compound-memory 0.1.0__tar.gz → 0.2.0__tar.gz

{compound_memory-0.1.0/src/compound_memory.egg-info → compound_memory-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: compound-memory
-Version: 0.1.0
+Version: 0.2.0
 Summary: Local multi-agent shared memory with compounding (MCP server + CLI)
 Author: chinwe
 License-Expression: MIT
@@ -147,4 +147,4 @@ PyPI 版本不可重传，tag 必须与 `pyproject.toml` 的 `version` 一致（
 
 1. **一次性配置**（PyPI → 项目 → Publishing）：owner `chinwe`、repo `compound-memory`、workflow `release.yml`、environment `pypi`。首次发布时项目尚不存在，在 pypi.org 用"pending publisher"预注册即可。
 2. **发布**：`git tag v0.1.0 && git push origin v0.1.0` → `release.yml` 自动 build + `uv publish`。
-3. 发布后 `uvx compound-memory-server` 即为通用安装形态（MCP 配置里的 `command` 也可换成 `uvx`，不再依赖仓库克隆路径）。
+3. 发布后 `uvx --from compound-memory compound-memory-server` 即为通用安装形态（`uvx` 的参数是包名，script 名不同须用 `--from`；MCP 配置里的 `command` 换成 uvx 后不再依赖仓库克隆路径）。

{compound_memory-0.1.0 → compound_memory-0.2.0}/README.md

@@ -118,4 +118,4 @@ PyPI 版本不可重传，tag 必须与 `pyproject.toml` 的 `version` 一致（
 
 1. **一次性配置**（PyPI → 项目 → Publishing）：owner `chinwe`、repo `compound-memory`、workflow `release.yml`、environment `pypi`。首次发布时项目尚不存在，在 pypi.org 用"pending publisher"预注册即可。
 2. **发布**：`git tag v0.1.0 && git push origin v0.1.0` → `release.yml` 自动 build + `uv publish`。
-3. 发布后 `uvx compound-memory-server` 即为通用安装形态（MCP 配置里的 `command` 也可换成 `uvx`，不再依赖仓库克隆路径）。
+3. 发布后 `uvx --from compound-memory compound-memory-server` 即为通用安装形态（`uvx` 的参数是包名，script 名不同须用 `--from`；MCP 配置里的 `command` 换成 uvx 后不再依赖仓库克隆路径）。

{compound_memory-0.1.0 → compound_memory-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "compound-memory"
-version = "0.1.0"
+version = "0.2.0"
 description = "Local multi-agent shared memory with compounding (MCP server + CLI)"
 readme = "README.md"
 # PEP 639 SPDX 表达式；与 License:: classifier 互斥，故后者已移除

{compound_memory-0.1.0 → compound_memory-0.2.0}/src/compound_memory/__init__.py

@@ -1,3 +1,3 @@
 """compound-memory: local multi-agent shared memory with compounding."""
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"

{compound_memory-0.1.0 → compound_memory-0.2.0}/src/compound_memory/cli.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import argparse
 import datetime as dt
 import json
+import os
 import sys
 from pathlib import Path
 from typing import Any
@@ -19,8 +20,13 @@ def _emit(payload: Any) -> None:
 
 
 def _open_store(args: argparse.Namespace) -> MemoryStore:
-    # CLI 与 server 同权：vec extra + 模型就绪即启用向量路，否则自动降级纯词面
-    return MemoryStore(Path(args.root), embedder=auto_encoder())
+    # CLI 与 server 同权：vec extra + 模型就绪即启用向量路，否则自动降级纯词面；
+    # 环境注入的进程身份（若有）同样生效——未设置时保持自报身份模式
+    return MemoryStore(
+        Path(args.root),
+        embedder=auto_encoder(),
+        agent_id=os.environ.get("COMPOUND_MEMORY_AGENT_ID") or None,
+    )
 
 
 def cmd_init(args: argparse.Namespace) -> None:
@@ -35,13 +41,17 @@ def cmd_write(args: argparse.Namespace) -> None:
 def cmd_search(args: argparse.Namespace) -> None:
     _emit(
         _open_store(args).search(
-            query=args.query, ns=args.ns, top_k=args.top_k, include_neighbors=args.include_neighbors
+            query=args.query,
+            ns=args.ns,
+            top_k=args.top_k,
+            include_neighbors=args.include_neighbors,
+            reader=args.reader,
         )
     )
 
 
 def cmd_get(args: argparse.Namespace) -> None:
-    _emit(_open_store(args).get(args.id))
+    _emit(_open_store(args).get(args.id, reader=args.reader))
 
 
 def cmd_link(args: argparse.Namespace) -> None:
@@ -62,7 +72,7 @@ def cmd_decay(args: argparse.Namespace) -> None:
 
 
 def cmd_revive(args: argparse.Namespace) -> None:
-    _emit(_open_store(args).revive(args.id))
+    _emit(_open_store(args).revive(args.id, reader=args.reader))
 
 
 def cmd_stats(args: argparse.Namespace) -> None:
@@ -88,6 +98,7 @@ def cmd_distill_plan(args: argparse.Namespace) -> None:
             min_uses=args.min_uses,
             min_confidence=args.min_confidence,
             ns=args.ns,
+            reader=args.reader,
         )
     )
 
@@ -125,18 +136,25 @@ def build_parser() -> argparse.ArgumentParser:
 
     p = sub.add_parser("search")
     p.add_argument("query"); p.add_argument("--ns", default="_shared"); p.add_argument("--top-k", type=int, default=5)
+    p.add_argument("--reader", default=None, help="caller identity, required for private agent-* namespaces")
     p.add_argument("--no-neighbors", dest="include_neighbors", action="store_false",
                    help="omit embedded one-hop neighbors from hits")
     p.set_defaults(func=cmd_search)
 
