feat: add multipart memory uploads

.env.example

@@ -1,13 +1,13 @@
-# EverOS HTTP server used by the gateway client.
+# Upstream memory service used by the gateway client.
-EVEROS_BASE_URL=http://127.0.0.1:1995
+MEMORY_GATEWAY_BACKEND_BASE_URL=http://127.0.0.1:1995
 
-# Gateway-owned SQLite database. This does not point at EverOS internal storage.
+# Gateway-owned SQLite database. This does not point at upstream internal storage.
 MEMORY_GATEWAY_DB_PATH=./data/memory_gateway.sqlite3
 
-# Raw uploaded files are stored here before being passed to EverOS by file URI.
+# Raw uploaded files are stored here for gateway-managed ingestion.
 MEMORY_GATEWAY_STORAGE_DIR=./data/storage
 
-# Number of resource session IDs sent per EverOS search request.
+# Number of resource session IDs sent per upstream search request.
 MEMORY_GATEWAY_RESOURCE_SEARCH_BATCH_SIZE=50
 
 # Max upload size in bytes. Default here is 25 MiB.
@@ -16,10 +16,10 @@ MEMORY_GATEWAY_MAX_UPLOAD_BYTES=26214400
 # Comma-separated MIME allowlist. Prefix wildcards such as image/* are supported.
 MEMORY_GATEWAY_ALLOWED_MIME_TYPES=image/*,audio/*,application/pdf,text/html,application/xhtml+xml,text/plain,text/markdown,text/csv,application/json,application/msword,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.ms-excel,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,application/vnd.ms-powerpoint,application/vnd.openxmlformats-officedocument.presentationml.presentation
 
-# EverOS add/flush retry policy during resource ingestion.
+# Upstream add/flush retry policy during resource ingestion.
-MEMORY_GATEWAY_EVEROS_INGEST_ATTEMPTS=3
+MEMORY_GATEWAY_BACKEND_INGEST_ATTEMPTS=3
-MEMORY_GATEWAY_EVEROS_RETRY_DELAY_SECONDS=0.25
+MEMORY_GATEWAY_BACKEND_RETRY_DELAY_SECONDS=0.25
-MEMORY_GATEWAY_EVEROS_TIMEOUT_SECONDS=120
+MEMORY_GATEWAY_BACKEND_TIMEOUT_SECONDS=120
 
 # API server settings used by python main.py.
 MEMORY_GATEWAY_HOST=0.0.0.0

.gitignore

@@ -1,6 +1,6 @@
 # Local environment files
 .env
-everos.env
+backend.env
 *.env.local
 
 # Gateway runtime data

core/__init__.py

@@ -1,4 +1,4 @@
-"""Lightweight Memory Gateway for EverOS."""
+"""Lightweight user resource memory gateway."""
 
 from __future__ import annotations
 

core/api.py

@@ -7,15 +7,23 @@ from datetime import datetime, timezone
 from typing import Any, Literal
 from urllib.parse import parse_qsl, quote, urlsplit, urlunsplit
 
+import httpx
 from fastapi import APIRouter, FastAPI, File, Form, HTTPException, Request, UploadFile
-from pydantic import BaseModel, Field
+from pydantic import ValidationError
+from pydantic import BaseModel, Field, field_validator
+from starlette.datastructures import UploadFile as StarletteUploadFile
 from starlette.responses import Response
 
 from .config import GatewayConfig
 from .db import init_db
-from .everos_client import EverOSClient
+from .backend_client import BackendClient
 from .repository import MemoryRepository
-from .service import MemoryGatewayService, UnsupportedContentType, UploadTooLarge
+from .service import (
+    InvalidAttachment,
+    MemoryGatewayService,
+    UnsupportedContentType,
+    UploadTooLarge,
+)
 
 
 API_LOGGER = logging.getLogger("memory_gateway.api")
@@ -34,15 +42,28 @@ SENSITIVE_FIELD_NAMES = {
 class SearchMemoriesRequest(BaseModel):
     user_id: str = Field(min_length=1)
     user_key: str = Field(min_length=1)
+    agent_id: str | None = Field(default=None, min_length=1)
     conversation_id: str | None = None
     query: str = Field(min_length=1)
     scope: list[Literal["current_chat", "resources", "all_user_memory"]] = Field(
         default_factory=lambda: ["current_chat", "resources"]
     )
-    top_k: int = Field(default=8, ge=1, le=100)
+    method: Literal["keyword", "vector", "hybrid", "agentic"] = "hybrid"
+    top_k: int = 8
+    radius: float | None = Field(default=None, ge=0, le=1)
+    include_profile: bool = True
+    enable_llm_rerank: bool = True
+    filters: dict[str, Any] | None = None
     app_id: str = "default"
     project_id: str = "default"
 
+    @field_validator("top_k")
+    @classmethod
+    def validate_top_k(cls, value: int) -> int:
+        if value != -1 and not 1 <= value <= 100:
+            raise ValueError("top_k must be -1 or in 1..100")
+        return value
+
 
 class AddMemoryMessage(BaseModel):
     sender_id: str = Field(min_length=1)
@@ -68,6 +89,22 @@ class FlushMemoryRequest(BaseModel):
     project_id: str = "default"
 
 
+class ExternalResourceRequest(BaseModel):
+    user_id: str = Field(min_length=1)
+    user_key: str = Field(min_length=1)
+    app_id: str = "default"
+    project_id: str = "default"
+    filename: str = Field(min_length=1)
+    mime_type: str | None = None
+    content_type: str | None = None
+    size_bytes: int | None = Field(default=None, ge=0)
+    sha256: str | None = None
+    source_uri: str = Field(min_length=1)
+    ingest_uri: str | None = None
+    title: str | None = None
+    description: str | None = None
+
+
 class MemoryOverrideRequest(BaseModel):
     user_id: str = Field(min_length=1)
     user_key: str = Field(min_length=1)
@@ -178,24 +215,85 @@ def _body_for_log(body: bytes, content_type: str | None) -> Any:
     return {"content_type": content_type, "size_bytes": len(body)}
 
 
+def _backend_http_error_detail(exc: httpx.HTTPStatusError) -> Any:
+    try:
+        return exc.response.json()
+    except ValueError:
+        return exc.response.text
+
+
+def _form_text(form: Any, field: str, default: str | None = None) -> str:
+    value = form.get(field)
+    if value is None:
+        if default is not None:
+            return default
+        raise HTTPException(status_code=422, detail=f"missing form field: {field}")
+    if isinstance(value, StarletteUploadFile):
+        raise HTTPException(status_code=422, detail=f"form field must be text: {field}")
+    return str(value)
+
+
+async def _form_json_text(form: Any, field: str) -> str:
+    value = form.get(field)
+    if value is None:
+        raise HTTPException(status_code=422, detail=f"missing form field: {field}")
+    if isinstance(value, StarletteUploadFile):
+        raw = await value.read()
+        return raw.decode("utf-8")
+    return str(value)
+
+
+def _upload_files_from_form(form: Any) -> dict[str, UploadFile]:
+    files: dict[str, UploadFile] = {}
+    for key, value in form.multi_items():
+        if not isinstance(value, StarletteUploadFile):
+            continue
+        if key == "messages":
+            continue
+        if key in files:
+            raise HTTPException(
+                status_code=422,
+                detail=f"duplicate upload file field: {key}",
+            )
+        files[key] = value
+    return files
+
+
+async def _multipart_messages(form: Any) -> list[dict[str, Any]]:
+    raw = await _form_json_text(form, "messages")
+    try:
+        parsed = json.loads(raw)
+    except json.JSONDecodeError as exc:
+        raise HTTPException(
+            status_code=400,
+            detail=f"invalid messages JSON: {exc.msg}",
+        ) from exc
+    if not isinstance(parsed, list):
+        raise HTTPException(status_code=400, detail="messages must be a JSON array")
+    try:
+        return [AddMemoryMessage.model_validate(item).model_dump() for item in parsed]
+    except ValidationError as exc:
+        raise HTTPException(status_code=422, detail=exc.errors()) from exc
+
+
 def create_app(
     *,
     config: GatewayConfig | None = None,
-    everos_client: Any | None = None,
+    backend_client: Any | None = None,
 ) -> FastAPI:
     cfg = config or GatewayConfig.from_env()
     init_db(cfg.database_path)
     repository = MemoryRepository(cfg.database_path)
-    client = everos_client or EverOSClient(
+    client = backend_client or BackendClient(
-        cfg.everos_base_url,
+        cfg.backend_base_url,
-        timeout=cfg.everos_timeout_seconds,
+        timeout=cfg.backend_timeout_seconds,
     )
     service = MemoryGatewayService(cfg, repository, client)
 
     app = FastAPI(title="memory-gateway", version="0.1.0")
     app.state.config = cfg
     app.state.repository = repository
-    app.state.everos_client = client
+    app.state.backend_client = client
     app.state.gateway_service = service
 
     router = APIRouter()
@@ -278,24 +376,24 @@ def create_app(
     @router.get("/health")
     async def health() -> dict[str, Any]:
         try:
-            everos_health = await client.health_check()
+            backend_health = await client.health_check()
         except Exception as exc:
             return {
                 "status": "degraded",
                 "api": {"status": "ok"},
-                "everos": {
+                "backend": {
                     "status": "unavailable",
-                    "base_url": cfg.everos_base_url,
+                    "base_url": cfg.backend_base_url,
                     "error": str(exc),
                 },
             }
         return {
             "status": "ok",
             "api": {"status": "ok"},
-            "everos": {
+            "backend": {
                 "status": "ok",
-                "base_url": cfg.everos_base_url,
+                "base_url": cfg.backend_base_url,
-                "data": everos_health,
+                "data": backend_health,
             },
         }
 
@@ -348,6 +446,26 @@ def create_app(
             return {"resources": []}
         return {"resources": [resource]}
 
+    @router.post("/resources/external")
+    async def register_external_resource(
+        request: ExternalResourceRequest,
+    ) -> dict[str, Any]:
+        require_user(request.user_id, request.user_key)
+        return await service.register_external_resource(
+            user_id=request.user_id,
+            app_id=request.app_id,
+            project_id=request.project_id,
+            filename=request.filename,
+            mime_type=request.mime_type,
+            content_type=request.content_type,
+            size_bytes=request.size_bytes,
+            sha256=request.sha256,
+            source_uri=request.source_uri,
+            ingest_uri=request.ingest_uri,
+            title=request.title,
+            description=request.description,
+        )
+
     @router.delete("/resources/{resource_id}")
     async def delete_resource(
         resource_id: str,
@@ -367,10 +485,16 @@ def create_app(
         require_user(request.user_id, request.user_key)
         return await service.search_memories(
             user_id=request.user_id,
+            agent_id=request.agent_id,
             query=request.query,
             conversation_id=request.conversation_id,
             scope=request.scope,
+            method=request.method,
             top_k=request.top_k,
+            radius=request.radius,
+            include_profile=request.include_profile,
+            enable_llm_rerank=request.enable_llm_rerank,
+            filters=request.filters,
             app_id=request.app_id,
             project_id=request.project_id,
         )
@@ -380,12 +504,50 @@ def create_app(
         request: AddMemoryRequest,
     ) -> dict[str, Any]:
         require_user(request.user_id, request.user_key)
-        return await service.add_memory(
+        try:
-            session_id=request.session_id,
+            return await service.add_memory(
-            app_id=request.app_id,
+                user_id=request.user_id,
-            project_id=request.project_id,
+                session_id=request.session_id,
-            messages=[message.model_dump() for message in request.messages],
+                app_id=request.app_id,
-        )
+                project_id=request.project_id,
+                messages=[message.model_dump() for message in request.messages],
+            )
+        except httpx.HTTPStatusError as exc:
+            raise HTTPException(
+                status_code=exc.response.status_code,
+                detail=_backend_http_error_detail(exc),
+            ) from exc
+        except UploadTooLarge as exc:
+            raise HTTPException(status_code=413, detail=str(exc)) from exc
+        except InvalidAttachment as exc:
+            raise HTTPException(status_code=422, detail=str(exc)) from exc
+
+    @router.post("/memories/add/multipart")
+    async def add_memory_multipart(request: Request) -> dict[str, Any]:
+        form = await request.form()
+        user_id = _form_text(form, "user_id")
+        user_key = _form_text(form, "user_key")
+        require_user(user_id, user_key)
+        try:
+            return await service.add_memory_with_uploads(
+                user_id=user_id,
+                session_id=_form_text(form, "session_id"),
+                app_id=_form_text(form, "app_id", "default"),
+                project_id=_form_text(form, "project_id", "default"),
+                messages=await _multipart_messages(form),
+                upload_files=_upload_files_from_form(form),
+            )
+        except httpx.HTTPStatusError as exc:
+            raise HTTPException(
+                status_code=exc.response.status_code,
+                detail=_backend_http_error_detail(exc),
+            ) from exc
+        except UploadTooLarge as exc:
+            raise HTTPException(status_code=413, detail=str(exc)) from exc
+        except UnsupportedContentType as exc:
+            raise HTTPException(status_code=415, detail=str(exc)) from exc
+        except InvalidAttachment as exc:
+            raise HTTPException(status_code=422, detail=str(exc)) from exc
 
     @router.post("/memories/flush")
     async def flush_memory(

core/backend_client.py

@@ -5,7 +5,7 @@ from typing import Any
 import httpx
 
 
-class EverOSClient:
+class BackendClient:
     def __init__(self, base_url: str, timeout: float = 120.0) -> None:
         self.base_url = base_url.rstrip("/")
         self.timeout = timeout

core/config.py

@@ -27,15 +27,15 @@ _DEFAULT_ALLOWED_MIME_TYPES = (
 
 @dataclass(frozen=True)
 class GatewayConfig:
-    everos_base_url: str = "http://127.0.0.1:1995"
+    backend_base_url: str = "http://127.0.0.1:1995"
     database_path: Path = _PROJECT_ROOT / "data" / "memory_gateway.sqlite3"
     storage_dir: Path = _PROJECT_ROOT / "data" / "storage"
     resource_search_batch_size: int = 50
     max_upload_bytes: int = 25 * 1024 * 1024
     allowed_mime_types: tuple[str, ...] = _DEFAULT_ALLOWED_MIME_TYPES
-    everos_ingest_attempts: int = 3
+    backend_ingest_attempts: int = 3
-    everos_retry_delay_seconds: float = 0.25
+    backend_retry_delay_seconds: float = 0.25
-    everos_timeout_seconds: float = 120.0
+    backend_timeout_seconds: float = 120.0
 
     @classmethod
     def from_env(cls) -> GatewayConfig:
@@ -48,8 +48,8 @@ class GatewayConfig:
             if item.strip()
         )
         return cls(
-            everos_base_url=os.environ.get(
+            backend_base_url=os.environ.get(
-                "EVEROS_BASE_URL",
+                "MEMORY_GATEWAY_BACKEND_BASE_URL",
                 "http://127.0.0.1:1995",
             ).rstrip("/"),
             database_path=Path(
@@ -71,13 +71,13 @@ class GatewayConfig:
                 os.environ.get("MEMORY_GATEWAY_MAX_UPLOAD_BYTES", str(25 * 1024 * 1024))
             ),
             allowed_mime_types=allowed_mime_types,
-            everos_ingest_attempts=int(
+            backend_ingest_attempts=int(
-                os.environ.get("MEMORY_GATEWAY_EVEROS_INGEST_ATTEMPTS", "3")
+                os.environ.get("MEMORY_GATEWAY_BACKEND_INGEST_ATTEMPTS", "3")
             ),
-            everos_retry_delay_seconds=float(
+            backend_retry_delay_seconds=float(
-                os.environ.get("MEMORY_GATEWAY_EVEROS_RETRY_DELAY_SECONDS", "0.25")
+                os.environ.get("MEMORY_GATEWAY_BACKEND_RETRY_DELAY_SECONDS", "0.25")
             ),
-            everos_timeout_seconds=float(
+            backend_timeout_seconds=float(
-                os.environ.get("MEMORY_GATEWAY_EVEROS_TIMEOUT_SECONDS", "120")
+                os.environ.get("MEMORY_GATEWAY_BACKEND_TIMEOUT_SECONDS", "120")
             ),
         )

core/db.py

@@ -43,6 +43,62 @@ ON user_resources (session_id);
 CREATE INDEX IF NOT EXISTS idx_user_resources_user_id
 ON user_resources (user_id);
 
