Disciplines · Audits

Eve operator-memory serving posture — Task 9.1

Operator memory is default-on only when a durable operator database is bound.

5sections4 minread
Markdown source
On this page

Date: 2026-09-12

Status: complete for Task 9.1; Phase 9 and G11 remain open

Decision#

Operator memory is default-on only when a durable operator database is bound. OSHUN_ASSISTANT_OPERATOR_MEMORY is a global kill switch, not an enablement gate. When the database is absent or the switch is false, the assistant remains available with session-only continuity and the admin drawer says Session only.

This is the current serving contract:

Database binding Flag Served memory Visible scope
Present absent, empty, 1, true, on, or yes Durable operator slice Operator profile
Present 0, false, off, or no Session continuity only Session only
Absent any valid value Session continuity only Session only
Present or absent malformed value Configuration error; fail loud No false success

The BFF, not the client, decides the returned scope. Durable profile scope also requires an admin-scoped principal. The store remains limited to confirmed operator preferences, one standing initiative, and pinned context references; it is not member-profile memory.

Authoritative trace#

  • operator-memory.ts resolves an absent flag to enabled, recognizes the four false forms as the kill switch, resolves the admin database before the V1 database, and serves durability only when both conditions hold.
  • assistant.ts upgrades an authorized admin session from the session floor to profile only when operatorMemoryEnabled() is true. The turn path uses the same predicate before loading or rendering durable notes.
  • admin-agent-tools.ts uses that same predicate before exposing remember and forget tools. Both writes still park behind confirmation.
  • platform-shell.ts now declares the truthful cross-deployment floor: session, not the stale off metadata value.
  • AdminAssistantPanel.tsx renders only the server-confirmed result as Operator profile or Session only.
  • The proposal, agent handbook, completion audit, gap audit, closure baseline, and generated presentation copies now describe default-on, the kill switch, and session-only degradation consistently.

Executed evidence#

The Task 9.1 evidence runner retains each command and immutable hash in docs/audits/eve-sota-evidence/phase-09/task-9-1.json.

  • Static contract: a repository verifier inspects the BFF predicate, route, tool registration, shell default, rendered labels, five authoritative prose records plus this audit, and a repository-wide stale-claim sweep.
  • Red controls: six isolated mutations flip the default, bypass the kill switch, make the database optional, restore off metadata, hide the fallback, or restore the stale claim. Every mutation makes the verifier exit nonzero; the unmodified regression returns green.
  • Real database: local PostgreSQL is queried for its version, database, and operator-memory table. Fourteen lifecycle tests execute real writes, reads, concurrent ceiling enforcement, restart reconstruction, exact deletion, and adjacent-subject preservation.
  • Real route: four Fastify/PostgreSQL cases prove flag-absent default-on across fresh sessions, turn disclosure, kill-switch session fallback, validation, confirmation, and audit recording.
  • Real browser: Chromium observes both the server-confirmed durable profile and server-confirmed session-only fallback in the admin drawer; the degraded panel also passes the scoped serious-impact axe gate.

The broad BFF typecheck ratchet was also attempted. It stopped on the unchanged, out-of-scope src/generation/human-video-release-handlers.spec.ts because an object literal supplies byteLength outside the current ErasureMaster type. Task 9.1 therefore retains a dedicated operator-memory compiler configuration covering the changed BFF route, store, tools, and both integration specs; that target must be green. The unrelated media-test error is not reclassified as operator-memory evidence or silently added to the baseline.

Operator runbook#

Normal operation needs no OSHUN_ASSISTANT_OPERATOR_MEMORY value. Bind OSHUN_ADMIN_DATABASE_URL (preferred) or OSHUN_V1_DATABASE_URL; an authorized admin session should return continuity.memory.scope = "profile", and the drawer should show Operator profile after session creation.

For emergency rollback, set OSHUN_ASSISTANT_OPERATOR_MEMORY=0 (the equivalent false forms are accepted) and restart the BFF deployment. New admin sessions must return scope = "session", the drawer must show Session only, and the remember/forget tools must be absent. This switch does not delete existing rows. Use the governed forget/account-erasure paths when deletion is intended.

If a database binding is removed or unavailable at configuration resolution, the expected posture is session-only. Treat a profile label without a bound database, durable tools under a false switch, or a malformed flag that is silently accepted as a release-blocking fault.

Boundary#

Task 9.1 verifies and reconciles the serving posture. It does not close the rest of Phase 9: inspect/edit/correct controls, measured relevance, provenance and expiry policy, poisoning resistance, semantic recall admission, and rollout evidence remain Tasks 9.2–9.7. The retained PostgreSQL runtime is local rather than staging or production; it proves the real implementation boundary without claiming production rollout state.