superlocalmemory 4.0.4 → 4.0.6

package/src/superlocalmemory/core/store_pipeline.py

@@ -14,6 +14,7 @@ from __future__ import annotations
 import hashlib
 import json
 import logging
+import sqlite3
 import uuid
 from typing import TYPE_CHECKING, Any
 
@@ -51,6 +52,72 @@ def _ingestion_effect_id(operation_id: str, *parts: object) -> str:
     return hashlib.sha256(payload.encode("utf-8")).hexdigest()[:32]
 
 
+def _record_correction_candidate(
+    db: DatabaseManager,
+    *,
+    operation_id: str,
+    profile_id: str,
+    scope: str,
+    predecessor_fact_id: str,
+    successor_fact_id: str,
+    reason_code: str,
+    trusted_actor_id: str,
+) -> None:
+    """Append a review candidate through the current canonical transaction.
+
+    This intentionally carries identifiers and a controlled reason code only.
+    It must not use detector prose because that can contain user memory text.
+    If the current path is bound to the canonical coordinator,
+    ``raw_connection`` yields its already-open transaction; otherwise the
+    database manager owns the short transaction. Either path is atomic.
+    """
+    if not trusted_actor_id or not predecessor_fact_id or not successor_fact_id:
+        return
+    if predecessor_fact_id == successor_fact_id:
+        return
+    from superlocalmemory.storage.correction_cases import (
+        CorrectionActor,
+        CorrectionCaseError,
+        propose_on_connection,
+    )
+
+    case_id = _ingestion_effect_id(
+        operation_id, "correction-case", profile_id, predecessor_fact_id,
+        successor_fact_id, reason_code,
+    )
+    idempotency_key = _ingestion_effect_id(
+        operation_id, "correction-proposal", profile_id, predecessor_fact_id,
+        successor_fact_id, reason_code,
+    )
+    actor = CorrectionActor(
+        actor_id=trusted_actor_id,
+        actor_kind="host_attested",
+        trust_tier="canonical_writer",
+    )
+    try:
+        with db.raw_connection() as conn:
+            propose_on_connection(
+                conn,
+                case_id=case_id,
+                profile_id=profile_id,
+                scope=scope,
+                predecessor_fact_id=predecessor_fact_id,
+                successor_fact_id=successor_fact_id,
+                reason_code=reason_code,
+                actor=actor,
+                idempotency_key=idempotency_key,
+                # Candidate detection observes a possible correction. It does
+                # not claim an event-time boundary from heuristic evidence.
+                is_profile_active=lambda candidate_profile: candidate_profile == profile_id,
+                is_actor_trusted=lambda candidate_actor: candidate_actor == actor,
+            )
+    except (CorrectionCaseError, sqlite3.Error, ValueError) as exc:
+        # A missing/hot-upgrading M042 ledger must not make memory ingestion
+        # unavailable. The candidate is advisory and has no retrieval effect;
+        # the warning is the operational signal that an operator must inspect.
+        logger.warning("Correction candidate not recorded for %s: %s", successor_fact_id, exc)
+
+
 def _record_fact_entity_association(
     db: DatabaseManager,
     *,
@@ -731,47 +798,30 @@ def run_store(
                         continue
                     fact = existing_fact
 
