memorix 1.7.3 → 1.8.0

package/src/cli/commands/feedback.ts

@@ -0,0 +1,58 @@
+import { defineCommand } from 'citty';
+import { MemoryFeedbackStore, type FeedbackCandidateKind, type MemoryFeedbackSignal } from '../../memory/feedback.js';
+import { emitError, emitResult, getCliProjectContext, getCliReadContext } from './operator-shared.js';
+
+const signals: MemoryFeedbackSignal[] = ['user-correction', 'verification-success', 'verification-failure', 'code-change', 'used', 'not-used', 'code-conflict', 'strengthen', 'weaken', 'revoke'];
+
+export default defineCommand({
+  meta: { name: 'feedback', description: 'Record and audit memory feedback' },
+  args: {
+    action: { type: 'positional', description: 'record, show, or audit', required: false },
+    id: { type: 'string', description: 'Candidate id' },
+    kind: { type: 'string', description: 'observation, claim, durable-memory, or workflow' },
+    signal: { type: 'string', description: 'Feedback signal' },
+    source: { type: 'string', description: 'Source reference for the feedback' },
+    actor: { type: 'string', description: 'Actor id or human label' },
+    note: { type: 'string', description: 'Short audit note' },
+    targetEventId: { type: 'string', description: 'Event id to revoke' },
+    limit: { type: 'string', description: 'Maximum audit rows' },
+    json: { type: 'boolean', description: 'Emit JSON' },
+  },
+  async run({ args }) {
+    const action = (args.action as string | undefined) || 'show';
+    const asJson = !!args.json;
+    try {
+      const context = action === 'show' || action === 'audit' ? await getCliReadContext() : await getCliProjectContext({ searchIndex: false });
+      const { project, dataDir } = context;
+      const id = String(args.id || '').trim();
+      const kind = (String(args.kind || 'observation').trim() || 'observation') as FeedbackCandidateKind;
+      if (!id) { emitError('--id is required.', asJson); return; }
+      if (!['observation', 'claim', 'durable-memory', 'workflow'].includes(kind)) { emitError('Invalid --kind.', asJson); return; }
+      const store = new MemoryFeedbackStore();
+      await store.init(dataDir);
+      if (action === 'show') {
+        const result = store.getState(project.id, kind, id);
+        emitResult({ project, result }, JSON.stringify(result, null, 2), asJson);
+        return;
+      }
+      if (action === 'audit') {
+        const result = store.audit(project.id, kind, id, Number(args.limit || 100));
+        emitResult({ project, result }, JSON.stringify(result, null, 2), asJson);
+        return;
+      }
+      if (action !== 'record') { emitError('action must be record, show, or audit.', asJson); return; }
+      const signal = String(args.signal || '').trim() as MemoryFeedbackSignal;
+      const sourceRef = String(args.source || '').trim();
+      if (!signals.includes(signal) || !sourceRef) { emitError(`record requires --signal (${signals.join(', ')}) and --source.`, asJson); return; }
+      const result = store.record({
+        projectId: project.id, candidateKind: kind, candidateId: id, signal, sourceRef,
+        ...(args.actor ? { actor: String(args.actor) } : {}),
+        ...(args.note ? { note: String(args.note) } : {}),
+        ...(args.targetEventId ? { targetEventId: String(args.targetEventId) } : {}),
+      });
+      emitResult({ project, result }, `Recorded ${signal} for ${kind}:${id}; weight=${result.state.weight.toFixed(2)}.`, asJson);
+    } catch (error) {
+      emitError(error instanceof Error ? error.message : String(error), asJson);
+    }
+  },
+});

package/src/cli/commands/resume.ts

@@ -16,6 +16,7 @@ export default defineCommand({
     agent: { type: 'string', description: 'Optional target agent for compatible workflow selection' },
     json: { type: 'boolean', description: 'Emit machine-readable JSON output' },
     briefJson: { type: 'boolean', description: 'Emit only the bounded agent brief and receipt JSON' },
+    fallback: { type: 'boolean', description: 'Mark this as the one-shot MCP-unavailable fallback for the task' },
   },
   async run({ args }) {
     await contextCommand.run?.({
@@ -26,6 +27,7 @@ export default defineCommand({
         agent: args.agent,
         json: args.json,
         briefJson: args.briefJson,
+        fallback: args.fallback,
         resume: true,
       },
       rawArgs: [],

