Memory graph for the console

Nodes are memories (one per stored item, in scope); links are semantic (Kairos similarity, server-tuned — k/threshold are not client-configurable in this version), tag, or source pairwise groupings. truncated is true when Kairos capped the tag/source grouping links. Class A — all three lanes.

NAMESPACE SCOPING: same as GET …/memories — ns is checked against the credential's scoped_namespaces after authorize(), so an out-of-scope ns is a 403 (never a 401); a credential restricted to exactly one namespace and omitting ns has that namespace injected.

Requires the memories:read scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying memories:read is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which INCLUDES memories:read — every key minted before scoping keeps working here.