-                # Opinion confidence tracking: reinforce or decay
-                if fact.fact_type == FactType.OPINION and action.action_type.value == "update":
-                    try:
-                        existing = db.get_fact(
-                            action.existing_fact_id or action.new_fact_id
-                        )
-                        if existing and existing.fact_type == FactType.OPINION:
-                            new_conf = min(1.0, existing.confidence + 0.1)
-                            db.update_fact(existing.fact_id, {"confidence": new_conf})
-                    except Exception:
-                        pass
-                elif fact.fact_type == FactType.OPINION and action.action_type.value == "supersede":
-                    try:
-                        old_id = getattr(action, "old_fact_id", None)
-                        if old_id:
-                            old_fact = db.get_fact(old_id)
-                            if old_fact:
-                                new_conf = max(0.0, old_fact.confidence - 0.2)
-                                db.update_fact(old_id, {"confidence": new_conf})
-                    except Exception:
-                        pass
-
                 if action.action_type.value in ("update", "supersede"):
-                    target_id = (
-                        (action.existing_fact_id or action.new_fact_id)
-                        if action.action_type.value == "update"
-                        else action.new_fact_id
-                    )
-                    if is_queryable_promotion and target_id != fact.fact_id:
-                        db.delete_fact(fact.fact_id)
-                    updated_fact = db.get_fact(target_id)
-                    if updated_fact is None:
+                    # A consolidator UPDATE/SUPERSEDE is a review-required
+                    # proposal.  It persists the incoming successor and does
+                    # not mutate, delete, archive, or change trust on the
+                    # matched predecessor.  Continue materializing the
+                    # incoming fact through the common projection pipeline.
+                    proposed_fact = db.get_fact(action.new_fact_id)
+                    if proposed_fact is None:
                         raise RuntimeError(
-                            f"consolidation {action.action_type.value} produced "
-                            f"missing fact {target_id}"
+                            f"consolidation {action.action_type.value} proposal produced "
+                            f"missing fact {action.new_fact_id}"
+                        )
+                    fact = proposed_fact
+                    if action.existing_fact_id:
+                        _record_correction_candidate(
+                            db,
+                            operation_id=ingestion_operation_id,
+                            profile_id=profile_id,
+                            scope=scope,
+                            predecessor_fact_id=action.existing_fact_id,
+                            successor_fact_id=action.new_fact_id,
+                            reason_code=f"consolidation_{action.action_type.value}",
+                            trusted_actor_id=trusted_actor_id,
                         )
-                    # Continue through the shared index/graph/temporal/
-                    # provenance stages.  The previous early continue made
-                    # UPDATE/SUPERSEDE facts look stored while skipping half of
-                    # canonical materialization.
-                    fact = updated_fact
                 # ADD case: consolidator already stored the fact (F8 fix)
                 # Fall through to post-processing below
             else:
@@ -860,6 +910,18 @@ def run_store(
                         "Temporal: %d facts invalidated by new fact %s",
                         len(invalidations), fact.fact_id,
                     )
+                    for candidate in invalidations:
+                        predecessor_fact_id = str(candidate.get("old_fact_id") or "")
+                        _record_correction_candidate(
+                            db,
+                            operation_id=ingestion_operation_id,
+                            profile_id=profile_id,
+                            scope=scope,
+                            predecessor_fact_id=predecessor_fact_id,
+                            successor_fact_id=fact.fact_id,
+                            reason_code="temporal_contradiction",
+                            trusted_actor_id=trusted_actor_id,
+                        )
             except Exception as exc:
                 temporal_complete = False
                 logger.debug(

package/src/superlocalmemory/encoding/consolidator.py

@@ -4,10 +4,13 @@
 
 """SuperLocalMemory V3 — Memory Consolidator.
 
-Mem0-style ADD/UPDATE/SUPERSEDE/NOOP logic for incoming facts.
-V1 was append-only (never updated, never deleted, never merged).
-This module gives a ~26% uplift by deduplicating, updating, and
-resolving contradictions at encoding time.
+Mem0-style ADD/UPDATE/SUPERSEDE/NOOP classification for incoming facts.
+
+UPDATE and SUPERSEDE are now *proposal classifications*: they persist the
+incoming fact but never rewrite, archive, lower trust for, or otherwise mutate
+the matched fact.  A reviewed correction owner may later apply a case through
+the correction ledger.  This keeps ingestion useful while preventing an
+automatic model judgement from changing the historical record.
 