package/src/cli/commands/serve-http.ts

@@ -26,6 +26,7 @@ import { resolveToolProfile } from '../../server/tool-profile.js';
 import { scopeKnowledgeGraphToProject } from '../../memory/graph-scope.js';
 import { projectObservationRetention, summarizeRetentionProjections } from '../../memory/retention.js';
 import { canManageObservation, filterReadableObservations } from '../../memory/visibility.js';
+import { CURRENT_MCP_PROTOCOL_VERSION, MCP_SERVER_NAME, getMcpDiagnostics } from '../../server/mcp-diagnostics.js';
 import { parseTcpPortOrReport } from '../port.js';
 import { mcpFileUriToPath } from '../mcp-root-path.js';
 
@@ -36,6 +37,8 @@ import { mcpFileUriToPath } from '../mcp-root-path.js';
  */
 export const DEFAULT_SESSION_TIMEOUT_MS = 12 * 60 * 60 * 1000;
 export const EXPIRED_SESSION_TTL_MS = 10 * 60 * 1000;
+/** Pinned SDK protocol accepted internally while the HTTP boundary speaks the current stateless contract. */
+export const MCP_SDK_COMPAT_PROTOCOL_VERSION = '2025-11-25';
 
 export function parseSessionTimeoutMs(raw: string | undefined): number {
   const value = raw?.trim();
@@ -116,6 +119,11 @@ export default defineCommand({
     const { findGitInSubdirs } = await import('../../project/detector.js');
     const { writeFileSync, mkdirSync } = await import('node:fs');
     const { homedir } = await import('node:os');
+    // Keep SQLite-backed control-plane helpers lazy. Besides reducing the
+    // handshake import graph, this prevents agent integration tests that mock
+    // node:fs from being evaluated before their mock factories initialize.
+    const { McpBindingStore } = await import('../../server/mcp-binding-store.js');
+    const { MemoryFeedbackStore } = await import('../../memory/feedback.js');
 
     // The [server] config section feeds startup defaults; CLI flags win.
     let configuredDefaults: ServeHttpConfiguredDefaults = {};
@@ -176,11 +184,12 @@ export default defineCommand({
       return store;
     }
 
-    // Bootstrap the initial project's TeamStore. Never open SQLite at $HOME
-    // (that creates a decoy ~/memorix.db). Unresolved launches share ~/.memorix/data.
-    const detectedProj = serveResolution.detectedProject ?? detectorMod.detectProject(projectRoot);
-    const teamDataDir = await persistMod.getProjectDataDir(detectedProj?.id ?? '__unresolved__');
-    const sharedTeamStore = await getTeamStore(teamDataDir);
+    // TeamStore is resolved per MCP session/project. Sharing one mutable
+    // singleton here made project A's coordination state visible to project B
+    // after a roots switch. The cache still reuses the same project's SQLite
+    // handle without crossing project data directories.
+    const statelessBindingStore = new McpBindingStore();
+    await statelessBindingStore.init(persistMod.getBaseDataDir());
 
