opencode-swarm 7.122.1 → 7.124.0

package/dist/knowledge/family-migration-shared.d.ts

@@ -0,0 +1,24 @@
+/**
+ * #1850: shared lock config for family-migration engines.
+ *
+ * Both the knowledge family (`src/knowledge/family-migration.ts`) and the
+ * memory family (`src/memory/memory-family-migration.ts`) use the SAME lock
+ * discipline. Centralizing it here ensures one source of truth — a change to
+ * the stale window or retry policy applies to both subsystems.
+ */
+/**
+ * Lock stale window for the migration critical section. The default
+ * knowledge-store `stale: 5000` (5 s) is too short for an 8+ file merge under
+ * load; a long merge would have its lock stolen by a concurrent writer
+ * mid-flight (issue #1846 critic C9). 30 s comfortably covers worst-case
+ * merges of large corpora.
+ */
+export declare const MIGRATION_LOCK_STALE_MS = 30000;
+/** Retry config for acquiring the migration lock. */
+export declare const MIGRATION_LOCK_RETRIES: {
+    readonly retries: {
+        readonly retries: 10;
+        readonly minTimeout: 100;
+        readonly maxTimeout: 500;
+    };
+};

package/dist/knowledge/family-migration.d.ts

@@ -28,6 +28,11 @@
 import type { CounterRollup } from '../hooks/knowledge-events.js';
 import type { KnowledgeEntryBase } from '../hooks/knowledge-types.js';
 import { type KnowledgeFamilyMember } from './family-manifest.js';
+/**
+ * Lock config for the migration critical section. Re-exported from
+ * `family-migration-shared.ts` (issue #1850) so the memory family migration
+ * engine reuses the SAME values. See the shared module for rationale.
+ */
 export interface FamilyMigrationCounts {
     /** Per-member counts (filename → {merged, skipped}). */
     readonly perMember: ReadonlyArray<{

package/dist/memory/config.d.ts

@@ -38,6 +38,17 @@ export interface MemoryConfig {
     /** Reflection / consolidation pass (issue #1464, Phase 3). */
     consolidation: ConsolidationConfig;
     hardDelete: boolean;
+    /**
+     * #1850 Linked Knowledge 5/5: opt-in cohort memory sharing. Default off —
+     * memory stays worktree-local (today's behavior) unless explicitly enabled.
+     * When enabled AND a memory-link pointer is present, repository-scoped
+     * memory is shared across sibling worktrees through the #1846 cohort
+     * identity. Knowledge link and memory link are independent toggles: linking
+     * knowledge does not imply linking memory.
+     */
+    link: {
+        enabled: boolean;
+    };
     embeddings: {
         enabled: boolean;
         model: string;

package/dist/memory/consolidation-log.d.ts

@@ -1,9 +1,15 @@
+import type { VettedMemoryRoot } from './storage-root';
 /**
  * Durable, append-only record of a completed consolidation pass. Persisted to
  * `.swarm/memory/consolidation-log.jsonl` (invariant #4: runtime state stays
  * under `.swarm/`). Serves two purposes:
  *  - idempotency: a pass for a `phaseNumber` already present here is a no-op;
  *  - observability: the `/swarm memory consolidation-log` CLI reads it.
+ *
+ * #1850 (critic GAP-3): when cohort sharing is active, the log follows the
+ * cohort root (acceptance #4 — consolidation state is part of the vetted-root
+ * surface). Callers may pass a `VettedMemoryRoot` to redirect; a raw directory
+ * string preserves today's local behavior.
  */
 export interface ConsolidationLogRecord {
     phaseNumber: number;
@@ -25,5 +31,5 @@ export interface ConsolidationLogRecord {
     errored: number;
     processedProposalIds: string[];
 }
-export declare function readConsolidationLog(directory: string): Promise<ConsolidationLogRecord[]>;
-export declare function appendConsolidationLog(directory: string, record: ConsolidationLogRecord): Promise<void>;
+export declare function readConsolidationLog(target: string | VettedMemoryRoot): Promise<ConsolidationLogRecord[]>;
+export declare function appendConsolidationLog(target: string | VettedMemoryRoot, record: ConsolidationLogRecord): Promise<void>;

