@remnic/core 9.3.613 → 9.3.615

package/src/access-mcp.ts

@@ -81,11 +81,15 @@ function toLegacyToolName(name: string): string {
     : name;
 }
 
-function withToolAliases(tool: McpTool): McpTool[] {
+function withToolAliases(tool: McpTool, emitLegacyTools = true): McpTool[] {
   const canonicalName = toCanonicalToolName(tool.name);
   const canonicalTool = canonicalName === tool.name ? tool : { ...tool, name: canonicalName };
   if (canonicalName === tool.name) return [canonicalTool];
-  return [canonicalTool, tool];
+  // Issue #1427: when legacy aliases are opted out, advertise only the
+  // canonical `remnic.*` name and drop the `engram.*` duplicate. Tool *calls*
+  // still accept both names (the dispatch canonicalizes), so suppressing the
+  // alias only trims `tools/list`, not callability.
+  return emitLegacyTools ? [canonicalTool, tool] : [canonicalTool];
 }
 
 function resolveChatGptInspectorRecallSessionKey(
@@ -111,6 +115,8 @@ const STRICT_MCP_SCHEMA_KEYS: Partial<Record<SchemaName, readonly string[]>> = {
     "entityRef",
     "ttl",
     "sourceReason",
+    "cwd",
+    "projectTag",
   ],
   suggestionSubmit: [
     "schemaVersion",
@@ -125,6 +131,8 @@ const STRICT_MCP_SCHEMA_KEYS: Partial<Record<SchemaName, readonly string[]>> = {
     "entityRef",
     "ttl",
     "sourceReason",
+    "cwd",
+    "projectTag",
   ],
   capsuleExport: [
     "name",
@@ -134,9 +142,40 @@ const STRICT_MCP_SCHEMA_KEYS: Partial<Record<SchemaName, readonly string[]>> = {
     "peerIds",
     "includeTranscripts",
     "encrypt",
+    "cwd",
+    "projectTag",
   ],
-  capsuleImport: ["archivePath", "namespace", "mode", "passphrase"],
-  capsuleList: ["namespace"],
+  capsuleImport: ["archivePath", "namespace", "mode", "passphrase", "cwd", "projectTag"],
+  capsuleList: ["namespace", "cwd", "projectTag"],
+};
+
+// Shared JSON-schema fragments for the client-injected git/project context
+// fields (#1434). Declared once to avoid drift across tool definitions.
+// `_SCOPED` is for write tools that resolve a project namespace from these
+// fields; `_IGNORED` is for tools that merely tolerate them for MCP client
+// compatibility (clients like Pi MCPorter auto-inject `cwd` on every call).
+const MCP_GIT_CONTEXT_SCHEMA_PROPS_SCOPED: Record<string, unknown> = {
+  cwd: {
+    type: "string",
+    description:
+      "Optional working directory. When no explicit namespace is given, resolves the project namespace this write is stored in (mirrors recall/observe).",
+  },
+  projectTag: {
+    type: "string",
+    description:
+      "Optional project tag for non-git project scoping. When no explicit namespace is given, routes this write to the tagged project namespace.",
+  },
+};
+const MCP_GIT_CONTEXT_SCHEMA_PROPS_IGNORED: Record<string, unknown> = {
+  cwd: {
+    type: "string",
+    description:
+      "Accepted for MCP client compatibility (git-context auto-injection); ignored by this tool.",
+  },
+  projectTag: {
+    type: "string",
+    description: "Accepted for MCP client compatibility; ignored by this tool.",
+  },
 };
 
 function parseMcpRequest<N extends SchemaName>(
@@ -212,13 +251,25 @@ export class EngramMcpServer {
   private readonly citationsEnabled: boolean;
   /** Whether to auto-enable citations for Codex adapter connections. */
   private readonly citationsAutoDetect: boolean;
+  /**
+   * Whether to advertise legacy `engram.*` tool aliases alongside the canonical
+   * `remnic.*` names (issue #1427). Defaults to true for backward compatibility;
+   * set false to halve the advertised `tools/list` surface.
+   */
+  private readonly emitLegacyTools: boolean;
 
