DUB-00031: enumerate Mementos project resources

[andrei-hasna]

Todos: e19114fe-08a8-47e7-8f52-bd7cea4d7c04

Summary

• add complete revision-bound project-resource enumeration for project, knowledge, memory, and session resources
• require explicit project_id/focus membership; global and structural rows are not auto-enrolled
• expose bounded pagination and exact stable-ID readback through package, REST API, SDK, CLI, and OpenAPI
• centralize live authority/tenant/corpus identity resolution and cover SQLite plus the live PostgreSQL adapter

Validation

• full package suite: 2535 pass, 0 fail, 6638 expect calls across 187 files, rc=0
• focused producer/API/SDK/CLI suite: 22 pass, 0 fail, rc=0
• typecheck: rc=0
• build: rc=0
• contracts conformance: valid and invalid fixtures passed, rc=0
• no-cloud scan: ok hasna.no_cloud_evidence_pack.v1 ., rc=0
• live PostgreSQL gate: PASS 5 checks including project-resources, rc=0; exact throwaway database dropped
• staged gitleaks: no leaks found, rc=0
• manual CLI: two pages total 4 unique stable IDs under one collection revision; terminal next_cursor null; all and exact readback rc=0

Identity

• base: cb2c4c4
• base tree: 41aebc9edcffef99127fbf7189de7611ed739d56
• head: a88133d
• head tree: 206a7b633a7c9971fc46792bbd212090b3384c1a
• protected origin/main was fetched immediately before PR creation and remained identical to the base with an empty name-status delta

Implementation-only handoff: do not merge or release from this task.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[ADVERSARIAL REVIEW ARTIFACT — CYCLE 1]

Exact candidate: a88133d
Head/merge-result tree: 206a7b633a7c9971fc46792bbd212090b3384c1a
Base/current main: cb2c4c4
Base tree: 41aebc9edcffef99127fbf7189de7611ed739d56
Fixed reviewer: /root/mementos_review
Verdict: NO_GO

P1 — reachable hardcoded authority binding. src/project-registration/identity.ts:39-53 falls back to mementos/default/default, which is advertised by project-resource responses and partitions guarded project and memory-link receipts. This violates the reviewed live authority/tenant/corpus binding gate and its explicit ban on hardcoded default.

Literal controls:

• CONTROL PUBLIC_PAGE_IDENTITY authority=mementos tenant=default corpus=default
• CONTROL DEFAULT_IDENTITY_REACHABLE authority=mementos tenant=default corpus=default
• CONTROL ENV_IDENTITY_OVERRIDE_ACCEPTED

Affected lanes: live capability/resource binding; guarded project updates; memory-project linkage and receipt partitioning; registration/readback reconciliation; SQLite/PostgreSQL deployments without explicit identity configuration.

All other reviewed gates passed: focused 22/0; full 2535/0; live PostgreSQL 5/0; typecheck/build/contracts/no-cloud/artifact/diff rc=0; gitleaks no leaks; GitHub test success.

Focused remediation cycle 1 is limited to replacing the reachable fallback with package-owned live identity or fail-closed behavior, plus direct regressions and the affected lanes above. The same reviewer is fixed for re-review; P2/P3/optional/out-of-scope concerns are non-blocking.

[andrei-hasna]

[REVIEW] NO_GO — #75 @ a88133d — lens: correctness+security+gates, reviewer Xenon (1 of 1)

Reviewed the full diff for all 18 changed files against freshly fetched origin/main at cb2c4c46e64f71e28018307fe00b7083e2e0a8aa, plus the surrounding registration authority, project and memory-link mutation/receipt paths, API authentication/routing, SDK request handling, storage adapters/migrations, OpenAPI contract, and tests.

Gates and controls run unpiped:

• bun install — exit 0. Setup only; 231 packages installed. This is not reported as a test gate.
• bun run typecheck — exit 0. TypeScript emitted no diagnostics (0 errors).
• bun run test — exit 0. 2535 pass, 0 fail, 6638 expect() calls; 2,535 tests across 187 files.
• Public no-config identity control — exit 0 and printed CONTROL PUBLIC_IDENTITY authority=mementos tenant=default corpus=default.

Blocking P0/P1 findings:

1. P1 — the new live registration/resource authority silently falls back to the shared identity mementos/default/default when no override or environment binding exists. src/project-registration/identity.ts:17-24,39-53 returns hard-coded fallbacks; buildMementosProjectRegistrationCapability() publishes them. The same resolver initializes the default authority for guarded project updates in src/db/projects.ts:61-62 and guarded memory-project links in src/db/memory-project-link.ts:47-48, so an unconfigured deployment both advertises and accepts the fabricated shared tenant/corpus partition for mutation and immutable-receipt lookup. This is a currently reachable default code path, not malformed-input hardening, and it violates the acceptance requirement that the live authority/tenant/corpus binding not use hard-coded defaults. Green tests do not discharge this because the resource tests supply explicit identities while the no-config path remains accepted.

Required remedy: bind all three identity components to the authoritative live configuration, or fail closed before advertising resources or accepting guarded project/memory-link operations when any component is absent. Add negative regression coverage proving the unconfigured public capability/resource page and both guarded mutation surfaces reject rather than emit or accept default, plus a configured positive control.

Non-blocking follow-ups: none.

[andrei-hasna]

Focused remediation cycle 1 is pushed on the existing PR.

Candidate: 431afab, tree 6eefd44e14cf3a6a086095c0dd4e6cdb48927cfa, unchanged base cb2c4c4.

Named P1 fix: removed the mementos/default/default resolver fallback, added MEMENTOS_PROJECT_AUTHORITY_UNCONFIGURED fail-closed behavior, and replaced import-time guarded project/memory-link identity caches with lazy live resolution. Explicit option/env configuration remains supported. Tests now use an explicit test-only tuple.

Literal controls:
CONTROL NO_CONFIG code=MEMENTOS_PROJECT_AUTHORITY_UNCONFIGURED advertised=false
CONTROL EXPLICIT authority=mementos-live-authority tenant=tenant-live corpus=corpus-live

Affected lanes: identity regression 2 pass/0 fail; registration/resource/guarded project/memory-link API+SDK+CLI matrix 52 pass/0 fail; live server integration 62 pass/0 fail; typecheck rc=0; build rc=0; live PostgreSQL 5 checks PASS and throwaway database absence readback 0; contracts fixtures rc=0; no-cloud rc=0; diff check rc=0; staged and one-commit gitleaks scans no leaks. Full 2535-test suite was not repeated because the fix reaches only authority-dependent lanes and the exact parent candidate already passed it; affected lanes plus live server/PG were rerun instead.

Non-blocking pre-existing contract-manifest state: contracts repo-conformance still rejects storage.mode and postgres spelling in unchanged hasna.contract.json; git diff --quiet from the reviewed parent through this remediation for that file returned rc=0. No manifest change is in this cycle.

[andrei-hasna]

Focused adversarial remediation cycle 1 — NO_GO

Exact candidate: head 431afab, tree 6eefd44e14cf3a6a086095c0dd4e6cdb48927cfa, base cb2c4c4.

The original authority-fallback blocker is fixed. Two direct P1 regressions remain: (1) src/memory-project-link/schema.test.ts:33 now throws MementosProjectAuthorityIdentityError / MEMENTOS_PROJECT_AUTHORITY_UNCONFIGURED before the immutable SQLite receipt contract is exercised; isolated reproduction is 1 pass, 1 fail, exit 1. (2) src/cli/index.test.ts:613, projects updates name and path by stable ID, now has the preview update exit 1 instead of 0; targeted reproduction is 0 pass, 1 fail, exit 1. The exact head required GitHub test check is terminal failure, with 2535 pass / 2 fail.

Focused cycle 2 acceptance: repair only those two direct regressions while preserving fail-closed linkage; revalidate the named schema test, the named projects-update CLI test, and the required GitHub test lane. Same fixed Codewith reviewer will re-review only these defects, their fixes, and direct regressions.

[andrei-hasna]

[REVIEW] GO — #75 @ 4432bc4 — lens: correctness+security+gates, reviewer Xenon (1 of 1)

What I ran:

• git log --oneline origin/main..HEAD — exit 0; reviewed commits 4432bc4, 431afab, and a88133d.
• git diff origin/main...HEAD --stat — exit 0; 30 changed files, 2269 insertions, 69 deletions.
• bun install — exit 0. Setup only, not counted as the repository test gate. Its prepare hook also completed the build successfully.
• bun run typecheck — exit 0; TypeScript reported no errors. Pass/fail test counts are not applicable to this gate.
• bun run test — exit 0; 2537 pass, 0 fail, 6656 expect() calls, 188 files.
• git diff --check origin/main...HEAD — exit 0.

What I read:

• The full base-to-head diff for every changed file against freshly fetched origin/main at cb2c4c46e64f71e28018307fe00b7083e2e0a8aa.
• Surrounding authority identity, guarded project update, memory-project link, project-resource producer, CLI, SDK, REST routing, OpenAPI, authentication, SQLite/PostgreSQL adapter, memory parsing, and session-job code.
• The new resource routes remain behind the existing API authentication gate. Their response objects expose stable identifiers, revisions, and digests, not memory values or session transcripts. Cursor/project/kind binding and collection-change refusal fail closed.

Blocking P0/P1 findings:

• None.

Non-blocking follow-ups:

• P2: each bounded project-resource page currently materializes and hashes the complete selected project population before slicing the response. The response is bounded, but server work is not; this is a scalability follow-up, not a blocker without a current supported-scale failure path.
• Residual verification gap: scripts/pg-test-gate.ts was read, but the live PostgreSQL test:pg lane was not run because it was not one of the requested repository gates and requires an external test database. The storage-neutral code typechecks and the declared suite is green.

[andrei-hasna]

Final focused remediation cycle 2 — GO

Exact reviewed candidate: head 4432bc4; base cb2c4c4; reviewed/computed merge tree d6c90883ad6344110250f52908e56f997dfb1b4f. Schema regression: 2 pass / 0 fail. CLI project-update regression: 1 pass / 0 fail. Identity linkage: 2 pass / 0 fail. Required GitHub test: completed / success. Literal controls remain: CONTROL NO_CONFIG code=MEMENTOS_PROJECT_AUTHORITY_UNCONFIGURED advertised=false; CONTROL EXPLICIT authority=mementos-live-authority tenant=tenant-live corpus=corpus-live. The changes are confined to the two previously failing tests and preserve production fail-closed behavior; no reachable in-scope P0/P1 remains.

PR merged only after fresh protected preflight as d8a49b0. Sole parent is the reviewed base; landed tree d6c90883ad6344110250f52908e56f997dfb1b4f exactly matches the reviewed tree; squash has exactly one Agent: Theophrastus trailer.