package/dist/memory/finalize-reward-sweep.d.ts

@@ -81,7 +81,7 @@
  * call below).
  */
 import type { MemoryConfig } from '../config/schema';
-import { createConfiguredMemoryProvider } from './gateway';
+import { createConfiguredMemoryProvider, createConfiguredMemoryProviderForRoot } from './gateway';
 import { applyCouncilReward } from './reward-capture';
 /**
  * Negative terminal reward for memories recalled into non-completed
@@ -128,5 +128,6 @@ export declare function runFinalizeRewardSweep(args: FinalizeRewardSweepArgs): P
  */
 export declare const _internals: {
     createConfiguredMemoryProvider: typeof createConfiguredMemoryProvider;
+    createConfiguredMemoryProviderForRoot: typeof createConfiguredMemoryProviderForRoot;
     applyCouncilReward: typeof applyCouncilReward;
 };

package/dist/memory/gateway.d.ts

@@ -1,5 +1,6 @@
 import { type MemoryConfig } from './config';
 import type { MemoryProposalStore, MemoryProvider, MemoryRecallUsageEvent, MemoryRecallUsageFilter } from './provider';
+import { type VettedMemoryRoot } from './storage-root';
 import type { AppliedMemoryChange, CuratorMemoryDecision, MemoryContext, MemoryKind, MemoryListFilter, MemoryProposal, MemoryRecord, MemoryScopeRef, MemorySource, RecallBundle, RecallMode } from './types';
 export interface MemoryGatewayOptions {
     config?: Partial<MemoryConfig>;
@@ -31,6 +32,12 @@ export declare class MemoryGateway {
     private readonly context;
     private readonly config;
     private readonly provider;
+    /**
+     * #1850: the resolved vetted memory root. Used by `deriveAllowedScopes` to
+     * emit a cohort scope when cohort sharing is active, and by `propose` to
+     * stamp provenance. Resolved once at construction (sync pointer read).
+     */
+    private readonly vettedRoot;
     private readonly now;
     private disposed;
     constructor(context: MemoryContext, options?: MemoryGatewayOptions);
@@ -71,3 +78,9 @@ export declare class MemoryGateway {
 }
 export declare function createMemoryGateway(context: MemoryContext, options?: MemoryGatewayOptions): MemoryGateway;
 export declare function createConfiguredMemoryProvider(directory: string, config: MemoryConfig): MemoryProvider & MemoryProposalStore;
+/**
+ * #1850: cohort-aware provider factory. Takes a resolved `VettedMemoryRoot` so
+ * callers that have already resolved (e.g. the finalize-reward sweep) skip the
+ * redundant pointer read. Both overloads converge here.
+ */
+export declare function createConfiguredMemoryProviderForRoot(root: VettedMemoryRoot, config: MemoryConfig): MemoryProvider & MemoryProposalStore;