-    p = sub.add_parser("get"); p.add_argument("id"); p.set_defaults(func=cmd_get)
+    p = sub.add_parser("get")
+    p.add_argument("id")
+    p.add_argument("--reader", default=None, help="caller identity, required for private agent-* namespaces")
+    p.set_defaults(func=cmd_get)
     p = sub.add_parser("link"); p.add_argument("a"); p.add_argument("b"); p.set_defaults(func=cmd_link)
     p = sub.add_parser("feedback"); p.add_argument("id"); p.add_argument("agent"); p.set_defaults(func=cmd_feedback)
 
     p = sub.add_parser("decay"); p.add_argument("--now", default=None, help="ISO date override (testing)")
     p.set_defaults(func=cmd_decay)
 
-    p = sub.add_parser("revive"); p.add_argument("id"); p.set_defaults(func=cmd_revive)
+    p = sub.add_parser("revive")
+    p.add_argument("id")
+    p.add_argument("--reader", default=None, help="caller identity, required for private agent-* namespaces")
+    p.set_defaults(func=cmd_revive)
     p = sub.add_parser(
         "distill-plan",
         help="scan distillation candidates and print a signal-annotated list",
@@ -148,6 +166,7 @@ def build_parser() -> argparse.ArgumentParser:
     p.add_argument("--min-uses", type=int, default=1, help="activity gate: uses >= this")
     p.add_argument("--min-confidence", type=float, default=0.5, help="activity gate: confidence >= this")
     p.add_argument("--ns", default="_shared")
+    p.add_argument("--reader", default=None, help="caller identity, required for private agent-* namespaces")
     p.set_defaults(func=cmd_distill_plan)
     p = sub.add_parser("distill-apply")
     p.add_argument("content"); p.add_argument("type", choices=MEMORY_TYPES); p.add_argument("source")

{compound_memory-0.1.0 → compound_memory-0.2.0}/src/compound_memory/server.py

@@ -2,10 +2,15 @@
 
 恰好 5 个 tool：memory_write / memory_search / memory_get / memory_link / memory_feedback。
 memory_feedback 是一等公民——复利闭环依赖它。
+
+所有 tool 声明 structured_output=False（单份序列化）：mcp 2.x 会从 `dict[str, Any]`
+注解推断 outputSchema，结构化载荷与文本回退同时下发双份，撑大宿主上下文；
+关闭后只走 text 一份 JSON，形状不变。
 """
 
 from __future__ import annotations
 
+import os
 from pathlib import Path
 from typing import Any, Callable
 
@@ -24,10 +29,15 @@ def configure(
     git: bool = True,
     git_probe: Callable[[], bool] | None = None,
     embedder: Callable[[list[str]], list[list[float]]] | None = None,
+    agent_id: str | None = None,
 ) -> MemoryStore:
     global _store
     _store = MemoryStore(
-        Path(root) if root is not None else default_root(), git=git, git_probe=git_probe, embedder=embedder
+        Path(root) if root is not None else default_root(),
+        git=git,
+        git_probe=git_probe,
+        embedder=embedder,
+        agent_id=agent_id,
     )
     return _store
 
@@ -39,7 +49,7 @@ def _store_or_configure() -> MemoryStore:
     return _store
 
 
-@mcp.tool()
+@mcp.tool(structured_output=False)
 def memory_write(
     content: str,
     type: str,
@@ -52,35 +62,44 @@ def memory_write(
     return _store_or_configure().write(content=content, type=type, source=source, ns=ns, key=key, links=links)
 
 
-@mcp.tool()
-def memory_search(query: str, ns: str = "_shared", top_k: int = 5, include_neighbors: bool = True) -> dict[str, Any]:
-    """Search memories. Fuses lexical (BM25) and, when the vec extra + model are installed, vector (BGE) recall via RRF; otherwise falls back to lexical only. Confidence/recency/type act only as a small tie-break. Default namespace is _shared. Each hit embeds up to 3 trimmed one-hop neighbors (active only) unless include_neighbors=False. Returns {'hits': [...]} sorted by score. Compounding rule: after actually adopting a hit, call memory_feedback (agent = your source id) — skipped feedbacks leave the store static."""
-    hits = _store_or_configure().search(query=query, ns=ns, top_k=top_k, include_neighbors=include_neighbors)
+@mcp.tool(structured_output=False)
+def memory_search(
+    query: str,
+    ns: str = "_shared",
+    top_k: int = 5,
+    include_neighbors: bool = True,
+    reader: str | None = None,
+) -> dict[str, Any]:
+    """Search memories. Fuses lexical (BM25) and, when the vec extra + model are installed, vector (BGE) recall via RRF; otherwise falls back to lexical only. Confidence/recency/type act only as a small tie-break. Default namespace is _shared. Each hit embeds up to 3 trimmed one-hop neighbors (active only) unless include_neighbors=False. reader: your own source agent id — REQUIRED when ns is 'agent-<name>' (private namespace, readable only by its owner host); ignored for _shared. Returns {'hits': [...]} sorted by score. Compounding rule: after actually adopting a hit, call memory_feedback (agent = your source id) — skipped feedbacks leave the store static."""
+    hits = _store_or_configure().search(
+        query=query, ns=ns, top_k=top_k, include_neighbors=include_neighbors, reader=reader
+    )
     return {"hits": hits, "count": len(hits)}
 
 
-@mcp.tool()
-def memory_get(mem_id: str, include_neighbors: bool = True) -> dict[str, Any]:
-    """Fetch a memory by id; one-hop link neighbors are included by default. After adopting it, call memory_feedback (agent = your source id)."""
-    return _store_or_configure().get(mem_id, include_neighbors=include_neighbors)
+@mcp.tool(structured_output=False)
+def memory_get(mem_id: str, include_neighbors: bool = True, reader: str | None = None) -> dict[str, Any]:
+    """Fetch a memory by id; one-hop link neighbors are included by default. reader: your own source agent id — required when the memory lives in a private 'agent-<name>' namespace (readable only by its owner host). After adopting it, call memory_feedback (agent = your source id)."""
+    return _store_or_configure().get(mem_id, include_neighbors=include_neighbors, reader=reader)
 
