superlocalmemory 3.8.13 → 4.0.0

package/src/superlocalmemory/mcp/http_transport.py

@@ -1,63 +1,33 @@
 # Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
 # Licensed under AGPL-3.0-or-later - see LICENSE file
-# Part of SuperLocalMemory V3 | https://qualixar.com | https://varunpratap.com
+# Part of SuperLocalMemory V4 | https://qualixar.com | https://varunpratap.com
 
-"""Resource-safe FastMCP Streamable-HTTP integration — Workstream E additions.
+"""Resource-safe Streamable-HTTP integration for mcp==2.0.0.
 
-MCP SDK 1.27.1 passes an AnyIO ``MemoryObjectReceiveStream`` directly to
-``EventSourceResponse`` for every JSON-RPC POST.  The response consumes that
-stream but does not close it after normal iteration, leaving one receive
-endpoint per request for the garbage collector.  The response is the owner of
-that per-request iterator, so SLM closes it at the response boundary.
+mcp 2.0.0 deleted ``mcp.server.fastmcp.FastMCP``. Replacement is
+``mcp.server.mcpserver.MCPServer`` with the same ``.tool()`` decorator and
+``run(transport="stdio")``.
 
-Workstream E (3.8.4): MCP Connection Resilience
-------------------------------------------------
-Two root causes of frequent MCP disconnects are addressed here:
+Fully-stateless is the default (see ``remote_mode.mcp_stateless`` and
+``unified_daemon._configure_mcp_transport_settings``). Under
+``stateless_http=True``:
 
-RC-2: No session idle timeout — zombie sessions accumulate forever.
-    Fix: ``SLMFastMCP.streamable_http_app()`` pre-creates the
-    ``StreamableHTTPSessionManager`` with a finite ``session_idle_timeout``
-    (default 600 s, overridable via ``SLM_MCP_SESSION_IDLE_TIMEOUT_S``).
+* ``session_idle_timeout`` is illegal (SDK raises RuntimeError) and unused —
+  there are no transport sessions to reap.
+* the EventStore (SSE Last-Event-ID resumability) is not used.
+* therefore the old ``SLMFastMCP.streamable_http_app()`` override that
+  pre-created a ``StreamableHTTPSessionManager`` is gone — kwargs go
+  straight to ``MCPServer.streamable_http_app(...)``.
 
-RC-3: No EventStore — every SSE drop requires a full re-initialize.
-    Fix: ``SLMInMemoryEventStore`` (bounded, in-memory, async-safe) is
-    injected as the session manager's event store.  A dropped SSE stream can
-    resume via ``Last-Event-ID`` instead of forcing a new ``initialize``
-    handshake.
-
-KNOWN LIMITATIONS (not fixed here, documented for future work):
-    * RC-1 (mcp-remote orphan test-sessions): The mcp-remote v0.1.38 bug
-      creates a ``testTransport``/``testClient`` that is never closed.  This
-      leaks one zombie session per mcp-remote startup.  Tracked upstream.
-      Session idle-timeout mitigates the accumulation.
-    * Client reconnect after daemon restart: ``SLMInMemoryEventStore`` is
-      in-memory only and does not survive daemon process restart.  After a
-      restart, stale ``Last-Event-ID`` values are unknown to the new store;
-      ``replay_events_after`` returns ``None`` and the client must
-      re-initialize.  A SQLite-backed EventStore is planned for v3.9.
-    * Claude Code client bug Anthropic #48557: Claude Code may send a stale
-      MCP session ID after server restart.  This is a client-side defect;
-      SLM cannot fix it from the server.
-    * Event-loop stall during background maintenance (RC-6): The pruner-lock
-      stall fix lives in Workstream A+F (already merged into this branch).
-      This module depends on that fix; see fix/3.8.4 merge commit.
+Application-level ``session_init`` / ``close_session`` are orthogonal
+(session_id is a str param persisted in the memories table) and unchanged.
 """
 
 from __future__ import annotations
 
 import logging
-import os
-from collections import OrderedDict, deque
-from typing import Any
 
-from mcp.server.fastmcp import FastMCP
-from mcp.server.streamable_http import (
-    EventCallback,
-    EventId,
-    EventMessage,
-    EventStore,
-    StreamId,
-)
+from mcp.server.mcpserver import MCPServer
 from sse_starlette.sse import EventSourceResponse
 from starlette.types import Receive, Scope, Send
 
