wicked-crew 0.7.17 → 0.7.19

package/dist/api/routes.d.ts

@@ -193,6 +193,17 @@ export declare const OpenPathSchema: z.ZodObject<{
     path: string;
     runId?: string | undefined;
 }>;
+/** `POST /memory/retire` body (DES-MEM-FACETED-001). `scope_prefix` is REQUIRED and, after trim,
+ *  non-empty (enforced in the route so the 400 names the total-wipe guard): estate `memory.erase`
+ *  is subtree-scoped and refuses an empty prefix. `.strict()` for the FINDING-031 posture — an
+ *  unknown field is a 400, never silently ignored into a broader erase than the caller sent. */
+export declare const RetireMemorySchema: z.ZodObject<{
+    scope_prefix: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    scope_prefix: string;
+}, {
+    scope_prefix: string;
+}>;
 /** The actor/audit deps (task #88) — threaded from `createServer`. */
 export interface SecurityDeps {
     audit: AuditLog;
@@ -247,6 +258,12 @@ export interface RuntimeDeps {
      *  Injectable so route tests never shell out to git; defaults to {@link gitReprovisionWorktree}. */
     reprovisionWorktree?: WorktreeReprovisioner;
     openWithOs?: (target: string) => Promise<void>;
+    /** The estate-MCP client behind `/proposals*` AND `/memory*` (DES-MEM-FACETED-001) — one seam for
+     *  every operator-facing estate tool (`proposal.*` + `memory.recall`/`memory.coverage`/
+     *  `memory.erase`). Injectable so route tests never spawn `wicked-estate-mcp`; defaults to the
+     *  real spawn-per-call client (NON-`--readonly`, `WICKED_MEMORY_DB` pinned to the operator global
+     *  store — memory.erase is a WRITE). */
+    callEstateTool?: (tool: string, args: Record<string, unknown>) => Promise<unknown>;
     /** Seat sign-in presence probe (seat sign-in) — injectable so route tests never read the
      *  developer's real dotfiles. Defaults to the file/env heuristic in seat-signin.ts. */
     signedIn?: (seatKey: string, workerConfigRoot?: string) => boolean | null;

package/dist/api/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAmD,WAAW,EAA4E,MAAM,oBAAoB,CAAC;AAG5K,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAMnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAWrD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAYtF,OAAO,EAAe,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAGnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,aAAa,EAOd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAgG7C;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,YAAY;;;;;;;;IAQvB;+FAC2F;;IAE3F;;;;;;+CAM2C;;IAE3C;;0FAEsF;;IAEtF;;;;6FAIyF;;IAEzF;;wDAEoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASpD,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;EAGZ,CAAC;AAEZ;;yEAEyE;AACzE,eAAO,MAAM,cAAc;;;;;;EAEhB,CAAC;AAgBZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAQpB,CAAC;AAOZ,4FAA4F;AAC5F,eAAO,MAAM,cAAc;;;;;;;;;EAGhB,CAAC;AAwBZ,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;oGACgG;IAChG,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;sDAEkD;IAClD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;uGACmG;IACnG,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;qBAEiB;IACjB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;4DAEwD;IACxD,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C;;oGAEgG;IAChG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;;yBAGqB;IACrB,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE;;;;gGAI4F;IAC5F,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;2FAEuF;IACvF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;wGAEoG;IACpG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;2FACuF;IACvF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC1E;;0DAEsD;IACtD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C;;gFAE4E;IAC5E,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,cAAc,CAAC;IAC3D;4FACwF;IACxF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;mGAC+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,EAIlC,YAAY,GAAE,WAA+B,EAG7C,QAAQ,GAAE,iBAAqF,EAK/F,QAAQ,GAAE,YAA0D,EAGpE,OAAO,GAAE,WAAgB,GACxB,IAAI,CAmhFN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/api/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAmD,WAAW,EAA4E,MAAM,oBAAoB,CAAC;AAG5K,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAmBnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAWrD,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAYtF,OAAO,EAAe,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAGnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,aAAa,EAOd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAGL,KAAK,WAAW,EAEhB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AA+J7C;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,YAAY;;;;;;;;IAQvB;+FAC2F;;IAE3F;;;;;;+CAM2C;;IAE3C;;0FAEsF;;IAEtF;;;;6FAIyF;;IAEzF;;wDAEoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASpD,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;EAGZ,CAAC;AAEZ;;yEAEyE;AACzE,eAAO,MAAM,cAAc;;;;;;EAEhB,CAAC;AAgBZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAQpB,CAAC;AAOZ,4FAA4F;AAC5F,eAAO,MAAM,cAAc;;;;;;;;