+CREATE TABLE IF NOT EXISTS memory_attachments (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL,
+    app_id TEXT NOT NULL DEFAULT 'default',
+    project_id TEXT NOT NULL DEFAULT 'default',
+    session_id TEXT NOT NULL,
+    resource_id TEXT,
+    content_type TEXT NOT NULL,
+    name TEXT NOT NULL,
+    internal_uri TEXT NOT NULL,
+    source TEXT NOT NULL,
+    sha256 TEXT,
+    created_at TIMESTAMP NOT NULL,
+    deleted_at TIMESTAMP
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_memory_attachments_unique_uri
+ON memory_attachments (user_id, session_id, internal_uri);
+
+CREATE INDEX IF NOT EXISTS idx_memory_attachments_user_session
+ON memory_attachments (user_id, session_id, deleted_at);
+
+CREATE INDEX IF NOT EXISTS idx_memory_attachments_resource
+ON memory_attachments (resource_id, deleted_at);
+
+INSERT OR IGNORE INTO memory_attachments (
+    id,
+    user_id,
+    app_id,
+    project_id,
+    session_id,
+    resource_id,
+    content_type,
+    name,
+    internal_uri,
+    source,
+    sha256,
+    created_at,
+    deleted_at
+)
+SELECT
+    'a_resource_' || id,
+    user_id,
+    app_id,
+    project_id,
+    session_id,
+    id,
+    content_type,
+    COALESCE(original_filename, id),
+    uri,
+    'resource_upload',
+    sha256,
+    created_at,
+    deleted_at
+FROM user_resources;
+
 CREATE TABLE IF NOT EXISTS memory_tombstones (
     id TEXT PRIMARY KEY,
     user_id TEXT NOT NULL,

core/repository.py

@@ -96,9 +96,13 @@ class MemoryRepository:
         now = utc_now()
         where = "id = ? AND deleted_at IS NULL"
         params: tuple[Any, ...] = (now, now, resource_id)
+        attachment_where = "resource_id = ? AND deleted_at IS NULL"
+        attachment_params: tuple[Any, ...] = (now, resource_id)
         if user_id is not None:
             where += " AND user_id = ?"
             params = (now, now, resource_id, user_id)
+            attachment_where += " AND user_id = ?"
+            attachment_params = (now, resource_id, user_id)
         with connect(self.db_path) as conn:
             conn.execute(
                 f"""
@@ -108,6 +112,14 @@ class MemoryRepository:
                 """,
                 params,
             )
+            conn.execute(
+                f"""
+                UPDATE memory_attachments
+                SET deleted_at = ?
+                WHERE {attachment_where}
+                """,
+                attachment_params,
+            )
             conn.commit()
         return self.get_resource(resource_id)
 
@@ -215,6 +227,62 @@ class MemoryRepository:
             ).fetchall()
         return [dict(row) for row in rows]
 
+    def create_attachment(self, **values: Any) -> dict[str, Any]:
+        attachment_id = str(values.get("id") or f"a_{uuid.uuid4().hex}")
+        payload = {
+            "id": attachment_id,
+            "created_at": utc_now(),
+            "deleted_at": None,
+            **values,
+        }
+        with connect(self.db_path) as conn:
+            conn.execute(
+                """
+                INSERT OR IGNORE INTO memory_attachments (
+                    id, user_id, app_id, project_id, session_id, resource_id,
+                    content_type, name, internal_uri, source, sha256,
+                    created_at, deleted_at
+                ) VALUES (
+                    :id, :user_id, :app_id, :project_id, :session_id, :resource_id,
+                    :content_type, :name, :internal_uri, :source, :sha256,
+                    :created_at, :deleted_at
+                )
+                """,
+                payload,
+            )
+            row = conn.execute(
+                """
+                SELECT * FROM memory_attachments
+                WHERE user_id = ? AND session_id = ? AND internal_uri = ?
+                """,
+                (
+                    payload["user_id"],
+                    payload["session_id"],
+                    payload["internal_uri"],
+                ),
+            ).fetchone()
+            conn.commit()
+        attachment = _row_to_dict(row)
+        if attachment is None:
+            raise RuntimeError("created attachment could not be read back")
+        return attachment
+
+    def list_attachments_for_session(
+        self,
+        user_id: str,
+        session_id: str,
+    ) -> list[dict[str, Any]]:
+        with connect(self.db_path) as conn:
+            rows = conn.execute(
+                """
+                SELECT * FROM memory_attachments
+                WHERE user_id = ? AND session_id = ? AND deleted_at IS NULL
+                ORDER BY created_at ASC, id ASC
+                """,
+                (user_id, session_id),
+            ).fetchall()
+        return [dict(row) for row in rows]
+
     def add_tombstone(
         self,
         user_id: str,

core/service.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import asyncio
 import base64
+import binascii
 import hashlib
 import mimetypes
 import secrets
@@ -50,6 +51,17 @@ def infer_content_type(filename: str | None, mime_type: str | None) -> str:
     return "doc"
 
 
+def normalize_content_type(
+    filename: str | None,
+    mime_type: str | None,
+    content_type: str | None,
+) -> str:
+    requested = (content_type or "").strip().lower()
+    if requested in {"image", "audio", "pdf", "html", "text", "doc"}:
+        return requested
+    return infer_content_type(filename, mime_type or requested)
+
+
 def _safe_filename(filename: str | None) -> str:
     name = Path(filename or "upload.bin").name
     return name or "upload.bin"
@@ -63,6 +75,10 @@ class UnsupportedContentType(ValueError):
     pass
 
 
+class InvalidAttachment(ValueError):
+    pass
+
+
 def _copy_upload(
     file: UploadFile,
     destination: Path,
@@ -122,16 +138,35 @@ def _remove_empty_parents(path: Path, stop_at: Path | None = None) -> None:
         current = parent
 
 
+def _read_upload_bytes(
+    file: UploadFile,
+    max_upload_bytes: int,
+) -> tuple[bytes, str, int]:
+    sha256 = hashlib.sha256()
+    size = 0
+    chunks: list[bytes] = []
+    while True:
+        chunk = file.file.read(1024 * 1024)
+        if not chunk:
+            break
+        size += len(chunk)
+        if size > max_upload_bytes:
+            raise UploadTooLarge(f"upload exceeds max size of {max_upload_bytes} bytes")
+        sha256.update(chunk)
+        chunks.append(chunk)
+    return b"".join(chunks), sha256.hexdigest(), size
+
+
 class MemoryGatewayService:
     def __init__(
         self,
         config: GatewayConfig,
         repository: MemoryRepository,
-        everos_client: Any,
+        backend_client: Any,
     ) -> None:
         self.config = config
         self.repository = repository
-        self.everos_client = everos_client
+        self.backend_client = backend_client
 
     def create_user(self, user_id: str) -> dict[str, Any]:
         user_key = f"uk_{secrets.token_urlsafe(32)}"
@@ -180,6 +215,7 @@ class MemoryGatewayService:
         )
         if existing is not None:
             shutil.rmtree(stored_path.parent, ignore_errors=True)
+            self._register_resource_attachment(existing)
             return self._resource_summary(existing)
 
         internal_uri = stored_path.resolve().as_uri()
@@ -202,10 +238,11 @@ class MemoryGatewayService:
             status="ingesting",
             error_message=None,
         )
+        self._register_resource_attachment(resource)
 
         try:
-            await self._retry_everos_call(
+            await self._retry_backend_call(
-                lambda: self.everos_client.add_memory(
+                lambda: self.backend_client.add_memory(
                     self._build_add_payload(
                         resource=resource,
                         user_id=user_id,
@@ -215,8 +252,8 @@ class MemoryGatewayService:
                     )
                 )
             )
-            await self._retry_everos_call(
+            await self._retry_backend_call(
-                lambda: self.everos_client.flush_memory(session_id, app_id, project_id)
+                lambda: self.backend_client.flush_memory(session_id, app_id, project_id)
             )
         except Exception as exc:
             failed = self.repository.update_resource_status(
@@ -229,8 +266,8 @@ class MemoryGatewayService:
         extracted = self.repository.update_resource_status(resource_id, "extracted")
         return self._resource_summary(extracted or resource)
 
-    async def _retry_everos_call(self, operation: Any) -> Any:
+    async def _retry_backend_call(self, operation: Any) -> Any:
-        attempts = max(1, self.config.everos_ingest_attempts)
+        attempts = max(1, self.config.backend_ingest_attempts)
         last_error: Exception | None = None
         for attempt in range(attempts):
             try:
@@ -239,11 +276,11 @@ class MemoryGatewayService:
                 last_error = exc
                 if attempt == attempts - 1:
                     break
-                delay = self.config.everos_retry_delay_seconds
+                delay = self.config.backend_retry_delay_seconds
                 if delay > 0:
                     await asyncio.sleep(delay)
         if last_error is None:
-            raise RuntimeError("EverOS operation failed")
+            raise RuntimeError("upstream memory service operation failed")
         raise last_error
 
     def _build_add_payload(
@@ -294,6 +331,123 @@ class MemoryGatewayService:
             item["base64"] = base64.b64encode(content).decode("ascii")
         return item
 
+    async def register_external_resource(
+        self,
+        *,
+        user_id: str,
+        app_id: str,
+        project_id: str,
+        filename: str,
+        mime_type: str | None,
+        content_type: str | None,
+        size_bytes: int | None,
+        sha256: str | None,
+        source_uri: str,
+        ingest_uri: str | None,
+        title: str | None,
+        description: str | None,
+    ) -> dict[str, Any]:
+        resource_id = new_resource_id()
+        session_id = resource_session_id(user_id, resource_id)
+        original_filename = _safe_filename(filename)
+        normalized_content_type = normalize_content_type(
+            original_filename,
+            mime_type,
+            content_type,
+        )
+        existing = None
+        if sha256:
+            existing = self.repository.find_active_resource_by_sha256(
+                user_id=user_id,
+                app_id=app_id,
+                project_id=project_id,
+                sha256=sha256,
+            )
+        if existing is not None:
+            self._register_resource_attachment(existing, source="external_resource")
+            return self._resource_summary(existing)
+
+        resource = self.repository.create_resource(
+            id=resource_id,
+            user_id=user_id,
+            app_id=app_id,
+            project_id=project_id,
+            session_id=session_id,
+            original_filename=original_filename,
+            mime_type=mime_type,
+            content_type=normalized_content_type,
+            uri=source_uri,
+            uri_public=False,
+            sha256=sha256,
+            size_bytes=size_bytes,
+            title=title,
+            description=description,
+            status="ingesting",
+            error_message=None,
+        )
+        self._register_resource_attachment(resource, source="external_resource")
+
+        try:
+            await self._retry_backend_call(
+                lambda: self.backend_client.add_memory(
+                    self._build_external_add_payload(
+                        resource=resource,
+                        user_id=user_id,
+                        app_id=app_id,
+                        project_id=project_id,
+                        filename=original_filename,
+                        ingest_uri=ingest_uri or source_uri,
+                    )
+                )
+            )
+            await self._retry_backend_call(
+                lambda: self.backend_client.flush_memory(session_id, app_id, project_id)
+            )
+        except Exception as exc:
+            failed = self.repository.update_resource_status(
+                resource_id,
+                "failed",
+                str(exc),
+            )
+            return self._resource_summary(failed or resource)
+
+        extracted = self.repository.update_resource_status(resource_id, "extracted")
+        return self._resource_summary(extracted or resource)
+
+    def _build_external_add_payload(
+        self,
+        *,
+        resource: dict[str, Any],
+        user_id: str,
+        app_id: str,
+        project_id: str,
+        filename: str,
+        ingest_uri: str,
+    ) -> dict[str, Any]:
+        content_item = {
+            "type": str(resource["content_type"]),
+            "name": filename,
+            "ext": Path(filename).suffix.lstrip(".") or None,
+            "uri": ingest_uri,
+            "extras": {
+                "resource_id": resource["id"],
+                "source": "external_resource",
+            },
+        }
+        return {
+            "session_id": resource["session_id"],
+            "app_id": app_id,
+            "project_id": project_id,
+            "messages": [
+                {
+                    "sender_id": user_id,
+                    "role": "user",
+                    "timestamp": current_timestamp_ms(),
+                    "content": [content_item],
+                }
+            ],
+        }
+
     def _resource_file_path(self, resource: dict[str, Any]) -> Path:
         uri = str(resource["uri"])
         parsed = urlparse(uri)
@@ -346,10 +500,16 @@ class MemoryGatewayService:
         self,
         *,
         user_id: str,
+        agent_id: str | None,
         query: str,
         conversation_id: str | None,
         scope: list[str],
+        method: str,
         top_k: int,
+        radius: float | None,
+        include_profile: bool,
+        enable_llm_rerank: bool,
+        filters: dict[str, Any] | None,
         app_id: str,
         project_id: str,
     ) -> dict[str, Any]:
@@ -359,15 +519,23 @@ class MemoryGatewayService:
         if "current_chat" in scope and conversation_id:
             payload = self._search_payload(
                 user_id=user_id,
+                agent_id=agent_id,
                 query=query,
+                method=method,
                 top_k=top_k,
+                radius=radius,
+                include_profile=include_profile,
+                enable_llm_rerank=enable_llm_rerank,
                 app_id=app_id,
                 project_id=project_id,
-                filters={"session_id": f"chat:{conversation_id}"},
+                filters=_combine_filters(
+                    filters,
+                    {"session_id": f"chat:{conversation_id}"},
+                ),
             )
             results.extend(
                 self._extract_results(
-                    await self.everos_client.search_memory(payload),
+                    await self.backend_client.search_memory(payload),
                     source_scope="current_chat",
                     session_resource_map=session_resource_map,
                     user_id=user_id,
@@ -385,15 +553,23 @@ class MemoryGatewayService:
             for batch in _chunks(session_ids, self.config.resource_search_batch_size):
                 payload = self._search_payload(
                     user_id=user_id,
+                    agent_id=agent_id,
                     query=query,
+                    method=method,
                     top_k=top_k,
+                    radius=radius,
+                    include_profile=include_profile,
+                    enable_llm_rerank=enable_llm_rerank,
                     app_id=app_id,
                     project_id=project_id,
-                    filters={"session_id": {"in": batch}},
+                    filters=_combine_filters(
+                        filters,
+                        {"session_id": {"in": batch}},
+                    ),
                 )
                 results.extend(
                     self._extract_results(
-                        await self.everos_client.search_memory(payload),
+                        await self.backend_client.search_memory(payload),
                         source_scope="resources",
                         session_resource_map=session_resource_map,
                         user_id=user_id,
@@ -403,15 +579,20 @@ class MemoryGatewayService:
         if "all_user_memory" in scope:
             payload = self._search_payload(
                 user_id=user_id,
+                agent_id=agent_id,
                 query=query,
+                method=method,
                 top_k=top_k,
+                radius=radius,
+                include_profile=include_profile,
+                enable_llm_rerank=enable_llm_rerank,
                 app_id=app_id,
                 project_id=project_id,
-                filters=None,
+                filters=filters,
             )
             results.extend(
                 self._extract_results(
-                    await self.everos_client.search_memory(payload),
+                    await self.backend_client.search_memory(payload),
                     source_scope="all_user_memory",
                     session_resource_map=session_resource_map,
                     user_id=user_id,
@@ -425,21 +606,279 @@ class MemoryGatewayService:
     async def add_memory(
         self,
         *,
+        user_id: str,
         session_id: str,
         app_id: str,
         project_id: str,
         messages: list[dict[str, Any]],
     ) -> dict[str, Any]:
+        attachments, generated_paths = self._prepare_memory_attachments(
+            user_id=user_id,
+            session_id=session_id,
+            app_id=app_id,
+            project_id=project_id,
+            messages=messages,
+        )
         payload = {
             "session_id": session_id,
             "app_id": app_id,
             "project_id": project_id,
             "messages": messages,
         }
-        return {
+        try:
+            backend = await self.backend_client.add_memory(payload)
+            for attachment in attachments:
+                self.repository.create_attachment(**attachment)
+        except Exception:
+            for path in generated_paths:
+                path.unlink(missing_ok=True)
+                _remove_empty_parents(path.parent, stop_at=self.config.storage_dir)
+            raise
+        return {"session_id": session_id, "backend": backend}
+
+    async def add_memory_with_uploads(
+        self,
+        *,
+        user_id: str,
+        session_id: str,
+        app_id: str,
+        project_id: str,
+        messages: list[dict[str, Any]],
+        upload_files: dict[str, UploadFile],
+    ) -> dict[str, Any]:
+        messages, attachments, generated_paths = self._prepare_uploaded_memory_files(
+            user_id=user_id,
+            session_id=session_id,
+            app_id=app_id,
+            project_id=project_id,
+            messages=messages,
+            upload_files=upload_files,
+        )
+        payload = {
             "session_id": session_id,
-            "everos": await self.everos_client.add_memory(payload),
+            "app_id": app_id,
+            "project_id": project_id,
+            "messages": messages,
         }
+        try:
+            backend = await self.backend_client.add_memory(payload)
+            for attachment in attachments:
+                self.repository.create_attachment(**attachment)
+        except Exception:
+            for path in generated_paths:
+                path.unlink(missing_ok=True)
+                _remove_empty_parents(path.parent, stop_at=self.config.storage_dir)
+            raise
+        return {"session_id": session_id, "backend": backend}
+
+    def _register_resource_attachment(
+        self,
+        resource: dict[str, Any],
+        *,
+        source: str = "resource_upload",
+    ) -> None:
+        self.repository.create_attachment(
+            user_id=resource["user_id"],
+            app_id=resource["app_id"],
+            project_id=resource["project_id"],
+            session_id=resource["session_id"],
+            resource_id=resource["id"],
+            content_type=resource["content_type"],
+            name=resource["original_filename"] or resource["id"],
+            internal_uri=resource["uri"],
+            source=source,
+            sha256=resource["sha256"],
+        )
+
+    def _prepare_memory_attachments(
+        self,
+        *,
+        user_id: str,
+        session_id: str,
+        app_id: str,
+        project_id: str,
+        messages: list[dict[str, Any]],
+    ) -> tuple[list[dict[str, Any]], list[Path]]:
+        attachments: list[dict[str, Any]] = []
+        generated_paths: list[Path] = []
+        try:
+            for message in messages:
+                content = message.get("content")
+                if not isinstance(content, list):
+                    continue
+                for item in content:
+                    if not isinstance(item, dict):
+                        continue
+                    uri = item.get("uri")
+                    encoded = item.get("base64")
+                    if not uri and not encoded:
+                        continue
+                    attachment_id = f"a_{uuid.uuid4().hex}"
+                    name = _attachment_name(item, str(uri) if uri else None)
+                    sha256: str | None = None
+                    if uri:
+                        internal_uri = str(uri)
+                        source = "memory_add_uri"
+                    else:
+                        try:
+                            data = base64.b64decode(str(encoded), validate=True)
+                        except (binascii.Error, ValueError) as exc:
+                            raise InvalidAttachment(
+                                f"invalid base64 attachment: {name}"
+                            ) from exc
+                        if len(data) > self.config.max_upload_bytes:
+                            raise UploadTooLarge(
+                                f"attachment exceeds max size of "
+                                f"{self.config.max_upload_bytes} bytes"
+                            )
+                        sha256 = hashlib.sha256(data).hexdigest()
+                        path = (
+                            self.config.storage_dir
+                            / user_id
+                            / "memory_attachments"
+                            / sha256
+                            / name
+                        )
+                        if not path.exists():
+                            path.parent.mkdir(parents=True, exist_ok=True)
+                            path.write_bytes(data)
+                            generated_paths.append(path)
+                        internal_uri = path.resolve().as_uri()
+                        source = "memory_add_base64"
+                    attachments.append(
+                        {
+                            "id": attachment_id,
+                            "user_id": user_id,
+                            "app_id": app_id,
+                            "project_id": project_id,
+                            "session_id": session_id,
+                            "resource_id": None,
+                            "content_type": str(item.get("type") or "doc"),
+                            "name": name,
+                            "internal_uri": internal_uri,
+                            "source": source,
+                            "sha256": sha256,
+                        }
+                    )
+        except Exception:
+            for path in generated_paths:
+                path.unlink(missing_ok=True)
+                _remove_empty_parents(path.parent, stop_at=self.config.storage_dir)
+            raise
+        return attachments, generated_paths
+
+    def _prepare_uploaded_memory_files(
+        self,
+        *,
+        user_id: str,
+        session_id: str,
+        app_id: str,
+        project_id: str,
+        messages: list[dict[str, Any]],
+        upload_files: dict[str, UploadFile],
+    ) -> tuple[list[dict[str, Any]], list[dict[str, Any]], list[Path]]:
+        attachments: list[dict[str, Any]] = []
+        generated_paths: list[Path] = []
+        used_upload_ids: set[str] = set()
+        try:
+            for message in messages:
+                content = message.get("content")
+                if not isinstance(content, list):
+                    continue
+                for index, item in enumerate(content):
+                    if not isinstance(item, dict) or "upload_id" not in item:
+                        continue
+                    upload_id = str(item.get("upload_id") or "").strip()
+                    if not upload_id:
+                        raise InvalidAttachment("upload_id must not be empty")
+                    if upload_id in used_upload_ids:
+                        raise InvalidAttachment(f"duplicate upload_id: {upload_id}")
+                    file = upload_files.get(upload_id)
+                    if file is None:
+                        raise InvalidAttachment(
+                            f"missing upload file for upload_id: {upload_id}"
+                        )
+                    used_upload_ids.add(upload_id)
+                    content[index] = self._materialize_uploaded_content_item(
+                        user_id=user_id,
+                        session_id=session_id,
+                        app_id=app_id,
+                        project_id=project_id,
+                        item=item,
+                        file=file,
+                        attachments=attachments,
+                        generated_paths=generated_paths,
+                    )
+            unused_upload_ids = sorted(set(upload_files) - used_upload_ids)
+            if unused_upload_ids:
+                raise InvalidAttachment(
+                    f"unused upload file field: {unused_upload_ids[0]}"
+                )
+        except Exception:
+            for path in generated_paths:
+                path.unlink(missing_ok=True)
+                _remove_empty_parents(path.parent, stop_at=self.config.storage_dir)
+            raise
+        return messages, attachments, generated_paths
+
+    def _materialize_uploaded_content_item(
+        self,
+        *,
+        user_id: str,
+        session_id: str,
+        app_id: str,
+        project_id: str,
+        item: dict[str, Any],
+        file: UploadFile,
+        attachments: list[dict[str, Any]],
+        generated_paths: list[Path],
+    ) -> dict[str, Any]:
+        name = _safe_filename(str(item.get("name") or file.filename or "upload.bin"))
+        mime_type = file.content_type or mimetypes.guess_type(name)[0]
+        if not _mime_allowed(mime_type, self.config.allowed_mime_types):
+            raise UnsupportedContentType(f"unsupported content type: {mime_type}")
+        content_type = normalize_content_type(
+            name,
+            mime_type,
+            str(item.get("type") or ""),
+        )
+        data, sha256, _size_bytes = _read_upload_bytes(
+            file,
+            self.config.max_upload_bytes,
+        )
+        path = self.config.storage_dir / user_id / "memory_attachments" / sha256 / name
+        if not path.exists():
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_bytes(data)
+            generated_paths.append(path)
+        content_item = {
+            key: value for key, value in item.items() if key not in {"upload_id", "uri"}
+        }
+        content_item["type"] = content_type
+        content_item["name"] = name
+        content_item["ext"] = Path(name).suffix.lstrip(".") or content_item.get("ext")
+        if content_type == "text":
+            content_item.pop("base64", None)
+            content_item["text"] = data.decode("utf-8", errors="replace")
+        else:
+            content_item.pop("text", None)
+            content_item["base64"] = base64.b64encode(data).decode("ascii")
+        attachments.append(
+            {
+                "id": f"a_{uuid.uuid4().hex}",
+                "user_id": user_id,
+                "app_id": app_id,
+                "project_id": project_id,
+                "session_id": session_id,
+                "resource_id": None,
+                "content_type": content_type,
+                "name": name,
+                "internal_uri": path.resolve().as_uri(),
+                "source": "memory_add_upload",
+                "sha256": sha256,
+            }
+        )
+        return content_item
 
