@remnic/core 9.3.680 → 9.3.681

package/src/access-boundary.test.ts

@@ -0,0 +1,212 @@
+/**
+ * Unit tests for the access boundary (issue #1525).
+ *
+ * Covers the normalization matrix the boundary owns (rules 17/28/36/48/51),
+ * the registry's validate-then-invoke contract, and the rule-51 "list valid
+ * options" error format. The surface-coverage fitness test lives in
+ * `access-surface-catalog.test.ts`.
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  __resetRegistryForTest,
+  coerceBooleanLike,
+  coercePositiveInteger,
+  defineOperation,
+  formatZodIssues,
+  getOperation,
+  listRegisteredOperations,
+  normalizeOptionalPath,
+  type OperationContext,
+} from "./access-boundary.js";
+import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
+
+// ---------------------------------------------------------------------------
+// Test fixtures
+// ---------------------------------------------------------------------------
+
+function makeMockService(handlers: Partial<EngramAccessService> = {}): EngramAccessService {
+  return { ...handlers } as unknown as EngramAccessService;
+}
+
+const ctx = (service: EngramAccessService, principal?: string): OperationContext => ({
+  service,
+  authenticatedPrincipal: principal,
+});
+
+// Reset the pilot registrations between files so defineOperation's "already
+// registered" guard doesn't fire when the real `access-operations.ts` is
+// imported by sibling test files in the same process.
+test.afterEach(() => {
+  __resetRegistryForTest();
+});
+
+// ---------------------------------------------------------------------------
+// coerceBooleanLike — rule 36 (string "false" is truthy)
+// ---------------------------------------------------------------------------
+
+test("coerceBooleanLike: accepts real booleans", () => {
+  assert.equal(coerceBooleanLike(true), true);
+  assert.equal(coerceBooleanLike(false), false);
+});
+
+test("coerceBooleanLike: treats absence as undefined (caller keeps its default)", () => {
+  assert.equal(coerceBooleanLike(undefined), undefined);
+  assert.equal(coerceBooleanLike(null), undefined);
+  assert.equal(coerceBooleanLike(""), undefined);
+});
+
+test("coerceBooleanLike: coerces every documented spelling, case-insensitive", () => {
+  for (const truthy of ["true", "TRUE", "1", "yes", "YES", "on"]) {
+    assert.equal(coerceBooleanLike(truthy), true, `${truthy} should be true`);
+  }
+  for (const falsy of ["false", "False", "0", "no", "No", "off"]) {
+    assert.equal(coerceBooleanLike(falsy), false, `${falsy} should be false`);
+  }
+});
+
+test("coerceBooleanLike: rejects values Boolean() would silently mis-coerce", () => {
+  // These are the exact cases rule 36 exists for — `Boolean("false") === true`
+  // would let `--installExtension=false` silently enable the flag.
+  assert.throws(() => coerceBooleanLike("not-a-bool"), EngramAccessInputError);
+  assert.throws(() => coerceBooleanLike(2), EngramAccessInputError);
+  assert.throws(() => coerceBooleanLike({}), EngramAccessInputError);
+});
+
+// ---------------------------------------------------------------------------
+// coercePositiveInteger — rule 28 (numeric strings at the edge)
+// ---------------------------------------------------------------------------
+
+test("coercePositiveInteger: absence → undefined", () => {
+  assert.equal(coercePositiveInteger(undefined, "limit"), undefined);
+  assert.equal(coercePositiveInteger(null, "limit"), undefined);
+  assert.equal(coercePositiveInteger("", "limit"), undefined);
+});
+
+test("coercePositiveInteger: coerces numeric strings the service would later reject", () => {
+  assert.equal(coercePositiveInteger("5", "limit"), 5);
+  assert.equal(coercePositiveInteger("5555", "port"), 5555);
+});
+
+test("coercePositiveInteger: accepts numbers that pass the integer/positive guard", () => {
+  assert.equal(coercePositiveInteger(7, "limit"), 7);
+});
+
+test("coercePositiveInteger: rejects zero, negatives, non-integers, booleans", () => {
+  // `Number(true) === 1` would silently pass without this guard.
+  for (const bad of [0, -1, 1.5, "0", "-3", "1.5", true, false, NaN]) {
+    assert.throws(() => coercePositiveInteger(bad, "limit"), EngramAccessInputError);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// normalizeOptionalPath — rule 17 (~ expansion via the shared helper)
+// ---------------------------------------------------------------------------
+
+test("normalizeOptionalPath: absence → undefined", () => {
+  assert.equal(normalizeOptionalPath(undefined), undefined);
+  assert.equal(normalizeOptionalPath(null), undefined);
+  assert.equal(normalizeOptionalPath(""), undefined);
+});
+
+test("normalizeOptionalPath: expands ~ via expandTildePath, never ad-hoc regex", () => {
+  const original = process.env.HOME;
+  const fakeHome = "/tmp/remnic-boundary-home";
+  process.env.HOME = fakeHome;
+  try {
+    assert.equal(normalizeOptionalPath("~/memory"), `${fakeHome}/memory`);
+  } finally {
+    process.env.HOME = original;
+  }
+});
+
+test("normalizeOptionalPath: rejects non-string shapes loudly", () => {
+  assert.throws(() => normalizeOptionalPath(42), EngramAccessInputError);
+  assert.throws(() => normalizeOptionalPath({ path: "x" }), EngramAccessInputError);
+});
+
+// ---------------------------------------------------------------------------
+// formatZodIssues — rule 51 (list valid options, never silently default)
+// ---------------------------------------------------------------------------
+
+test("formatZodIssues: names the offending field and lists enum options", async () => {
+  const { z } = await import("zod");
+  const schema = z.object({ mode: z.enum(["auto", "no_recall"]) });
+  const result = schema.safeParse({ mode: "bogus" });
+  assert.ok(!result.success);
+  const message = formatZodIssues(result.error);
+  assert.match(message, /mode/);
+  assert.match(message, /auto.*no_recall/);
+});
+
+test("formatZodIssues: includes the (root) path for top-level errors", async () => {
+  const { z } = await import("zod");
+  const schema = z.object({}).strict();
+  const result = schema.safeParse({ rogue: 1 });
+  assert.ok(!result.success);
+  const message = formatZodIssues(result.error);
+  assert.ok(message.length > 0);
+});
+
+// ---------------------------------------------------------------------------
+// defineOperation / getOperation — registry contract
+// ---------------------------------------------------------------------------
+
+test("defineOperation: parses then invokes the handler with the typed input", async () => {
+  let observed: { x?: number } | undefined;
+  const op = defineOperation<{ x?: number }, { doubled: number }>({
+    name: "memory_get",
+    description: "test",
+    schema: (await import("zod")).object({ x: (await import("zod")).number().optional() }),
+    handler: async (input) => {
+      observed = input;
+      return { doubled: (input.x ?? 0) * 2 };
+    },
+  });
+  const out = await op.run({ x: 21 }, ctx(makeMockService()));
+  assert.equal(out.doubled, 42);
+  assert.deepEqual(observed, { x: 21 });
+});
+
+test("defineOperation: rejects invalid input with EngramAccessInputError BEFORE the handler runs", async () => {
+  let ran = false;
+  const op = defineOperation<{ x: number }, void>({
+    name: "memory_get",
+    description: "test",
+    schema: (await import("zod")).object({ x: (await import("zod")).number() }),
+    handler: async () => {
+      ran = true;
+    },
+  });
+  await assert.rejects(
+    () => op.run({ x: "not-a-number" }, ctx(makeMockService())),
+    (err: unknown) => err instanceof EngramAccessInputError,
+  );
+  assert.equal(ran, false, "handler must not run on validation failure");
+});
+
+test("defineOperation: duplicate registration is a programming error, not an input fault", async () => {
+  const { z } = await import("zod");
+  const spec = {
+    name: "memory_get" as const,
+    description: "first",
+    schema: z.object({}),
+    handler: async () => undefined,
+  };
+  defineOperation(spec);
+  assert.throws(() => defineOperation(spec), /already registered/);
+});
+
+test("getOperation / listRegisteredOperations: round-trip a registration", async () => {
+  const { z } = await import("zod");
+  defineOperation({
+    name: "memory_search",
+    description: "test",
+    schema: z.object({}),
+    handler: async () => undefined,
+  });
+  assert.ok(getOperation("memory_search"));
+  assert.ok(listRegisteredOperations().includes("memory_search"));
+});