   constructor(
     private readonly service: EngramAccessService,
-    options: { principal?: string; citationsEnabled?: boolean; citationsAutoDetect?: boolean } = {},
+    options: {
+      principal?: string;
+      citationsEnabled?: boolean;
+      citationsAutoDetect?: boolean;
+      emitLegacyTools?: boolean;
+    } = {},
   ) {
     this.citationsEnabled = options.citationsEnabled === true;
     this.citationsAutoDetect = options.citationsAutoDetect !== false;
+    this.emitLegacyTools = options.emitLegacyTools !== false;
     this.authenticatedPrincipal =
       options.principal?.trim() ||
       readEnvVar("OPENCLAW_ENGRAM_ACCESS_PRINCIPAL")?.trim() ||
@@ -598,6 +649,7 @@ export class EngramMcpServer {
             },
             includeTranscripts: { type: "boolean" },
             encrypt: { type: "boolean" },
+            ...MCP_GIT_CONTEXT_SCHEMA_PROPS_IGNORED,
           },
           required: ["name"],
           additionalProperties: false,
@@ -623,6 +675,7 @@ export class EngramMcpServer {
               type: "string",
               description: "Passphrase for encrypted capsule archives.",
             },
+            ...MCP_GIT_CONTEXT_SCHEMA_PROPS_IGNORED,
           },
           required: ["archivePath"],
           additionalProperties: false,
@@ -635,6 +688,7 @@ export class EngramMcpServer {
           type: "object",
           properties: {
             namespace: { type: "string" },
+            ...MCP_GIT_CONTEXT_SCHEMA_PROPS_IGNORED,
           },
           additionalProperties: false,
         },
@@ -739,6 +793,7 @@ export class EngramMcpServer {
             entityRef: { type: "string" },
             ttl: { type: "string" },
             sourceReason: { type: "string" },
+            ...MCP_GIT_CONTEXT_SCHEMA_PROPS_SCOPED,
           },
           required: ["content"],
           additionalProperties: false,
@@ -762,6 +817,7 @@ export class EngramMcpServer {
             entityRef: { type: "string" },
             ttl: { type: "string" },
             sourceReason: { type: "string" },
+            ...MCP_GIT_CONTEXT_SCHEMA_PROPS_SCOPED,
           },
           required: ["content"],
           additionalProperties: false,
@@ -1703,7 +1759,7 @@ export class EngramMcpServer {
           additionalProperties: false,
         },
       },
-    ].flatMap((tool) => withToolAliases(tool));
+    ].flatMap((tool) => withToolAliases(tool, this.emitLegacyTools));
   }
 
   /** Get clientInfo for a specific MCP session. Returns undefined for non-MCP requests. */
@@ -1985,7 +2041,12 @@ export class EngramMcpServer {
   }
 
   private toolAcceptsArgument(name: string, key: string): boolean {
-    const tool = this.tools.find((entry) => entry.name === name);
+    // Match by canonical name so argument validation resolves whether the
+    // caller used the `engram.*` or `remnic.*` name and regardless of whether
+    // legacy aliases are advertised (issue #1427) — a tool stays callable under
+    // both names even when only the canonical alias appears in `tools/list`.
+    const target = toCanonicalToolName(name);
+    const tool = this.tools.find((entry) => toCanonicalToolName(entry.name) === target);
     const inputSchema = getObjectProperties(tool?.inputSchema);
     const properties = getObjectProperties(inputSchema?.properties);
     if (properties && Object.prototype.hasOwnProperty.call(properties, key)) {
@@ -2481,6 +2542,8 @@ export class EngramMcpServer {
           entityRef: body.entityRef,
           ttl: body.ttl,
           sourceReason: body.sourceReason,
+          cwd: body.cwd,
+          projectTag: body.projectTag,
         });
       }
       case "engram.suggestion_submit": {
@@ -2499,6 +2562,8 @@ export class EngramMcpServer {
           entityRef: body.entityRef,
           ttl: body.ttl,
           sourceReason: body.sourceReason,
+          cwd: body.cwd,
+          projectTag: body.projectTag,
         });
       }
       case "engram.entity_get":

