topos-node 1.4.1__tar.gz → 1.4.2__tar.gz

{topos_node-1.4.1 → topos_node-1.4.2}/MANIFEST.in

@@ -6,3 +6,6 @@ recursive-include shared *.json
 # Tray icon glyphs (topos/cli/assets) — without them the tray cannot render.
 recursive-include topos *.png
 recursive-include topos/features/derivation/bundled_packs *.yaml
+
+# Pinned runtime privacy rubric; absence must fail closed, but must ship.
+include topos/permissions_v2/shadow_rubric.pinned.md

{topos_node-1.4.1/topos_node.egg-info → topos_node-1.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: topos-node
-Version: 1.4.1
+Version: 1.4.2
 Summary: Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://topos.dialogues.ai
@@ -40,6 +40,7 @@ Requires-Dist: scikit-learn<2,>=1.4
 Requires-Dist: sqlite-vec~=0.1.9
 Requires-Dist: pystray~=0.19.5
 Requires-Dist: pillow>=10.0
+Requires-Dist: pytypedstream==0.1.0
 Provides-Extra: database
 Requires-Dist: psycopg[binary]~=3.3.3; extra == "database"
 Provides-Extra: engine

{topos_node-1.4.1 → topos_node-1.4.2}/pyproject.toml

@@ -9,7 +9,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "topos-node"
-version = "1.4.1"
+version = "1.4.2"
 description = "Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client"
 readme = "README.md"
 license = "Apache-2.0"
@@ -65,6 +65,8 @@ dependencies = [
   # only when a GUI session is detected — harmless on headless installs.
   "pystray~=0.19.5",
   "pillow>=10.0",
+  # Pure-data validation of complete native iMessage archives; no NSUnarchiver.
+  "pytypedstream==0.1.0",
 ]
 
 [project.urls]

{topos_node-1.4.1 → topos_node-1.4.2}/topos/__version__.py

@@ -1,6 +1,6 @@
 """Topos Control Plane Version Information."""
 
-__version__ = "1.4.1"
-__version_info__ = (1, 4, 1)
+__version__ = "1.4.2"
+__version_info__ = (1, 4, 2)
 
