docs: define persona memory provenance contract #5591
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| # Persona and Memory Provenance Contract | ||
|
|
||
| **Status:** Proposed contribution for [#4253](https://github.com/tinyhumansai/openhuman/issues/4253) | ||
|
|
||
| **Scope:** Documentation and design contract for the first vertical slice of the guided persona builder and memory dashboard. | ||
|
|
||
| ## 1. Purpose | ||
|
|
||
| OpenHuman already exposes memory and agent-profile capabilities to the runtime, but a non-technical user needs a clear answer to three questions before trusting those capabilities: what the system believes, where each statement came from, and how to correct or retire it. This document defines a small, implementation-neutral contract for presenting persona and memory state without creating a second UI-only source of truth. | ||
|
|
||
| The contract is intentionally narrower than the full #4253 feature. It does not prescribe a complete dashboard, template catalog, or storage migration. It defines the state and provenance semantics that those surfaces should share. | ||
|
|
||
| ## 2. Source-of-truth rule | ||
|
|
||
| The runtime profile and memory stores remain authoritative. The React UI may edit and display these records, but it must not persist a parallel persona or memory model in browser-only storage. A successful UI mutation is complete only after the runtime source of truth acknowledges it and the UI refreshes from that source. | ||
|
|
||
| The flow is therefore: | ||
|
|
||
| ```text | ||
| User action → UI validation → runtime RPC → authoritative store → refreshed view | ||
| ``` | ||
|
|
||
| A failed or unconfirmed runtime mutation must not be presented as saved. Optimistic UI may show a pending state, but it must be discarded when the RPC fails or the refreshed record does not contain the requested change. | ||
|
|
||
| ## 3. Memory record contract | ||
|
|
||
| The dashboard should render each memory record with the following semantic fields, whether they are returned directly by the current backend or introduced through an adapter at the UI boundary: | ||
|
|
||
| | Field | Meaning | User-facing treatment | | ||
| | --- | --- | --- | | ||
| | `statement` | The retained fact, preference, goal, or observation. | Primary readable content. | | ||
| | `source` | How the record entered the system. | Always visible in a compact provenance label. | | ||
| | `confidence` | A bounded estimate of record reliability. | Display as qualitative bands, not false precision. | | ||
| | `state` | Lifecycle or epistemic status. | Distinguish active, provisional, needs-confirmation, and retired. | | ||
| | `projectContext` | The work or personal context to which the record belongs. | Show the active context and prevent silent cross-context retrieval. | | ||
| | `createdAt` / `lastConfirmedAt` | Record age and most recent confirmation. | Use for freshness and review prompts. | | ||
| | `evidenceRefs` | References to the interaction, import, or approved output that supports the record. | Link or disclose when available; never expose secrets. | | ||
|
|
||
| The initial source vocabulary should preserve the distinction between explicit user statements, approved outputs, interaction inferences, and imported documents. If the runtime has a different enum, the adapter should map it losslessly and keep an unknown value visible as `Other` rather than silently classifying it. | ||
|
Comment on lines
+27
to
+39
Contributor
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
rg -n -C 6 'MemoryEntry|source|confidence|state|projectContext|evidenceRefs|createdAt|lastConfirmedAt' \
--glob '*.rs' --glob '*.ts' --glob '*.tsx' .Repository: tinyhumansai/openhuman Length of output: 50379 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- candidate files ---'
git ls-files | rg -i '(^|/)(memory|persona|provenance|context|evidence)|memory|persona|provenance' | head -n 300
printf '%s\n' '--- specification ---'