     async def flush_memory(
         self,
@@ -450,7 +889,7 @@ class MemoryGatewayService:
     ) -> dict[str, Any]:
         return {
             "session_id": session_id,
-            "everos": await self.everos_client.flush_memory(
+            "backend": await self.backend_client.flush_memory(
                 session_id,
                 app_id,
                 project_id,
@@ -461,19 +900,29 @@ class MemoryGatewayService:
         self,
         *,
         user_id: str,
+        agent_id: str | None,
         query: str,
+        method: str,
         top_k: int,
+        radius: float | None,
+        include_profile: bool,
+        enable_llm_rerank: bool,
         app_id: str,
         project_id: str,
         filters: dict[str, Any] | None,
     ) -> dict[str, Any]:
         payload: dict[str, Any] = {
-            "user_id": user_id,
             "query": query,
+            "method": method,
             "top_k": top_k,
+            "include_profile": include_profile,
+            "enable_llm_rerank": enable_llm_rerank,
             "app_id": app_id,
             "project_id": project_id,
         }
+        payload["agent_id" if agent_id else "user_id"] = agent_id or user_id
+        if radius is not None:
+            payload["radius"] = radius
         if filters is not None:
             payload["filters"] = filters
         return payload
@@ -487,18 +936,22 @@ class MemoryGatewayService:
         user_id: str,
     ) -> list[dict[str, Any]]:
         data = response.get("data", {})
-        raw_items: list[dict[str, Any]] = []
+        raw_items: list[tuple[str, dict[str, Any]]] = []
-        for key in (
+        memory_types = {
-            "episodes",
+            "episodes": "episode",
-            "profiles",
+            "profiles": "profile",
-            "agent_cases",
+            "agent_cases": "agent_case",
-            "agent_skills",
+            "agent_skills": "agent_skill",
-            "unprocessed_messages",
+            "unprocessed_messages": "unprocessed_message",
-        ):
+        }
-            raw_items.extend(data.get(key, []) or [])
+        for key, memory_type in memory_types.items():
+            raw_items.extend(
+                (memory_type, item) for item in (data.get(key, []) or [])
+            )
 
         normalized = []
-        for raw in raw_items:
+        attachment_cache: dict[str, list[dict[str, Any]]] = {}
+        for memory_type, raw in raw_items:
             session_id = raw.get("session_id")
             resource = session_resource_map.get(session_id)
             if resource is None and isinstance(session_id, str):
@@ -506,9 +959,21 @@ class MemoryGatewayService:
                     session_id,
                     user_id,
                 )
+            attachments: list[dict[str, Any]] = []
+            if isinstance(session_id, str):
+                if session_id not in attachment_cache:
+                    attachment_cache[session_id] = (
+                        self.repository.list_attachments_for_session(
+                            user_id,
+                            session_id,
+                        )
+                    )
+                session_attachments = attachment_cache[session_id]
+                attachments = _matching_attachments(raw, session_attachments)
             normalized.append(
                 {
                     "id": raw.get("id"),
+                    "memory_type": memory_type,
                     "session_id": session_id,
                     "text": _display_text(raw),
                     "score": raw.get("score"),
@@ -517,6 +982,7 @@ class MemoryGatewayService:
                     "resource_uri": (
                         public_resource_uri(user_id, resource["id"]) if resource else None
                     ),
+                    "attachments": attachments,
                     "raw": raw,
                 }
             )
@@ -623,6 +1089,72 @@ class MemoryGatewayService:
         }
 
 
+def _combine_filters(
+    custom_filters: dict[str, Any] | None,
+    scope_filters: dict[str, Any] | None,
+) -> dict[str, Any] | None:
+    if custom_filters is None:
+        return scope_filters
+    if scope_filters is None:
+        return custom_filters
+    return {"AND": [custom_filters, scope_filters]}
+
+
+def _attachment_name(item: dict[str, Any], uri: str | None) -> str:
+    if item.get("name"):
+        return _safe_filename(str(item["name"]))
+    if uri:
+        parsed = urlparse(uri)
+        uri_name = Path(unquote(parsed.path)).name
+        if uri_name:
+            return _safe_filename(uri_name)
+    extension = str(item.get("ext") or "bin").lstrip(".") or "bin"
+    return f"attachment.{extension}"
+
+
+def _matching_attachments(
+    raw: dict[str, Any],
+    attachments: list[dict[str, Any]],
+) -> list[dict[str, Any]]:
+    strings = [value.casefold() for value in _raw_string_values(raw)]
+    matched: list[dict[str, Any]] = []
+    seen_uris: set[str] = set()
+    for attachment in attachments:
+        name = str(attachment["name"])
+        internal_uri = str(attachment["internal_uri"])
+        if internal_uri in seen_uris:
+            continue
+        if not any(name.casefold() in value for value in strings):
+            continue
+        seen_uris.add(internal_uri)
+        matched.append(
+            {
+                "type": attachment["content_type"],
+                "name": name,
+                "internal_uri": internal_uri,
+            }
+        )
+    return matched
+
+
+def _raw_string_values(value: Any, key: str | None = None) -> list[str]:
+    if key is not None and key.casefold() == "base64":
+        return []
+    if isinstance(value, str):
+        return [value]
+    if isinstance(value, dict):
+        strings: list[str] = []
+        for item_key, item_value in value.items():
+            strings.extend(_raw_string_values(item_value, str(item_key)))
+        return strings
+    if isinstance(value, list):
+        strings = []
+        for item in value:
+            strings.extend(_raw_string_values(item))
+        return strings
+    return []
+
+
 def _chunks(items: list[str], size: int) -> list[list[str]]:
     if not items:
         return []

docs/superpowers/plans/2026-06-12-memory-gateway-agent-skill.md

@@ -0,0 +1,45 @@
+# Memory Gateway Agent Skill Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Create a reusable AI-agent skill that safely operates the Memory Gateway API through a deterministic Python CLI.
+
+**Architecture:** Keep procedural guidance in `SKILL.md`, detailed endpoint schemas in `references/api.md`, and all HTTP/multipart behavior in one standard-library CLI. Read credentials from environment variables or explicit flags and never persist secrets in the skill.
+
+**Tech Stack:** Agent Skills format, Python 3 standard library, pytest, Memory Gateway HTTP API.
+
+---
+
+### Task 1: Scaffold the skill
+
+**Files:**
+- Create: `skill/memory-gateway-agent/SKILL.md`
+- Create: `skill/memory-gateway-agent/agents/openai.yaml`
+- Create: `skill/memory-gateway-agent/scripts/memory_gateway.py`
+- Create: `skill/memory-gateway-agent/references/api.md`
+
+- [x] Initialize the standard skill structure with `init_skill.py`.
+- [x] Remove generated placeholders and keep only required resources.
+
+### Task 2: Implement and test the CLI
+
+**Files:**
+- Create: `tests/test_memory_gateway_skill.py`
+- Modify: `skill/memory-gateway-agent/scripts/memory_gateway.py`
+
+- [x] Write failing tests for environment credentials, JSON requests, multipart uploads, and HTTP errors.
+- [x] Run the focused tests and confirm they fail for missing implementation.
+- [x] Implement the standard-library CLI with commands for health, users, resources, search, add/flush, override, and delete.
+- [x] Run the focused tests and confirm they pass.
+
+### Task 3: Author and validate the skill
+
+**Files:**
+- Modify: `skill/memory-gateway-agent/SKILL.md`
+- Modify: `skill/memory-gateway-agent/references/api.md`
+- Modify: `skill/memory-gateway-agent/agents/openai.yaml`
+
+- [x] Document the agent workflow, authentication rules, ownership checks, and safe handling of secrets.
+- [x] Document endpoint parameters and CLI examples in the API reference.
+- [x] Generate UI metadata with the official skill-creator script.
+- [x] Run `quick_validate.py`, CLI `--help`, focused tests, and the full project test suite.

docs/superpowers/plans/2026-06-12-upstream-brand-neutralization.md

@@ -0,0 +1,62 @@
+# Upstream Brand Neutralization Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Remove the upstream product identity from the current Memory Gateway files without changing the upstream memory HTTP protocol.
+
+**Architecture:** Replace product-specific names with `backend` terminology at configuration, client, service, API, test, and documentation boundaries. Enforce the result with a repository-level regression test that scans both file names and text content.
+
+**Tech Stack:** Python 3, FastAPI, pytest, Markdown, environment configuration.
+
+---
+
+### Task 1: Add the neutral-brand regression test
+
+**Files:**
+- Create: `tests/test_branding.py`
+
+- [x] Add a test that constructs the forbidden token from separate string fragments.
+- [x] Scan non-generated project file names and UTF-8 text contents.
+- [x] Run the test and verify it fails against the existing product-specific names.
+
+### Task 2: Rename runtime boundaries
+
+**Files:**
+- Rename: `core/backend_client.py` to `core/backend_client.py`
+- Modify: `core/api.py`
+- Modify: `core/config.py`
+- Modify: `core/service.py`
+- Modify: `core/__init__.py`
+- Modify: `.env.example`
+- Modify: `.gitignore`
+- Delete: `backend.env.example`
+
+- [x] Rename the client class, dependency attributes, retry helpers, and configuration fields to `backend` terminology.
+- [x] Rename environment variables to `MEMORY_GATEWAY_BACKEND_*`.
+- [x] Rename health and direct add/flush response fields to `backend`.
+- [x] Preserve all `/api/v1/memory/*` paths.
+
+### Task 3: Rename tests and public documentation
+
+**Files:**
+- Rename: `tests/test_backend_integration.py` to `tests/test_backend_integration.py`
+- Modify: `tests/test_gateway.py`
+- Modify: `tests/test_command.md`
+- Modify: `README.md`
+- Modify: `pyproject.toml`
+- Modify: `skill/memory-gateway-agent/SKILL.md`
+- Modify: `skill/memory-gateway-agent/references/api.md`
+
+- [x] Rename fixtures, tests, environment flags, examples, and expected JSON fields.
+- [x] Describe the dependency only as an upstream memory service.
+- [x] Update integration commands and package metadata.
+
+### Task 4: Verify the current working tree
+
+**Files:**
+- Modify: `docs/superpowers/plans/2026-06-12-upstream-brand-neutralization.md`
+
+- [x] Remove generated bytecode caches.
+- [x] Run the branding regression test.
+- [x] Run the full test suite and Python compilation.
+- [x] Run a final case-insensitive content and file-name scan, excluding `.git` history.

