superlocalmemory 3.7.8 → 3.8.1

package/src/superlocalmemory/storage/migration_runner.py

@@ -92,6 +92,36 @@ from superlocalmemory.storage.migrations import (
 from superlocalmemory.storage.migrations import (
     M020_model_state_integrity as _M020,
 )
+from superlocalmemory.storage.migrations import (
+    M021_ingestion_log_profile as _M021,
+)
+from superlocalmemory.storage.migrations import (
+    M022_entity_aliases_profile as _M022,
+)
+from superlocalmemory.storage.migrations import (
+    M023_mesh_profile_isolation as _M023,
+)
+from superlocalmemory.storage.migrations import (
+    M024_rbac_users_roles as _M024,
+)
+from superlocalmemory.storage.migrations import (
+    M025_perf_indexes as _M025,
+)
+from superlocalmemory.storage.migrations import (
+    M026_rbac_memberships_fk as _M026,
+)
+from superlocalmemory.storage.migrations import (
+    M027_transferable_patterns_profile as _M027,
+)
+from superlocalmemory.storage.migrations import (
+    M028_fact_entity_associations as _M028,
+)
+from superlocalmemory.storage.migrations import (
+    M029_behavioral_history_indexes as _M029,
+)
+from superlocalmemory.storage.migrations import (
+    M030_entity_explorer_indexes as _M030,
+)
 
 # Map migration name → module (used for the optional ``verify(conn)`` hook
 # that lets the runner detect "already applied" state when an idempotent
@@ -116,6 +146,16 @@ _MODULES = {
     _M018.NAME: _M018,
     _M019.NAME: _M019,
     _M020.NAME: _M020,
+    _M021.NAME: _M021,
+    _M022.NAME: _M022,
+    _M023.NAME: _M023,
+    _M024.NAME: _M024,
+    _M025.NAME: _M025,
+    _M026.NAME: _M026,
+    _M027.NAME: _M027,
+    _M028.NAME: _M028,
+    _M029.NAME: _M029,
+    _M030.NAME: _M030,
 }
 
 logger = logging.getLogger(__name__)
@@ -171,6 +211,9 @@ MIGRATIONS: list[Migration] = [
     Migration(name=_M007.NAME, db_target="memory", ddl=_M007.DDL),
     # M018 is additive and independent of runtime-bootstrapped tables.
     Migration(name=_M018.NAME, db_target="memory", ddl=_M018.DDL),
+    # M024 creates RBAC tables (users / memberships / sessions). Independent
+    # brand-new tables, so it runs pre-engine-init.
+    Migration(name=_M024.NAME, db_target="memory", ddl=_M024.DDL),
     Migration(name=_M019.NAME, db_target="memory", ddl=_M019.DDL,
               dependencies=(_M018.NAME,)),
     # M006 + M011 are deliberately NOT here — see DEFERRED_MIGRATIONS below.
@@ -187,6 +230,10 @@ MIGRATIONS: list[Migration] = [
 # position proxy when the column is absent, so a failed deferred apply never
 # crashes the trainer — it just keeps the old label path.
 DEFERRED_MIGRATIONS: list[Migration] = [
+    # M028 captures an atomic_facts rowid high-water mark before readiness.
+    # atomic_facts/canonical_entities are bootstrapped by MemoryEngine.
+    Migration(name=_M028.NAME, db_target="memory", ddl=_M028.DDL,
+              dependencies=(_M018.NAME,)),
     Migration(name=_M006.NAME, db_target="memory", ddl=_M006.DDL),
     # M011 extends atomic_facts + creates memory_archive / memory_merge_log.
     # atomic_facts is bootstrapped at engine init, so M011 defers alongside M006.
@@ -203,6 +250,32 @@ DEFERRED_MIGRATIONS: list[Migration] = [
     Migration(name=_M016.NAME, db_target="memory", ddl=_M016.DDL),
     # M017 adds scope to the engine-bootstrapped CCQ consolidation table.
     Migration(name=_M017.NAME, db_target="memory", ddl=_M017.DDL),
+    # M021 rebuilds ingestion_log with a profile-scoped dedup constraint.
+    # Deferred: ingestion_log is created at engine init (apply_v343_schema).
+    Migration(name=_M021.NAME, db_target="memory", ddl=_M021.DDL),
+    # M022 adds profile_id to entity_aliases, backfilled from the parent entity.
+    # Deferred: entity_aliases is created at engine init (create_all_tables).
+    Migration(name=_M022.NAME, db_target="memory", ddl=_M022.DDL),
+    # M023 profile-scopes every mesh coordination table (peers/messages/state/
+    # locks/events). Deferred: mesh tables are created at engine init
+    # (apply_v343_schema), same as M021.
+    Migration(name=_M023.NAME, db_target="memory", ddl=_M023.DDL),
+    # M025 adds hot-path perf indexes (atomic_facts dedup, mesh cleanup/list).
+    Migration(name=_M025.NAME, db_target="memory", ddl=_M025.DDL),
+    # M026 rebuilds rbac_memberships with a profiles FK (ON DELETE CASCADE) so
+    # deleting a profile cascade-purges its role grants (SEC-H-01 defense-in-
+    # depth). Deferred: the FK target `profiles` is created at engine init.
+    Migration(name=_M026.NAME, db_target="memory", ddl=_M026.DDL),
+    # M027 rebuilds transferable_patterns with profile_id + UNIQUE(profile_id,
+    # pattern_type, key) to prevent cross-profile preference contamination (H-01,
+    # cycle-3 audit). Deferred: CrossProjectAggregator creates the table on first
+    # consolidation run, not during engine init or apply_all. apply() is a no-op
+    # when the table is absent (first install after the schema change).
+    Migration(name=_M027.NAME, db_target="learning", ddl=_M027.DDL),
+    # M029 indexes behavioral tables bootstrapped during engine initialization.
+    Migration(name=_M029.NAME, db_target="memory", ddl=_M029.DDL),
+    # M030 bounds Entity Explorer pagination and profile-summary ranking.
+    Migration(name=_M030.NAME, db_target="memory", ddl=_M030.DDL),
 ]
 