if test -f docs/specs/2026-08-19-persona-memory-provenance-contract.md; then
cat -n docs/specs/2026-08-19-persona-memory-provenance-contract.md | sed -n '1,90p'
fi
printf '%s\n' '--- targeted symbol matches ---'
rg -n -C 3 --glob '*.rs' --glob '*.ts' --glob '*.tsx' \
'MemoryEntry|MemoryRecord|memory record|memoryRecords|provenance|evidenceRefs|projectContext|lastConfirmedAt|confidence|needs-confirmation|retired' . \
| head -n 1200Repository: tinyhumansai/openhuman Length of output: 50381 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- AST outlines ---'
for f in \
src/openhuman/memory/mod.rs \
src/openhuman/memory/sources/schemas.rs \
src/openhuman/memory/sources/rpc.rs \
src/openhuman/memory/read_rpc/types.rs \
app/src/components/intelligence/IntelligenceMemoryTab.tsx \
app/src/components/intelligence/MemoryResultList.tsx \
app/src/components/intelligence/MemoryChunkDetail.tsx \
app/src/components/intelligence/MemorySourcesRegistry.tsx \
app/src/utils/tauriCommands/memory.ts
do
if test -f "$f"; then
echo "### $f"
ast-grep outline "$f" 2>/dev/null | head -n 160 || true
fi
done
printf '%s\n' '--- canonical type and field definitions ---'
rg -n -C 8 \
'pub struct MemoryEntry|struct MemoryEntry|pub enum MemoryCategory|source_ref|EvidenceRef|confidence|project_context|created_at|last_confirmed_at|evidence_refs|projectContext|lastConfirmedAt' \
src/openhuman/memory src/openhuman/learning app/src/components/intelligence app/src/services \
--glob '*.rs' --glob '*.ts' --glob '*.tsx' \
| head -n 1800
printf '%s\n' '--- UI mapping and display logic ---'
rg -n -C 8 \
'MemoryEntry|source_ref|sourceRef|provenance|confidence|projectContext|createdAt|lastConfirmedAt|evidenceRefs|Other|Unknown|Derived' \
app/src/components/intelligence app/src/services app/src/utils/tauriCommands \
--glob '*.ts' --glob '*.tsx' \
| head -n 1800Repository: tinyhumansai/openhuman Length of output: 50379 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- MemoryEntry definitions ---'
rg -n -C 12 'pub struct MemoryEntry|struct MemoryEntry|impl .*MemoryEntry|MemoryEntry \{' \
src tests --glob '*.rs' | head -n 1200
printf '%s\n' '--- read RPC types and mapping ---'
cat -n src/openhuman/memory/read_rpc/types.rs | sed -n '1,125p'
cat -n src/openhuman/memory/read_rpc/chunks.rs | sed -n '40,180p'
cat -n src/openhuman/memory/read_rpc/chunks.rs | sed -n '320,470p'
printf '%s\n' '--- TypeScript chunk and source models ---'
rg -n -C 12 'interface Chunk|type Chunk|ChunkRow|source_kind|source_ref|lifecycle_status|timestamp_ms|MemorySourceEntry' \
app/src --glob '*.ts' --glob '*.tsx' | head -n 1800
printf '%s\n' '--- requested-field defaulting or inference ---'
rg -n -C 5 'confidence|projectContext|project_context|lastConfirmedAt|last_confirmed_at|evidenceRefs|evidence_refs|needs-confirmation|provisional|retired|Other|Unknown|Derived' \
app/src src/openhuman/memory --glob '*.ts' --glob '*.tsx' --glob '*.rs' \
| head -n 1800Repository: tinyhumansai/openhuman Length of output: 50379 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- exact definition files ---'
rg -l --glob '*.rs' 'pub struct MemoryEntry|pub enum MemoryCategory|struct ProfileFacet|enum FacetType|struct Learning|initial_confidence' src tests | sort -u
printf '%s\n' '--- exact MemoryEntry definition ---'
for f in $(rg -l --glob '*.rs' 'pub struct MemoryEntry'); do
echo "### $f"
line=$(rg -n 'pub struct MemoryEntry' "$f" | cut -d: -f1 | head -n1)
start=$((line-20)); test "$start" -lt 1 && start=1
sed -n "${start},$((line+80))p" "$f"
done
printf '%s\n' '--- profile and learning definitions ---'
rg -l --glob '*.rs' 'struct ProfileFacet|enum FacetType|initial_confidence|source_segment_ids|EvidenceRef' src tests | sort -u | while read -r f; do
echo "### $f"
rg -n -C 12 'struct ProfileFacet|enum FacetType|initial_confidence|source_segment_ids|EvidenceRef' "$f" | head -n 240
done
printf '%s\n' '--- exact TypeScript Chunk definition and RPC conversion ---'
rg -l --glob '*.ts' --glob '*.tsx' 'export interface Chunk|export type Chunk|ChunkRow|memoryTree.*Chunks|listChunks' app/src | sort -u | while read -r f; do
