openclaw-memory-atmem 2.2.6-beta.5 → 2.2.6-beta.6

package/README.md

@@ -22,7 +22,7 @@ Existing AtMem 2.1 users run `atmem openclaw upgrade` after upgrading the Python
 package. This preserves the current memory mode and migration, verifies the new
 bridge with a self-test flight, and rolls back the bridge on failure.
 
-Bridge `2.2.6-beta.5` adds Spec 007 exact task-context delivery. When the host
+Bridge `2.2.6-beta.6` adds Spec 007 exact task-context delivery. When the host
 supplies `taskId` in hook context, the bridge requests only that governed task,
 checks its byte digest, contributes it separately from recalled memory, and
 confirms exposure. With no `taskId`, task delivery stays off and existing

package/dist/index.js

@@ -25,7 +25,7 @@ import { lstat, mkdir, readFile, realpath, rename, unlink, writeFile } from "nod
 import { spawnSync } from "node:child_process";
 import { AtmemClient } from "./src/rpc-client.js";
 import { runSetup } from "./src/setup.js";
-import { NOT_OWNER_MESSAGE, NO_IDENTITY_MESSAGE, describeDecision, isConversationOwner, ok, refusal, sessionIdentityForTool, } from "./src/task-tools.js";
+import { NOT_OWNER_MESSAGE, NO_IDENTITY_MESSAGE, describeDecision, isConversationOwner, ok, resolveBoundTaskForTool, refusal, sessionIdentityForTool, } from "./src/task-tools.js";
 const TAG = "[memory-atmem]";
 const TAKEOVER_GUIDANCE = "<atmem_memory_provider>\n" +
     "AtMem is the active durable-memory provider. " +
@@ -809,7 +809,9 @@ function register(api) {
                         task_id: taskPrepared.task_id ?? ctx.taskId,
                         task_disposition: taskPrepared?.disposition ?? "withheld",
                         task_revision: taskPrepared?.revision,
-                        task_context_sha256: taskPrepared?.context_sha256?.replace(/^sha256:/, ""),
+                        ...(taskPrepared?.context_sha256
+                            ? { task_context_sha256: taskPrepared.context_sha256.replace(/^sha256:/, "") }
+                            : {}),
                         task_reason_codes: taskPrepared?.reason_codes ?? [],
                     });
                 }
@@ -848,6 +850,10 @@ function register(api) {
                     digest_profile: "atmem-context-envelope-canonical-json-v1",
                     context_chars: (prepared.context ?? "").length,
                     candidate_ids: prepared.candidate_ids ?? [],
+                    candidates_considered: prepared.retrieval?.eligible_candidate_count ?? 0,
+                    retrieval_support_class: prepared.retrieval?.decision?.support_class ?? "not_recorded",
+                    retrieval_reason_codes: prepared.retrieval?.decision?.reason_codes ?? [],
+                    retrieval_calibration_version: prepared.retrieval?.decision?.calibration_version,
                     exposure_id: prepared.exposure_id,
                     mode: prepared.mode,
                     context_location: prepared.inject
@@ -1744,13 +1750,20 @@ function register(api) {
                 required: ["item_id", "status", "base_revision"],
             },
             async execute(toolCallId, params) {
-                const identity = sessionIdentityForTool(toolCtx);
-                if (!identity)
-                    return refusal(NO_IDENTITY_MESSAGE);
-                const result = (await callFor(toolCtx, "control_propose_task_delta", {
+                const resolution = await resolveBoundTaskForTool(toolCtx, (identity) => callFor(toolCtx, "control_prepare_task_context", {
                     ...identity,
                     ...taskScope(toolCtx),
-                    task_id: String(params.task_id ?? ""),
+                    host_run_id: toolCtx.runId,
+                }));
+                if (!resolution.ok) {
+                    return refusal(`${resolution.message} (${resolution.reasonCodes.join(", ")})`);
+                }
+                const result = (await callFor(toolCtx, "control_propose_task_delta", {
+                    ...resolution.identity,
+                    ...taskScope(toolCtx),
+                    // Redundant checked assertion. Authority came from the current
+                    // conversation focus above, never from the model's parameters.
+                    task_id: resolution.taskId,
                     base_revision: Number(params.base_revision ?? 0),
                     // Derived from stable host identifiers, never from payload content
                     // or a clock, so a retried tool call collapses to one decision.

package/dist/src/rpc-client.js

@@ -128,7 +128,7 @@ export class AtmemClient {
             capabilities: {},
             clientInfo: {
                 name: "openclaw-memory-atmem",
-                version: "2.2.6-beta.5",
+                version: "2.2.6-beta.6",
             },
         });
         this.notify("notifications/initialized", {});

package/dist/src/task-tools.js

@@ -30,6 +30,29 @@ export function sessionIdentityForTool(ctx) {
         session_epoch: sessionEpoch,
     };
 }
+/** Resolve authority from the authenticated conversation, never model input. */
+export async function resolveBoundTaskForTool(ctx, prepare) {
+    const identity = sessionIdentityForTool(ctx);
+    if (!identity) {
+        return { ok: false, message: NO_IDENTITY_MESSAGE, reasonCodes: ["host_identity_missing"] };
+    }
+    const prepared = (await prepare(identity));
+    if (prepared.disposition !== "injected" || !prepared.task_id) {
+        const reasons = (prepared.reason_codes ?? []).map(String);
+        return {
+            ok: false,
+            message: "This conversation has no active governed task focus. " +
+                "No task progress was recorded.",
+            reasonCodes: reasons.length ? reasons : ["task_context_selection_required"],
+        };
+    }
+    return {
+        ok: true,
+        identity,
+        taskId: String(prepared.task_id),
+        revision: prepared.revision,
+    };
+}
 /** Absence is never permission. Only an explicit affirmative is the owner. */
 export function isConversationOwner(ctx) {
     return ctx.senderIsOwner === true;

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "memory-atmem",
   "name": "Memory (atmem)",
   "description": "OpenClaw bridge installed and managed by the AtMem memory control plane.",
-  "version": "2.2.6-beta.5",
+  "version": "2.2.6-beta.6",
   "commandAliases": ["memory-atmem"],
   "activation": {
     "onStartup": true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-memory-atmem",
-  "version": "2.2.6-beta.5",
+  "version": "2.2.6-beta.6",
   "description": "OpenClaw Agent Black Box and memory control-plane bridge for AtMem",
   "type": "module",
   "main": "./dist/index.js",