package/dist/memory/index.d.ts

@@ -3,17 +3,19 @@ export { DEFAULT_MEMORY_CONFIG, resolveMemoryConfig } from './config';
 export { MemoryDisabledError, MemoryValidationError } from './errors';
 export { evaluateMemoryRecallFixtures, loadRecallEvaluationFixtures, type RecallEvaluationMetrics, type RecallEvaluationMode, type RecallEvaluationOptions, type RecallEvaluationProviderName, type RecallEvaluationReport, type RecallEvaluationRun, } from './evaluation';
 export type { MemoryGatewayOptions, ProposeMemoryInput, RecallMemoryInput, } from './gateway';
-export { createConfiguredMemoryProvider, createMemoryGateway, MemoryGateway, } from './gateway';
+export { createConfiguredMemoryProvider, createConfiguredMemoryProviderForRoot, createMemoryGateway, MemoryGateway, } from './gateway';
 export { createMemoryLifecycleHooks, type MemoryLifecycleHookOptions, type MemoryLifecycleHooks, } from './injector';
 export { backupLegacyJsonl, getLegacyJsonlFileStatus, type JsonlBackupResult, type JsonlImportPayload, type JsonlInvalidRow, type JsonlMigrationReport, LEGACY_JSONL_MIGRATION_NAME, LEGACY_JSONL_MIGRATION_VERSION, readLegacyJsonl, readMigrationReport, resolveMemoryStorageDir, resolveSqliteDatabasePath, writeJsonlExport, writeMigrationReport, } from './jsonl-migration';
 export { LocalJsonlMemoryProvider } from './local-jsonl-provider';
 export { buildMemoryMaintenanceReport, type MemoryMaintenanceReport, type MemoryMaintenanceReportOptions, type MemoryRecallUsageByMemory, type MemoryRecallUsageByRole, type MemorySupersededChain, shouldCompactMemory, } from './maintenance';
+export { invalidateMemoryStoreDirCache, isMemoryLinked, MEMORY_LINK_POINTER_FILENAME, type MemoryLinkPointer, readMemoryLinkPointer, removeMemoryLinkPointer, resolveMemoryStoreDir, writeMemoryLinkPointer, } from './memory-link';
 export { buildRecallPromptBlock } from './prompt-block';
 export type { MemoryCompactOptions, MemoryCompactResult, MemoryProposalStore, MemoryProvider, MemoryRecallUsageEvent, MemoryRecallUsageFilter, } from './provider';
 export { buildMemoryRecallPlan, type MemoryRecallPlan, type MemoryRecallPlannerInput, } from './recall-planner';
-export { findSecrets, redactSecrets } from './redaction';
+export { buildMemoryCohortFingerprintInput, computeMemoryCohortFingerprint, computeRedactionPolicyVersion, findSecrets, redactSecrets, } from './redaction';
 export { MEMORY_RECALL_PROFILES, type MemoryRecallProfile, normalizeMemoryAgentRole, resolveMemoryRecallProfile, } from './role-profiles';
 export { appendMemoryRunLog, sanitizeRunId } from './run-log';
 export { computeMemoryContentHash, createBundleId, createMemoryId, createProposalId, isExpired, normalizeMemoryText, validateCuratorMemoryDecision, validateMemoryProposal, validateMemoryRecordRules, } from './schema';
 export { SQLiteMemoryProvider } from './sqlite-provider';
+export { isCohortRoot, isLocalRoot, resolveVettedMemoryRoot, rootStoragePath, type VettedMemoryRoot, wrapLocalRoot, } from './storage-root';
 export type { AppliedMemoryChange, CuratorMemoryDecision, MemoryContext, MemoryKind, MemoryListFilter, MemoryPatch, MemoryProposal, MemoryRecord, MemoryScopeRef, MemoryScopeType, NewMemoryRecord, RecallBundle, RecallInjectionSkipReason, RecallMode, RecallRequest, RecallResultItem, ResolvedCuratorMemoryDecision, } from './types';

package/dist/memory/local-jsonl-provider.d.ts

@@ -5,11 +5,22 @@ import type { AppliedMemoryChange, MemoryListFilter, MemoryProposal, MemoryRecor
 export declare class LocalJsonlMemoryProvider implements MemoryProvider, MemoryProposalStore {
     readonly name = "local-jsonl";
     private readonly rootDirectory;
+    /**
+     * #1850: when set, the provider serves a cohort-shared store. Cohort roots
+     * bypass `validateSwarmPath` (constructed by the resolver from a sanitized
+     * linkId). `null` for local-root providers (today's behavior).
+     */
+    private readonly cohortRoot;
     private readonly config;
     private initialized;
     private memories;
     private proposals;
-    constructor(rootDirectory: string, config?: Partial<MemoryConfig>);
+    constructor(rootDirectory: string, config?: Partial<MemoryConfig>, vettedCohortRoot?: string | null);
+    /**
+     * #1850 (critic GAP-5): explicit cohort-root path branch.
+     * - cohort root → `<cohortRoot>/<filename>` (NO validateSwarmPath).
+     * - local root → existing behavior: strip `.swarm/`, validateSwarmPath.
+     */
     private pathFor;
     initialize(): Promise<void>;
     upsert(record: MemoryRecord): Promise<MemoryRecord>;
@@ -34,6 +45,19 @@ export declare class LocalJsonlMemoryProvider implements MemoryProvider, MemoryP
     compact(): Promise<void>;
     compactMaintenance(options?: MemoryCompactOptions): Promise<MemoryCompactResult>;
     private audit;
+    /**
+     * #1850 (critic CONCERN-1): bump the cohort generation marker so sibling
+     * worktrees observe this write on their next revalidation. Called at the
+     * provider layer so ALL write paths invalidate peers. Local writes are
+     * no-ops. Best-effort: a bump failure must never block the write.
+     */
+    private bumpCohortGeneration;
+    /**
+     * #1850 (KC-001 fix): mirror the SQLite provider's fingerprint check. Reads
+     * `memory-cohort-config.json` and throws on mismatch. Absent/malformed file
+     * is permissive (fail-open never strands memory).
+     */
+    private assertCohortConfigFingerprint;
     private activeMemory;
     private validateDecisionMemory;
 }