echo "### $f"
rg -n -C 16 'export interface Chunk|export type Chunk|ChunkRow|memoryTree.*Chunks|listChunks' "$f" | head -n 320
done
printf '%s\n' '--- semantic field construction ---'
rg -n -C 8 --glob '*.ts' --glob '*.tsx' \
'statement\s*:|confidence\s*:|projectContext\s*:|project_context\s*:|lastConfirmedAt\s*:|last_confirmed_at\s*:|evidenceRefs\s*:|evidence_refs\s*:|state\s*:' \
app/src | head -n 1200Repository: tinyhumansai/openhuman Length of output: 598 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- all MemoryEntry declarations and exports ---'
rg -n -C 8 --glob '*.rs' \
'MemoryEntry|memory_entry|type Memory|struct .*Entry|enum .*Entry|pub use .*memory' \
src/openhuman/memory src/openhuman/agent | head -n 1600
printf '%s\n' '--- learning model declarations ---'
rg -n -C 14 --glob '*.rs' \
'struct |enum |type |confidence|initial_confidence|observed_at|evidence|state|status|facet' \
src/openhuman/agent/learning | head -n 2200
printf '%s\n' '--- frontend declarations containing Chunk ---'
rg -n -C 10 --glob '*.ts' --glob '*.tsx' \
'interface Chunk|type Chunk|Chunk =|ChunkRow|source_kind' \
app/src/utils app/src/services app/src/components/intelligence \
| head -n 1600
printf '%s\n' '--- frontend memory RPC exports ---'
rg -n -C 12 --glob '*.ts' --glob '*.tsx' \
'memoryTree|list_chunks|read_rpc|Chunk' \
app/src/utils/tauriCommands app/src/services app/src/components/intelligence \
| head -n 1800Repository: tinyhumansai/openhuman Length of output: 50379 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- memory tree public types ---'
cat -n app/src/utils/tauriCommands/memoryTree.ts | sed -n '20,125p'
printf '%s\n' '--- learning files ---'
find src/openhuman/agent/learning -maxdepth 3 -type f -name '*.rs' -print | sort
for f in $(find src/openhuman/agent/learning -maxdepth 3 -type f -name '*.rs' | sort); do
echo "### $f"
rg -n -C 10 \
'^(pub )?(struct|enum|type)|confidence|observed_at|confirmed|evidence|source|project|context|state|status|facet' \
"$f" | head -n 260
done
printf '%s\n' '--- profile APIs and schemas ---'
rg -n -C 12 --glob '*.rs' \
'ProfileFacet|FacetType|list_active_facets|upsert_provider_facet|confidence|observed_at|segment_id|evidence' \
src/openhuman/memory src/openhuman/agent | head -n 1800
printf '%s\n' '--- semantic-field assignments and fallback values ---'
rg -n -C 8 --glob '*.rs' --glob '*.ts' --glob '*.tsx' \
'confidence\s*[:=].*(0|1|default|unwrap|Some)|state\s*[:=].*(active|provisional|unknown|Other)|project[_A-Za-z]*\s*[:=]|last[_A-Za-z]*confirmed|evidence[_A-Za-z]*\s*[:=]' \
src/openhuman app/src | head -n 1600Repository: tinyhumansai/openhuman Length of output: 22344 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- provider API definitions ---'
rg -l --glob '*.rs' 'pub struct ProfileFacet|pub enum FacetState|pub enum UserState|trait MemoryProfile' src/openhuman/memory src/openhuman/agent | sort -u | while read -r f; do
echo "### $f"
rg -n -C 18 'pub struct ProfileFacet|pub enum FacetState|pub enum UserState|trait MemoryProfile' "$f" | head -n 700
done
printf '%s\n' '--- EvidenceRef and source metadata ---'
rg -l --glob '*.rs' 'enum EvidenceRef|struct EvidenceRef|pub enum EvidenceRef|source_ref|SourceKind|project_context|project_id|workspace' \
src/openhuman/memory src/openhuman/agent/learning | sort -u | while read -r f; do
echo "### $f"
rg -n -C 12 'enum EvidenceRef|struct EvidenceRef|pub enum EvidenceRef|source_ref|SourceKind|project_context|project_id|workspace' "$f" | head -n 500
done
printf '%s\n' '--- profile schema and persistence ---'
rg -n -C 14 --glob '*.rs' \
'user_profile_facets|CREATE TABLE.*facet|INSERT INTO.*facet|first_seen_at|last_seen_at|evidence_refs|FacetState::|unwrap_or.*state|default.*state' \
src/openhuman/memory src/openhuman/agent/learning | head -n 2200Repository: tinyhumansai/openhuman Length of output: 193 🏁 Script executed: #!/bin/bash
set -euo pipefail
provider=$(git ls-files | rg '/memory/api/provider\.rs$' | head -n1)
