robo-cortex 0.4.2__tar.gz → 0.4.3__tar.gz

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to this project are documented here. Format loosely follows
 
 ## [Unreleased]
 
+## [0.4.3] — 2026-07-31
+
+### Fixed
+
+- **Silent wrong-store mutation on id collision.** Repo-local and global stores are independent autoincrement sequences, so a repo memory and a global memory can share the same numeric id. `roco status`/`link`/`evidence verify` (and the SDK/MCP equivalents), when called without `--scope`, used to silently pick whichever store hit first (local, by convention) — so e.g. `roco status 10 activate` could flip the wrong, unrelated memory to `active` with no error and no indication anything was off. `find_memory_store`/the new `find_evidence_store` now detect the collision and raise a clear `id N exists in both repo and global stores -- pass --scope repo or --scope global to disambiguate` error instead of guessing. `status`/`link` also now echo which store they acted on (`Memory 10 (global) -> active`) so a resolved-but-unintended target is visible immediately. Found live during normal usage.
+
+### Added
+
+- **Global store id partitioning.** New global memories/evidence/links now start at id 1,000,000,000+ (bumped in place, no renumbering of existing rows) so future ids can no longer collide with any repo-local store's ids — the same bug class above, closed structurally going forward. Ids assigned before this change can still collide with existing repo-local ids; the collision-detection fix above is what catches those.
+
 ## [0.4.2] — 2026-07-26
 
 ### Changed

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: robo-cortex
-Version: 0.4.2
+Version: 0.4.3
 Summary: Long-term memory system for LLM coding agents working inside a Git repository
 Project-URL: Homepage, https://robotel.top
 Project-URL: Repository, https://github.com/robotel-limited/robo-cortex
@@ -36,12 +36,13 @@ Description-Content-Type: text/markdown
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Smithery Calls](https://smithery.ai/badge/robotel-top/robo-cortex)](https://smithery.ai/servers/robotel-top/robo-cortex)
 [![robo-cortex MCP server](https://glama.ai/mcp/servers/robotel-limited/robo-cortex/badges/score.svg)](https://glama.ai/mcp/servers/robotel-limited/robo-cortex)
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.21610869.svg)](https://doi.org/10.5281/zenodo.21610869)
 
 [![robo-cortex MCP server](https://glama.ai/mcp/servers/robotel-limited/robo-cortex/badges/card.svg)](https://glama.ai/mcp/servers/robotel-limited/robo-cortex)
 
 **Git-aware knowledge integrity for AI coding agents.**
 
-Your AI agent debugs a bug, learns the lesson, and forgets it by next week — or worse, keeps citing a "lesson" that the code has since made false. robo-cortex is a local knowledge base built for that specific failure mode: memories are anchored to git blob hashes, so when the code they're about changes, the memory is automatically flagged for review instead of being silently trusted or silently lost.
+Your AI agent debugs a bug, learns the lesson, and forgets it by next week — or worse, keeps citing a "lesson" that the code has since made false. robo-cortex is a local knowledge base built for that specific failure mode: memories are anchored to git blob hashes, so when the code they're about changes, the memory is automatically flagged for review instead of being silently trusted or silently lost. In other words: **drift detection and stale-memory detection for AI agent memory**, done deterministically from git history — not an LLM guess, not an embedding-similarity heuristic.
 
 ---
 
@@ -49,7 +50,7 @@ Your AI agent debugs a bug, learns the lesson, and forgets it by next week — o
 
 Most agent-memory tools are embeddings + a vector database + a cloud dependency. robo-cortex is deliberately none of that. Four things it does that a generic key-value memory store doesn't:
 
-1. **Git-aware staleness detection.** Every memory can link to specific file paths, captured by git blob hash at record time. When the linked code changes, the memory is automatically flagged `needs_review` on the next `retrieve`/`search`/`affected` call — and a committed revert automatically heals it back. The healing requires three conditions: (a) the revert must be **committed** (git blob hash must match HEAD again), (b) the memory must have been flagged by the system (not manually via `change_status`), and (c) you must run a lazy trigger (`retrieve`/`search`/`affected`) after the revert to scan for changes. No other memory tool ties itself to your actual code's history this way.
+1. **Git-aware staleness (drift) detection.** Every memory can link to specific file paths, captured by git blob hash at record time. When the linked code changes, the memory is automatically flagged `needs_review` on the next `retrieve`/`search`/`affected` call — and a committed revert automatically heals it back. The healing requires three conditions: (a) the revert must be **committed** (git blob hash must match HEAD again), (b) the memory must have been flagged by the system (not manually via `change_status`), and (c) you must run a lazy trigger (`retrieve`/`search`/`affected`) after the revert to scan for changes. Few memory tools tie themselves to your actual code's history this deterministically — no embedding similarity, no LLM judgment call, just a git blob hash matching or not.
 2. **Evidence, not vibes.** Memories can carry attached evidence (test output, a commit, a re-runnable command) with a mechanically computed strength — not a judgment call. A `provisional` memory only becomes `active` once real evidence backs it, or a human explicitly promotes it.
 3. **Zero dependencies, fully local.** Pure stdlib + SQLite (FTS5 for search). No embeddings, no API keys, no network calls unless you explicitly configure Gitea evidence verification. `.cortex/memory.db` is just a file — inspect it with `sqlite3` any time.
 4. **A real lifecycle with an audit trail.** Every status change (`active` → `superseded` → `archived`, etc.) requires a `--reason`, permanently recorded. Nothing disappears silently; wrong lessons are marked `invalidated`, not deleted.

