opencode-swarm 7.145.2 → 7.146.1

package/dist/memory/config.d.ts

@@ -31,6 +31,26 @@ export interface MemoryConfig {
     };
     redaction: {
         rejectDurableSecrets: boolean;
+        /**
+         * #1466: run a PII detector over durable memory text at the write
+         * boundary. Default false — the default install performs no PII
+         * detection (pre-#1466 behavior). When true, a summary (types/counts/
+         * score, never matched text) is attached to proposals.
+         */
+        detectPii: boolean;
+        /**
+         * #1466: which PiiDetector implementation to use. 'regex' (default) is
+         * dependency-free; 'ner' requires the optional
+         * `@xenova/transformers` peer dependency (typed error when absent).
+         */
+        piiDetector: 'regex' | 'ner';
+        /**
+         * #1466: reject durable memory proposals whose PII score EXCEEDS
+         * `piiThreshold` (default 0.7). Rejection is logged to `memory_events`
+         * as `pii_rejected` with types/score only — never matched text.
+         */
+        rejectDurablePii: boolean;
+        piiThreshold: number;
     };
     maintenance: {
         /** @deprecated superseded by `maintenance.importance` (issue #1464); retained for back-compat. */

package/dist/memory/errors.d.ts

@@ -5,3 +5,17 @@ export declare class MemoryValidationError extends Error {
 export declare class MemoryDisabledError extends Error {
     constructor(message?: string);
 }
+/**
+ * #1466: the configured PiiDetector could not run. Thrown fail-closed — an
+ * operator who opted into `memory.redaction.piiDetector: 'ner'` (or into
+ * PII rejection) must get an actionable error, not a silent skip of the
+ * privacy control or a raw ERR_MODULE_NOT_FOUND.
+ *
+ * PR #2310 feedback (PRR-016): extends MemoryValidationError so gateway and
+ * tool-layer callers that branch on the validation-error family (and the
+ * `code` field) handle the opt-in-misconfiguration case through the same
+ * contract as every other write-boundary rejection.
+ */
+export declare class MemoryPiiDetectorError extends MemoryValidationError {
+    constructor(message: string);
+}

package/dist/memory/gateway.d.ts

@@ -48,6 +48,8 @@ export declare class MemoryGateway {
     private readonly vettedRoot;
     private readonly now;
     private disposed;
+    /** #1466: cached PII detector instance (NER keeps its loaded pipeline here). */
+    private piiDetector;
     constructor(context: MemoryContext, options?: MemoryGatewayOptions);
     isEnabled(): boolean;
     dispose(): Promise<void>;
@@ -69,6 +71,34 @@ export declare class MemoryGateway {
     upsertCurated(record: MemoryRecord): Promise<MemoryRecord>;
     recordOutcome(input: RecordMemoryOutcomeInput): Promise<MemoryRecord>;
     applyCuratorDecision(decision: CuratorMemoryDecision): Promise<AppliedMemoryChange>;
+    /**
+     * #1466: single write-boundary validation for every durable-record-
+     * materializing path (propose, upsertCurated, recordOutcome-created
+     * records, applyCuratorDecision).
+     *
+     * ALWAYS runs the full `validateMemoryRecordRules` rule set exactly ONCE
+     * per record (evidence/secret/sentinel rules — including when PII policy
+     * is off, the default). When `detectPii`/`rejectDurablePii` is on, the
+     * configured detector runs first and its findings ride the same single
+     * validation call (threshold logic lives only in the schema funnel). On a
+     * PII rejection the `pii_rejected` audit event is logged (types/score
+     * only, never matched text) before rethrowing; the rejected record is NOT
+     * persisted — storing rejected PII text would defeat the control.
+     *
+     * Returns the parsed record plus a matched-text-free PII summary for
+     * metadata annotation (undefined when nothing was found or detection is
+     * off). A detector that cannot run (opt-in NER without the peer
+     * dependency) fails closed with a typed error — never a silent skip.
+     */
+    private validateRecordWithPiiPolicy;
+    /**
+     * PR #2310 feedback FB-3: free-text that becomes durable memory state
+     * WITHOUT being a MemoryRecord body (outcome `correction` text — up to
+     * 4000 chars, agent-callable, and re-injected into prompts via the
+     * reflection path) must pass the same write-boundary checks: the DD-14
+     * sentinel/bundle bans and, when configured, the PII threshold.
+     */
+    private enforcePiiTextPolicy;
     createRecord(input: {
         kind: MemoryKind;
         text: string;
@@ -81,6 +111,8 @@ export declare class MemoryGateway {
         metadata?: Record<string, unknown>;
         anchors?: MemoryAnchor[];
         outcomes?: MemoryOutcome[];
+        /** #1466: audit reason stamped when this record supersedes another. */
+        supersedesReason?: string;
     }): MemoryRecord;
     private resolveCuratorDecision;
     private createRecordFromNew;

