fix(memory): collapse per-channel memory domains to project:default#557
Merged
Conversation
…203) ToMemoryDomain() derived per-channel domains from session ID prefixes (e.g. project:c0agm484p0q), causing memories stored in one Slack channel to be invisible to find_memories searches from another. Collapse all domains to project:default until a proper domain-scoping mechanism is designed. Switch find_memories to SearchAcrossDomainsByPlanAsync (cross-domain search) to match what automatic recall already does. Audience and boundary remain the security gates.
Replace 10 scattered "project:default" string literals with SecurityPolicyDefaults.DefaultMemoryDomain. The one remaining literal in Netclaw.Tools.Abstractions stays because that project has no dependency on Netclaw.Configuration.
…ULL audience (#558) Record INSERT paths in ApplyInlineCurationBatchAsync and SupersedeRecordAsync omitted audience and boundary columns, leaving all records with NULL audience. Combined with the COALESCE fallback defaulting to the requesting audience, this caused personal DM memories to leak into Team channels. Fix: - Add boundary/audience to inline curation and supersede record INSERTs - Change COALESCE fallback for NULL audience from requesting audience to Personal (most restrictive) — untagged records fail closed - Change all NULL audience reader fallbacks from Public to Personal
… for inline docs SupersedeRecordAsync now reads and carries forward memory_class from the original record instead of silently defaulting to 'evidence'. ApplyInlineCurationBatchAsync document path now uses resolvedBoundary and operation.Audience directly, matching ApplyCurationBatchAsync.
…tion DTOs Replace string Audience with default "public" on SQLiteMemoryCurationOperation and MemoryCheckpointCandidate with required TrustAudience enum parameter. Omitting audience is now a compile error, not a silent default to the most permissive level. - Boundary also made required (no default) on SQLiteMemoryCurationOperation - INSERT paths call .ToWireValue() to convert enum to wire string - All test callers updated with explicit audience and boundary values
This was referenced Apr 7, 2026
…cores (#561) All recall coordinator logs now include the session ID for correlation with turn-level logs. Added per-candidate selector scores to the candidate selection log and a new memory_retrieval_final log showing injected items with their RecallRank scores. DeterministicCandidateSelector exposes SelectWithScores() to surface scoring details without changing the existing Select() API.
d56739c to
a95e003
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes cross-channel memory isolation, audience enforcement, and recall observability.
project:default— memory is no longer siloed by Slack channel ID. Switchesfind_memoriesto cross-domain search matching what automatic recall already does.audienceandboundaryto all record INSERT paths (ApplyInlineCurationBatchAsync,SupersedeRecordAsync). Changes NULL audience fallback from requesting audience (most permissive) to Personal (most restrictive) — untagged records fail closed. MakesAudiencea requiredTrustAudienceenum onSQLiteMemoryCurationOperationandMemoryCheckpointCandidate— omitting audience is now a compile error.memory_retrieval_finallog with injected item titles and RecallRank scores.SecurityPolicyDefaults.DefaultMemoryDomainconstant replacing 10+ scattered string literals.memory_classthroughSupersedeRecordAsync(was silently defaulting to 'evidence').resolvedBoundaryfor inline curation document INSERTs (was passing raw nullable value).Test plan
dotnet slopwatch analyze— 0 violations