 __all__ = ["__version__", "__version_info__"]

topos_node-1.4.2/topos/api/permissions_native_probe.py

@@ -0,0 +1,150 @@
+"""Local-owner-only diagnostic. No native paths, text or release authority on the wire."""
+import asyncio
+from datetime import datetime, timezone
+import sqlite3
+
+from fastapi import APIRouter, Depends, HTTPException
+from fastapi.responses import JSONResponse
+
+from topos.auth import resolve_request_principal
+from topos.permissions_v2.canonical import PolicyError
+from topos.permissions_v2.contract import Identifier, StrictModel
+
+router = APIRouter(prefix='/v1/permissions-beta/v2/imessage', tags=['permissions-owner-maintenance'])
+
+
+class NativeProbeRequest(StrictModel):
+    dataset_id: Identifier
+    starts_at: str
+    ends_at: str
+
+
+@router.post('/preflight')
+async def preflight(body: NativeProbeRequest, principal=Depends(resolve_request_principal)):
+    from topos.principal import OWNER_APP
+    if principal is None or principal.cls != OWNER_APP or principal.channel != 'uds':
+        raise HTTPException(403, 'owner_socket_required')
+
+    def apply():
+        from topos.permissions_v2.runtime import get_runtime
+        from topos.permissions_v2.native_imessage_probe import probe_native_messages
+        runtime = get_runtime()
+        identity = runtime.protocol.ledger.identity
+        if principal.acting_user and principal.acting_user != identity.owner_id:
+            raise PolicyError('owner_binding')
+        path = runtime.protocol.canonical_database
+        conn = sqlite3.connect(path.as_uri() + '?mode=ro', uri=True, timeout=1)
+        try:
+            conn.row_factory = sqlite3.Row
+            conn.execute('PRAGMA query_only=ON')
+            conn.execute('BEGIN')
+            return probe_native_messages(conn, dataset_id=body.dataset_id, owner_id=identity.owner_id,
+                starts_at=body.starts_at, ends_at=body.ends_at, now=datetime.now(timezone.utc))
+        finally:
+            conn.close()
+    try:
+        result = await asyncio.to_thread(apply)
+        return JSONResponse(result, headers={'Cache-Control': 'no-store'})
+    except PolicyError as exc:
+        raise HTTPException(503, exc.code, headers={'Cache-Control': 'no-store'}) from None
+    except Exception:
+        raise HTTPException(503, 'native_probe_unavailable', headers={'Cache-Control': 'no-store'}) from None
+
+
+class NativeRecoveryRequest(NativeProbeRequest):
+    owner_attestation: str
+
+
+# Recovery is a bounded maintenance operation, never a sync loop or a recipient
+# API. One run per process avoids duplicate paid/local preparation on retries.
+import threading
+_RECOVERY_LOCK = threading.Lock()
+
+
+@router.post('/recover')
+async def recover(body: NativeRecoveryRequest, principal=Depends(resolve_request_principal)):
+    from topos.principal import OWNER_APP
+    from topos.permissions_v2.ingest_provenance import OWNER_ATTESTATION
+    if principal is None or principal.cls != OWNER_APP or principal.channel != 'uds':
+        raise HTTPException(403, 'owner_socket_required')
+    if body.owner_attestation != OWNER_ATTESTATION:
+        raise HTTPException(422, 'ingest_owner_attestation_required')
+    if not _RECOVERY_LOCK.acquire(blocking=False):
+        raise HTTPException(409, 'native_recovery_running')
+
+    def apply():
+        from dataclasses import replace
+        from topos.permissions_v2.runtime import get_runtime
+        from topos.permissions_v2.native_imessage_probe import capture_matching_snapshot
+        from topos.permissions_v2.imessage_reconciliation import ATTRIBUTED_CONTRACT, parse_reconciliation_snapshot
+        from topos.permissions_v2.reconciliation_provenance import publish_existing
+        from topos.permissions_v2.reconciliation_facts import prepare_facts, derive_prepared
+        from topos.permissions_v2.reconciliation_facts import owner_subject
+        from topos.principal import set_principal, reset_principal
+        runtime = get_runtime()
+        identity = runtime.protocol.ledger.identity
+        if principal.acting_user and principal.acting_user != identity.owner_id:
+            raise PolicyError('owner_binding')
+        token = set_principal(replace(principal, acting_user=identity.owner_id))
+        db = None
+        try:
+            service = runtime.ingestion()
+            db = runtime.ingestion_connection()
+            owner_subject(db)
+            if db.execute("SELECT 1 FROM sqlite_master WHERE name='ingest_provenance_enrollments'").fetchone():
+                if db.execute('SELECT 1 FROM ingest_provenance_enrollments WHERE dataset_id=?', (body.dataset_id,)).fetchone():
+                    raise PolicyError('native_recovery_already_enrolled')
+            # The configured private directories are installed by the operator,
+            # not picked or chmodded from request fields.
+            db.execute('PRAGMA query_only=ON')
+            db.execute('BEGIN')
+            snapshot_id, measured = capture_matching_snapshot(db, snapshot_root=service.root,
+                dataset_id=body.dataset_id, owner_id=identity.owner_id, starts_at=body.starts_at,
+                ends_at=body.ends_at, now=datetime.now(timezone.utc))
+            description, data = service._snapshot(snapshot_id, ATTRIBUTED_CONTRACT)
+            records = parse_reconciliation_snapshot(data, now=datetime.now(timezone.utc), reader_contract=ATTRIBUTED_CONTRACT)
+            boundary = service.resolver.entity_boundary(db)
+            rows = []
+            withheld = 0
+            for record in records:
+                row = dict(db.execute('SELECT * FROM conversation_messages WHERE message_id=?', (record.message_id,)).fetchone())
+                try:
+                    boundary.check(table='conversation_messages', record_id=record.message_id,
+                                   source_id='imessage', dataset_id=body.dataset_id, row=row)
+                    rows.append(row)
+                except PolicyError:
+                    withheld += 1
+            db.rollback()
+            db.execute('PRAGMA query_only=OFF')
+            # No writer lock or live DB transaction during local inference.
+            prepared, stats = asyncio.run(prepare_facts(rows))
+            if not prepared:
+                return {'authority_created': False, 'counts': measured['counts'], 'preparation': stats,
+                        'boundary_withheld': withheld}
+            enrollment = service.enroll(db, snapshot_id=snapshot_id, dataset_id=body.dataset_id,
+                snapshot_sha256=description['snapshot_sha256'], owner_attestation=body.owner_attestation,
+                reader_contract=ATTRIBUTED_CONTRACT)
+            derived = {}
+            def derive(conn, current):
+                derived.update(derive_prepared(conn, current, prepared))
+            result = publish_existing(service, db, enrollment_id=enrollment['enrollment_id'], derive=derive,
+                classifications={key: item['classification'] for key, item in prepared.items()})
+            return {'authority_created': True, 'reconciled': result['reconciled'], 'preparation': stats,
+                    'derivation': derived, 'boundary_withheld': withheld}
+        finally:
+            if db is not None:
+                db.close()
+            reset_principal(token)
+    try:
+        # The worker owns the lock until it actually stops, even if HTTP cancels.
+        def guarded():
+            try:
+                return apply()
+            finally:
+                _RECOVERY_LOCK.release()
+        result = await asyncio.to_thread(guarded)
+        return JSONResponse(result, headers={'Cache-Control': 'no-store'})
+    except PolicyError as exc:
+        raise HTTPException(503, exc.code, headers={'Cache-Control': 'no-store'}) from None
+    except Exception:
+        raise HTTPException(503, 'native_recovery_unavailable', headers={'Cache-Control': 'no-store'}) from None