@@ -65,196 +35,9 @@ from superlocalmemory import __version__
 
 logger = logging.getLogger(__name__)
 
-# ---------------------------------------------------------------------------
-# Session idle timeout — configurable default
-# ---------------------------------------------------------------------------
-
-#: Default session idle timeout in seconds.
-#:
-#: Rationale for 600 s (10 minutes), not the SDK's suggested 1800 s:
-#:   * At 1800 s, with mcp-remote leaking 3 zombie sessions per conversation
-#:     start and a typical conversation cadence of one every 15 min,
-#:     up to (1800/15) × 3 = 360 zombie sessions can accumulate in the worst
-#:     case before the first one expires.  600 s bounds this to ~6.
-#:   * 600 s is well above the 15 s SSE keepalive interval, the typical
-#:     in-conversation idle gap (<5 min), and the mcp-remote reconnect window.
-#:   * Active sessions push their idle deadline forward on every tool call,
-#:     so a user making any request within 10 min never loses their session.
-#:   * A session idle for exactly 10 min (user stepped away) is reaped and
-#:     recreated transparently on next tool call via mcp-remote reconnect.
-#:
-#: CRIT — anti-patterns to avoid:
-#:   Too aggressive (<60 s): frequent idle-deadline checks waste CPU in
-#:     AnyIO's CancelScope machinery; legitimate quiet users are interrupted.
-#:   Too lenient (>7200 s = 2 h): zombie sessions accumulate at rates that
-#:     can reach 100+ entries, degrading AnyIO task-group scheduling.
-_DEFAULT_SESSION_IDLE_TIMEOUT: float = 600.0
-
-
-def _slm_session_idle_timeout() -> float:
-    """Return the configured MCP session idle timeout in seconds.
-
-    Reads ``SLM_MCP_SESSION_IDLE_TIMEOUT_S`` from the environment.
-    Falls back to :data:`_DEFAULT_SESSION_IDLE_TIMEOUT` on missing or
-    non-numeric values.  A value ≤ 0 is also treated as the default.
-    """
-    raw = os.environ.get("SLM_MCP_SESSION_IDLE_TIMEOUT_S", "").strip()
-    if raw:
-        try:
-            val = float(raw)
-            if val > 0:
-                return val
-        except ValueError:
-            logger.warning(
-                "SLM_MCP_SESSION_IDLE_TIMEOUT_S=%r is not a valid number; "
-                "using default %s s",
-                raw,
-                _DEFAULT_SESSION_IDLE_TIMEOUT,
-            )
-    return _DEFAULT_SESSION_IDLE_TIMEOUT
-
 
