strata-agent-memory 0.2.7__tar.gz → 0.2.8__tar.gz

{strata_agent_memory-0.2.7/strata_agent_memory.egg-info → strata_agent_memory-0.2.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: strata-agent-memory
-Version: 0.2.7
+Version: 0.2.8
 Summary: Portable, auditable, cross-vendor memory for LLM agents: evidence-bound claims, trust tiers, and compiled context views.
 Author: Strata Intelligence
 License-Expression: Apache-2.0

{strata_agent_memory-0.2.7 → strata_agent_memory-0.2.8}/agent_memory/__init__.py

@@ -9,4 +9,4 @@ see, what did it claim, and can the proof be re-run.
 The core is dependency-free (Python 3.10+ standard library only).
 """
 
-__version__ = "0.2.7"
+__version__ = "0.2.8"

{strata_agent_memory-0.2.7 → strata_agent_memory-0.2.8}/agent_memory/compiler.py

@@ -14,6 +14,7 @@ Roles and modes follow the fork/isolate rule:
 from __future__ import annotations
 
 import re
+import sys
 from dataclasses import dataclass, field
 from datetime import timedelta
 from typing import Callable, Dict, Iterable, List, Optional, Tuple
@@ -142,6 +143,9 @@ class Compiled:
     pinned_cap: Optional[int] = None
     pinned_cut: Dict[str, int] = field(default_factory=dict)
     pinned_full: Dict[str, int] = field(default_factory=dict)
+    # the retrieval plugin that took part (ctr_9e166c2f291b829b): {plugin, share, ids}, and
+    # error when it could not run; None when config.retrieval names none
+    retrieval: Optional[Dict] = None
 
     def included_ids(self) -> List[str]:
         return [i.id for items in self.sections.values() for i in items]
@@ -590,6 +594,10 @@ def compile_context(
         else:
             out.sections["working"].append(item)
 