package/dist/memory/index.d.ts

@@ -1,6 +1,6 @@
 export type { MemoryConfig } from './config';
 export { DEFAULT_MEMORY_CONFIG, resolveMemoryConfig } from './config';
-export { MemoryDisabledError, MemoryValidationError } from './errors';
+export { MemoryDisabledError, MemoryPiiDetectorError, MemoryValidationError, } from './errors';
 export { evaluateMemoryRecallFixtures, loadRecallEvaluationFixtures, type RecallEvaluationMetrics, type RecallEvaluationMode, type RecallEvaluationOptions, type RecallEvaluationProviderName, type RecallEvaluationReport, type RecallEvaluationRun, } from './evaluation';
 export type { MemoryGatewayOptions, ProposeMemoryInput, RecallMemoryInput, RecordMemoryOutcomeInput, } from './gateway';
 export { createConfiguredMemoryProvider, createConfiguredMemoryProviderForRoot, createMemoryGateway, MemoryGateway, } from './gateway';
@@ -10,6 +10,7 @@ export { LocalJsonlMemoryProvider } from './local-jsonl-provider';
 export { buildMemoryMaintenanceReport, type MemoryMaintenanceReport, type MemoryMaintenanceReportOptions, type MemoryRecallUsageByMemory, type MemoryRecallUsageByRole, type MemorySupersededChain, shouldCompactMemory, } from './maintenance';
 export { invalidateMemoryStoreDirCache, isMemoryLinked, MEMORY_LINK_POINTER_FILENAME, type MemoryLinkPointer, readMemoryLinkPointer, removeMemoryLinkPointer, resolveMemoryStoreDir, writeMemoryLinkPointer, } from './memory-link';
 export type { MemoryOutcomeEvent } from './outcome-events';
+export { computePiiScore, createPiiDetector, type PiiDetector, type PiiFinding, type PiiType, RegexPiiDetector, summarizePiiFindings, } from './pii';
 export { buildRecallPromptBlock } from './prompt-block';
 export type { MemoryCompactOptions, MemoryCompactResult, MemoryProposalStore, MemoryProvider, MemoryRecallUsageEvent, MemoryRecallUsageFilter, } from './provider';
 export { buildMemoryRecallPlan, type MemoryRecallPlan, type MemoryRecallPlannerInput, } from './recall-planner';
@@ -18,6 +19,6 @@ export { readDeadAnchorMemoryIds, readReflectionDigest, recordOutcomeWithReflect
 export { MEMORY_RECALL_PROFILES, type MemoryRecallProfile, normalizeMemoryAgentRole, resolveMemoryRecallProfile, } from './role-profiles';
 export { appendMemoryRunLog, sanitizeRunId } from './run-log';
 export { computeMemoryContentHash, createBundleId, createMemoryId, createProposalId, isExpired, MemoryAnchorSchema, normalizeMemoryAnchorFile, normalizeMemoryText, validateCuratorMemoryDecision, validateMemoryProposal, validateMemoryRecordRules, } from './schema';
-export { SQLiteMemoryProvider } from './sqlite-provider';
+export { EVENT_CHAIN_GENESIS, MEMORY_EVENTS_CHAIN_HEAD_KEY, type MemoryAuditVerificationReport, type MemoryEventRow, memoryEventRowHash, SQLiteMemoryProvider, verifyMemoryEventChainRows, } from './sqlite-provider';
 export { isCohortRoot, isLocalRoot, resolveVettedMemoryRoot, rootStoragePath, type VettedMemoryRoot, wrapLocalRoot, } from './storage-root';
 export type { AppliedMemoryChange, CuratorMemoryDecision, MemoryAnchor, MemoryContext, MemoryKind, MemoryListFilter, MemoryOutcome, MemoryPatch, MemoryProposal, MemoryRecord, MemoryScopeRef, MemoryScopeType, NewMemoryRecord, RecallBundle, RecallInjectionSkipReason, RecallMode, RecallRequest, RecallResultItem, ResolvedCuratorMemoryDecision, } from './types';