docs/superpowers/plans/2026-06-15-memory-attachment-path-mapping.md

@@ -0,0 +1,57 @@
+# Memory Attachment Path Mapping Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Persist attachment-to-session mappings for resource and direct memory ingestion, then return filename-matched real URIs from memory search results.
+
+**Architecture:** Add one SQLite attachment table and repository methods. Register resource files directly, materialize base64 memory attachments under Gateway storage, and enrich normalized search results by matching attachment names against recursive raw string values.
+
+**Tech Stack:** Python 3.10+, FastAPI, SQLite, Pydantic, pytest, httpx.
+
+---
+
+### Task 1: Attachment persistence
+
+**Files:**
+- Modify: `core/db.py`
+- Modify: `core/repository.py`
+- Modify: `tests/test_gateway.py`
+
+- [x] Write failing tests proving attachment records can be created, listed by user/session, deduplicated, and soft-deleted with resources.
+- [x] Run focused tests and verify failure because the table and methods do not exist.
+- [x] Add `memory_attachments`, indexes, resource backfill SQL, and focused repository methods.
+- [x] Run focused tests and verify they pass.
+
+### Task 2: Register attachments during ingestion
+
+**Files:**
+- Modify: `core/api.py`
+- Modify: `core/service.py`
+- Modify: `tests/test_gateway.py`
+
+- [x] Write failing tests for `/resources`, `/memories/add` URI items, and `/memories/add` base64 items.
+- [x] Run focused tests and verify missing mappings and files.
+- [x] Register resource mappings, pass authenticated `user_id` into add service, materialize base64 files, and persist successful add mappings.
+- [x] Run focused tests and verify they pass.
+
+### Task 3: Enrich search results
+
+**Files:**
+- Modify: `core/service.py`
+- Modify: `tests/test_gateway.py`
+
+- [x] Write failing tests for filename match, no match, base64-key exclusion, and cross-user isolation.
+- [x] Run focused tests and verify `attachments` is absent.
+- [x] Recursively collect raw strings excluding base64 and return deduplicated matching attachments.
+- [x] Run focused tests and verify they pass.
+
+### Task 4: Documentation and regression
+
+**Files:**
+- Modify: `README.md`
+- Modify: `tests/test_command.md`
+
+- [x] Document attachment persistence, historical backfill limits, matching behavior, and response shape.
+- [x] Update the search response example with `attachments`.
+- [x] Run `git diff --check`, compile checks, and the complete pytest suite.
+- [x] Review the final diff for user isolation and unintended URI exposure outside search.

docs/superpowers/plans/2026-06-15-memory-search-upstream-options.md

@@ -0,0 +1,118 @@
+# Memory Search Upstream Options Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Extend `POST /memories/search` with all upstream search options while preserving Gateway authentication, scopes, resource isolation, tombstones, and overrides.
+
+**Architecture:** Extend the existing Pydantic request model and pass the validated values through `MemoryGatewayService`. Keep scope orchestration intact, combine caller filters with scope-generated session filters using `AND`, and tag normalized results according to their upstream response array.
+
+**Tech Stack:** Python 3.10+, FastAPI, Pydantic v2, pytest, pytest-asyncio, httpx ASGI transport.
+
+---
+
+### Task 1: Search request options and defaults
+
+**Files:**
+- Modify: `tests/test_gateway.py`
+- Modify: `core/api.py`
+- Modify: `core/service.py`
+
+- [x] **Step 1: Write failing tests for defaults, custom options, and validation**
+
+Add API tests that assert a default search sends `method="hybrid"`, `include_profile=true`, and `enable_llm_rerank=true`; a custom request forwards `agent_id`, `keyword`, `radius`, `top_k=-1`, and both false flags; and invalid `method`, `radius`, and `top_k=0` return HTTP 422.
+
+- [x] **Step 2: Run tests and verify expected failures**
+
+Run:
+
+```bash
+uv run pytest tests/test_gateway.py -k 'search_forwards_default_upstream_options or search_forwards_all_upstream_options or search_rejects_invalid_upstream_options' -q
+```
+
+Expected: assertions fail because the request model and service do not yet accept or forward the new fields.
+
+- [x] **Step 3: Implement request fields and payload forwarding**
+
+Extend `SearchMemoriesRequest` with:
+
+```python
+agent_id: str | None = Field(default=None, min_length=1)
+method: Literal["keyword", "vector", "hybrid", "agentic"] = "hybrid"
+radius: float | None = Field(default=None, ge=0, le=1)
+include_profile: bool = True
+enable_llm_rerank: bool = True
+filters: dict[str, Any] | None = None
+```
+
+Validate `top_k` as `-1` or `1..100`, pass all values to the service, and make `_search_payload` select exactly one upstream owner key (`agent_id` when present, otherwise `user_id`).
+
+- [x] **Step 4: Run focused tests and verify they pass**
+
+Run the command from Step 2. Expected: all selected tests pass.
+
+### Task 2: Filter composition and result memory types
+
+**Files:**
+- Modify: `tests/test_gateway.py`
+- Modify: `core/service.py`
+
+- [x] **Step 1: Write failing tests for filter composition and result types**
+
+Add a resource-scope test asserting caller filters and `session_id in [...]` are combined as:
+
+```python
+{"AND": [caller_filters, {"session_id": {"in": [session_id]}}]}
+```
+
+Extend the fake backend to return all response arrays and assert normalized results have `memory_type` values `episode`, `profile`, `agent_case`, `agent_skill`, and `unprocessed_message`.
+
+- [x] **Step 2: Run tests and verify expected failures**
+
+Run:
+
+```bash
+uv run pytest tests/test_gateway.py -k 'search_combines_custom_and_scope_filters or search_labels_all_memory_types' -q
+```
+
+Expected: failures because caller filters are not composed and normalized results have no `memory_type`.
+
+- [x] **Step 3: Implement composition and typed normalization**
+
+Add a small `_combine_filters` helper that returns either condition directly, returns `None` when both are absent, or returns `{"AND": [custom, scope]}` when both exist. Iterate an explicit mapping from response array name to memory type in `_extract_results` and include the mapped value in every normalized result.
+
+- [x] **Step 4: Run focused tests and verify they pass**
+
+Run the command from Step 2. Expected: both tests pass.
+
+### Task 3: Documentation and regression verification
+
+**Files:**
+- Modify: `README.md`
+- Verify: `tests/test_gateway.py`
+- Verify: `tests/test_memory_gateway_skill.py`
+
+- [x] **Step 1: Update the Chinese API documentation**
+
+Document `agent_id`, `method`, `radius`, `include_profile`, `enable_llm_rerank`, `filters`, the `top_k=-1` rule, filter composition, and the `memory_type` response field. Update the curl and JSON examples with the new defaults.
+
+- [x] **Step 2: Run formatting and full tests**
+
+Run:
+
+```bash
+git diff --check
+uv run pytest -q
+```
+
+Expected: no whitespace errors and all tests pass.
+
+- [x] **Step 3: Review the final diff**
+
+Run:
+
+```bash
+git diff --stat
+git diff -- core/api.py core/service.py tests/test_gateway.py README.md
+```
+
+Expected: changes are limited to the approved search compatibility scope and documentation.

docs/superpowers/specs/2026-06-12-upstream-brand-neutralization-design.md

@@ -0,0 +1,23 @@
+# Upstream Brand Neutralization Design
+
+## Goal
+
+Remove the upstream product name from the current Memory Gateway working tree while preserving the upstream HTTP protocol and application behavior.
+
+## Scope
+
+- Rename the upstream client module, class, configuration fields, environment variables, state attributes, response fields, tests, and integration test file to neutral `backend` terminology.
+- Rewrite README, Skill documentation, examples, package metadata, and test records to describe an "upstream memory service".
+- Remove the upstream-specific environment example because its variable names identify the product.
+- Preserve `/api/v1/memory/add`, `/api/v1/memory/flush`, and `/api/v1/memory/search` paths.
+- Do not rewrite Git history.
+
+## Compatibility
+
+This is an intentional configuration and response-schema rename. Deployments must move to `MEMORY_GATEWAY_BACKEND_*` variables, and health/add/flush consumers must read the `backend` field. No legacy aliases are retained because they would defeat the neutralization requirement.
+
+## Verification
+
+- Add an automated repository scan that rejects the forbidden upstream token in current files and file names.
+- Run the full unit suite and compilation checks.
+- Run a final case-insensitive repository scan excluding `.git`, virtual environments, runtime data, and generated bytecode.

docs/superpowers/specs/2026-06-15-memory-attachment-path-mapping-design.md

@@ -0,0 +1,101 @@
+# Memory 附件真实路径映射设计
+
+## 目标
+
+让 `/resources` 和 `/memories/add` 两种摄入方式都保存附件与 session 的映射。
+`/memories/search` 返回结果时，根据结果 `session_id` 查询当前用户附件，并且只有
+当附件完整文件名出现在结果 `raw` 的字符串字段中时，才返回该附件真实 URI。
+
+## 数据模型
+
+新增 SQLite 表 `memory_attachments`：
+
+- `id TEXT PRIMARY KEY`
+- `user_id TEXT NOT NULL`
+- `app_id TEXT NOT NULL DEFAULT 'default'`
+- `project_id TEXT NOT NULL DEFAULT 'default'`
+- `session_id TEXT NOT NULL`
+- `resource_id TEXT`
+- `content_type TEXT NOT NULL`
+- `name TEXT NOT NULL`
+- `internal_uri TEXT NOT NULL`
+- `source TEXT NOT NULL`
+- `sha256 TEXT`
+- `created_at TIMESTAMP NOT NULL`
+- `deleted_at TIMESTAMP`
+
+以 `(user_id, session_id, internal_uri)` 建立唯一索引，避免幂等上传产生重复映射；
+以 `(user_id, session_id, deleted_at)` 建立查询索引。
+
+数据库初始化时，将现有未删除 `user_resources` 回填为附件映射。历史
+`/memories/add` 请求没有保存在 Gateway 数据库中，因此无法自动回填。
+
+## 摄入规则
+
+### `/resources`
+
+资源记录创建后，为保存的真实 `file://` URI 创建附件映射：
+
+- `session_id` 使用 `resource:{user_id}:{resource_id}`；
+- `resource_id` 指向资源；
+- `source` 为 `resource_upload`；
+- `content_type`、文件名、SHA256 复用资源元数据。
+
+重复资源上传时确保已有资源对应的附件映射存在。
+
+### `/memories/add`
+
+API 将已鉴权的 `user_id` 一并传给 service。逐条检查 message 的 content item：
+
+- 只有字符串 content 或纯文本 item 时不创建附件；
+- 有 `uri` 时记录该 URI，`source=memory_add_uri`；
+- 没有 `uri` 但有 `base64` 时，解码并保存到
+  `storage/{user_id}/memory_attachments/{attachment_id}/{safe_name}`，记录生成的
+  `file://` URI，`source=memory_add_base64`；
+- 同时存在 `uri` 和 `base64` 时优先使用 `uri`，不重复落盘；
+- 文件名优先使用 `name`，否则从 URI 路径或 `ext` 生成安全名称。
+
+上游 add 调用失败时，删除本次 base64 生成的文件，不写入映射。调用成功后写入
+附件映射。上游请求体保持原样，不修改现有 add 行为。
+
+## 搜索匹配规则
+
+对每条标准化搜索结果：
+
+1. 根据已鉴权 `user_id` 和结果 `session_id` 查询未删除附件；
+2. 递归遍历 `raw` 中 dict、list 的字符串值；
+3. 跳过键名为 `base64` 的值，避免扫描大块编码数据；
+4. 使用附件完整文件名做不区分大小写的子串匹配；
+5. 仅命中的附件进入 `attachments`，按 `internal_uri` 去重；
+6. 没有 session 或没有命中时返回 `attachments: []`。
+
+响应附件格式：
+
+```json
+{
+  "type": "image",
+  "name": "simple-multimodal-image.png",
+  "internal_uri": "file:///home/tom/memory-gateway/tests/simple-multimodal-image.png"
+}
+```
+
+episode 是 session 级记忆，因此只能在同一 session 的附件中按文件名匹配，不能
+证明具体附件是向量召回的直接来源。
+
+## 删除与隔离
+
+- 所有附件查询必须同时匹配 `user_id` 和 `session_id`；
+- 删除 `/resources` 时，对应附件映射设置 `deleted_at`；
+- 真实路径按用户明确要求直接出现在搜索结果中；
+- 不改变资源列表和详情现有的 `resource://` 对外 URI。
+
+## 测试
+
+- 资源上传创建附件映射；
+- 资源搜索仅在 raw 出现文件名时返回真实 URI；
+- raw 不含文件名时返回空附件数组；
+- `/memories/add` 的 URI content 创建映射；
+- `/memories/add` 的 base64 content 落盘并创建映射；
+- 不扫描 raw 中的 base64 字段；
+- 不返回其他用户同 session 的附件；
+- 现有测试继续通过。

docs/superpowers/specs/2026-06-15-memory-search-upstream-options-design.md

@@ -0,0 +1,145 @@
+# Memory Search 上游参数增量兼容设计
+
+## 目标
+
+扩展 Memory Gateway 的 `POST /memories/search`，在保留现有用户鉴权、
+`scope` 搜索编排、资源隔离、软删除和覆盖修改能力的前提下，支持上游
+搜索接口的全部请求选项。
+
+本次只修改 `/memories/search`，不新增 `/memories/get`，也不提供上游路径的
+线协议兼容接口。
+
+## 请求模型
+
+保留现有字段：
+
+- `user_id`：必填，始终用于 Gateway 用户鉴权和本地数据隔离。
+- `user_key`：必填，用于 Gateway 用户鉴权。
+- `conversation_id`：可选，供 `current_chat` scope 生成 session 过滤条件。
+- `query`：必填。
+- `scope`：保留 `current_chat`、`resources`、`all_user_memory`。
+- `app_id`、`project_id`：默认 `default`。
+
+新增或扩展字段：
+
+- `agent_id`：可选。存在时，上游搜索使用 `agent_id`；不存在时使用
+  Gateway 鉴权用户的 `user_id`。请求中不会同时向上游发送两种 owner ID。
+- `method`：支持 `keyword`、`vector`、`hybrid`、`agentic`，默认 `hybrid`。
+- `top_k`：支持 `-1` 或 `1..100`，保留 Gateway 默认值 `8`。
+- `radius`：可选，范围 `0..1`。
+- `include_profile`：布尔值，默认 `true`。
+- `enable_llm_rerank`：布尔值，默认 `true`。
+- `filters`：可选对象，支持上游开放字段过滤 DSL，包括嵌套 `AND`、`OR`。
+
+`agent_id` 只改变上游记忆 owner，不替代 Gateway 的 `user_id/user_key` 鉴权。
+这可以防止调用者绕过 Gateway 用户体系，同时允许同一已认证用户查询被授权
+使用的 agent memory。当前版本不新增 agent 权限表，因此仅校验 Gateway 用户
+凭据，不声明 agent 的独立所有权关系。
+
+## 搜索编排与过滤器合并
+
+每一次上游 search 调用都必须透传：
+
+- owner：`agent_id` 或 `user_id`，二选一；
+- `query`；
+- `method`；
+- `top_k`；
+- `radius`，仅在请求提供时发送；
+- `include_profile`；
+- `enable_llm_rerank`；
+- `app_id`；
+- `project_id`；
+- 合并后的 `filters`。
+
+现有 scope 继续生成内部 session 条件：
+
+- `current_chat`：`session_id = chat:{conversation_id}`；
+- `resources`：按批次生成 `session_id in [...]`；
+- `all_user_memory`：不生成 session 条件。
+
+当请求同时提供自定义 `filters` 和 scope session 条件时，使用以下结构合并：
+
+```json
+{
+  "AND": [
+    {"自定义过滤条件": "..."},
+    {"session_id": "scope 生成的条件"}
+  ]
+}
+```
+
+仅存在其中一个条件时直接使用该条件；两者都不存在时不发送 `filters`。
+Gateway 不解析或重写自定义过滤 DSL 的内部字段，由上游执行完整校验。
+
+`agent_id` 与所有 scope 均可组合。对于没有对应数据的组合，上游自然返回空数组；
+Gateway 不额外禁止这些组合，以保持接口简单并完整透传搜索能力。
+
+## 响应标准化
+
+继续返回 Gateway 的统一结构：
+
+```json
+{
+  "results": []
+}
+```
+
+每个结果新增 `memory_type`：
+
+| 上游数组 | `memory_type` |
+|---|---|
+| `episodes` | `episode` |
+| `profiles` | `profile` |
+| `agent_cases` | `agent_case` |
+| `agent_skills` | `agent_skill` |
+| `unprocessed_messages` | `unprocessed_message` |
+
+其余字段保持现状：`id`、`session_id`、`text`、`score`、`source_scope`、
+`resource_id`、`resource_uri` 和 `raw`。
+
+profile 和 agent skill 等没有 `session_id` 的结果允许返回 `null`。资源映射只对
+能匹配当前用户资源 session 的结果生效，不泄露其他用户的内部资源 URI。
+
+所有类型的结果继续按现有顺序执行：
+
+1. 合并各 scope 的结果；
+2. 应用当前用户的 memory tombstone；
+3. 按 memory ID 应用当前用户的 active override；
+4. 返回统一结果。
+
+## 错误处理
+
+- 不合法的 `method`、`top_k` 或 `radius` 由 Gateway 请求模型返回 HTTP 422。
+- 上游过滤 DSL 错误和其他 HTTP 错误继续由现有 client 行为向外传播。
+- 不改变当前 `current_chat` 缺少 `conversation_id` 时跳过该 scope 的行为。
+- 不为 `agent_id` 引入新的数据库表或权限模型。
+
+## 代码改动
+
+- `core/api.py`
+  - 扩展 `SearchMemoriesRequest`。
+  - 将新增参数传给 service。
+- `core/service.py`
+  - 扩展 `search_memories` 和 `_search_payload`。
+  - 合并自定义 filters 与 scope filters。
+  - 标准化结果时增加 `memory_type`。
+- `tests/test_gateway.py`
+  - 验证默认参数透传。
+  - 验证全部自定义搜索选项透传。
+  - 验证 agent owner 与用户鉴权身份分离。
+  - 验证 filters 与 scope 条件使用 `AND` 合并。
+  - 验证五类结果的 `memory_type`。
+- `README.md`
+  - 更新 `/memories/search` 参数和响应说明。
+
+## 验收标准
+
+1. 未提供新字段时，上游收到 `method=hybrid`、`include_profile=true`、
+   `enable_llm_rerank=true`。
+2. 所有上游搜索选项均能通过 Gateway 请求并原样传递。
+3. `top_k=-1` 被接受，`top_k=0` 和范围外值被拒绝。
+4. 自定义 filters 不会覆盖 scope 的资源或聊天 session 隔离条件。
+5. 设置 `agent_id` 后，上游只收到 `agent_id`，Gateway 仍使用
+   `user_id/user_key` 完成鉴权。
+6. 每个搜索结果包含准确的 `memory_type`。
+7. 现有 tombstone、override、资源 URI 隔离测试继续通过。