     type SessionState = {
       transport: InstanceType<typeof StreamableHTTPServerTransport>;
@@ -396,8 +405,95 @@ export default defineCommand({
       // No Access-Control-Allow-Origin at all for disallowed origins —
       // browser will block the response (fail-closed).
       res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-      res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept, Mcp-Session-Id, Last-Event-Id');
-      res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id');
+      res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept, Mcp-Session-Id, Mcp-Project-Handle, Mcp-Project-Root, Mcp-Stateless, Last-Event-Id');
+      res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id, Mcp-Project-Handle, Mcp-Protocol-Version, Mcp-Method, Mcp-Name');
+      res.setHeader('Mcp-Protocol-Version', req.headers['mcp-protocol-version'] || CURRENT_MCP_PROTOCOL_VERSION);
+      res.setHeader('Mcp-Method', req.method || 'UNKNOWN');
+      res.setHeader('Mcp-Name', MCP_SERVER_NAME);
+    }
+
+    /** Handle one 2026 stateless MCP request with a fresh server/transport. */
+    async function handleStatelessPost(req: IncomingMessage, res: ServerResponse, body: unknown): Promise<void> {
+      const handleId = typeof req.headers['mcp-project-handle'] === 'string'
+        ? req.headers['mcp-project-handle']
+        : undefined;
+      const persisted = handleId ? statelessBindingStore.touch(handleId) : undefined;
+      if (handleId && !persisted) {
+        res.writeHead(404, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ jsonrpc: '2.0', error: { code: -32001, message: 'MCP project handle not found or expired; initialize again.' }, id: null }));
+        return;
+      }
+      const requestedRoot = typeof req.headers['mcp-project-root'] === 'string'
+        ? req.headers['mcp-project-root']
+        : undefined;
+      const root = persisted?.projectRoot ?? requestedRoot ?? projectRoot;
+      if (!persisted && !isInitializeRequest(body)) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ jsonrpc: '2.0', error: { code: -32000, message: 'Stateless MCP requests require Mcp-Project-Handle; initialize first.' }, id: null }));
+        return;
+      }
+
+      const { createMemorixServer } = await import('../../server.js');
+      const { createProjectBindingController } = await import('../../server/request-context.js');
+      const binding = createProjectBindingController(root);
+      const { server, projectId, handleTransportClose } = await createMemorixServer(
+        root,
+        undefined,
+        undefined,
+        {
+          allowUntrackedFallback: false,
+          deferProjectInitUntilBound: true,
+          deferProjectRuntimeInit: true,
+          dashboardMode: 'control-plane',
+          dashboardPort: port,
+          toolProfile,
+          projectBinding: binding,
+        },
+      );
+      const transport = new StreamableHTTPServerTransport({
+        // No Mcp-Session-Id: the protocol state is carried by our explicit
+        // durable project handle and reconstructed on every request.
+        sessionIdGenerator: undefined,
+        enableJsonResponse: true,
+      });
+      try {
+        await server.connect(transport);
+        let effectiveHandle = persisted;
+        if (!effectiveHandle && projectId !== '__unresolved__') {
+          effectiveHandle = statelessBindingStore.create({
+            projectId,
+            projectRoot: root,
+            dataDir: await persistMod.getProjectDataDir(projectId),
+          });
+        }
+        if (effectiveHandle) res.setHeader('Mcp-Project-Handle', effectiveHandle.handleId);
+        // The 1.30 SDK predates the 2026-07-28 version string. Keep the
+        // external stateless headers at the current contract, but normalize
+        // only the SDK-facing request and initialize params to its newest
+        // accepted wire version. This is a real compatibility adapter, not a
+        // claim that the pinned SDK implements newer optional extensions.
+        const sdkBody = body && typeof body === 'object'
+          ? JSON.parse(JSON.stringify(body)) as Record<string, any>
+          : body;
+        const sdkRequest = sdkBody as Record<string, any> | undefined;
+        if (sdkRequest && typeof sdkRequest === 'object' && sdkRequest.method === 'initialize' && sdkRequest.params) {
+          sdkRequest.params.protocolVersion = MCP_SDK_COMPAT_PROTOCOL_VERSION;
+        }
+        if (req.headers['mcp-protocol-version']) {
+          req.headers['mcp-protocol-version'] = MCP_SDK_COMPAT_PROTOCOL_VERSION;
+          for (let i = 0; i < req.rawHeaders.length; i += 2) {
+            if (req.rawHeaders[i].toLowerCase() === 'mcp-protocol-version') {
+              req.rawHeaders[i + 1] = MCP_SDK_COMPAT_PROTOCOL_VERSION;
+              break;
+            }
+          }
+        }
+        patchMcpResponse(res);
+        await transport.handleRequest(req, res, sdkBody);
+      } finally {
+        handleTransportClose();
+        await transport.close().catch(() => undefined);
+      }
     }
 
     /**
@@ -407,6 +503,14 @@ export default defineCommand({
       const sessionId = req.headers['mcp-session-id'] as string | undefined;
       const body = await parseBody(req);
 