 
@@ -348,7 +421,65 @@ def _apply_single(
                 )
                 logger.warning(detail)
                 return ("failed", detail)
-            return ("skipped", "already complete")
+            # A matching migration-log row is not proof that the promised
+            # schema still exists. Existing installs can retain a migration log
+            # while a partial restore drops an additive table or index.
+            #
+            # Never replay a historical migration merely because verify()
+            # fails. Some migrations rebuild tables and transform data; replay
+            # would be destructive (M002 is the canonical example). Only a
+            # module-supplied repair(conn) hook is allowed to reconcile a
+            # completed migration's end-state.
+            mod = _MODULES.get(migration.name)
+            verify_fn = (
+                getattr(mod, "verify", None) if mod is not None else None
+            )
+            if verify_fn is None:
+                return ("skipped", "already complete")
+            try:
+                schema_complete = bool(verify_fn(conn))
+            except sqlite3.Error as exc:
+                return (
+                    "failed",
+                    f"schema verification failed for {migration.name}: {exc}",
+                )
+            if schema_complete:
+                return ("skipped", "already complete (schema verified)")
+            if dry_run:
+                return (
+                    "skipped",
+                    "dry-run: would repair missing migration end-state",
+                )
+            repair_fn = (
+                getattr(mod, "repair", None) if mod is not None else None
+            )
+            if not callable(repair_fn):
+                detail = (
+                    f"schema incomplete for completed migration "
+                    f"{migration.name}; automatic replay is disabled"
+                )
+                logger.warning(detail)
+                return ("failed", detail)
+            try:
+                repair_fn(conn)
+            except sqlite3.Error as exc:
+                return (
+                    "failed",
+                    f"safe repair failed for {migration.name}: {exc}",
+                )
+            try:
+                if not bool(verify_fn(conn)):
+                    return (
+                        "failed",
+                        f"safe repair did not restore {migration.name}",
+                    )
+            except sqlite3.Error as exc:
+                return (
+                    "failed",
+                    f"post-repair verification failed for "
+                    f"{migration.name}: {exc}",
+                )
+            return ("applied", "missing end-state repaired safely")
         # status is 'failed' or 'in_progress' → retry from scratch.
         if dry_run:
             return ("skipped", f"dry-run: would retry (status={status})")

package/src/superlocalmemory/storage/migrations/M010_evolution_config.py

@@ -50,6 +50,11 @@ def verify(conn: sqlite3.Connection) -> bool:
     return _REQUIRED_TABLES.issubset(names)
 