package/src/access-schema.ts

@@ -243,6 +243,17 @@ export const memoryStoreRequestSchema = z.object({
   entityRef: entityRefSchema,
   ttl: ttlSchema,
   sourceReason: sourceReasonSchema,
+  // Git/project context for project-scoped writes (#1434). When no explicit
+  // `namespace` is given, these route the write to the same project namespace
+  // recall/observe resolve from `cwd`/`projectTag` (issue #569, rule 42). Also
+  // lets MCP clients that auto-inject `cwd` (e.g. Pi MCPorter) call write tools.
+  cwd: z.string().trim().min(1, "cwd must be non-empty when provided").max(2048).optional(),
+  projectTag: z
+    .string()
+    .trim()
+    .min(1, "projectTag must be non-empty when provided")
+    .max(256)
+    .optional(),
 });
 
 export const suggestionSubmitRequestSchema = memoryStoreRequestSchema;

package/src/access-service-coding-write.test.ts

@@ -0,0 +1,478 @@
+/**
+ * #1434: explicit-write tools (memory_store / suggestion_submit) must resolve
+ * their write namespace through the SAME project-scope overlay the read path
+ * uses, so a memory stored with a client-injected `cwd`/`projectTag` is
+ * discoverable by project-scoped recall (rule 42 symmetry). Previously these
+ * tools ignored coding context and always wrote to the base namespace.
+ *
+ * Invariants verified here (review hardening on PR #1444):
+ *  - Symmetry: a `projectTag`/`cwd` (or an existing session context) overlays
+ *    the project namespace onto the principal self base — the SAME namespace
+ *    recall/observe/buffer use — so scoped stores are found by scoped recall.
+ *  - Base: the principal self namespace (defaultNamespaceForPrincipal), which
+ *    collapses to `config.defaultNamespace` when namespaces are disabled or the
+ *    principal has no self policy (the common deployment is unchanged).
+ *  - Read-only: the resolver NEVER mutates session coding context, so
+ *    idempotency peeks / dryRun preflights are side-effect free (Codex review).
+ *  - Persist: a pre-resolved project namespace reaches storage instead of being
+ *    rejected by the static policy allow-list (Codex P1 / Cursor High).
+ *  - Precedence: explicit `namespace` wins; namespaces-disabled is a no-op.
+ */
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { EngramAccessService } from "./access-service.js";
+import { Orchestrator } from "./orchestrator.js";
+import { persistExplicitCapture } from "./explicit-capture.js";
+import type { ValidExplicitCapture } from "./explicit-capture.js";
+import {
+  combineNamespaces,
+  projectNamespaceName,
+  projectTagProjectId,
+} from "./coding/coding-namespace.js";
+import type { CodingContext, PluginConfig } from "./types.js";
+
+function makeOrchestratorStub(overrides: Partial<PluginConfig> = {}): Orchestrator {
+  const orch = Object.create(Orchestrator.prototype) as Orchestrator;
+  const internals = orch as unknown as {
+    config: PluginConfig;
+    _codingContextBySession: Map<string, CodingContext>;
+  };
+  internals.config = {
+    namespacesEnabled: true,
+    defaultNamespace: "default",
+    sharedNamespace: "shared",
+    namespacePolicies: [],
+    codingMode: { projectScope: true },
+    memoryDir: "/synthetic/remnic-coding-write",
+    recallCrossNamespaceBudgetEnabled: false,
+    recallCrossNamespaceBudgetWindowMs: 60_000,
+    recallCrossNamespaceBudgetSoftLimit: 10,
+    recallCrossNamespaceBudgetHardLimit: 30,
+    ...overrides,
+  } as unknown as PluginConfig;
+  internals._codingContextBySession = new Map();
+  return orch;
+}
+
+function resolver(service: EngramAccessService) {
+  return (req: unknown) =>
+    (
+      service as unknown as {
+        resolveCodingScopedWriteNamespace: (r: unknown) => Promise<string>;
+      }
+    ).resolveCodingScopedWriteNamespace(req);
+}
+
+function projectNamespaceFor(tag: string): string {
+  // projectScope (no branch scope) overlay namespace == projectNamespaceName.
+  return combineNamespaces("default", projectNamespaceName(projectTagProjectId(tag)));
+}
+