 Mode A: keyword-based contradiction detection (zero LLM).
 Mode B/C: LLM-assisted contradiction detection when available.
@@ -20,7 +23,7 @@ from __future__ import annotations
 
 import logging
 import math
-from typing import Any, Protocol
+from typing import Protocol
 
 from superlocalmemory.core.config import EncodingConfig
 from superlocalmemory.storage.database import DatabaseManager
@@ -30,7 +33,6 @@ from superlocalmemory.storage.models import (
     ConsolidationActionType,
     EdgeType,
     GraphEdge,
-    MemoryLifecycle,
 )
 
 logger = logging.getLogger(__name__)
@@ -310,29 +312,17 @@ class MemoryConsolidator:
         *,
         reason: str,
     ) -> ConsolidationAction:
-        """Update existing fact: bump evidence, optionally merge content."""
-        new_evidence = existing.evidence_count + 1
-        new_confidence = min(1.0, existing.confidence + 0.05)
-        updates: dict[str, Any] = {
-            "evidence_count": new_evidence,
-            "confidence": new_confidence,
-        }
-
-        # If LLM available, merge content for a richer fact
-        if self._llm is not None and self._llm.is_available():
-            merged = self._merge_facts(existing.content, new_fact.content)
-            if merged:
-                updates["content"] = merged
-
-        self._db.update_fact(existing.fact_id, updates)
+        """Persist a proposed refinement without rewriting the predecessor."""
+        self._db.store_fact(new_fact)
+        self._create_semantic_edges(new_fact, profile_id)
         action = self._log_action(
             ConsolidationActionType.UPDATE,
             new_fact.fact_id, existing.fact_id,
             profile_id, reason,
         )
         logger.debug(
-            "UPDATE fact %s (evidence=%d): %s",
-            existing.fact_id, new_evidence, reason,
+            "UPDATE proposal %s -> %s: %s",
+            existing.fact_id, new_fact.fact_id, reason,
         )
         return action
 
@@ -344,37 +334,17 @@ class MemoryConsolidator:
         *,
         reason: str,
     ) -> ConsolidationAction:
-        """Archive old fact, store new, create contradiction edge."""
-        # Archive old fact (keep for history but deprioritize in retrieval)
-        self._db.update_fact(
-            existing.fact_id,
-            {"lifecycle": MemoryLifecycle.ARCHIVED},
-        )
-        # Store new fact
+        """Persist a proposed successor without changing the predecessor."""
         self._db.store_fact(new_fact)
-        # Create contradiction + supersedes edges
-        self._db.store_edge(GraphEdge(
-            profile_id=profile_id,
-            source_id=new_fact.fact_id,
-            target_id=existing.fact_id,
-            edge_type=EdgeType.CONTRADICTION,
-            weight=1.0,
-        ))
-        self._db.store_edge(GraphEdge(
-            profile_id=profile_id,
-            source_id=new_fact.fact_id,
-            target_id=existing.fact_id,
-            edge_type=EdgeType.SUPERSEDES,
-            weight=1.0,
-        ))
+        self._create_semantic_edges(new_fact, profile_id)
         action = self._log_action(
             ConsolidationActionType.SUPERSEDE,
             new_fact.fact_id, existing.fact_id,
             profile_id, reason,
         )
         logger.debug(
-            "SUPERSEDE %s → %s: %s",
-            new_fact.fact_id, existing.fact_id, reason,
+            "SUPERSEDE proposal %s -> %s: %s",
+            existing.fact_id, new_fact.fact_id, reason,
         )
         return action
 

package/src/superlocalmemory/encoding/temporal_validator.py

@@ -2,7 +2,7 @@
 # Licensed under AGPL-3.0-or-later - see LICENSE file
 # Part of SuperLocalMemory V3
 
-"""Temporal Intelligence -- contradiction detection and fact invalidation.
+"""Temporal Intelligence -- contradiction detection and reviewable proposals.
 
 Implements full bi-temporal validity tracking with 4 timestamps (L8 fix).
 Contradiction detection via sheaf cohomology (Mode A: pure math) or
@@ -36,7 +36,7 @@ logger = logging.getLogger(__name__)
 
 
 class TemporalValidator:
-    """Validates temporal consistency and manages fact invalidation.
+    """Validates temporal consistency and proposes fact corrections.
 
     Components received via __init__ (NOT the engine -- Rule 06):
     - db: DatabaseManager
@@ -75,15 +75,20 @@ class TemporalValidator:
         new_fact: AtomicFact,
         profile_id: str,
     ) -> list[dict]:
-        """Check new fact for contradictions and invalidate old facts.
+        """Check new fact for contradictions without mutating old facts.
 