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/README.md

@@ -7,12 +7,13 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Smithery Calls](https://smithery.ai/badge/robotel-top/robo-cortex)](https://smithery.ai/servers/robotel-top/robo-cortex)
 [![robo-cortex MCP server](https://glama.ai/mcp/servers/robotel-limited/robo-cortex/badges/score.svg)](https://glama.ai/mcp/servers/robotel-limited/robo-cortex)
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.21610869.svg)](https://doi.org/10.5281/zenodo.21610869)
 
 [![robo-cortex MCP server](https://glama.ai/mcp/servers/robotel-limited/robo-cortex/badges/card.svg)](https://glama.ai/mcp/servers/robotel-limited/robo-cortex)
 
 **Git-aware knowledge integrity for AI coding agents.**
 
-Your AI agent debugs a bug, learns the lesson, and forgets it by next week — or worse, keeps citing a "lesson" that the code has since made false. robo-cortex is a local knowledge base built for that specific failure mode: memories are anchored to git blob hashes, so when the code they're about changes, the memory is automatically flagged for review instead of being silently trusted or silently lost.
+Your AI agent debugs a bug, learns the lesson, and forgets it by next week — or worse, keeps citing a "lesson" that the code has since made false. robo-cortex is a local knowledge base built for that specific failure mode: memories are anchored to git blob hashes, so when the code they're about changes, the memory is automatically flagged for review instead of being silently trusted or silently lost. In other words: **drift detection and stale-memory detection for AI agent memory**, done deterministically from git history — not an LLM guess, not an embedding-similarity heuristic.
 
 ---
 
@@ -20,7 +21,7 @@ Your AI agent debugs a bug, learns the lesson, and forgets it by next week — o
 
 Most agent-memory tools are embeddings + a vector database + a cloud dependency. robo-cortex is deliberately none of that. Four things it does that a generic key-value memory store doesn't:
 
-1. **Git-aware staleness detection.** Every memory can link to specific file paths, captured by git blob hash at record time. When the linked code changes, the memory is automatically flagged `needs_review` on the next `retrieve`/`search`/`affected` call — and a committed revert automatically heals it back. The healing requires three conditions: (a) the revert must be **committed** (git blob hash must match HEAD again), (b) the memory must have been flagged by the system (not manually via `change_status`), and (c) you must run a lazy trigger (`retrieve`/`search`/`affected`) after the revert to scan for changes. No other memory tool ties itself to your actual code's history this way.
+1. **Git-aware staleness (drift) detection.** Every memory can link to specific file paths, captured by git blob hash at record time. When the linked code changes, the memory is automatically flagged `needs_review` on the next `retrieve`/`search`/`affected` call — and a committed revert automatically heals it back. The healing requires three conditions: (a) the revert must be **committed** (git blob hash must match HEAD again), (b) the memory must have been flagged by the system (not manually via `change_status`), and (c) you must run a lazy trigger (`retrieve`/`search`/`affected`) after the revert to scan for changes. Few memory tools tie themselves to your actual code's history this deterministically — no embedding similarity, no LLM judgment call, just a git blob hash matching or not.
 2. **Evidence, not vibes.** Memories can carry attached evidence (test output, a commit, a re-runnable command) with a mechanically computed strength — not a judgment call. A `provisional` memory only becomes `active` once real evidence backs it, or a human explicitly promotes it.
 3. **Zero dependencies, fully local.** Pure stdlib + SQLite (FTS5 for search). No embeddings, no API keys, no network calls unless you explicitly configure Gitea evidence verification. `.cortex/memory.db` is just a file — inspect it with `sqlite3` any time.
 4. **A real lifecycle with an audit trail.** Every status change (`active` → `superseded` → `archived`, etc.) requires a `--reason`, permanently recorded. Nothing disappears silently; wrong lessons are marked `invalidated`, not deleted.