+test("#1434 projectTag scopes the write to the project namespace, read-only", async () => {
+  const orch = makeOrchestratorStub();
+  const service = new EngramAccessService(orch);
+
+  const resolved = await resolver(service)({
+    sessionKey: "sess-1",
+    authenticatedPrincipal: "alice",
+    projectTag: "Blend/Supply",
+    content: "x",
+  });
+
+  assert.equal(resolved, projectNamespaceFor("Blend/Supply"));
+  assert.notEqual(resolved, "default", "project context must change the namespace");
+  // Read-only: resolving must NOT persist coding context on the session.
+  assert.equal(
+    orch.getCodingContextForSession("sess-1"),
+    null,
+    "resolver must not mutate session coding context (peek/dryRun safety)",
+  );
+});
+
+test("#1434 a sessionless write with projectTag stays on the base namespace (recall symmetry)", async () => {
+  // Without a sessionKey the recall path can't attach or look up coding context
+  // (maybeAttachCodingContext / applyCodingNamespaceOverlay both no-op), so a
+  // sessionless recall searches the base namespace. A sessionless write must
+  // therefore also stay on the base — else the store would be hidden from the
+  // same client's recall (Codex review).
+  const orch = makeOrchestratorStub();
+  const service = new EngramAccessService(orch);
+  const resolved = await resolver(service)({
+    authenticatedPrincipal: "alice",
+    projectTag: "Blend/Supply",
+    content: "x",
+  });
+  assert.equal(resolved, "default");
+});
+
+test("#1434 an existing session coding context scopes the write (recall-then-store flow)", async () => {
+  const orch = makeOrchestratorStub();
+  orch.setCodingContextForSession("sess-ctx", {
+    projectId: projectTagProjectId("Blend/Supply"),
+    branch: null,
+    rootPath: projectTagProjectId("Blend/Supply"),
+    defaultBranch: null,
+  });
+  const service = new EngramAccessService(orch);
+
+  const resolved = await resolver(service)({
+    sessionKey: "sess-ctx",
+    authenticatedPrincipal: "alice",
+    content: "x",
+  });
+  assert.equal(resolved, projectNamespaceFor("Blend/Supply"));
+});
+
+test("#1434 an existing session binding wins over per-call projectTag (recall symmetry)", async () => {
+  // Session is bound to project A; this write also passes per-call projectTag B.
+  // The write MUST resolve to A — the same project the session's recall searches
+  // (recall is session-first: maybeAttachCodingContext returns early when a
+  // context is already attached). A per-call-wins write would land in B, which
+  // that session's recall never searches, so the memory would be undiscoverable.
+  const orch = makeOrchestratorStub();
+  orch.setCodingContextForSession("sess-reuse", {
+    projectId: projectTagProjectId("Project/A"),
+    branch: null,
+    rootPath: projectTagProjectId("Project/A"),
+    defaultBranch: null,
+  });
+  const service = new EngramAccessService(orch);
+  const resolved = await resolver(service)({
+    sessionKey: "sess-reuse",
+    authenticatedPrincipal: "alice",
+    projectTag: "Project/B",
+    content: "x",
+  });
+  assert.equal(resolved, projectNamespaceFor("Project/A"));
+  assert.notEqual(resolved, projectNamespaceFor("Project/B"));
+});
+
+test("#1434 explicit namespace wins and bypasses coding overlay", async () => {
+  const orch = makeOrchestratorStub();
+  const service = new EngramAccessService(orch);
+  const resolved = await resolver(service)({
+    sessionKey: "sess-2",
+    authenticatedPrincipal: "alice",
+    namespace: "default",
+    projectTag: "Blend/Supply",
+    content: "x",
+  });
+  assert.equal(resolved, "default");
+});
+
+test("#1434 unqualified write (self policy) stays on config.defaultNamespace", async () => {
+  // Even when principal "alice" has a self policy, an UNQUALIFIED write (no
+  // coding overlay) stays on config.defaultNamespace — exactly the pre-#1434
+  // behavior. #1434 only re-scopes project-identified writes; it must not
+  // silently move plain unqualified writes to a principal self namespace (Codex