+      const requestedProtocol = req.headers['mcp-protocol-version'];
+      const statelessRequested = req.headers['mcp-stateless'] === 'true'
+        || requestedProtocol === CURRENT_MCP_PROTOCOL_VERSION;
+      if (!sessionId && statelessRequested) {
+        await handleStatelessPost(req, res, body);
+        return;
+      }
+
       if (sessionId && sessions.has(sessionId)) {
         // Existing session — route to its transport
         sessionLastActivity.set(sessionId, Date.now());
@@ -464,7 +568,7 @@ export default defineCommand({
         const { server, switchProject, handleTransportClose } = await createMemorixServer(
           projectRoot,
           undefined,
-          { teamStore: sharedTeamStore },
+          undefined,
           {
             allowUntrackedFallback: false,
             deferProjectInitUntilBound: true,
@@ -660,6 +764,20 @@ export default defineCommand({
       );
     }
 
+    async function loadProjectFeedback(dataDir: string, projectId: string): Promise<Map<string, { weight: number; status: any }>> {
+      const result = new Map<string, { weight: number; status: any }>();
+      try {
+        const feedback = new MemoryFeedbackStore();
+        await feedback.init(dataDir);
+        for (const state of feedback.listStates(projectId, 'observation')) {
+          result.set(state.candidateId, { weight: state.weight, status: state.status });
+        }
+      } catch {
+        // Older stores without the 1.8 tables retain the pre-feedback posture.
+      }
+      return result;
+    }
+
     // Resolve static directory (dist/dashboard/static)
     const cliDir = pathModule.default.dirname(fileURLToPath(import.meta.url));
     const dashStaticDir = pathModule.default.join(cliDir, '..', 'dashboard', 'static');
@@ -727,10 +845,53 @@ export default defineCommand({
           return;
         }
 
+        const maintenanceMatch = apiPath.match(/^\/maintenance\/(cleanup|deduplicate|consolidate|retention)\/(preview|execute)$/);
+        if (maintenanceMatch) {
+          if (req.method !== 'POST') {
+            sendJson({ error: 'Maintenance actions require POST.' }, 405);
+            return;
+          }
+          const bodyValue = await parseBody(req);
+          const body = bodyValue && typeof bodyValue === 'object' && !Array.isArray(bodyValue)
+            ? bodyValue as Record<string, unknown>
+            : {};
+          const { projectId: maintenanceProjectId, dataDir: maintenanceDataDir } = await resolveRequestProject(url);
+          const maintenanceStore = await getDashboardObservationStore(maintenanceDataDir);
+          const context = {
+            dataDir: maintenanceDataDir,
+            projectId: maintenanceProjectId,
+            projectRoot: maintenanceProjectId === defaultProject.id ? projectRoot : null,
+            store: maintenanceStore,
+          };
+          const maintenance = await import('../../dashboard/maintenance.js');
+          const action = maintenanceMatch[1];
+          const phase = maintenanceMatch[2];
+          let result: unknown;
+          if (action === 'cleanup') {
+            result = phase === 'preview'
+              ? await maintenance.previewCleanup(context, body.includeNoise === true)
+              : await maintenance.executeCleanup(context, body.payload, body.token);
+          } else if (action === 'deduplicate') {
+            result = phase === 'preview'
+              ? await maintenance.previewDeduplicate(context)
+              : await maintenance.executeDeduplicate(context, body.payload, body.token);
+          } else if (action === 'consolidate') {
+            result = phase === 'preview'
+              ? await maintenance.previewConsolidate(context)
+              : await maintenance.executeConsolidate(context, body.payload, body.token);
+          } else {
+            result = phase === 'preview'
+              ? await maintenance.previewRetentionArchive(context)
+              : await maintenance.executeRetentionArchive(context, body.payload, body.token);
+          }
+          sendJson(result);
+          return;
+        }
+
         if (apiPath === '/team') {
           // Phase 4a: All team state is in SQLite via TeamStore
-          const { projectId: teamProjectId } = await resolveRequestProject(url);
-          const ts = sharedTeamStore;
+          const { projectId: teamProjectId, dataDir: teamDataDir } = await resolveRequestProject(url);
+          const ts = await getTeamStore(teamDataDir);
           const scope = url.searchParams.get('scope') || 'project';
 