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/src/robo_cortex/__init__.py

@@ -1,4 +1,4 @@
-__version__ = "0.4.2"
+__version__ = "0.4.3"
 
 from robo_cortex.sdk import RoboCortex, retrieve, record, search
 

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/src/robo_cortex/cli/commands/evidence.py

@@ -3,8 +3,12 @@
 import json
 import sys
 
-from robo_cortex.core.errors import NotFoundError, RoboCortexError
-from robo_cortex.core.evidence import EVIDENCE_KINDS, attach_evidence, verify_evidence
+from robo_cortex.core.evidence import (
+    EVIDENCE_KINDS,
+    attach_evidence,
+    find_evidence_store,
+    verify_evidence,
+)
 from robo_cortex.core.memory import find_memory_store
 from robo_cortex.cli._common import _get_cmd_name, _store, _global_store, cli_command
 
@@ -45,15 +49,8 @@ def run_verify(args) -> int:
         # lives in: it's this invocation's ambient repo context, used to
         # resolve the Gitea owner/repo via the local git remote
         # (Stage 10) for gitea_pr/gitea_issue evidence specifically.
-        if args.scope == "repo":
-            result = verify_evidence(conn, args.evidence_id, repo_root)
-        elif args.scope == "global":
-            result = verify_evidence(global_conn, args.evidence_id, repo_root)
-        else:
-            try:
-                result = verify_evidence(conn, args.evidence_id, repo_root)
-            except NotFoundError:
-                result = verify_evidence(global_conn, args.evidence_id, repo_root)
+        store = find_evidence_store(conn, global_conn, args.evidence_id, scope=args.scope)
+        result = verify_evidence(store, args.evidence_id, repo_root)
 
     print(json.dumps(result) if args.json else json.dumps(result, indent=2))
     return 0

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/src/robo_cortex/cli/commands/link.py

@@ -21,12 +21,16 @@ def run(args) -> int:
                 file=sys.stderr,
             )
             return 1
+        resolved_scope = "global" if store1 is global_conn else "repo"
         result = create_link(store1, args.id1, args.id2, link_type)
 
     if args.json:
-        print(json.dumps(result))
+        print(json.dumps({**result, "scope": resolved_scope}))
     else:
-        print(f"Linked {result['from_id']} --{result['link_type']}--> {result['to_id']}")
+        print(
+            f"Linked {result['from_id']} --{result['link_type']}--> "
+            f"{result['to_id']} ({resolved_scope})"
+        )
     return 0
 
 

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/src/robo_cortex/cli/commands/status.py

@@ -39,15 +39,16 @@ def run(args) -> int:
 
         new_status = STATUS_ACTIONS[args.action]
         store = find_memory_store(conn, global_conn, args.id, scope=args.scope)
+        resolved_scope = "global" if store is global_conn else "repo"
         result = change_status(
             store, repo_root, args.id, new_status, args.reason,
             supersedes_link_to=args.supersedes,
         )
 
     if args.json:
-        print(json.dumps(result))
+        print(json.dumps({**result, "scope": resolved_scope}))
     else:
-        print(f"Memory {result['id']} -> {result['status']}")
+        print(f"Memory {result['id']} ({resolved_scope}) -> {result['status']}")
     return 0
 
 

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/src/robo_cortex/core/errors.py

@@ -28,5 +28,9 @@ class NotFoundError(RoboCortexError):
     exit_code = 1
 
 
+class AmbiguousIdError(RoboCortexError):
+    exit_code = 1
+
+
 class IllegalTransitionError(RoboCortexError):
     exit_code = 1

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/src/robo_cortex/core/evidence.py

@@ -1,6 +1,6 @@
 from datetime import datetime, timezone
 
-from .errors import NotFoundError, ValidationError
+from .errors import AmbiguousIdError, NotFoundError, ValidationError
 from .memory import get_memory, reverify
 
 EVIDENCE_KINDS = {
@@ -107,6 +107,45 @@ def _mark_unverifiable(conn, evidence_id: int, kind: str, ref: str | None, reaso
     }
 
 
+def find_evidence_store(local_conn, global_conn, evidence_id: int, scope: str | None = None):
+    """Same shape as `memory.find_memory_store`, for evidence rows: evidence
+    ids are also a per-store autoincrement sequence, so a bare id can
+    collide between the repo and global stores just like memory ids do.
+    `scope=None` checks both and raises AmbiguousIdError on a double hit
+    instead of silently verifying whichever store's row happened to match
+    first -- the same failure mode reported for memory ids in
+    prompt-bug-roco.md, just not routed through find_memory_store because
+    evidence rows aren't looked up by `get_memory`.
+    """
+    def _has_evidence(conn) -> bool:
+        return conn.execute(
+            "SELECT 1 FROM evidence WHERE id = ?", (evidence_id,)
+        ).fetchone() is not None
+
+    if scope == "repo":
+        if not _has_evidence(local_conn):
+            raise NotFoundError(f"no evidence with id {evidence_id}")
+        return local_conn
+    if scope == "global":
+        if global_conn is None or not _has_evidence(global_conn):
+            raise NotFoundError(f"no evidence with id {evidence_id}")
+        return global_conn
+
+    local_hit = _has_evidence(local_conn)
+    global_hit = global_conn is not None and _has_evidence(global_conn)
+
+    if local_hit and global_hit:
+        raise AmbiguousIdError(
+            f"evidence id {evidence_id} exists in both repo and global stores -- "
+            "pass --scope repo or --scope global to disambiguate"
+        )
+    if local_hit:
+        return local_conn
+    if global_hit:
+        return global_conn
+    raise NotFoundError(f"no evidence with id {evidence_id}")
+
+
 def verify_evidence(conn, evidence_id: int, repo_root=None) -> dict:
     """The single explicit re-verification entry point (ARCHITECTURE.md §3,
     §9) -- the only place a network call to Gitea is ever allowed, and only