+  // review). The symmetry fix applies to the coding-overlay path only.
+  const orch = makeOrchestratorStub({
+    namespacePolicies: [
+      { name: "alice", readPrincipals: ["alice"], writePrincipals: ["alice"] },
+    ],
+  } as Partial<PluginConfig>);
+  const service = new EngramAccessService(orch);
+  const resolved = await resolver(service)({
+    sessionKey: "sess-3",
+    authenticatedPrincipal: "alice",
+    content: "x",
+  });
+  assert.equal(resolved, "default");
+});
+
+test("#1434 unqualified write with no principal policy stays on the default namespace", async () => {
+  // No policy named after the principal => base is defaultNamespace, so behavior
+  // is unchanged for the common deployment.
+  const orch = makeOrchestratorStub();
+  const service = new EngramAccessService(orch);
+  const resolved = await resolver(service)({
+    sessionKey: "sess-3b",
+    authenticatedPrincipal: "alice",
+    content: "x",
+  });
+  assert.equal(resolved, "default");
+});
+
+test("#1434 project write overlays onto the principal self base (recall symmetry)", async () => {
+  // With a self policy, a project-scoped write overlays onto the principal self
+  // base (defaultNamespaceForPrincipal) — the SAME base recall/observe/buffer
+  // overlay onto — so the store is discoverable by that principal's
+  // project-scoped recall (Cursor review / rule 42).
+  const orch = makeOrchestratorStub({
+    namespacePolicies: [
+      { name: "alice", readPrincipals: ["alice"], writePrincipals: ["alice"] },
+    ],
+  } as Partial<PluginConfig>);
+  const service = new EngramAccessService(orch);
+  const resolved = await resolver(service)({
+    sessionKey: "sess-3c",
+    authenticatedPrincipal: "alice",
+    projectTag: "Blend/Supply",
+    content: "x",
+  });
+  assert.equal(
+    resolved,
+    combineNamespaces("alice", projectNamespaceName(projectTagProjectId("Blend/Supply"))),
+  );
+});
+
+test("#1434 an explicit coding-overlay namespace string is NOT a writable target", async () => {
+  // Project scoping is requested via cwd/projectTag, never by naming the derived
+  // overlay namespace. A caller naming an overlay-shaped namespace directly is
+  // authorized strictly through canWriteNamespace and rejected, so the persist
+  // allow-list can never be bypassed by guessing an overlay name.
+  const orch = makeOrchestratorStub();
+  const service = new EngramAccessService(orch);
+  await assert.rejects(
+    resolver(service)({
+      sessionKey: "sess-explicit-overlay",
+      authenticatedPrincipal: "alice",
+      namespace: projectNamespaceFor("Blend/Supply"), // "default-project-…"
+      content: "x",
+    }),
+    /not writable/,
+  );
+});
+
+test("#1434 a prefix-colliding principal namespace cannot be written cross-tenant (Codex P1)", async () => {
+  // Policies for both `alice` and `alice-project-team`. An authenticated `alice`
+  // must NOT be able to write `alice-project-team-project-foo` (the OTHER
+  // principal's project-scoped namespace) by exploiting a shared `alice-project-`
+  // prefix. Strict canWriteNamespace authorization rejects it.
+  const orch = makeOrchestratorStub({
+    namespacePolicies: [
+      { name: "alice", readPrincipals: ["alice"], writePrincipals: ["alice"] },
+      {
+        name: "alice-project-team",
+        readPrincipals: ["teamuser"],
+        writePrincipals: ["teamuser"],
+      },
+    ],
+  } as Partial<PluginConfig>);
+  const service = new EngramAccessService(orch);
+  await assert.rejects(
+    resolver(service)({
+      sessionKey: "sess-collide",
+      authenticatedPrincipal: "alice",
+      namespace: "alice-project-team-project-foo",
+      content: "x",
+    }),
+    /not writable/,
+  );
+});
+
+test("#1434 a derived overlay base the principal cannot write is rejected (Codex P1)", async () => {
+  // The principal has a self policy but NO write access to the configured
+  // default namespace. An explicit `default-project-foo` must be rejected —
+  // overlay namespaces are never accepted as caller strings, and the base must