 
+def repair(conn: sqlite3.Connection) -> None:
+    """Restore additive Skill Evolution tables without replaying other migrations."""
+    conn.executescript(DDL)
+
+
 DDL = """
 CREATE TABLE IF NOT EXISTS evolution_config (
     profile_id        TEXT PRIMARY KEY,

package/src/superlocalmemory/storage/migrations/M021_ingestion_log_profile.py

@@ -0,0 +1,108 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory — per-profile isolation (I-4)
+
+"""M021 — per-profile ingestion_log dedup (memory.db, deferred).
+
+``ingestion_log`` is the compatibility ledger for external-adapter ingests. Its
+dedup UNIQUE constraint was global — ``UNIQUE(source_type, dedup_key)`` — so a
+second profile ingesting the same source key could not record its own ledger
+row (INSERT OR IGNORE silently no-op'd), losing that profile's fact_ids in the
+ledger. (The authoritative dedup already moved to the M018 ingestion_operations
+table, which is profile-scoped, so the memory itself is not starved — this
+migration fixes the ledger so per-profile bookkeeping is complete.)
+
+SQLite cannot alter a UNIQUE constraint in place, so the table is rebuilt:
+rename → create with profile_id + UNIQUE(profile_id, source_type, dedup_key) →
+copy rows backfilling profile_id='default' → drop old. Idempotent and tolerant
+of a missing table (fresh installs create it correctly via schema_v343).
+
+Deferred because ingestion_log is created at engine init (apply_v343_schema),
+after ``apply_all`` runs — same reason as M016.
+
+Author: Varun Pratap Bhardwaj / Qualixar
+"""
+
+from __future__ import annotations
+
+import sqlite3
+
+NAME = "M021_ingestion_log_profile"
+DB_TARGET = "memory"
+
+# Documentation + drift hash. apply() below is the authoritative executor.
+DDL = (
+    "ALTER TABLE ingestion_log ADD COLUMN profile_id TEXT NOT NULL DEFAULT 'default';"
+    "-- rebuild for UNIQUE(profile_id, source_type, dedup_key)"
+)
+
+_NEW_TABLE = """
+CREATE TABLE ingestion_log (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    profile_id TEXT NOT NULL DEFAULT 'default',
+    source_type TEXT NOT NULL,
+    dedup_key TEXT NOT NULL,
+    fact_ids TEXT DEFAULT '[]',
+    metadata TEXT DEFAULT '{}',
+    status TEXT DEFAULT 'ingested',
+    ingested_at TEXT NOT NULL,
+    UNIQUE(profile_id, source_type, dedup_key)
+)
+"""
+
+
+def _cols(conn: sqlite3.Connection, table: str) -> set[str]:
+    return {r[1] for r in conn.execute(f"PRAGMA table_info({table})").fetchall()}
+
+
+def _table_exists(conn: sqlite3.Connection, table: str) -> bool:
+    return conn.execute(
+        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (table,)
+    ).fetchone() is not None
+
+
+def apply(conn: sqlite3.Connection) -> None:
+    """Rebuild ingestion_log with a profile-scoped dedup constraint.
+
+    No-op on a fresh install (table already has profile_id) or when the table
+    doesn't exist yet. Existing rows backfill to the 'default' profile.
+    """
+    if not _table_exists(conn, "ingestion_log"):
+        return
+    if "profile_id" in _cols(conn, "ingestion_log"):
+        return
+
+    conn.execute("ALTER TABLE ingestion_log RENAME TO _ingestion_log_old")
+    conn.executescript(_NEW_TABLE)
+    # Copy legacy rows under the 'default' profile. Column set matches the
+    # pre-migration schema (id, source_type, dedup_key, fact_ids, metadata,
+    # status, ingested_at).
+    old_cols = _cols(conn, "_ingestion_log_old")
+    has_meta = "metadata" in old_cols
+    if has_meta:
+        conn.execute(
+            "INSERT INTO ingestion_log "
+            "(id, profile_id, source_type, dedup_key, fact_ids, metadata, "
+            " status, ingested_at) "
+            "SELECT id, 'default', source_type, dedup_key, fact_ids, metadata, "
+            " status, ingested_at FROM _ingestion_log_old"
+        )
+    else:
+        conn.execute(
+            "INSERT INTO ingestion_log "
+            "(id, profile_id, source_type, dedup_key, fact_ids, status, ingested_at) "
+            "SELECT id, 'default', source_type, dedup_key, fact_ids, "
+            " status, ingested_at FROM _ingestion_log_old"
+        )
+    conn.execute("DROP TABLE _ingestion_log_old")
+    conn.execute(
+        "CREATE INDEX IF NOT EXISTS idx_ingestion_dedup "
+        "ON ingestion_log(profile_id, source_type, dedup_key)"
+    )
+
+
+def verify(conn: sqlite3.Connection) -> bool:
+    """Applied once ingestion_log carries profile_id (or is absent on fresh DB)."""
+    if not _table_exists(conn, "ingestion_log"):
+        return True  # nothing to migrate; fresh install creates it correctly
+    return "profile_id" in _cols(conn, "ingestion_log")

