Honcho PR Map: Cleanup Pass

Context

This issue is a cleanup map for the current open Honcho PR cluster: pick one canonical PR per bug cluster, merge/rebase that, then close duplicates with a Superseded by #NNN link.

This is not meant to be an exhaustive audit of every Honcho search hit. It is a maintainer path through the pile.

Current highest-priority path

1. Security / config hygiene

• fix(security): apply 0600 permissions on memory plugin config files containing API keys #32244: apply 0600 permissions to memory-plugin config files containing API keys.
• observe_me=True: Honcho integration runs third-party inference on user conversations without disclosure #4074: cloud disclosure/security issue. fix(honcho): disclose cloud data flow during setup #24458 attempts setup disclosure, but needs freshness/rebase review.

2. Runtime identity / peer mapping

Canonical: #30077.

#30077 now carries the runtime peer mapping path and should be treated as the canonical identity/perspective correctness PR.

It covers:

• Honcho memory provider: support runtime peer alias/prefix mapping for multi-user gateways #27314: runtime peer alias/prefix mapping for multi-user gateways.
• Surface pinPeerName in hermes memory setup wizard for multi-instance Honcho setups #28283: setup/status UX for pinPeerName / pinUserPeer.
• feat(honcho): add stable multi-user memory identity mapping #27371: original runtime peer mapping PR, included with authorship preserved.
• feat(honcho): surface pinPeerName in setup and status (#28283) #28572: setup/status pinPeerName surface, superseded by fix(honcho): runtime peer mapping — correctness follow-ups + setup wizard + docs #30077's broader setup/status/docs work.

Do not fold these into #30077:

• feat(honcho): support per-LID peer routing #21539: WhatsApp-specific LID routing. Use userPeerAliases docs/examples if needed; do not add peerByLid as a parallel Honcho config surface.
• feat(honcho): add per-platform peer identity routing #15598: alternate peerIdentityStrategy / peerIdentities model. Do not mix with fix(honcho): runtime peer mapping — correctness follow-ups + setup wizard + docs #30077's resolver surface.
• feat(api-server): X-Hermes-User-* / Chat-* headers for multi-user identity #24423: useful API-server identity headers, but broader gateway/API-server scope. Keep as a companion PR unless maintainers explicitly want API identity plumbing in the same PR.

3. Peer cards / No profile facts

Canonical: #27979, adopted into local #30077 work with authorship preserved.

#17124, #31240, and #27979 all address the same direct target peer-card fallback cluster. Prefer #27979 because it includes both:

• direct target peer-card fallback, and
• peer-card read/write path alignment.

#31240 is narrower and includes .paperclip_artifacts/candidate-skip-ledger.jsonl; do not adopt it directly. #17124 includes merge commits and an older fallback shape.

#23485 is also a good fit: it aligns honcho_context(peer="user") perspective with the same observer/target resolution model.

Local validation performed against #30077 + #27979 + #23485:

• scripts/run_tests.sh tests/honcho_plugin/test_session.py tests/test_honcho_session_context.py tests/honcho_plugin/test_pin_peer_name.py tests/honcho_plugin/test_cli.py tests/run_agent/test_memory_provider_init.py tests/gateway/test_agent_cache.py
• Result: 251 passed, 0 failed.

After #27979/#23485 are pushed into #30077, #30077 should also close/supersede:

• [Bug]: honcho_profile tool returns "No profile facts" on self-hosted Honcho v3.0.7+ #31219: honcho_profile returns No profile facts on self-hosted Honcho v3-style direct peer-card lookup.
• fix(honcho): align peer-card read and write paths #27979: peer-card read/write path alignment.
• fix(honcho): align user context peer perspective #23485: session-context peer perspective.
• fix(honcho): fallback to durable peer cards for profiles #17124 / fix(honcho): fall back to direct target peer cards #31240: direct target peer-card fallback variants.
• fix: write Honcho peer cards with observer target #23022 / fix: align Honcho profile card writes #20729: write-path/profile-card subsets, likely superseded by fix(honcho): align peer-card read and write paths #27979-in-fix(honcho): runtime peer mapping — correctness follow-ups + setup wizard + docs #30077.

4. Multimodal sync crash

Canonical: #32030.

• fix(memory): normalize multimodal sync content #32030: provider-agnostic multimodal content normalization; likely canonical for honcho memory: sync_turn fails on multimodal (list) content — vision turns not recorded #30252.
• fix(honcho): sync_turn crashes on list input from image-bearing messages #22768, fix(honcho): flatten multimodal list content in sync_turn (#30252) #30264, fix(honcho): flatten multimodal list content in sync_turn (#30252) #30294 duplicate the same crash at narrower scopes.
• fix(honcho): preserve memory when backend rejects conclusions #26484 is adjacent but not identical: preserve memory when backend rejects conclusions.

Recommendation: prefer #32030; close #22768/#30264/#30294 if #32030 covers their tests.