host=$(git ls-files | rg '/memory/api/host\.rs$' | head -n1)
echo "provider=$provider"
echo "host=$host"
printf '%s\n' '--- provider API ---'
cat -n "$provider" | sed -n '1,360p'
printf '%s\n' '--- host evidence API ---'
cat -n "$host" | sed -n '1,260p'
printf '%s\n' '--- profile persistence references ---'
rg -n -C 12 --glob '*.rs' \
'ProfileFacet|user_profile_facets|evidence_refs|first_seen_at|last_seen_at|FacetState|UserState' \
src/openhuman/memory src/openhuman/agent/learning | head -n 2200Repository: tinyhumansai/openhuman Length of output: 160 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- memory API module files ---'
git ls-files | rg 'src/openhuman/memory/api|src/openhuman/memory/.*/(provider|host)|src/openhuman/.*/api' | head -n 200
printf '%s\n' '--- API module declarations ---'
rg -n -C 20 --glob '*.rs' \
'mod provider|pub mod provider|mod host|pub mod host|ProfileFacet|EvidenceRef|FacetState|UserState' \
src/openhuman/memory src/openhuman/agent/learning | head -n 1800
printf '%s\n' '--- memory/api.rs ---'
cat -n src/openhuman/memory/api.rs | sed -n '1,420p'Repository: tinyhumansai/openhuman Length of output: 50379 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- API inline module and profile declarations ---'
rg -n -C 20 --glob 'api.rs' \
'provider|host|ProfileFacet|EvidenceRef|FacetState|UserState|trait MemoryProfile' \
src/openhuman/memory
printf '%s\n' '--- source and project mapping paths ---'
rg -n -C 10 --glob '*.rs' --glob '*.ts' --glob '*.tsx' \
'source_kind|source_ref|source_segment_ids|evidence_refs|project_context|project_id|workspace_id|namespace|context_selector' \
src/openhuman/memory src/openhuman/agent/learning app/src/utils/tauriCommands app/src/components/intelligence \
| head -n 2200
printf '%s\n' '--- fallback/default assignments in relevant files ---'
rg -n -C 8 --glob '*.rs' --glob '*.ts' --glob '*.tsx' \
'unwrap_or\(|unwrap_or_else\(|unwrap_or_default\(|Default::default|: null|: undefined|= null|= undefined|\"unknown\"|\"Other\"|\"agent\"' \
src/openhuman/memory/read_rpc src/openhuman/memory/query src/openhuman/agent/learning \
app/src/utils/tauriCommands/memoryTree.ts app/src/components/intelligence \
| head -n 1800Repository: tinyhumansai/openhuman Length of output: 50379 Define canonical adapter semantics for every field. If the runtime lacks a field, the adapter must expose 🤖 Prompt for AI Agents |
||
|
|
||
| ## 4. State transitions | ||
|
|
||
| Memory lifecycle and epistemic status should be explicit. The minimum supported transitions are: | ||
|
|
||
| ```text | ||
| provisional → active | ||
| provisional → needs-confirmation | ||
| active → needs-confirmation | ||
| active → retired | ||
| needs-confirmation → active | ||
| needs-confirmation → retired | ||
| ``` | ||
|
|
||
| A user correction must create an auditable replacement or correction event rather than silently mutating the displayed text. Retiring a record must remove it from default active retrieval while preserving its history for contradiction review and debugging. A newer explicit user statement outranks an older inference, but the older inference should remain traceable as superseded rather than disappearing without explanation. | ||
|
Comment on lines
+43
to
+54
Contributor
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift Complete the lifecycle and deletion contract. Line 54 uses This follows the linked issue requirements for contradiction handling, archiving, and deletion. 🤖 Prompt for AI Agents |
||
|
|
||
| ## 5. Persona sections | ||
|
|
||
| The guided persona editor should map to structured sections that the runtime already understands or can adopt incrementally: | ||
|
|
||
| | Section | Examples | | ||
| | --- | --- | | ||
| | Professional identity | Name, roles, industries, languages, locations, public positioning. | | ||
| | Communication preferences | Tone, structure, audience, verbosity, languages, anti-preferences. | | ||
| | Active projects | Project name, context, goals, constraints, relevant tools, current status. | | ||