+    # the retrieval plugin (ctr_9e166c2f291b829b): the ids it finds for the task, of which
+    # the reader sees only what this compile's own policy filter let through (candidates)
+    retrieval_cfg, retrieved = _retrieval(ledger, task, {item.id: item for item, _ in candidates}, out, assessment)
+
     seen_dnr = set()
     for it in do_not_retry:
         key = (it.id, it.statement)
@@ -619,35 +627,72 @@ def compile_context(
     # costed provisionally here and the difference is charged once it is known
     provisional = _obligations(role, mode, round_no, bool(out.sections["cross_check"]), bool(contract_id), lens)
     overhead = overhead_tokens(out, provisional)
-    used = overhead
-    kept: Dict[str, List[Item]] = {name: [] for name in SECTION_ORDER}
-    remaining_by_section = {name: [] for name in SECTION_ORDER}
-    # pass 1: each section up to its share; pass 2: fill leftovers in priority order
-    for name in SECTION_ORDER:
-        cap = int(budget * SECTION_SHARE[name])
-        # half of the constraints section is kept for its human-filed items, which arrive
-        # in standing order, so the freshly filed ones compete for the other half only
-        reserved = int(cap * CONSTRAINT_HUMAN_RESERVE) if name == "constraints" else 0
-        section_used = unreserved_used = 0
-        for item in out.sections[name]:
-            cost = cost_of(item)
-            reserve_eligible = bool(reserved) and item.is_human
-            fits_share = reserve_eligible or unreserved_used + cost <= cap - reserved
-            if section_used + cost <= cap and fits_share and used + cost <= budget:
-                kept[name].append(item)
-                section_used += cost
-                unreserved_used += 0 if reserve_eligible else cost
-                used += cost
-            else:
-                remaining_by_section[name].append(item)
-    for name in SECTION_ORDER:
-        for item in remaining_by_section[name]:
-            cost = cost_of(item)
-            if used + cost <= budget:
-                kept[name].append(item)
-                used += cost
-            else:
-                out.excluded.append((item.id, "budget"))
+    def allocate(reserve: int, found: List[Item], fixed: Optional[List[Item]] = None):
+        """(kept, used, left out for the budget): pass one fills each section up to its
+        share, the retrieval plugin's ``found`` fill its section up to ``reserve``, and pass
+        two fills leftovers in priority order. ``fixed`` is the constraints section as
+        compile alone keeps it: the plugin's share is never taken from what always applies
+        (the review of ctr_9e166c2f291b829b)."""
+        used = overhead
+        kept: Dict[str, List[Item]] = {name: [] for name in SECTION_ORDER}
+        remaining_by_section: Dict[str, List[Item]] = {name: [] for name in SECTION_ORDER}
+        # pass 1: each section up to its share; pass 2: fill leftovers in priority order
+        for name in SECTION_ORDER:
+            if name == "constraints" and fixed is not None:
+                kept[name] = list(fixed)
+                used += sum(cost_of(item) for item in fixed)
+                held = {id(item) for item in fixed}
+                remaining_by_section[name] = [item for item in out.sections[name] if id(item) not in held]
+                continue
+            cap = int(budget * SECTION_SHARE[name])
+            # half of the constraints section is kept for its human-filed items, which arrive
+            # in standing order, so the freshly filed ones compete for the other half only
+            reserved = int(cap * CONSTRAINT_HUMAN_RESERVE) if name == "constraints" else 0
+            section_used = unreserved_used = 0
+            for item in out.sections[name]:
+                cost = cost_of(item)
+                reserve_eligible = bool(reserved) and item.is_human
+                fits_share = reserve_eligible or unreserved_used + cost <= cap - reserved
+                if section_used + cost <= cap and fits_share and used + cost <= budget - reserve:
+                    kept[name].append(item)
+                    section_used += cost
+                    unreserved_used += 0 if reserve_eligible else cost
+                    used += cost
+                else:
+                    remaining_by_section[name].append(item)
+        taken = {item.id for items in kept.values() for item in items}
+        if found:
+            # what the plugin found and pass 1 did not already keep, in the plugin's order,
+            # up to its share: a record shown once, in the section that placed it first
+            kept["retrieved"], spent = [], 0
+            for item in found:
+                cost = cost_of(item)
+                if item.id not in taken and spent + cost <= reserve and used + cost <= budget:
+                    kept["retrieved"].append(item)
+                    taken.add(item.id)
+                    spent += cost
+                    used += cost
+        left_out: List[str] = []
+        for name in SECTION_ORDER:
+            for item in remaining_by_section[name]:
+                if item.id in taken:
+                    continue  # the retrieved section placed it
+                cost = cost_of(item)
+                if used + cost <= budget:
+                    kept[name].append(item)
+                    used += cost
+                else:
+                    left_out.append(item.id)
+        return kept, used, left_out
+
+    # compile alone; and when the retrieval plugin found something, again with its share
+    # held back from every section but the constraints, which keep what compile alone
+    # gives them. A plugin that finds nothing changes nothing (BENCHMARK-PLAN 1.2)
+    kept, used, left_out = allocate(0, [])
+    if retrieved:
+        kept, used, left_out = allocate(int(budget * retrieval_cfg["share"]), retrieved, fixed=kept["constraints"])
+        out.retrieval["ids"] = [item.id for item in kept["retrieved"]]
+    out.excluded += [(rid, "budget") for rid in left_out]
     out.sections = kept
     out.used_tokens = used
 
@@ -668,6 +713,34 @@ def compile_context(
     return out
 
 
+def _retrieval(ledger, task: Optional[str], eligible: Dict[str, "Item"], out: "Compiled",
+               assessment: Optional[dict] = None):
+    """(the plugin's settings or None, the eligible items it found, best first), and
+    ``out.retrieval`` set to what the receipt records. A plugin that cannot run leaves the
+    view as compile alone makes it, and says so: on the receipt, and in one stderr line."""
+    from . import retrieval as retrieval_mod  # local: retrieval imports this module
+    try:
+        cfg = retrieval_mod.settings(ledger.config)
+    except retrieval_mod.RetrievalError as exc:
+        out.retrieval = {"plugin": retrieval_mod.configured_name(ledger.config), "share": None, "ids": [],
+                         "error": str(exc)}
+        print(f"agent-memory: the retrieval plugin did not run ({exc}); compiled without it", file=sys.stderr)
+        return None, []
+    if cfg is None:
+        return None, []
+    out.retrieval = {"plugin": cfg["plugin"], "share": cfg["share"], "ids": []}
+    if not task:
+        return cfg, []  # nothing to search by: a view with no task is compile's alone
+    try:
+        found = retrieval_mod.retrieve(ledger, task, cfg, assessment)
+    except retrieval_mod.RetrievalError as exc:
+        out.retrieval["error"] = str(exc)
+        print(f"agent-memory: the retrieval plugin {cfg['plugin']} did not run ({exc}); compiled without it",
+              file=sys.stderr)
+        return cfg, []
+    return cfg, [eligible[rid] for rid in found if rid in eligible]
+
+
 def compiled_from_json(payload: dict) -> Compiled:
     """Rebuild a Compiled from ``render.render_json``'s payload.
 