package/src/superlocalmemory/storage/migrations/M022_entity_aliases_profile.py

@@ -0,0 +1,86 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory — per-profile isolation (I-7)
+
+"""M022 — profile_id on entity_aliases (memory.db, deferred).
+
+entity_aliases had no profile_id, so aliases were keyed by entity_id alone. When
+the same entity_id appears under two profiles, one profile's aliases were
+visible to (and deduped against) the other. Add profile_id and backfill each
+alias from its parent canonical entity's profile (the correct owner), falling
+back to 'default' for orphans.
+
+Additive column — no UNIQUE change, so a simple ADD COLUMN + backfill. Deferred
+because entity_aliases is created at engine init (create_all_tables), after
+apply_all runs — same reason as M016.
+
+Author: Varun Pratap Bhardwaj / Qualixar
+"""
+
+from __future__ import annotations
+
+import sqlite3
+
+NAME = "M022_entity_aliases_profile"
+DB_TARGET = "memory"
+
+DDL = "ALTER TABLE entity_aliases ADD COLUMN profile_id TEXT NOT NULL DEFAULT 'default'"
+
+
+def _cols(conn: sqlite3.Connection, table: str) -> set[str]:
+    return {r[1] for r in conn.execute(f"PRAGMA table_info({table})").fetchall()}
+
+
+def _table_exists(conn: sqlite3.Connection, table: str) -> bool:
+    return conn.execute(
+        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (table,)
+    ).fetchone() is not None
+
+
+def apply(conn: sqlite3.Connection) -> None:
+    """Add profile_id to entity_aliases and backfill from the parent entity.
+
+    No-op on a fresh install (column already present) or a missing table.
+    """
+    if not _table_exists(conn, "entity_aliases"):
+        return
+
+    if "profile_id" not in _cols(conn, "entity_aliases"):
+        conn.execute(
+            "ALTER TABLE entity_aliases "
+            "ADD COLUMN profile_id TEXT NOT NULL DEFAULT 'default'"
+        )
+        # Backfill each alias from its parent canonical entity's profile. If the
+        # parent is missing (orphan) the COALESCE keeps 'default'.
+        if _table_exists(conn, "canonical_entities"):
+            conn.execute(
+                "UPDATE entity_aliases SET profile_id = COALESCE("
+                " (SELECT ce.profile_id FROM canonical_entities ce "
+                "  WHERE ce.entity_id = entity_aliases.entity_id LIMIT 1), 'default')"
+            )
+
+    # Always ensure the index (this migration owns it — schema.create_all_tables
+    # deliberately does NOT create it, since on an upgrade the column doesn't
+    # exist yet at create-all time). Idempotent for fresh installs too.
+    conn.execute(
+        "CREATE INDEX IF NOT EXISTS idx_aliases_profile_entity "
+        "ON entity_aliases(profile_id, entity_id)"
+    )
+
+
+def verify(conn: sqlite3.Connection) -> bool:
+    """Applied once entity_aliases has profile_id AND its index (or is absent).
+
+    Checking the index (not just the column) means a fresh install — where
+    create_all_tables made the column but not the index — still runs apply()
+    to create the index.
+    """
+    if not _table_exists(conn, "entity_aliases"):
+        return True
+    if "profile_id" not in _cols(conn, "entity_aliases"):
+        return False
+    idx = conn.execute(
+        "SELECT 1 FROM sqlite_master WHERE type='index' "
+        "AND name='idx_aliases_profile_entity'"
+    ).fetchone()
+    return idx is not None