package/dist/memory/memory-family-manifest.d.ts

@@ -0,0 +1,52 @@
+/**
+ * #1850 Linked Knowledge 5/5: memory family manifest.
+ *
+ * One authoritative inventory of every memory artifact, classified by scope
+ * and merge strategy. Drives `migrateMemoryFamily` so a new artifact cannot be
+ * silently omitted from link/unlink migration (issue #1850 acceptance #7).
+ *
+ * Mirrors the structure of `KNOWLEDGE_FAMILY` in
+ * `src/knowledge/family-manifest.ts` but is memory-specific. The two
+ * manifests are deliberately separate: knowledge uses text/JSONL merge
+ * strategies; memory has a binary SQLite blob whose merge strategy is
+ * fundamentally different (ATTACH + INSERT OR IGNORE).
+ *
+ * Scope classifications:
+ *  - `canonical`  — data that must be migrated to preserve cohort state.
+ *  - `derived`    — rebuildable state (FTS shadow tables, vec0 index,
+ *                   embedding cache). Travels inside `memory.db` for SQLite;
+ *                   rebuilt on first open if missing. Not migrated separately.
+ *
+ * Merge strategies:
+ *  - `sqlite-file-copy` — whole-DB file copy under exclusive lock; for
+ *                         non-empty destinations, ATTACH + INSERT OR IGNORE
+ *                         keyed by record id (critic CONCERN-6).
+ *  - `append-union`     — id-keyed union of append-only JSONL (reuses the
+ *                         knowledge-family pattern).
+ *  - `skip`             — not migrated (derived state rebuilt on open).
+ */
+export type MemoryFamilyMergeStrategy = 'sqlite-file-copy' | 'append-union' | 'skip';
+export type MemoryFamilyScope = 'canonical' | 'derived';
+export interface MemoryFamilyMember {
+    filename: string;
+    scope: MemoryFamilyScope;
+    mergeStrategy: MemoryFamilyMergeStrategy;
+    /** Human-readable note for diagnostics. */
+    note?: string;
+}
+/**
+ * The canonical memory family manifest. Adding a member here automatically
+ * includes it in link + unlink migration (mirrors `KNOWLEDGE_FAMILY`).
+ *
+ * NOTE: for SQLite-provider cohort members, only `memory.db` is migrated as a
+ * binary blob; the JSONL members are migrated ONLY when a cohort member uses
+ * the `local-jsonl` provider (rare — JSONL is legacy/debug mode per schema).
+ * The migration engine skips JSONL members when the source uses SQLite, and
+ * vice versa, so a mixed-provider cohort fails closed with a diagnostic
+ * (acceptance #10) rather than silently losing data.
+ */
+export declare const MEMORY_FAMILY: readonly MemoryFamilyMember[];
+/** Filenames that are actually migrated (not skipped). */
+export declare const MIGRATED_MEMORY_FILENAMES: readonly string[];
+/** Look up a member by filename. */
+export declare function findMemoryFamilyMember(filename: string): MemoryFamilyMember | undefined;