 
-@mcp.tool()
+@mcp.tool(structured_output=False)
 def memory_link(id_a: str, id_b: str) -> dict[str, Any]:
-    """Create a bidirectional link between two memories (compounding source #2: association)."""
+    """Create a bidirectional link between two memories (compounding source #2: association). Both memories must live in the same namespace; cross-namespace links are rejected."""
     return _store_or_configure().link(id_a, id_b)
 
 
-@mcp.tool()
+@mcp.tool(structured_output=False)
 def memory_feedback(mem_id: str, agent: str) -> dict[str, Any]:
-    """Report that a memory was actually used. Increments uses, raises confidence (+0.1; extra +0.15 when a different agent validates). agent must be your own source agent id. Archiving is reversed on feedback. MUST be called after a memory is adopted — this closes the compounding loop."""
+    """Report that a memory was actually used. Increments uses, raises confidence (+0.1; extra +0.15 when a different agent validates). agent must be your own source agent id. Memories in a private 'agent-<name>' namespace accept feedback only from the owner (agent = 'agent-<name>' or '<name>'). Archiving is reversed on feedback. MUST be called after a memory is adopted — this closes the compounding loop."""
     return _store_or_configure().feedback(mem_id, agent)
 
 
 def main() -> None:
     if _store is None:
-        # 生产入口自动挂向量路（vec extra + 模型就绪才生效，否则静默降级纯词面）
-        configure(embedder=auto_encoder())
+        # 生产入口自动挂向量路（vec extra + 模型就绪才生效，否则静默降级纯词面）；
+        # 宿主经 COMPOUND_MEMORY_AGENT_ID 注入进程身份，未设置则保持自报身份模式
+        configure(embedder=auto_encoder(), agent_id=os.environ.get("COMPOUND_MEMORY_AGENT_ID") or None)
     mcp.run()
 
 

{compound_memory-0.1.0 → compound_memory-0.2.0}/src/compound_memory/storage.py

@@ -18,7 +18,7 @@ import subprocess
 import uuid
 from dataclasses import asdict
 from pathlib import Path
-from typing import Any, Callable
+from typing import Any, Callable, overload
 
 import yaml
 
@@ -115,6 +115,7 @@ class MemoryStore:
         remover: Callable[[Path], None] | None = None,
         git_probe: Callable[[], bool] | None = None,
         embedder: Callable[[list[str]], list[list[float]]] | None = None,
+        agent_id: str | None = None,
     ) -> None:
         self.root = Path(root)
         self.ns_root = self.root / "namespaces"
@@ -126,6 +127,10 @@ class MemoryStore:
         self.git_enabled = git and (git_probe or _git_available)()
         self._clock = clock
         self._remover = remover or _unlink_file
+        # 进程侧身份证明：agent_id 非空时（宿主经 COMPOUND_MEMORY_AGENT_ID 注入），
+        # 所有调用方自报身份（source/reader/agent）必须与其一致，缺省 reader 自动补真值。
+        # 只由 server/cli 入口显式传入，store 自身不读环境变量（测试与库调用保持确定性）。
+        self.agent_id = agent_id
         self._ensure_layout()
         if self.git_enabled and not (self.root / ".git").exists():
             # init commit 仅限首次创建：__init__ 在每次 CLI/MCP 启动都会执行，
@@ -232,6 +237,55 @@ class MemoryStore:
         if ns != "_shared" and not ns.startswith("agent-"):
             raise ValueError("ns must be '_shared' or start with 'agent-'")
 
+    @staticmethod
+    def _check_ns_owner(ns: str, identity: str | None, role: str = "reader") -> None:
+        """读/反馈侧 owner 校验：agent-* 私有 ns 只有属主宿主可读、可反馈。
+
+        与 write 的 `_check_ns + PermissionError` 对称——写侧已保证非属主写不进
+        私有 ns，读侧若不校验则任何宿主显式传 ns=agent-<别人> 即可越权读全量
+        （2026-10-03 实测：search 签名原本无调用方身份参数，跨宿主零阻力）；
+        feedback 侧不校验则外来 agent 可刷 uses/confidence 或复活归档。
+
+        identity 缺省时对 _shared 放行、对 agent-* 拒绝：宁可不读，不猜身份。
+        role 只是让报错指引对得上调用方的参数名（reader / agent）。
+        """
+        if not ns.startswith("agent-"):
+            return
+        owner = ns[len("agent-"):]
+        if identity in (ns, owner):
+            return
+        raise PermissionError(
+            f"namespace {ns!r} is private to {owner!r}; {role} is {identity!r}. "
+            f"Pass {role}={ns!r} or {role}={owner!r} if you are that host."
+        )
+
+    @overload
+    def _resolve_identity(self, value: str, role: str) -> str: ...
+
+    @overload
+    def _resolve_identity(self, value: None, role: str) -> str | None: ...
+
+    def _resolve_identity(self, value: str | None, role: str) -> str | None:
+        """身份裁决：进程注入（agent_id）优先于调用方自报。
+
+        - 未启用 attestation（agent_id 为空）⇒ 原样放行，行为同旧版（自报身份）。
+        - 调用方缺省 ⇒ 自动补进程身份（诚实缺省，如 search 私有 ns 忘带 reader）。
+        - 调用方与进程身份等价（agent-x / x 两种形式）⇒ 归一化为 agent_id，
+          保证 validated_by 等记录字段去重一致。
+        - 调用方与进程身份矛盾 ⇒ 响亮报错（伪造/配错宿主都该炸，不该静默改写）。
+        """
+        if self.agent_id is None:
+            return value
+        if value is None:
+            return self.agent_id
+        accepted = {self.agent_id, self.agent_id.removeprefix("agent-")}
+        if value in accepted:
+            return self.agent_id
+        raise PermissionError(
+            f"{role} {value!r} contradicts attested agent {self.agent_id!r} "
+            f"(COMPOUND_MEMORY_AGENT_ID); the process identity wins"
+        )
+
     def write(
         self,
         content: str,
@@ -244,6 +298,7 @@ class MemoryStore:
         confidence: float | None = None,
         origin: str | None = None,
     ) -> dict[str, Any]:
+        source = self._resolve_identity(source, "source")
         mem, conflict_with = self._write_new(
             content,
             type=type,
@@ -306,21 +361,33 @@ class MemoryStore:
             result["conflicts_with"] = conflict_with.id
         return result
 
