared store; a read opts in with cross_project.`);
+}
 function planContext(ctx, opts) {
     const pinnedOnly = opts.pinnedOnly === true;
     // Global memories do not establish a project boundary for task state.
     const hasLocal = isInitialized(ctx.hippoRoot);
     const query = (opts.q ?? '').trim() || '*';
     const globalRoot = getGlobalRoot();
-    const hasGlobal = isInitialized(globalRoot);
+    // The store's own flag counts too, so no surface can read a shared store as its owner.
+    const sharedStore = opts.sharedStore === true || isSharedStore(ctx.hippoRoot);
+    // A store serving many people is not its operator's, so the operator's own global store stays out.
+    const hasGlobal = !sharedStore && isInitialized(globalRoot);
     const primaryIsGlobal = isGlobalStoreRoot(ctx.hippoRoot);
     // opts.scope is only the tag boost, opts.exactScope the envelope request; other-project memories are
     // excluded unless the caller asks for them (crossProject) or isolation is disabled.
     const config = loadConfig(ctx.hippoRoot);
     const isolationEnabled = config.contextProjectIsolation !== false;
     const currentProject = opts.currentProject ?? resolveProjectIdentity(process.cwd());
-    const includeCrossProject = opts.crossProject === true || !isolationEnabled;
+    // A caller with no project reads every row as its own; on a shared store those rows are other people's.
+    if (sharedStore && projectId(currentProject).trim() === '')
+        throw new BadRequestError('a shared store needs the caller\'s project');
+    if (sharedStore && !isolationEnabled)
+        warnIsolationIgnored(ctx.hippoRoot);
+    const includeCrossProject = opts.crossProject === true || (!isolationEnabled && !sharedStore);
     // Decided before the ambient loads so the pinned-only FTS candidate query can share their connection.
     const promptRecallPending = pinnedOnly && Boolean(opts.prompt?.trim()) && config.pinnedInject.promptRecall === true;
     const cost = opts.cost;
@@ -167,12 +186,14 @@ function planContext(ctx, opts) {
         includeRecent: opts.includeRecent ?? 0,
         activeScope: opts.scope ?? '',
         exactScope: opts.exactScope || undefined,
+        ownScope: personalScopeOf(ctx.actor) ?? undefined,
         query,
         hasLocal,
         hasGlobal,
         globalRoot,
         primaryIsGlobal,
         hasLocalTaskState: hasLocal && !primaryIsGlobal,
+        sharedStore,
         config,
         currentProject,
         includeCrossProject,
@@ -190,7 +211,7 @@ function promptRecallRequest(opts, plan) {
         ? Array.from(promptTokens(opts.prompt ?? ''))
         : [];
     return promptRecallTerms.length > 0
-        ? { terms: promptRecallTerms, limit: Math.floor(finiteOr(pinnedInject.promptRecallCandidates, 100, 1)) }
+        ? { terms: promptRecallTerms, limit: Math.floor(finiteOr(pinnedInject.promptRecallCandidates, 100, 1)), ownScope: plan.ownScope }
         : undefined;
 }
 /** Reports the block's facts to the observer and returns the budget left after the fixed headers. */
@@ -204,9 +225,33 @@ function openBlockBudget(plan, opts, budget) {
         ? Math.max(0, blockBudget - cost.fixed(blockBudget, { cross: plan.includeCrossProject, promptRecall: promptRecallPending, ambient: !pinnedOnly && config.ambient.enabled }))
         : blockBudget;
 }
+const NO_TASK_STATE = { snapshot: null, handoff: null, events: [] };
+// Keyed on the RAW snapshot: a scope-hidden active session must not fall through to another session's ambient handoff.
+function loadRawTaskState(ctx, opts, plan) {
+    if (!plan.hasLocalTaskState)
+        return NO_TASK_STATE;
+    // On a shared store task state is one person's, keyed by owner and project so it follows them into their next session.
+    const key = plan.sharedStore
+        ? { owner: ownerOrSubject(ctx.actor), project: projectNames(plan.currentProject) }
+        : undefined;
+    // Bounded read: an orphaned snapshot ages out of this ambient surface; the owner session's read stays unbounded.
+    const snapshot = loadFreshActiveTaskSnapshot(ctx.hippoRoot, ctx.tenantId, { sessionId: opts.currentSessionId }, key);
+    const sessionId = snapshot?.session_id;
+    const handoff = sessionId
+        ? loadLatestHandoff(ctx.hippoRoot, ctx.tenantId, sessionId, {}, key)