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/src/robo_cortex/core/memory.py

@@ -3,7 +3,7 @@ import sqlite3
 from pathlib import Path
 
 from . import db as dbmod
-from .errors import NotFoundError, ValidationError
+from .errors import AmbiguousIdError, NotFoundError, ValidationError
 from .git import blob_hash_at_head
 from .text import fts_query_string, tokenize_without_stopwords
 
@@ -289,12 +289,15 @@ def find_memory_store(local_conn, global_conn, memory_id: int, scope: str | None
     proven live: a local id 1 makes global id 1 unreachable by id from that
     repo without a way to say which store you mean.
 
-    `scope=None` (default): try local first, global second -- local wins by
-    convention (`--repo` is the primary context of a CLI/MCP invocation),
-    NotFoundError only if neither has it. `scope='repo'` / `scope='global'`:
-    look only in that store, no fallback -- the explicit disambiguator for
-    when the caller already knows which memory they mean and a same-id
-    collision would otherwise resolve to the wrong one.
+    `scope=None` (default): look in both stores. Exactly one hit resolves
+    unambiguously. Both hit -> AmbiguousIdError instead of silently picking
+    one -- an earlier version silently preferred local here, which is what
+    let `roco status 10 activate` flip an unrelated repo-scoped memory
+    instead of the intended global one, live, with no error and no
+    indication anything had gone wrong (see prompt-bug-roco.md). Neither
+    hit -> NotFoundError. `scope='repo'` / `scope='global'`: look only in
+    that store, no fallback -- the explicit disambiguator for when the
+    caller already knows which memory they mean.
 
     Used by every ID-taking command (`show`, `status`, `evidence
     add/verify`, `link`) so a scope='global' memory recorded once is still
@@ -309,17 +312,29 @@ def find_memory_store(local_conn, global_conn, memory_id: int, scope: str | None
         get_memory(global_conn, memory_id)
         return global_conn
 
-    try:
-        get_memory(local_conn, memory_id)
+    local_hit = _has_memory(local_conn, memory_id)
+    global_hit = global_conn is not None and _has_memory(global_conn, memory_id)
+
+    if local_hit and global_hit:
+        raise AmbiguousIdError(
+            f"id {memory_id} exists in both repo and global stores -- "
+            "pass --scope repo or --scope global to disambiguate"
+        )
+    if local_hit:
         return local_conn
-    except NotFoundError:
-        pass
-    if global_conn is not None:
-        get_memory(global_conn, memory_id)  # raises NotFoundError if absent there too
+    if global_hit:
         return global_conn
     raise NotFoundError(f"no memory with id {memory_id}")
 
 
+def _has_memory(conn, memory_id: int) -> bool:
+    try:
+        get_memory(conn, memory_id)
+        return True
+    except NotFoundError:
+        return False
+
+
 def reverify(conn, repo_root: Path, memory_id: int) -> None:
     """Re-verification: recapture the current HEAD blob hash of every
     linked path and bump `last_verified_at` to now.

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/src/robo_cortex/core/store.py

@@ -32,6 +32,21 @@ def open_store(repo_arg: str | None) -> tuple[Path, sqlite3.Connection]:
 GLOBAL_DIR = Path.home() / ".cortex"
 GLOBAL_DB_FILENAME = "global.db"
 
