Memory: unguarded DELETE /api/memory/banks/{id} enables one-call data loss (RCA + hardening)

[thinmintdev]

Summary

On 2026-07-04 an agent misidentified the live Hindsight banks as orphaned and issued DELETE /api/memory/banks/{bank_id}, irreversibly cascade-deleting ~632 records across private__hermes-agent (275 facts), private__hermes, and shared. Recovered from a PBS backup.

Root cause

DELETE /api/memory/banks/{bank_id} (src/hal0/api/routes/memory_admin.py, _FORWARDS) is a bare passthrough to Hindsight with no confirmation, no soft-delete, no auth. The entire /api/memory/* surface is unauthenticated and bound on 0.0.0.0:8080, so any LAN host — or an agent's terminal/tool — can wipe a bank with one curl, bypassing the UI confirm dialog. Contributing UX bug: the dashboard mislabels the banks (colon vs double-underscore spelling; list?bank returns wrong data) which fed the misdiagnosis.

Fixes (branch fix/memory-tab-functional, hotpatched on CT105)

• DELETE /banks/{id} now requires ?confirm=<bank_id> (or body {"confirm":...}); mismatch → 400, no forward.
• GET /api/memory/list?bank= alias mapped to dataset (was silently returning default-dataset rows).

Remaining hardening (this issue)

• Reintroduce write-auth (bearer or localhost-only) on mutating /api/memory/* routes; keep reads open if desired.
• Soft-delete / tombstone for banks (rename + TTL purge) so deletes are reversible.
• Audit-log every destructive memory op.

[thinmintdev]

PR #1030 lands the audit-log portion of this issue: every destructive /api/memory/* op (bank delete, memories/config/document/directive/operation/mental-model deletes, and namespace POST /api/memory/delete) now writes a durable record_action row (actor + target + truthful outcome). Combined with the ?confirm= guard from #1028, the exact op that caused the incident is now both gated and attributable.

Leaving this open for the two remaining asks, which are design decisions rather than mechanical fixes:

• Write-auth on mutating routes — reintroducing auth contradicts the ADR-0012 decision to run /api/memory/* open on 0.0.0.0:8080; localhost-only would break the LAN dashboard's own delete/config calls. Needs an explicit product/security call on the model (bearer token? mutate-only? per-route?).
• Soft-delete / tombstone for banks — needs upstream Hindsight support (bank rename + TTL purge); not expressible through the current REST surface.

Suggest tracking those two as separate scoped issues so this one can close on the audit-log slice.