package/dist/memory/memory-family-migration.d.ts

@@ -0,0 +1,94 @@
+/**
+ * #1850 Linked Knowledge 5/5: cohort memory family migration engine.
+ *
+ * Drives both `/swarm memory link` and `/swarm memory unlink` off the single
+ * {@link MEMORY_FAMILY} manifest. Mirrors the architecture of
+ * `src/knowledge/family-migration.ts` (issue #1846) but is memory-specific:
+ *
+ *  - JSONL members use `append-union` (id-keyed, idempotent on retry) — the
+ *    same primitive the knowledge family uses.
+ *  - The SQLite `memory.db` uses `sqlite-file-copy`: under an exclusive lock,
+ *    checkpoint+close the source, copy the file into a staging path, validate
+ *    by opening read-only and counting rows, then either (a) atomically rename
+ *    into an empty destination, or (b) for a non-empty destination, ATTACH the
+ *    staged DB and `INSERT OR IGNORE` keyed by id (critic CONCERN-6).
+ *
+ * All-or-nothing commit (issue #1850 acceptance #7): stage → validate →
+ * commit. The memory-link pointer is flipped LAST by the caller
+ * (`handleMemoryLinkCommand`), so a mid-migration failure leaves the worktree
+ * in its prior link state and a retry is idempotent.
+ *
+ * Lock discipline: `proper-lockfile` on the destination cohort dir with a
+ * bumped `stale` (30s) for the migration critical section — reused from the
+ * knowledge family so there is one source of truth for the lock config.
+ *
+ * No writes happen here on the plugin-init path (invariant 1). Called only
+ * from the `/swarm memory link` / `/swarm memory unlink` command handlers.
+ */
+import type { VettedMemoryRoot } from './storage-root.js';
+export interface MemoryFamilyMigrationCounts {
+    readonly perMember: ReadonlyArray<{
+        filename: string;
+        merged: number;
+        skipped: number;
+    }>;
+}
+/** Id-keyed union of two append-only JSONL arrays (idempotent on retry). */
+declare function appendUnionById<T>(destination: T[], source: T[]): {
+    merged: T[];
+    added: number;
+    skipped: number;
+};
+/** Serialize a merged JSONL member. */
+declare function serializeJsonl(values: unknown[]): string;
+/** Validate a serialized JSONL member: every line must parse and carry an id. */
+declare function validateSerializedJsonl(serialized: string): boolean;
+/**
+ * Copy the SQLite DB file (+ non-empty WAL/SHM sidecars) from source to a
+ * staging path under the destination directory. The caller MUST have drained
+ * and closed the source provider first (the command handler does this via
+ * `evictAndCloseForRoot`).
+ *
+ * Returns the staging path, or null if the source DB does not exist.
+ */
+declare function stageSqliteDb(sourceStoragePath: string, destDir: string): {
+    stagedPath: string;
+} | null;
+/**
+ * Merge a staged SQLite DB into the destination. If the destination has no
+ * existing DB, atomically rename the staged file into place. If the
+ * destination has an existing DB, ATTACH the staged DB and INSERT OR IGNORE
+ * rows keyed by id (critic CONCERN-6 — two worktrees linking concurrently
+ * must not overwrite each other's data).
+ *
+ * NOTE: this function does NOT open the DB via the provider (that would
+ * re-enter the pool). It uses a minimal direct-open to copy rows. The
+ * destination provider will re-open and rebuild FTS/vec on next access.
+ */
+declare function mergeStagedSqlite(destStoragePath: string, stagedPath: string): Promise<{
+    merged: number;
+    skipped: number;
+}>;
+/** Best-effort row count via a direct DB open (does not enter the pool). */
+declare function countRowsSafe(dbPath: string): Promise<number>;
+/**
+ * Migrate the complete memory family from `sourceRoot` into `destRoot`,
+ * merging each member according to its manifest strategy. All-or-nothing:
+ * stage → validate → commit. The memory-link pointer is NOT touched here
+ * (caller flips it).
+ *
+ * @param destRoot the cohort root that absorbs the merge (link → cohort;
+ *   unlink → local).
+ * @param sourceRoot the root whose family is merged in (link → local;
+ *   unlink → cohort).
+ */
+export declare function migrateMemoryFamily(destRoot: VettedMemoryRoot, sourceRoot: VettedMemoryRoot): Promise<MemoryFamilyMigrationCounts>;
+export declare const _internals: {
+    appendUnionById: typeof appendUnionById;
+    serializeJsonl: typeof serializeJsonl;
+    validateSerializedJsonl: typeof validateSerializedJsonl;
+    stageSqliteDb: typeof stageSqliteDb;
+    mergeStagedSqlite: typeof mergeStagedSqlite;
+    countRowsSafe: typeof countRowsSafe;
+};
+export {};