+# Repo-local stores and the global store share one schema/migration chain,
+# so each starts its own autoincrement id sequence at 1 -- meaning a repo
+# memory #10 and a global memory #10 can (and did, live) coexist and refer
+# to unrelated rows, with nothing to disambiguate a bare id between them
+# (see prompt-bug-roco.md). Reserving this range for the global store makes
+# new collisions structurally impossible: no realistic single-user repo
+# will ever record a billion memories. This only pushes future ids in the
+# global store's autoincrement tables above the floor -- it never touches
+# already-assigned ids (that would renumber existing memory/evidence rows
+# out from under their own FK references and any external reference to
+# those ids), so ids assigned before this fix shipped can still collide;
+# `find_memory_store`'s AmbiguousIdError is what catches those.
+GLOBAL_ID_FLOOR = 1_000_000_000
+_GLOBAL_AUTOINCREMENT_TABLES = ("memory", "evidence", "memory_link", "cold_storage")
+
 # Override for tests (and any user who wants a non-default location): a full
 # path to the global db file. Without this, every test process would read
 # and write the *real* ~/.cortex/global.db on whatever machine runs the
@@ -69,4 +84,27 @@ def open_global_store() -> sqlite3.Connection | None:
     db_path.parent.mkdir(parents=True, exist_ok=True)
     conn = connect(db_path)
     migrate(conn)
+    _ensure_global_id_floor(conn)
     return conn
+
+
+def _ensure_global_id_floor(conn: sqlite3.Connection) -> None:
+    """Bump each autoincrement table's next id up to GLOBAL_ID_FLOOR if it
+    isn't already past it. Idempotent (only ever raises seq, never lowers
+    it) and a no-op once the floor has been crossed, so it's cheap to call
+    on every open rather than needing a one-time migration step.
+    """
+    for table in _GLOBAL_AUTOINCREMENT_TABLES:
+        row = conn.execute(
+            "SELECT seq FROM sqlite_sequence WHERE name = ?", (table,)
+        ).fetchone()
+        if row is None:
+            conn.execute(
+                "INSERT INTO sqlite_sequence (name, seq) VALUES (?, ?)",
+                (table, GLOBAL_ID_FLOOR),
+            )
+        elif row[0] < GLOBAL_ID_FLOOR:
+            conn.execute(
+                "UPDATE sqlite_sequence SET seq = ? WHERE name = ?",
+                (GLOBAL_ID_FLOOR, table),
+            )

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/tests/test_cli_scope_b.py

@@ -1,4 +1,6 @@
 import json
+import os
+import sqlite3
 import subprocess
 import sys
 
@@ -104,12 +106,14 @@ def test_cli_explain_human_readable_output_on_global_item_does_not_crash(tmp_pat
     assert _run_cli("init", "--repo", str(repo_a)).returncode == 0
     assert _run_cli("init", "--repo", str(repo_b)).returncode == 0
 
-    assert _run_cli(
+    record_result = _run_cli(
         "record", "--repo", str(repo_a),
         "--type", "lesson", "--scope", "global", "--confidence", "high",
         "--statement", "Prefer SQLite over Postgres for local-first single-user tools.",
         "--assumptions", "single-user, local-first",
-    ).returncode == 0
+        "--json",
+    )
+    assert record_result.returncode == 0
 
     retrieve_result = _run_cli(
         "retrieve", "--repo", str(repo_b),
@@ -120,7 +124,7 @@ def test_cli_explain_human_readable_output_on_global_item_does_not_crash(tmp_pat
     assert "assumptions_gate=" in retrieve_result.stdout
     assert "passed=True" in retrieve_result.stdout
 
-    memory_id = 1
+    memory_id = json.loads(record_result.stdout)["id"]
     show_result = _run_cli(
         "show", str(memory_id), "--repo", str(repo_b),
         "--explain-against", "database choice for a single-user local-first tool",
@@ -129,9 +133,11 @@ def test_cli_explain_human_readable_output_on_global_item_does_not_crash(tmp_pat
     assert "assumptions_gate=" in show_result.stdout
 
 
-def test_cli_scope_disambiguates_a_colliding_id(tmp_path):
-    """Proven live: a local id 1 shadows global id 1 for show/status/
-    evidence without a way to say which store is meant. --scope fixes it."""
+def test_cli_new_global_ids_no_longer_collide_with_repo_ids(tmp_path):
+    """Structural half of the id-collision fix (prompt-bug-roco.md option
+    3): the global store's ids are now partitioned into a high range, so a
+    freshly recorded global memory no longer collides with a repo-local id
+    -- `show` resolves either one correctly with no --scope needed."""
     repo_a = build_fixture_repo_a(tmp_path / "a")
     assert _run_cli("init", "--repo", str(repo_a)).returncode == 0
 