| | Working principles | Approval requirements, safety boundaries, evidence standards, review gates. | | ||
| | Learning profile | Provisional preferences and interaction patterns awaiting confirmation. | | ||
|
|
||
| Symbolic astrology or numerology inputs, if supported by a future profile layer, should be stored as reflective context with explicit provenance and uncertainty. They must not be written as deterministic personality facts or allowed to outrank explicit user instructions and real business constraints. | ||
|
|
||
| ## 6. Project isolation | ||
|
|
||
| Every memory search and persona view should carry an explicit context selector. The default must be the current project or workspace context, not a global union of all memories. A global search should require an intentional user action and should disclose that it crosses contexts. | ||
|
|
||
| At minimum, the UI should make the following states distinguishable: | ||
|
|
||
| 1. The record belongs to the active project. | ||
| 2. The record belongs to another known project and is excluded by default. | ||
| 3. The record has no project context and is available only to explicitly global flows. | ||
| 4. The record is restricted and must not be rendered in a broader context. | ||
|
|
||
| The implementation should reuse the runtime’s existing project or source-scope mechanisms rather than inventing a browser-only filter. A project selector that changes only the visible list but not the RPC query is not sufficient. | ||
|
|
||
| ## 7. Minimum vertical slice | ||
|
|
||
| A low-risk first implementation can deliver the following without attempting the entire epic: | ||
|
|
||
| 1. A read-only memory list that renders statement, provenance, state, confidence band, freshness, and project context. | ||
| 2. A project-context filter that is passed through to the authoritative memory query. | ||
| 3. A confirmation action for provisional or needs-confirmation records. | ||
| 4. A correction action that writes through the runtime source of truth and refreshes the record. | ||
| 5. Tests covering explicit user statements, approved outputs, interaction inferences, imported documents, cross-project exclusion, correction failure, and retirement. | ||
|
|
||
| The persona editor can then reuse the same provenance and confirmation components for structured profile sections. | ||
|
|
||
| ## 8. Safety and privacy requirements | ||
|
|
||
| The dashboard must not expose passwords, access tokens, authentication codes, payment information, or unnecessary personal data about third parties. Logs and analytics must not include user-authored memory text, evidence contents, credentials, or raw provider envelopes. Restricted records should be redacted or omitted according to the runtime policy, not hidden only with CSS. | ||
|
Comment on lines
+95
to
+97
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
rg -n -C 8 'restricted|redact|evidenceRefs|MemoryEntry|Recall' \
--glob '*.rs' --glob '*.ts' --glob '*.tsx' .Repository: tinyhumansai/openhuman Length of output: 50379 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- agent memory implementation ---'
sed -n '260,410p' src/openhuman/agent/tinyagents/host/agent_memory.rs
printf '%s\n' '--- recall-related symbols and tests ---'
rg -n -C 4 'recall_through_facade|MemoryItem|citation|sanitize_text|redact|serialized|serde_json|Recall' \
src/openhuman/agent src/openhuman/memory --glob '*.rs' | head -n 500
printf '%s\n' '--- specification context ---'
sed -n '80,110p' docs/specs/2026-08-19-persona-memory-provenance-contract.mdRepository: tinyhumansai/openhuman Length of output: 47107 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- retrieval facade and source-scope types ---'
rg -n -C 6 'recall_through_facade|SourceScope|evidence_refs|evidenceRefs|restricted|Restricted|redact|sanitize' \
src/openhuman/memory src/openhuman/agent/tinyagents --glob '*.rs' | head -n 600
printf '%s\n' '--- memory-tree RPC response types and serializers ---'