everos.env.example

@@ -1,36 +0,0 @@
-# EverOS server settings used by the upstream EverOS process.
-# Copy this file to everos.env or to the EverOS project .env, then fill secrets.
-
-# API listener. The Memory Gateway should point EVEROS_BASE_URL at this host/port.
-EVEROS_API__HOST=127.0.0.1
-EVEROS_API__PORT=8000
-
-# Logging
-EVEROS_LOG_LEVEL=INFO
-EVEROS_LOG_FORMAT=console
-TZ=Asia/Shanghai
-
-# LLM provider
-EVEROS_LLM__BASE_URL=https://api.openai.com/v1
-EVEROS_LLM__API_KEY=replace-with-llm-api-key
-EVEROS_LLM__MODEL=gpt-4o-mini
-EVEROS_LLM__TIMEOUT_SECONDS=120
-
-# Embedding provider
-EVEROS_EMBEDDING__BASE_URL=https://api.openai.com/v1
-EVEROS_EMBEDDING__API_KEY=replace-with-embedding-api-key
-EVEROS_EMBEDDING__MODEL=text-embedding-3-small
-EVEROS_EMBEDDING__TIMEOUT_SECONDS=120
-
-# Rerank provider
-EVEROS_RERANK__BASE_URL=https://api.example.com/v1
-EVEROS_RERANK__API_KEY=replace-with-rerank-api-key
-EVEROS_RERANK__MODEL=replace-with-rerank-model
-EVEROS_RERANK__TIMEOUT_SECONDS=120
-
-# Multimodal parsing provider
-EVEROS_MULTIMODAL__BASE_URL=https://api.openai.com/v1
-EVEROS_MULTIMODAL__API_KEY=replace-with-multimodal-api-key
-EVEROS_MULTIMODAL__MODEL=gpt-4o-mini
-EVEROS_MULTIMODAL__TIMEOUT_SECONDS=120
-EVEROS_MULTIMODAL__RESIZE_IMAGES_FOR_VLM=true

pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "memory-gateway"
 version = "0.1.0"
-description = "Lightweight Memory Gateway for EverOS user resources"
+description = "Lightweight user resource memory gateway"
 requires-python = ">=3.10"
 dependencies = [
     "fastapi>=0.104.0",
@@ -31,5 +31,5 @@ testpaths = ["tests"]
 python_files = ["test_*.py"]
 asyncio_mode = "auto"
 markers = [
-    "integration: tests that call a real EverOS service",
+    "integration: tests that call a real upstream memory service",
 ]

skill/memory-gateway-agent/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: memory-gateway-agent
+description: Use when an AI agent needs to create or authenticate a Memory Gateway user, upload and manage user resources, add or flush chat memories, search scoped memory, or apply user-approved memory corrections and deletions through the Memory Gateway HTTP API.
+---
+
+# Memory Gateway Agent
+
+Use the bundled CLI instead of constructing HTTP requests manually. It produces JSON output and uses only the Python standard library.
+
+## Configure
+
+Set these variables before authenticated operations:
+
+```bash
+export MEMORY_GATEWAY_BASE_URL="http://127.0.0.1:8010"
+export MEMORY_GATEWAY_USER_ID="u_123"
+export MEMORY_GATEWAY_USER_KEY="uk_xxx"
+SKILL_DIR="/path/to/memory-gateway-agent"
+CLI="python $SKILL_DIR/scripts/memory_gateway.py"
+```
+
+Do not write a real `user_key` into source files, prompts, logs, or committed documentation. Command-line flags may override environment variables, but environment variables are preferred because process arguments may be observable.
+
+## Workflow
+
+1. Run `$CLI health` when connectivity or upstream memory service availability is uncertain.
+2. Use an existing `user_id` and `user_key`. Run `create-user` only when the user explicitly needs a new Gateway identity.
+3. Choose the operation:
+   - Upload durable user files with `upload-resource`.
+   - Add conversational or multimodal messages with `add-memory`, then call `flush-memory`.
+   - Search with the narrowest useful scope.
+   - List or inspect resources before deleting them.
+4. Treat JSON output as the source of truth. Preserve returned `resource_id`, memory `id`, and `session_id` exactly.
+5. For override or deletion, use the memory `id` and `session_id` returned by search. Never invent IDs or apply changes across users.
+
+## Common Commands
+
+```bash
+$CLI health
+$CLI list-resources
+$CLI upload-resource ./contract.pdf --title "Contract"
+$CLI search "What are the payment terms?" --scope resources --top-k 8
+$CLI search "What did we discuss?" --scope current_chat --conversation-id c_456
+$CLI override-memory mem_abc --session-id resource:u_123:r_xxx --text "Corrected text"
+$CLI delete-memory mem_abc --session-id resource:u_123:r_xxx --reason "User requested deletion"
+```
+
+For chat ingestion, put the Gateway `messages` array in a JSON file:
+
+```bash
+$CLI add-memory --session-id chat:c_456 --messages /tmp/messages.json
+$CLI flush-memory --session-id chat:c_456
+```
+
+Read [references/api.md](references/api.md) when choosing scopes, constructing multimodal messages, interpreting errors, or using less common commands.
+
+## Safety Rules
+
+- Do not expose internal file paths. Return the Gateway's `resource://{user_id}/{resource_id}` URI to users.
+- Do not claim ingestion succeeded unless the upload status is `extracted` or flush reports success.
+- Treat `health.status = degraded` as Gateway available but upstream memory service unavailable.
+- Resource deletion is soft deletion in Gateway search scope and removes the Gateway upload copy; it does not delete upstream memory service internal indexes.
+- Memory override and deletion require an owned `resource:{user_id}:{resource_id}` or `memory_edit:{user_id}` session.
+- Ask for confirmation before destructive deletion unless the user's current request explicitly instructs deletion.

skill/memory-gateway-agent/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Memory Gateway Agent"
+  short_description: "Operate Memory Gateway resources and user memories"
+  default_prompt: "Use $memory-gateway-agent to store, search, edit, or delete user memory through Memory Gateway."

skill/memory-gateway-agent/references/api.md

@@ -0,0 +1,260 @@
+# Memory Gateway API Reference
+
+## Contents
+
+- Configuration
+- Session IDs
+- CLI commands
+- Message format
+- Search scopes
+- Errors and result handling
+
+## Configuration
+
+The CLI reads:
+
+| Variable | Default | Purpose |
+|---|---|---|
+| `MEMORY_GATEWAY_BASE_URL` | `http://127.0.0.1:8010` | Gateway URL |
+| `MEMORY_GATEWAY_USER_ID` | none | Authenticated user ID |
+| `MEMORY_GATEWAY_USER_KEY` | none | Authenticated user key |
+| `MEMORY_GATEWAY_TIMEOUT_SECONDS` | `120` | HTTP timeout |
+
+Global CLI flags `--base-url`, `--user-id`, `--user-key`, and `--timeout` override these values. Put global flags before the subcommand.
+
+## Session IDs
+
+| Memory source | Format |
+|---|---|
+| Chat | `chat:{conversation_id}` |
+| Uploaded resource | `resource:{user_id}:{resource_id}` |
+| Manual correction | `memory_edit:{user_id}` |
+
+Use the exact `session_id` returned by the API whenever possible.
+
+## CLI Commands
+
+Assume:
+
+```bash
+CLI="python skill/memory-gateway-agent/scripts/memory_gateway.py"
+```
+
+### Health
+
+```bash
+$CLI health
+```
+
+No credentials required. HTTP 200 may contain `"status": "degraded"` when upstream memory service is unavailable.
+
+### Create User
+
+```bash
+$CLI create-user u_123
+```
+
+Returns a randomly generated `user_key`. Store it securely. Repeating the same `user_id` returns the existing key.
+
+### Upload Resource
+
+```bash
+$CLI upload-resource ./document.pdf \
+  --app-id default \
+  --project-id default \
+  --title "Document title" \
+  --description "Optional description"
+```
+
+Requires credentials. Supported resources depend on the server MIME allowlist. Success returns:
+
+```json
+{
+  "resource_id": "r_xxx",
+  "session_id": "resource:u_123:r_xxx",
+  "uri": "resource://u_123/r_xxx",
+  "status": "extracted"
+}
+```
+
+`failed` means the record exists but upstream memory service ingestion failed. Identical active content for the same user/app/project may return the existing resource.
+
+### List, Get, and Delete Resources
+
+```bash
+$CLI list-resources
+$CLI get-resource r_xxx
+$CLI delete-resource r_xxx
+```
+
+Missing or foreign resource details return `{"resources": []}`. Delete excludes the resource from future `resources` searches.
+
+### Search
+
+```bash
+$CLI search "payment terms" --scope resources --top-k 8
+$CLI search "previous discussion" \
+  --scope current_chat \
+  --conversation-id c_456
+$CLI search "known preferences" --scope all_user_memory
+```
+
+Repeat `--scope` to combine scopes:
+
+```bash
+$CLI search "query" --scope current_chat --scope resources \
+  --conversation-id c_456
+```
+
+When no scope is provided, the CLI searches `resources` only unless a conversation ID is supplied; with a conversation ID it searches `current_chat` and `resources`. Explicit `current_chat` scope requires `--conversation-id`.
+
+Each result includes normalized `id`, `session_id`, `text`, `source_scope`, and optional resource metadata. The `raw` field preserves the upstream memory service response.
+
+### Add and Flush Memory
+
+Create `/tmp/messages.json` containing an array:
+
+```json
+[
+  {
+    "sender_id": "u_123",
+    "role": "user",
+    "timestamp": 1781172177000,
+    "content": [
+      {"type": "text", "text": "Remember this note"}
+    ]
+  }
+]
+```
+
+Then run:
+
+```bash
+$CLI add-memory --session-id chat:c_456 --messages /tmp/messages.json
+$CLI flush-memory --session-id chat:c_456
+```
+
+`--messages` accepts either a JSON array string or a path to a JSON file. Always flush after all messages for the session have been added.
+
+For local binary files that cannot be converted to base64 by the caller, use the
+multipart API directly. Put an `upload_id` in the content item and send a file
+field with the same name:
+
+```bash
+curl -X POST "$MEMORY_GATEWAY_BASE_URL/memories/add/multipart" \
+  -F user_id="$MEMORY_GATEWAY_USER_ID" \
+  -F user_key="$MEMORY_GATEWAY_USER_KEY" \
+  -F session_id=chat:c_456 \
+  -F app_id=default \
+  -F project_id=default \
+  -F 'messages=[
+    {
+      "sender_id": "u_123",
+      "role": "user",
+      "timestamp": 1781172177000,
+      "content": [
+        {"type": "text", "text": "Remember this image"},
+        {
+          "type": "image",
+          "upload_id": "image_1",
+          "name": "image.png",
+          "ext": "png"
+        }
+      ]
+    }
+  ]' \
+  -F 'image_1=@./image.png;type=image/png'
+```
+
+The multipart endpoint appends messages to the provided chat session. It stores
+the uploaded file under Gateway storage, forwards text/base64 content to the
+upstream memory service, and records an attachment mapping. Call `flush-memory`
+afterward when the session should be extracted and indexed. This differs from
+`upload-resource`, which creates an independent `resource:{user_id}:{resource_id}`
+session and automatically performs add plus flush for resource searches.
+
+### Override and Delete Memory
+
+Use IDs from a search result:
+
+```bash
+$CLI override-memory mem_abc \
+  --session-id resource:u_123:r_xxx \
+  --text "Corrected memory text"
+
+$CLI delete-memory mem_abc \
+  --session-id resource:u_123:r_xxx \
+  --reason "User requested deletion"
+```
+
+These operations write Gateway overrides or tombstones. They do not modify upstream memory service files directly. The server rejects sessions not owned by the authenticated user.
+
+## Message Format
+
+Each message requires:
+
+| Field | Type | Notes |
+|---|---|---|
+| `sender_id` | string | Usually the current user ID |
+| `role` | string | `user`, `assistant`, or `tool` |
+| `timestamp` | integer | Unix milliseconds, greater than zero |
+| `content` | string or array | Text or upstream memory service content items |
+
+Common content items:
+
+```json
+{"type": "text", "text": "Plain text"}
+```
+
+```json
+{
+  "type": "image",
+  "base64": "BASE64_DATA",
+  "ext": "png",
+  "name": "image.png"
+}
+```
+
+```json
+{
+  "type": "audio",
+  "base64": "BASE64_DATA",
+  "ext": "wav",
+  "name": "audio.wav"
+}
+```
+
+Prefer base64 for local binary files. A `file://` URI is only usable when upstream memory service can access the same filesystem path.
+If that shared path guarantee is not true, use `/memories/add/multipart`,
+`upload-resource`, or `/resources/external`.
+
+## Search Scopes
+
+| Scope | Behavior |
+|---|---|
+| `current_chat` | Searches `chat:{conversation_id}`; provide `--conversation-id` |
+| `resources` | Searches extracted, non-deleted resources belonging to the user/app/project |
+| `all_user_memory` | Searches user memory without a session filter |
+
+Use the narrowest scope that answers the request. This reduces unrelated results and prevents accidental cross-context use.
+
+## Errors and Result Handling
+
+The CLI exits nonzero and writes JSON to stderr:
+
+```json
+{"error": "Memory Gateway returned HTTP 401: invalid user credentials"}
+```
+
+Common statuses:
+
+| Status | Meaning |
+|---|---|
+| `401` | Invalid `user_id` or `user_key` |
+| `403` | Memory session is not owned by the user |
+| `404` | Resource not found for deletion |
+| `413` | Upload exceeds server size limit |
+| `415` | MIME type is not allowed |
+| `422` | Request fields are invalid or missing |
+
+Do not retry `401`, `403`, `413`, `415`, or `422` without changing the request. Retry connectivity or transient server failures only when appropriate for the caller's workflow.