-    def get(self, mem_id: str, include_neighbors: bool = True) -> dict[str, Any]:
+    def get(self, mem_id: str, include_neighbors: bool = True, reader: str | None = None) -> dict[str, Any]:
+        reader = self._resolve_identity(reader, "reader")
         mem = self.find(mem_id)
         if mem is None:
             return {"found": False}
+        self._check_ns_owner(mem.ns, reader)
         result = asdict(mem)
         result["found"] = True
+        # links 输出同 ns 脱敏：跨 ns 遗留链不把对侧 id 暴露给本侧读者（与邻居召回同规则）
+        same_ns_links: list[str] = []
+        for l in mem.links:
+            t = self.find(l)
+            if t is None or t.ns == mem.ns:
+                same_ns_links.append(l)
+        result["links"] = same_ns_links
         if include_neighbors and mem.links:
-            neighbors = [asdict(n) for n in (self.find(l) for l in mem.links) if n is not None]
+            neighbors = [asdict(n) for n in (self.find(l) for l in same_ns_links) if n is not None]
             result["neighbors"] = neighbors
         return result
 
     def feedback(self, mem_id: str, agent: str) -> dict[str, Any]:
+        agent = self._resolve_identity(agent, "agent")
         mem = self.find(mem_id)
         if mem is None:
             return {"found": False}
+        # 私有记忆只有属主可反馈：防外来 agent 刷 uses/confidence、混入 validated_by 或复活归档
+        self._check_ns_owner(mem.ns, agent, role="agent")
         if mem.archived:
             self._move_to_active(mem)
         mem.uses += 1
@@ -346,6 +413,10 @@ class MemoryStore:
         if missing:
             return {"found": False, "missing": missing}
         assert mem_a is not None and mem_b is not None
+        # 跨 ns 链会把对侧 id 写进本侧文件 frontmatter，成为私有 id 的泄漏源；
+        # 且邻居召回本就同 ns 过滤，跨 ns 链对复利无贡献——创建侧直接禁止
+        if mem_a.ns != mem_b.ns:
+            raise ValueError(f"cannot link memories across namespaces: {mem_a.ns!r} vs {mem_b.ns!r}")
         if id_b not in mem_a.links:
             mem_a.links.append(id_b)
         if id_a not in mem_b.links:
@@ -361,13 +432,19 @@ class MemoryStore:
         ns: str = "_shared",
         top_k: int = 5,
         include_neighbors: bool = True,
+        reader: str | None = None,
     ) -> list[dict[str, Any]]:
         """检索 = 选候选（store 的 layout 职责）+ 排序（scoring.rank 单一定义点）。
 
         embedder 可用时叠加向量召回：候选 = 词面命中 ∪ 向量 KNN（ns/活性过滤），
         两路 rank 在 rank 内 RRF 融合；向量路任何故障都降级纯词面（宁缺勿炸）。
+
+        reader 是调用方身份，ns=agent-* 时必填且须为属主（读侧 owner 校验，
+        与 write 的越权抛 PermissionError 对称）；ns=_shared 时忽略。
         """
         self._check_ns(ns)
+        reader = self._resolve_identity(reader, "reader")
+        self._check_ns_owner(ns, reader)
         now = self._clock()
         q_tokens = tokenize(query)
         if not q_tokens:
@@ -378,7 +455,7 @@ class MemoryStore:
             self._candidates(q_tokens, ns, vec_rels),
             now=now,
             top_k=top_k,
-            neighbor_lookup=self._active_neighbors if include_neighbors else None,
+            neighbor_lookup=(lambda mid: self._active_neighbors(mid, ns)) if include_neighbors else None,
             vec_sims=vec_sims,
         )
 
@@ -414,15 +491,19 @@ class MemoryStore:
         except Exception:
             return None, []
 
-    def _active_neighbors(self, mem_id: str) -> list[Memory]:
-        """邻居召回的数据源：hit 的一度 links，归档邻居不召回（截断/上限/去环归 rank）。"""
+    def _active_neighbors(self, mem_id: str, ns: str = "_shared") -> list[Memory]:
+        """邻居召回的数据源：hit 的一度 links，归档邻居不召回（截断/上限/去环归 rank）。
+
+        ns 过滤是访问控制的一部分，不可省：_shared 记忆若链到agent-* 私有记忆，
+        邻居会把私有正文带进 _shared 的检索结果（2026-10-03 实测泄漏）。
+        """
         mem = self.find(mem_id)
         if mem is None:
             return []
         out: list[Memory] = []
         for link_id in mem.links:
             neighbor = self.find(link_id)
-            if neighbor is not None and not neighbor.archived:
+            if neighbor is not None and not neighbor.archived and neighbor.ns == ns:
                 out.append(neighbor)
         return out
 