package/dist/memory/pii.d.ts

@@ -0,0 +1,66 @@
+export type PiiType = 'email' | 'phone' | 'credit_card' | 'ssn' | 'ip_address' | 'person' | 'organization' | 'location';
+export interface PiiFinding {
+    type: PiiType;
+    /** The matched text. NEVER persist or log this — findings summaries are
+     * reduced to type/counts/score at every logging boundary. */
+    match: string;
+    /** Detector confidence in [0,1]. The rejection threshold compares the
+     * maximum finding confidence against `memory.redaction.piiThreshold`. */
+    confidence: number;
+}
+export interface PiiDetector {
+    readonly id: 'regex' | 'ner';
+    /** Async because the NER implementation awaits model inference. */
+    detect(text: string): Promise<PiiFinding[]>;
+}
+/**
+ * Score model (#1466): the max finding confidence. A single high-confidence
+ * finding (a Luhn-valid card, an email) is enough to exceed the 0.7 default
+ * threshold; low-confidence families (bare IP addresses at 0.5) are reported
+ * but do not reject on their own.
+ */
+export declare function computePiiScore(findings: PiiFinding[]): number;
+/** Reduce findings to a loggable summary — no matched text leaves this module. */
+export declare function summarizePiiFindings(findings: PiiFinding[]): {
+    score: number;
+    countsByType: Record<string, number>;
+};
+/** Dependency-free detector (default). */
+export declare class RegexPiiDetector implements PiiDetector {
+    readonly id: "regex";
+    detect(rawText: string): Promise<PiiFinding[]>;
+}
+/**
+ * DI seam (repo convention, cf. `src/db/sqlite-loader.ts:_internals`). Tests
+ * inject a fake module loader to exercise both the loaded path and the
+ * absent-module typed-error path without installing a ~110MB model. Production
+ * code never mutates this.
+ */
+export declare const _internals: {
+    requireModule: (id: string) => unknown;
+    reset: () => void;
+};
+/**
+ * Opt-in NER detector. Construction is cheap; the model loads on first
+ * `detect()` (memoized in-flight — PR #2310 feedback FB-5: concurrent first
+ * calls must share one load, the library does not dedupe internally) and is
+ * cached on the instance. Absent peer dependency → typed
+ * `MemoryPiiDetectorError` (fail-closed with an install hint).
+ */
+export declare class NerPiiDetector implements PiiDetector {
+    readonly id: "ner";
+    private pipeline;
+    private pipelinePromise;
+    private loadError;
+    /**
+     * Eagerly verify module availability without loading the model. Available
+     * for callers that want to surface opt-in misconfiguration (e.g. a future
+     * doctor/validate surface) before any text is processed; ordinary callers
+     * hit the same typed error from the first detect().
+     */
+    assertAvailable(): void;
+    private loadModule;
+    private getPipeline;
+    detect(text: string): Promise<PiiFinding[]>;
+}
+export declare function createPiiDetector(kind: 'regex' | 'ner'): PiiDetector;

package/dist/memory/prompt-block.d.ts

@@ -1,5 +1,5 @@
 import type { RecallBundle, RecallResultItem } from './types';
-export declare function buildRecallPromptBlock(items: RecallResultItem[], tokenBudget: number, generatedAt?: string): {
+export declare function buildRecallPromptBlock(items: RecallResultItem[], tokenBudget: number, generatedAt?: string, bundleId?: string): {
     promptBlock: string;
     tokenEstimate: number;
     items: RecallResultItem[];