package/src/superlocalmemory/storage/migrations/M023_mesh_profile_isolation.py

@@ -0,0 +1,194 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory — per-profile isolation (I-6 / C2)
+
+"""M023 — profile_id on all mesh coordination tables (memory.db, deferred).
+
+The mesh broker is a per-agent coordination bus (peers, notification messages,
+shared key/value state, file locks, event log). Every mesh table was GLOBAL —
+no ``profile_id`` — so in a multi-tenant deployment (profiles = individual /
+team / company tenants) tenant A could see tenant B's peers, receive B's
+broadcast messages, read/overwrite B's shared state by key collision, and be
+blocked by B's file locks. That is a concrete cross-tenant isolation leak.
+
+This migration makes the mesh namespace per-profile:
+
+  * mesh_peers, mesh_messages, mesh_events — additive ``profile_id`` column +
+    profile-leading indexes (no primary-key change).
+  * mesh_state — rebuilt with PRIMARY KEY(profile_id, key) so the same key can
+    exist independently per tenant.
+  * mesh_locks — rebuilt with PRIMARY KEY(profile_id, file_path) so one tenant's
+    lock on a path never blocks another tenant.
+
+mesh_reads is intentionally left unchanged: it is (message_id, peer_id), both of
+which are already profile-scoped by their parent rows, so a cross-profile read
+row is unreachable.
+
+Existing rows backfill to the 'default' profile (the default active profile).
+Idempotent and tolerant of missing tables; deferred because the mesh tables are
+created at engine init (apply_v343_schema), after ``apply_all`` runs — same
+reason as M021.
+
+Author: Varun Pratap Bhardwaj / Qualixar
+"""
+
+from __future__ import annotations
+
+import sqlite3
+
+NAME = "M023_mesh_profile_isolation"
+DB_TARGET = "memory"
+
+# Documentation + drift hash. apply() below is the authoritative executor.
+DDL = (
+    "ALTER TABLE mesh_peers ADD COLUMN profile_id TEXT NOT NULL DEFAULT 'default';"
+    "ALTER TABLE mesh_messages ADD COLUMN profile_id TEXT NOT NULL DEFAULT 'default';"
+    "ALTER TABLE mesh_events ADD COLUMN profile_id TEXT NOT NULL DEFAULT 'default';"
+    "-- rebuild mesh_state PK(profile_id, key); mesh_locks PK(profile_id, file_path)"
+)
+
+_NEW_STATE = """
+CREATE TABLE mesh_state (
+    profile_id TEXT NOT NULL DEFAULT 'default',
+    key TEXT NOT NULL,
+    value TEXT NOT NULL,
+    set_by TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    PRIMARY KEY (profile_id, key)
+)
+"""
+
+_NEW_LOCKS = """
+CREATE TABLE mesh_locks (
+    profile_id TEXT NOT NULL DEFAULT 'default',
+    file_path TEXT NOT NULL,
+    locked_by TEXT NOT NULL,
+    locked_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL DEFAULT '9999-12-31T23:59:59Z',
+    PRIMARY KEY (profile_id, file_path)
+)
+"""
+
+
+def _cols(conn: sqlite3.Connection, table: str) -> set[str]:
+    return {r[1] for r in conn.execute(f"PRAGMA table_info({table})").fetchall()}
+
+
+def _table_exists(conn: sqlite3.Connection, table: str) -> bool:
+    return conn.execute(
+        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (table,)
+    ).fetchone() is not None
+
+
+def _add_profile_column(conn: sqlite3.Connection, table: str) -> None:
+    """Additive profile_id on a table whose primary key does not change."""
+    if not _table_exists(conn, table):
+        return
+    if "profile_id" not in _cols(conn, table):
+        conn.execute(
+            f"ALTER TABLE {table} "
+            "ADD COLUMN profile_id TEXT NOT NULL DEFAULT 'default'"
+        )
+        # New column defaults 'default' for every legacy row; no extra UPDATE
+        # needed. (NOT NULL DEFAULT is applied to existing rows by SQLite.)
+
+
+def _atomic_rebuild(conn: sqlite3.Connection, table: str, create_sql: str,
+                    insert_sql: str) -> None:
+    """RENAME→CREATE→copy→DROP as ONE transaction.
+
+    Uses conn.execute (NOT executescript, which force-commits mid-rebuild and