@@ -690,6 +763,7 @@ def compiled_from_json(payload: dict) -> Compiled:
         # saying it was cut
         board=[dict(row) for row in payload.get("board") or []],
     )
+    out.retrieval = payload.get("retrieval") if isinstance(payload.get("retrieval"), dict) else None
     display = payload.get("reader_display")
     out.reader_display = display if isinstance(display, str) and display else None
     out.config_notes = [n for n in payload.get("config_notes") or [] if isinstance(n, str)]
@@ -840,6 +914,10 @@ def record_compilation(ledger, compiled: Compiled, rendered: str, render_name: s
         # which reliability numbers the reader was shown, or null when annotation was off
         "reliability": compiled.reliability_meta,
     }
+    if compiled.retrieval is not None:
+        # which configuration produced the view (ctr_9e166c2f291b829b): the plugin, its
+        # share, the ids it added, and why it did not run when it did not
+        body["retrieval"] = compiled.retrieval
     # which repository the view was cut to, and where it was served and asked from: set
     # only when they are, so a plain view's receipt is what it always was
     for key, value in (("repo", compiled.repo), ("served", compiled.served or None),

{strata_agent_memory-0.2.7 → strata_agent_memory-0.2.8}/agent_memory/contracts.py

@@ -765,7 +765,8 @@ def run_acceptance(ledger, contract_id: str, cwd: Optional[str] = None, timeout:
             detail = (f"exit {body['exit']} (expected {expect_exit})" + (f"; {body.get('summary')}" if body.get("summary") else "")
                       + ("; timed out, and everything it started was stopped" if body.get("timed_out") else ""))
             if sandbox is not None:
-                reason = ev.sandbox_failure(sandbox["image"], body, expect_exit, check["cmd"]) if not ok else None
+                reason = (ev.sandbox_failure(sandbox["image"], body, expect_exit, check["cmd"],
+                                             unproven=ev.image_proof(sandbox, where)) if not ok else None)
                 if reason:
                     outcome, detail = "error", f"{reason}; {detail}"
                 detail = f"sandboxed: podman {sandbox['image']}; {detail}"

{strata_agent_memory-0.2.7 → strata_agent_memory-0.2.8}/agent_memory/evidence.py

@@ -1073,6 +1073,14 @@ def resolved_directory(path, what: str) -> str:
 # cannot be had here -- no podman, no image, a directory that is not a worktree, a malformed
 # key -- is an `error`, never a run on the host.
 SANDBOX_IMAGE = "am-recheck:0.2"   # deploy/driver/Containerfile.recheck, built once on the driver
+# what an image deploy/driver/build-recheck-image.sh made says of itself: the sha256 of the
+# lockfile the whole suite passed against inside it, and how many tests the build left out
+# by a named marker. Only that script sets them, and only after its proof run is green.
+PROVEN_LABEL = "io.agent-memory.recheck.proven"
+EXCLUDED_LABEL = "io.agent-memory.recheck.excluded"
+SANDBOX_LOCKFILE = "uv.lock"
+PROOF_CACHE_SECONDS = 300.0   # a resident lane sees an image rebuilt under it within this
+_PROOF_CACHE: Dict[Tuple[str, str], Tuple[float, str]] = {}
 SANDBOX_HOST_ENV = ("LANG", "TZ")
 _SANDBOX_DEFAULTS = {"memory": "2g", "cpus": 2, "pids": 512}
 _IMAGE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/:@-]*$")
@@ -1100,15 +1108,18 @@ class SandboxError(ValueError):
 
