@joshuaswarren/openclaw-engram 9.0.31 → 9.0.32

package/README.md

@@ -36,6 +36,7 @@ AI agents forget everything between conversations. Engram fixes that.
 - **Causal trajectory recall** — Engram can now, when `causalTrajectoryRecallEnabled` is enabled, inject prompt-relevant causal chains back into recall context as a separate `Causal Trajectories` section with lightweight match explainability.
 - **Trust-zone promotion path** — Engram can now, when `trustZonesEnabled` and `quarantinePromotionEnabled` are enabled, persist typed quarantine, working, and trusted records, plan explicit promotions, block direct `quarantine -> trusted` jumps, and require anchored provenance before promoting risky working records into `trusted`.
 - **Trust-zone recall** — Engram can now, when `trustZoneRecallEnabled` is enabled, inject prompt-relevant `working` and `trusted` trust-zone records into recall context as a separate `Trust Zones` section while keeping `quarantine` material out of recall by default.
+- **Provenance trust scoring** — Engram can now, when `memoryPoisoningDefenseEnabled` is enabled, score trust-zone provenance deterministically from source class and evidence anchors so poisoning defenses start with measurable trust signals instead of opaque heuristics.
 - **Zero-config start** — Install, add an API key, restart. Engram works out of the box with sensible defaults and progressively unlocks advanced features as you enable them.
 
 ## Quick Start
@@ -197,6 +198,7 @@ Key settings:
 | `quarantinePromotionEnabled` | `false` | Allow explicit trust-zone promotions such as `quarantine -> working` and guarded `working -> trusted` |
 | `trustZoneStoreDir` | `{memoryDir}/state/trust-zones` | Root directory for trust-zone records |
 | `trustZoneRecallEnabled` | `false` | Inject prompt-relevant working and trusted trust-zone records into recall context |
+| `memoryPoisoningDefenseEnabled` | `false` | Enable deterministic provenance trust scoring in trust-zone status output as the first poisoning-defense signal |
 
 Full reference: [Config Reference](docs/config-reference.md)
 

package/dist/index.js

@@ -300,6 +300,7 @@ function parseConfig(raw) {
     quarantinePromotionEnabled: cfg.quarantinePromotionEnabled === true,
     trustZoneStoreDir: typeof cfg.trustZoneStoreDir === "string" && cfg.trustZoneStoreDir.trim().length > 0 ? cfg.trustZoneStoreDir.trim() : path.join(memoryDir, "state", "trust-zones"),
     trustZoneRecallEnabled: cfg.trustZoneRecallEnabled === true,
+    memoryPoisoningDefenseEnabled: cfg.memoryPoisoningDefenseEnabled === true,
     // Local LLM Provider (v2.1)
     localLlmEnabled: cfg.localLlmEnabled === true || cfg.localLlmEnabled === "true",
     // default: false
@@ -14672,6 +14673,40 @@ function dedupeStrings(values) {
   if (out.length === 0) return void 0;
   return [...new Set(out)];
 }
+var SOURCE_CLASS_WEIGHTS = {
+  manual: 0.9,
+  system_memory: 0.85,
+  user_input: 0.75,
+  tool_output: 0.55,
+  subagent_trace: 0.45,
+  web_content: 0.35
+};
+function roundTrustScore(value) {
+  return Math.round(value * 1e3) / 1e3;
+}
+function trustScoreBand(total) {
+  if (total >= 0.8) return "high";
+  if (total >= 0.5) return "medium";
+  return "low";
+}
+function scoreTrustZoneProvenance(record) {
+  const sourceClassWeight = SOURCE_CLASS_WEIGHTS[record.provenance.sourceClass];
+  const sourceIdBonus = typeof record.provenance.sourceId === "string" ? 0.1 : 0;
+  const evidenceHashBonus = typeof record.provenance.evidenceHash === "string" ? 0.2 : 0;
+  const sessionKeyBonus = typeof record.provenance.sessionKey === "string" ? 0.05 : 0;
+  const total = roundTrustScore(
+    Math.min(1, sourceClassWeight + sourceIdBonus + evidenceHashBonus + sessionKeyBonus)
+  );
+  return {
+    total,
+    band: trustScoreBand(total),
+    anchored: hasAnchoredProvenance(record),
+    sourceClassWeight,
+    sourceIdBonus,
+    evidenceHashBonus,
+    sessionKeyBonus
+  };
+}
 function planTrustZonePromotion(options) {
   const { record, targetZone } = options;
   const reasons = [];
@@ -14865,13 +14900,23 @@ async function getTrustZoneStoreStatus(options) {
   records.sort((a, b) => b.recordedAt.localeCompare(a.recordedAt));
   const byZone = {};
   const byKind = {};
+  const byTrustBand = {};
+  let trustScoreTotal = 0;
   for (const record of records) {
     byZone[record.zone] = (byZone[record.zone] ?? 0) + 1;
     byKind[record.kind] = (byKind[record.kind] ?? 0) + 1;
+    if (options.poisoningDefenseEnabled === true) {
+      const score = scoreTrustZoneProvenance(record);
+      byTrustBand[score.band] = (byTrustBand[score.band] ?? 0) + 1;
+      trustScoreTotal += score.total;
+    }
   }
+  const averageTrustScore = options.poisoningDefenseEnabled === true && records.length > 0 ? roundTrustScore(trustScoreTotal / records.length) : void 0;
+  const latestRecordTrustScore = options.poisoningDefenseEnabled === true && records[0] ? scoreTrustZoneProvenance(records[0]) : void 0;
   return {
     enabled: options.enabled,
     promotionEnabled: options.promotionEnabled,
+    poisoningDefenseEnabled: options.poisoningDefenseEnabled,
     rootDir,
     zonesDir,
     records: {
@@ -14882,9 +14927,12 @@ async function getTrustZoneStoreStatus(options) {
       byKind,
       latestRecordId: records[0]?.recordId,
       latestRecordedAt: records[0]?.recordedAt,
-      latestZone: records[0]?.zone
+      latestZone: records[0]?.zone,
+      averageTrustScore,
+      byTrustBand: options.poisoningDefenseEnabled === true ? byTrustBand : void 0
     },
     latestRecord: records[0],
+    latestRecordTrustScore,
     invalidRecords
   };
 }
@@ -26808,7 +26856,8 @@ async function runTrustZoneStatusCliCommand(options) {
     memoryDir: options.memoryDir,
     trustZoneStoreDir: options.trustZoneStoreDir,
     enabled: options.trustZonesEnabled,
-    promotionEnabled: options.quarantinePromotionEnabled
+    promotionEnabled: options.quarantinePromotionEnabled,
+    poisoningDefenseEnabled: options.memoryPoisoningDefenseEnabled
   });
 }
 async function runTrustZonePromoteCliCommand(options) {
@@ -27992,7 +28041,8 @@ function registerCli(api, orchestrator) {
           memoryDir: orchestrator.config.memoryDir,
           trustZoneStoreDir: orchestrator.config.trustZoneStoreDir,
           trustZonesEnabled: orchestrator.config.trustZonesEnabled,
-          quarantinePromotionEnabled: orchestrator.config.quarantinePromotionEnabled
+          quarantinePromotionEnabled: orchestrator.config.quarantinePromotionEnabled,
+          memoryPoisoningDefenseEnabled: orchestrator.config.memoryPoisoningDefenseEnabled
         });
         console.log(JSON.stringify(status, null, 2));
         console.log("OK");