topos_node-1.4.2/topos/api/permissions_search_maintenance.py

@@ -0,0 +1,44 @@
+"""Owner socket maintenance of existing signed message-search indexes."""
+from fastapi import APIRouter, Depends, HTTPException
+
+from topos.auth import resolve_request_principal
+from topos.core.handlers.permissions_v2 import handle_permissions_v2_message_search_rebuild
+
+router = APIRouter(prefix="/v1/permissions-beta/v2/message-search", tags=["permissions-owner-maintenance"])
+
+
+@router.post("/rebuild")
+async def rebuild(principal=Depends(resolve_request_principal)):
+    from topos.principal import set_principal, reset_principal
+
+    token = set_principal(principal)
+    try:
+        result = await handle_permissions_v2_message_search_rebuild({"id":"owner-search-rebuild"})
+    finally:
+        reset_principal(token)
+    if result.get("status") != "ok":
+        raise HTTPException(result.get("code",503), result.get("error","permissions_v2_unavailable"),
+                            headers={"Cache-Control":"no-store"})
+    from fastapi.responses import JSONResponse
+    return JSONResponse(result["payload"], headers={"Cache-Control":"no-store"})
+
+
+@router.post("/message-review")
+async def message_review(payload: dict, principal=Depends(resolve_request_principal)):
+    from topos.principal import set_principal, reset_principal
+    from topos.core.handlers.permissions_v2 import handle_permissions_v2_message_review
+    from fastapi.responses import JSONResponse
+    from topos.principal import OWNER_APP
+    if principal.cls == OWNER_APP and principal.channel == "uds" and not principal.acting_user:
+        from dataclasses import replace
+        from topos.permissions_v2.runtime import get_runtime
+        principal = replace(principal, acting_user=get_runtime().protocol.ledger.identity.owner_id)
+    token = set_principal(principal)
+    try:
+        result = await handle_permissions_v2_message_review({"id":"owner-message-review","payload":payload})
+    finally:
+        reset_principal(token)
+    if result.get("status") != "ok":
+        raise HTTPException(result.get("code",503),result.get("error","message_review_unavailable"),
+                            headers={"Cache-Control":"no-store"})
+    return JSONResponse(result["payload"],headers={"Cache-Control":"no-store"})