 # ---------------------------------------------------------------------------
-# SLMInMemoryEventStore — bounded, in-memory, async-safe
-# ---------------------------------------------------------------------------
-
-
-class SLMInMemoryEventStore(EventStore):
-    """Bounded in-memory event store for MCP SSE resumability.
-
-    Enables clients to reconnect to the GET /mcp SSE endpoint and replay
-    missed events via the ``Last-Event-ID`` header instead of performing a
-    full ``initialize`` handshake (which creates a new session and adds to
-    the zombie-session count).
-
-    Design choices:
-    ---------------
-    * **Per-stream bounded deque** — each stream_id maps to a
-      ``deque(maxlen=max_events_per_stream)``.  Oldest events are evicted
-      automatically (FIFO) when the cap is hit.
-    * **Global stream count cap** — the store tracks at most
-      ``max_streams`` distinct stream_ids.  When exceeded, the least-recently
-      used stream is evicted from the dict.  This bounds total memory usage.
-    * **Async-safe, lock-free** — all access happens on a single asyncio event
-      loop; no ``asyncio.Lock`` is needed.
-    * **Priming events (message=None) are stored but skipped during replay** —
-      the SDK mints a fresh priming event in the replay path (see
-      ``StreamableHTTPServerTransport._replay_events``).
-
-    Memory bound:
-    -------------
-    ``max_events_per_stream`` × ~2 KB (avg JSONRPCMessage) × ``max_streams``
-    = 200 × 2 KB × 100 = ~40 MB in the absolute worst case.
-    At steady state with idle-timeout reaping sessions after 10 min, the
-    typical load is 3–6 active streams × 200 events × 2 KB ≈ 1.2–2.4 MB.
-
-    Known limitation:
-    -----------------
-    This store is in-memory only.  It does not survive a daemon process
-    restart.  After a restart, any ``Last-Event-ID`` from a previous process
-    is unknown; ``replay_events_after`` returns ``None`` and the client must
-    re-initialize.  A SQLite-backed EventStore is planned for v3.9.
-    """
-
-    def __init__(
-        self,
-        max_events_per_stream: int = 200,
-        max_streams: int = 100,
-    ) -> None:
-        """Initialise the bounded event store.
-
-        Args:
-            max_events_per_stream: Maximum number of events stored per
-                stream before oldest events are dropped.  Default 200
-                (~400 KB per stream at 2 KB/event).
-            max_streams: Maximum number of distinct stream_ids tracked.
-                When exceeded, the least-recently used stream is evicted
-                (all its events are lost).  Default 100.
-        """
-        self._max_events = max_events_per_stream
-        self._max_streams = max_streams
-        # OrderedDict maintains insertion/access order for LRU eviction.
-        # stream_id → deque[(event_id, message)]
-        self._store: OrderedDict[str, deque] = OrderedDict()
-        # Monotonically incrementing counter; single event loop → no lock needed.
-        self._counter: int = 0
-
-    # ------------------------------------------------------------------
-    # EventStore ABC implementation
-    # ------------------------------------------------------------------
-
-    async def store_event(
-        self,
-        stream_id: StreamId,
-        message: Any,  # JSONRPCMessage | None
-    ) -> EventId:
-        """Store an event for the given stream and return its unique event_id.
-
-        Args:
-            stream_id: The stream (GET /mcp SSE connection) this event belongs to.
-            message: The JSON-RPC message, or ``None`` for priming events.
-
-        Returns:
-            A monotonically incrementing string event_id.
-        """
-        self._counter += 1
-        event_id: EventId = str(self._counter)
-
-        if stream_id not in self._store:
-            # Evict oldest stream if at capacity
-            if len(self._store) >= self._max_streams:
-                oldest_stream, _ = self._store.popitem(last=False)
-                logger.debug(
-                    "SLMInMemoryEventStore: evicted oldest stream %r "
-                    "(max_streams=%d reached)",
-                    oldest_stream,
-                    self._max_streams,
-                )
-            self._store[stream_id] = deque(maxlen=self._max_events)
-        else:
-            # Move to "most recently used" end so LRU eviction works correctly
-            self._store.move_to_end(stream_id)
-
-        self._store[stream_id].append((event_id, message))
-        return event_id
-
-    async def replay_events_after(
-        self,
-        last_event_id: EventId,
-        send_callback: EventCallback,
-    ) -> StreamId | None:
-        """Replay events that occurred after ``last_event_id``.
-
-        Searches all tracked streams for ``last_event_id`` and forwards every
-        subsequent non-None event to ``send_callback``.  Priming events
-        (``message=None``) are skipped; the SDK mints a fresh priming event
-        in the replay path.
-
-        Args:
-            last_event_id: The ID of the last event the client received.
-            send_callback: Async callback that receives each missed
-                ``EventMessage`` in order.
-
-        Returns:
-            The stream_id that contained ``last_event_id``, or ``None`` if
-            the event was not found (client must re-initialize).
-        """
-        for stream_id, events in self._store.items():
-            found = False
-            for event_id, message in events:
-                if found:
-                    if message is not None:
-                        await send_callback(EventMessage(message=message, event_id=event_id))
-                elif event_id == last_event_id:
-                    found = True
-            if found:
-                return stream_id
-        # last_event_id not in any stream (evicted or never seen)
-        return None
-
-
-# ---------------------------------------------------------------------------
-# SSE resource guard (unchanged from pre-E)
+# SSE resource guard (still useful if a host opts into non-json SSE responses)
 # ---------------------------------------------------------------------------
 
 
@@ -278,109 +61,25 @@ def install_streamable_http_resource_guard() -> None:
 
 
 # ---------------------------------------------------------------------------
-# SLMFastMCP — session lifecycle + SSE cleanup
+# SLMFastMCP — thin MCPServer wrapper (name kept for import stability)
 # ---------------------------------------------------------------------------
 
 
-class SLMFastMCP(FastMCP):
-    """FastMCP with SLM release identity, deterministic SSE cleanup, and
-    session lifecycle management (Workstream E).
-
-    Additions over the base FastMCP:
+class SLMFastMCP(MCPServer):
+    """MCPServer with SLM release identity.
 
