memorix 1.2.1 → 1.2.3

package/src/compact/engine.ts

@@ -9,7 +9,7 @@
  * Layer 3 (detail)   → Full observation content (~500-1000 tokens/result)
  */
 
-import type { SearchOptions, IndexEntry, TimelineContext, MemorixDocument, ObservationRef, MemoryRef, MiniSkill, SourceSnapshot } from '../types.js';
+import type { SearchOptions, IndexEntry, TimelineContext, MemorixDocument, ObservationRef, MemoryRef, MiniSkill, SourceSnapshot, ObservationReader } from '../types.js';
 import { searchObservations, getTimeline, getObservationsByIds, makeOramaObservationId } from '../store/orama-store.js';
 import { getObservation, getAllObservations } from '../memory/observations.js';
 import { ensureFreshIndex } from '../memory/freshness.js';
@@ -21,6 +21,7 @@ import { getObservationStore } from '../store/obs-store.js';
 import { getMiniSkillStore } from '../store/mini-skill-store.js';
 import { miniSkillToDocument, resolveProvenanceStatus, type ProvenanceStatus } from '../skills/mini-skills.js';
 import { redactCredentials } from '../memory/secret-filter.js';
+import { canReadObservation, filterReadableObservations } from '../memory/visibility.js';
 
 export function normalizeMemoryBrowseQuery(query: string): string {
   const trimmed = query.trim();
@@ -76,14 +77,17 @@ export async function compactSearch(options: SearchOptions): Promise<{
   let formatted = formatIndexTable(entries, searchOptions.query, !options.projectId);
 
   if (entries.length === 0 && options.projectId) {
-    const allObservations = getAllObservations();
+    const allObservations = filterReadableObservations(getAllObservations(), options.reader);
     const projectAliases = new Set(await resolveAliases(options.projectId).catch(() => [options.projectId]));
     const projectHasStoredMemory = allObservations.some((obs) => obs.projectId && projectAliases.has(obs.projectId));
     if (!projectHasStoredMemory) {
       formatted =
-        `This project does not have any Memorix memories yet.\n\n` +
-        `It looks like a fresh project: the tool call worked, but there is nothing stored to retrieve yet.\n\n` +
-        `Memories will start appearing after observations, session summaries, hook captures, or git-memory are written.`;
+        options.reader
+          ? `No Memorix memories are available to this session yet.\n\n` +
+            `The tool call worked, but this session has no project-visible memory to retrieve.`
+          : `This project does not have any Memorix memories yet.\n\n` +
+            `It looks like a fresh project: the tool call worked, but there is nothing stored to retrieve yet.\n\n` +
+            `Memories will start appearing after observations, session summaries, hook captures, or git-memory are written.`;
     } else {
       formatted =
         `No memories found matching "${options.query}".\n\n` +
@@ -106,12 +110,13 @@ export async function compactTimeline(
   projectId?: string,
   depthBefore = 3,
   depthAfter = 3,
+  reader?: ObservationReader,
 ): Promise<{
   timeline: TimelineContext;
   formatted: string;
   totalTokens: number;
 }> {
-  const result = await getTimeline(anchorId, projectId, depthBefore, depthAfter);
+  const result = await getTimeline(anchorId, projectId, depthBefore, depthAfter, reader);
 