skill/memory-gateway-agent/scripts/memory_gateway.py

@@ -0,0 +1,466 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import json
+import mimetypes
+import os
+import sys
+import uuid
+from pathlib import Path
+from typing import Any
+from urllib.error import HTTPError, URLError
+from urllib.parse import urlencode
+from urllib.request import Request, urlopen
+
+
+class GatewayError(RuntimeError):
+    pass
+
+
+class Settings:
+    def __init__(
+        self,
+        base_url: str,
+        user_id: str | None,
+        user_key: str | None,
+        timeout: float = 120.0,
+    ) -> None:
+        self.base_url = base_url.rstrip("/")
+        self.user_id = user_id
+        self.user_key = user_key
+        self.timeout = timeout
+
+    @classmethod
+    def from_env(cls) -> Settings:
+        return cls(
+            base_url=os.environ.get(
+                "MEMORY_GATEWAY_BASE_URL",
+                "http://127.0.0.1:8010",
+            ),
+            user_id=os.environ.get("MEMORY_GATEWAY_USER_ID"),
+            user_key=os.environ.get("MEMORY_GATEWAY_USER_KEY"),
+            timeout=float(os.environ.get("MEMORY_GATEWAY_TIMEOUT_SECONDS", "120")),
+        )
+
+
+class MemoryGatewayClient:
+    def __init__(
+        self,
+        base_url: str,
+        *,
+        user_id: str | None = None,
+        user_key: str | None = None,
+        timeout: float = 120.0,
+    ) -> None:
+        self.base_url = base_url.rstrip("/")
+        self.user_id = user_id
+        self.user_key = user_key
+        self.timeout = timeout
+
+    def _credentials(self) -> dict[str, str]:
+        if not self.user_id or not self.user_key:
+            raise GatewayError(
+                "user credentials are required; set MEMORY_GATEWAY_USER_ID and "
+                "MEMORY_GATEWAY_USER_KEY or pass --user-id and --user-key"
+            )
+        return {"user_id": self.user_id, "user_key": self.user_key}
+
+    def _request(
+        self,
+        method: str,
+        path: str,
+        *,
+        query: dict[str, Any] | None = None,
+        json_body: dict[str, Any] | None = None,
+        body: bytes | None = None,
+        headers: dict[str, str] | None = None,
+    ) -> dict[str, Any]:
+        url = f"{self.base_url}{path}"
+        if query:
+            url = f"{url}?{urlencode(query, doseq=True)}"
+        request_headers = dict(headers or {})
+        request_body = body
+        if json_body is not None:
+            request_body = json.dumps(json_body, ensure_ascii=False).encode("utf-8")
+            request_headers["Content-Type"] = "application/json"
+        request = Request(
+            url,
+            data=request_body,
+            headers=request_headers,
+            method=method,
+        )
+        try:
+            with urlopen(request, timeout=self.timeout) as response:
+                raw = response.read()
+        except HTTPError as exc:
+            raw = exc.read()
+            detail = _error_detail(raw, exc.reason)
+            raise GatewayError(f"Memory Gateway returned HTTP {exc.code}: {detail}") from exc
+        except URLError as exc:
+            raise GatewayError(f"cannot connect to Memory Gateway: {exc.reason}") from exc
+        if not raw:
+            return {}
+        try:
+            value = json.loads(raw.decode("utf-8"))
+        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+            raise GatewayError("Memory Gateway returned a non-JSON response") from exc
+        if not isinstance(value, dict):
+            raise GatewayError("Memory Gateway returned an unexpected JSON response")
+        return value
+
+    def health(self) -> dict[str, Any]:
+        return self._request("GET", "/health")
+
+    def create_user(self, user_id: str) -> dict[str, Any]:
+        return self._request("POST", "/users", json_body={"user_id": user_id})
+
+    def upload_resource(
+        self,
+        file_path: Path,
+        *,
+        app_id: str = "default",
+        project_id: str = "default",
+        title: str | None = None,
+        description: str | None = None,
+    ) -> dict[str, Any]:
+        if not file_path.is_file():
+            raise GatewayError(f"upload file does not exist: {file_path}")
+        fields: dict[str, str] = {
+            **self._credentials(),
+            "app_id": app_id,
+            "project_id": project_id,
+        }
+        if title is not None:
+            fields["title"] = title
+        if description is not None:
+            fields["description"] = description
+        boundary = f"memory-gateway-{uuid.uuid4().hex}"
+        mime_type = mimetypes.guess_type(file_path.name)[0] or "application/octet-stream"
+        body = _multipart_body(
+            boundary,
+            fields,
+            field_name="file",
+            file_path=file_path,
+            mime_type=mime_type,
+        )
+        return self._request(
+            "POST",
+            "/resources",
+            body=body,
+            headers={"Content-Type": f"multipart/form-data; boundary={boundary}"},
+        )
+
+    def list_resources(self) -> dict[str, Any]:
+        return self._request("GET", "/resources", query=self._credentials())
+
+    def get_resource(self, resource_id: str) -> dict[str, Any]:
+        return self._request(
+            "GET",
+            f"/resources/{resource_id}",
+            query=self._credentials(),
+        )
+
+    def delete_resource(self, resource_id: str) -> dict[str, Any]:
+        return self._request(
+            "DELETE",
+            f"/resources/{resource_id}",
+            query=self._credentials(),
+        )
+
+    def search(
+        self,
+        query: str,
+        *,
+        conversation_id: str | None = None,
+        scopes: list[str] | None = None,
+        top_k: int = 8,
+        app_id: str = "default",
+        project_id: str = "default",
+    ) -> dict[str, Any]:
+        selected_scopes = scopes or (
+            ["current_chat", "resources"] if conversation_id else ["resources"]
+        )
+        if "current_chat" in selected_scopes and not conversation_id:
+            raise GatewayError(
+                "conversation_id is required when search scope includes current_chat"
+            )
+        payload: dict[str, Any] = {
+            **self._credentials(),
+            "query": query,
+            "scope": selected_scopes,
+            "top_k": top_k,
+            "app_id": app_id,
+            "project_id": project_id,
+        }
+        if conversation_id is not None:
+            payload["conversation_id"] = conversation_id
+        return self._request("POST", "/memories/search", json_body=payload)
+
+    def add_memory(
+        self,
+        session_id: str,
+        messages: list[dict[str, Any]],
+        *,
+        app_id: str = "default",
+        project_id: str = "default",
+    ) -> dict[str, Any]:
+        return self._request(
+            "POST",
+            "/memories/add",
+            json_body={
+                **self._credentials(),
+                "session_id": session_id,
+                "messages": messages,
+                "app_id": app_id,
+                "project_id": project_id,
+            },
+        )
+
+    def flush_memory(
+        self,
+        session_id: str,
+        *,
+        app_id: str = "default",
+        project_id: str = "default",
+    ) -> dict[str, Any]:
+        return self._request(
+            "POST",
+            "/memories/flush",
+            json_body={
+                **self._credentials(),
+                "session_id": session_id,
+                "app_id": app_id,
+                "project_id": project_id,
+            },
+        )
+
+    def override_memory(
+        self,
+        memory_id: str,
+        session_id: str,
+        override_text: str,
+    ) -> dict[str, Any]:
+        return self._request(
+            "PATCH",
+            f"/memories/{memory_id}",
+            json_body={
+                **self._credentials(),
+                "session_id": session_id,
+                "override_text": override_text,
+            },
+        )
+
+    def delete_memory(
+        self,
+        memory_id: str,
+        session_id: str,
+        *,
+        reason: str | None = None,
+    ) -> dict[str, Any]:
+        payload: dict[str, Any] = {
+            **self._credentials(),
+            "session_id": session_id,
+        }
+        if reason is not None:
+            payload["reason"] = reason
+        return self._request(
+            "DELETE",
+            f"/memories/{memory_id}",
+            json_body=payload,
+        )
+
+
+def _error_detail(raw: bytes, fallback: Any) -> str:
+    try:
+        body = json.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        return str(fallback)
+    if isinstance(body, dict) and body.get("detail"):
+        return str(body["detail"])
+    return str(fallback)
+
+
+def _multipart_body(
+    boundary: str,
+    fields: dict[str, str],
+    *,
+    field_name: str,
+    file_path: Path,
+    mime_type: str,
+) -> bytes:
+    marker = boundary.encode("ascii")
+    chunks: list[bytes] = []
+    for name, value in fields.items():
+        chunks.extend(
+            [
+                b"--" + marker + b"\r\n",
+                f'Content-Disposition: form-data; name="{name}"\r\n\r\n'.encode(),
+                value.encode("utf-8"),
+                b"\r\n",
+            ]
+        )
+    chunks.extend(
+        [
+            b"--" + marker + b"\r\n",
+            (
+                f'Content-Disposition: form-data; name="{field_name}"; '
+                f'filename="{file_path.name}"\r\n'
+            ).encode(),
+            f"Content-Type: {mime_type}\r\n\r\n".encode(),
+            file_path.read_bytes(),
+            b"\r\n--" + marker + b"--\r\n",
+        ]
+    )
+    return b"".join(chunks)
+
+
+def _load_json_array(value: str) -> list[dict[str, Any]]:
+    source = Path(value)
+    text = source.read_text(encoding="utf-8") if source.is_file() else value
+    try:
+        parsed = json.loads(text)
+    except json.JSONDecodeError as exc:
+        raise GatewayError(f"invalid messages JSON: {exc}") from exc
+    if not isinstance(parsed, list) or not all(isinstance(item, dict) for item in parsed):
+        raise GatewayError("messages JSON must be an array of objects")
+    return parsed
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description="Memory Gateway agent CLI")
+    parser.add_argument("--base-url")
+    parser.add_argument("--user-id")
+    parser.add_argument("--user-key")
+    parser.add_argument("--timeout", type=float)
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    subparsers.add_parser("health")
+    create_user = subparsers.add_parser("create-user")
+    create_user.add_argument("user_id")
+
+    upload = subparsers.add_parser("upload-resource")
+    upload.add_argument("file", type=Path)
+    _add_scope_arguments(upload)
+    upload.add_argument("--title")
+    upload.add_argument("--description")
+
+    subparsers.add_parser("list-resources")
+    get_resource = subparsers.add_parser("get-resource")
+    get_resource.add_argument("resource_id")
+    delete_resource = subparsers.add_parser("delete-resource")
+    delete_resource.add_argument("resource_id")
+
+    search = subparsers.add_parser("search")
+    search.add_argument("query")
+    search.add_argument("--conversation-id")
+    search.add_argument(
+        "--scope",
+        action="append",
+        choices=["current_chat", "resources", "all_user_memory"],
+    )
+    search.add_argument("--top-k", type=int, default=8)
+    _add_scope_arguments(search)
+
+    add = subparsers.add_parser("add-memory")
+    add.add_argument("--session-id", required=True)
+    add.add_argument(
+        "--messages",
+        required=True,
+        help="JSON array or path to a JSON file containing messages",
+    )
+    _add_scope_arguments(add)
+
+    flush = subparsers.add_parser("flush-memory")
+    flush.add_argument("--session-id", required=True)
+    _add_scope_arguments(flush)
+
+    override = subparsers.add_parser("override-memory")
+    override.add_argument("memory_id")
+    override.add_argument("--session-id", required=True)
+    override.add_argument("--text", required=True)
+
+    delete_memory = subparsers.add_parser("delete-memory")
+    delete_memory.add_argument("memory_id")
+    delete_memory.add_argument("--session-id", required=True)
+    delete_memory.add_argument("--reason")
+    return parser
+
+
+def _add_scope_arguments(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument("--app-id", default="default")
+    parser.add_argument("--project-id", default="default")
+
+
+def main(argv: list[str] | None = None) -> int:
+    settings = Settings.from_env()
+    args = build_parser().parse_args(argv)
+    client = MemoryGatewayClient(
+        args.base_url or settings.base_url,
+        user_id=args.user_id or settings.user_id,
+        user_key=args.user_key or settings.user_key,
+        timeout=args.timeout or settings.timeout,
+    )
+    try:
+        result = _run_command(client, args)
+    except GatewayError as exc:
+        print(json.dumps({"error": str(exc)}, ensure_ascii=False), file=sys.stderr)
+        return 1
+    print(json.dumps(result, ensure_ascii=False, indent=2))
+    return 0
+
+
+def _run_command(client: MemoryGatewayClient, args: argparse.Namespace) -> dict[str, Any]:
+    if args.command == "health":
+        return client.health()
+    if args.command == "create-user":
+        return client.create_user(args.user_id)
+    if args.command == "upload-resource":
+        return client.upload_resource(
+            args.file,
+            app_id=args.app_id,
+            project_id=args.project_id,
+            title=args.title,
+            description=args.description,
+        )
+    if args.command == "list-resources":
+        return client.list_resources()
+    if args.command == "get-resource":
+        return client.get_resource(args.resource_id)
+    if args.command == "delete-resource":
+        return client.delete_resource(args.resource_id)
+    if args.command == "search":
+        return client.search(
+            args.query,
+            conversation_id=args.conversation_id,
+            scopes=args.scope,
+            top_k=args.top_k,
+            app_id=args.app_id,
+            project_id=args.project_id,
+        )
+    if args.command == "add-memory":
+        return client.add_memory(
+            args.session_id,
+            _load_json_array(args.messages),
+            app_id=args.app_id,
+            project_id=args.project_id,
+        )
+    if args.command == "flush-memory":
+        return client.flush_memory(
+            args.session_id,
+            app_id=args.app_id,
+            project_id=args.project_id,
+        )
+    if args.command == "override-memory":
+        return client.override_memory(args.memory_id, args.session_id, args.text)
+    if args.command == "delete-memory":
+        return client.delete_memory(
+            args.memory_id,
+            args.session_id,
+            reason=args.reason,
+        )
+    raise GatewayError(f"unsupported command: {args.command}")
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tests/test_backend_integration.py

@@ -9,31 +9,31 @@ import pytest
 
 from core.api import create_app
 from core.config import GatewayConfig
-from core.everos_client import EverOSClient
+from core.backend_client import BackendClient
 
 
 pytestmark = pytest.mark.integration
 
 
 def _integration_enabled() -> bool:
-    return os.environ.get("RUN_EVEROS_INTEGRATION") == "1"
+    return os.environ.get("RUN_BACKEND_INTEGRATION") == "1"
 
 
 def _ingest_integration_enabled() -> bool:
-    return os.environ.get("RUN_EVEROS_INGEST_INTEGRATION") == "1"
+    return os.environ.get("RUN_BACKEND_INGEST_INTEGRATION") == "1"
 
 
-def _everos_base_url() -> str:
+def _backend_base_url() -> str:
-    return os.environ.get("EVEROS_BASE_URL", "http://127.0.0.1:1995")
+    return os.environ.get("MEMORY_GATEWAY_BACKEND_BASE_URL", "http://127.0.0.1:1995")
 
 
 @pytest.mark.skipif(
     not _integration_enabled(),
-    reason="set RUN_EVEROS_INTEGRATION=1 to run against a real EverOS service",
+    reason="set RUN_BACKEND_INTEGRATION=1 to run against an upstream memory service",
 )
 @pytest.mark.asyncio
-async def test_real_everos_health_check() -> None:
+async def test_real_backend_health_check() -> None:
-    client = EverOSClient(_everos_base_url(), timeout=10)
+    client = BackendClient(_backend_base_url(), timeout=10)
 
     health = await client.health_check()
 
@@ -43,17 +43,17 @@ async def test_real_everos_health_check() -> None:
 @pytest.mark.skipif(
     not _ingest_integration_enabled(),
     reason=(
-        "set RUN_EVEROS_INGEST_INTEGRATION=1 to run real EverOS add/flush ingestion"
+        "set RUN_BACKEND_INGEST_INTEGRATION=1 to run upstream add/flush ingestion"
     ),
 )
 @pytest.mark.asyncio
-async def test_gateway_uploads_text_resource_to_real_everos(tmp_path: Path) -> None:
+async def test_gateway_uploads_text_resource_to_real_backend(tmp_path: Path) -> None:
     config = GatewayConfig(
-        everos_base_url=_everos_base_url(),
+        backend_base_url=_backend_base_url(),
         database_path=tmp_path / "gateway.sqlite3",
         storage_dir=tmp_path / "storage",
-        everos_ingest_attempts=1,
+        backend_ingest_attempts=1,
-        everos_timeout_seconds=30,
+        backend_timeout_seconds=30,
     )
     app = create_app(config=config)
     transport = httpx.ASGITransport(app=app)
@@ -69,8 +69,8 @@ async def test_gateway_uploads_text_resource_to_real_everos(tmp_path: Path) -> N
             data={"user_id": user_id, "user_key": user_key},
             files={
                 "file": (
-                    "real-everos.txt",
+                    "integration.txt",
-                    b"real everos integration",
+                    b"upstream memory service integration",
                     "text/plain",
                 )
             },

tests/test_branding.py

@@ -0,0 +1,35 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+
+PROJECT_ROOT = Path(__file__).resolve().parents[1]
+FORBIDDEN_TOKEN = "ever" + "os"
+SKIPPED_PARTS = {
+    ".git",
+    ".pytest_cache",
+    ".venv",
+    "__pycache__",
+    "data",
+}
+
+
+def test_current_project_does_not_expose_upstream_product_name() -> None:
+    matches: list[str] = []
+    for path in PROJECT_ROOT.rglob("*"):
+        relative = path.relative_to(PROJECT_ROOT)
+        if any(part in SKIPPED_PARTS for part in relative.parts):
+            continue
+        if FORBIDDEN_TOKEN in path.name.lower():
+            matches.append(f"filename: {relative}")
+        if not path.is_file():
+            continue
+        try:
+            text = path.read_text(encoding="utf-8")
+        except UnicodeDecodeError:
+            continue
+        for line_number, line in enumerate(text.splitlines(), start=1):
+            if FORBIDDEN_TOKEN in line.lower():
+                matches.append(f"content: {relative}:{line_number}")
+
+    assert matches == []

tests/test_command.md

@@ -1,143 +1,126 @@
-# Memory Gateway multimodal API test
+# Memory Gateway API curl examples
 
-This file records a real end-to-end test through **Memory Gateway**, not direct EverOS calls.
+This file keeps only the concrete API curl shapes and short notes. Replace
+`<USER_KEY>` with the key returned by `POST /users`.
 