 def sandbox_config(policy: Optional[dict]) -> Optional[dict]:
     """The sandbox ``policy`` asks a re-check to run in, or None for none. ``recheck_sandbox``
-    is true or ``{engine: podman, image, memory, cpus, pids}``; anything else raises
-    SandboxError, because an operator who asked for a sandbox gets one or no re-run."""
+    is true or ``{engine: podman, image, memory, cpus, pids, lockfile}``; anything else raises
+    SandboxError, because an operator who asked for a sandbox gets one or no re-run.
+    ``lockfile`` names the file, relative to a worktree's top, the image is proven against
+    (image_proof); uv.lock unless it says otherwise."""
     value = (policy or {}).get("recheck_sandbox")
     if value is None or value is False:
         return None
     if value is True:
         value = {}
     if not isinstance(value, dict):
-        raise SandboxError("recheck_sandbox must be true or an object {engine: podman, image, memory, cpus, pids}")
+        raise SandboxError("recheck_sandbox must be true or an object "
+                           "{engine: podman, image, memory, cpus, pids, lockfile}")
     engine = value.get("engine", "podman")
     if engine != "podman":
         raise SandboxError(f"recheck_sandbox.engine {engine!r}: podman is the only engine")
@@ -1116,6 +1127,7 @@ def sandbox_config(policy: Optional[dict]) -> Optional[dict]:
     memory = value.get("memory", _SANDBOX_DEFAULTS["memory"])
     cpus = value.get("cpus", _SANDBOX_DEFAULTS["cpus"])
     pids = value.get("pids", _SANDBOX_DEFAULTS["pids"])
+    lockfile = value.get("lockfile", SANDBOX_LOCKFILE)
     if not isinstance(image, str) or not _IMAGE_RE.match(image):
         raise SandboxError(f"recheck_sandbox.image {image!r} is not an image reference")
     if not isinstance(memory, str) or not _MEMORY_RE.match(memory):
@@ -1124,7 +1136,74 @@ def sandbox_config(policy: Optional[dict]) -> Optional[dict]:
         raise SandboxError(f"recheck_sandbox.cpus {cpus!r} is not a number of cpus")
     if isinstance(pids, bool) or not isinstance(pids, int) or not 0 < pids <= 1_000_000:
         raise SandboxError(f"recheck_sandbox.pids {pids!r} is not a process count")
-    return {"engine": "podman", "image": image, "memory": memory, "cpus": cpus, "pids": pids}
+    if not isinstance(lockfile, str) or not lockfile or PurePosixPath(lockfile).is_absolute() \
+            or ".." in PurePosixPath(lockfile).parts:
+        raise SandboxError(f"recheck_sandbox.lockfile {lockfile!r} is not a path inside a worktree")
+    return {"engine": "podman", "image": image, "memory": memory, "cpus": cpus, "pids": pids,
+            "lockfile": lockfile}
+
+
+def image_proof(sandbox: dict, cwd: str, podman: Optional[str] = None) -> Optional[str]:
+    """None when the sandbox's image is proven complete for a re-run in ``cwd``, else why
+    it is not: no lockfile there, an image with no proof, or one proven for another
+    lockfile. Proven means build-recheck-image.sh ran the whole suite inside the image with
+    a tree's top mounted at /work, against that top's lockfile, and labelled the image with
+    the lockfile's sha256 (PROVEN_LABEL). So only a re-run whose own directory is such a top
+    is what was proven: a container mounts nothing but the re-run's directory, and one below
+    the top sees neither its lockfile nor the package the proof imported from /work (the
+    review of 9a9cbd6). Until then a failure in the sandbox may be the image's and not the
+    code's, so it refutes nothing (sandbox_failure; ctr_e4a93fd6d32e2b66)."""
+    name = sandbox.get("lockfile") or SANDBOX_LOCKFILE
+    lockfile = Path(cwd).resolve() / name
+    if not lockfile.is_file():
+        above = _worktree_file(Path(cwd), name)
+        if above is not None:
+            return (f"the re-run's directory is below its tree's top ({above.parent}), and the image is "
+                    f"proven only with a top mounted at /work")
+        return f"the worktree holds no {name}"
+    try:
+        digest = hashlib.sha256(lockfile.read_bytes()).hexdigest()
+    except OSError as exc:
+        return f"{lockfile} cannot be read: {exc}"
+    image = sandbox["image"]
+    proven = _image_label(podman or shutil.which("podman") or "podman", image, PROVEN_LABEL)
+    if not proven:
+        return f"{image} carries no proof"
+    if proven != digest:
+        return f"{image} is proven for lockfile {proven[:12]}, and this worktree's is {digest[:12]}"
+    return None
+
+
+def _worktree_file(start: Path, name: str) -> Optional[Path]:
+    """``name`` in ``start`` or the nearest directory above it, stopping at the worktree's
+    top (the first directory holding .git): a receipt's cwd is often a subdirectory."""
+    here = start.resolve()
+    while True:
+        candidate = here / name
+        if candidate.is_file():
+            return candidate
+        if (here / ".git").exists() or here.parent == here:
+            return None
+        here = here.parent
+
+
+def _image_label(podman: str, image: str, label: str) -> str:
+    """One label of a local image, '' when it has none or podman cannot say; asked at most
+    once per PROOF_CACHE_SECONDS per image, since a lane re-runs many receipts in one."""
+    now = time.monotonic()
+    cached = _PROOF_CACHE.get((image, label))
+    if cached is not None and now - cached[0] < PROOF_CACHE_SECONDS:
+        return cached[1]
+    try:
+        done = subprocess.run([podman, "image", "inspect", "--format",
+                               "{{ index .Config.Labels \"%s\" }}" % label, image],
+                              stdin=subprocess.DEVNULL, capture_output=True, text=True, timeout=30)
+        value = done.stdout.strip() if done.returncode == 0 else ""
+    except (OSError, subprocess.SubprocessError):
+        value = ""
+    value = "" if value in ("<no value>", "<nil>") else value
+    _PROOF_CACHE[(image, label)] = (now, value)
+    return value
 