{topos_node-1.4.1 → topos_node-1.4.2}/topos/app.py

@@ -29,6 +29,8 @@ from .api import (
     ingestion_sources as ingestion_sources_routes,
     permissions_identity as permissions_identity_routes,
     permissions_ingestion as permissions_ingestion_routes,
+    permissions_search_maintenance as permissions_search_maintenance_routes,
+    permissions_native_probe as permissions_native_probe_routes,
     intelligence_lifecycle as intelligence_lifecycle_routes,
     local_mcp as local_mcp_routes,
     llm as llm_routes,
@@ -143,6 +145,8 @@ app.include_router(ingestion_routes.router, prefix="/v1")
 app.include_router(ingestion_sources_routes.router)
 app.include_router(permissions_ingestion_routes.router)
 app.include_router(permissions_identity_routes.router)
+app.include_router(permissions_search_maintenance_routes.router)
+app.include_router(permissions_native_probe_routes.router)
 app.include_router(query_routes.router, prefix="/v1")
 app.include_router(messenger_analytics_routes.router, prefix="/v1")
 app.include_router(uma_data_routes.router)

{topos_node-1.4.1 → topos_node-1.4.2}/topos/core/handlers/permissions_v2.py

@@ -87,7 +87,8 @@ async def handle_permissions_v2_status(message):
 async def _handle_evidence(message, operation, *, projection=False):
     from ...permissions_v2.canonical import PolicyError
     from ...permissions_v2.evidence import EvidenceBinding
-    from ...permissions_v2.evidence_reviews import EvidenceLookup, RecordEvidenceReview, RevokeEvidenceReview
+    from ...permissions_v2.evidence_reviews import (EvidenceLookup, FactOptIn, FactOptOut, RecordEvidenceReview,
+        ReviewQueueRequest, ReviewTotalsRequest, RevokeEvidenceReview)
     from ...permissions_v2.fact_contract import FAMILY, OUTPUT_FAMILIES
     from ...permissions_v2.identity import LEGACY_CONTRACT, SUBJECT_CONTRACTS
     from ...permissions_v2.projection_reviews import RecordProjectionReview, RevokeProjectionReview
@@ -123,7 +124,9 @@ async def _handle_evidence(message, operation, *, projection=False):
             binding = EvidenceBinding.parse(payload["binding"])
             request_type = {"preview":EvidenceLookup, "read":EvidenceLookup,
                 "record":RecordProjectionReview if projection else RecordEvidenceReview,
-                "revoke":RevokeProjectionReview if projection else RevokeEvidenceReview}[operation]
+                "revoke":RevokeProjectionReview if projection else RevokeEvidenceReview,
+                # Implicit review's owner surfaces: the queue, the totals, the deselection and its undo.
+                "queue":ReviewQueueRequest, "totals":ReviewTotalsRequest, "opt_out":FactOptOut, "opt_in":FactOptIn}[operation]
             request = request_type.parse(payload["request"])
             runtime = get_runtime()
             actual = EvidenceBinding.parse(runtime.protocol.ledger.identity.model_dump())
@@ -146,12 +149,12 @@ async def _handle_evidence(message, operation, *, projection=False):
                 return getattr(service, operation)(request, now=int(time.time()), contract=contract,
                                                    family=family)
             service = runtime.evidence_reviews(require_existing=operation in {"record", "revoke"})
-            if operation == "record":
-                result = service.record(request, now=int(time.time()))
+            if operation in {"record", "opt_out"}:
+                result = getattr(service, operation)(request, now=int(time.time()))
                 _refresh_message_search(runtime)
                 return result
             result = getattr(service, operation)(request)
-            if operation == "revoke":
+            if operation in {"revoke", "opt_in"}:
                 _refresh_message_search(runtime)
             return result
 
@@ -201,6 +204,30 @@ async def handle_permissions_v2_evidence_review_revoke(message):
     return await _handle_evidence(message, "revoke")
 