-Gateway URL used by curl:
+Base URL used in the live deployment test:
 
 ```text
 http://127.0.0.1:8010
 ```
 
-Gateway upstream EverOS:
+Test files:
 
 ```text
-http://10.6.80.123:1995
+tests/simple-multimodal-image.png
+tests/simple-tone.wav
 ```
 
-Test assets:
+## 1. Health
-
-```text
-/home/tom/memory-gateway/tests/simple-multimodal-image.png
-/home/tom/memory-gateway/tests/simple-tone.wav
-```
-
-Asset check:
-
-```text
-tests/simple-multimodal-image.png: PNG image data, 96 x 64, 8-bit/color RGB, non-interlaced
-tests/simple-tone.wav:             RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 8000 Hz
-```
-
-## Start Gateway
-
-Command:
 
 ```bash
-cd /home/tom/memory-gateway
+curl -sS http://127.0.0.1:8010/health
-
-EVEROS_BASE_URL=http://10.6.80.123:1995 \
-MEMORY_GATEWAY_DB_PATH=/tmp/memory_gateway_curl.sqlite3 \
-MEMORY_GATEWAY_STORAGE_DIR=/tmp/memory_gateway_curl_storage \
-MEMORY_GATEWAY_HOST=127.0.0.1 \
-MEMORY_GATEWAY_PORT=8010 \
-.venv/bin/python main.py
 ```
 
-Observed startup:
+Expected shape:
-
-```text
-INFO:     Started server process [771099]
-INFO:     Waiting for application startup.
-INFO:     Application startup complete.
-INFO:     Uvicorn running on http://127.0.0.1:8010 (Press CTRL+C to quit)
-```
-
-## 1. Create Gateway user
-
-Request:
-
-```bash
-curl -sS --location 'http://127.0.0.1:8010/users' \
-  --header 'Content-Type: application/json' \
-  --data '{
-    "user_id": "gateway_user_20260611180257"
-  }'
-```
-
-Response:
 
 ```json
 {
-  "user_id": "gateway_user_20260611180257",
+  "status": "ok",
-  "user_key": "uk_REDACTED",
+  "api": {"status": "ok"},
-  "created_at": "2026-06-11T10:02:57.435437+00:00"
+  "backend": {
+    "status": "ok",
+    "base_url": "http://0.0.0.0:1995",
+    "data": {"status": "ok"}
+  }
 }
 ```
 
-HTTP metadata:
+## 2. Create user
 
-```text
+```bash
-HTTP_STATUS:200
+curl -sS -X POST http://127.0.0.1:8010/users \
-TOTAL_TIME:0.022431
+  -H 'Content-Type: application/json' \
+  -d '{"user_id":"gateway_demo_user"}'
 ```
 
-## 2. Add text + audio(base64) + image(file) through Gateway
+Expected shape:
+
+```json
+{
+  "user_id": "gateway_demo_user",
+  "user_key": "uk_REDACTED",
+  "created_at": "2026-06-22T06:54:35.823262+00:00"
+}
+```
+
+Use the returned `user_key` in later requests.
+
+## 3. Add chat memory with multipart files
+
+Use this when files belong to a chat/session message and the client should not
+or cannot convert the files to base64.
+
+`upload_id` rules:
+
+- `upload_id` is defined by the caller.
+- Gateway does not generate it.
+- Gateway does not require a format such as `user_id_filetype_number`.
+- It only needs to be non-empty, unique inside the request, and equal to the
+  multipart file field name.
+- Good simple values are `image_1`, `image_2`, `audio_1`, `doc_1`.
+
+In the `messages` JSON, `upload_id: "image_1"` points to this file field:
+
+```bash
+-F 'image_1=@tests/simple-multimodal-image.png;type=image/png'
+```
 
 Request:
 
 ```bash
-cd /home/tom/memory-gateway
+curl -sS -X POST http://127.0.0.1:8010/memories/add/multipart \
-
+  -F 'user_id=gateway_demo_user' \
-USER_ID="gateway_user_20260611180257"
+  -F 'user_key=<USER_KEY>' \
-USER_KEY="uk_REDACTED"
+  -F 'session_id=chat:gateway_demo_conversation' \
-CONVERSATION_ID="gateway-multimodal-20260611180257"
+  -F 'app_id=default' \
-SESSION_ID="chat:${CONVERSATION_ID}"
+  -F 'project_id=default' \
-TIMESTAMP_MS="1781172177000"
+  -F 'messages=[
-AUDIO_BASE64="$(base64 -w0 tests/simple-tone.wav)"
+    {
-
+      "sender_id": "gateway_demo_user",
-curl -sS --location 'http://127.0.0.1:8010/memories/add' \
+      "role": "user",
-  --header 'Content-Type: application/json' \
+      "timestamp": 1782111275810,
-  --data "{
+      "content": [
-    \"user_id\": \"${USER_ID}\",
+        {
-    \"user_key\": \"${USER_KEY}\",
+          "type": "text",
-    \"session_id\": \"${SESSION_ID}\",
+          "text": "请记住这次上传：图片里有左上红色方块、右上蓝色圆形、底部绿色横条；音频是一段短促测试音。"
-    \"app_id\": \"default\",
+        },
-    \"project_id\": \"default\",
+        {
-    \"messages\": [
+          "type": "image",
-      {
+          "upload_id": "image_1",
-        \"sender_id\": \"${USER_ID}\",
+          "name": "simple-multimodal-image.png",
-        \"role\": \"user\",
+          "ext": "png"
-        \"timestamp\": ${TIMESTAMP_MS},
+        },
-        \"content\": [
+        {
-          {
+          "type": "audio",
-            \"type\": \"text\",
+          "upload_id": "audio_1",
-            \"text\": \"请通过 Memory Gateway 同时记住这段文字、音频和图片：图片里有左侧红色方块、右侧蓝色圆形、底部绿色横条；音频是一段短促的测试音。以后可能会问图片中各个物体的位置和颜色。\"
+          "name": "simple-tone.wav",
-          },
+          "ext": "wav"
-          {
+        }
-            \"type\": \"audio\",
+      ]
-            \"base64\": \"${AUDIO_BASE64}\",
+    }
-            \"ext\": \"wav\",
+  ]' \
-            \"name\": \"simple-tone.wav\"
+  -F 'image_1=@tests/simple-multimodal-image.png;type=image/png' \
-          },
+  -F 'audio_1=@tests/simple-tone.wav;type=audio/wav'
-          {
-            \"type\": \"image\",
-            \"uri\": \"file:///home/tom/memory-gateway/tests/simple-multimodal-image.png\",
-            \"ext\": \"png\",
-            \"name\": \"simple-multimodal-image.png\"
-          }
-        ]
-      }
-    ]
-  }"
 ```
 
-Response:
+Expected shape:
 
 ```json
 {
-  "session_id": "chat:gateway-multimodal-20260611180257",
+  "session_id": "chat:gateway_demo_conversation",
-  "everos": {
+  "backend": {
-    "request_id": "c9e24b8d27ee4ad08a8df70273336637",
+    "request_id": "0d6451f4077040e4af207cc6b034ea34",
     "data": {
       "message_count": 1,
       "status": "accumulated"
@@ -146,66 +129,56 @@ Response:
 }
 ```
 
-HTTP metadata:
+Gateway stores the uploaded files and forwards upstream-compatible `base64` or
+`text` content. The client does not send `file://` and does not send base64.
 
-```text
+Common errors:
-HTTP_STATUS:200
-TOTAL_TIME:1.552665
-```
 
-## 3. Flush through Gateway
+- Missing file field for an `upload_id`: `422`
+- Duplicate `upload_id`: `422`
+- Extra uploaded file field not referenced by `messages`: `422`
+- Unsupported MIME type: `415`
+- File too large: `413`
 
-Request:
+## 4. Flush chat session
+
+`/memories/add/multipart` only appends messages. Call flush when the session
+should be extracted and indexed.
 
 ```bash
-curl -sS --location 'http://127.0.0.1:8010/memories/flush' \
+curl -sS -X POST http://127.0.0.1:8010/memories/flush \
-  --header 'Content-Type: application/json' \
+  -H 'Content-Type: application/json' \
-  --data '{
+  -d '{
-    "user_id": "gateway_user_20260611180257",
+    "user_id": "gateway_demo_user",
-    "user_key": "uk_REDACTED",
+    "user_key": "<USER_KEY>",
-    "session_id": "chat:gateway-multimodal-20260611180257",
+    "session_id": "chat:gateway_demo_conversation",
     "app_id": "default",
     "project_id": "default"
   }'
 ```
 
-Response:
+Expected shape:
 
 ```json
 {
-  "session_id": "chat:gateway-multimodal-20260611180257",
+  "session_id": "chat:gateway_demo_conversation",
-  "everos": {
+  "backend": {
-    "request_id": "8eb7d5db2d3b43f4999f445aabb813b1",
+    "request_id": "4df5415115a34f109c564abd2f9012c6",
-    "data": {
+    "data": {"status": "extracted"}
-      "status": "extracted"
-    }
   }
 }
 ```
 
-HTTP metadata:
+## 5. Search chat session
-
-```text
-HTTP_STATUS:200
-TOTAL_TIME:2.135721
-```
-
-## 4. Search through Gateway
-
-EverOS indexing can lag briefly after `flush`, so this test waited about 2 seconds before searching.
-
-Request:
 
 ```bash
-sleep 2
+curl -sS -X POST http://127.0.0.1:8010/memories/search \
-
+  -H 'Content-Type: application/json' \
-curl -sS --location 'http://127.0.0.1:8010/memories/search' \
+  -d '{
-  --header 'Content-Type: application/json' \
+    "user_id": "gateway_demo_user",
-  --data '{
+    "user_key": "<USER_KEY>",
-    "user_id": "gateway_user_20260611180257",
+    "conversation_id": "gateway_demo_conversation",
-    "user_key": "uk_REDACTED",
+    "query": "图片里的蓝色圆形在哪里？底部是什么颜色的横条？",
-    "conversation_id": "gateway-multimodal-20260611180257",
-    "query": "图片里的蓝色圆形在哪里？音频是什么？",
     "scope": ["current_chat"],
     "top_k": 5,
     "app_id": "default",
@@ -213,241 +186,96 @@ curl -sS --location 'http://127.0.0.1:8010/memories/search' \
   }'
 ```
 
-Response:
+Expected result excerpt:
 
 ```json
 {
   "results": [
     {
-      "id": "gateway_user_20260611180257_ep_20260611_00000001",
+      "session_id": "chat:gateway_demo_conversation",
-      "session_id": "chat:gateway-multimodal-20260611180257",
-      "text": "On June 11, 2026 at 10:02 AM UTC, user gateway_user_20260611180257 uploaded a multimodal memory package via Memory Gateway. The package included an image file named simple-multimodal-image.png and a short test audio clip. The image displayed three geometric shapes on a light gray background: a solid red square in the upper-left, a solid blue circle in the upper-right (horizontally aligned with the square), and a long, thin green horizontal rectangle spanning the bottom below both shapes. The user instructed the system to retain these details, anticipating future queries regarding the objects' positions and colors.",
-      "score": 0.6069304347038269,
       "source_scope": "current_chat",
-      "resource_id": null,
+      "text": "The image contained a red square, a blue circle, and a green horizontal rectangle.",
-      "resource_uri": null,
+      "attachments": [
-      "raw": {
+        {
-        "id": "gateway_user_20260611180257_ep_20260611_00000001",
+          "type": "image",
-        "user_id": "gateway_user_20260611180257",
+          "name": "simple-multimodal-image.png",
-        "app_id": "default",
+          "internal_uri": "file:///home/tom/memory-gateway/data/storage/..."
-        "project_id": "default",
+        },
-        "session_id": "chat:gateway-multimodal-20260611180257",
+        {
-        "timestamp": "2026-06-11T10:02:57Z",
+          "type": "audio",
-        "sender_ids": [
+          "name": "simple-tone.wav",
-          "gateway_user_20260611180257"
+          "internal_uri": "file:///home/tom/memory-gateway/data/storage/..."
-        ],
+        }
-        "summary": "On June 11, 2026 at 10:02 AM UTC, user gateway_user_20260611180257 uploaded a multimodal memory package via Memory Gateway. The package included an image file named simple-multimodal-image.png and a s",
+      ]
-        "subject": "gateway_user_20260611180257 Multimodal Memory Upload June 11, 2026",
-        "episode": "On June 11, 2026 at 10:02 AM UTC, user gateway_user_20260611180257 uploaded a multimodal memory package via Memory Gateway. The package included an image file named simple-multimodal-image.png and a short test audio clip. The image displayed three geometric shapes on a light gray background: a solid red square in the upper-left, a solid blue circle in the upper-right (horizontally aligned with the square), and a long, thin green horizontal rectangle spanning the bottom below both shapes. The user instructed the system to retain these details, anticipating future queries regarding the objects' positions and colors.",
-        "type": "Conversation",
-        "score": 0.6069304347038269,
-        "atomic_facts": [
-          {
-            "id": "gateway_user_20260611180257_af_20260611_00000004",
-            "content": "gateway_user_20260611180257 stated that questions about the positions and colors of the objects in the image might be asked in the future.",
-            "score": 0.6069304347038269
-          }
-        ]
-      }
     }
   ]
 }
 ```
 
-HTTP metadata:
+## 6. Upload an independent resource
 
-```text
+Use `/resources` when the file is an independent resource, not just an
-HTTP_STATUS:200
+attachment inside one chat message.
-TOTAL_TIME:0.064128
-```
-
-# Other Memory Gateway API tests
-
-The following calls used a temporary Gateway database and storage directory. All requests target Memory Gateway at `http://127.0.0.1:8010`.
-
-## 5. Health
-
-Request:
 
 ```bash
-curl -sS --location 'http://127.0.0.1:8010/health'
+curl -sS -X POST http://127.0.0.1:8010/resources \
+  -F 'user_id=gateway_demo_user' \
+  -F 'user_key=<USER_KEY>' \
+  -F 'app_id=default' \
+  -F 'project_id=default' \
+  -F 'title=Gateway demo image resource' \
+  -F 'description=Demo upload for simple multimodal image' \
+  -F 'file=@tests/simple-multimodal-image.png;type=image/png'
 ```
 
-Response:
+Expected shape:
 
 ```json
 {
-  "status": "ok",
+  "resource_id": "r_1678eacf3e8c49f9a8863454c5b35e68",
-  "api": {"status": "ok"},
+  "session_id": "resource:gateway_demo_user:r_1678eacf3e8c49f9a8863454c5b35e68",
-  "everos": {
+  "uri": "resource://gateway_demo_user/r_1678eacf3e8c49f9a8863454c5b35e68",
-    "status": "ok",
-    "base_url": "http://10.6.80.123:1995",
-    "data": {"status": "ok"}
-  }
-}
-```
-
-```text
-HTTP_STATUS:200
-TOTAL_TIME:0.034914
-```
-
-## 6. Invalid credentials
-
-Request:
-
-```bash
-curl -sS --location \
-  'http://127.0.0.1:8010/resources?user_id=other_api_20260612095541&user_key=wrong-key'
-```
-
-Response:
-
-```json
-{"detail":"invalid user credentials"}
-```
-
-```text
-HTTP_STATUS:401
-TOTAL_TIME:0.001447
-```
-
-## 7. Upload resource
-
-The temporary test user was created with:
-
-```bash
-curl -sS --location 'http://127.0.0.1:8010/users' \
-  --header 'Content-Type: application/json' \
-  --data '{"user_id":"other_api_20260612095541"}'
-```
-
-User response:
-
-```json
-{
-  "user_id": "other_api_20260612095541",
-  "user_key": "uk_REDACTED",
-  "created_at": "2026-06-12T01:55:41.448076+00:00"
-}
-```
-
-Upload request:
-
-```bash
-cd /home/tom/memory-gateway
-
-curl -sS --location 'http://127.0.0.1:8010/resources' \
-  --form 'user_id=other_api_20260612095541' \
-  --form 'user_key=uk_REDACTED' \
-  --form 'app_id=default' \
-  --form 'project_id=default' \
-  --form 'title=Gateway API image resource' \
-  --form 'description=Resource lifecycle test through Memory Gateway' \
-  --form 'file=@tests/simple-multimodal-image.png;type=image/png'
-```
-
-Response:
-
-```json
-{
-  "resource_id": "r_2700e435f72a49e6a7f736d17f8c7ac7",
-  "session_id": "resource:other_api_20260612095541:r_2700e435f72a49e6a7f736d17f8c7ac7",
-  "uri": "resource://other_api_20260612095541/r_2700e435f72a49e6a7f736d17f8c7ac7",
   "status": "extracted"
 }
 ```
 
-```text
+Unlike `/memories/add/multipart`, `/resources` automatically calls upstream add
-HTTP_STATUS:200
+and flush.
-TOTAL_TIME:4.700296
-```
 
-## 8. List resources
+## 7. List resources
-
-Request:
 
 ```bash
-curl -sS --location \
+curl -sS \
-  'http://127.0.0.1:8010/resources?user_id=other_api_20260612095541&user_key=uk_REDACTED'
+  'http://127.0.0.1:8010/resources?user_id=gateway_demo_user&user_key=<USER_KEY>'
 ```
 
-Response:
+Expected shape:
 
 ```json
 {
   "resources": [
     {
-      "resource_id": "r_2700e435f72a49e6a7f736d17f8c7ac7",
+      "resource_id": "r_1678eacf3e8c49f9a8863454c5b35e68",
-      "user_id": "other_api_20260612095541",
       "filename": "simple-multimodal-image.png",
       "content_type": "image",
       "mime_type": "image/png",
-      "uri": "resource://other_api_20260612095541/r_2700e435f72a49e6a7f736d17f8c7ac7",
+      "uri": "resource://gateway_demo_user/r_1678eacf3e8c49f9a8863454c5b35e68",
-      "session_id": "resource:other_api_20260612095541:r_2700e435f72a49e6a7f736d17f8c7ac7",
+      "session_id": "resource:gateway_demo_user:r_1678eacf3e8c49f9a8863454c5b35e68",
-      "status": "extracted",
+      "status": "extracted"
-      "title": "Gateway API image resource",
-      "description": "Resource lifecycle test through Memory Gateway",
-      "created_at": "2026-06-12T01:55:41.527716+00:00",
-      "updated_at": "2026-06-12T01:55:46.204082+00:00"
     }
   ]
 }
 ```
 
-```text
+## 8. Search resources
-HTTP_STATUS:200
-TOTAL_TIME:0.001785
-```
-
-## 9. Resource detail
-
-Request:
 
 ```bash
-curl -sS --location \
+curl -sS -X POST http://127.0.0.1:8010/memories/search \
-  'http://127.0.0.1:8010/resources/r_2700e435f72a49e6a7f736d17f8c7ac7?user_id=other_api_20260612095541&user_key=uk_REDACTED'
+  -H 'Content-Type: application/json' \
-```
+  -d '{
-
+    "user_id": "gateway_demo_user",
-Response:
+    "user_key": "<USER_KEY>",
-
+    "query": "这张资源图片里有哪些几何图形和颜色？",
-```json
-{
-  "resources": [
-    {
-      "resource_id": "r_2700e435f72a49e6a7f736d17f8c7ac7",
-      "user_id": "other_api_20260612095541",
-      "filename": "simple-multimodal-image.png",
-      "content_type": "image",
-      "mime_type": "image/png",
-      "uri": "resource://other_api_20260612095541/r_2700e435f72a49e6a7f736d17f8c7ac7",
-      "session_id": "resource:other_api_20260612095541:r_2700e435f72a49e6a7f736d17f8c7ac7",
-      "status": "extracted",
-      "title": "Gateway API image resource",
-      "description": "Resource lifecycle test through Memory Gateway",
-      "created_at": "2026-06-12T01:55:41.527716+00:00",
-      "updated_at": "2026-06-12T01:55:46.204082+00:00"
-    }
-  ]
-}
-```
-
-```text
-HTTP_STATUS:200
-TOTAL_TIME:0.001634
-```
-
-## 10. Search resource memory
-
-Request:
-
-```bash
-curl -sS --location 'http://127.0.0.1:8010/memories/search' \
-  --header 'Content-Type: application/json' \
-  --data '{
-    "user_id": "other_api_20260612095541",
-    "user_key": "uk_REDACTED",
-    "query": "图片中有哪些颜色和形状？",
     "scope": ["resources"],
     "top_k": 5,
     "app_id": "default",
@@ -455,251 +283,43 @@ curl -sS --location 'http://127.0.0.1:8010/memories/search' \
   }'
 ```
 
-Response:
+Expected result excerpt:
 