package/dist/memory/provider.d.ts

@@ -73,6 +73,14 @@ export interface MemoryProvider {
     readonly name: string;
     initialize?(): Promise<void>;
     close?(): Promise<void> | void;
+    /**
+     * Persist a record. #1466 NOTE: the GATEWAY is the PII write boundary —
+     * `MemoryGateway`'s validation funnel runs the configured PII detector
+     * and the full rule set before records reach this method. Direct
+     * provider-level `upsert` calls (dev tooling, evaluation fixtures,
+     * legacy-jsonl migration) intentionally bypass PII enforcement; route
+     * user-facing writes through the gateway when the privacy policy matters.
+     */
     upsert(record: MemoryRecord): Promise<MemoryRecord>;
     appendOutcome?(memoryId: string, event: {
         id: string;
@@ -87,6 +95,13 @@ export interface MemoryProvider {
     listRecallUsage?(filter?: MemoryRecallUsageFilter): Promise<MemoryRecallUsageEvent[]>;
     appendRewardEvent?(event: Omit<MemoryRewardEvent, 'id'>): Promise<void>;
     listRewardEvents?(filter?: MemoryRewardEventFilter): Promise<MemoryRewardEvent[]>;
+    /**
+     * #1466: append a gateway-emitted audit event to the provider's event log
+     * (`memory_events`, hash-chained on the SQLite provider). Narrowly typed to
+     * the PII-rejection operation — provider-internal operations stay internal.
+     * Optional: the local-jsonl provider has no event log and simply omits it.
+     */
+    recordEvent?(operation: 'pii_rejected', targetId: string, reason?: string): Promise<void>;
     compactMaintenance?(options?: MemoryCompactOptions): Promise<MemoryCompactResult>;
     list(filter: MemoryListFilter): Promise<MemoryRecord[]>;
     /**

package/dist/memory/redaction.d.ts

@@ -4,15 +4,27 @@ export interface SecretFinding {
 }
 /**
  * #1850: Coarse redaction-policy fingerprint. Two cohort members with the same
- * count of secret-pattern families and the same `rejectDurableSecrets` setting
- * are considered policy-compatible; a mismatch fails closed at link time and on
+ * count of secret-pattern families and the same redaction toggles are
+ * considered policy-compatible; a mismatch fails closed at link time and on
  * cohort-root open. This is honest about what it measures (the regex pattern
- * count + the durable-rejection toggle) — it is NOT a content hash of stored
+ * count + the durable-rejection toggles) — it is NOT a content hash of stored
  * records. Bump the salt constant when the redaction contract changes
- * meaningfully (e.g. adding PII detection per #1466).
+ * meaningfully (done for #1466: PII detection settings joined the policy).
  */
-export declare const REDACTION_POLICY_SALT = 1;
-export declare function computeRedactionPolicyVersion(rejectDurableSecrets: boolean): number;
+export declare const REDACTION_POLICY_SALT = 2;
+/**
+ * #1466: redaction-policy input. `detectPii`/`rejectDurablePii`/`piiDetector`
+ * are optional so non-memory callers (e.g. the consensus miner, which applies
+ * the default-off policy) keep a one-field call site. Absent PII fields are
+ * treated as off/regex — the pre-#1466 behavior.
+ */
+export interface RedactionPolicyVersionInput {
+    rejectDurableSecrets: boolean;
+    detectPii?: boolean;
+    rejectDurablePii?: boolean;
+    piiDetector?: 'regex' | 'ner';
+}
+export declare function computeRedactionPolicyVersion(policy: RedactionPolicyVersionInput): number;
 export interface MemoryCohortFingerprintInput {
     provider: string;
     redaction_policy_version: number;
@@ -26,10 +38,17 @@ export interface MemoryCohortFingerprintInput {
  * `memory-cohort-config.json` and read back by every consumer.
  *
  * Version 1 is the algorithm below (sorted-key canonical JSON -> sha256 -> first
- * 12 hex chars). Files written before this field existed are treated as
+ * 12 hex chars). Files written before the field existed are treated as
  * version 1, which is exactly correct: they were produced by this same
  * algorithm, so they keep validating with no forced re-link.
  *
+ * Version 2 (#1466): no change to canonicalization, hashing, or truncation —
+ * bumped because `redaction_policy_version` changed its value for unchanged
+ * user config (REDACTION_POLICY_SALT 1→2 with the PII policy fields joining
+ * the input, plus a new secret-pattern family). Per the rule below, a changed
+ * digest for an unchanged input is a version bump so legacy files surface as
+ * "re-run `/swarm memory link`" instead of a false config-mismatch throw.
+ *
  * BUMP THIS whenever a change would alter the digest for an unchanged input —
  * e.g. a different hash, a different truncation length, a change to
  * `stableCanonicalStringify`'s output for a reachable input, or a change to the
@@ -37,7 +56,7 @@ export interface MemoryCohortFingerprintInput {
  * comparing fingerprints, so a bump surfaces as "re-run `/swarm memory link`"
  * instead of being misreported as a real provider/embedding config mismatch.
  */
-export declare const FINGERPRINT_ALGORITHM_VERSION = 1;
+export declare const FINGERPRINT_ALGORITHM_VERSION = 2;
 /**
  * #2062 F-012 (R3 fix): the algorithm version implied by a persisted cohort
  * config that has NO `algorithm_version` field. Every file written before the
@@ -117,6 +136,10 @@ export declare function buildMemoryCohortFingerprintInput(config: {
     provider: string;
     redaction: {
         rejectDurableSecrets: boolean;
+        /** #1466 PII policy fields (optional — pre-#1466 callers omit them). */
+        detectPii?: boolean;
+        rejectDurablePii?: boolean;
+        piiDetector?: 'regex' | 'ner';
     };
     embeddings: {
         model: string;

