xinmi/scripts/native_memory_api_smoke.md

# Native memory API smoke fixture

This script verifies the actual deployed HTTP API, workbench job leases/worker,
database persistence, memory review and the prompt sent to a deterministic local
fake model. It does not benchmark AI quality or invoke any existing model.

## Automatic disposable workspace

Use the wrapper to provision and clean up the required fixture:

```sh
node scripts/native_memory_fixture.cjs --run
```

It reads the existing private admin login file at
`/Volumes/Extreme SSD/yawan-storage/weknora/acceptance/super-admin-login.json`.
Override that path with `MEMORY_SMOKE_ADMIN_AUTH`. The file must have no group or
other read permissions. The wrapper creates two uniquely named disposable users
and an empty workspace, enables explicit-only memory with vector recall disabled,
and gives only the fixture owner a disposable balance. The owner has workspace
owner privileges to create the local fake model; the outsider remains an ordinary
contributor. Neither user is a system administrator.

Credentials are written only into mode-0600 files within a mode-0700 run directory.
The manifest is credential-free and is saved at each setup stage. The wrapper runs
the smoke script, then checks no fixture workbench job remains active and removes
only the new workspace, fixture users, auth tokens, balance, model, Agent, memory
and workbench rows. It validates both workspace name/business marker and exact
user identities before cleanup. A surviving smoke process, unexpected tables or foreign memberships stop
cleanup for inspection. Administrator audit entries in the original workspace
remain as evidence. There is no database reset, and no real provider is called.

If interrupted, rerun just the exact fixture cleanup:

```sh
node scripts/native_memory_fixture.cjs --cleanup /absolute/path/memory-smoke-RUN/fixture.json
```

The wrapper defaults to Docker context `colima-yawan`, container
`WeKnora-postgres`, database `yawan_native_acceptance_20260915` and source tenant
`10059`. This database is production despite its historical name. Connection
overrides are `MEMORY_SMOKE_DOCKER`, `MEMORY_SMOKE_DOCKER_CONTEXT`,
`MEMORY_SMOKE_DB_CONTAINER`, `MEMORY_SMOKE_DB_NAME` and
`MEMORY_SMOKE_SOURCE_TENANT`. Cleanup requires the same recorded connection.
`MEMORY_SMOKE_DIRECTORY` changes the parent directory for fixture reports.
The wrapper is intended to be run after deployment by the release operator.

The wrapper also seeds one synthetic accepted legacy history row through a
private child-process channel, after checking the new Agent's exact owner,
workspace, name and memory setting. This is a new fixture record, never a real
user's imported history. After migration 217, the actual API must require owner
scope consent, preserve the original text/source, create exactly one linked native
preference, include it in the next real generation request to the local stub, and
reject access from the other user. Deleting that native preference then repeating
confirmation must not restore it. The dedicated workspace cleanup removes this
synthetic history too. Provenance matching during migration is tested separately
with an isolated PostgreSQL database. Standalone existing-fixture mode does not
seed or claim coverage of legacy reconfirmation.

## Existing fixture mode

Requirements:

- Node 20+ and the local backend origin after deployment.
- A dedicated empty workspace whose name starts with `memory-smoke-`, with memory enabled.
- Two disposable users whose usernames start with `memory-smoke-`. The owner must be able to create a model, Agent, flow and content task. The outsider must not be a system administrator. The outsider may share the fixture workspace or use another empty fixture workspace.
- Two local mode-0600 JSON auth files with `{"token":"..."}`. Optional `tenantID` selects the active workspace through `X-Tenant-ID`. Do not put tokens in commands, source control or the result report.

```sh
MEMORY_SMOKE_OWNER_AUTH=/absolute/path/owner-auth.json \
MEMORY_SMOKE_OUTSIDER_AUTH=/absolute/path/outsider-auth.json \
MEMORY_SMOKE_MANIFEST=/absolute/path/memory-smoke-result.json \
node scripts/native_memory_api_smoke.cjs --run
```

The default origin is `http://127.0.0.1:18080/api/v1`; override with
`MEMORY_SMOKE_BASE`. Public hostnames are refused. The model stub listens on a
random local host port so the backend container can reach it through
`host.docker.internal`. Set `MEMORY_SMOKE_MODEL_HOST=127.0.0.1` for a backend
running directly on the host. The stub receives only fixture content.

The script checks 135-minute task creation, 90-minute update, persistence, and
rejection of negative/fractional/over-1440 durations without mutating saved state.
It also checks that draft content does not become memory, adopting human
advice creates one pending candidate, repeated adoption deduplicates it,
another account cannot approve or delete it, explicit review writes an active
memory, the next generation actually recalls that preference, and skip/source
deletion invalidate only pending candidates. It also runs quality review and
exact ordered composition, changes the duration to 225 minutes, verifies the
original prose is retained while old review/composition results are cleared,
and checks that composition is blocked until renewed confirmation and review.
Reacceptance restores invalidated pending feedback without resetting explicitly
approved memories. It refuses nonempty owner memory
or content fixtures and does not alter workspace settings.

Cleanup uses exact created resource/memory IDs through APIs. It waits for every
recorded job to be terminal first. On job timeout it deliberately retains the
fixture and reports the IDs instead of deleting beneath a running worker. The
manifest is written after every created object, contains no token, and supports
manual recovery. API deletion leaves workbench review/history records and
memory tombstones; the companion `.cleanup.sql` removes only this run's exact
candidate/resource IDs within its tenant/owner scope. It refuses active jobs.
Run that SQL against the matching database after reviewing the manifest. Audit
and usage logs and the disposable accounts/workspace remain as test evidence;
remove the dedicated fixture identities through the normal administration
workflow when the evidence is no longer needed. No broad database reset is used.

This fixture tests native content feedback and recall. Chat extraction retry,
timestamp pagination, per-session checkpoints and pending conflict rollback
are covered by the offline Go integration suites; this script does not claim
to simulate those asynchronous chat failures.