@@ -148,11 +154,52 @@ def test_cli_scope_disambiguates_a_colliding_id(tmp_path):
     )
     local_id = json.loads(local_record.stdout)["id"]
     global_id = json.loads(global_record.stdout)["id"]
+    assert local_id != global_id
+
+    local_show = _run_cli("show", str(local_id), "--repo", str(repo_a), "--json")
+    global_show = _run_cli("show", str(global_id), "--repo", str(repo_a), "--json")
+    assert json.loads(local_show.stdout)["statement"] == "a local fact"
+    assert json.loads(global_show.stdout)["statement"] == "a global lesson"
+
+
+def test_cli_scope_disambiguates_a_legacy_colliding_id(tmp_path):
+    """Proven live (prompt-bug-roco.md): before the id-floor fix, a local
+    id could shadow a global id of the same number for show/status/evidence
+    with no way to say which store is meant. New installs no longer produce
+    this (ids are partitioned apart, re-enforced on every open -- resetting
+    the sequence between CLI invocations wouldn't stick), but rows already
+    assigned a low id before the floor existed still can collide forever
+    (the floor never renumbers existing rows). Simulated here by inserting
+    a global row directly with an explicit low id, bypassing the sequence
+    the same way pre-fix on-disk data would sit. Bare `show` must now
+    refuse instead of silently shadowing; --scope still reaches each one."""
+    repo_a = build_fixture_repo_a(tmp_path / "a")
+    assert _run_cli("init", "--repo", str(repo_a)).returncode == 0
+    assert _run_cli("init", "--repo", str(repo_a), "--global").returncode == 0
+
+    local_record = _run_cli(
+        "record", "--repo", str(repo_a),
+        "--type", "fact", "--scope", "repo", "--confidence", "low",
+        "--statement", "a local fact", "--json",
+    )
+    local_id = json.loads(local_record.stdout)["id"]
+
+    global_db_path = os.environ["ROBO_CORTEX_GLOBAL_DB"]
+    global_conn = sqlite3.connect(global_db_path)
+    global_conn.execute(
+        "INSERT INTO memory (id, type, scope, statement, assumptions, confidence) "
+        "VALUES (?, 'lesson', 'global', 'a global lesson', 'single-user', 'high')",
+        (local_id,),
+    )
+    global_conn.commit()
+    global_conn.close()
+    global_id = local_id
     assert local_id == global_id  # the collision this test is about
 
-    # without disambiguation, the local one shadows the global one
-    default_show = _run_cli("show", str(local_id), "--repo", str(repo_a), "--json")
-    assert json.loads(default_show.stdout)["statement"] == "a local fact"
+    # without disambiguation, the ambiguous id is refused, not silently guessed
+    default_show = _run_cli("show", str(local_id), "--repo", str(repo_a))
+    assert default_show.returncode != 0
+    assert "exists in both repo and global stores" in default_show.stderr
 
     # --scope reaches each one unambiguously
     repo_show = _run_cli("show", str(local_id), "--repo", str(repo_a), "--scope", "repo", "--json")

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/tests/test_evidence.py

@@ -1,9 +1,15 @@
 import pytest
 
 from robo_cortex.core.db import connect, migrate
-from robo_cortex.core.errors import NotFoundError, ValidationError
-from robo_cortex.core.evidence import attach_evidence, evidence_strength, verify_evidence
+from robo_cortex.core.errors import AmbiguousIdError, NotFoundError, ValidationError
+from robo_cortex.core.evidence import (
+    attach_evidence,
+    evidence_strength,
+    find_evidence_store,
+    verify_evidence,
+)
 from robo_cortex.core.memory import get_memory, record_memory
+from robo_cortex.core.store import open_global_store
 
 from .fixtures import build_fixture_repo_a
 
@@ -131,3 +137,42 @@ def test_verify_evidence_rejects_unknown_id(tmp_path):
     _repo, conn = _store(tmp_path)
     with pytest.raises(NotFoundError):
         verify_evidence(conn, 9999)
+
+
+def test_find_evidence_store_raises_ambiguous_on_id_collision(tmp_path):
+    """Evidence ids are a per-store autoincrement sequence too -- same
+    shape as the memory-id collision (prompt-bug-roco.md), just not routed
+    through find_memory_store since evidence rows aren't memories. The
+    store.py id-floor fix stops *new* collisions, but ids assigned before
+    that floor existed can still collide; simulated here by resetting the
+    global store's evidence sequence back down, the way pre-fix on-disk
+    data would look."""
+    repo, local_conn = _store(tmp_path)
+    global_conn = open_global_store()
+
+    local_result = record_memory(local_conn, repo, type="fact", scope="repo", statement="x", confidence="low")
+    local_evidence = attach_evidence(
+        local_conn, repo, local_result["id"], kind="free_text", description="local evidence",
+    )
+
+    global_conn.execute("UPDATE sqlite_sequence SET seq = 0 WHERE name = 'evidence'")
+    global_result = record_memory(
+        global_conn, repo, type="lesson", scope="global", confidence="high",
+        statement="global lesson", assumptions="single-user",
+    )
+    global_evidence = attach_evidence(
+        global_conn, repo, global_result["id"], kind="free_text", description="global evidence",
+    )
+
+    assert local_evidence["evidence_id"] == global_evidence["evidence_id"]  # the collision this test is about
+
+    with pytest.raises(AmbiguousIdError, match="exists in both repo and global stores"):
+        find_evidence_store(local_conn, global_conn, local_evidence["evidence_id"])
+
+    # explicit scope reaches each one unambiguously
+    assert find_evidence_store(
+        local_conn, global_conn, local_evidence["evidence_id"], scope="repo"
+    ) is local_conn
+    assert find_evidence_store(
+        local_conn, global_conn, global_evidence["evidence_id"], scope="global"
+    ) is global_conn

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/tests/test_mcp_contracts.py

@@ -6,6 +6,7 @@ JSON-RPC, same as the stdout-purity tests.
 