;EAGhB,CAAC;AAEZ;;;gGAGgG;AAChG,eAAO,MAAM,kBAAkB;;;;;;EAEpB,CAAC;AAwBZ,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;oGACgG;IAChG,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;sDAEkD;IAClD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;uGACmG;IACnG,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;qBAEiB;IACjB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;4DAEwD;IACxD,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C;;oGAEgG;IAChG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;;yBAGqB;IACrB,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE;;;;gGAI4F;IAC5F,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;2FAEuF;IACvF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;wGAEoG;IACpG,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;;4CAIwC;IACxC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF;2FACuF;IACvF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAC1E;;0DAEsD;IACtD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C;;gFAE4E;IAC5E,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,cAAc,CAAC;IAC3D;4FACwF;IACxF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;mGAC+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB,EAIlC,YAAY,GAAE,WAA+B,EAG7C,QAAQ,GAAE,iBAAqF,EAK/F,QAAQ,GAAE,YAA0D,EAGpE,OAAO,GAAE,WAAgB,GACxB,IAAI,CA2vFN"}

package/dist/api/routes.js

@@ -14,6 +14,7 @@ import { buildAcceptanceView, resolveRunWorkflow } from '../qe/acceptance.js';
 import { buildEvidenceBundle, coreUnitId, evidenceFilename } from './evidence.js';
 import { outputUnavailableReason, resolveUnit, unitKeysFor } from './unit-output.js';
 import { execCapped, ExecOutputTooLarge } from '../core/exec.js';
+import { callEstateTool, EstateMcpError } from '../core/estate-mcp-client.js';
 import { SeatHealthTracker } from './seat-health.js';
 import { applyWorkerConfigRoot, signedInHeuristic } from './seat-signin.js';
 import { allowedRootsFor, isInsideRoot, openWithSystemDefault } from './open-path.js';
@@ -86,6 +87,59 @@ function invalidBody(err, what) {
         : what;
     return { error, details: err.issues };
 }
+/** First value of a possibly-repeated query param, WITHOUT trimming — `''` is PRESERVED because a
+ *  blank `scope`/`scope_prefix` is meaningful to estate (root / whole-subtree), unlike an omitted
+ *  one. Returns undefined only when the param is absent. */
+function firstQueryValue(v) {
+    return Array.isArray(v) ? v[0] : v;
+}
+/** A JSON object whose every value is a string (a facet/intent tuple, axis→value). */
+function isStringRecord(v) {
+    return (typeof v === 'object' &&
+        v !== null &&
+        !Array.isArray(v) &&
+        Object.values(v).every((x) => typeof x === 'string'));
+}
+/** A JSON object whose every value is a number (a coverage breakdown map). */
+function isNumberRecord(v) {
+    return (typeof v === 'object' &&
+        v !== null &&
+        !Array.isArray(v) &&
+        Object.values(v).every((x) => typeof x === 'number'));
+}
+/** The broad-browse recall token budget for `GET /memory` when the caller passes no `limit` — larger
+ *  than estate's own 2000 default so a browse returns a meaningful slice, not a conversational one. */
+const MEMORY_BROWSE_TOKEN_BUDGET = 8000;
+/**
+ * Shape one estate `memory.recall` item (`{ memory_id, scope, content, tier, score }`) into the wire
+ * {@link MemoryItem}. estate recall does NOT surface per-item facets, so `facets` defaults to `{}`
+ * (mapped defensively so a future estate that DOES carry them rides through); `score` is dropped
+ * when absent. String fields missing on the wire degrade to `''` rather than throwing on one item.
+ */
+function shapeMemoryItem(raw) {
+    const r = typeof raw === 'object' && raw !== null ? raw : {};
+    const str = (v) => (typeof v === 'string' ? v : '');
+    const item = {
+        id: str(r['memory_id']),
+        content: str(r['content']),
+        tier: str(r['tier']),
+        scope: str(r['scope']),
+        facets: isStringRecord(r['facets']) ? r['facets'] : {},
+    };
+    if (typeof r['score'] === 'number')
+        item.score = r['score'];
+    return item;
+}
+/** Shape the estate `memory.coverage` result (`{ total, by_tier, by_kind }`) into the wire
+ *  {@link MemoryCoverageResponse}. A shape estate never produces is an UPSTREAM fault — thrown as an
+ *  {@link EstateMcpError} (→ 502), never silently coerced to zeroes. */
+function shapeMemoryCoverage(raw) {
+    const r = typeof raw === 'object' && raw !== null ? raw : undefined;
+    if (r === undefined || typeof r['total'] !== 'number' || !isNumberRecord(r['by_tier']) || !isNumberRecord(r['by_kind'])) {
+        throw new EstateMcpError('memory.coverage returned an unexpected shape');
+    }
+    return { total: r['total'], by_tier: r['by_tier'], by_kind: r['by_kind'] };
+}
 // Closed facet vocabularies for the `GET /governance/rules` browse filters (wiki-mgmt) — the
 // wire contract's `RuleBrowseQuery`. Sets, not zod: the query is otherwise free-form and only
 // these three facets have a vocabulary to enforce.
