# Eve operator-memory serving posture — Task 9.1

Date: 2026-09-12

Status: complete for Task 9.1; Phase 9 and G11 remain open

## Decision

Operator memory is default-on only when a durable operator database is bound.
`OSHUN_ASSISTANT_OPERATOR_MEMORY` is a global kill switch, not an enablement
gate. When the database is absent or the switch is false, the assistant remains
available with session-only continuity and the admin drawer says `Session only`.

This is the current serving contract:

| Database binding  | Flag                                       | Served memory                  | Visible scope      |
| ----------------- | ------------------------------------------ | ------------------------------ | ------------------ |
| Present           | absent, empty, `1`, `true`, `on`, or `yes` | Durable operator slice         | `Operator profile` |
| Present           | `0`, `false`, `off`, or `no`               | Session continuity only        | `Session only`     |
| Absent            | any valid value                            | Session continuity only        | `Session only`     |
| Present or absent | malformed value                            | Configuration error; fail loud | No false success   |

The BFF, not the client, decides the returned scope. Durable profile scope also
requires an admin-scoped principal. The store remains limited to confirmed
operator preferences, one standing initiative, and pinned context references; it
is not member-profile memory.

## Authoritative trace

- `operator-memory.ts` resolves an absent flag to enabled, recognizes the four
  false forms as the kill switch, resolves the admin database before the V1
  database, and serves durability only when both conditions hold.
- `assistant.ts` upgrades an authorized admin session from the session floor to
  profile only when `operatorMemoryEnabled()` is true. The turn path uses the
  same predicate before loading or rendering durable notes.
- `admin-agent-tools.ts` uses that same predicate before exposing remember and
  forget tools. Both writes still park behind confirmation.
- `platform-shell.ts` now declares the truthful cross-deployment floor:
  `session`, not the stale `off` metadata value.
- `AdminAssistantPanel.tsx` renders only the server-confirmed result as
  `Operator profile` or `Session only`.
- The proposal, agent handbook, completion audit, gap audit, closure baseline,
  and generated presentation copies now describe default-on, the kill switch,
  and session-only degradation consistently.

## Executed evidence

The Task 9.1 evidence runner retains each command and immutable hash in
`docs/audits/eve-sota-evidence/phase-09/task-9-1.json`.

- Static contract: a repository verifier inspects the BFF predicate, route, tool
  registration, shell default, rendered labels, five authoritative prose records
  plus this audit, and a repository-wide stale-claim sweep.
- Red controls: six isolated mutations flip the default, bypass the kill switch,
  make the database optional, restore `off` metadata, hide the fallback, or
  restore the stale claim. Every mutation makes the verifier exit nonzero; the
  unmodified regression returns green.
- Real database: local PostgreSQL is queried for its version, database, and
  operator-memory table. Fourteen lifecycle tests execute real writes, reads,
  concurrent ceiling enforcement, restart reconstruction, exact deletion, and
  adjacent-subject preservation.
- Real route: four Fastify/PostgreSQL cases prove flag-absent default-on across
  fresh sessions, turn disclosure, kill-switch session fallback, validation,
  confirmation, and audit recording.
- Real browser: Chromium observes both the server-confirmed durable profile and
  server-confirmed session-only fallback in the admin drawer; the degraded panel
  also passes the scoped serious-impact axe gate.

The broad BFF typecheck ratchet was also attempted. It stopped on the unchanged,
out-of-scope `src/generation/human-video-release-handlers.spec.ts` because an
object literal supplies `byteLength` outside the current `ErasureMaster` type.
Task 9.1 therefore retains a dedicated operator-memory compiler configuration
covering the changed BFF route, store, tools, and both integration specs; that
target must be green. The unrelated media-test error is not reclassified as
operator-memory evidence or silently added to the baseline.

## Operator runbook

Normal operation needs no `OSHUN_ASSISTANT_OPERATOR_MEMORY` value. Bind
`OSHUN_ADMIN_DATABASE_URL` (preferred) or `OSHUN_V1_DATABASE_URL`; an authorized
admin session should return `continuity.memory.scope = "profile"`, and the
drawer should show `Operator profile` after session creation.

For emergency rollback, set `OSHUN_ASSISTANT_OPERATOR_MEMORY=0` (the equivalent
false forms are accepted) and restart the BFF deployment. New admin sessions
must return `scope = "session"`, the drawer must show `Session only`, and the
remember/forget tools must be absent. This switch does not delete existing rows.
Use the governed forget/account-erasure paths when deletion is intended.

If a database binding is removed or unavailable at configuration resolution, the
expected posture is session-only. Treat a profile label without a bound
database, durable tools under a false switch, or a malformed flag that is
silently accepted as a release-blocking fault.

## Boundary

Task 9.1 verifies and reconciles the serving posture. It does not close the rest
of Phase 9: inspect/edit/correct controls, measured relevance, provenance and
expiry policy, poisoning resistance, semantic recall admission, and rollout
evidence remain Tasks 9.2–9.7. The retained PostgreSQL runtime is local rather
than staging or production; it proves the real implementation boundary without
claiming production rollout state.