 
 def sandbox_refusal(cwd: str) -> Optional[str]:
@@ -1163,7 +1242,11 @@ def sandbox_argv(podman: str, sandbox: dict, cwd: str, argv: Union[str, List[str
             passed += ["-e", f"{key}={host_env[key]}"]
     for key, value in (variables or {}).items():
         passed += ["-e", f"{key}={value}"]
-    return [podman, "run", "--rm", "--pull=never", "--name", name,
+    # --init: podman's init (catatonit) is the container's PID 1 and reaps what the command
+    # started and killed. Without one a killed child stays a zombie nobody waits for, and a
+    # receipt that checks its children are gone reads it as alive (the image proof on the
+    # driver, 2026-09-30: two tests failed that way)
+    return [podman, "run", "--rm", "--pull=never", "--init", "--name", name,
             "--network=none", "--userns=keep-id", "--cap-drop=all",
             "--security-opt=no-new-privileges", "--read-only", "--tmpfs", "/tmp:rw,nosuid,nodev",
             "--pids-limit", str(sandbox["pids"]), "--memory", str(sandbox["memory"]),
@@ -1199,9 +1282,9 @@ def network_refusal(text: str) -> Optional[str]:
     return None
 
 
-# what a command says when the image does not hold what it imports or runs: the base image
-# holds an interpreter, uv and pytest and nothing of the project (an image per lockfile is a
-# later story), so a missing module is the image's gap, not the receipt's
+# what a command says when the image does not hold what it imports or runs: an image not
+# proven for the worktree's lockfile may lack anything, and even a proven one holds only
+# what the lockfile names, so a missing module is the image's gap, not the receipt's
 IMAGE_LACKS = "sandboxed, the image lacks"
 _MISSING = re.compile(r"No module named '?([A-Za-z0-9_.]+)'?|(?:^|: )([A-Za-z0-9_.+-]+): (?:command )?not found")
 
@@ -1215,11 +1298,15 @@ def image_lacks(text: str) -> Optional[str]:
     return None
 
 
-def sandbox_failure(image: str, fresh: dict, expected_exit, cmd) -> Optional[str]:
+def sandbox_failure(image: str, fresh: dict, expected_exit, cmd,
+                    unproven: Optional[str] = None) -> Optional[str]:
     """Why a sandboxed run that disagreed with its expectation is no answer, or None when it
     is one: podman's own failure (exit 125: no image by that name), a program the image
-    cannot run (126, 127), a network the sandbox does not have, or a module the image does
-    not hold. The re-check and the acceptance check read a sandboxed run alike.
+    cannot run (126, 127), a network the sandbox does not have, a module the image does not
+    hold -- and any failure at all in an image not proven complete for the worktree's
+    lockfile (``unproven``, image_proof's reason), since that failure may be the image's.
+    Only a proven image's failure refutes. The re-check and the acceptance check read a
+    sandboxed run alike.
 