 
+@handles("permissions_v2_evidence_review_queue", owner_only=True)
+async def handle_permissions_v2_evidence_review_queue(message):
+    """Owner-only: a page of current facts, least confident first, with labels, standing and source counts."""
+    return await _handle_evidence(message, "queue")
+
+
+@handles("permissions_v2_evidence_totals", owner_only=True)
+async def handle_permissions_v2_evidence_totals(message):
+    """Owner-only: qualifying / deselected / withheld counts, overall and per source."""
+    return await _handle_evidence(message, "totals")
+
+
+@handles("permissions_v2_evidence_opt_out", owner_only=True)
+async def handle_permissions_v2_evidence_opt_out(message):
+    """Owner-only: deselect one fact; every search index is rebuilt without it."""
+    return await _handle_evidence(message, "opt_out")
+
+
+@handles("permissions_v2_evidence_opt_in", owner_only=True)
+async def handle_permissions_v2_evidence_opt_in(message):
+    """Owner-only: reselect one fact; every search index is rebuilt with it."""
+    return await _handle_evidence(message, "opt_in")
+
+
 @handles("permissions_v2_projection_preview", owner_only=True)
 async def handle_permissions_v2_projection_preview(message):
     return await _handle_evidence(message, "preview", projection=True)
@@ -242,17 +269,100 @@ async def handle_permissions_v2_message_search_rebuild(message):
         return {"id": req_id, "status": "error", "code": 403, "error": "owner_mode_required"}
 
