Harden standalone memory erasure

.env.example

@@ -28,6 +28,7 @@ PORT=8080
 #SLACK_BOT_ICON_EMOJI=:robot_face:
 
 CORE_SIGNING_SECRET=
+MEMORY_TOMBSTONE_SECRET=
 CAPABILITY_SECRET=
 PORTAL_IDENTITY_SECRET=
 CONNECTOR_SECRET_KEY=

cli/src/secrets.ts

@@ -82,6 +82,13 @@ export const FIRST_PARTY_SECRET_SPECS: readonly SecretSpec[] = [
     description: "HMAC key shared by core and surface plugins.",
     generate: MINT_LOCALLY,
   },
+  {
+    name: "MEMORY_TOMBSTONE_SECRET",
+    service: "core",
+    required: true,
+    description: "Stable HMAC key for non-identifying memory erasure tombstones; rotate only with a migration.",
+    generate: MINT_LOCALLY,
+  },
   {
     name: "CAPABILITY_SECRET",
     service: "core",

cli/test/aws.test.ts

@@ -1617,6 +1617,7 @@ test("AWS task definitions are digest-pinned and route only computed secrets", (
     "CORE_SIGNING_SECRET",
     "DATABASE_URL",
     "FLY_RESIDENT_ENV_ACME_API_KEY",
+    "MEMORY_TOMBSTONE_SECRET",
     "PORTAL_IDENTITY_SECRET",
     "PUBLIC_API_URL",
     "SKILL_SIGNING_SECRET",

cli/test/docker-secrets.test.ts

@@ -11,6 +11,7 @@ const SECRETS = {
   CAPABILITY_SECRET: "capability-supersecret",
   CONNECTOR_SECRET_KEY: "connector-supersecret".repeat(2),
   CORE_SIGNING_SECRET: "core-signing-supersecret".repeat(2),
+  MEMORY_TOMBSTONE_SECRET: "memory-tombstone-supersecret".repeat(2),
   PORTAL_IDENTITY_SECRET: "portal-identity-supersecret",
   SKILL_SIGNING_SECRET: "skill-signing-supersecret".repeat(2),
   FLY_SANDBOX_API_TOKEN: "fly-api-supersecret",
@@ -259,7 +260,7 @@ test(
       );
       writeFileSync(
         join(dir, ".env"),
-        `CAPABILITY_SECRET=capability-sign\nCONNECTOR_SECRET_KEY=${"connector-key".repeat(3)}\nCORE_SIGNING_SECRET=${"core-sign".repeat(4)}\nPORTAL_IDENTITY_SECRET=portal-sign\nSKILL_SIGNING_SECRET=${"skill-sign".repeat(4)}\n`,
+        `CAPABILITY_SECRET=capability-sign\nCONNECTOR_SECRET_KEY=${"connector-key".repeat(3)}\nCORE_SIGNING_SECRET=${"core-sign".repeat(4)}\nMEMORY_TOMBSTONE_SECRET=${"memory-tombstone".repeat(3)}\nPORTAL_IDENTITY_SECRET=portal-sign\nSKILL_SIGNING_SECRET=${"skill-sign".repeat(4)}\n`,
       );
       const fake = fakeDocker(dir);
       process.env.PATH = `${dir}:${priorPath}`;
@@ -372,7 +373,7 @@ test(
       );
       writeFileSync(
         join(dir, ".env"),
-        `CAPABILITY_SECRET=capability\nCONNECTOR_SECRET_KEY=${"connector".repeat(4)}\nPORTAL_IDENTITY_SECRET=identity\nSKILL_SIGNING_SECRET=${"ok".repeat(16)}\n`,
+        `CAPABILITY_SECRET=capability\nCONNECTOR_SECRET_KEY=${"connector".repeat(4)}\nMEMORY_TOMBSTONE_SECRET=${"memory-tombstone".repeat(3)}\nPORTAL_IDENTITY_SECRET=identity\nSKILL_SIGNING_SECRET=${"ok".repeat(16)}\n`,
       );
       fakeDocker(dir);
       process.env.PATH = `${dir}:${priorPath}`;