@@ -445,10 +526,13 @@ class MemoryStore:
             self._commit("decay: archive " + ", ".join(archived))
         return archived
 
-    def revive(self, mem_id: str) -> dict[str, Any]:
+    def revive(self, mem_id: str, reader: str | None = None) -> dict[str, Any]:
+        reader = self._resolve_identity(reader, "reader")
         mem = self.find(mem_id)
         if mem is None:
             return {"found": False}
+        # revive 返回全文，与 get 同属按 id 读路径：私有 ns 仅属主可复活
+        self._check_ns_owner(mem.ns, reader)
         if mem.archived:
             self._move_to_active(mem)
             self._save(mem)
@@ -480,6 +564,7 @@ class MemoryStore:
         min_uses: int = 1,
         min_confidence: float = 0.5,
         ns: str = "_shared",
+        reader: str | None = None,
     ) -> dict[str, Any]:
         """蒸馏候选扫描：窗口 + 活性门过滤，产出带信号标注的建议清单（只标注不合并）。
 
@@ -487,8 +572,12 @@ class MemoryStore:
         （BM25 normalized_similarity ≥ DISTILL_DUP_SIM_THRESHOLD，弱信号）、
         promotion_candidate（episode 高活性，晋升建议——判断后置，#6）。
         归档区不参与；坏日期记忆按宁缺勿滥跳过。
+
+        reader：候选带正文返回，扫私有 ns 须属主（与 get/search 同规则）。
         """
         self._check_ns(ns)
+        reader = self._resolve_identity(reader, "reader")
+        self._check_ns_owner(ns, reader)
         now = self._clock()
         cands: list[Memory] = []
         for path in sorted((self.ns_root / ns).rglob("*.md")):
@@ -548,11 +637,17 @@ class MemoryStore:
         源批量归档，收进一次 commit。源任一不存在 ⇒ 整体不落库（found: False）。
         产物与现存 fact/insight 的 key 冲突走既有 review 队列机制，不特殊对待。
         """
+        source = self._resolve_identity(source, "source")
         source_ids = list(dict.fromkeys(source_ids))  # 去重保序：重复源只归档一次
         sources = [self.find(mid) for mid in source_ids]
         missing = [mid for mid, mem in zip(source_ids, sources) if mem is None]
         if missing:
             return {"found": False, "missing": missing}
+        # 蒸馏不跨 ns：私有记忆被当源蒸进 _shared 是正文泄漏通道；
+        # distill_plan 本就按单 ns 扫描，源与产物同 ns 是既定流程
+        foreign_ns = sorted({s.ns for s in sources if s is not None and s.ns != ns})
+        if foreign_ns:
+            raise ValueError(f"distill sources must live in target ns {ns!r}; found in: {foreign_ns}")
         mem, conflict_with = self._write_new(
             content,
             type=type,

{compound_memory-0.1.0 → compound_memory-0.2.0/src/compound_memory.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: compound-memory
-Version: 0.1.0
+Version: 0.2.0
 Summary: Local multi-agent shared memory with compounding (MCP server + CLI)
 Author: chinwe
 License-Expression: MIT
@@ -147,4 +147,4 @@ PyPI 版本不可重传，tag 必须与 `pyproject.toml` 的 `version` 一致（
 
 1. **一次性配置**（PyPI → 项目 → Publishing）：owner `chinwe`、repo `compound-memory`、workflow `release.yml`、environment `pypi`。首次发布时项目尚不存在，在 pypi.org 用"pending publisher"预注册即可。
 2. **发布**：`git tag v0.1.0 && git push origin v0.1.0` → `release.yml` 自动 build + `uv publish`。
-3. 发布后 `uvx compound-memory-server` 即为通用安装形态（MCP 配置里的 `command` 也可换成 `uvx`，不再依赖仓库克隆路径）。
+3. 发布后 `uvx --from compound-memory compound-memory-server` 即为通用安装形态（`uvx` 的参数是包名，script 名不同须用 `--from`；MCP 配置里的 `command` 换成 uvx 后不再依赖仓库克隆路径）。

{compound_memory-0.1.0 → compound_memory-0.2.0}/src/compound_memory.egg-info/SOURCES.txt

@@ -23,5 +23,6 @@ tests/test_index.py
 tests/test_lifecycle.py
 tests/test_mcp_tools.py
 tests/test_model.py
+tests/test_ns_isolation.py
 tests/test_scoring.py
 tests/test_vector_index.py

{compound_memory-0.1.0 → compound_memory-0.2.0}/tests/test_mcp_tools.py

@@ -34,10 +34,12 @@ current_store: MemoryStore
 
 
 @asynccontextmanager
-async def make_client(root: Path, git_off: bool = False):
+async def make_client(root: Path, git_off: bool = False, agent_id: str | None = None):
     """配置 server store 并开内存 client；无 git 场景经 configure 注入探测 adapter。"""
     global current_store
-    current_store = cm_server.configure(root, git=True, git_probe=(lambda: False) if git_off else None)
+    current_store = cm_server.configure(
+        root, git=True, git_probe=(lambda: False) if git_off else None, agent_id=agent_id
+    )
     async with mcp.Client(cm_server.mcp) as c:
         yield c
 
@@ -269,6 +271,81 @@ class TestNamespacePermissions:
             }))
             assert res["ns"] == "agent-tars"
 