-    1. **Session idle timeout**: the ``StreamableHTTPSessionManager`` is
-       pre-created with a finite ``session_idle_timeout`` so zombie sessions
-       (from mcp-remote orphan test-connects, or abandoned conversations) are
-       automatically reaped instead of accumulating forever.
+    Named ``SLMFastMCP`` for backward-compatible imports. Behaviour is
+    fully-stateless by default at the *call site* via
+    ``streamable_http_app(stateless_http=True, json_response=True, ...)`` —
+    this class does not override that method.
 
-    2. **Bounded event store**: a ``SLMInMemoryEventStore`` is injected so
-       that a dropped SSE stream can resume via ``Last-Event-ID`` without a
-       full ``initialize`` round-trip.
-
-    3. **Ordering guard**: ``streamable_http_app()`` reads the ``stateless_http``
-       flag from ``self.settings`` at call time.  If the flag is ``True``
-       (set by ``_configure_mcp_transport_settings()`` in unified_daemon.py),
-       ``session_idle_timeout`` is suppressed — the MCP SDK raises
-       ``RuntimeError`` if both are set simultaneously.  If
-       ``streamable_http_app()`` is called before settings are configured
-       (e.g. in unit tests), the default ``stateless_http=False`` applies
-       safely.
+    ``version`` is passed to ``MCPServer.__init__`` directly (no private
+    ``_mcp_server.version`` poke — that attribute is gone in mcp 2.0.0).
     """
 
     def __init__(self, *args, product_version: str = __version__, **kwargs) -> None:
+        # MCPServer takes version= as a first-class kwarg.
+        kwargs.setdefault("version", product_version)
         super().__init__(*args, **kwargs)
-        # FastMCP delegates the initialize response to the low-level MCP
-        # server. Without an explicit value it reports the installed ``mcp``
-        # library version, which makes an SLM 3.7 server identify itself as
-        # (for example) 1.27.1 to every IDE client.
-        self._mcp_server.version = product_version
-
-    def streamable_http_app(self):  # type: ignore[override]
-        """Return the Streamable-HTTP Starlette app.
-
-        Pre-creates the ``StreamableHTTPSessionManager`` with SLM-specific
-        parameters before delegating to ``super()`` (which skips re-creation
-        because the manager is already set).
-
-        Ordering guarantee
-        ------------------
-        In production ``unified_daemon.py`` always calls
-        ``_configure_mcp_transport_settings(fastmcp)`` *before* this method,
-        so ``self.settings.stateless_http`` reflects the correct runtime value.
-        If this method is called first (unit tests, embedded hosts), the
-        default ``stateless_http=False`` is used — safe because the stateless
-        guard only matters when ``stateless_http=True`` (avoid SDK RuntimeError).
-
-        Dependency note (A+F)
-        ---------------------
-        This method assumes that ``fix/3.8.4-A+F`` (already merged into this
-        branch) has eliminated the pruner-lock stall that caused event-loop
-        starvation during background maintenance.  Session idle-timeout and
-        the event store improve resilience to transient drops, but they cannot
-        compensate for a fully stalled event loop.
-        """
+        # Optional SSE resource guard for hosts that still request event-stream.
         install_streamable_http_resource_guard()
-
-        if self._session_manager is None:
-            from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
-
-            # Ordering guard: read stateless_http defensively.
-            # ``_configure_mcp_transport_settings()`` may not have been called
-            # yet; ``getattr`` with a False default ensures we never pass
-            # session_idle_timeout=<value> into a stateless manager (SDK raises
-            # RuntimeError if both are set simultaneously).
-            is_stateless: bool = getattr(self.settings, "stateless_http", False)
-
-            # Idle timeout: finite for stateful sessions; None for stateless
-            # (stateless sessions have no identity — there is nothing to reap).
-            idle_timeout: float | None = (
-                None if is_stateless else _slm_session_idle_timeout()
-            )
-
-            # Event store: inject SLMInMemoryEventStore for stateful mode.
-            # Stateless mode must not receive an event store (SDK limitation).
-            # If the caller already configured an event store (via FastMCP
-            # constructor argument), respect it — do not replace with ours.
-            if is_stateless:
-                event_store: EventStore | None = None
-            else:
-                event_store = self._event_store or SLMInMemoryEventStore()
-
-            self._session_manager = StreamableHTTPSessionManager(
-                app=self._mcp_server,
-                event_store=event_store,
-                retry_interval=self._retry_interval,
-                json_response=self.settings.json_response,
-                stateless=is_stateless,
-                security_settings=self.settings.transport_security,
-                session_idle_timeout=idle_timeout,
-            )
-            logger.info(
-                "SLM MCP session manager created: stateless=%s, "
-                "idle_timeout=%ss, event_store=%s",
-                is_stateless,
-                idle_timeout,
-                type(event_store).__name__ if event_store else "None",
-            )
-
-        return super().streamable_http_app()