cli/test/doctor.test.ts

@@ -31,7 +31,7 @@ test("Docker doctor rejects missing and placeholder required secrets before exte
   try {
     await assert.rejects(
       doctorCommon(config, new Map([["CORE_SIGNING_SECRET", "replace-me"]]), { requiredSecretValues: true }),
-      /CAPABILITY_SECRET, CONNECTOR_SECRET_KEY, CORE_SIGNING_SECRET, PORTAL_IDENTITY_SECRET, PUBLIC_API_URL, SKILL_SIGNING_SECRET/,
+      /CAPABILITY_SECRET, CONNECTOR_SECRET_KEY, CORE_SIGNING_SECRET, MEMORY_TOMBSTONE_SECRET, PORTAL_IDENTITY_SECRET, PUBLIC_API_URL, SKILL_SIGNING_SECRET/,
     );
   } finally {
     if (prior === undefined) delete process.env.ANTHROPIC_API_KEY;
@@ -51,6 +51,7 @@ test("doctor allows deferred Slack setup but rejects a partial token pair", asyn
     ["CAPABILITY_SECRET", "a".repeat(64)],
     ["CONNECTOR_SECRET_KEY", "b".repeat(64)],
     ["CORE_SIGNING_SECRET", "c".repeat(64)],
+    ["MEMORY_TOMBSTONE_SECRET", "m".repeat(64)],
     ["PORTAL_IDENTITY_SECRET", "d".repeat(64)],
     ["SKILL_SIGNING_SECRET", "e".repeat(64)],
   ]);
@@ -474,6 +475,7 @@ test("doctor treats a missing sandbox block as info (no Fly checks), not a failu
         ["CAPABILITY_SECRET", "capability-value"],
         ["CONNECTOR_SECRET_KEY", "connector-value".repeat(3)],
         ["CORE_SIGNING_SECRET", "source-value".repeat(4)],
+        ["MEMORY_TOMBSTONE_SECRET", "memory-value".repeat(4)],
         ["PORTAL_IDENTITY_SECRET", "identity-value"],
         ["SKILL_SIGNING_SECRET", "skill-value".repeat(4)],
       ]),

cli/test/fly-up.test.ts

@@ -84,6 +84,7 @@ else if (a[0] === "secrets" && a[1] === "list") {
       "CORE_SIGNING_SECRET",
       "FLY_DEPLOY_API_TOKEN",
       "FLY_API_TOKEN",
+      "MEMORY_TOMBSTONE_SECRET",
       "PORTAL_IDENTITY_SECRET",
       "SECURITY_SCREEN_PROXY_TOKEN",
       "SKILL_SIGNING_SECRET",

deploy/stacks/acme/.env.example

@@ -16,6 +16,7 @@ CONNECTOR_SECRET_KEY=
 # HMAC key shared by core and surface plugins. (admin, core, portal, slack, web-ui)
 # Generate with: openssl rand -hex 32
 CORE_SIGNING_SECRET=
+MEMORY_TOMBSTONE_SECRET=
 
 # Deployment-specific OIDC client identifier when it should not be committed. (portal)
 OIDC_CLIENT_ID=

package.json

@@ -17,6 +17,7 @@
     "dev-instance:status": "bash scripts/dev-instance.sh status",
     "dev-instance:down": "bash scripts/dev-instance.sh down",
     "worker": "node --env-file-if-exists=.env src/runs/worker-main.ts",
+    "memory-service": "node --env-file-if-exists=.env src/memory/server-main.ts",
     "test": "node --experimental-test-module-mocks --test test/*.test.ts",
     "test:root:shard": "node scripts/run-root-test-shard.mjs",
     "test:root:shard:check": "node scripts/run-root-test-shard.mjs --check --shards 5",