     def apply():
-        with with_db_write():
-            runtime = get_runtime()
-            if principal.acting_user != runtime.protocol.ledger.identity.owner_id:
-                raise PolicyError("owner_binding")
-            index = runtime.message_search_index()
+        from dataclasses import replace
+        from ...principal import set_principal, reset_principal
+
+        token = None
+        try:
+            with with_db_write():
+                runtime = get_runtime()
+                owner_id = runtime.protocol.ledger.identity.owner_id
+                if (principal.channel == "cp_relay" and principal.acting_user != owner_id
+                    or principal.channel == "uds" and principal.acting_user and principal.acting_user != owner_id):
+                    raise PolicyError("owner_binding")
+                if principal.channel == "uds":
+                    # The authenticated local owner transport identifies this
+                    # paired node. Bind its account from trusted runtime state,
+                    # never from a request body/header, for deeper owner checks.
+                    token = set_principal(replace(principal, acting_user=owner_id))
+                index = runtime.message_search_index()
+            # The index owns its publication/check gates. Fact qualification
+            # and embedding must not hold the writer gate for the whole build.
             index.sweep()
             states = index.rebuild_all()
             return {"grants": len(states), "ready": sum(state == "ready" for state in states.values())}
+        finally:
+            if token is not None:
+                reset_principal(token)
     try:
         return {"id": req_id, "status": "ok", "payload": await asyncio.to_thread(apply)}
     except PolicyError as exc:
         return {"id": req_id, "status": "error", "code": 403 if exc.code == "owner_binding" else 503, "error": exc.code}
     except Exception:
         return {"id": req_id, "status": "error", "code": 503, "error": "permissions_v2_unavailable"}
+
+
+@handles("permissions_v2_message_review", owner_only=True)
+async def handle_permissions_v2_message_review(message):
+    from ...permissions_v2.canonical import PolicyError, digest
+    from ...permissions_v2.evidence import EvidenceBinding, _owner
+    from ...permissions_v2.message_review_contract import (MessageLookup, RecordMessageReview,
+        MessageReviewQueue, MessageReviewPreview, MessageOptOutResult, MessageReviewResult,
+        AutomaticReviewRequest, AutomaticReviewLookup)
+    from ...permissions_v2.message_evidence import (preview_message, record_message_review, queue_messages, message_key)
+    from ...permissions_v2.runtime import get_runtime
+    from ...storage.db.write_gate import with_db_write
+
+    req_id, payload = message.get("id"), message.get("payload")
+    if not isinstance(payload, dict) or set(payload) != {"binding", "operation", "request"}:
+        return {"id":req_id,"status":"error","code":400,"error":"message_review_payload_invalid"}
+    def apply():
+        with with_db_write():
+            runtime = get_runtime()
+            actual = EvidenceBinding.parse(runtime.protocol.ledger.identity.model_dump())
+            _owner(actual)
+            if EvidenceBinding.parse(payload["binding"]) != actual:
+                raise PolicyError("evidence_target_binding")
+            op = payload["operation"]
+            model = {"queue":MessageReviewQueue, "preview":MessageLookup, "record":RecordMessageReview,
+                     "opt_out":MessageLookup, "opt_in":MessageLookup,
+                     "automatic_start":AutomaticReviewRequest, "automatic_status":AutomaticReviewLookup,
+                     "automatic_cancel":AutomaticReviewLookup}.get(op)
+            if model is None:
+                raise PolicyError("message_review_operation_invalid")
+            request = model.parse(payload["request"])
+            if op.startswith("automatic_"):
+                worker = runtime.automatic_message_reviews()
+                if op == "automatic_start":
+                    return worker.start(request)
+                return worker.cancel() if op == "automatic_cancel" else worker.status()
+            service = runtime.evidence_reviews(require_existing=True)
+            resolver, reviews = service.resolver, service.reviews
+            if op == "queue":
+                return queue_messages(resolver, reviews, request, now=int(time.time()))
+            if op == "record":
+                review = record_message_review(resolver, reviews, **request.model_dump(), reviewed_at=int(time.time()))
+                result = MessageReviewResult(review=review, review_revision=digest(review.model_dump()))
+            else:
+                if request.identity.binding != actual or request.identity.table == "signal_objects":
+                    raise PolicyError("evidence_target_binding")
+                if op == "preview":
+                    return MessageReviewPreview.parse(preview_message(resolver, reviews, request.identity))
+                key = message_key(request.identity)
+                if op == "opt_out":
+                    reviews.opt_out(key, now=int(time.time()))
+                else:
+                    reviews.opt_in(key)
+                result = MessageOptOutResult(identity=request.identity, opted_out=op == "opt_out")
+        _refresh_message_search(runtime)
+        return result
+    try:
+        result = await asyncio.to_thread(apply)
+        return {"id":req_id,"status":"ok","payload":result.model_dump()}
+    except PolicyError as exc:
+        code = (403 if exc.code in {"owner_authority_required", "evidence_target_binding"} else
+                409 if exc.code in {"review_stale", "review_conflict", "review_id_conflict"} else
+                400 if exc.code in {"schema_invalid", "message_review_window_invalid", "message_review_operation_invalid"} else 503)
+        return {"id":req_id,"status":"error","code":code,"error":exc.code}
+    except Exception:
+        return {"id":req_id,"status":"error","code":503,"error":"message_review_unavailable"}

{topos_node-1.4.1 → topos_node-1.4.2}/topos/features/facts/evidence_time.py

@@ -16,10 +16,12 @@ It is deliberately narrow, because every wrong refusal keeps a stale belief:
 - Evidence is read when the decision is made, from the rows the facts'
   current ``source_refs`` name, never from the record frozen at insert. A ref
   counts only while its row still exists, is not deleted or excluded, and the
-  ref names that row's source AND dataset. A ref without both (every shared
-  extractor writes one) cannot say which of several same-id rows it means.
+  ref names that row's table and source, plus its dataset for human messages.
+  AI-chat rows have no dataset column; the trust must prove their enrollment
+  and parent owner/source binding instead.
 - Only owner statements are ordered, and a ref counts only when its row is the
-  owner's own (``is_from_self`` 1). A refresh merges refs from any speaker into
+  owner's own (``is_from_self`` 1, or an authored user prompt with validated
+  native provenance). A refresh merges refs from any speaker into
   a fact, so the fact's label alone does not show whose message supports it.
 - A time is "cannot tell" when it could end after the moment its row is known
   to have existed: the trust's own ceiling for rows it vouches for (for the
@@ -43,6 +45,7 @@ from ..temporal.points import TimePoint, order, parse_point, span, unknown
 from ..temporal.records import EventTime
 