         Algorithm:
         1. Detect contradictions (sheaf or LLM).
-        2. For each contradiction: invalidate old fact (set valid_until + system_expired_at).
-        3. Apply trust penalty to invalidated facts.
-        4. Return list of invalidation actions.
+        2. Exclude valid historical progressions using explicit event anchors.
+        3. Return review-required correction candidates.
 
-        Returns list of dicts: {old_fact_id, new_fact_id, reason, severity}
+        This legacy method name is intentionally retained for API compatibility.
+        It no longer expires facts, changes trust, or changes retrieval state.
+        The reviewed-correction owner is the only layer permitted to apply a
+        candidate to bi-temporal validity.
+
+        Returns list of dicts: {old_fact_id, new_fact_id, reason, severity,
+        status="proposed"}.
         """
         contradictions = self.detect_contradiction(new_fact, profile_id)
 
@@ -108,25 +113,16 @@ class TemporalValidator:
                 )
                 continue
 
-            # Step 1: Invalidate the old fact (bi-temporal)
-            self.invalidate_fact(
-                fact_id=old_fact_id,
-                invalidated_by=new_fact.fact_id,
-                reason=reason,
-            )
-
-            # Step 2: Apply trust penalty
-            self._apply_trust_penalty(old_fact_id, profile_id)
-
             actions.append({
                 "old_fact_id": old_fact_id,
                 "new_fact_id": new_fact.fact_id,
                 "reason": reason,
                 "severity": severity,
+                "status": "proposed",
             })
 
         logger.info(
-            "Temporal: invalidated %d facts due to new fact %s",
+            "Temporal: proposed %d correction(s) due to new fact %s",
             len(actions), new_fact.fact_id,
         )
         return actions

package/src/superlocalmemory/hooks/user_prompt_hook.py

@@ -98,7 +98,7 @@ def main() -> int:
 
     try:
         topic_sig = compute_topic_signature(prompt, entity_hits=entity_hits)
-        entry = read_entry_fast(session_id, topic_sig)
+        entry = read_entry_fast(session_id, topic_sig, require_current_admission=True)
     except Exception:
         sys.stdout.write("{}")
         return 0

package/src/superlocalmemory/infra/backup.py

@@ -25,6 +25,10 @@ from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Dict, Generator, List, Optional
 
+from superlocalmemory.infra.backup_obligations import (
+    BackupObligationStore,
+    erase_profile_from_snapshot,
+)
 from superlocalmemory.infra.data_root import DynamicStatePath, canonical_data_root
 
 logger = logging.getLogger("superlocalmemory.backup")
@@ -387,6 +391,21 @@ class BackupCoordinator:
         # Phase C succeeded — remove pre-restore snapshots.
         self._cleanup_pre_restore_snapshots(pre_restore_map, pre_restore_lance)
 
+        # Phase D — GDPR obligation replay (invariant: no restore may resurrect
+        # erased personal data).  Must run AFTER live files are in place and
+        # pre-restore snapshots are removed so there is no window where the
+        # erased data could be read.  A replay failure raises immediately; the
+        # caller receives BackupRestoreError and must treat the restore as
+        # failed until an operator manually remediates.
+        if backup_set_dir is not None:
+            _replay_obligations_after_restore(
+                data_root=self._base_dir,
+                snapshot_key=str(backup_set_dir),
+                restored_db_paths=[
+                    self._base_dir / e.store_name for e in manifest.stores
+                ],
+            )
+
     # ------------------------------------------------------------------
     # Internal helpers (factored out for subclass testability)
     # ------------------------------------------------------------------
@@ -727,6 +746,24 @@ class BackupManager:
                 src.close()
 