     The last two are read from the run's own output, which its author wrote: a failing
     command can print its way to "sandboxed, no network". That buys it no verification --
@@ -1237,6 +1324,8 @@ def sandbox_failure(image: str, fresh: dict, expected_exit, cmd) -> Optional[str
     lacking = image_lacks(tail)
     if lacking:
         return f"{IMAGE_LACKS} {lacking}"
+    if unproven:
+        return f"the re-run failed in {image}, which is not proven for this worktree's lockfile ({unproven}); not a refutation"
     return None
 
 
@@ -1441,6 +1530,12 @@ def _git(args: Sequence[str], cwd: str) -> subprocess.CompletedProcess:
                           timeout=GIT_CHECK_SECONDS)
 
 
+class BindingError(ValueError):
+    """A binding that could not be built on this host: a commit its repository does not
+    hold, a file that is missing or not a regular one. The message is this host's detail
+    (its paths, git's stderr); a server answers a remote caller without it (serve.py)."""
+
+
 def commit_binding(repo: Optional[str] = None, sha: Optional[str] = None, branch: Optional[str] = None) -> dict:
     """Bind to a commit. Raises ValueError when the sha does not resolve in the repo:
     a binding to a commit that does not exist is not evidence of anything."""
@@ -1996,7 +2091,11 @@ def check(body: dict, cwd: Optional[str] = None, strict: bool = False, timeout:
     if notes.get("sandboxed"):
         # a disagreement the sandbox itself caused is a question it could not ask there,
         # not a different answer (the PE's ruling on ctr_543e, for the network)
-        reason = (sandbox_failure(notes["sandboxed"], notes.get("fresh") or {}, body.get("exit"), body.get("cmd"))
+        # the image's proof is asked only of a disagreement: a match verifies in any image
+        unproven = (image_proof(notes["sandbox"], notes["sandbox_cwd"])
+                    if outcome == "mismatch" and notes.get("sandbox") else None)
+        reason = (sandbox_failure(notes["sandboxed"], notes.get("fresh") or {}, body.get("exit"), body.get("cmd"),
+                                  unproven=unproven)
                   if outcome == "mismatch" else None)
         if reason:
             outcome = "error"
@@ -2181,6 +2280,7 @@ def _check_binding(body: dict, cwd: Optional[str] = None, strict: bool = False,
             if sandbox is not None:  # check() reads a disagreement through sandbox_failure
                 notes["sandboxed"] = sandbox["image"]
                 notes["fresh"] = fresh
+                notes["sandbox"], notes["sandbox_cwd"] = sandbox, run_cwd
             if fresh.get("start_error") and fresh["exit"] != body.get("exit"):
                 # The command never started here and the recording does not say it should
                 # not have, so nothing was asked and nothing disagreed: a `chmod`, a

{strata_agent_memory-0.2.7 → strata_agent_memory-0.2.8}/agent_memory/ledger.py

@@ -130,6 +130,7 @@ UNTRUSTED_POLICY = {
     "recheck_allow": list(STARTER_CONFIG["recheck_allow"]),  # not the clone's idea of "safe"
     "recheck_allow_shell": False,
     "recheck_sandbox": None,   # which image a re-check runs in, and whether: the machine's, never a clone's
+    "retrieval": None,         # the plugin a compile runs (ctr_9e166c2f291b829b): the machine's, never a clone's
     "redact": [],              # an attacker-supplied regex can hang capture (catastrophic backtracking)
     "path_map": [],            # where a re-check runs
     "org_path": None,          # what it reads and writes outside the checkout

{strata_agent_memory-0.2.7 → strata_agent_memory-0.2.8}/agent_memory/mcp_server.py

@@ -30,7 +30,7 @@ import sys
 import traceback
 from datetime import timedelta
 from pathlib import Path
-from typing import Any, Dict, Optional
+from typing import Any, Dict, List, Optional
 
 from . import __version__
 from . import approvals as approvals_mod
@@ -706,12 +706,7 @@ class Server:
         if any(not isinstance(item, str) for item in evidence):
             # an inline evidence object is an agent typing its own receipt
             return self._text("rejected: evidence must be receipt ids; use memory_run", is_error=True)
-        if args.get("commit"):
-            evidence.append(ev.commit_binding(str(ledger.root), args["commit"]))
-        for f in args.get("files") or []:
-            evidence.append(ev.file_binding(f))
-        for f in args.get("env_files") or []:
-            evidence.append(ev.file_binding(f, role="environment"))
+        evidence += self._bindings(args, ledger)
         if evidence:
             body["evidence"] = evidence
         for key in ("rationale", "example", "outcome", "source", "contract", "confidence", "expect"):
@@ -736,6 +731,20 @@ class Server:
             out["warning"] = warning
         return self._text(json.dumps(out))
 