 import json
 import os
+import sqlite3
 import subprocess
 import sys
 
@@ -303,10 +304,14 @@ def test_verify_evidence_gitea_backed_degrades_gracefully(tmp_path):
     assert result["reason"] == "gitea_not_configured"
 
 
-def test_scope_disambiguator_reaches_shadowed_global_memory(tmp_path):
+def test_scope_disambiguator_reaches_a_legacy_colliding_memory(tmp_path):
     """The second pre-Stage-9 fix, verified all the way through the MCP
-    layer: a local id 1 shadows global id 1 by default; scope='global'
-    reaches the intended memory."""
+    layer. A fresh global id no longer collides with a repo-local one at all
+    (store.py's id-floor partitioning) -- forced here by resetting the
+    global sequence back down, the way pre-fix on-disk data would look, so
+    this still exercises the collision path. Bare get_memory on the
+    ambiguous id must now fail instead of silently shadowing to local;
+    scope='repo'/'global' still reach each one."""
     repo = build_fixture_repo_a(tmp_path)
     _init(repo)
 
@@ -314,18 +319,30 @@ def test_scope_disambiguator_reaches_shadowed_global_memory(tmp_path):
         local_result = await _call(session, "record_memory", {
             "type": "fact", "scope": "repo", "confidence": "low", "statement": "a local fact",
         })
+
+        global_db_path = os.environ["ROBO_CORTEX_GLOBAL_DB"]
+        global_conn = sqlite3.connect(global_db_path)
+        global_conn.execute(
+            "UPDATE sqlite_sequence SET seq = ? WHERE name = 'memory'",
+            (local_result["id"] - 1,),
+        )
+        global_conn.commit()
+        global_conn.close()
+
         global_result = await _call(session, "record_memory", {
             "type": "lesson", "scope": "global", "confidence": "high",
             "statement": "a global lesson", "assumptions": "single-user",
         })
-        assert local_result["id"] == global_result["id"]
+        assert local_result["id"] == global_result["id"]  # the collision this test is about
 
-        default_fetch = await _call(session, "get_memory", {"memory_id": local_result["id"]})
+        default_error = await _call_expect_error(
+            session, "get_memory", {"memory_id": local_result["id"]}
+        )
         repo_fetch = await _call(session, "get_memory", {"memory_id": local_result["id"], "scope": "repo"})
         global_fetch = await _call(session, "get_memory", {"memory_id": global_result["id"], "scope": "global"})
-        return default_fetch, repo_fetch, global_fetch
+        return default_error, repo_fetch, global_fetch
 
-    default_fetch, repo_fetch, global_fetch = run_scenario(repo, scenario)
-    assert default_fetch["statement"] == "a local fact"  # default shadows to local
+    default_error, repo_fetch, global_fetch = run_scenario(repo, scenario)
+    assert "exists in both repo and global stores" in default_error
     assert repo_fetch["statement"] == "a local fact"
     assert global_fetch["statement"] == "a global lesson"

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/tests/test_scope_b.py

@@ -5,7 +5,7 @@
 import pytest
 
 from robo_cortex.core.db import connect, migrate
-from robo_cortex.core.errors import NotFoundError, ValidationError
+from robo_cortex.core.errors import AmbiguousIdError, NotFoundError, ValidationError
 from robo_cortex.core.memory import find_memory_store, get_memory, list_memories, record_memory
 from robo_cortex.core.retrieve import retrieve_context, search_memory
 from robo_cortex.core.store import open_global_store
@@ -212,45 +212,55 @@ def test_find_memory_store_falls_back_to_global_when_absent_locally(tmp_path):
         find_memory_store(local_conn_a, global_conn, 999999)
 
 
-def test_find_memory_store_prefers_local_on_id_collision(tmp_path):
-    """Both stores are independent autoincrement sequences and both start
-    at 1, so the same id can legitimately refer to two different memories.
-    Documented resolution order: local wins."""
+def test_find_memory_store_raises_ambiguous_on_id_collision(tmp_path):
+    """Both stores are independent autoincrement sequences, so the same id
+    can legitimately refer to two different memories -- proven live
+    (prompt-bug-roco.md): silently preferring local here let `roco status
+    10 activate` flip an unrelated repo memory instead of the intended
+    global one, with no error and no indication anything was wrong.
+    scope=None must now refuse instead of guessing."""
     repo_a, local_conn_a = _repo_a(tmp_path)
     global_conn = open_global_store()
 
     local_result = record_memory(
         local_conn_a, repo_a, type="fact", scope="repo", confidence="low", statement="local fact",
     )
+    # the id-floor fix (store.py) stops *new* global ids from colliding with
+    # repo-local ones -- force the pre-fix scenario (ids assigned before the
+    # floor existed) by resetting the global sequence back down, since that
+    # residual case is exactly what AmbiguousIdError still needs to catch.
+    global_conn.execute("UPDATE sqlite_sequence SET seq = 0 WHERE name = 'memory'")
     global_result = record_memory(
         global_conn, repo_a, type="lesson", scope="global", confidence="high",
         statement="global lesson", assumptions="single-user",
     )
     assert local_result["id"] == global_result["id"]  # the collision this test is about
 