+    could leave a zombie *_old table with the only copy of the data if a later
+    step fails). BEGIN IMMEDIATE + explicit COMMIT/ROLLBACK guarantees the
+    rebuild is all-or-nothing even under the runner's autocommit connection.
+    """
+    if not _table_exists(conn, table):
+        return
+    if "profile_id" in _cols(conn, table):
+        return
+    old = f"_{table}_old"
+    conn.execute("BEGIN IMMEDIATE")
+    try:
+        conn.execute(f"ALTER TABLE {table} RENAME TO {old}")
+        conn.execute(create_sql.strip().rstrip(";"))
+        conn.execute(insert_sql.replace("__OLD__", old))
+        conn.execute(f"DROP TABLE {old}")
+        conn.execute("COMMIT")
+    except Exception:
+        conn.execute("ROLLBACK")
+        raise
+
+
+def _rebuild_state(conn: sqlite3.Connection) -> None:
+    _atomic_rebuild(
+        conn, "mesh_state", _NEW_STATE,
+        "INSERT INTO mesh_state (profile_id, key, value, set_by, updated_at) "
+        "SELECT 'default', key, value, set_by, updated_at FROM __OLD__",
+    )
+
+
+def _rebuild_locks(conn: sqlite3.Connection) -> None:
+    _atomic_rebuild(
+        conn, "mesh_locks", _NEW_LOCKS,
+        "INSERT INTO mesh_locks "
+        "(profile_id, file_path, locked_by, locked_at, expires_at) "
+        "SELECT 'default', file_path, locked_by, locked_at, expires_at FROM __OLD__",
+    )
+
+
+def _indexes(conn: sqlite3.Connection) -> None:
+    """Profile-leading indexes. Created here (not in schema_v343) so an upgrade
+    never runs CREATE INDEX on a column that does not exist yet."""
+    if _table_exists(conn, "mesh_peers") and "profile_id" in _cols(conn, "mesh_peers"):
+        peer_cols = _cols(conn, "mesh_peers")
+        if "session_id" in peer_cols:
+            conn.execute(
+                "CREATE INDEX IF NOT EXISTS idx_mesh_peers_profile "
+                "ON mesh_peers(profile_id, session_id)"
+            )
+        if "status" in peer_cols:
+            conn.execute(
+                "CREATE INDEX IF NOT EXISTS idx_mesh_peers_profile_status "
+                "ON mesh_peers(profile_id, status)"
+            )
+    if _table_exists(conn, "mesh_messages") and "profile_id" in _cols(conn, "mesh_messages"):
+        msg_cols = _cols(conn, "mesh_messages")
+        conn.execute(
+            "CREATE INDEX IF NOT EXISTS idx_mesh_messages_profile_to "
+            "ON mesh_messages(profile_id, to_peer, read)"
+        )
+        # target_type / project_path are v3.4.6 additions. In the normal upgrade
+        # path they exist (schema_v343 applies its ALTERs before deferred
+        # migrations run), but guard anyway so M023 is robust on any DB.
+        if {"target_type", "project_path"} <= msg_cols:
+            conn.execute(
+                "CREATE INDEX IF NOT EXISTS idx_mesh_messages_profile_target "
+                "ON mesh_messages(profile_id, target_type, project_path)"
+            )
+    if _table_exists(conn, "mesh_events") and "profile_id" in _cols(conn, "mesh_events"):
+        conn.execute(
+            "CREATE INDEX IF NOT EXISTS idx_mesh_events_profile "
+            "ON mesh_events(profile_id, id)"
+        )
+
+
+def apply(conn: sqlite3.Connection) -> None:
+    """Profile-scope every mesh table. Idempotent; no-op on a fresh/migrated DB.
+
+    Existing rows backfill to the 'default' profile.
+    """
+    _add_profile_column(conn, "mesh_peers")
+    _add_profile_column(conn, "mesh_messages")
+    _add_profile_column(conn, "mesh_events")
+    _rebuild_state(conn)
+    _rebuild_locks(conn)
+    _indexes(conn)
+
+
+def verify(conn: sqlite3.Connection) -> bool:
+    """Applied once every mesh table carries profile_id (or is absent)."""
+    for table in ("mesh_peers", "mesh_messages", "mesh_events",
+                  "mesh_state", "mesh_locks"):
+        if _table_exists(conn, table) and "profile_id" not in _cols(conn, table):
+            return False
+    return True