             logger.info("Restored: %s -> %s", filename, target.name)
+
+            # GDPR obligation replay — prevent a restore from resurrecting
+            # previously erased personal data.  Failure is fatal: return False
+            # so the caller knows the restore is not clean.
+            try:
+                _replay_obligations_after_restore(
+                    data_root=self.db_path.parent,
+                    snapshot_key=str(backup_path),
+                    restored_db_paths=[target],
+                )
+            except BackupRestoreError as exc:
+                logger.error(
+                    "Restore obligation replay failed for %s: %s — "
+                    "restore is NOT clean; erased data may be present",
+                    filename, exc,
+                )
+                return False
+
             return True
 
         except Exception as exc:
@@ -798,3 +835,104 @@ class BackupManager:
             "total_size_mb": round(sum(b["size_mb"] for b in backups), 2),
             "backups": backups,
         }
+
+
+# ---------------------------------------------------------------------------
+# GDPR obligation replay — module-level so both backup classes can call it
+# ---------------------------------------------------------------------------
+
+
+def _replay_obligations_after_restore(
+    data_root: Path,
+    snapshot_key: str,
+    restored_db_paths: list[Path],
+) -> None:
+    """Re-apply pending erasure obligations to freshly restored database files.
+
+    This function is the enforcement point for the restore-replay invariant:
+    no restore may resurface data that was Art.17-erased from the live stores.
+
+    ``snapshot_key`` is the string path that was recorded as the obligation's
+    ``snapshot_path`` when the obligation was created (typically the backup-set
+    directory for new-style backups, or the per-file `.db` path for legacy
+    backups).
+
+    Raises:
+        BackupRestoreError: if any obligation cannot be replayed.  The caller
+            must treat the restore as failed and surface this to the operator.
+    """
+    store = BackupObligationStore(data_root)
+    obligations = store.list_pending_for_snapshot(snapshot_key)
+
+    # Belt-and-suspenders: even when path matching fails (e.g. backup moved),
+    # detect erased profiles by scanning the restored DB and checking whether
+    # any of the profiles present have pending obligations.
+    if not obligations:
+        for db_path in restored_db_paths:
+            if not db_path.exists():
+                continue
+            try:
+                import sqlite3 as _sq3
+                conn = _sq3.connect(str(db_path))
+                try:
+                    tables = {
+                        r[0] for r in
+                        conn.execute(
+                            "SELECT name FROM sqlite_master WHERE type='table'"
+                        ).fetchall()
+                    }
+                    for tbl in ("profiles", "atomic_facts"):
+                        if tbl not in tables:
+                            continue
+                        cols = {
+                            r[1] for r in
+                            conn.execute(f"PRAGMA table_info({tbl})").fetchall()
+                        }
+                        if "profile_id" not in cols:
+                            continue
+                        for (pid,) in conn.execute(
+                            f"SELECT DISTINCT profile_id FROM {tbl}"
+                        ).fetchall():
+                            if pid:
+                                obligations.extend(
+                                    store.list_pending_for_profile(pid)
+                                )
+                finally:
+                    conn.close()
+            except Exception as exc:  # noqa: BLE001
+                logger.warning(
+                    "_replay_obligations_after_restore: scan failed for %s: %s",
+                    db_path.name, exc,
+                )
+
+    if not obligations:
+        return
+
+    profile_ids = {o["profile_id"] for o in obligations}
+
+    for profile_id in profile_ids:
+        for db_path in restored_db_paths:
+            if not db_path.exists():
+                continue
+            try:
+                deleted = erase_profile_from_snapshot(db_path, profile_id)
+                if deleted:
+                    logger.info(
+                        "Restore replay: erased profile %r from %s: %s",
+                        profile_id, db_path.name, deleted,
+                    )
+            except Exception as exc:  # noqa: BLE001
+                raise BackupRestoreError(
+                    f"Erasure obligation replay failed for profile {profile_id!r} "
+                    f"in {db_path.name}: {exc}.  "
+                    "The restored database may contain previously erased personal "
+                    "data.  Manual remediation required."
+                ) from exc
+
+    # Discharge obligations for this specific snapshot so they do not block
+    # the completeness flag for future erasures of the same profile.
+    discharged = store.discharge_for_snapshot(snapshot_key, "replayed_on_restore")
+    logger.info(
+        "Obligation replay: discharged %d obligations for snapshot %s",
+        discharged, snapshot_key,
+    )