Palace Memory - FastAPI + MCP

Palace Scoped Search

Palace has three different search widths: one named shared room, a guarded public fallback, and an unrestricted raw vector query when no scope is supplied.

4scope types
50max results
3fallback policies
20kcontext chars
01
1Scope
Named Shared
Memory
`tenant_shared` is a real Palace scope, not the same thing as leaving scope blank.
What the request says
TS
Ask for `tenant_shared`
The MCP and REST contracts model `tenant_shared` as a scope with no key. Supplying a key is rejected before the search runs.
SK
Keep scoped memory out
A tenant-shared lookup filters to memory entries whose metadata says `scope.type = tenant_shared`.
specific shared room
Plain-English meaning
✓
Good for common facts. It is the place for tenant-wide memory that any authorized caller may use.
x
Not a wildcard. It does not mean search `agent`, `workspace`, or `session` scopes.
no keyrequired shape
namedshared scope
02
2Route
LIVE
Selected Routes
First
`retrieve_agent_memory` searches chosen routes, records what it touched, then decides whether fallback is needed.
1
Caller scope Searches `agent/` unless workspace strict mode is on.
SEARCH
2
Workspace scopes Searches explicit project keys like `workspace/palaceoftruth`.
SEARCH
3
Delegated agent scopes Only authorized `include_agent_scope_keys` are appended to the route list.
POLICY
4
Tenant shared Included immediately, never, or only when selected routes are empty.
OPTION
✓ Enough signal
Results are merged, deduped, prioritized, and returned without widening.
! Weak signal
The trace explains whether tenant-shared or broad-corpus fallback ran.
03
3Fallback
Broad Is
Guarded
`broad_corpus` is a separate opt-in pass; raw no-scope search is wider and less safe.
Broad-corpus behavior
BC
Runs after selected routes
Skipped when disabled or when selected workspace results already satisfy the display limit.
PX
Excludes private memory scopes
The broad pass sets `exclude_private_memory_scopes=True`, so agent/workspace/session memory stays out.
different from no scope
Raw no-scope behavior
Widest ALL
`scope_type` is null
The SQL scope filter is not applied, so ready items across scope metadata can match.
Guarded SAFE
Broad corpus fallback
The query can widen, but private memory scopes are explicitly excluded.
enabledexplicit policy
private offbroad fallback
No scopeis the widest raw vector search path.