+  // pass canWriteNamespace.
+  const orch = makeOrchestratorStub({
+    defaultNamespace: "default",
+    namespacePolicies: [
+      { name: "alice", readPrincipals: ["alice"], writePrincipals: ["alice"] },
+      { name: "default", readPrincipals: ["admin"], writePrincipals: ["admin"] },
+    ],
+  } as Partial<PluginConfig>);
+  const service = new EngramAccessService(orch);
+  await assert.rejects(
+    resolver(service)({
+      sessionKey: "sess-base-noauth",
+      authenticatedPrincipal: "alice",
+      namespace: "default-project-foo",
+      content: "x",
+    }),
+    /not writable/,
+  );
+});
+
+test("#1434 a forged cross-principal namespace cannot widen access", async () => {
+  // A caller naming a namespace that is not writable for this principal is
+  // rejected by canWriteNamespace — it can't escalate to another principal's
+  // namespace.
+  const orch = makeOrchestratorStub();
+  const service = new EngramAccessService(orch);
+  await assert.rejects(
+    resolver(service)({
+      sessionKey: "sess-forge",
+      authenticatedPrincipal: "alice",
+      namespace: "victim-secret",
+      content: "x",
+    }),
+    /not writable/,
+  );
+});
+
+test("#1434 namespaces disabled: cwd/projectTag are a no-op (common single-tenant MCP case)", async () => {
+  const orch = makeOrchestratorStub({ namespacesEnabled: false } as Partial<PluginConfig>);
+  const service = new EngramAccessService(orch);
+  const resolved = await resolver(service)({
+    sessionKey: "sess-4",
+    projectTag: "Blend/Supply",
+    content: "x",
+  });
+  assert.equal(resolved, "default");
+});
+
+function makeAttachOrchestrator() {
+  const contexts = new Map<string, CodingContext>();
+  const getStorageCalls: Array<string | undefined> = [];
+  const orch = {
+    config: {
+      namespacesEnabled: true,
+      defaultNamespace: "default",
+      sharedNamespace: "shared",
+      namespacePolicies: [],
+      codingMode: { projectScope: true },
+      memoryDir: "/synthetic/remnic-coding-write-attach",
+      recallCrossNamespaceBudgetEnabled: false,
+      recallCrossNamespaceBudgetWindowMs: 60_000,
+      recallCrossNamespaceBudgetSoftLimit: 10,
+      recallCrossNamespaceBudgetHardLimit: 30,
+    },
+    getCodingContextForSession: (sk: string) => contexts.get(sk) ?? null,
+    setCodingContextForSession: (sk: string, ctx: CodingContext) => {
+      contexts.set(sk, ctx);
+    },
+    getStorage: async (ns?: string) => {
+      getStorageCalls.push(ns);
+      return {
+        readAllMemories: async () => [],
+        writeMemory: async () => "mem-1",
+        appendMemoryLifecycleEvents: async () => {},
+      };
+    },
+  } as unknown as Orchestrator;
+  return { orch, contexts, getStorageCalls };
+}
+
+function storeRequest(
+  overrides: Record<string, unknown>,
+): Parameters<EngramAccessService["memoryStore"]>[0] {
+  return {
+    authenticatedPrincipal: "alice",
+    content: "durable project memory",
+    category: "fact",
+    confidence: 0.9,
+    tags: [],
+    ...overrides,
+  } as unknown as Parameters<EngramAccessService["memoryStore"]>[0];
+}
+
+test("#1434 a real memory_store attaches coding context so a later bare recall on the session is scoped (Cursor review)", async () => {
+  // A store with sessionKey + per-call projectTag must seed the session's
+  // coding binding (like recall's maybeAttachCodingContext), so a SUBSEQUENT
+  // bare recall on the same session — one that omits cwd/projectTag — is scoped
+  // to the same project and finds the memory.
+  const { orch, contexts, getStorageCalls } = makeAttachOrchestrator();
+  const service = new EngramAccessService(orch);
+
+  const res = await service.memoryStore(
+    storeRequest({ sessionKey: "sess-attach", projectTag: "Blend/Supply" }),
+  );
+
+  assert.equal(res.status, "stored");
+  assert.equal(res.namespace, projectNamespaceFor("Blend/Supply"));
+  // The store attached the coding context the recall path reads.
+  assert.equal(
+    contexts.get("sess-attach")?.projectId,