@@ -212,6 +266,13 @@ export const OpenPathSchema = z.object({
     path: z.string().min(1),
     runId: z.string().min(1).optional(),
 }).strict();
+/** `POST /memory/retire` body (DES-MEM-FACETED-001). `scope_prefix` is REQUIRED and, after trim,
+ *  non-empty (enforced in the route so the 400 names the total-wipe guard): estate `memory.erase`
+ *  is subtree-scoped and refuses an empty prefix. `.strict()` for the FINDING-031 posture — an
+ *  unknown field is a 400, never silently ignored into a broader erase than the caller sent. */
+export const RetireMemorySchema = z.object({
+    scope_prefix: z.string(),
+}).strict();
 /**
  * A SKIN-OWNED settings key (crew#323): one lowercase segment under the `studio.` namespace,
  * e.g. `studio.appearance`, `studio.notifications`. The daemon never interprets these values —
@@ -282,6 +343,10 @@ runtime = {}) {
         });
     const deliverExec = runtime.deliverExec ?? runDeliverScript;
     const reprovisionWorktree = runtime.reprovisionWorktree ?? gitReprovisionWorktree;
+    // The estate MCP client behind `/proposals*` AND `/memory*` (DES-MEM-FACETED-001) — one seam. The
+    // default is the real spawn-per-call `wicked-estate-mcp` client; route tests inject a stub so no
+    // process is ever spawned.
+    const estateTool = runtime.callEstateTool ?? callEstateTool;
     /** Repo root for a repo ref, from the registry — shared by the reprovision path below. */
     const repoRootOf = async (repoRef) => (await adapter.listRepos()).find((r) => r.id === repoRef)?.root_path;
     // The run-DTO joins (DES-UX-001 §8.2/§8.3, DES-UX-002 §7.2): `project_id` from the membership
@@ -2636,6 +2701,207 @@ runtime = {}) {
         });
         return { settings };
     });
+    // ── Memory proposal queue (DES-MEM-FACETED-001 §5.0) ─────────────────────────
+    // The estate proposal queue over HTTP, so a studio operator can review the learnings workers
+    // propose and approve/reject them. The queue tools live ONLY on the estate MCP (JSON-RPC over
+    // stdio, estate #162), reached through `proposalTool` — a spawn-per-call `wicked-estate-mcp`
+    // client, NON-`--readonly` (this is the OPERATOR surface: it lists AND mutates), with
+    // WICKED_MEMORY_DB pinned to the operator global store. A queue/estate failure is an UPSTREAM
+    // fault (502), kept distinct from a client mistake (400: a bad `state`/`id`, or estate's own
+    // -32602 invalid-params) — the FINDING-031 posture that a malformed filter is refused, never
+    // silently honored as a different request.
+    const estateUpstreamError = (reply, err) => {
+        if (err instanceof EstateMcpError && err.code === -32602) {
+            return reply.code(400).send({ error: err.message });
+        }
+        return reply.code(502).send({ error: message(err) });
+    };
+    // GET /proposals?kind_type=&state= → proposal.list → { proposals: Proposal[] }.
+    app.get(`${V}/proposals`, { config: { manifest: { responseType: 'ListProposalsResponse', statusCodes: [200, 400, 502] } } }, async (req, reply) => {
+        const q = req.query;
+        const rawOf = (v) => Array.isArray(v) ? v[0] : v;
+        const rawKind = rawOf(q.kind_type);
+        const rawState = rawOf(q.state);
+        // Fail-loud: a PRESENT-but-blank param (`?state=` / `?state=%20`) is a client error, NOT a
+        // silent "no filter" — else a client accidentally issues a broader query than intended.