+        : loadLatestHandoff(ctx.hippoRoot, ctx.tenantId, undefined, {
+            unfinishedOnly: true,
+            maxAgeMs: SNAPSHOT_AMBIENT_MAX_AGE_MS,
+            // Scope is admitted in SQL so a newer denied row can't hide an older eligible one before LIMIT 1.
+            scopeFilter: 'default-deny',
+        }, key);
+    // Raw session id here too: each event is admitted on its own scope, same as recall and the CLI.
+    const events = sessionId ? listSessionEvents(ctx.hippoRoot, ctx.tenantId, { session_id: sessionId, limit: 5 }) : [];
+    return { snapshot, handoff, events };
+}
 // Sections print ahead of the memories, so they are paid first; one that does not fit is dropped, as an oversize entry is.
 function loadTaskSections(ctx, opts, plan, startLeft) {
-    const { exactScope, hasLocalTaskState, cost } = plan;
+    const { exactScope, ownScope, cost } = plan;
     let left = startLeft;
     const pays = (tokens) => {
         if (tokens > left)
@@ -214,38 +259,12 @@ function loadTaskSections(ctx, opts, plan, startLeft) {
         left -= tokens;
         return true;
     };
-    // Bounded read: an orphaned snapshot ages out of this ambient surface; the owner session's read stays unbounded.
     const rowScope = (r) => r?.scope ?? null;
-    const rawActiveSnapshot = hasLocalTaskState
-        ? loadFreshActiveTaskSnapshot(ctx.hippoRoot, ctx.tenantId, {
-            sessionId: opts.currentSessionId,
-        })
-        : null;
+    const raw = loadRawTaskState(ctx, opts, plan);
     // The same envelope rule ambientAdmitEntry applies to memory rows.
-    const activeSnapshot = rawActiveSnapshot && passesScopeFilterForRecall(rowScope(rawActiveSnapshot), exactScope)
-        ? rawActiveSnapshot
-        : null;
-    // Key on the RAW snapshot: a scope-hidden active session must not fall through to another session's ambient handoff.
-    const rawSessionHandoff = !hasLocalTaskState
-        ? null
-        : rawActiveSnapshot?.session_id
-            ? loadLatestHandoff(ctx.hippoRoot, ctx.tenantId, rawActiveSnapshot.session_id)
-            : loadLatestHandoff(ctx.hippoRoot, ctx.tenantId, undefined, {
-                unfinishedOnly: true,
-                maxAgeMs: SNAPSHOT_AMBIENT_MAX_AGE_MS,
-                // Scope is admitted in SQL so a newer denied row can't hide an older eligible one before LIMIT 1.
-                scopeFilter: 'default-deny',
-            });
-    const sessionHandoff = rawSessionHandoff && passesScopeFilterForRecall(rowScope(rawSessionHandoff), exactScope)
-        ? rawSessionHandoff
-        : null;
-    // Raw session id here too: each event is admitted on its own scope, same as recall and the CLI.
-    const recentSessionEvents = hasLocalTaskState && rawActiveSnapshot?.session_id
-        ? listSessionEvents(ctx.hippoRoot, ctx.tenantId, {
-            session_id: rawActiveSnapshot.session_id,
-            limit: 5,
-        }).filter((e) => passesScopeFilterForRecall(rowScope(e), exactScope))
-        : [];
+    const activeSnapshot = raw.snapshot && passesScopeFilterForRecall(rowScope(raw.snapshot), exactScope, ownScope) ? raw.snapshot : null;
+    const sessionHandoff = raw.handoff && passesScopeFilterForRecall(rowScope(raw.handoff), exactScope, ownScope) ? raw.handoff : null;
+    const recentSessionEvents = raw.events.filter((e) => passesScopeFilterForRecall(rowScope(e), exactScope, ownScope));
     const shownSnapshot = activeSnapshot && (!cost || pays(cost.snapshot(activeSnapshot))) ? activeSnapshot : null;
     const shownHandoff = sessionHandoff && (!cost || pays(cost.handoff(sessionHandoff))) ? sessionHandoff : null;
     const shownEvents = recentSessionEvents.length > 0 && (!cost || pays(cost.trail(recentSessionEvents))) ? recentSessionEvents : [];
@@ -254,14 +273,11 @@ function loadTaskSections(ctx, opts, plan, startLeft) {
 }
 function ambientAdmission(opts, plan, shownHandoff) {
     const transcriptHandoffSession = shownHandoff?.evidence?.derivedFrom === 'transcript' ? shownHandoff.sessionId : null;
-    let digestHiddenForHandoff = false;
     const ambientAdmit = (e) => {
         // A printed handoff already carries the session's closing message, which its digest would print a second time.
-        if (transcriptHandoffSession !== null && e.source_session_id === transcriptHandoffSession && isSessionDigestRow(e)) {