package/dist/memory/schema.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { type PiiFinding } from './pii';
 import type { CuratorMemoryDecision, MemoryAnchor, MemoryKind, MemoryOutcome, MemoryPatch, MemoryProposal, MemoryRecord, MemoryScopeRef, NewMemoryRecord } from './types';
 export declare const MAX_MEMORY_TEXT_LENGTH = 2000;
 export declare const MAX_MEMORY_ANCHORS = 20;
@@ -147,6 +148,10 @@ export declare const MemoryRecordSchema: z.ZodObject<{
     schemaVersion: z.ZodOptional<z.ZodNumber>;
     providerVersion: z.ZodOptional<z.ZodString>;
     sourceRevision: z.ZodOptional<z.ZodString>;
+    sourceTaskId: z.ZodOptional<z.ZodString>;
+    embeddingModelVersion: z.ZodOptional<z.ZodString>;
+    validFrom: z.ZodOptional<z.ZodString>;
+    supersedesReason: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export declare const MemoryProposalSchema: z.ZodObject<{
     id: z.ZodString;
@@ -237,6 +242,10 @@ export declare const MemoryProposalSchema: z.ZodObject<{
         schemaVersion: z.ZodOptional<z.ZodNumber>;
         providerVersion: z.ZodOptional<z.ZodString>;
         sourceRevision: z.ZodOptional<z.ZodString>;
+        sourceTaskId: z.ZodOptional<z.ZodString>;
+        embeddingModelVersion: z.ZodOptional<z.ZodString>;
+        validFrom: z.ZodOptional<z.ZodString>;
+        supersedesReason: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     targetMemoryId: z.ZodOptional<z.ZodString>;
     relatedMemoryIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -290,6 +299,15 @@ export declare function isExpired(record: MemoryRecord, now?: Date): boolean;
 export declare function hasEvidenceSource(record: MemoryRecord): boolean;
 export declare function validateMemoryRecordRules(record: MemoryRecord, options: {
     rejectDurableSecrets: boolean;
+    /**
+     * #1466: precomputed PII findings for the record text. The DETECTOR is
+     * async (NER), so callers run it and pass results in; this function
+     * owns the threshold decision so it stays the single enforcement point.
+     * Absent findings = no enforcement (JSONL import, maintenance paths).
+     */
+    piiFindings?: PiiFinding[];
+    rejectDurablePii?: boolean;
+    piiThreshold?: number;
 }): MemoryRecord;
 export declare function validateMemoryProposal(proposal: MemoryProposal): MemoryProposal;
 export declare function validateCuratorMemoryDecision(decision: unknown): CuratorMemoryDecision;

package/dist/memory/sentinel.d.ts

@@ -13,3 +13,15 @@
  * the guard can never drift apart.
  */
 export declare const MEMORY_RECALL_SENTINEL = "## Retrieved Swarm Memory";
+/**
+ * #1466 (DD-14): the unforgeable recall-injection anchor. Every injected
+ * recall block embeds the bundle id produced by `createBundleId`
+ * (schema.ts — `bundle_<14 digits>_<8 hex>`), and `messagesContainRecall`
+ * accepts ONLY that marker (plus the write-banned full sentinel header, for
+ * blocks injected by pre-#1466 builds still in flight). Stored memory text
+ * containing the literal `bundle_` prefix is rejected at write time
+ * (`validateMemoryRecordRules`), so no stored memory can forge the anchor.
+ * The regex pins the exact `createBundleId` shape to avoid prose false
+ * positives.
+ */
+export declare const RECALL_BUNDLE_MARKER_RE: RegExp;

