Harden runtime: providers, transport, HTTP contract, security, metrics

[AndrewMoryakov]

Summary

Fixes from a multi-scope code review of the runtime. Each fix was scoped to a disjoint set of files so changes don't overlap. No data migration; existing mem0 stores and access paths are unaffected (qdrant config/read paths unchanged; the scope-registry is a separate, rebuildable index).

Correctness

• HTTP add contract — the HTTP surface now accepts the documented text field and synthesizes messages like the MCP/CLI adapters (previously {"text": ...} returned a KeyError/400).
• Uniform input validation — HTTP query/body now validate against each operation's JSON schema (limit/enum/type/unexpected-field checks), matching MCP. Shared validator extracted to runtime/schema_validation.py.
• mem0 add fallback — when mem0's response lacks a record, the fallback now attributes the write by id/text instead of returning an arbitrary pre-existing row (which could sync the wrong id to the registry).
• reconcile — conflict detection now partitions by scope (user, agent, run), eliminating cross-user false positives and reducing the O(n²) pass to per-group.

Reliability / concurrency

• mem0 provider caching — replaced @lru_cache on instance methods with per-instance caches, so a reconfigured provider rebuilds Memory and re-reads the API key (no stale backend, no instance leak).
• owner-process proxy — should_proxy_to_api() now confirms ownership by matching os.getpid() against the recorded API pid, so a child that inherits AGENTMEMORY_OWNER_PROCESS=1 no longer touches the embedded backend directly.
• proxy startup lock — the cross-process lock now wraps only the spawn; the up-to-20s health-wait runs outside it, so parallel clients don't serialize.
• proxy auth errors — proxied 401/403 now surface an actionable "set AGENTMEMORY_API_TOKEN" message instead of a misleading validation error.
• scope_registry — SQLite now uses WAL + busy_timeout/synchronous=NORMAL; a failed needs_rebuild status write is logged instead of silently swallowed.
• atomic_io — the containing directory is fsynced after os.replace (POSIX) for true crash durability; gracefully skipped where unsupported.
• clients — batch connect/disconnect/status/doctor now isolate per-target failures; a malformed existing client config yields an actionable error without clobbering the file.

Security

• OAuth — PLAIN PKCE is rejected (S256 only); redirect_uri is validated by exact hostname (127.0.0.1/::1/localhost, rejecting @/suffix spoofing); /oauth/authorize is rate-limited.

Metrics

• Bounded label cardinality (error types per op, model names) folding overflow into __other__ to prevent unbounded memory/series growth; histogram le labels render as plain numbers.

Test plan

• Full suite: python -m unittest discover -s tests — 422 tests, no new failures (2 pre-existing env-dependent failures confirmed against the base commit).
• Added focused regression tests for each fix (http_client, transport, operation_adapters, reconcile, clients, scope_registry, mem0).
• Optional: live mem0 smoke (add → search → get) where OPENROUTER_API_KEY is configured.

Behavioral notes (not breakage)

• HTTP input is now strictly validated like MCP (extra fields / bad enum / limit < 1 → 400).
• OAuth clients relying on PLAIN PKCE must switch to S256.
• The scope-registry auto-upgrades to WAL on first open (creates -wal/-shm sidecars); no action required.

https://claude.ai/code/session_01BKjtun7hVwxh6Hv3YLdrww

---

Generated by Claude Code