           // Determine effective project ID for query
@@ -847,6 +1008,7 @@ export default defineCommand({
           const graph = { entities: getGraphStore().loadEntities(), relations: getGraphStore().loadRelations() };
 
           const observations = await loadDashboardProjectObservations(statsDataDir, statsProjectId, 'active');
+          const feedback = await loadProjectFeedback(statsDataDir, statsProjectId);
           const statsStore = await getDashboardObservationStore(statsDataDir);
           const nextId = await statsStore.loadIdCounter();
           const typeCounts: Record<string, number> = {};
@@ -887,7 +1049,10 @@ export default defineCommand({
           const retention = summarizeRetentionProjections(
             observations
               .filter((observation) => observation.type !== 'probe')
-              .map((observation) => projectObservationRetention(observation, { referenceTime: new Date(now) })),
+              .map((observation) => projectObservationRetention(observation, {
+                referenceTime: new Date(now),
+                feedback: feedback.get(String(observation.id)),
+              })),
           );
           const retentionSummary = {
             active: retention.active,
@@ -1006,6 +1171,23 @@ export default defineCommand({
           return;
         }
 
+        if (apiPath === '/evidence') {
+          const { projectId: evidenceProjectId, dataDir: evidenceDataDir } = await resolveRequestProject(url);
+          const { EvidenceCardStore } = await import('../../store/evidence-store.js');
+          const evidenceStore = new EvidenceCardStore();
+          await evidenceStore.init(evidenceDataDir);
+          const observations = await loadDashboardProjectObservations(evidenceDataDir, evidenceProjectId, 'active');
+          evidenceStore.syncObservations(observations);
+          const query = (url.searchParams.get('q') || '').trim().toLowerCase();
+          const limit = Math.min(100, Math.max(1, Number(url.searchParams.get('limit') || 20)));
+          const cards = evidenceStore.list(evidenceProjectId, { limit: 100 })
+            .filter((card) => !query || [card.title, card.summary, card.sourceRef, card.locator ?? ''].join(' ').toLowerCase().includes(query))
+            .slice(0, limit)
+            .map((card) => ({ ...card, events: evidenceStore.listEvents(card.id, 8) }));
+          sendJson({ projectId: evidenceProjectId, cards });
+          return;
+        }
+
         if (apiPath === '/graph') {
           const { projectId: graphProjectId, dataDir: graphDataDir } = await resolveRequestProject(url);
           const { initGraphStore, getGraphStore } = await import('../../store/graph-store.js');
@@ -1030,12 +1212,13 @@ export default defineCommand({
         if (apiPath === '/retention') {
           const { projectId: retProjectId, dataDir: retDataDir } = await resolveRequestProject(url);
           const observations = await loadDashboardProjectObservations(retDataDir, retProjectId, 'active');
+          const feedback = await loadProjectFeedback(retDataDir, retProjectId);
           const referenceTime = new Date();
           const rows = observations
             .filter((observation) => observation.type !== 'probe')
             .map((observation) => ({
               observation,
-              retention: projectObservationRetention(observation, { referenceTime }),
+              retention: projectObservationRetention(observation, { referenceTime, feedback: feedback.get(String(observation.id)) }),
             }))
             .sort((a, b) => b.retention.displayScore - a.retention.displayScore);
           const summary = summarizeRetentionProjections(rows.map((row) => row.retention));
@@ -1499,6 +1682,12 @@ export default defineCommand({
         return;
       }
 
+      if (url.pathname === '/protocol-diagnostics') {
+        res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'public, max-age=60' });
+        res.end(JSON.stringify(getMcpDiagnostics()));
+        return;
+      }
+
       // MCP endpoint
       if (url.pathname === '/mcp') {
         // Ensure Accept header includes both application/json and text/event-stream.