-            digestHiddenForHandoff = true;
+        if (transcriptHandoffSession !== null && e.source_session_id === transcriptHandoffSession && isSessionDigestRow(e))
             return false;
-        }
-        return ambientAdmitEntry(e, plan.currentProject, plan.includeCrossProject, plan.exactScope);
+        return ambientAdmitEntry(e, plan.currentProject, plan.includeCrossProject, plan.exactScope, plan.ownScope);
     };
     const ownSessionId = opts.currentSessionId || '';
     // Inside admit, not after the load, so the loader's window widens past a session's own items.
@@ -272,10 +288,17 @@ function ambientAdmission(opts, plan, shownHandoff) {
     const admit = (e) => !e.superseded_by && !isOwnCompactionItem(e) && ambientAdmit(e);
     // The two-store search has always ranked a session's own compaction items; only the local search drops them.
     const bothStoresAdmit = (e) => !e.superseded_by && ambientAdmit(e);
-    return { ambientAdmit, admit, bothStoresAdmit, digestHidden: () => digestHiddenForHandoff };
+    return { ambientAdmit, admit, bothStoresAdmit };
+}
+/** Origins the recent backfill may read past its first window; on a shared store, only the caller's own project rows. */
+function recentOrigins(plan) {
+    if (plan.sharedStore)
+        return { names: projectNames(plan.currentProject).filter((n) => n !== ''), userGlobal: false };
+    return plan.originProject && { names: plan.originProject, userGlobal: true };
 }
 function loadPools(ctx, plan, admission, recallRequest) {
-    const { obs, pinnedOnly, primaryIsGlobal, hasGlobal, exactScope } = plan;
+    const { obs, pinnedOnly, primaryIsGlobal, hasGlobal, exactScope, ownScope } = plan;
+    const recent = { needed: plan.includeRecent, origins: recentOrigins(plan) };
     const searches = plan.query !== '*' && !pinnedOnly;
     const searchesBoth = searches && hasGlobal && !primaryIsGlobal;
     const poolAdmit = searchesBoth ? admission.bothStoresAdmit : admission.admit;
@@ -283,19 +306,20 @@ function loadPools(ctx, plan, admission, recallRequest) {
     const qualityDrop = (isGlobal) => obs && !plan.promptRecallPending ? (e) => obs.qualityDropped(e, isGlobal) : undefined;
     // The window's predicates are ones admit applies anyway, so below the cap the admitted rows are unchanged.
     const window = searches
-        ? { query: plan.query, exactScope, project: plan.originProject }
+        ? { query: plan.query, exactScope, ownScope, project: plan.originProject }
         : {
             exactScope,
+            ownScope,
             project: plan.originProject,
             cap: CONTEXT_CANDIDATE_CAP,
             now: evalNow(),
         };
     // Tenant-scoped loads: never resolveTenantId({}) here.
     const local = plan.hasLocal
-        ? loadAmbientEntries(ctx.hippoRoot, ctx.tenantId, pinnedOnly, plan.includeRecent, loadAdmit, window, recallRequest, qualityDrop(primaryIsGlobal))
+        ? loadAmbientEntries(ctx.hippoRoot, ctx.tenantId, pinnedOnly, recent, loadAdmit, window, recallRequest, qualityDrop(primaryIsGlobal))
         : { entries: [] };
     const global = hasGlobal && !primaryIsGlobal
-        ? loadAmbientEntries(plan.globalRoot, ctx.tenantId, pinnedOnly, plan.includeRecent, loadAdmit, window, recallRequest, qualityDrop(true))
+        ? loadAmbientEntries(plan.globalRoot, ctx.tenantId, pinnedOnly, recent, loadAdmit, window, recallRequest, qualityDrop(true))
         : { entries: [] };
     return { local, global };
 }
@@ -369,7 +393,7 @@ function recordRetrieval(ctx, opts, plan, selected, activeSnapshot) {
     return { items, ambientState: plan.config.ambient.enabled ? readAmbientState(ctx, plan) : undefined };
 }
 function readAmbientState(ctx, plan) {
-    const filter = { exactScope: plan.exactScope, project: plan.originProject, currentProject: projectNames(plan.currentProject), now: evalNow() };
+    const filter = { exactScope: plan.exactScope, ownScope: plan.ownScope, project: plan.originProject, currentProject: projectNames(plan.currentProject), now: evalNow() };
     const roots = [...(plan.hasLocal ? [ctx.hippoRoot] : []), ...(plan.hasGlobal && !plan.primaryIsGlobal ? [plan.globalRoot] : [])];
     const tallies = roots.map((root) => loadAmbientTallies(root, ctx.tenantId, filter));
     const total = tallies.length > 0 ? tallies.reduce(addAmbientTallies) : undefined;