package/dist/memory/memory-link.d.ts

@@ -0,0 +1,103 @@
+/**
+ * #1850 Linked Knowledge 5/5: memory link pointer + resolution cache.
+ *
+ * Mirrors `src/hooks/knowledge-link.ts` for the memory subsystem. The pointer
+ * lives at `<directory>/.swarm/memory-link.json` — a SEPARATE pointer from the
+ * knowledge `link.json`. This deliberate split satisfies issue #1850 acceptance
+ * #1 (memory sharing is independently opt-in) and #2 (status distinguishes
+ * knowledge link from memory link). Both pointers carry the same canonical
+ * cohort id from #1846 — they identify the same cohort — but toggling one does
+ * not toggle the other.
+ *
+ * The shared cohort store lives at `<dataDir>/links/<linkId>/` (reusing
+ * `resolveLinkBaseDir` / `resolveLinkDir` from `knowledge-link.ts`). Memory
+ * occupies the `memory/` subdirectory of that cohort container, keeping
+ * knowledge and memory family files siblings without filename collisions.
+ *
+ * Reuses from `knowledge-link.ts`:
+ *  - `resolveLinkBaseDir`, `resolveLinkDir`, `sanitizeLinkId` — the cohort
+ *    directory layout and id sanitization are shared infrastructure (one
+ *    cohort container per cohort id).
+ *
+ * Does NOT duplicate the platform data-dir logic (Windows LOCALAPPDATA, macOS
+ * Application Support, linux XDG) — that lives once in `knowledge-link.ts`.
+ *
+ * Cross-process revalidation (issue #1850 §6 "bounded revalidation window"):
+ * like the knowledge resolver, a cache hit re-stats the pointer file and
+ * invalidates on `mtimeMs:ctimeMs:size` change, so a sibling worktree's
+ * `/swarm memory link` / `/swarm memory unlink` is observed without restart
+ * and without waiting for the TTL backstop.
+ */
+import { resolveLinkBaseDir, resolveLinkDir, sanitizeLinkId } from '../hooks/knowledge-link.js';
+/** On-disk pointer at `<directory>/.swarm/memory-link.json`. */
+export interface MemoryLinkPointer {
+    /** Pointer schema version. */
+    version: 1 | 2;
+    /** Sanitized link id (cohort directory segment). */
+    linkId: string;
+    /** Human-friendly name when the link was created from an explicit name. */
+    name?: string;
+    /** ISO 8601 creation timestamp. */
+    createdAt: string;
+    /** Canonical cohort id from `resolveCohortId` (issue #1846). */
+    cohortId?: string;
+    /** How the cohort id was derived. */
+    identitySource?: 'remote' | 'git-common-dir' | 'path';
+    /** True when the cohort id is machine-local (not portable). */
+    degraded?: boolean;
+    /** Memory cohort config fingerprint (provider/schema/embedding/redaction). */
+    configFingerprint?: string;
+    /** Monotonic generation counter, bumped on each link/unlink. */
+    generation?: number;
+}
+export declare const MEMORY_LINK_POINTER_FILENAME = "memory-link.json";
+/**
+ * Read and validate the memory link pointer for a worktree. Null if absent or
+ * malformed (fail-open — a corrupt pointer never strands memory; it degrades
+ * to local).
+ */
+export declare function readMemoryLinkPointer(directory: string): MemoryLinkPointer | null;
+/** Write the memory link pointer atomically and invalidate the cache. */
+export declare function writeMemoryLinkPointer(directory: string, pointer: MemoryLinkPointer): Promise<void>;
+/** Remove the memory link pointer (idempotent) and invalidate the cache. */
+export declare function removeMemoryLinkPointer(directory: string): Promise<void>;
+/**
+ * Build the stat fingerprint for the pointer file. Returns null when absent
+ * (so an absent→present transition is detected as a change). Includes ctimeMs
+ * because Windows rename preserves mtimeMs (mirrors knowledge-link.ts:365).
+ */
+declare function pointerStatFingerprint(directory: string): string | null;
+/**
+ * Resolve the directory that holds the cohort store for `directory`.
+ *
+ * Returns the shared link directory (`<dataDir>/links/<linkId>`) when an active
+ * memory-link pointer is present, otherwise the local `<directory>/.swarm`.
+ * Fail-open: any read/parse error degrades to local. Synchronous and cached;
+ * on a cache hit a cheap `stat` revalidates cross-process changes so the hot
+ * recall path stays fast while observing link/unlink without TTL wait.
+ *
+ * NOTE: when unlinked, the return value is byte-identical to
+ * `path.join(directory, '.swarm')`, so callers are unaffected.
+ *
+ * Memory occupies `<result>/memory/`. The caller (`resolveVettedMemoryRoot`)
+ * appends `memory` to namespace within the cohort container.
+ */
+export declare function resolveMemoryStoreDir(directory: string): string;
+/** Drop cached resolution(s). Pass a directory to invalidate one, omit for all. */
+export declare function invalidateMemoryStoreDirCache(directory?: string): void;
+/** True when the worktree currently redirects to a shared cohort store. */
+export declare function isMemoryLinked(directory: string): boolean;
+/** Surface an orphaned local memory store if the link pointer is active. */
+export declare function warnIfMemoryOrphaned(directory: string): void;
+export declare const _internals: {
+    resolveMemoryStoreDir: typeof resolveMemoryStoreDir;
+    readMemoryLinkPointer: typeof readMemoryLinkPointer;
+    writeMemoryLinkPointer: typeof writeMemoryLinkPointer;
+    removeMemoryLinkPointer: typeof removeMemoryLinkPointer;
+    invalidateMemoryStoreDirCache: typeof invalidateMemoryStoreDirCache;
+    resolveLinkDir: typeof resolveLinkDir;
+    resolveLinkBaseDir: typeof resolveLinkBaseDir;
+    sanitizeLinkId: typeof sanitizeLinkId;
+    pointerStatFingerprint: typeof pointerStatFingerprint;
+};
+export { resolveLinkDir, resolveLinkBaseDir, sanitizeLinkId };