 ```json
 {
   "results": [
     {
-      "id": "other_api_20260612095541_ep_20260612_00000001",
-      "session_id": "resource:other_api_20260612095541:r_2700e435f72a49e6a7f736d17f8c7ac7",
-      "text": "On June 12, 2026 at 01:55 AM UTC, the user other_api_20260612095541 uploaded an image titled 'simple-multimodal-image.png' for visual analysis. The image displayed three distinct geometric shapes on a plain, light gray background. The composition included a solid red square in the upper-left portion, a solid blue circle in the upper-right portion, and a long, thin, horizontal green rectangle situated below both shapes. The red square and blue circle were roughly aligned horizontally, while the green rectangle spanned a width greater than either of the upper shapes.",
-      "score": 0.6418947577476501,
       "source_scope": "resources",
-      "resource_id": "r_2700e435f72a49e6a7f736d17f8c7ac7",
+      "resource_id": "r_1678eacf3e8c49f9a8863454c5b35e68",
-      "resource_uri": "resource://other_api_20260612095541/r_2700e435f72a49e6a7f736d17f8c7ac7",
+      "resource_uri": "resource://gateway_demo_user/r_1678eacf3e8c49f9a8863454c5b35e68",
-      "raw": {
+      "text": "The image displayed a red square, a blue circle, and a green rectangle.",
-        "id": "other_api_20260612095541_ep_20260612_00000001",
+      "attachments": [
-        "user_id": "other_api_20260612095541",
+        {
-        "app_id": "default",
+          "type": "image",
-        "project_id": "default",
+          "name": "simple-multimodal-image.png",
-        "session_id": "resource:other_api_20260612095541:r_2700e435f72a49e6a7f736d17f8c7ac7",
+          "internal_uri": "file:///home/tom/memory-gateway/data/storage/..."
-        "timestamp": "2026-06-12T01:55:41.541000Z",
+        }
-        "sender_ids": ["other_api_20260612095541"],
+      ]
-        "summary": "On June 12, 2026 at 01:55 AM UTC, the user other_api_20260612095541 uploaded an image titled 'simple-multimodal-image.png' for visual analysis. The image displayed three distinct geometric shapes on a",
-        "subject": "Visual Analysis of Geometric Shapes Uploaded by other_api_20260612095541 on June 12, 2026",
-        "episode": "On June 12, 2026 at 01:55 AM UTC, the user other_api_20260612095541 uploaded an image titled 'simple-multimodal-image.png' for visual analysis. The image displayed three distinct geometric shapes on a plain, light gray background. The composition included a solid red square in the upper-left portion, a solid blue circle in the upper-right portion, and a long, thin, horizontal green rectangle situated below both shapes. The red square and blue circle were roughly aligned horizontally, while the green rectangle spanned a width greater than either of the upper shapes.",
-        "type": "Conversation",
-        "score": 0.6418947577476501,
-        "atomic_facts": [
-          {
-            "id": "other_api_20260612095541_af_20260612_00000001",
-            "content": "The image displays three distinct geometric shapes on a plain, light gray background.",
-            "score": 0.6418947577476501
-          }
-        ]
-      }
     }
   ]
 }
 ```
 
-```text
+## Multipart vs resources
-HTTP_STATUS:200
-TOTAL_TIME:0.176981
-```
 
-## 11. Override memory
+Use `/memories/add/multipart` when the upload belongs to a chat/session message:
 
-Request:
+- caller supplies `session_id`, usually `chat:{conversation_id}`;
+- caller defines `upload_id` values in `messages`;
+- caller uploads files as form fields with names matching `upload_id`;
+- Gateway only calls upstream add;
+- caller should call `/memories/flush`;
+- search normally uses `current_chat` or `all_user_memory`.
 
-```bash
+Use `/resources` when the upload is an independent resource:
-curl -sS --location --request PATCH \
-  'http://127.0.0.1:8010/memories/other_api_20260612095541_ep_20260612_00000001' \
-  --header 'Content-Type: application/json' \
-  --data '{
-    "user_id": "other_api_20260612095541",
-    "user_key": "uk_REDACTED",
-    "session_id": "resource:other_api_20260612095541:r_2700e435f72a49e6a7f736d17f8c7ac7",
-    "override_text": "OVERRIDE: 图片左侧是红色方块，右侧是蓝色圆形，底部是绿色横条。"
-  }'
-```
 
-Response:
+- Gateway creates `resource_id`;
-
+- Gateway creates `session_id = resource:{user_id}:{resource_id}`;
-```json
+- Gateway writes `user_resources`;
-{
+- Gateway automatically calls upstream add and flush;
-  "memory_id": "other_api_20260612095541_ep_20260612_00000001",
+- search normally uses `resources`.
-  "override_id": "o_328f03b40b164c4896640fd2567042cb",
-  "status": "active"
-}
-```
-
-```text
-HTTP_STATUS:200
-TOTAL_TIME:0.007037
-```
-
-The next search returned the overridden text:
-
-Request:
-
-```bash
-curl -sS --location 'http://127.0.0.1:8010/memories/search' \
-  --header 'Content-Type: application/json' \
-  --data '{
-    "user_id": "other_api_20260612095541",
-    "user_key": "uk_REDACTED",
-    "query": "图片中有哪些颜色和形状？",
-    "scope": ["resources"],
-    "top_k": 5,
-    "app_id": "default",
-    "project_id": "default"
-  }'
-```
-
-```json
-{
-  "results": [
-    {
-      "id": "other_api_20260612095541_ep_20260612_00000001",
-      "session_id": "resource:other_api_20260612095541:r_2700e435f72a49e6a7f736d17f8c7ac7",
-      "text": "OVERRIDE: 图片左侧是红色方块，右侧是蓝色圆形，底部是绿色横条。",
-      "score": 0.6418947577476501,
-      "source_scope": "resources",
-      "resource_id": "r_2700e435f72a49e6a7f736d17f8c7ac7",
-      "resource_uri": "resource://other_api_20260612095541/r_2700e435f72a49e6a7f736d17f8c7ac7",
-      "raw": {
-        "id": "other_api_20260612095541_ep_20260612_00000001",
-        "user_id": "other_api_20260612095541",
-        "app_id": "default",
-        "project_id": "default",
-        "session_id": "resource:other_api_20260612095541:r_2700e435f72a49e6a7f736d17f8c7ac7",
-        "timestamp": "2026-06-12T01:55:41.541000Z",
-        "sender_ids": ["other_api_20260612095541"],
-        "summary": "On June 12, 2026 at 01:55 AM UTC, the user other_api_20260612095541 uploaded an image titled 'simple-multimodal-image.png' for visual analysis. The image displayed three distinct geometric shapes on a",
-        "subject": "Visual Analysis of Geometric Shapes Uploaded by other_api_20260612095541 on June 12, 2026",
-        "episode": "On June 12, 2026 at 01:55 AM UTC, the user other_api_20260612095541 uploaded an image titled 'simple-multimodal-image.png' for visual analysis. The image displayed three distinct geometric shapes on a plain, light gray background. The composition included a solid red square in the upper-left portion, a solid blue circle in the upper-right portion, and a long, thin, horizontal green rectangle situated below both shapes. The red square and blue circle were roughly aligned horizontally, while the green rectangle spanned a width greater than either of the upper shapes.",
-        "type": "Conversation",
-        "score": 0.6418947577476501,
-        "atomic_facts": [
-          {
-            "id": "other_api_20260612095541_af_20260612_00000001",
-            "content": "The image displays three distinct geometric shapes on a plain, light gray background.",
-            "score": 0.6418947577476501
-          }
-        ]
-      },
-      "override_id": "o_328f03b40b164c4896640fd2567042cb"
-    }
-  ]
-}
-```
-
-```text
-HTTP_STATUS:200
-TOTAL_TIME:0.055485
-```
-
-## 12. Delete memory with tombstone
-
-Request:
-
-```bash
-curl -sS --location --request DELETE \
-  'http://127.0.0.1:8010/memories/other_api_20260612095541_ep_20260612_00000001' \
-  --header 'Content-Type: application/json' \
-  --data '{
-    "user_id": "other_api_20260612095541",
-    "user_key": "uk_REDACTED",
-    "session_id": "resource:other_api_20260612095541:r_2700e435f72a49e6a7f736d17f8c7ac7",
-    "reason": "Gateway API tombstone test"
-  }'
-```
-
-Response:
-
-```json
-{
-  "memory_id": "other_api_20260612095541_ep_20260612_00000001",
-  "tombstone_id": "t_2cba49bf3b6641ea96865612deebc036",
-  "status": "deleted"
-}
-```
-
-```text
-HTTP_STATUS:200
-TOTAL_TIME:0.006502
-```
-
-Repeating the resource search after creating the tombstone:
-
-```bash
-curl -sS --location 'http://127.0.0.1:8010/memories/search' \
-  --header 'Content-Type: application/json' \
-  --data '{
-    "user_id": "other_api_20260612095541",
-    "user_key": "uk_REDACTED",
-    "query": "图片中有哪些颜色和形状？",
-    "scope": ["resources"],
-    "top_k": 5,
-    "app_id": "default",
-    "project_id": "default"
-  }'
-```
-
-```json
-{"results":[]}
-```
-
-```text
-HTTP_STATUS:200
-TOTAL_TIME:0.067841
-```
-
-## 13. Delete resource
-
-Request:
-
-```bash
-curl -sS --location --request DELETE \
-  'http://127.0.0.1:8010/resources/r_2700e435f72a49e6a7f736d17f8c7ac7?user_id=other_api_20260612095541&user_key=uk_REDACTED'
-```
-
-Response:
-
-```json
-{
-  "resource_id": "r_2700e435f72a49e6a7f736d17f8c7ac7",
-  "session_id": "resource:other_api_20260612095541:r_2700e435f72a49e6a7f736d17f8c7ac7",
-  "uri": "resource://other_api_20260612095541/r_2700e435f72a49e6a7f736d17f8c7ac7",
-  "status": "deleted"
-}
-```
-
-```text
-HTTP_STATUS:200
-TOTAL_TIME:0.014089
-```
-
-List after deletion:
-
-```bash
-curl -sS --location \
-  'http://127.0.0.1:8010/resources?user_id=other_api_20260612095541&user_key=uk_REDACTED'
-```
-
-```json
-{"resources":[]}
-```
-
-```text
-HTTP_STATUS:200
-TOTAL_TIME:0.001226
-```
-
-Detail after deletion:
-
-```bash
-curl -sS --location \
-  'http://127.0.0.1:8010/resources/r_2700e435f72a49e6a7f736d17f8c7ac7?user_id=other_api_20260612095541&user_key=uk_REDACTED'
-```
-
-```json
-{"resources":[]}
-```
-
-```text
-HTTP_STATUS:200
-TOTAL_TIME:0.001223
-```

tests/test_memory_gateway_skill.py

@@ -0,0 +1,204 @@
+from __future__ import annotations
+
+import importlib.util
+import json
+from pathlib import Path
+from urllib.error import HTTPError
+
+import pytest
+
+
+SCRIPT_PATH = (
+    Path(__file__).parents[1]
+    / "skill"
+    / "memory-gateway-agent"
+    / "scripts"
+    / "memory_gateway.py"
+)
+
+
+def load_cli():
+    spec = importlib.util.spec_from_file_location("memory_gateway_skill_cli", SCRIPT_PATH)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+class FakeResponse:
+    def __init__(self, body: dict[str, object], status: int = 200) -> None:
+        self.body = json.dumps(body).encode()
+        self.status = status
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *args: object) -> None:
+        return None
+
+    def read(self) -> bytes:
+        return self.body
+
+    def close(self) -> None:
+        return None
+
+
+def test_settings_read_gateway_credentials_from_environment(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    cli = load_cli()
+    monkeypatch.setenv("MEMORY_GATEWAY_BASE_URL", "http://gateway.test/")
+    monkeypatch.setenv("MEMORY_GATEWAY_USER_ID", "u_agent")
+    monkeypatch.setenv("MEMORY_GATEWAY_USER_KEY", "uk_secret")
+
+    settings = cli.Settings.from_env()
+
+    assert settings.base_url == "http://gateway.test"
+    assert settings.user_id == "u_agent"
+    assert settings.user_key == "uk_secret"
+
+
+def test_json_request_sends_authenticated_payload(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    cli = load_cli()
+    captured: dict[str, object] = {}
+
+    def fake_urlopen(request, timeout):
+        captured["url"] = request.full_url
+        captured["method"] = request.method
+        captured["body"] = json.loads(request.data)
+        captured["content_type"] = request.headers["Content-type"]
+        captured["timeout"] = timeout
+        return FakeResponse({"results": []})
+
+    monkeypatch.setattr(cli, "urlopen", fake_urlopen)
+    client = cli.MemoryGatewayClient(
+        "http://gateway.test",
+        user_id="u_agent",
+        user_key="uk_secret",
+        timeout=9,
+    )
+
+    result = client.search("contract", scopes=["resources"], top_k=5)
+
+    assert result == {"results": []}
+    assert captured == {
+        "url": "http://gateway.test/memories/search",
+        "method": "POST",
+        "body": {
+            "user_id": "u_agent",
+            "user_key": "uk_secret",
+            "query": "contract",
+            "scope": ["resources"],
+            "top_k": 5,
+            "app_id": "default",
+            "project_id": "default",
+        },
+        "content_type": "application/json",
+        "timeout": 9,
+    }
+
+
+def test_upload_builds_multipart_request_without_exposing_file_uri(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    cli = load_cli()
+    upload = tmp_path / "note.txt"
+    upload.write_text("remember this", encoding="utf-8")
+    captured: dict[str, object] = {}
+
+    def fake_urlopen(request, timeout):
+        captured["url"] = request.full_url
+        captured["method"] = request.method
+        captured["body"] = request.data
+        captured["content_type"] = request.headers["Content-type"]
+        return FakeResponse(
+            {
+                "resource_id": "r_1",
+                "uri": "resource://u_agent/r_1",
+                "status": "extracted",
+            }
+        )
+
+    monkeypatch.setattr(cli, "urlopen", fake_urlopen)
+    client = cli.MemoryGatewayClient(
+        "http://gateway.test",
+        user_id="u_agent",
+        user_key="uk_secret",
+    )
+
+    result = client.upload_resource(upload, title="Agent note")
+
+    body = captured["body"]
+    assert isinstance(body, bytes)
+    assert captured["url"] == "http://gateway.test/resources"
+    assert captured["method"] == "POST"
+    assert str(captured["content_type"]).startswith("multipart/form-data; boundary=")
+    assert b'name="user_id"' in body
+    assert b"u_agent" in body
+    assert b'name="file"; filename="note.txt"' in body
+    assert b"remember this" in body
+    assert b"file://" not in body
+    assert result["uri"] == "resource://u_agent/r_1"
+
+
+def test_http_error_raises_gateway_error_without_leaking_user_key(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    cli = load_cli()
+
+    def fake_urlopen(request, timeout):
+        raise HTTPError(
+            request.full_url,
+            401,
+            "Unauthorized",
+            hdrs=None,
+            fp=FakeResponse({"detail": "invalid user credentials"}),
+        )
+
+    monkeypatch.setattr(cli, "urlopen", fake_urlopen)
+    client = cli.MemoryGatewayClient(
+        "http://gateway.test",
+        user_id="u_agent",
+        user_key="uk_super_secret",
+    )
+
+    with pytest.raises(cli.GatewayError) as exc_info:
+        client.list_resources()
+
+    message = str(exc_info.value)
+    assert "401" in message
+    assert "invalid user credentials" in message
+    assert "uk_super_secret" not in message
+
+
+def test_load_messages_accepts_large_inline_json() -> None:
+    cli = load_cli()
+    value = json.dumps(
+        [
+            {
+                "sender_id": "u_agent",
+                "role": "user",
+                "timestamp": 1234567890123,
+                "content": "x" * 5000,
+            }
+        ]
+    )
+
+    messages = cli._load_json_array(value)
+
+    assert messages[0]["content"] == "x" * 5000
+
+
+def test_search_requires_conversation_id_for_current_chat_scope() -> None:
+    cli = load_cli()
+    client = cli.MemoryGatewayClient(
+        "http://gateway.test",
+        user_id="u_agent",
+        user_key="uk_secret",
+    )
+
+    with pytest.raises(cli.GatewayError, match="conversation_id"):
+        client.search("what did we discuss", scopes=["current_chat"])