package/dist/api/dormant.d.ts

@@ -9,12 +9,12 @@ import type { Context } from './types.js';
 export declare function listDormant(ctx: Context, opts?: ListDormantOpts): DormantMemory[];
 /**
  * Bring a dormant memory back into active memory. It returns as if just
- * recalled: `last_retrieved` is now, so it gets a full half-life before it
- * can fade again. Every other field is the snapshot taken when it went
- * dormant.
+ * recalled, with a full half-life. A row audit repair set aside returns
+ * `verified`, so no quality check judges it again. Every other field is the
+ * snapshot taken when it went dormant.
  *
  * Throws when the tenant has no dormant memory with that id (another
- * tenant's id reads the same way), when a live memory already holds the id,
+ * tenant's id, or another person's personal row, reads the same way), when a live memory already holds the id,
  * and RejectedValueError when the value has been rejected since. On any
  * throw the dormant copy stays where it is.
  */
@@ -25,6 +25,6 @@ export declare function restoreDormant(ctx: Context, id: string): MemoryEntry;
  * dormant memory with that id.
  */
 export declare function forgetDormant(ctx: Context, id: string): void;
-/** Whether the tenant holds a dormant memory with this id (for "not found" hints). */
+/** Whether the tenant holds a dormant memory with this id that the caller may touch (for "not found" hints). */
 export declare function isDormant(ctx: Context, id: string): boolean;
 //# sourceMappingURL=dormant.d.ts.map