+    projectTagProjectId("Blend/Supply"),
+  );
+  assert.ok(
+    getStorageCalls.every((ns) => ns === projectNamespaceFor("Blend/Supply")),
+    `expected all getStorage calls on the project namespace, got ${JSON.stringify(getStorageCalls)}`,
+  );
+  // A later BARE resolve (no per-call context) on the same session — what a
+  // subsequent recall on this session uses — is now scoped to the same project.
+  const bare = await resolver(service)({
+    sessionKey: "sess-attach",
+    authenticatedPrincipal: "alice",
+    content: "y",
+  });
+  assert.equal(bare, projectNamespaceFor("Blend/Supply"));
+});
+
+test("#1434 an explicit-namespace store does NOT bind the session to a project (Codex review)", async () => {
+  // An explicit `namespace` bypasses the coding overlay, so the write must not
+  // seed a project binding the session never wrote to — else later bare recalls
+  // would search a project namespace with no committed memory.
+  const { orch, contexts } = makeAttachOrchestrator();
+  const service = new EngramAccessService(orch);
+  const res = await service.memoryStore(
+    storeRequest({ sessionKey: "sess-explicit", namespace: "default", projectTag: "Blend/Supply" }),
+  );
+  assert.equal(res.status, "stored");
+  assert.equal(res.namespace, "default");
+  assert.equal(contexts.get("sess-explicit"), undefined, "explicit-namespace write must not bind the session");
+});
+
+test("#1434 a dryRun store does NOT bind the session to a project (Codex review)", async () => {
+  // A dryRun is a read-only preview; it must not mutate session coding context.
+  const { orch, contexts } = makeAttachOrchestrator();
+  const service = new EngramAccessService(orch);
+  const res = await service.memoryStore(
+    storeRequest({ sessionKey: "sess-dry", projectTag: "Blend/Supply", dryRun: true }),
+  );
+  assert.equal(res.status, "validated");
+  assert.equal(contexts.get("sess-dry"), undefined, "dryRun must not bind the session");
+});
+
+// ── Persist layer (#1434 P1/High): a pre-resolved project namespace must reach
+// storage instead of being rejected by the static policy allow-list. ──────────
+
+function makePersistOrchestrator() {
+  const getStorageCalls: Array<string | undefined> = [];
+  const orch = {
+    config: {
+      namespacesEnabled: true,
+      defaultNamespace: "default",
+      sharedNamespace: "shared",
+      namespacePolicies: [],
+    },
+    getStorage: async (ns?: string) => {
+      getStorageCalls.push(ns);
+      return {
+        readAllMemories: async () => [],
+        writeMemory: async () => "mem-1",
+        appendMemoryLifecycleEvents: async () => {},
+      };
+    },
+  } as unknown as Orchestrator;
+  return { orch, getStorageCalls };
+}
+
+function candidate(overrides: Partial<ValidExplicitCapture> = {}): ValidExplicitCapture {
+  return {
+    content: "durable project memory",
+    category: "fact",
+    confidence: 0.9,
+    tags: [],
+    namespace: "default-project-tag-abc123",
+    ...overrides,
+  };
+}
+
+test("#1434 persistExplicitCapture routes a pre-resolved project namespace to storage", async () => {
+  const { orch, getStorageCalls } = makePersistOrchestrator();
+  const res = await persistExplicitCapture(
+    orch,
+    candidate({ namespacePreResolved: true }),
+    "memory_store",
+  );
+  assert.equal(res.id, "mem-1");
+  // The dynamic project namespace must be used verbatim (dup-check + write),
+  // never rewritten or rejected.
+  assert.ok(
+    getStorageCalls.every((ns) => ns === "default-project-tag-abc123"),
+    `expected all getStorage calls on the project namespace, got ${JSON.stringify(getStorageCalls)}`,
+  );
+});
+
+test("#1434 persistExplicitCapture still rejects an unauthorized namespace when not pre-resolved", async () => {
+  const { orch } = makePersistOrchestrator();
+  await assert.rejects(
+    persistExplicitCapture(orch, candidate(), "memory_store"),
+    /unsupported namespace/,
+    "the policy allow-list guard must still apply to callers that do not pre-authorize",
+  );
+});