src/config.ts

@@ -23,6 +23,77 @@ import {
   type ModelProvider,
   type ModelProviderAvailability,
 } from "./model/pi-models.ts";
+import { parseScopeId, type ScopeKind } from "./types.ts";
+
+export interface MemoryServiceConfig {
+  databaseUrl: string;
+  signingSecret: string;
+  tombstoneSecret: string;
+  integrationId: string;
+  allowedScopeKinds: ReadonlySet<ScopeKind>;
+  allowedScopePrefixes: readonly string[];
+  port: number;
+}
+
+export function loadMemoryServiceConfig(env: NodeJS.ProcessEnv = process.env): MemoryServiceConfig {
+  const required = (name: string): string => {
+    const value = env[name]?.trim();
+    if (!value) throw new Error(`${name} is required`);
+    return value;
+  };
+  const list = (name: string): string[] =>
+    required(name)
+      .split(",")
+      .map((value) => value.trim())
+      .filter(Boolean);
+  const databaseUrl = required("MEMORY_SERVICE_DATABASE_URL");
+  const signingSecret = required("MEMORY_SERVICE_SIGNING_SECRET");
+  if (signingSecret.length < 32) throw new Error("MEMORY_SERVICE_SIGNING_SECRET must be at least 32 characters");
+  if ([env.CORE_SIGNING_SECRET, env.CAPABILITY_SECRET, env.PORTAL_IDENTITY_SECRET].includes(signingSecret)) {
+    throw new Error("MEMORY_SERVICE_SIGNING_SECRET must be distinct from core, capability, and portal secrets");
+  }
+  const tombstoneSecret = required("MEMORY_SERVICE_TOMBSTONE_SECRET");
+  if (tombstoneSecret.length < 32) {
+    throw new Error("MEMORY_SERVICE_TOMBSTONE_SECRET must be at least 32 characters");
+  }
+  if (
+    [databaseUrl, signingSecret, env.CORE_SIGNING_SECRET, env.CAPABILITY_SECRET, env.PORTAL_IDENTITY_SECRET].includes(
+      tombstoneSecret,
+    )
+  ) {
+    throw new Error(
+      "MEMORY_SERVICE_TOMBSTONE_SECRET must be distinct from the database credential and request/core secrets",
+    );
+  }
+  const integrationId = required("MEMORY_SERVICE_INTEGRATION_ID");
+  const supportedKinds = new Set<ScopeKind>(["personal", "channel", "team", "org", "group"]);
+  const configuredKinds = list("MEMORY_SERVICE_ALLOWED_SCOPE_KINDS");
+  if (configuredKinds.some((kind) => !supportedKinds.has(kind as ScopeKind))) {
+    throw new Error("MEMORY_SERVICE_ALLOWED_SCOPE_KINDS contains an unsupported scope kind");
+  }
+  const allowedScopePrefixes = list("MEMORY_SERVICE_ALLOWED_SCOPE_PREFIXES");
+  if (
+    allowedScopePrefixes.some((prefix) => {
+      const parsed = parseScopeId(prefix);
+      return !prefix.endsWith(":") || !parsed.kind || !configuredKinds.includes(parsed.kind) || !parsed.ref;
+    })
+  ) {
+    throw new Error("MEMORY_SERVICE_ALLOWED_SCOPE_PREFIXES must match an allowed scope kind and non-empty prefix");
+  }
+  const port = numEnvStrict("PORT", env.PORT) ?? CONFIG_DEFAULTS.port;
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
+    throw new Error("PORT must be an integer from 1 to 65535");
+  }
+  return {
+    databaseUrl,
+    signingSecret,
+    tombstoneSecret,
+    integrationId,
+    allowedScopeKinds: new Set(configuredKinds as ScopeKind[]),
+    allowedScopePrefixes,
+    port,
+  };
+}
 