rg -n -C 8 'struct .*Response|enum .*Response|serde.*Serialize|to_string|to_value|fetch_leaves|QuerySource|Recall' \
src/openhuman/memory/tree src/openhuman/memory/query --glob '*.rs' | head -n 800
printf '%s\n' '--- relevant tests ---'
rg -n -C 5 'redact|sanitize|restricted|evidence|serialized|serde_json::from_str|scope' \
src/openhuman/agent/tinyagents src/openhuman/memory --glob '*.rs' | head -n 800Repository: tinyhumansai/openhuman Length of output: 50379 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- exact facade implementation ---'
rg -l 'recall_through_facade' src/openhuman --glob '*.rs' | while read -r f; do
echo "FILE: $f"
rg -n -C 20 'recall_through_facade' "$f"
done
printf '%s\n' '--- all evidence and restriction fields ---'
rg -n -C 10 'evidence|source_scope|source_scope|project|restricted|privacy|redact|sanitize_text' \
src/openhuman/memory src/openhuman/agent --glob '*.rs' \
-g '!**/i18n/**' | head -n 1000Repository: tinyhumansai/openhuman Length of output: 50379 Sensitive Data Exposure (CWE-200): Exposure of Sensitive Information to an Unauthorized Actor Enforce restricted-record policy before serialization. The authoritative recall facade returns 🤖 Prompt for AI Agents |
||
|
|
||
| External write actions remain approval-controlled. A correction or retirement initiated by the user is a direct user-approved mutation; an agent-generated suggestion to correct or retire a record must stop at a review state until the user confirms it. | ||
|
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
rg -n -C 8 'correct|retir|approve|approval|actor|agent|user' \
--glob '*.rs' --glob '*.ts' --glob '*.tsx' .Repository: tinyhumansai/openhuman Length of output: 50379 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- spec context ---'
sed -n '70,115p' docs/specs/2026-08-19-persona-memory-provenance-contract.md
printf '%s\n' '--- targeted implementation references ---'
rg -n -i -C 4 'persona memory|memory provenance|provenance|correction|retirement|retire|approval|approved|mutation' \
src app docs/specs \
--glob '*.rs' --glob '*.ts' --glob '*.tsx' --glob '*.md' \
| head -n 500Repository: tinyhumansai/openhuman Length of output: 37182 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- memory mutation and approval symbols ---'
rg -n -i -C 5 \
'correction|retirement|retire|needs[-_ ]confirmation|provisional|confirmed|memory.*(update|delete|remove)|(?:update|delete|remove).*memory|approval' \
src/openhuman/memory src/openhuman \
--glob '*.rs' --glob '*.ts' --glob '*.tsx' \
| head -n 800
printf '%s\n' '--- memory API and RPC files ---'
git ls-files 'src/openhuman/memory/**' | head -n 200Repository: tinyhumansai/openhuman Length of output: 50378 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- document mutation implementation ---'
sed -n '270,325p' src/openhuman/memory/ops/documents.rs
sed -n '430,470p' src/openhuman/memory/ops/documents.rs
printf '%s\n' '--- memory RPC registration and authorization context ---'
rg -n -C 6 'memory_delete_document|doc_delete|clear_namespace|memory_query_namespace|register.*memory|active_memory_guard' \
src/openhuman --glob '*.rs' | head -n 500Repository: tinyhumansai/openhuman Length of output: 42949 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- guarded document writes ---'
sed -n '300,345p' src/openhuman/memory/guard/families.rs
printf '%s\n' '--- write-policy implementation ---'
rg -n -C 8 'fn admit_write|admit_write\(|struct .*Policy|Capability::Documents' \
src/openhuman/memory/guard src/openhuman/security --glob '*.rs' | head -n 500
printf '%s\n' '--- delete RPC exposure ---'
rg -n -C 5 'memory_delete_document|doc_delete|DeleteDocumentRequest' \
src --glob '*.rs' | head -n 300Repository: tinyhumansai/openhuman Length of output: 50378 🏁 Script executed: #!/bin/bash
set -euo pipefail
sed -n '70,180p' src/openhuman/memory/guard/policy.rsRepository: tinyhumansai/openhuman Length of output: 4263 Authorization Bypass (CWE-862): Missing Authorization Require server-side authorization for every memory mutation.
🤖 Prompt for AI Agents |
||
|
|
||
| ## 9. Verification plan | ||
|
|
||
| The implementation should add focused tests at the smallest affected layers. Runtime tests should verify that project scope is applied to the query and that correction or retirement failures do not produce a false success. UI tests should verify provenance labels, state transitions, context filtering, and the error state after a rejected mutation. A manual smoke path should create a provisional record, confirm it, correct it, switch project context, and verify that unrelated records do not appear by default. | ||
|
Comment on lines
+101
to
+103
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
doc='docs/specs/2026-08-19-persona-memory-provenance-contract.md'
printf '%s\n' '--- document outline ---'
ast-grep outline "$doc" 2>/dev/null || true
printf '%s\n' '--- sections 1-9 ---'
sed -n '1,125p' "$doc"
printf '%s\n' '--- related symbols and tests ---'
rg -n -i 'persona|provenance|restricted|evidence|approval|analytics|scrub|redact|retir|correct' src docs tests 2>/dev/null | head -250Repository: tinyhumansai/openhuman Length of output: 34961 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- changed files ---'
git status --short
git diff --stat
printf '%s\n' '--- recent commit summary ---'
git log -1 --oneline
printf '%s\n' '--- document history metadata ---'
git diff -- docs/specs/2026-08-19-persona-memory-provenance-contract.md | sed -n '1,220p'Repository: tinyhumansai/openhuman Length of output: 305 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- commit files ---'
git show --stat --oneline --decorate --no-renames HEAD
git show --format= --name-status --no-renames HEAD
printf '%s\n' '--- commit subject and body ---'
git show -s --format=fuller HEADRepository: tinyhumansai/openhuman Length of output: 757 Other (CWE-693) Extend Section 9 with negative security tests. Require runtime-boundary tests for restricted-payload redaction, evidence-reference authorization, log and analytics scrubbing, and user-versus-agent approval. Assert that sensitive values do not cross the RPC or logging boundary. 🤖 Prompt for AI Agents |
||
|
|
||
| This contract should be revised when the runtime RPC schemas are finalized. Until then, adapters should prefer explicit `Other` or `Unknown` values over lossy inference. | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
Repository: tinyhumansai/openhuman
Length of output: 50381
🏁 Script executed:
Repository: tinyhumansai/openhuman
Length of output: 50381
🏁 Script executed:
Repository: tinyhumansai/openhuman
Length of output: 50379
🏁 Script executed:
Repository: tinyhumansai/openhuman
Length of output: 50381
🏁 Script executed:
Repository: tinyhumansai/openhuman
Length of output: 50379
🏁 Script executed:
Repository: tinyhumansai/openhuman
Length of output: 50378
🏁 Script executed:
Repository: tinyhumansai/openhuman
Length of output: 869
Define immutable record identity and optimistic concurrency. The runtime exposes
MemoryEntry.id, but the contract does not define its stability. Current memory mutations usenamespaceandkeywithout a revision oretag. Define correction and retirement RPCs with an immutable record ID and revision token, and reject stale revisions before writing.🤖 Prompt for AI Agents