+    def _bindings(self, args: dict, ledger) -> List[dict]:
+        """The bindings a claim's arguments ask for, built on this host: the commit in this
+        ledger's repository, then the files by path. What building one raises names this
+        host (its repository, git's stderr, which paths exist), which the caller of a local
+        server already knows; the served tool keeps it from a remote one (serve.py)."""
+        built: List[dict] = []
+        if args.get("commit"):
+            built.append(ev.commit_binding(str(ledger.root), args["commit"]))
+        for f in args.get("files") or []:
+            built.append(ev.file_binding(f))
+        for f in args.get("env_files") or []:
+            built.append(ev.file_binding(f, role="environment"))
+        return built
+
     def tool_memory_run(self, args: dict) -> dict:
         if not self.allow_run:
             return self._text(

{strata_agent_memory-0.2.7 → strata_agent_memory-0.2.8}/agent_memory/remote.py

@@ -48,6 +48,21 @@ RECHECK_TIMEOUT = 660.0
 # the client speaks the revision the stdio server speaks; the server accepts three
 MCP_VERSION = "2025-06-18"
 
+# How much of a reply this client will hold (ctr_cfbd768152e255a4). A hostile, broken or
+# intercepted replica could otherwise send a body with no end, and the CLI, a hook or the
+# relay would read all of it into memory. The largest legitimate reply is one record, and
+# serve takes a posted record of up to serve.MAX_BODY_BYTES (8 MiB). On 2026-09-30 the
+# fleet's 3,171 records had a largest of 51 KB, the 500 largest together (a worst page at
+# PAGE_MAX) were 1.8 MiB, /audit was 262 KB and the whole ledger 4 MiB. So 32 MiB is four
+# times the largest record the server accepts and seventeen times today's worst page, and
+# it is all a replica can make the client hold. A test pins these against serve's.
+REPLY_MAX_BYTES = 32 * 1024 * 1024
+# the event stream never ends, so it is capped per line: one data line carries one record
+STREAM_LINE_MAX_BYTES = 16 * 1024 * 1024
+# an error body is {"error": "..."} and only its first 500 characters are ever shown, so it
+# is read this far and no further; a longer one is cut, not refused, as it is already an error
+ERROR_BODY_MAX_BYTES = 64 * 1024
+
 LOOPBACK_HOSTS = {"localhost", "127.0.0.1", "::1", "[::1]"}
 
 
@@ -300,11 +315,11 @@ class Client:
                 req.add_header(key, value)
         try:
             with self.opener.open(req, timeout=timeout or self.timeout) as resp:
-                return resp.status, dict(resp.headers), resp.read().decode("utf-8", "replace")
+                return resp.status, dict(resp.headers), _capped_body(resp, path).decode("utf-8", "replace")
         except urllib.error.HTTPError as exc:
             if 300 <= exc.code < 400:
                 raise RemoteError(exc.code, _redirect_refusal(exc.headers.get("Location"))) from exc
-            raise RemoteError(exc.code, _message(exc.code, exc.read())) from exc
+            raise RemoteError(exc.code, _message(exc.code, exc.read(ERROR_BODY_MAX_BYTES))) from exc
         except urllib.error.URLError as exc:
             raise RemoteError(0, f"cannot reach {self.base}: {exc.reason}") from exc
         except (TimeoutError, OSError) as exc:  # a socket timeout on a read already under way
@@ -428,7 +443,8 @@ class Client:
         nothing on the wire: every way a stream can stop has the same answer, which is to
         reconnect with the last id that did arrive. RemoteError is for the answer that
         never became a stream at all, which is a different thing and the caller's to
-        report. This method does no work until it is iterated. ``alive``, when given, is
+        report, and for a line longer than STREAM_LINE_MAX_BYTES, which no record makes
+        and which is read no further. This method does no work until it is iterated. ``alive``, when given, is
         called for every line the server sends, a heartbeat included: a caller that backs off
         between connections can tell a live stream that was quiet from one that sent nothing.
         ``on_open``, when given, is handed a ``close()`` once the stream is open, which any
@@ -452,7 +468,7 @@ class Client:
         except urllib.error.HTTPError as exc:
             if 300 <= exc.code < 400:
                 raise RemoteError(exc.code, _redirect_refusal(exc.headers.get("Location"))) from exc
-            raise RemoteError(exc.code, _message(exc.code, exc.read())) from exc
+            raise RemoteError(exc.code, _message(exc.code, exc.read(ERROR_BODY_MAX_BYTES))) from exc
         except urllib.error.URLError as exc:
             raise RemoteError(0, f"cannot reach {self.base}: {exc.reason}") from exc
         except (TimeoutError, OSError) as exc:
@@ -465,11 +481,14 @@ class Client:
         try:
             while True:
                 try:
-                    raw = stream.readline()
+                    raw = stream.readline(STREAM_LINE_MAX_BYTES + 1)
                 except (TimeoutError, OSError):  # a socket timeout is the idle stream's end
                     return
                 if not raw:
                     return
+                if len(raw) > STREAM_LINE_MAX_BYTES:  # a line with no end in sight: stop reading
+                    raise RemoteError(stream.status, f"/events sent a line of more than {STREAM_LINE_MAX_BYTES} "
+                                                     f"bytes (STREAM_LINE_MAX_BYTES); stopped reading the stream")
                 if alive is not None:
                     alive()
                 line = raw.decode("utf-8", "replace").rstrip("\n").rstrip("\r")
@@ -575,6 +594,25 @@ def _redirect_refusal(location: Optional[str]) -> str:
             "the host it names. Point --remote at the final URL.")
 