 export interface Config {
   production: boolean;
@@ -89,6 +160,7 @@ export interface Config {
   skillSyncPollMs: number;
   monitorHeartbeatMs: number;
   signingSecret?: string;
+  memoryTombstoneSecret?: string;
   capabilitySecret?: string;
   portalIdentitySecret?: string;
   requireSignedPortalIdentity?: boolean;
@@ -654,6 +726,20 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): Config {
       "CODEX_AUTH_FILE is supported for local Codex harnesses only; production must use CODEX_AUTH_CREDENTIAL (keychain custody)",
     );
   }
+  const memoryTombstoneSecret = env.MEMORY_TOMBSTONE_SECRET?.trim();
+  if (
+    memoryTombstoneSecret &&
+    [
+      env.CORE_SIGNING_SECRET,
+      env.CAPABILITY_SECRET,
+      env.PORTAL_IDENTITY_SECRET,
+      env.CONNECTOR_SECRET_KEY,
+      env.SKILL_SIGNING_SECRET,
+      env.DATABASE_URL,
+    ].some((value) => value?.trim() === memoryTombstoneSecret)
+  ) {
+    throw new Error("MEMORY_TOMBSTONE_SECRET must differ from the database credential and every other core secret");
+  }
   const modelProvider = modelProviderEnvStrict(env);
   for (const key of ["SESSION_STORE", "RUN_STORE", "ARTIFACT_STORE"] as const) {
     if (env[key] === "sqlite") {
@@ -899,6 +985,7 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): Config {
     monitorHeartbeatMs:
       (numEnvStrict("MONITOR_HEARTBEAT_SEC", env.MONITOR_HEARTBEAT_SEC) ?? CONFIG_DEFAULTS.monitorHeartbeatSec) * 1000,
     ...(env.CORE_SIGNING_SECRET ? { signingSecret: env.CORE_SIGNING_SECRET } : {}),
+    ...(memoryTombstoneSecret ? { memoryTombstoneSecret } : {}),
     ...((env.CAPABILITY_SECRET ?? env.CORE_SIGNING_SECRET)
       ? { capabilitySecret: env.CAPABILITY_SECRET ?? env.CORE_SIGNING_SECRET }
       : {}),

src/deployment/secret-schema.ts

@@ -26,6 +26,7 @@ export const CORE_SECRET_SPECS: readonly RuntimeSecretSpec[] = [
   { name: "CAPABILITY_SECRET", requiredWhen: "production" },
   { name: "CONNECTOR_SECRET_KEY", requiredWhen: "production" },
   { name: "CORE_SIGNING_SECRET", requiredWhen: "production" },
+  { name: "MEMORY_TOMBSTONE_SECRET", requiredWhen: "postgres" },
   { name: "PORTAL_IDENTITY_SECRET", requiredWhen: "production" },
   { name: "SKILL_SIGNING_SECRET", requiredWhen: "production" },
   { name: "AUTH_ALLOWED_EMAILS", requiredWhen: "email-auth" },
@@ -46,7 +47,7 @@ export const CORE_SECRET_SPECS: readonly RuntimeSecretSpec[] = [
 const GATE_PREDICATES: Readonly<Record<SecretGate, (env: NodeJS.ProcessEnv) => boolean>> = {
   production: (env) => env.NODE_ENV === "production",
   codex: (env) => env.HARNESS?.trim() === "codex" && !env.CODEX_AUTH_FILE?.trim() && !env.CODEX_AUTH_CREDENTIAL?.trim(),
-  postgres: (env) => env.SESSION_STORE === "postgres" || env.RUN_STORE === "postgres",
+  postgres: (env) => Boolean(env.DATABASE_URL) || env.SESSION_STORE === "postgres" || env.RUN_STORE === "postgres",
   sprites: (env) => env.SANDBOX_BACKEND === "sprites" || env.SANDBOX_SECONDARY_BACKEND === "sprites",
   smolmachines: (env) => env.SANDBOX_BACKEND === "smolmachines" || env.SANDBOX_SECONDARY_BACKEND === "smolmachines",
   "fly-sandbox": (env) => env.SANDBOX_BACKEND === "fly",
@@ -77,7 +78,10 @@ function isInvalidSecret(name: string, value: string | undefined): boolean {
   const candidate = value?.trim();
   if (!candidate || /^(replace-me|placeholder|changeme|todo)$/i.test(candidate)) return true;
   return (
-    (name === "CONNECTOR_SECRET_KEY" || name === "CORE_SIGNING_SECRET" || name === "SKILL_SIGNING_SECRET") &&
+    (name === "CONNECTOR_SECRET_KEY" ||
+      name === "CORE_SIGNING_SECRET" ||
+      name === "MEMORY_TOMBSTONE_SECRET" ||
+      name === "SKILL_SIGNING_SECRET") &&
     !isStrongSigningSecret(candidate)
   );
 }