 LEAF_TABLE = "conversation_messages"
+_ORDERED_TABLES = (LEAF_TABLE, "ai_chat_messages")
 OWNER = "owner"
 _EVENT_COLUMN = {"conversation_messages": "event_at", "ai_chat_messages": "event_at", "journal_entries": "entry_at"}
 # SQLite's datetime('now') forms, UTC by definition, with optional fractional seconds.
@@ -104,31 +107,47 @@ def _last(point: TimePoint) -> int:
 
 
 def _owner_row(row: Dict[str, Any]) -> bool:
+    if row.get("_table") == "ai_chat_messages":
+        # These labels only permit asking the trust. They never replace the
+        # durable proof of the row and its parent account identity.
+        return row.get("sender_type") in ("human", "user") and row.get("actor_role") == "authored"
     flag = row.get("is_from_self")
     return flag is True or (type(flag) is int and flag == 1)
 
 
+def _names_row(ref: Dict[str, Any], row: Dict[str, Any]) -> bool:
+    if ref.get("source_id") in (None, "") or str(ref["source_id"]) != str(row.get("source_id")):
+        return False
+    if row["_table"] == "ai_chat_messages":
+        return ref.get("dataset_id") is None  # the AI leaf contract is datasetless
+    return ref.get("dataset_id") not in (None, "") and str(ref["dataset_id"]) == str(row.get("dataset_id"))
+
+
 def _points(conn, trust: EvidenceTrust, refs: Iterable[Dict[str, Any]]) -> List[Optional[TimePoint]]:
     """One entry per ref: the trusted point, or ``None`` when it cannot tell."""
     refs = [ref for ref in refs or []]
-    ids = sorted({str(ref.get("record_id")) for ref in refs
-                  if type(ref) is dict and ref.get("table") == LEAF_TABLE and ref.get("record_id")})
-    rows: Dict[str, Dict[str, Any]] = {}
-    if ids:
+    rows: Dict[tuple, Dict[str, Any]] = {}
+    for table in _ORDERED_TABLES:
+        ids = sorted({str(ref.get("record_id")) for ref in refs
+                      if type(ref) is dict and ref.get("table") == table and ref.get("record_id")})
+        if not ids:
+            continue
         try:
             cursor = conn.execute(
-                f"SELECT * FROM {LEAF_TABLE} WHERE message_id IN ({','.join('?' for _ in ids)})", ids)
+                f"SELECT * FROM {table} WHERE message_id IN ({','.join('?' for _ in ids)})", ids)
             names = [column[0] for column in cursor.description]
-            rows = {str(values[names.index("message_id")]): dict(zip(names, values)) for values in cursor.fetchall()}
+            for values in cursor.fetchall():
+                row = {**dict(zip(names, values)), "_table": table}
+                rows[(table, str(row["message_id"]))] = row
         except sqlite3.Error:
-            rows = {}
+            continue
     excluded = _excluded_ids(conn) if rows else set()
     out: List[Optional[TimePoint]] = []
     for ref in refs:
-        row = rows.get(str(ref.get("record_id"))) if type(ref) is dict and ref.get("table") == LEAF_TABLE else None
+        row = (rows.get((ref.get("table"), str(ref.get("record_id"))))
+               if type(ref) is dict and ref.get("table") in _ORDERED_TABLES else None)
         if (row is None or _deleted(row) or str(row.get("message_id")) in excluded or not _owner_row(row)
-                or not all(ref.get(key) not in (None, "") and str(ref[key]) == str(row.get(key))
-                           for key in ("source_id", "dataset_id"))):
+                or not _names_row(ref, row)):
             out.append(None)
             continue
         try:

{topos_node-1.4.1 → topos_node-1.4.2}/topos/features/facts/extract.py

@@ -467,6 +467,7 @@ def extract_rules_facts(
     source_ref,
     temporal_for,
     accept_value=None,
+    message_extractor=None,
     stats: Optional[Dict[str, int]] = None,
 ) -> int:
     """The rules floor alone, for a caller that has already proved its rows.
@@ -476,7 +477,8 @@ def extract_rules_facts(
     chooses or creates a self entity: the caller supplies the subject, the
     reference and the temporal record for each row. ``accept_value`` may refuse
     a value before anything is written; refusals count under
-    ``value_refused`` in ``stats``.
+    ``value_refused`` in ``stats``. ``message_extractor`` is a trusted server
+    callback for proved message rows, never a request-selected extractor.
     """
     from ..lifecycle.exclusions import excluded_record_ids
 
@@ -487,6 +489,8 @@ def extract_rules_facts(
         table = str(row.get("_table") or "")
         record_id = row.get("record_id") or row.get("message_id") or row.get("id")
         extractor = _EXTRACTORS.get(table)
+        if message_extractor is not None and table in ("conversation_messages", "ai_chat_messages"):
+            extractor = lambda item, db: message_extractor(item, db, table=table)
         if extractor is None or str(record_id or "") in excluded_records:
             stats["rows_skipped"] = stats.get("rows_skipped", 0) + 1
             continue

{topos_node-1.4.1 → topos_node-1.4.2}/topos/features/lifecycle/blackhole.py

@@ -329,6 +329,9 @@ class BlackholeStore:
         if existing:
             # Idempotent: already protected. Refresh the mutable bits, do not
             # restart a rebuild that may already have completed.
+            # A re-flag must not forget owner-saved aliases when the entity was
+            # reaped or its current resolver inventory has become narrower.
+            aliases_json = json.dumps(sorted(set(existing["aliases"]) | set(_normalized_aliases(aliases_json))))
             with with_db_write():
                 self._conn.execute(
                     """

{topos_node-1.4.1 → topos_node-1.4.2}/topos/features/lifecycle/blackhole_guard.py

@@ -272,6 +272,48 @@ class BlackholeGuard:
             kept.append(row)
         return kept
 
+    def filter_observed_canonical_rows(self, rows, *, canonical_table):
+        """Veto observed identity/contact/context on legacy canonical reads.
+
+        The owner retains access. Unsupported or unavailable protection context
+        withholds; this never confers a grant or certifies semantic absence.
+        A fresh boundary is used for each call, not cached between DB snapshots.
+        """
+        if self.sees_everything:
+            return list(rows)
+        from ...permissions_v2.canonical import PolicyError
+        from ...permissions_v2.entity_boundary import EntityBoundary
+        from contextlib import closing, nullcontext
+        from urllib.parse import quote
+
+        try:
+            # Check existing protection state as the old guard did; required
+            # entity/record schemas are still checked in the fresh snapshot.
+            # Do not trust request-local cached ids at egress.
+            _ = self.active
+            path = self._conn.execute("PRAGMA database_list").fetchone()[2]
+            own_snapshot = bool(path) and not self._conn.in_transaction
+            context = (closing(sqlite3.connect("file:" + quote(path, safe="/") + "?mode=ro", uri=True))
+                       if own_snapshot else nullcontext(self._conn))
+            with context as conn:
+                if own_snapshot:
+                    conn.execute("BEGIN")
+                boundary = EntityBoundary(conn)
+                blocked = {str(row[0]) for row in conn.execute("SELECT record_id FROM owner_only_records")}
+                result = []
+                for row in rows:
+                    try:
+                        if any(str(row.get(key) or "") in blocked for key in
+                               ("record_id", "message_id", "id", "event_id", "entry_id", "transaction_id", "segment_id", "contact_id")):
+                            continue
+                        if not boundary.legacy_veto(canonical_table, row):
+                            result.append(row)
+                    except (PolicyError, sqlite3.Error, TypeError, ValueError, RecursionError):
+                        continue
+                return result
+        except (PolicyError, sqlite3.Error, TypeError, ValueError, RecursionError):
+            return []
+
     # ------------------------------------------------- free-text egress scan
 
     def text_mentions_blackholed(self, text: Optional[str]) -> bool: