From 669316c254a295720376d2f64f5a26bb2fc81b13 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Fri, 17 Jul 2026 14:04:31 -0700 Subject: [PATCH] memory: cross-agent Tier-3 memory bleed = Worldtree defect (reported) Lofn recalls Sindra's memories because WT writes Tier-3 memory scoped end_user-only (no agent_self); ratatoskr stores/filters faithfully and needs no change. Reported to worldtree-dev (thread 01KXRY8V1C...); fork-relevant (memory isolation inherits this WT axis). --- persistent-memory.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/persistent-memory.md b/persistent-memory.md index 61bcecb..ee8e659 100644 --- a/persistent-memory.md +++ b/persistent-memory.md @@ -76,6 +76,21 @@ auth via infra-ops `ENGINE_TOKEN`. Deploy: `irv-ml1:8201`, WireGuard-only. Canon `vh/arbo:docs/rest-api.md` v1.4.27 + auto-served `/openapi.json`. comfy-dev offered a concrete t2i walkthrough + will coordinate the token when we smoke. +**⚠️ Cross-agent Tier-3 memory BLEED — WORLDTREE defect (found via debug surface 2026-07-17; reported to +worldtree-dev, reply pending).** Loaded Lofn (Tier-1) in the memory explorer under end_user `ratatoskr-tui` +→ saw **Sindra's** chunks, and a live Lofn turn **recalled Vuong's name** (a Sindra fact). ROOT: WT writes +Tier-3 memory scoped `{"end_user": "ratatoskr-tui"}`, `worldtree_scope: "end_user"`, **NO `agent_self`** — +`agent_id: "ratatoskr:sindra"` rides as record metadata only, not isolation scope. So every agent under one +end_user shares the pool. **NOT a ratatoskr defect:** our v0.6 lattice {end_user,group,tenant,agent_self} + +`_matches_scope` support agent_self; `upsert_many` stores scope verbatim (no strip/inject); read-path proof — +Lofn getting Sindra's chunks means WT's retrieval `scope_all` ALSO omits agent_self (else `_scope_subset` +excludes agent_self-less records → Lofn would get nothing). FIX is WT's: stamp `agent_self` on Tier-3 writes ++ include it in turn-retrieval scope_all; ratatoskr enforces the moment it arrives, zero change. Likely the +known per-(user,character) isolation gap (#172). Thread `01KXRY8V1C30R3HGFCTKHPA4PR`. **FORK RELEVANCE:** the +fork's memory isolation inherits this same WT axis — don't design around it, it's Worldtree's to close. +Explorer nuance: its agent filter is LENIENT (excludes a chunk only if it CARRIES a conflicting agent_self), +so agent_self-less chunks show under any agent — a faithful display of user-shared data, not a separate bug. + **✅ Cross-session name-recall arc COMPLETE + SHIPPED (v0.20.11→v0.20.15, pushed).** person-prime `scan` verb + `mark_superseded` verb both shipped, deployed to :8392, and live-verified; **WT #364 closed end-to-end both sides; Sindra durably recalls Vuong's name** (the "name unknown" negatives are RETIRED