package/dist/memory/provider-pool.d.ts

@@ -1,5 +1,6 @@
 import type { MemoryConfig } from './config';
 import type { MemoryProposalStore, MemoryProvider } from './provider';
+import type { VettedMemoryRoot } from './storage-root';
 /**
  * Return true if the provider is currently managed by the pool.
  *
@@ -22,8 +23,42 @@ export declare function isPooledProvider(provider: MemoryProvider & Partial<Memo
  * Note: this function returns synchronously. The provider's actual database
  * open happens lazily inside `provider.initialize()`, which callers await
  * separately (and which is protected by the provider's own init mutex).
+ *
+ * #1850: callers that have resolved a `VettedMemoryRoot` should prefer
+ * `getOrCreateProviderForRoot` so the cohort dimension (cohort id + generation)
+ * is part of the pool key. This legacy entry treats `directory` as a local
+ * root (cohort sharing inactive for that caller — emits a debug log per
+ * critic CONCERN-5 so incomplete wiring is visible).
  */
 export declare function getOrCreateProvider(directory: string, config: MemoryConfig): MemoryProvider & MemoryProposalStore;
+/**
+ * #1850: cohort-aware provider acquisition. The pool key incorporates the
+ * root kind + canonical path + cohort generation, so:
+ *   - the same cohort root always converges on the same pool entry (acceptance #5);
+ *   - a generation bump (observed via the `memory-link.json` pointer-stat
+ *     revalidation in `resolveVettedMemoryRoot`) invalidates the stale entry
+ *     so the in-memory mirror is reloaded (acceptance #8).
+ *
+ * NOTE (final-critic correction): the `memory.gen` marker written by providers
+ * on cohort writes is NOT consumed by this pool today. Cross-process write
+ * visibility relies on SQLite WAL mode (readers see committed writes on the
+ * next query) plus the 2s TTL + pointer-stat revalidation in
+ * `resolveMemoryStoreDir`. The `memory.gen` marker is reserved for a future
+ * tighter revalidation loop and is safe to write (best-effort, never blocks).
+ *
+ * Revalidation: on each call for a cohort root, the caller is expected to have
+ * already resolved the current generation (the resolver does this via
+ * `memory-link.json` pointer-stat). If the generation in the supplied root
+ * differs from the cached entry's generation, the cached entry is evicted and
+ * a fresh provider is constructed (which reloads the in-memory mirror).
+ */
+export declare function getOrCreateProviderForRoot(root: VettedMemoryRoot, config: MemoryConfig): MemoryProvider & MemoryProposalStore;
+/**
+ * #1850: scoped eviction — close and drop the pool entry for a specific root
+ * (used by the migration engine before file copy). Waits for refCount=0 via
+ * the deferred mechanism if held; callers should retry-acquire or fail closed.
+ */
+export declare function evictAndCloseForRoot(root: VettedMemoryRoot): void;
 /**
  * Release a pooled provider back to the pool by decrementing its refCount.
  *

package/dist/memory/redaction.d.ts

@@ -2,6 +2,37 @@ export interface SecretFinding {
     type: string;
     match: string;
 }
+/**
+ * #1850: Coarse redaction-policy fingerprint. Two cohort members with the same
+ * count of secret-pattern families and the same `rejectDurableSecrets` setting
+ * are considered policy-compatible; a mismatch fails closed at link time and on
+ * cohort-root open. This is honest about what it measures (the regex pattern
+ * count + the durable-rejection toggle) — it is NOT a content hash of stored
+ * records. Bump the salt constant when the redaction contract changes
+ * meaningfully (e.g. adding PII detection per #1466).
+ */
+export declare const REDACTION_POLICY_SALT = 1;
+export declare function computeRedactionPolicyVersion(rejectDurableSecrets: boolean): number;
+export interface MemoryCohortFingerprintInput {
+    provider: string;
+    redaction_policy_version: number;
+    embedding_model: string;
+    embedding_dimension: number;
+    embedding_version: string;
+}
+export declare function computeMemoryCohortFingerprint(input: MemoryCohortFingerprintInput): string;
+/** Convenience: build the fingerprint input from a memory config subset. */
+export declare function buildMemoryCohortFingerprintInput(config: {
+    provider: string;
+    redaction: {
+        rejectDurableSecrets: boolean;
+    };
+    embeddings: {
+        model: string;
+        dimension: number;
+        version?: string;
+    };
+}): MemoryCohortFingerprintInput;
 export declare function findSecrets(text: string): SecretFinding[];
 export declare function containsSecret(text: string): boolean;
 export declare function redactSecrets(text: string): string;