 
+def _capped_body(resp, path: str) -> bytes:
+    """A reply's body, or RemoteError once it is over REPLY_MAX_BYTES.
+
+    A declared Content-Length over the cap is refused before any of it is read, and a body
+    that declares none, or declares less than it sends, is read one byte past the cap and
+    no further. The message names the cap and the path; never the query, which carries
+    what was asked, and never the token.
+    """
+    where = path.split("?", 1)[0]
+    refusal = f"{where} answered with more than {REPLY_MAX_BYTES} bytes (REPLY_MAX_BYTES); stopped reading"
+    declared = resp.headers.get("Content-Length")
+    if declared is not None and declared.strip().isdigit() and int(declared) > REPLY_MAX_BYTES:
+        raise RemoteError(resp.status, refusal)
+    body = resp.read(REPLY_MAX_BYTES + 1)
+    if len(body) > REPLY_MAX_BYTES:
+        raise RemoteError(resp.status, refusal)
+    return body
+
+
 def _message(status: int, payload: bytes) -> str:
     """The server's own message for a failed request: every error body in this API is
     ``{"error": "..."}``, and anything else (a proxy's HTML) is shown as it arrived."""

{strata_agent_memory-0.2.7 → strata_agent_memory-0.2.8}/agent_memory/render.py

@@ -23,6 +23,7 @@ SECTION_TITLES = {
     "decisions": "Decisions",
     "directions": "Directions (what to try next, what to avoid)",
     "working": "Working memory (evidenced or asserted; confirm before relying on)",
+    "retrieved": "Retrieved (what the retrieval plugin found for this task; confirm before relying on)",
     "exemplars": "Exemplars",
 }
 
@@ -161,7 +162,8 @@ def _markdown_lines(c: Compiled, h: str) -> Tuple[List[str], int]:
     that stays the same bytes while only working memory changes (roadmap 8.5.1)."""
     lines: List[str] = _header_lines(c, h)
     prefix = None
-    for name in ("constraints", "contract", "cross_check", "do_not_retry", "verified", "decisions", "directions", "working", "exemplars"):
+    for name in ("constraints", "contract", "cross_check", "do_not_retry", "verified", "decisions", "directions", "working",
+                 "retrieved", "exemplars"):
         if name == "working":
             prefix = len(lines)
         if name == "contract":
@@ -313,6 +315,10 @@ def render_json(c: Compiled) -> str:
         "obligations": c.obligations,
         "excluded": [{"id": i, "reason": r} for i, r in c.excluded],
     }
+    if c.retrieval is not None:
+        # only when a plugin took part, as the receipt carries it: without the key the json
+        # view is what it was (the review of #149)
+        payload["retrieval"] = c.retrieval
     return json.dumps(payload, indent=2, ensure_ascii=False) + "\n"