package/src/superlocalmemory/storage/migrations/M024_rbac_users_roles.py

@@ -0,0 +1,87 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V3 — RBAC / teams (C3)
+
+"""M024 — user identity + role-based access control tables (memory.db).
+
+SLM's tenancy boundary is the profile (individual / team / company). Until now
+the daemon had no *user* identity — access was machine-level (install token /
+daemon capability). For team and company deployments an org needs real users,
+each with a role on a profile, managed from the dashboard.
+
+Adopts the Cognee reference model (Tenant -> User -> Role):
+  * rbac_users        — a person/agent identity with a hashed password.
+  * rbac_memberships  — (profile_id, user_id) -> role, the tenant/role grant.
+  * rbac_sessions     — dashboard login sessions (hashed bearer token + expiry).
+
+RBAC is additive: with zero users the daemon stays single-operator (the machine
+operator over loopback is the implicit owner). Once users + memberships exist,
+logged-in users are enforced against their role. Brand-new independent tables,
+so this is a normal (pre-engine-init) migration with an idempotent apply().
+
+Author: Varun Pratap Bhardwaj / Qualixar
+"""
+
+from __future__ import annotations
+
+import sqlite3
+
+NAME = "M024_rbac_users_roles"
+DB_TARGET = "memory"
+
+DDL = """
+CREATE TABLE IF NOT EXISTS rbac_users (
+    user_id TEXT PRIMARY KEY,
+    username TEXT NOT NULL UNIQUE,
+    display_name TEXT DEFAULT '',
+    password_hash TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'active',
+    created_at TEXT NOT NULL,
+    created_by TEXT DEFAULT 'owner'
+);
+CREATE TABLE IF NOT EXISTS rbac_memberships (
+    profile_id TEXT NOT NULL,
+    user_id TEXT NOT NULL,
+    role TEXT NOT NULL,
+    added_at TEXT NOT NULL,
+    added_by TEXT DEFAULT 'owner',
+    PRIMARY KEY (profile_id, user_id)
+);
+CREATE TABLE IF NOT EXISTS rbac_sessions (
+    token_hash TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL,
+    last_seen TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS rbac_settings (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_rbac_memberships_user
+    ON rbac_memberships(user_id);
+CREATE INDEX IF NOT EXISTS idx_rbac_sessions_user
+    ON rbac_sessions(user_id);
+CREATE INDEX IF NOT EXISTS idx_rbac_sessions_expiry
+    ON rbac_sessions(expires_at);
+"""
+
+
+def _table_exists(conn: sqlite3.Connection, table: str) -> bool:
+    return conn.execute(
+        "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?", (table,)
+    ).fetchone() is not None
+
+
+def apply(conn: sqlite3.Connection) -> None:
+    """Create the RBAC tables. Idempotent (CREATE TABLE IF NOT EXISTS)."""
+    conn.executescript(DDL)
+
+
+def verify(conn: sqlite3.Connection) -> bool:
+    """Applied once all RBAC tables exist."""
+    return all(
+        _table_exists(conn, t)
+        for t in ("rbac_users", "rbac_memberships", "rbac_sessions",
+                  "rbac_settings")
+    )