+    async def test_private_read_requires_reader_param(self, memroot):
+        """search/get 的 reader 透传：缺身份 is_error，属主身份放行."""
+        async with make_client(memroot) as client:
+            priv = call(await client.call_tool("memory_write", {
+                "content": "私有检索草稿", "type": "fact", "source": "agent-tars", "ns": "agent-tars",
+            }))
+            no_reader = await client.call_tool(
+                "memory_search", {"query": "私有检索", "ns": "agent-tars"}
+            )
+            assert no_reader.is_error
+            assert (await client.call_tool("memory_get", {"mem_id": priv["id"]})).is_error
+            hits = call(await client.call_tool(
+                "memory_search", {"query": "私有检索", "ns": "agent-tars", "reader": "agent-tars"}
+            ))
+            assert [h["id"] for h in hits["hits"]] == [priv["id"]]
+            got = call(await client.call_tool(
+                "memory_get", {"mem_id": priv["id"], "reader": "tars"}
+            ))
+            assert got["found"] is True
+
+    async def test_cross_ns_link_rejected(self, memroot):
+        async with make_client(memroot) as client:
+            shared = call(await client.call_tool("memory_write", {
+                "content": "共享记忆", "type": "episode", "source": "agent-a",
+            }))
+            priv = call(await client.call_tool("memory_write", {
+                "content": "私有记忆", "type": "episode", "source": "agent-tars", "ns": "agent-tars",
+            }))
+            res = await client.call_tool("memory_link", {"id_a": shared["id"], "id_b": priv["id"]})
+            assert res.is_error
+
+    async def test_private_feedback_rejects_foreign_agent(self, memroot):
+        async with make_client(memroot) as client:
+            priv = call(await client.call_tool("memory_write", {
+                "content": "私有反馈目标", "type": "fact", "source": "agent-tars", "ns": "agent-tars",
+            }))
+            res = await client.call_tool("memory_feedback", {"mem_id": priv["id"], "agent": "agent-a"})
+            assert res.is_error
+            ok = call(await client.call_tool("memory_feedback", {"mem_id": priv["id"], "agent": "tars"}))
+            assert ok["uses"] == 1
+
+
+class TestSingleCopySerialization:
+    """structured_output=False：载荷只走 text 一份，无 structuredContent 双份下发。"""
+
+    async def test_no_structured_content_duplication(self, memroot):
+        async with make_client(memroot) as client:
+            res = await client.call_tool("memory_search", {"query": "anything"})
+            assert res.structured_content is None
+            assert len(res.content) == 1
+            assert res.content[0].type == "text"
+
+
+class TestAttestationWiring:
+    """进程身份注入（configure 的 agent_id，生产来自 COMPOUND_MEMORY_AGENT_ID）经 tool 缝生效。"""
+
+    async def test_forged_identity_rejected(self, memroot):
+        async with make_client(memroot, agent_id="agent-zcode") as client:
+            res = await client.call_tool("memory_write", {
+                "content": "x", "type": "fact", "source": "agent-a",
+            })
+            assert res.is_error
+            ok = call(await client.call_tool("memory_write", {
+                "content": "x", "type": "fact", "source": "agent-zcode",
+            }))
+            assert ok["source"] == "agent-zcode"
+
+    async def test_reader_autofilled_from_process_identity(self, memroot):
+        async with make_client(memroot, agent_id="agent-zcode") as client:
+            priv = call(await client.call_tool("memory_write", {
+                "content": "私有自动补 reader", "type": "fact", "source": "agent-zcode", "ns": "agent-zcode",
+            }))
+            hits = call(await client.call_tool("memory_search", {"query": "私有自动补", "ns": "agent-zcode"}))
+            assert [h["id"] for h in hits["hits"]] == [priv["id"]]
+
 
 class TestWithoutGit:
     async def test_tools_work_without_git(self, memroot2):