-    resolved = find_memory_store(local_conn_a, global_conn, local_result["id"])
-    assert resolved is local_conn_a
-    assert get_memory(resolved, local_result["id"])["statement"] == "local fact"
+    with pytest.raises(AmbiguousIdError, match="exists in both repo and global stores"):
+        find_memory_store(local_conn_a, global_conn, local_result["id"])
 
 
-def test_find_memory_store_explicit_scope_reaches_the_shadowed_global_memory(tmp_path):
-    """Proven live: without a disambiguator, a colliding local id 1 makes
-    global id 1 completely unreachable by id. --scope='global' (surfaced in
-    the CLI and, per Gate B follow-up, as an MCP tool input) is the fix."""
+def test_find_memory_store_explicit_scope_reaches_either_side_of_a_collision(tmp_path):
+    """Proven live: without a disambiguator, a colliding id is ambiguous
+    between stores. --scope='repo'/'global' (surfaced in the CLI and, per
+    Gate B follow-up, as an MCP tool input) reaches each one unambiguously."""
     repo_a, local_conn_a = _repo_a(tmp_path)
     global_conn = open_global_store()
 
     local_result = record_memory(
         local_conn_a, repo_a, type="fact", scope="repo", confidence="low", statement="local fact",
     )
+    # force a pre-id-floor-style collision -- see comment above
+    global_conn.execute("UPDATE sqlite_sequence SET seq = 0 WHERE name = 'memory'")
     global_result = record_memory(
         global_conn, repo_a, type="lesson", scope="global", confidence="high",
         statement="global lesson", assumptions="single-user",
     )
     assert local_result["id"] == global_result["id"]
 
-    # default (no scope) still shadows the global one -- documented, not a bug
-    assert find_memory_store(local_conn_a, global_conn, local_result["id"]) is local_conn_a
+    # default (no scope) is ambiguous and must be refused, not silently guessed
+    with pytest.raises(AmbiguousIdError):
+        find_memory_store(local_conn_a, global_conn, local_result["id"])
 
     # explicit scope reaches each one unambiguously
     local_store = find_memory_store(local_conn_a, global_conn, local_result["id"], scope="repo")
@@ -269,3 +279,48 @@ def test_find_memory_store_explicit_scope_raises_not_found_if_wrong(tmp_path):
 
     with pytest.raises(NotFoundError):
         find_memory_store(local_conn_a, global_conn, local_result["id"], scope="global")
+
+
+def test_global_store_ids_are_partitioned_above_repo_ids(tmp_path):
+    """Structural half of the id-collision fix (prompt-bug-roco.md option
+    3): new global memories start far above any realistic repo-local id, so
+    future recordings can no longer collide by construction -- unlike the
+    AmbiguousIdError guard, which only catches a collision after it exists."""
+    from robo_cortex.core.store import GLOBAL_ID_FLOOR
+
+    repo_a, local_conn_a = _repo_a(tmp_path)
+    global_conn = open_global_store()
+
+    local_result = record_memory(
+        local_conn_a, repo_a, type="fact", scope="repo", confidence="low", statement="local fact",
+    )
+    global_result = record_memory(
+        global_conn, repo_a, type="lesson", scope="global", confidence="high",
+        statement="global lesson", assumptions="single-user",
+    )
+
+    assert local_result["id"] < GLOBAL_ID_FLOOR
+    assert global_result["id"] >= GLOBAL_ID_FLOOR
+    assert local_result["id"] != global_result["id"]
+
+    # unambiguous by construction now -- no --scope needed
+    resolved = find_memory_store(local_conn_a, global_conn, global_result["id"])
+    assert resolved is global_conn
+
+
+def test_global_store_id_floor_does_not_renumber_existing_rows(tmp_path):
+    """The floor only pushes the *next* id up; it must never touch ids
+    already assigned (that would break memory_link/evidence FK references,
+    and any external reference to a memory by id)."""
+    repo_a, local_conn_a = _repo_a(tmp_path)
+    global_conn = open_global_store()
+
+    first = record_memory(
+        global_conn, repo_a, type="lesson", scope="global", confidence="high",
+        statement="first global lesson", assumptions="single-user",
+    )
+    global_conn.close()
+
+    # simulate a second process/CLI invocation re-opening the same store
+    reopened = open_global_store()
+    assert get_memory(reopened, first["id"])["statement"] == "first global lesson"

{robo_cortex-0.4.2 → robo_cortex-0.4.3}/tests/test_smoke.py

@@ -2,4 +2,4 @@ from robo_cortex import __version__
 
 
 def test_version_is_set():
-    assert __version__ == "0.4.2"
+    assert __version__ == "0.4.3"