Scoped API key authorization exists in HTTP code but is not wired into the packaged server entry point #592

Environment

macOS arm64; Memmy desktop 1.2.0; memmy-memory-runtime/service 2.1.3; SQLite schema 9; local service at 127.0.0.1:18960. Summary/evolution/embedding configured through Memmy account. These observations were collected on 2026-10-09. Code locations refer to the installed package under ~/.memmy/memory-service/runtime/2.1.3/darwin-arm64/dist/src/, not verified GitHub permalinks. Installed config has no local storage token; packaged entry point permits anonymous access in this case.

Reproduction path

1. Inspect authenticate() and scope guards: scoped keys support scopes such as memory:read.
2. Inspect the packaged listenMemoryHttpServer invocation.
3. Review supported YAML configuration: the entry point passes either localServiceToken or allowAnonymous, not scopedApiKeys.

Expected / actual

Users need supported per-Agent read-only credentials. Current entry point does not expose the scoped-key capability; a local service token grants *. The default scoped-key scopes, if omitted, also include read and write.
Please expose validated configuration and explicit scope defaults. Document that scope restrictions are not an OS security boundary for local agents with direct file/config access.

Evidence

• server/index.js:111: auth constructed from config.storage.token or allowAnonymous:true.
• server/http.js:1053: scopedApiKeys branch and default read/write scopes.
• server/http.js:1124: read/write/admin scope guards.
• config/index.js:424: storage token parsing.

No custom scoped-key configuration was written or tested. This report concerns packaged wiring, not a claim that the HTTP helper cannot enforce scopes.

Related: #463 discusses local authentication/namespace access. This report focuses on packaged scoped-key configuration wiring.

No credentials, private conversation text or database attachments are included. No configuration changes were performed for this report.