package/dist/memory/sqlite-provider.d.ts

@@ -4,6 +4,52 @@ import { type MemoryOutcomeEvent } from './outcome-events';
 import type { MemoryCompactOptions, MemoryCompactResult, MemoryProposalStore, MemoryProvider, MemoryRecallUsageEvent, MemoryRecallUsageFilter, MemoryRewardEvent, MemoryRewardEventFilter, MemoryTransaction } from './provider';
 import type { RecallScoringDiagnostics } from './scoring';
 import type { AppliedMemoryChange, MemoryAnchor, MemoryListFilter, MemoryOutcome, MemoryProposal, MemoryRecord, RecallRequest, RecallResultItem, ResolvedCuratorMemoryDecision } from './types';
+/** #1466: genesis anchor for the memory_events hash chain (mirrors the
+ * knowledge-receipt ledger's GENESIS convention). */
+export declare const EVENT_CHAIN_GENESIS = "GENESIS";
+export declare const MEMORY_EVENTS_CHAIN_HEAD_KEY = "memory_events_chain_head";
+export interface MemoryEventRow {
+    id: string;
+    operation: string;
+    target_id: string;
+    reason: string | null;
+    timestamp: string;
+    event_json: string | null;
+    prev_hash: string | null;
+}
+/**
+ * #1466: SHA-256 over the canonical serialization of a FULL event row
+ * (including its own prev_hash — the chain link is "hash of the entire
+ * previous row", so tampering any field of row n breaks row n+1's link).
+ * Mirrors `receiptRecordHash` in knowledge-receipt-ledger-storage.ts.
+ */
+export declare function memoryEventRowHash(row: MemoryEventRow): string;
+export interface MemoryAuditVerificationReport {
+    supported: boolean;
+    totalRows: number;
+    /** Rows inside the verified hash chain. */
+    chainedRows: number;
+    /** Rows predating migration v13 (NULL prev_hash prefix) — reported, not verified. */
+    legacyRows: number;
+    verified: boolean;
+    /** First divergence, when the chain is broken. */
+    divergence?: {
+        rowId: string;
+        detail: string;
+    };
+    /** Chain-head check against _meta — catches last-row tampering. */
+    headMatch: boolean | null;
+    headExpected?: string;
+    headStored?: string | null;
+}
+/**
+ * #1466: lazily verify the memory_events hash chain over ordered rows. Pure —
+ * takes the already-read rows plus the stored head, returns a report. Used by
+ * `/swarm memory audit-verify` and tests. The chain link is "hash of the full
+ * previous row (including its prev_hash)", so tampering any field of row n
+ * breaks row n+1; the _meta head catches tampering of the LAST row.
+ */
+export declare function verifyMemoryEventChainRows(rows: MemoryEventRow[], storedHead: string | null): MemoryAuditVerificationReport;
 interface Migration {
     version: number;
     name: string;
@@ -135,6 +181,47 @@ export declare class SQLiteMemoryProvider implements MemoryProvider, MemoryPropo
     private runMigrations;
     private backfillScopeKeys;
     private backfillRecallRunIds;
+    /**
+     * #1466 (migration v12 follow-up): backfill `valid_from` for pre-v12 rows
+     * from the record's createdAt (fallback: updated_at). source_task_id /
+     * agent_role / embedding_model_version keep their ALTER TABLE defaults per
+     * the issue's backfill note — migration must not fail on missing data.
+     *
+     * Implemented as a single JSON1 statement (no per-row loop) and executed
+     * via run(): bun's per-Database QUERY cache is strictly bounded (~20
+     * statements, bun 1.3.x) and EVICTED entries are never finalized on close
+     * — on Windows that keeps memory.db locked after close() until GC. run()
+     * does not use that cache; keep new db.query() SQL strings to a minimum.
+     */
+    private backfillProvenanceColumns;
+    /**
+     * #1466 (migration v13 follow-up): deterministically chain all existing
+     * event rows (first row anchored to GENESIS, row n prev_hash = hash of the
+     * full row n-1). Recomputes from row content only — existing prev_hash
+     * values are ignored — so a crash mid-backfill heals identically on the
+     * next init. The _meta head mirrors the last row's hash so last-row
+     * tampering is detectable.
+     */
+    private backfillEventHashChain;
+    /**
+     * #1466: `/swarm memory audit-verify` backend. Lazily recomputes the
+     * memory_events hash chain and the _meta head. Read-only.
+     */
+    verifyAuditChain(): Promise<MemoryAuditVerificationReport>;
+    /**
+     * #1466: true once the memory_events.prev_hash column exists (migration
+     * v13 applied). Memoized positive — the column never disappears — so the
+     * schema probe runs only until the first success.
+     */
+    private eventChainReadyCache;
+    private eventChainColumnReady;
+    /** #1466: gateway-emitted audit events (PII rejection). */
+    recordEvent(operation: 'pii_rejected', targetId: string, reason?: string): Promise<void>;
+    /**
+     * #1466: embedding model version for provenance stamping. Empty when
+     * embeddings are not active for this database.
+     */
+    private embeddingModelVersionStamp;
     private initializeFtsIndex;
     private initializeVecExtension;
     private recreateFtsIndex;
@@ -145,6 +232,8 @@ export declare class SQLiteMemoryProvider implements MemoryProvider, MemoryPropo
     private loadMemories;
     private loadProposals;
     private writeMemory;
+    /** Raw row (WITH provenance columns) for a single memory item. */
+    private readMemoryItemRowById;
     private readMemoryById;
     private readOutcomeEvents;
     private readOutcomeEventsForMemoryIds;
@@ -185,6 +274,10 @@ export declare class SQLiteMemoryProvider implements MemoryProvider, MemoryPropo
     private hasOutcomeEvent;
     private event;
     private insertEvent;
+    /** #1466: see runMigrations / backfillEventHashChain (fresh-DB fast path). */
+    private databaseStartedFresh;
+    private migrationsComplete;
+    private freshInitMigrationEvents;
     private requireDb;
 }
 declare function splitSql(sql: string): string[];