package/dist/memory/schema.d.ts

@@ -7,6 +7,7 @@ export declare const MemoryScopeTypeSchema: z.ZodEnum<{
     global_user: "global_user";
     repository: "repository";
     run: "run";
+    cohort: "cohort";
 }>;
 export declare const MemoryScopeRefSchema: z.ZodObject<{
     type: z.ZodEnum<{
@@ -16,6 +17,7 @@ export declare const MemoryScopeRefSchema: z.ZodObject<{
         global_user: "global_user";
         repository: "repository";
         run: "run";
+        cohort: "cohort";
     }>;
     userId: z.ZodOptional<z.ZodString>;
     workspaceId: z.ZodOptional<z.ZodString>;
@@ -24,6 +26,7 @@ export declare const MemoryScopeRefSchema: z.ZodObject<{
     repoRoot: z.ZodOptional<z.ZodString>;
     runId: z.ZodOptional<z.ZodString>;
     agentId: z.ZodOptional<z.ZodString>;
+    cohortId: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export declare const MemoryKindSchema: z.ZodEnum<{
     evidence: "evidence";
@@ -67,6 +70,7 @@ export declare const MemoryRecordSchema: z.ZodObject<{
             global_user: "global_user";
             repository: "repository";
             run: "run";
+            cohort: "cohort";
         }>;
         userId: z.ZodOptional<z.ZodString>;
         workspaceId: z.ZodOptional<z.ZodString>;
@@ -75,6 +79,7 @@ export declare const MemoryRecordSchema: z.ZodObject<{
         repoRoot: z.ZodOptional<z.ZodString>;
         runId: z.ZodOptional<z.ZodString>;
         agentId: z.ZodOptional<z.ZodString>;
+        cohortId: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     kind: z.ZodEnum<{
         evidence: "evidence";
@@ -125,6 +130,13 @@ export declare const MemoryRecordSchema: z.ZodObject<{
     supersededBy: z.ZodOptional<z.ZodString>;
     contentHash: z.ZodString;
     metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    cohortId: z.ZodOptional<z.ZodString>;
+    producerSessionId: z.ZodOptional<z.ZodString>;
+    producerAgentRole: z.ZodOptional<z.ZodString>;
+    redactionPolicyVersion: z.ZodOptional<z.ZodNumber>;
+    schemaVersion: z.ZodOptional<z.ZodNumber>;
+    providerVersion: z.ZodOptional<z.ZodString>;
+    sourceRevision: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export declare const MemoryProposalSchema: z.ZodObject<{
     id: z.ZodString;
@@ -146,6 +158,7 @@ export declare const MemoryProposalSchema: z.ZodObject<{
                 global_user: "global_user";
                 repository: "repository";
                 run: "run";
+                cohort: "cohort";
             }>;
             userId: z.ZodOptional<z.ZodString>;
             workspaceId: z.ZodOptional<z.ZodString>;
@@ -154,6 +167,7 @@ export declare const MemoryProposalSchema: z.ZodObject<{
             repoRoot: z.ZodOptional<z.ZodString>;
             runId: z.ZodOptional<z.ZodString>;
             agentId: z.ZodOptional<z.ZodString>;
+            cohortId: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>;
         kind: z.ZodEnum<{
             evidence: "evidence";
@@ -204,6 +218,13 @@ export declare const MemoryProposalSchema: z.ZodObject<{
         supersededBy: z.ZodOptional<z.ZodString>;
         contentHash: z.ZodString;
         metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        cohortId: z.ZodOptional<z.ZodString>;
+        producerSessionId: z.ZodOptional<z.ZodString>;
+        producerAgentRole: z.ZodOptional<z.ZodString>;
+        redactionPolicyVersion: z.ZodOptional<z.ZodNumber>;
+        schemaVersion: z.ZodOptional<z.ZodNumber>;
+        providerVersion: z.ZodOptional<z.ZodString>;
+        sourceRevision: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     targetMemoryId: z.ZodOptional<z.ZodString>;
     relatedMemoryIds: z.ZodOptional<z.ZodArray<z.ZodString>>;