+        if (rawKind !== undefined && rawKind.trim() === '') {
+            return reply.code(400).send({ error: '`kind_type` must not be empty' });
+        }
+        if (rawState !== undefined && !['pending', 'approved', 'rejected'].includes(rawState.trim())) {
+            return reply.code(400).send({ error: '`state` must be one of pending|approved|rejected' });
+        }
+        const kindType = rawKind?.trim() || undefined;
+        const state = rawState?.trim() || undefined;
+        const args = {};
+        if (kindType !== undefined)
+            args.kind_type = kindType;
+        if (state !== undefined)
+            args.state = state;
+        try {
+            return (await estateTool('proposal.list', args));
+        }
+        catch (err) {
+            return estateUpstreamError(reply, err);
+        }
+    });
+    // POST /proposals/:id/approve → proposal.approve →
+    //   { outcome:'promoted', active_id }  — a MEMORY proposal, now an active memory (complete);
+    //   { outcome:'handed_off', payload }  — a POLICY proposal, returned VERBATIM.
+    app.post(`${V}/proposals/:id/approve`, { config: { manifest: { responseType: 'ApproveProposalResponse', statusCodes: [200, 400, 502] } } }, async (req, reply) => {
+        const { id } = req.params;
+        if (id.trim() === '') {
+            return reply.code(400).send({ error: '`id` is required' });
+        }
+        try {
+            // TODO: route handed_off policy payload to steering (crew steering-write, DES-MEM-FACETED-001
+            // §5.2). Policy→steering routing is OUT OF SCOPE here: a `handed_off` outcome is passed
+            // through as-is for a later steering-write to consume; memory proposals return `promoted` and
+            // need nothing more.
+            return (await estateTool('proposal.approve', { id }));
+        }
+        catch (err) {
+            return estateUpstreamError(reply, err);
+        }
+    });
+    // POST /proposals/:id/reject → proposal.reject → { ok: true }.
+    app.post(`${V}/proposals/:id/reject`, { config: { manifest: { responseType: 'RejectProposalResponse', statusCodes: [200, 400, 502] } } }, async (req, reply) => {
+        const { id } = req.params;
+        if (id.trim() === '') {
+            return reply.code(400).send({ error: '`id` is required' });
+        }
+        try {
+            return (await estateTool('proposal.reject', { id }));
+        }
+        catch (err) {
+            return estateUpstreamError(reply, err);
+        }
+    });
+    // ── Memory management (governed-knowledge surface, DES-MEM-FACETED-001) ───────
+    // Browse + retire the EXISTING operator memory store — the studio counterpart to /proposals:
+    // proposals DECIDE learnings not yet stored; these MANAGE what already is. The estate memory
+    // tools live ONLY on the estate MCP (memory.recall / memory.coverage / memory.erase), reached
+    // through the SAME `estateTool` seam and `estateUpstreamError` ladder as /proposals — a client
+    // mistake (non-integer limit, malformed facets JSON, empty retire scope_prefix, or estate's own
+    // -32602 invalid-params) is a 400; an upstream estate/transport fault, or a malformed estate
+    // response, is a 502.
+    //
+    // GRANULARITY, stated honestly (the estate contract, not a convenience wrapper):
+    //   • BROWSE is query-based. estate has no "list all"; `memory.recall` returns a token-budgeted,
+    //     relevance-ranked slice. Broad browse = an empty `query` + `scope_prefix` (subtree filter,
+    //     "" = every memory) + a large token budget. `limit` IS that token budget — estate exposes no
+    //     row-count cap — so it bounds the SIZE of the slice, not a memory count.
+    //   • recall returns { memory_id, scope, content, tier, score } and does NOT surface per-item
+    //     facets, so MemoryItem.facets is always {} (mapped defensively for a future estate).
+    //   • RETIRE is SUBTREE-scoped, never per-id. estate exposes NO per-memory delete: `memory.erase`
+    //     hard-deletes EVERY memory whose scope equals or descends from `scope_prefix`, and refuses an
+    //     empty prefix (a total-wipe guard). So retire takes a `scope_prefix` and reports how many
+    //     memories the subtree wipe removed — the UI must show the operator the subtree, not one row.
+    // GET /memory?query=&scope=&scope_prefix=&facets=<json>&limit= → memory.recall → { memories }.
+    app.get(`${V}/memory`, { config: { manifest: { responseType: 'ListMemoriesResponse', statusCodes: [200, 400, 502] } } }, async (req, reply) => {
+        const q = req.query;
+        // `query` defaults to "" (broad browse). scope / scope_prefix forward verbatim WHEN PRESENT —
+        // a blank value is meaningful to estate (root / whole-subtree), so it is not dropped.
+        const args = { query: firstQueryValue(q.query) ?? '' };
+        const scope = firstQueryValue(q.scope);
+        if (scope !== undefined)
+            args.scope = scope;
+        const scopePrefix = firstQueryValue(q.scope_prefix);
+        if (scopePrefix !== undefined)
+            args.scope_prefix = scopePrefix;
+        // `facets` is the recall `intent` tuple (axis→value). Present-but-blank is a client error
+        // (fail-loud, never a silent no-filter — FINDING-031); a present value must parse to a JSON
+        // object of string values (estate further validates each axis and answers -32602 → 400).