compound_memory-0.2.0/tests/test_ns_isolation.py

@@ -0,0 +1,265 @@
+"""ns 隔离行为测试（store 缝）：读写双侧属主边界 + 旁路通道（link/feedback/distill）。
+
+spec 原为「读不隔离」，2026-10-03 修订为双侧属主校验（fail-closed，缺身份即拒绝）。
+默认检索的候选圈定已挡住直读；这里钉的是显式 ns 与旁路的拒绝/放行，
+以及 get 输出对跨 ns 遗留链的脱敏。MCP 参数透传在 test_mcp_tools.py。
+
+为何要钉旁路：私有内容的主路（search/get）封死后，剩余攻击面是按 id
+直操作的三条旁路——共同前提是拿到私有 id，所以 links 脱敏也是边界的一部分。
+"""
+
+from __future__ import annotations
+
+import datetime as dt
+import json
+
+import pytest
+
+from compound_memory.cli import main as cli_main
+from compound_memory.storage import MemoryStore
+from conftest import CLOCK_DATE
+
+OWNER = "agent-zcode"
+OWNER_BARE = "zcode"
+FOREIGN = "agent-workbuddy"
+PRIVATE_NS = "agent-zcode"
+
+
+def _days_ago(n: int) -> str:
+    """相对测试固定"今天"（CLOCK_DATE）推算——store 的 clock 已注入同一日期。"""
+    return (CLOCK_DATE - dt.timedelta(days=n)).isoformat()
+
+
+def _seed(store: MemoryStore) -> tuple[str, str]:
+    """预置一对最简数据：属主私有记忆 + 外来 _shared 公开记忆。"""
+    priv = store.write("zcode private draft", type="fact", source=OWNER, ns=PRIVATE_NS, key="priv")
+    pub = store.write("shared public note", type="fact", source=FOREIGN, ns="_shared", key="pub")
+    return priv["id"], pub["id"]
+
+
+def _add_legacy_link(store: MemoryStore, mem_id: str, target_id: str) -> None:
+    """伪造存量跨 ns 链（规则生效前的遗留数据）：改文件 links 后重建索引。
+
+    正路 link() 现已拒绝跨 ns，跨 ns 链只能这样造出来——这正是测试目的。
+    """
+    mem = store.find(mem_id)
+    assert mem is not None
+    mem.links.append(target_id)
+    store._save(mem)
+
+
+class TestReadIsolation:
+    def test_default_search_never_sees_private(self, store: MemoryStore):
+        """主路隔离：_shared 检索即便用私有记忆的原词也命中不了私有 ns。"""
+        _seed(store)
+        hits = store.search("zcode private draft")
+        assert all(h["ns"] != PRIVATE_NS for h in hits)
+
+    def test_private_search_requires_owner_reader(self, store: MemoryStore):
+        priv_id, _ = _seed(store)
+        with pytest.raises(PermissionError):
+            store.search("private draft", ns=PRIVATE_NS)
+        with pytest.raises(PermissionError):
+            store.search("private draft", ns=PRIVATE_NS, reader=FOREIGN)
+        # 属主两种身份形式（全称/短名）都放行
+        assert [h["id"] for h in store.search("private draft", ns=PRIVATE_NS, reader=OWNER)] == [priv_id]
+        assert [h["id"] for h in store.search("private draft", ns=PRIVATE_NS, reader=OWNER_BARE)] == [priv_id]
+
+    def test_shared_search_ignores_reader(self, store: MemoryStore):
+        _seed(store)
+        hits = store.search("public note", reader=FOREIGN)
+        assert [h["ns"] for h in hits] == ["_shared"]
+
+    def test_private_get_requires_owner_reader(self, store: MemoryStore):
+        priv_id, _ = _seed(store)
+        with pytest.raises(PermissionError):
+            store.get(priv_id)
+        with pytest.raises(PermissionError):
+            store.get(priv_id, reader=FOREIGN)
+        assert store.get(priv_id, reader=OWNER)["found"] is True
+        assert store.get(priv_id, reader=OWNER_BARE)["found"] is True
+
+    def test_legacy_cross_ns_link_redacted_from_get(self, store: MemoryStore):
+        """存量跨 ns 链的双向脱敏：links 输出与邻居召回都不暴露对侧 id。"""
+        priv_id, _ = _seed(store)
+        bridge = store.write("bridging note", type="episode", source=FOREIGN)
+        _add_legacy_link(store, bridge["id"], priv_id)
+        _add_legacy_link(store, priv_id, bridge["id"])
+        store.rebuild_index()
+
+        got_pub = store.get(bridge["id"])
+        assert got_pub["links"] == []
+        assert got_pub.get("neighbors", []) == []
+        got_priv = store.get(priv_id, reader=OWNER)
+        assert got_priv["links"] == []
+
+        hits = store.search("bridging")
+        assert hits and hits[0]["neighbors"] == []
+
+
+class TestLinkNamespaceRule:
+    def test_cross_ns_link_rejected(self, store: MemoryStore):
+        priv_id, pub_id = _seed(store)
+        with pytest.raises(ValueError, match="across namespaces"):
+            store.link(pub_id, priv_id)
+        # 原子拒绝：两侧文件都不留下链
+        assert store.find(pub_id) is not None and store.find(pub_id).links == []  # type: ignore[union-attr]
+        assert store.find(priv_id) is not None and store.find(priv_id).links == []  # type: ignore[union-attr]
+
+    def test_same_ns_link_ok(self, store: MemoryStore):
+        _, pub_id = _seed(store)
+        other = store.write("another shared note", type="fact", source=FOREIGN, ns="_shared")
+        res = store.link(pub_id, other["id"])
+        assert res["found"] is True
+        assert other["id"] in store.find(pub_id).links  # type: ignore[union-attr]
+
+    def test_self_link_still_rejected(self, store: MemoryStore):
+        _, pub_id = _seed(store)
+        with pytest.raises(ValueError, match="itself"):
+            store.link(pub_id, pub_id)
+
+
+class TestFeedbackNamespaceRule:
+    def test_foreign_feedback_on_private_denied(self, store: MemoryStore):
+        priv_id, _ = _seed(store)
+        with pytest.raises(PermissionError):
+            store.feedback(priv_id, FOREIGN)
+        mem = store.find(priv_id)
+        assert mem is not None and mem.uses == 0 and mem.confidence == 0.5
+
+    def test_owner_feedback_on_private_ok(self, store: MemoryStore):
+        priv_id, _ = _seed(store)
+        res = store.feedback(priv_id, OWNER)
+        assert res["uses"] == 1 and res["confidence"] == 0.6
+
+    def test_shared_feedback_unaffected(self, store: MemoryStore):
+        _, pub_id = _seed(store)
+        assert store.feedback(pub_id, FOREIGN)["found"] is True
+
+
+class TestDistillNamespaceRule:
+    def test_cross_ns_sources_rejected_atomically(self, store: MemoryStore):
+        priv_id, pub_id = _seed(store)
+        # 私有 → _shared（正文外泄方向）与 _shared → 私有（越权并源）都拒绝
+        with pytest.raises(ValueError, match="must live in target ns"):