package/src/cli/fallback-budget.ts

@@ -0,0 +1,59 @@
+import { createHash } from 'node:crypto';
+import { getDatabase } from '../store/sqlite-db.js';
+
+export const DEFAULT_FALLBACK_TTL_MS = 10 * 60 * 1000;
+
+export interface FallbackClaim {
+  allowed: boolean;
+  key: string;
+  reason?: string;
+  count: number;
+}
+
+export function fallbackRequestKey(projectId: string, task: string | undefined): string {
+  const normalized = (task ?? '').trim().toLowerCase().replace(/\s+/g, ' ');
+  return createHash('sha256').update(`${projectId}\n${normalized}`).digest('hex').slice(0, 32);
+}
+
+/**
+ * Durable one-shot fallback guard. A failed MCP discovery must not turn into a
+ * loop of help/search/status probes; one bounded context request is enough.
+ */
+export class CliFallbackBudget {
+  private db: any = null;
+
+  async init(dataDir: string): Promise<void> {
+    this.db = getDatabase(dataDir);
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS cli_fallback_attempts (
+        project_id TEXT NOT NULL,
+        request_key TEXT NOT NULL,
+        count INTEGER NOT NULL DEFAULT 0,
+        last_attempt_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL,
+        PRIMARY KEY (project_id, request_key)
+      )
+    `);
+  }
+
+  claim(projectId: string, task: string | undefined, now = Date.now(), ttlMs = DEFAULT_FALLBACK_TTL_MS): FallbackClaim {
+    if (!this.db) throw new Error('CliFallbackBudget is not initialized.');
+    const key = fallbackRequestKey(projectId, task);
+    const current = this.db.prepare(`
+      SELECT count, expires_at FROM cli_fallback_attempts WHERE project_id = ? AND request_key = ?
+    `).get(projectId, key);
+    const count = Number(current?.count ?? 0);
+    if (current && Number(current.expires_at) > now && count >= 1) {
+      return { allowed: false, key, count, reason: 'Fallback budget exhausted for this task. Stop probing and continue with the current project files.' };
+    }
+    this.db.prepare(`
+      INSERT INTO cli_fallback_attempts (project_id, request_key, count, last_attempt_at, expires_at)
+      VALUES (?, ?, 1, ?, ?)
+      ON CONFLICT(project_id, request_key) DO UPDATE SET
+        count = CASE WHEN excluded.expires_at > cli_fallback_attempts.expires_at THEN 1 ELSE cli_fallback_attempts.count + 1 END,
+        last_attempt_at = excluded.last_attempt_at,
+        expires_at = CASE WHEN excluded.expires_at > cli_fallback_attempts.expires_at THEN excluded.expires_at ELSE cli_fallback_attempts.expires_at END
+    `).run(projectId, key, now, now + Math.max(1_000, ttlMs));
+    return { allowed: true, key, count: 1 };
+  }
+}

package/src/cli/index.ts

@@ -248,6 +248,8 @@ const main = defineCommand({
     codegraph: () => import('./commands/codegraph.js').then(m => m.default),
     checkpoint: () => import('./commands/checkpoint.js').then(m => m.default),
     knowledge: () => import('./commands/knowledge.js').then(m => m.default),
+    evidence: () => import('./commands/evidence.js').then(m => m.default),
+    feedback: () => import('./commands/feedback.js').then(m => m.default),
     reasoning: () => import('./commands/reasoning.js').then(m => m.default),
     retention: () => import('./commands/retention.js').then(m => m.default),
     formation: () => import('./commands/formation.js').then(m => m.default),
@@ -318,7 +320,7 @@ const main = defineCommand({
     const firstArg = process.argv[2];
     const knownSubs = ['ask', 'search', 'remember', 'recent', 'help', 'workbench', 'memcode', 'config',
       'init', 'setup', 'integrate', 'memory', 'context', 'resume', 'explain', 'codegraph', 'checkpoint', 'knowledge', 'reasoning', 'retention', 'formation', 'audit', 'transfer', 'skills', 'identity',
-      'session', 'team', 'task', 'message', 'lock', 'handoff', 'poll',
+      'session', 'team', 'task', 'message', 'lock', 'handoff', 'poll', 'evidence', 'feedback',
       'receipt',
       'serve', 'serve-http', 'status', 'sync',
       'hook', 'hooks', 'ingest', 'media', 'git-hook', 'git-hook-uninstall',
@@ -362,6 +364,8 @@ const main = defineCommand({
       console.error('  codegraph  Refresh/status/context-pack for CodeGraph Memory');
       console.error('  checkpoint Inspect native compact continuity checkpoints');
       console.error('  knowledge  Review source-backed knowledge pages and project workflows');
+      console.error('  evidence   Inspect source-backed evidence cards');
+      console.error('  feedback   Record or audit memory feedback');
       console.error('  reasoning  Store/search decision rationale');
       console.error('  retention  Inspect stale/archive status');
       console.error('  formation  Inspect Memory Formation metrics');