5. Self-hosted / base URL / local auth

Keep these as separate sub-bugs unless a clean self-hosted umbrella PR appears:

• fix(honcho): support base_url-only config in cmd_identity for local instances #13439 / [Bug]: Local Honcho "base_url" instead of api key does not work #2613: base_url-only config for local instances.
• fix(honcho): honor host-specific baseUrl #14489 / [Bug]: Honcho session link for locally hosted honcho incorrectly links to public honcho server #4269: host-block baseUrl and local session links.
• fix(plugins/honcho): strip version prefix from base_url for self-hosted instances (#20688) #20720 / Bug: Honcho SDK double-prefixing causes 404 errors for self-hosted instances #20688: strip version prefix / SDK double-prefixing.
• feat(honcho): prompt for local JWT during self-hosted setup #30180 / [Feature]: Honcho local host support - JWT support #29885: local JWT setup.
• fix(honcho): use safe profile host keys #26478 / _host_key() returns dot-separated form ("hermes.fundraising") that violates Honcho workspace ID regex #26459 / Honcho memory plugin generates invalid workspace/peer IDs for profile names containing dots #30246: safe host/workspace IDs.
• Bug: self-hosted Honcho memory broken — honcho-ai SDK 2.x incompatible with Honcho server 3.x #5434: SDK 2.x vs Honcho server 3.x compatibility.

6. Session naming / path normalization

• fix(plugins): cap Honcho session name to 100 chars to prevent API errors (#13868) #15380: cap Honcho session names; closes [Bug]: resolve_session_name sanitizes gateway_session_key without length truncation, overflows Honcho's 100-char session ID limit #13868.
• fix(honcho): normalize manual cwd overrides #23256: normalize manual cwd overrides; canonical candidate for Bug: Honcho session override lookup misses configured cwd when path spelling changes #13284 after rebase/status check.

These are small enough to merge independently after freshness checks.

Secondary clusters

Startup/lifecycle reliability

• fix(honcho): prevent TOCTOU race in get_honcho_client() #24763 closes bug: TOCTOU race in get_honcho_client() allows duplicate Honcho client construction #24759: prevent TOCTOU duplicate Honcho client construction.
• fix: shut down Honcho memory provider after oneshot #31664: shut down Honcho memory provider after oneshot.
• fix(honcho): make startup fail open #24847 closes/relates Slow startup: Honcho memory provider blocks initialization for ~60s+ per step #5726 and feat(honcho): optional lightweight cached startup context for recallMode=tools #2164: fail open instead of blocking startup.
• Keep ACP responsive with lazy Honcho tools memory #19102: keep ACP responsive with lazy Honcho tools memory.

Recommendation: keep #24763 and #31664 narrow. Treat #24847/#19102 as startup-latency/fail-open work; verify against the current lazy/session-init path.

Tool correctness / budgets / schemas

• fix(honcho): honor focused memory tool budgets #29403 closes Honcho memory tools ignore focused query and token budget controls #29402: honor focused memory tool budgets.
• fix(honcho): reject whitespace-only honcho_search and honcho_reasoning queries #11256: reject whitespace-only honcho_search / honcho_reasoning queries.
• feat(honcho): add honcho_list_conclusions tool to expose conclusion IDs #16133 relates honcho_conclude: no delete or update — tool only appends, never modifies #17968: expose conclusion IDs so users can delete/update conclusions.
• [honcho] honcho_conclude 工具在初始化失败后无法重试 #8920: honcho_conclude cannot retry after initialization failure.
• fix(honcho): honcho toolset excluded from tool surface when platform_toolsets is configured #4523: Honcho toolset excluded when platform_toolsets is configured.

Prioritize #29403 and #4523 because they affect runtime correctness/tool availability.

Memory-context leakage / prompt hygiene

• fix(memory): defense-in-depth scrub of <memory-context> leaks #33248: defense-in-depth scrub of <memory-context> leaks.
• fix(cli): strip memory-context fence tags from resumed history display #23393: strip memory-context fence tags from resumed CLI history display.
• fix(memory): filter framework artifacts before sync #32031: filter framework artifacts before sync.
• fix(honcho): filter deriver noise and label dialectic context injection #25344: filter deriver noise and label dialectic context injection.
• fix(honcho): keep injected memory context silent #18062: keep injected memory context silent.
• Related issue: [Bug]: Honcho auto-injected context rebuilds cached system prompt every N turns, invalidating KV cache on every prefix-caching backend #13631, auto-injected context invalidates prompt caching.

Some of these are broader memory-provider/prompt-assembly hygiene, not Honcho-only. Pick one canonical boundary rule for memory-context handling, then close narrower duplicates.

Session writes / metadata / write frequency

• fix(honcho): dedupe repeated message flushes #18536: dedupe repeated message flushes.
• fix(honcho): respect writeFrequency in sync_turn #19650: respect writeFrequency in sync_turn.
• fix(honcho): session title overrides sessionStrategy setting #24748 closes [Bug]: Honcho - session titles override sessionStrategy setting #24740: session titles override sessionStrategy.
• feat(honcho): add session-write dedup and platform metadata stripping #9404 / feat: add Honcho session-write dedup and metadata stripping #9422: session-write dedup and platform metadata stripping.

Compare #18536, #19650, and #9422 before merging; they may touch the same write path from different angles.

Plugin migration / setup compatibility

• feat(agent): auto-migrate Honcho to memory provider plugin #12743: auto-migrate Honcho to memory provider plugin. Current main already has Honcho under plugins/memory/honcho/, so this is migration/activation cleanup, not the original move.
• fix(memory): expose legacy honcho setup alias #25529: expose legacy honcho setup alias.

Only merge if current setup flows still break for users upgrading from old Honcho config paths. Otherwise close as stale migration cleanup.

Optional/session-sharing features

• feat(honcho): HONCHO_SESSION env var for per-launch session pinning #18152: HONCHO_SESSION env var for per-launch session pinning.
• Add sharedSessions config for cross-session recall in Honcho plugin #28436: sharedSessions config for cross-session recall.
• feat(honcho): add peerPerspective context, workspace agentPeerMap, and multi-agent observer hierarchy #9405 / feat: add Honcho peerPerspective, agentPeerMap, and multi-agent observer hierarchy #9423: peerPerspective, agentPeerMap, multi-agent observer hierarchy.

Defer until #30077 settles the core identity mapping semantics.

Suggested cleanup order

1. Land fix(security): apply 0600 permissions on memory plugin config files containing API keys #32244 for config permissions.
2. Land fix(honcho): runtime peer mapping — correctness follow-ups + setup wizard + docs #30077 as the canonical runtime identity + peer perspective cleanup.
3. After fix(honcho): runtime peer mapping — correctness follow-ups + setup wizard + docs #30077 lands, close duplicate/superseded PRs:
   • feat(honcho): add stable multi-user memory identity mapping #27371, feat(honcho): surface pinPeerName in setup and status (#28283) #28572
   • fix(honcho): align peer-card read and write paths #27979, fix(honcho): align user context peer perspective #23485, fix(honcho): fallback to durable peer cards for profiles #17124, fix(honcho): fall back to direct target peer cards #31240, fix: write Honcho peer cards with observer target #23022, fix: align Honcho profile card writes #20729, once the adopted commits are on the PR branch
   • feat(honcho): support per-LID peer routing #21539 / feat(honcho): add per-platform peer identity routing #15598 unless maintainers want docs-only follow-up work
4. Land fix(memory): normalize multimodal sync content #32030 for multimodal sync; close fix(honcho): sync_turn crashes on list input from image-bearing messages #22768/fix(honcho): flatten multimodal list content in sync_turn (#30252) #30264/fix(honcho): flatten multimodal list content in sync_turn (#30252) #30294 if covered.
5. Work self-hosted issues independently: fix(honcho): support base_url-only config in cmd_identity for local instances #13439, fix(honcho): honor host-specific baseUrl #14489, fix(plugins/honcho): strip version prefix from base_url for self-hosted instances (#20688) #20720, feat(honcho): prompt for local JWT during self-hosted setup #30180, fix(honcho): use safe profile host keys #26478.
6. Land small independent reliability fixes: fix(plugins): cap Honcho session name to 100 chars to prevent API errors (#13868) #15380, fix(honcho): normalize manual cwd overrides #23256, fix(honcho): prevent TOCTOU race in get_honcho_client() #24763, fix: shut down Honcho memory provider after oneshot #31664.
7. Treat memory-context/prompt hygiene as a separate cleanup track.

At a glance

Cluster	Canonical PR	Related issue(s)	Supersede / close candidates
Config security	#32244, #24458	#4074	—
Runtime peer mapping	#30077	#27314, #28283	#27371, #28572, #21539, #15598
Peer cards / context perspective	#27979 + #23485 in #30077	#31219	#17124, #31240, #23022, #20729
API-server identity headers	#24423	—	keep separate / companion
Multimodal sync	#32030	#30252	#22768, #30264, #30294
Self-hosted base URL	#13439, #14489, #20720	#2613, #4269, #20688	older base_url retries if covered
Local JWT	#30180	#29885	—
Safe host keys	#26478	#26459, #30246	—
Session naming/path	#15380, #23256	#13868, #13284	older cwd/path variants
Startup lifecycle	#24763, #24847, #31664, #19102	#24759, #5726	overlapping lazy-startup variants
Memory-context hygiene	#33248, #23393, #32031	#13631	narrower tag-scrub duplicates
Tool correctness	#29403, #16133	#29402, #17968, #8920, #4523	—

Status note: PR mergeability and cherry-pick viability must be rechecked immediately before merging/closing anything.