package/dist/memory/types.d.ts

@@ -70,6 +70,15 @@ export interface MemoryRecord {
     providerVersion?: string;
     /** Source git revision of the producer, when available. */
     sourceRevision?: string;
+    /** Unit-of-work (plan task) identity that produced the record. Never
+     * defaulted to sessionID — see MemoryContext.unitId. */
+    sourceTaskId?: string;
+    /** Embedding model version at write time (Phase 4 swaps join on this). */
+    embeddingModelVersion?: string;
+    /** When this memory became authoritative (supersede chains). */
+    validFrom?: string;
+    /** Why this record superseded its predecessor. */
+    supersedesReason?: string;
 }
 export interface MemoryProposal {
     id: string;

package/dist/tools/dispatch-lanes.d.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { type BackgroundDelegationRecord, type BackgroundDelegationWorkflowLaneRecovery } from '../background/pending-delegations.js';
 import { resolveExactMergeBaseAsync, resolvePrWorkflowRevisionDigestAsync } from '../background/workspace-snapshot.js';
+import { loadPluginConfig } from '../config/loader.js';
 import { type PrReviewDepthTier, validatePrWorkflowTransportRecovery } from '../hooks/pr-workflow-gate.js';
 import { buildLaneOrientationBlock } from '../hooks/repo-graph-injection.js';
 import { createParallelDispatcher } from '../parallel/dispatcher/parallel-dispatcher.js';
@@ -90,6 +91,11 @@ declare const DispatchLanesAsyncArgsSchema: z.ZodObject<{
         evidence: z.ZodString;
     }, z.core.$strict>], "result">>>;
     feedback_inventory: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    pr_review_wave_stage: z.ZodOptional<z.ZodEnum<{
+        canary: "canary";
+        fanout: "fanout";
+    }>>;
+    pr_review_wave_attempt: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 declare const CollectLaneResultsArgsSchema: z.ZodObject<{
     batch_id: z.ZodString;
@@ -158,7 +164,7 @@ export interface DispatchLanesResult {
 }
 export interface DispatchLanesAsyncResult {
     success: boolean;
-    failure_class?: 'invalid_args' | 'no_client';
+    failure_class?: 'invalid_args' | 'no_client' | 'circuit_open' | 'retry_exhausted';
     message?: string;
     batch_id: string | null;
     dispatched: number;
@@ -295,6 +301,7 @@ export declare const _internals: {
     getSessionOps: () => SessionOps | null;
     getGeneratedAgentNames: () => readonly string[];
     createParallelDispatcher: typeof createParallelDispatcher;
+    loadPluginConfig: typeof loadPluginConfig;
     resolvePrWorkflowRevisionDigestAsync: typeof resolvePrWorkflowRevisionDigestAsync;
     resolveExactMergeBaseAsync: typeof resolveExactMergeBaseAsync;
     validatePrWorkflowTransportRecovery: typeof validatePrWorkflowTransportRecovery;
@@ -386,6 +393,11 @@ export declare const _test_exports: {
             evidence: z.ZodString;
         }, z.core.$strict>], "result">>>;
         feedback_inventory: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        pr_review_wave_stage: z.ZodOptional<z.ZodEnum<{
+            canary: "canary";
+            fanout: "fanout";
+        }>>;
+        pr_review_wave_attempt: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>;
     DEFAULT_TIMEOUT_MS: number;
     DEFAULT_ASYNC_LAUNCH_TIMEOUT_MS: number;