package/src/compact/engine.ts

@@ -22,6 +22,8 @@ import { getMiniSkillStore } from '../store/mini-skill-store.js';
 import { miniSkillToDocument, resolveProvenanceStatus, type ProvenanceStatus } from '../skills/mini-skills.js';
 import { redactCredentials } from '../memory/secret-filter.js';
 import { canReadObservation, filterReadableObservations } from '../memory/visibility.js';
+import { getProjectDataDir } from '../store/persistence.js';
+import { MemoryFeedbackStore, feedbackWeightMultiplier } from '../memory/feedback.js';
 
 export function normalizeMemoryBrowseQuery(query: string): string {
   const trimmed = query.trim();
@@ -71,9 +73,32 @@ export async function compactSearch(options: SearchOptions, surface: RetrievalSu
 }> {
   await ensureFreshIndex();
   const searchOptions = { ...options, query: normalizeMemoryBrowseQuery(options.query) };
-  const entries = (await searchObservations(searchOptions)).map((entry) =>
+  let entries = (await searchObservations(searchOptions)).map((entry) =>
     entry.projectId || !options.projectId ? entry : { ...entry, projectId: options.projectId },
   );
+  if (options.projectId) {
+    try {
+      const feedback = new MemoryFeedbackStore();
+      await feedback.init(await getProjectDataDir(options.projectId));
+      const states = feedback.weights(options.projectId, 'observation');
+      entries = entries
+        .map((entry) => {
+          const state = states.get(String(entry.id));
+          if (!state) return entry;
+          return {
+            ...entry,
+            score: (entry.score ?? 0) * feedbackWeightMultiplier(state.weight),
+            feedbackWeight: state.weight,
+            feedbackStatus: state.status,
+          };
+        })
+        .filter((entry) => entry.feedbackStatus !== 'archived' || options.status === 'all')
+        .sort((a, b) => (b.score ?? 0) - (a.score ?? 0));
+    } catch {
+      // Feedback is an enrichment lane. Retrieval remains available if an old
+      // local database has not yet run the 1.8 schema migration.
+    }
+  }
   let formatted = formatIndexTable(entries, searchOptions.query, !options.projectId, surface);
 
   if (entries.length === 0 && options.projectId) {

package/src/config/dotenv-loader.ts

@@ -31,6 +31,8 @@ let dotenvProjectRoot: string | null = null;
 
 /** Track which .env files were loaded (for diagnostics) */
 const loadedEnvFiles: string[] = [];
+const loadedEnvKeys = new Set<string>();
+const loadedEnvValues = new Map<string, string>();
 /** Track keys injected by .env so project switches can cleanly restore process.env */
 const injectedKeys = new Set<string>();
 
@@ -40,6 +42,8 @@ function loadEnvFile(filePath: string): void {
   const parsed = parse(readFileSync(filePath, 'utf-8'));
   for (const [key, value] of Object.entries(parsed)) {
     if (!(key in process.env)) {
+      loadedEnvKeys.add(key);
+      loadedEnvValues.set(key, value);
       process.env[key] = value;
       injectedKeys.add(key);
     }
@@ -68,6 +72,8 @@ export function loadDotenv(projectRoot?: string, options: DotenvLoadOptions = {}
   }
 
   loadedEnvFiles.length = 0;
+  loadedEnvKeys.clear();
+  loadedEnvValues.clear();
 