+        const rawFacets = firstQueryValue(q.facets);
+        if (rawFacets !== undefined) {
+            if (rawFacets.trim() === '') {
+                return reply.code(400).send({ error: '`facets` must not be empty' });
+            }
+            let parsedFacets;
+            try {
+                parsedFacets = JSON.parse(rawFacets);
+            }
+            catch {
+                return reply.code(400).send({ error: '`facets` must be a JSON object of axis:value strings' });
+            }
+            if (!isStringRecord(parsedFacets)) {
+                return reply.code(400).send({ error: '`facets` must be a JSON object of axis:value strings' });
+            }
+            args.intent = parsedFacets;
+        }
+        // `limit` is the recall token budget (estate has no row-count cap). Omitted/blank ⇒ the broad
+        // browse budget; a present value must be a positive integer (mirrors GET /audit's `limit`).
+        const rawLimit = firstQueryValue(q.limit);
+        let tokenBudget = MEMORY_BROWSE_TOKEN_BUDGET;
+        if (rawLimit !== undefined && rawLimit.trim() !== '') {
+            const n = Number(rawLimit);
+            if (!Number.isFinite(n) || !Number.isInteger(n) || n < 1) {
+                return reply.code(400).send({ error: '`limit` must be a positive integer (the recall token budget)' });
+            }
+            tokenBudget = n;
+        }
+        args.token_budget = tokenBudget;
+        try {
+            const raw = await estateTool('memory.recall', args);
+            const items = typeof raw === 'object' && raw !== null ? raw['items'] : undefined;
+            if (!Array.isArray(items)) {
+                throw new EstateMcpError('memory.recall returned an unexpected shape');
+            }
+            const body = { memories: items.map(shapeMemoryItem) };
+            return body;
+        }
+        catch (err) {
+            return estateUpstreamError(reply, err);
+        }
+    });
+    // GET /memory/coverage?scope_prefix= → memory.coverage → { total, by_tier, by_kind }.
+    app.get(`${V}/memory/coverage`, { config: { manifest: { responseType: 'MemoryCoverageResponse', statusCodes: [200, 400, 502] } } }, async (req, reply) => {
+        const q = req.query;
+        const scopePrefix = firstQueryValue(q.scope_prefix);
+        const args = {};
+        if (scopePrefix !== undefined)
+            args.scope_prefix = scopePrefix;
+        try {
+            return shapeMemoryCoverage(await estateTool('memory.coverage', args));
+        }
+        catch (err) {
+            return estateUpstreamError(reply, err);
+        }
+    });
+    // POST /memory/retire { scope_prefix } → memory.erase → { erased }. SUBTREE-scoped (no per-id
+    // delete in estate); an empty scope_prefix is refused at the route (a 400 BEFORE any spawn) — the
+    // same total-wipe guard estate enforces with -32602.
+    app.post(`${V}/memory/retire`, {
+        config: {
+            manifest: {
+                requestType: 'RetireMemoryBody',
+                responseType: 'RetireMemoryResponse',
+                statusCodes: [200, 400, 502],
+            },
+        },
+    }, async (req, reply) => {
+        const parsed = RetireMemorySchema.safeParse(req.body);
+        if (!parsed.success) {
+            return reply.code(400).send(invalidBody(parsed.error, 'Invalid retire request'));
+        }
+        const scopePrefix = parsed.data.scope_prefix.trim();
+        if (scopePrefix === '') {
+            return reply.code(400).send({
+                error: '`scope_prefix` must not be empty — memory.erase is subtree-scoped (no per-id delete) and refuses a total wipe',
+            });
+        }
+        try {
+            const raw = await estateTool('memory.erase', { scope_prefix: scopePrefix });
+            const deleted = typeof raw === 'object' && raw !== null ? raw['deleted_count'] : undefined;
+            if (typeof deleted !== 'number') {
+                throw new EstateMcpError('memory.erase returned an unexpected shape');
+            }
+            const body = { erased: deleted };
+            return body;
+        }
+        catch (err) {
+            return estateUpstreamError(reply, err);
+        }
+    });
     // ── Projects (DES-PROJECT-001) — the 9-route experience-plane surface ────────
     registerProjectRoutes(app, adapter, { ...projects, settings: projectSettings }, security);
     // ── Campaigns (crew#342 + TH-9) — the engine's durable Run-DAG scheduler over REST ──────────