package/dist/workflow/coder-settlement.d.ts

@@ -80,6 +80,19 @@ export interface CoderSettlementWalState {
     transitionId?: string;
     processId?: number;
     recordedAt?: string;
+    /**
+     * Whether the settlement attributed an accepted mutation. Only meaningful
+     * on COMMITTED WALs — the parser enforces the boolean only for PREPARED
+     * state (workflow-wal-schema.ts), so consumers must compare `=== true`.
+     */
+    accepted?: boolean;
+    /**
+     * The file paths the dispatch declared it would change, as recorded on the
+     * WAL at dispatch time. `null`/absent means no scope was declared. Used to
+     * bind durable Stage-A attribution to the files a gate-tool call actually
+     * scanned, rather than attributing on task-state cardinality alone.
+     */
+    declaredFiles?: string[] | null;
     /** The in-process ownership registry still holds this dispatch (toolAfter never drained it). */
     ownedInProcess: boolean;
     /** A different, still-alive host process owns the dispatch. Never force-releasable from here. */

package/dist/workflow/stage-a-repair.d.ts

@@ -0,0 +1,41 @@
+export type StageARepairOutcome = {
+    taskId: string;
+    outcome: 'repaired';
+    generation: number;
+    transitionId: string;
+} | {
+    taskId: string;
+    outcome: 'skipped_not_wedged';
+    state: string;
+} | {
+    taskId: string;
+    outcome: 'skipped_not_green';
+    reason: 'no_pre_check_bundles' | 'pre_check_failed_or_stale';
+} | {
+    taskId: string;
+    outcome: 'error';
+    message: string;
+};
+export interface StageARepairResult {
+    results: StageARepairOutcome[];
+    truncated: boolean;
+}
+export type PreCheckGreennessResult = {
+    green: true;
+} | {
+    green: false;
+    reason: 'no_pre_check_bundles' | 'pre_check_failed_or_stale';
+};
+/**
+ * Repair path for tasks already wedged at `coder_delegated`
+ * (TASK_WORKFLOW_STAGE_A_REQUIRED post-reset wedge). For each flat task
+ * evidence file whose workflow store sits at `coder_delegated` with no
+ * pre_check gate proof AND a green post-settlement pre-check bundle, emits
+ * the missing `stage_a_passed` transition directly and appends an audit
+ * event. Never re-runs the coder; live DISPATCHED/PREPARED settlement WALs
+ * refuse the transition loudly (CODER_SETTLEMENT_IN_PROGRESS) and surface as
+ * per-task errors without blocking siblings.
+ */
+export declare function repairWedgedStageA(directory: string, options?: {
+    taskIds?: string[];
+}): Promise<StageARepairResult>;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.145.2",
+	"version": "7.146.1",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -108,9 +108,11 @@
 		"repro:1144": "bun scripts/repro-1144.mjs",
 		"repro:1873": "bun build scripts/repro-1873-entry.ts --outdir dist-build-test/repro-1873 --target node --format esm && node scripts/repro-1873.mjs",
 		"check:events": "bun run scripts/check-event-contract.ts",
+		"check:retention": "bun run scripts/check-retention-registry.ts",
 		"check:test-file-cap": "bun run scripts/check-test-file-cap.ts",
 		"check:gate-portability": "bun run scripts/check-gate-portability.ts",
-		"check:bare-spawn": "bun run scripts/check-bare-executable-spawn.ts"
+		"check:bare-spawn": "bun run scripts/check-bare-executable-spawn.ts",
+		"check:memory-recall": "bun run scripts/memory-recall-regression.ts"
 	},
 	"dependencies": {
 		"@opencode-ai/plugin": "^1.18.3",
@@ -130,5 +132,13 @@
 		"bun-types": "1.3.8",
 		"js-yaml": "^4.1.1",
 		"typescript": "^5.7.3"
+	},
+	"peerDependencies": {
+		"@xenova/transformers": "^2.17.2"
+	},
+	"peerDependenciesMeta": {
+		"@xenova/transformers": {
+			"optional": true
+		}
 	}
 }