   // Loading order = priority order (with override: false, first value wins).
   // System env vars already exist in process.env, so they always win.
@@ -96,6 +102,7 @@ export function resetDotenv(): void {
   dotenvLoaded = false;
   dotenvProjectRoot = null;
   loadedEnvFiles.length = 0;
+  loadedEnvKeys.clear();
 }
 
 /**
@@ -105,6 +112,16 @@ export function getLoadedEnvFiles(): readonly string[] {
   return loadedEnvFiles;
 }
 
+/** Get names found in loaded .env files without exposing their values. */
+export function getLoadedEnvKeys(): ReadonlySet<string> {
+  return loadedEnvKeys;
+}
+
+/** Get the value injected by .env, if the current process still has that value. */
+export function getLoadedEnvValue(key: string): string | undefined {
+  return loadedEnvValues.get(key);
+}
+
 // ─── Supported .env variables ───
 // These are the ONLY variables Memorix reads from .env.
 // All are secrets or endpoint URLs — no behavior config.

package/src/dashboard/config-provenance.ts

@@ -0,0 +1,17 @@
+import { getLoadedEnvValue } from '../config/dotenv-loader.js';
+
+export interface DashboardKeySourceOptions {
+  value: string;
+  envKeys: readonly string[];
+  configSource: string;
+}
+
+/** Resolve a secret source using the ordered environment fallback candidates. */
+export function resolveDashboardKeySource({ value, envKeys, configSource }: DashboardKeySourceOptions): string {
+  for (const envKey of envKeys) {
+    const envValue = process.env[envKey];
+    if (envValue !== value) continue;
+    return getLoadedEnvValue(envKey) === envValue ? '.env' : `env:${envKey}`;
+  }
+  return configSource;
+}

package/src/dashboard/evidence.ts

@@ -0,0 +1,63 @@
+import type { Entity, Relation, Observation } from '../types.js';
+
+export interface EvidenceCard {
+  id: number;
+  title: string;
+  type: string;
+  entityName: string;
+  why: string;
+  source: string;
+  sessionId?: string;
+  createdAt: string;
+  updatedAt?: string;
+  status: string;
+  verification: 'unverified' | 'verified' | 'conflicted';
+  files: string[];
+  relatedEntities: string[];
+  correctionHistory: string[];
+}
+
+function relationNeighbors(entityName: string, relations: Relation[]): string[] {
+  return [...new Set(relations.flatMap((relation) => {
+    if (relation.from === entityName) return [relation.to];
+    if (relation.to === entityName) return [relation.from];
+    return [];
+  }))].slice(0, 8);
+}
+
+/** Build bounded, operator-readable evidence cards from persisted records. */
+export function buildEvidenceCards(
+  observations: Observation[],
+  graph: { entities: Entity[]; relations: Relation[] },
+  query = '',
+  limit = 20,
+): EvidenceCard[] {
+  const needle = query.trim().toLowerCase();
+  return observations
+    .filter((observation) => !needle || [observation.title, observation.narrative, observation.entityName, ...(observation.concepts ?? [])]
+      .join(' ').toLowerCase().includes(needle))
+    .sort((a, b) => b.id - a.id)
+    .slice(0, Math.max(1, Math.min(100, limit)))
+    .map((observation) => {
+      const neighbors = relationNeighbors(observation.entityName, graph.relations);
+      const entity = graph.entities.find((candidate) => candidate.name === observation.entityName);
+      const verification = observation.status === 'resolved' ? 'verified' :
+        observation.status === 'archived' ? 'conflicted' : 'unverified';
+      return {
+        id: observation.id,
+        title: observation.title,
+        type: observation.type,
+        entityName: observation.entityName,
+        why: entity ? 'Matched persisted entity and project-scoped evidence.' : 'Matched project-scoped memory record.',
+        source: observation.sourceDetail || observation.source || 'unknown',
+        ...(observation.sessionId ? { sessionId: observation.sessionId } : {}),
+        createdAt: observation.createdAt,
+        ...(observation.updatedAt ? { updatedAt: observation.updatedAt } : {}),
+        status: observation.status || 'active',
+        verification,
+        files: observation.filesModified || [],
+        relatedEntities: neighbors,
+        correctionHistory: [],
+      };
+    });
+}