+            store.distill_apply("合并产物", type="insight", source=OWNER, source_ids=[priv_id], ns="_shared")
+        with pytest.raises(ValueError, match="must live in target ns"):
+            store.distill_apply("合并产物", type="insight", source=OWNER, source_ids=[pub_id], ns=PRIVATE_NS)
+        # 原子：源未被归档、产物未落库
+        assert store.find(priv_id) is not None and not store.find(priv_id).archived  # type: ignore[union-attr]
+        assert store.find(pub_id) is not None and not store.find(pub_id).archived  # type: ignore[union-attr]
+
+    def test_same_ns_distill_by_owner_ok(self, store: MemoryStore):
+        priv_id, _ = _seed(store)
+        res = store.distill_apply(
+            "蒸馏产物内容", type="insight", source=OWNER, source_ids=[priv_id], ns=PRIVATE_NS
+        )
+        assert res["ns"] == PRIVATE_NS and priv_id in res["links"]
+        assert store.find(priv_id) is not None and store.find(priv_id).archived  # type: ignore[union-attr]
+
+    def test_distill_plan_private_requires_owner_reader(self, store: MemoryStore):
+        """distill_plan 候选带正文返回：扫私有 ns 与 get/search 同规则。"""
+        priv_id, _ = _seed(store)
+        store.feedback(priv_id, OWNER)  # 过活性门（uses >= 1）
+        with pytest.raises(PermissionError):
+            store.distill_plan(ns=PRIVATE_NS)
+        plan = store.distill_plan(ns=PRIVATE_NS, reader=OWNER)
+        assert [c["id"] for c in plan["candidates"]] == [priv_id]
+
+
+class TestReviveNamespaceRule:
+    def test_revive_private_requires_owner_reader(self, store: MemoryStore):
+        """revive 返回全文，与 get 同属按 id 读路径：私有 ns 仅属主可复活。"""
+        old = store.write(
+            "zcode old private episode", type="episode", source=OWNER, ns=PRIVATE_NS, created=_days_ago(120)
+        )
+        assert old["id"] in store.decay_sweep()
+        with pytest.raises(PermissionError):
+            store.revive(old["id"])
+        assert store.revive(old["id"], reader=OWNER)["archived"] is False
+
+
+class TestAttestation:
+    """进程侧身份证明：身份等于进程（COMPOUND_MEMORY_AGENT_ID），不等于自称。
+
+    三条裁决规则：缺省自动补进程身份（诚实缺省）、等价形式归一化、
+    矛盾响亮报错——连带关闭「_shared 伪造 source 污染跨 Agent 验证」的口子。
+    """
+
+    @pytest.fixture
+    def attested(self, tmp_path) -> MemoryStore:
+        from conftest import sandbox_safe_remove
+
+        return MemoryStore(
+            tmp_path / "attested", clock=lambda: CLOCK_DATE, remover=sandbox_safe_remove, agent_id=OWNER
+        )
+
+    def test_reader_auto_filled_for_owner_ns(self, attested: MemoryStore):
+        priv = attested.write("私有草稿", type="fact", source=OWNER, ns=PRIVATE_NS)
+        hits = attested.search("私有草稿", ns=PRIVATE_NS)  # 忘带 reader：自动补进程身份
+        assert [h["id"] for h in hits] == [priv["id"]]
+
+    def test_forged_reader_rejected(self, attested: MemoryStore):
+        attested.write("私有草稿", type="fact", source=OWNER, ns=PRIVATE_NS)
+        with pytest.raises(PermissionError, match="attested agent"):
+            attested.search("私有草稿", ns=PRIVATE_NS, reader=FOREIGN)
+
+    def test_foreign_ns_denied_even_with_autofill(self, attested: MemoryStore):
+        """自动补的是进程身份：读别人的私有 ns 依旧被属主门挡住。"""
+        mem, _ = attested._write_new(
+            "workbuddy 私密",
+            type="fact",
+            source=FOREIGN,
+            ns="agent-workbuddy",
+            key=None,
+            links=None,
+            created=None,
+            confidence=None,
+            origin=None,
+        )
+        with pytest.raises(PermissionError):
+            attested.search("workbuddy 私密", ns="agent-workbuddy")
+        with pytest.raises(PermissionError):
+            attested.get(mem.id)
+
+    def test_write_source_must_match_process(self, attested: MemoryStore):
+        """attestation 连带关闭 _shared 伪造 source 的口子；等价形式归一化。"""
+        with pytest.raises(PermissionError, match="attested agent"):
+            attested.write("x", type="fact", source=FOREIGN)
+        res = attested.write("y", type="fact", source="zcode")  # 短名等价
+        assert res["source"] == OWNER  # 落库归一化为进程身份
+
+    def test_feedback_agent_must_match_process(self, attested: MemoryStore):
+        mem = attested.write("x", type="fact", source=OWNER)
+        with pytest.raises(PermissionError, match="attested agent"):
+            attested.feedback(mem["id"], FOREIGN)
+        assert attested.feedback(mem["id"], "zcode")["validated_by"] == [OWNER]
+
+    def test_unattested_keeps_self_declared(self, store: MemoryStore):
+        """回归护栏：未启用 attestation 的 store 行为与旧版完全一致。"""
+        assert store.write("x", type="fact", source=FOREIGN)["source"] == FOREIGN
+
+    def test_cli_env_attestation(self, store: MemoryStore, monkeypatch, capsys):
+        priv_id, _ = _seed(store)
+        monkeypatch.setenv("COMPOUND_MEMORY_AGENT_ID", OWNER)
+        root = ["--root", str(store.root)]
+        assert cli_main(root + ["get", priv_id]) == 0  # reader 自动补进程身份
+        capsys.readouterr()
+        assert cli_main(root + ["get", priv_id, "--reader", FOREIGN]) == 2
+
+
+class TestCliReaderFlag:
+    """CLI 缺 reader 时 fail-closed（exit 2），--reader 全称/短名都放行。"""
+
+    def test_cli_get_and_search_roundtrip(self, store: MemoryStore, capsys: pytest.CaptureFixture[str]):
+        priv_id, _ = _seed(store)
+        root = ["--root", str(store.root)]
+        assert cli_main(root + ["search", "private draft", "--ns", PRIVATE_NS]) == 2
+        assert cli_main(root + ["get", priv_id]) == 2
+        assert cli_main(root + ["search", "private draft", "--ns", PRIVATE_NS, "--reader", OWNER]) == 0
+        out = json.loads(capsys.readouterr().out)
+        # CLI search 输出是裸数组（{"hits": ...} 包装只在 MCP 层）
+        assert [h["id"] for h in out] == [priv_id]
+        assert cli_main(root + ["get", priv_id, "--reader", OWNER_BARE]) == 0
+        out = json.loads(capsys.readouterr().out)
+        assert out["found"] is True