package/src/superlocalmemory/mcp/profiles.py

@@ -49,6 +49,11 @@ _PROFILE_FULL: frozenset[str] = frozenset({  # 34 base — EXPLICIT literal, NOT
     "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
     # v3.8.0: bounded-loop tools (CLI + /slm-loop command + MCP).
     "slm_loop_run", "slm_loop_history", "slm_loop_show",
+    # v4: prestage_context IS registered (see mcp/server.py) but is deliberately
+    # NOT in full/power. The profile names are a user-facing config contract
+    # (SLM_MCP_PROFILE=full42) and the published tool-count table depends on
+    # them; adding a tool here would make "full42" serve 43 tools. New tools
+    # reach users through the `whole` profile until a profile rename is shipped.
 }) | _PROFILE_FULL_MESH  # 42
 
 _PROFILE_POWER: frozenset[str] = _PROFILE_FULL | frozenset({  # 54

package/src/superlocalmemory/mcp/resources.py

@@ -36,8 +36,16 @@ def register_resources(server, get_engine: Callable) -> None:
         try:
             from superlocalmemory.hooks.auto_recall import AutoRecall
             from superlocalmemory.mcp._pool_adapter import pool_recall
+            # Pass engine so the soft-prompt bridge (engine->AutoInvoker) fires on
+            # this real MCP session-context surface; recall_fn still drives recall.
+            # Fail-soft: if the engine is unavailable, recall via pool_recall alone.
+            try:
+                _eng = get_engine()
+            except Exception:
+                _eng = None
             auto = AutoRecall(
                 recall_fn=pool_recall,
+                engine=_eng,
                 config={"enabled": True, "max_memories_injected": 10, "relevance_threshold": 0.3},
             )
             context = auto.get_session_context(query="recent decisions and important context")

package/src/superlocalmemory/mcp/server.py

@@ -1,8 +1,8 @@
 # Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
 # Licensed under AGPL-3.0-or-later - see LICENSE file
-# Part of SuperLocalMemory V3 | https://qualixar.com | https://varunpratap.com
+# Part of SuperLocalMemory V4 | https://qualixar.com | https://varunpratap.com
 
-"""SuperLocalMemory V3 — MCP Server.
+"""SuperLocalMemory V4 — MCP Server.
 
 Clean MCP server calling V3 MemoryEngine. Supports all MCP-compatible IDEs.
 
@@ -27,11 +27,13 @@ _os.environ.setdefault('SLM_SKIP_DEP_CHECK', '1')
 import logging
 import sys
 
+from superlocalmemory import __version__ as _slm_version
 from superlocalmemory.mcp.http_transport import SLMFastMCP
 
 logger = logging.getLogger(__name__)
 
-server = SLMFastMCP("SuperLocalMemory V3")
+# mcp 2.0.0: MCPServer takes version= directly (no private _mcp_server poke).
+server = SLMFastMCP("SuperLocalMemory V4", version=_slm_version)
 
 # Lazy engine singleton -------------------------------------------------------
 
@@ -81,7 +83,7 @@ def reset_engine():
 # Antigravity, Windsurf) and a maximal SLM registration crowds out
 # other MCP servers the user may have installed.
 # Admin/diagnostics tools remain available via CLI (`slm <command>`).
-# Set SLM_MCP_ALL_TOOLS=1 to enable all 84 tools (power users).
+# Set SLM_MCP_ALL_TOOLS=1 to enable all 87 tools (power users).
 