package/dist/api/dormant.js

@@ -10,6 +10,8 @@ import { listDormantRows, readDormantSnapshot, deleteDormantRow, hasDormantRow,
 import { createMemory, calculateStrength } from '../memory.js';
 import { appendAuditEvent, reportAuditWriteFailure } from '../audit.js';
 import { loadConfig } from '../config.js';
+import { canTouchScope, personalScopeOf, touchableScopeSql } from '../recall-scope.js';
+const touchable = (ctx) => touchableScopeSql('', personalScopeOf(ctx.actor));
 /**
  * A tenant's dormant memories (src/dormant.ts): what sleep moved out of
  * active memory instead of deleting, when `dormant.enabled` is on. Newest
@@ -18,7 +20,7 @@ import { loadConfig } from '../config.js';
 export function listDormant(ctx, opts = {}) {
     const db = openHippoDb(ctx.hippoRoot);
     try {
-        return listDormantRows(db, ctx.tenantId, opts);
+        return listDormantRows(db, ctx.tenantId, opts, touchable(ctx));
     }
     finally {
         closeHippoDb(db);
@@ -26,12 +28,12 @@ export function listDormant(ctx, opts = {}) {
 }
 /**
  * Bring a dormant memory back into active memory. It returns as if just
- * recalled: `last_retrieved` is now, so it gets a full half-life before it
- * can fade again. Every other field is the snapshot taken when it went
- * dormant.
+ * recalled, with a full half-life. A row audit repair set aside returns
+ * `verified`, so no quality check judges it again. Every other field is the
+ * snapshot taken when it went dormant.
  *
  * Throws when the tenant has no dormant memory with that id (another
- * tenant's id reads the same way), when a live memory already holds the id,
+ * tenant's id, or another person's personal row, reads the same way), when a live memory already holds the id,
  * and RejectedValueError when the value has been rejected since. On any
  * throw the dormant copy stays where it is.
  */
@@ -42,7 +44,7 @@ export function restoreDormant(ctx, id) {
         db.exec('BEGIN IMMEDIATE');
         try {
             const dormant = readDormantSnapshot(db, ctx.tenantId, id);
-            if (!dormant) {
+            if (!dormant || !canTouchScope(ctx.actor, dormant.entry.scope ?? null)) {
                 throw new NotFoundError(`dormant memory not found: ${id}`);
             }
             if (db.prepare(`SELECT 1 FROM memories WHERE id = ?`).get(id) !== undefined) {
@@ -59,6 +61,8 @@ export function restoreDormant(ctx, id) {
                 ...dormant.entry,
                 last_retrieved: now.toISOString(),
             };
+            if (dormant.reason === 'quality-repair')
+                revived.confidence = 'verified';
             restored = stampOriginProject(ctx.hippoRoot, { ...revived, strength: calculateStrength(revived, now) });
             writeEntryDbOnly(db, restored, { actor: ctx.actor.subject });
             deleteDormantRow(db, ctx.tenantId, id);
@@ -104,7 +108,7 @@ export function restoreDormant(ctx, id) {
 export function forgetDormant(ctx, id) {
     const db = openHippoDb(ctx.hippoRoot);
     try {
-        if (!deleteDormantRow(db, ctx.tenantId, id)) {
+        if (!hasDormantRow(db, ctx.tenantId, id, touchable(ctx)) || !deleteDormantRow(db, ctx.tenantId, id)) {
             throw new NotFoundError(`dormant memory not found: ${id}`);
         }
         try {
@@ -127,11 +131,11 @@ export function forgetDormant(ctx, id) {
     // Counted like every other permanent removal (forget, archiveRaw).
     updateStatsUnlessBusy(ctx.hippoRoot, { forgotten: 1 }, `removed ${id}`);
 }
-/** Whether the tenant holds a dormant memory with this id (for "not found" hints). */
+/** Whether the tenant holds a dormant memory with this id that the caller may touch (for "not found" hints). */
 export function isDormant(ctx, id) {
     const db = openHippoDb(ctx.hippoRoot);
     try {
-        return hasDormantRow(db, ctx.tenantId, id);
+        return hasDormantRow(db, ctx.tenantId, id, touchable(ctx));
     }
     finally {
         closeHippoDb(db);

package/dist/api/drill-down.d.ts

@@ -1,3 +1,4 @@
+import type { CallerProject } from '../prompt-hook.js';
 import type { Context } from './types.js';
 export interface DrillDownOpts {
     /** Cap on number of children returned. Default 50. */
@@ -19,6 +20,7 @@ export interface DrillDownOpts {
      */
     depth?: number;
     cost?: DrillDownCost;
+    project?: CallerProject;
 }
 export interface DrillDownSummary {
     id: string;

package/dist/api/drill-down.js

@@ -3,7 +3,8 @@ import { closeHippoDb } from '../db.js';
 import { openStore } from '../store/open.js';
 import { selectEntriesByIds, selectChildrenByParent } from '../store/entry-reads.js';
 import { estimateTokens } from '../token-ledger.js';
-import { passesScopeFilterForRecall } from '../recall-scope.js';
+import { passesScopeFilterForRecall, personalScopeOf } from '../recall-scope.js';
+import { classifyOriginProject } from '../project-identity.js';
 /**
  * Walk one step down the DAG from a level-2 (or higher) summary to its direct
  * children. Companion to `recall(... summarizeOverflow: true)` — when recall
@@ -44,16 +45,20 @@ function drillDownOn(db, ctx, summaryId, depth, opts, limit) {
     // unauthorised tenants. The two cases collapse into not_found.
     if (!summary)
         return { failure: 'not_found' };
-    if ((summary.dag_level ?? 0) < 2)
-        return { failure: 'not_drillable' };
-    if (!passesScopeFilterForRecall(summary.scope ?? null, undefined)) {
+    const own = personalScopeOf(ctx.actor) ?? undefined;
+    if (!passesScopeFilterForRecall(summary.scope ?? null, undefined, own)) {
         // codex round 3 P1: collapse to not_found. A distinguishable
         // "scope_blocked" tells a no-scope caller "this row exists, just
         // not for you" — same existence-leak the HTTP 404 collapse was
         // already preventing. Match the HTTP behaviour at the API level.
         return { failure: 'not_found' };
     }
-    const { collected, level0DirectCount } = collectDescendants(db, ctx.tenantId, summaryId, depth);
+    const shown = (row) => !opts.project || classifyOriginProject(row.origin_project, opts.project) !== 'cross-project';
+    if (!shown(summary))
+        return { failure: 'not_found' };
+    if ((summary.dag_level ?? 0) < 2)
+        return { failure: 'not_drillable' };
+    const { collected, level0DirectCount } = collectDescendants(db, ctx.tenantId, summaryId, depth, own, shown);
     const summaryOut = {
         id: summary.id,
         content: summary.content,
@@ -83,7 +88,7 @@ function drillDownOn(db, ctx, summaryId, depth, opts, limit) {
 }
 // BFS with a visited set: dag_parent_id is not unique, so a misconfigured tree could emit a child twice past depth 1.
 // The level-0 count is kept apart so a legacy summary's descendantCount fallback counts direct children only.
-function collectDescendants(db, tenantId, summaryId, depth) {
+function collectDescendants(db, tenantId, summaryId, depth, own, shown) {
     const collected = [];
     const visited = new Set([summaryId]);
     let frontier = [summaryId];
@@ -93,7 +98,7 @@ function collectDescendants(db, tenantId, summaryId, depth) {
         const kidsByParent = selectChildrenByParent(db, frontier, tenantId);
         for (const parentId of frontier) {
             const kids = kidsByParent.get(parentId) ?? [];
-            const eligibleKids = kids.filter((c) => passesScopeFilterForRecall(c.scope ?? null, undefined));
+            const eligibleKids = kids.filter((c) => passesScopeFilterForRecall(c.scope ?? null, undefined, own) && shown(c));
             for (const k of eligibleKids) {
                 if (visited.has(k.id))
                     continue;

package/dist/api/forget.d.ts

@@ -33,7 +33,7 @@ export interface RejectResult {
  * forms — pass exactly one:
  *  - `memoryId`: reject the CURRENT content of an existing memory. Removes
  *    that row and every other live row in the tenant whose normalized
- *    digest matches (not just the id passed).
+ *    digest matches (not just the id passed), except another person's personal rows.
  *  - `value`: pre-emptive form — tombstone content that may not currently
  *    be stored (or is already gone). Zero removals.
  *

package/dist/api/forget.js

@@ -4,11 +4,13 @@ import { BadRequestError, NotFoundError } from '../api-errors.js';
 import { deleteEntry } from '../store/delete-and-batch.js';
 import { updateStatsUnlessBusy } from '../store/index-and-stats.js';
 import { rejectValue, unrejectValue, listRejectionsForTenant } from '../reject-flow.js';
-import { selectMemoryTenant } from '../store/tenant-lookup.js';
+import { selectMemoryReach } from '../store/tenant-lookup.js';
+import { canTouchScope, personalScopeOf } from '../recall-scope.js';
 export function forget(ctx, id) {
     const db = openHippoDb(ctx.hippoRoot);
     try {
-        if (selectMemoryTenant(db, id) !== ctx.tenantId) {
+        const reach = selectMemoryReach(db, id);
+        if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
             throw new NotFoundError(`memory not found: ${id}`);
         }
     }
@@ -31,7 +33,7 @@ export function forget(ctx, id) {
  * forms — pass exactly one:
  *  - `memoryId`: reject the CURRENT content of an existing memory. Removes
  *    that row and every other live row in the tenant whose normalized
- *    digest matches (not just the id passed).
+ *    digest matches (not just the id passed), except another person's personal rows.
  *  - `value`: pre-emptive form — tombstone content that may not currently
  *    be stored (or is already gone). Zero removals.
  *
@@ -46,7 +48,8 @@ export function reject(ctx, opts) {
         // keeps the error message consistent with the rest of this module.
         const db = openHippoDb(ctx.hippoRoot);
         try {
-            if (selectMemoryTenant(db, opts.memoryId) !== ctx.tenantId) {
+            const reach = selectMemoryReach(db, opts.memoryId);
+            if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
                 throw new NotFoundError(`memory not found: ${opts.memoryId}`);
             }
         }
@@ -61,6 +64,7 @@ export function reject(ctx, opts) {
         reason: opts.reason,
         memoryId: opts.memoryId,
         value: opts.value,
+        ownScope: personalScopeOf(ctx.actor) ?? undefined,
     });
     return { digest: result.digest, removedIds: result.removedIds };
 }

package/dist/api/learn.js

@@ -6,6 +6,7 @@ import { embedMemory } from '../embeddings.js';
 import { extractInvalidationTarget, invalidateMatching } from '../invalidation.js';
 import { computeSchemaFit, createMemory, Layer } from '../memory.js';
 import { extractPathTags } from '../path-context.js';
+import { canReadScope, personalScopeOf, touchableScopeSql } from '../recall-scope.js';
 import { RejectedValueError } from '../rejection.js';
 import { duplicateKey, longestWord, storedTextKeys } from '../same-text.js';
 import { loadTextsHoldingWords } from '../store/candidates.js';
@@ -37,9 +38,10 @@ export function learn(ctx, opts) {
 function writeLessons(ctx, lessons, opts, config) {
     const { hippoRoot, tenantId } = ctx;
     const { profile } = opts;
-    // Schema fit needs every row; without it, only rows holding a lesson's longest word can be its copy.
-    const existing = profile.full ? loadAllEntries(hippoRoot, tenantId) : undefined;
-    const keys = storedTextKeys(existing ?? loadTextsHoldingWords(hippoRoot, tenantId, lessons.map(longestWord)));
+    // Schema fit needs every row; without it, only rows holding a lesson's longest word can be its copy. Learn is host-admin only, so both read what an admin can.
+    const existing = profile.full ? loadAllEntries(hippoRoot, tenantId).filter((e) => e.scope == null || canReadScope(ctx.actor, e.scope)) : undefined;
+    const readable = touchableScopeSql('', personalScopeOf(ctx.actor));
+    const keys = storedTextKeys(existing ?? loadTextsHoldingWords(hippoRoot, tenantId, lessons.map(longestWord), undefined, readable));
     const pathTags = profile.full ? extractPathTags(opts.repoPath) : [];
     const counts = { added: 0, skipped: 0, rejected: 0, invalidations: [] };
     for (const lesson of lessons) {

package/dist/api/outcome.d.ts

@@ -2,7 +2,7 @@ import type { Context } from './types.js';
 /**
  * Apply a positive/negative outcome to a list of recently-recalled memory ids.
  * Used by the MCP `hippo_outcome` tool and the HTTP `POST /v1/outcome` route.
- * Tenant-scoped: ids that don't belong to ctx.tenantId are silently skipped
+ * Tenant-scoped: ids outside ctx.tenantId, or in someone else's personal scope, are silently skipped
  * (matches the prior MCP semantics — a stale id from another tenant doesn't
  * crash the call). Each successful outcome emits one audit_log row with
  * op='outcome' tagged with ctx.actor.subject.

package/dist/api/outcome.js

@@ -7,6 +7,7 @@ import { loadIndex } from '../store/index-and-stats.js';
 import { applyOutcome, CHURN_STALE_TAG } from '../memory.js';
 import { appendAuditEvent } from '../audit.js';
 import { recordTraceOutcome } from '../recall-trace.js';
+import { canTouchScope } from '../recall-scope.js';
 export function outcome(ctx, ids, good, opts) {
     const appliedIds = [];
     const db = openStore(ctx.hippoRoot);
@@ -14,7 +15,7 @@ export function outcome(ctx, ids, good, opts) {
         const live = selectEntriesByIds(db, ids, ctx.tenantId);
         for (const id of ids) {
             const entry = live.get(id);
-            if (!entry)
+            if (!entry || !canTouchScope(ctx.actor, entry.scope ?? null))
                 continue;
             let updated = applyOutcome(entry, good);
             if (good && updated.tags.includes(CHURN_STALE_TAG)) { // a good outcome reconfirms the entry

package/dist/api/promote.js

@@ -15,7 +15,8 @@ import { appendAuditEvent } from '../audit.js';
 import { promoteToGlobal } from '../shared.js';
 import { archiveRawMemory } from '../raw-archive.js';
 import { loadConfig } from '../config.js';
-import { selectMemoryTenant } from '../store/tenant-lookup.js';
+import { selectMemoryReach } from '../store/tenant-lookup.js';
+import { canTouchScope } from '../recall-scope.js';
 export function promote(ctx, id) {
     // Tenant scope: promoteToGlobal reads the entry from the local root via
     // readEntry without a tenant filter, so a Bearer for tenant A could
@@ -25,7 +26,8 @@ export function promote(ctx, id) {
     // another tenant).
     const ownerDb = openHippoDb(ctx.hippoRoot);
     try {
-        if (selectMemoryTenant(ownerDb, id) !== ctx.tenantId) {
+        const reach = selectMemoryReach(ownerDb, id);
+        if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
             throw new NotFoundError(`memory not found: ${id}`);
         }
     }
@@ -78,10 +80,10 @@ export function supersede(ctx, oldId, newContent) {
     }
     return { ok: true, oldId, newId: newEntry.id };
 }
-/** The tenant-scoped row to supersede; readEntry's tenant filter makes another tenant's id read as not found. */
+/** The tenant-scoped row to supersede; another tenant's id, or someone else's personal row, reads as not found. */
 function readSupersedable(ctx, oldId) {
     const old = readEntry(ctx.hippoRoot, oldId, ctx.tenantId);
-    if (!old) {
+    if (!old || !canTouchScope(ctx.actor, old.scope ?? null)) {
         throw new NotFoundError(`Memory not found: ${oldId}`);
     }
     // The CAS UPDATE closes the race; this check only gives a clearer error in the common single-writer case.
@@ -140,7 +142,8 @@ export function archiveRaw(ctx, id, reason, opts = {}) {
         // pre-check. Deny cross-tenant access with the same not-found message
         // archiveRawMemory itself would throw on a missing row, so we don't
         // leak whether the id exists in another tenant.
-        if (selectMemoryTenant(db, id) !== ctx.tenantId) {
+        const reach = selectMemoryReach(db, id);
+        if (reach?.tenantId !== ctx.tenantId || !canTouchScope(ctx.actor, reach.scope)) {
             throw new NotFoundError(`memory not found: ${id}`);
         }
         archiveRawMemory(db, id, {

package/dist/api/recall-types.d.ts

@@ -5,6 +5,7 @@ import type { RerankStep, SearchResult } from '../search/types.js';
 import type { PlanningFallacyHint, PlanningFallacyWatching } from '../predictions/planning-fallacy.js';
 import type { AnchoringHint, RecallHistorySnapshot } from '../recall-history.js';
 import type { AvailabilityHint } from '../availability.js';
+import type { CallerProject } from '../prompt-hook.js';
 export interface RecallOpts {
     query: string;
     limit?: number;
@@ -76,8 +77,8 @@ export interface RecallOpts {
      * session handoff, recent session events) on the result. Default false to keep
      * the hot path cheap; agent boot paths should set this to true.
      *
-     * All three lookups are tenant-scoped to ctx.tenantId via the store
-     * helpers. No risk of cross-tenant leak.
+     * All three lookups are tenant-scoped to ctx.tenantId. On a shared store they are
+     * the caller's own, keyed by owner and `project`, and empty without a project.
      *
      * Note: when no active snapshot exists, sessionHandoff is null and
      * recentSessionEvents is []. We deliberately do NOT fall back to the latest
@@ -86,6 +87,7 @@ export interface RecallOpts {
      * `hippo session resume`.
      */
     includeContinuity?: boolean;
+    project?: CallerProject;
     /**
      * When set AND `(ctx.tenantId, sessionId)` has active goals AND
      * `goalTag` is unset, `api.recall` applies the dlPFC goal-stack boost lifted