   const timeline: TimelineContext = {
     anchorId,
@@ -135,6 +140,7 @@ export async function compactTimeline(
  */
 export async function compactDetail(
   idsOrRefs: number[] | ObservationRef[] | string[],
+  options: { reader?: ObservationReader } = {},
 ): Promise<{
   documents: MemorixDocument[];
   formatted: string;
@@ -212,7 +218,7 @@ export async function compactDetail(
   const missingRefs: ObservationRef[] = [];
   for (const ref of refs) {
     const obs = getObservation(ref.id, ref.projectId);
-    if (obs && (ref.projectId ? obs.projectId === ref.projectId : true)) {
+    if (obs && (ref.projectId ? obs.projectId === ref.projectId : true) && canReadObservation(obs, options.reader)) {
       documentMap.set(toRefKey(ref), {
         id: makeOramaObservationId(obs.projectId, obs.id),
         observationId: obs.id,
@@ -232,6 +238,11 @@ export async function compactDetail(
         source: obs.source ?? 'agent',
         sourceDetail: obs.sourceDetail ?? '',
         valueCategory: obs.valueCategory ?? '',
+        admissionState: obs.admissionState ?? '',
+        admissionReason: obs.admissionReason ?? '',
+        visibility: obs.visibility ?? 'project',
+        createdByAgentId: obs.createdByAgentId ?? '',
+        sharedWithAgentIds: JSON.stringify(obs.sharedWithAgentIds ?? []),
       });
     } else {
       missingRefs.push(ref);
@@ -242,19 +253,19 @@ export async function compactDetail(
     for (const ref of missingRefs) {
       const fallbackDocs = await getObservationsByIds([ref.id], ref.projectId);
       const doc = fallbackDocs[0];
-      if (doc) {
+      if (doc && canReadObservation(doc, options.reader)) {
         documentMap.set(toRefKey(ref), doc);
         continue;
       }
       const stored = await getPersistedObservation(ref);
-      if (stored) {
+      if (stored && canReadObservation(stored, options.reader)) {
         documentMap.set(toRefKey(ref), observationToDocument(stored));
       }
     }
   }
 
   // Build cross-reference map for all requested observations
-  const allObs = getAllObservations();
+  const allObs = filterReadableObservations(getAllObservations(), options.reader);
   const crossRefMap = new Map<string, string[]>();
   for (const ref of refs) {
     const obs = getObservation(ref.id, ref.projectId);
@@ -401,6 +412,11 @@ function observationToDocument(obs: ReturnType<typeof getAllObservations>[number
     source: obs.source ?? 'agent',
     sourceDetail: obs.sourceDetail ?? '',
     valueCategory: obs.valueCategory ?? '',
+    admissionState: obs.admissionState ?? '',
+    admissionReason: obs.admissionReason ?? '',
+    visibility: obs.visibility ?? 'project',
+    createdByAgentId: obs.createdByAgentId ?? '',
+    sharedWithAgentIds: JSON.stringify(obs.sharedWithAgentIds ?? []),
   };
 }
 

package/src/compact/index-format.ts

@@ -179,6 +179,8 @@ export function formatObservationDetail(doc: {
   entityName: string;
   sourceDetail?: string;
   valueCategory?: string;
+  admissionState?: string;
+  admissionReason?: string;
   source?: string;
   commitHash?: string;
   relatedCommits?: string[];
@@ -187,7 +189,15 @@ export function formatObservationDetail(doc: {
   const lines: string[] = [];
 
   // Provenance header — shown before #ID when sourceDetail (or legacy source='git') is set
-  const header = buildProvenanceHeader(doc.sourceDetail, doc.valueCategory, doc.source, doc.commitHash, doc.relatedCommits);
+  const header = buildProvenanceHeader(
+    doc.sourceDetail,
+    doc.valueCategory,
+    doc.admissionState,
+    doc.admissionReason,
+    doc.source,
+    doc.commitHash,
+    doc.relatedCommits,
+  );
   if (header) {
     lines.push(header);
     lines.push('');
@@ -236,6 +246,8 @@ export function formatObservationDetail(doc: {
 function buildProvenanceHeader(
   sourceDetail?: string,
   valueCategory?: string,
+  admissionState?: string,
+  admissionReason?: string,
   source?: string,
   commitHash?: string,
   relatedCommits?: string[],
@@ -257,12 +269,23 @@ function buildProvenanceHeader(
     lines.push(verificationLine);
   }
 
-  if (valueCategory === 'core') {
+  if (valueCategory === 'core' && admissionState !== 'candidate' && admissionState !== 'ephemeral') {
     lines.push('[CORE] Core — immune to decay');
+  } else if (valueCategory === 'core') {
+    lines.push('[CORE] Core candidate — not durable until qualification completes');
   } else if (valueCategory === 'ephemeral') {
     lines.push('[WARN] Ephemeral — short-lived signal');
   }
 
+  if (admissionState === 'candidate') {
+    lines.push('[PENDING] Candidate — excluded from automatic context until current Code Memory qualifies it');
+  } else if (admissionState === 'ephemeral') {
+    lines.push('[TRACE] Ephemeral capture — excluded from automatic context');
+  } else if (admissionState === 'qualified') {
+    lines.push('[QUALIFIED] Automatic evidence passed current Code Memory qualification');
+  }
+  if (admissionReason) lines.push(`Admission: ${redactCredentials(admissionReason)}`);
+
   return lines.join('\n');
 }
 

package/src/dashboard/server.ts

@@ -23,6 +23,8 @@ import { resetDotenv } from '../config/dotenv-loader.js';
 import { initProjectRoot } from '../config/yaml-loader.js';
 import { clearProjectRoot } from '../config/yaml-loader.js';
 import { scopeKnowledgeGraphToProject } from '../memory/graph-scope.js';
+import { canManageObservation, filterReadableObservations } from '../memory/visibility.js';
+import type { Observation } from '../types.js';
 
 // MIME types for static file serving
 const MIME_TYPES: Record<string, string> = {
@@ -59,6 +61,15 @@ function filterByProject<T extends { projectId?: string }>(items: T[], projectId
     return items.filter(item => item.projectId === projectId);
 }
 
+/**
+ * The dashboard has no per-agent authentication. Treat it as an unbound reader:
+ * project facts remain inspectable, while personal and team-scoped records stay
+ * in their owning MCP session.
+ */
+function filterDashboardObservations(observations: Observation[], projectId: string): Observation[] {
+    return filterReadableObservations(observations, { projectId });
+}
+
 function isActiveStatus(status?: string): boolean {
     return (status ?? 'active') === 'active';
 }
@@ -147,7 +158,10 @@ async function handleApi(
                 // List all unique project IDs from observations data (flat storage)
                 // Deduplicate using alias registry – aliased IDs are merged under canonical
                 try {
-                    const allObs = await getObservationStore().loadAll() as Array<{ projectId?: string; status?: string }>;
+                    const allObs = filterReadableObservations(
+                        await getObservationStore().loadAll(),
+                        {},
+                    ) as Array<{ projectId?: string; status?: string }>;
                     const projectSet = new Map<string, number>();
                     for (const obs of allObs) {
                         if (!isActiveStatus(obs.status)) continue;
@@ -204,14 +218,20 @@ async function handleApi(
                 await initGraphStore(effectiveDataDir);
                 const gStore = getGraphStore();
                 const graph = { entities: gStore.loadEntities(), relations: gStore.loadRelations() };
-                const graphObs = await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' });
+                const graphObs = filterDashboardObservations(
+                    await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' }),
+                    effectiveProjectId,
+                );
                 const scoped = scopeKnowledgeGraphToProject(graph, graphObs);
                 sendJson(res, { entities: scoped.entities, relations: scoped.relations });
                 break;
             }
 
             case '/observations': {
-                const observations = await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' });
+                const observations = filterDashboardObservations(
+                    await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' }),
+                    effectiveProjectId,
+                );
                 sendJson(res, observations);
                 break;
             }
@@ -226,7 +246,10 @@ async function handleApi(
             case '/stats': {
                 await initGraphStore(effectiveDataDir);
                 const graph = { entities: getGraphStore().loadEntities(), relations: getGraphStore().loadRelations() };
-                const observations = await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' }) as Array<{ type?: string; id?: number; createdAt?: string; title?: string; entityName?: string; relatedEntities?: string[]; status?: string }>;
+                const observations = filterDashboardObservations(
+                    await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' }),
+                    effectiveProjectId,
+                ) as Array<{ type?: string; id?: number; createdAt?: string; title?: string; entityName?: string; relatedEntities?: string[]; status?: string }>;
                 const nextId = await getObservationStore().loadIdCounter();
 
                 // Project-scoped graph counts (must match /api/graph and /api/export)
@@ -362,7 +385,10 @@ async function handleApi(
             }
 
             case '/retention': {
-                const observations = await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' }) as Array<{
+                const observations = filterDashboardObservations(
+                    await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' }),
+                    effectiveProjectId,
+                ) as Array<{
                     id?: number;
                     title?: string;
                     type?: string;
@@ -423,7 +449,10 @@ async function handleApi(
 
                 await initMiniSkillStore(effectiveDataDir);
 
-                const allObs = await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' });
+                const allObs = filterDashboardObservations(
+                    await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' }),
+                    effectiveProjectId,
+                );
                 const skills = await getMiniSkillStore().loadByProject(effectiveProjectId);
 
                 const overview = generateKnowledgeBase({
@@ -444,7 +473,10 @@ async function handleApi(
                 await initMiniSkillStore(effectiveDataDir);
                 await initGraphStore(effectiveDataDir);
 
-                const allObs = await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' });
+                const allObs = filterDashboardObservations(
+                    await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' }),
+                    effectiveProjectId,
+                );
                 const skills = await getMiniSkillStore().loadByProject(effectiveProjectId);
 
                 const fullGraph = { entities: getGraphStore().loadEntities(), relations: getGraphStore().loadRelations() };
@@ -597,7 +629,7 @@ async function handleApi(
 
             case '/identity': {
                 // Project identity health — with classification layering (matches control-plane contract)
-                const allObs = await getObservationStore().loadAll() as Array<{ projectId?: string }>;
+                const allObs = filterReadableObservations(await getObservationStore().loadAll(), {}) as Array<{ projectId?: string }>;
                 const allProjectIds = [...new Set(allObs.map(o => o.projectId).filter(Boolean))] as string[];
 
                 // Classify every known ID (real / temporary / placeholder) + dirty axis
@@ -698,6 +730,8 @@ async function handleApi(
                     } else if (matchObs.projectId !== effectiveProjectId) {
                         // Cross-project deletion guard: reject if obs belongs to a different project
                         sendError(res, `Observation #${obsId} belongs to project "${matchObs.projectId}", not "${effectiveProjectId}"`, 403);
+                    } else if (!canManageObservation(matchObs, { projectId: effectiveProjectId })) {
+                        sendError(res, `Observation #${obsId} is not manageable from the unbound dashboard.`, 403);
                     } else {
                         await obsStore.remove(obsId);
 
@@ -722,7 +756,10 @@ async function handleApi(
                 if (apiPath === '/export') {
                     await initGraphStore(effectiveDataDir);
                     const fullGraph = { entities: getGraphStore().loadEntities(), relations: getGraphStore().loadRelations() };
-                    const observations = await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' });
+                    const observations = filterDashboardObservations(
+                        await getObservationStore().loadByProject(effectiveProjectId, { status: 'active' }),
+                        effectiveProjectId,
+                    );
                     const nextId = await getObservationStore().loadIdCounter();
                     const scoped = scopeKnowledgeGraphToProject(fullGraph, observations);
                     const exportData = {

package/src/hooks/admission.ts

@@ -0,0 +1,117 @@
+import type { ObservationAdmissionState, ObservationType } from '../types.js';
+import { isSignificantKnowledge } from './significance-filter.js';
+import type { NormalizedHookInput } from './types.js';
+
+export type HookCaptureCategory =
+  | 'file_modify'
+  | 'file_read'
+  | 'command'
+  | 'search'
+  | 'memorix_internal'
+  | 'unknown';
+
+export type HookAdmissionDecision =
+  | { action: 'drop'; reason: string }
+  | {
+    action: 'store';
+    admissionState: ObservationAdmissionState;
+    admissionReason: string;
+    valueCategory: 'core' | 'contextual' | 'ephemeral';
+  };
+
+const FAILURE_PATTERN = /\b(fail(?:ed|ure)?|error|exception|assert(?:ion)?|exit code [1-9]|TypeError|ReferenceError|SyntaxError|ENOENT|ECONNREFUSED|panic)\b/i;
+const DECISION_PATTERN = /\b(decision|decided|choose|chosen|because|trade-?off|invariant|root cause|workaround|must|should not)\b/i;
+const TASK_PATTERN = /\b(add|implement|fix|refactor|migrate|upgrade|debug|investigate|test|release|deploy|remove)\b/i;
+const VALIDATION_PATTERN = /\b(test|tests|vitest|jest|pytest|playwright|cypress|typecheck|lint|build|cargo test|go test)\b/i;
+const FOCUSED_VALIDATION_PATTERN = /(?:--run|--filter|--grep|\s-t\s|\.test\.|\.spec\.|::[\w-]+)/i;
+const ROUTINE_SUCCESS_PATTERN = /\b(added \d+ packages|up to date|passed|all tests pass|tests? passed|0 failures|success(?:fully)?)\b/i;
+
+function isCandidateType(type: ObservationType): boolean {
+  return type === 'decision' ||
+    type === 'gotcha' ||
+    type === 'problem-solution' ||
+    type === 'trade-off' ||
+    type === 'why-it-exists';
+}
+
+function candidate(
+  admissionReason: string,
+  valueCategory: 'core' | 'contextual' = 'contextual',
+): HookAdmissionDecision {
+  return { action: 'store', admissionState: 'candidate', admissionReason, valueCategory };
+}
+
+function ephemeral(admissionReason: string): HookAdmissionDecision {
+  return { action: 'store', admissionState: 'ephemeral', admissionReason, valueCategory: 'ephemeral' };
+}
+
+/**
+ * Cheap, deterministic first-pass admission for cross-agent hooks. It never
+ * promotes an automatic record directly to durable context: background
+ * qualification must still prove a current Code Memory reference.
+ */
+export function assessHookAdmission(input: {
+  hook: NormalizedHookInput;
+  category: HookCaptureCategory;
+  content: string;
+  observationType: ObservationType;
+}): HookAdmissionDecision {
+  const { hook, category, content, observationType } = input;
+  const command = hook.command ?? '';
+  const hasFailure = FAILURE_PATTERN.test(content);
+  const hasDecision = DECISION_PATTERN.test(content) || isCandidateType(observationType);
+  const isValidation = VALIDATION_PATTERN.test(command) || VALIDATION_PATTERN.test(content);
+  const isFocusedValidation = FOCUSED_VALIDATION_PATTERN.test(command);
+  const isRoutineSuccess = ROUTINE_SUCCESS_PATTERN.test(content);
+
+  if (hasFailure) {
+    return candidate('automatic capture contains a concrete failure or verification signal');
+  }
+  if (hasDecision) {
+    return candidate('automatic capture contains a decision or durable rationale', 'core');
+  }
+
+  if (hook.event === 'user_prompt') {
+    return TASK_PATTERN.test(content)
+      ? candidate('user task contains a concrete technical action')
+      : { action: 'drop', reason: 'prompt has no durable technical task signal' };
+  }
+
+  if (hook.event === 'post_response') {
+    // Agent integrations such as OpenCode emit concise end-of-turn summaries.
+    // Keep technically meaningful ones as candidates; qualification still
+    // prevents them from becoming automatic context without code evidence.
+    return isSignificantKnowledge(content).isSignificant
+      ? candidate('assistant response records a concrete technical outcome')
+      : { action: 'drop', reason: 'response has no durable technical outcome' };
+  }
+
+  if (hook.event === 'session_end') {
+    // The handler already applies a minimum-content gate for session end.
+    // Preserve a compact handoff trace, but keep it out of automatic context
+    // until later qualification.
+    return candidate('session-end summary awaits Code Memory qualification');
+  }
+
+  if (category === 'file_modify') {
+    return candidate('file mutation awaits Code Memory qualification');
+  }
+
+  if (category === 'command') {
+    if (isValidation && isFocusedValidation && !isRoutineSuccess) {
+      return candidate('focused validation result awaits Code Memory qualification');
+    }
+    if (isValidation || isRoutineSuccess) {
+      return ephemeral('routine command result retained only as a short-lived trace');
+    }
+    return ephemeral('command activity retained only as a short-lived trace');
+  }
+
+  if (category === 'search' || category === 'unknown') {
+    return content.length >= 300
+      ? ephemeral('unverified automatic activity retained only as a short-lived trace')
+      : { action: 'drop', reason: 'automatic activity has insufficient evidence' };
+  }
+
+  return { action: 'drop', reason: 'capture category is not eligible for automatic storage' };
+}