 import os as _os_reg
 
@@ -97,6 +99,11 @@ _ESSENTIAL_TOOLS: set[str] = {
     "report_feedback",
     # Memory management (2)
     "forget", "run_maintenance",
+    # NOTE: prestage_context IS registered (see register_prestage_tool below)
+    # but is deliberately absent from the default surface. _ESSENTIAL_TOOLS must
+    # stay at 42 to match the full42 profile: the profile names are a
+    # user-facing config contract and the published tool-count table depends on
+    # them. New tools reach users via the `whole` profile until a rename ships.
     # Infinite memory + learning (4)
     "consolidate_cognitive", "get_soft_prompts",
     "set_mode", "report_outcome",
@@ -263,6 +270,46 @@ from superlocalmemory.mcp.tools_optimize import register_optimize_tools
 register_optimize_tools(_target)  # v3.6.11: Surface B Optimize tools (proxy-free)
 from superlocalmemory.mcp.tools_loops import register_loop_tools
 register_loop_tools(_target, get_engine)  # v3.8.0: bounded-loop tools (CLI+command+MCP)
+from superlocalmemory.mcp.tools_ops import register_ops_tools
+register_ops_tools(_target, get_engine)  # Wave-3: operational recovery & admin remediation
+from superlocalmemory.mcp.tools_context import register_prestage_tool
+
+
+def _prestage_recall(query: str, limit: int, profile_id: str, as_of: str | None = None):
+    """Bridge engine.recall → prestage_context recall_fn shape."""
+    engine = get_engine()
+    if hasattr(engine, "profile_id") and profile_id:
+        try:
+            engine.profile_id = profile_id
+        except Exception:
+            pass
+    try:
+        if as_of is not None:
+            results = engine.recall(query, limit=limit, as_of=as_of)
+        else:
+            results = engine.recall(query, limit=limit)
+    except TypeError:
+        results = engine.recall(query, limit=limit)
+    out: list[dict] = []
+    for r in results or []:
+        if isinstance(r, dict):
+            out.append({
+                "id": str(r.get("fact_id") or r.get("id") or ""),
+                "text": str(r.get("content") or r.get("text") or ""),
+                "score": float(r.get("score") or r.get("relevance_score") or 0.0),
+                "source": str(r.get("source") or "recall"),
+            })
+        else:
+            out.append({
+                "id": str(getattr(r, "fact_id", "") or ""),
+                "text": str(getattr(r, "content", "") or ""),
+                "score": float(getattr(r, "score", 0.0) or 0.0),
+                "source": "recall",
+            })
+    return out
+
+
+register_prestage_tool(_target, _prestage_recall)
 
 
 # Keep stdio MCP processes thin until a tool truly needs a local LIGHT engine.

package/src/superlocalmemory/mcp/shared.py

@@ -63,13 +63,32 @@ def authorize_mcp_mutation(
     MCP URL/env agent identifiers remain audit attribution only.  The trusted
     principal is derived from the private local install capability, matching
     the canonical ingestion and recall-worker mutation boundaries.
+
+    Phase 1: Routes through the admission registry so enterprise policy applies
+    even when the caller has local trust (trust-hook alone cannot bypass registry).
+    AdmissionDenied propagates to the caller; personal OWNER is always admitted.
     """
     if operation not in {"update", "delete"}:
         raise ValueError("MCP mutations must use update or delete policy")
 
+    from superlocalmemory.core.actor_context import Transport
+    from superlocalmemory.core.admission import (
+        AdmissionDenied,
+        _resolve_deployment,
+        admit,
+        resolve_actor,
+    )
     from superlocalmemory.core.engine_ingestion import local_trusted_actor_id
+    from superlocalmemory.core.operation_request import OperationKind
     from superlocalmemory.mcp.agent_context import get_current_agent_id
 
+    deployment = _resolve_deployment()
+    tier = "enterprise" if deployment.is_enterprise else "personal"
+    mode = "company" if deployment.is_enterprise else "local"
+    actor = resolve_actor(Transport.MCP, tier=tier, mode=mode)
+    kind = OperationKind.FORGET if operation == "delete" else OperationKind.CORRECT
+    admit(kind, actor, mode=mode)  # raises AdmissionDenied on deny
+
     source_agent_id = get_current_agent_id(env_fallback=True)
     context = {
         "operation": operation,

package/src/superlocalmemory/mcp/tools_active.py

@@ -22,6 +22,10 @@ import logging
 import uuid
 from typing import TYPE_CHECKING, Callable
 
+from mcp.types import ToolAnnotations
+
+from superlocalmemory.core.admission import admits
+from superlocalmemory.core.operation_request import OperationKind
 from superlocalmemory.infra.data_root import state_path
 from superlocalmemory.mcp.shared import authorize_mcp_mutation
 from superlocalmemory.storage.read_connection import ReadConnectionFactory
@@ -257,7 +261,7 @@ def register_active_tools(server, get_engine: Callable) -> None:
     # ------------------------------------------------------------------
     # 1. session_init — Auto-recall project context at session start
     # ------------------------------------------------------------------
-    @server.tool()
+    @server.tool(annotations=ToolAnnotations(readOnlyHint=True))
     async def session_init(
         project_path: str = "",
         query: str = "",
@@ -289,7 +293,7 @@ def register_active_tools(server, get_engine: Callable) -> None:
             from superlocalmemory.mcp._pool_adapter import pool_recall
 
             engine = get_engine()
-            rules = RulesEngine()
+            rules = RulesEngine(config_path=state_path("config.json"))
 
             if not rules.should_recall("session_start"):
                 return {
@@ -436,6 +440,20 @@ def register_active_tools(server, get_engine: Callable) -> None:
                 # weaker ad-hoc path when the mandatory renderer fails.
                 context = ""
 
+            # Live soft-prompt injection (Phase 5): prepend the profile's behavioral
+            # soft prompt so it reaches the session_init context agents actually
+            # consume (same engine->AutoInvoker bridge AutoRecall uses). Fail-soft.
+            try:
+                _sp_getter = getattr(
+                    getattr(engine, "_auto_invoker", None),
+                    "_get_soft_prompt_text", None,
+                )
+                _soft_prompt = _sp_getter() if callable(_sp_getter) else ""
+                if _soft_prompt:
+                    context = f"{_soft_prompt}\n\n{context}" if context else _soft_prompt
+            except Exception as exc:
+                logger.warning("session_init soft-prompt injection failed: %s", exc)
+
             # GAP-FIX (v3.4.65 delivery-lead): the memories[] array is part of
             # the MCP response Claude Code ingests — it MUST be bounded too, not
             # just the rendered `context` string. Previously full unclamped
@@ -544,6 +562,7 @@ def register_active_tools(server, get_engine: Callable) -> None:
     # 2. observe — Auto-capture decisions/bugs/preferences
     # ------------------------------------------------------------------
     @server.tool()
+    @admits(OperationKind.REMEMBER)
     async def observe(
         content: str,
         agent_id: str | None = None,
@@ -568,7 +587,7 @@ def register_active_tools(server, get_engine: Callable) -> None:
             from superlocalmemory.hooks.rules_engine import RulesEngine
             from superlocalmemory.mcp._pool_adapter import pool_store
 
-            rules = RulesEngine()
+            rules = RulesEngine(config_path=state_path("config.json"))
 
             auto = AutoCapture(
                 store_fn=pool_store,
@@ -626,6 +645,7 @@ def register_active_tools(server, get_engine: Callable) -> None:
     # 3. report_feedback — Explicit feedback for learning
     # ------------------------------------------------------------------
     @server.tool()
+    @admits(OperationKind.REMEMBER)
     async def report_feedback(
         fact_id: str,
         feedback: str = "relevant",
@@ -741,6 +761,7 @@ def register_active_tools(server, get_engine: Callable) -> None:
     # ------------------------------------------------------------------
 
     @server.tool()
+    @admits(OperationKind.CONSOLIDATE)
     async def close_session(session_id: str = "") -> dict:
         """Close the current session and create temporal summary events.
 
@@ -794,10 +815,10 @@ def register_active_tools(server, get_engine: Callable) -> None:
     # ------------------------------------------------------------------
 
     @server.tool()
+    @admits(OperationKind.CORRECT)
     async def core_memory(
         action: str,
         fact_id: str = "",
-        profile_id: str = "default",
     ) -> dict:
         """Manage the explicit Core Memory pin set (v3.4.65).