package/src/access-boundary.ts

@@ -0,0 +1,235 @@
+/**
+ * Single input-validation and error boundary for the CLI/MCP/HTTP access
+ * surfaces (issue #1525, epic #1520 Phase 1).
+ *
+ * Every operation that crosses the access-service facade passes through ONE
+ * registry entry: a zod-validated request envelope, a shared error mapper,
+ * and the "reject invalid input and list valid options" behavior that
+ * CLAUDE.md rules 14/17/24/28/36/48/51 previously had to be re-implemented
+ * per handler. The three surfaces become thin adapters — one operation
+ * definition, three transports — so a validation fix lands everywhere at
+ * once.
+ *
+ * Host-agnostic (rule 31): operation names carry no `openclaw-*`/`engram-*`
+ * prefix. Session/namespace tenancy stays in the handler layer (resolved via
+ * ScopePlan #1521); the boundary validates SHAPE, not tenancy.
+ */
+
+import { z } from "zod";
+import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
+import { expandTildePath } from "./utils/path.js";
+
+// ---------------------------------------------------------------------------
+// Canonical operation names — host-agnostic (rule 31)
+// ---------------------------------------------------------------------------
+
+/**
+ * Canonical operation ids. One id is shared by the MCP tool, the HTTP route,
+ * and the CLI command that expose the same operation. Add to this union as
+ * each domain-group migration PR (memory ops → connectors → namespaces …)
+ * lands; the fitness test in `access-surface-catalog.test.ts` treats the
+ * registered set as the migration state.
+ */
+export type OperationName =
+  | "memory_get"
+  | "memory_search"
+  | "memory_store";
+
+// ---------------------------------------------------------------------------
+// Operation context — what every handler receives
+// ---------------------------------------------------------------------------
+
+/**
+ * Per-call context. `service` is the facade the handler delegates to; the
+ * boundary never reaches past it. `authenticatedPrincipal` is resolved by
+ * the SURFACE (MCP header / HTTP identity / CLI flag) before the boundary
+ * runs, so handlers stay principal-source-agnostic. `hooks` carries
+ * transport-level callbacks (e.g. HTTP write-quota enforcement) that must
+ * fire atomically inside the service call; surfaces that have no such hook
+ * leave it undefined.
+ */
+export interface OperationContext {
+  readonly service: EngramAccessService;
+  readonly authenticatedPrincipal?: string;
+  readonly hooks?: OperationHooks;
+}
+
+/**
+ * Transport-level callbacks a handler forwards into the service call. Kept
+ * narrow on purpose: the boundary owns validation + dispatch shape, not
+ * transport policy. Add fields here only when a surface genuinely needs a
+ * callback the service itself consumes.
+ */
+export interface OperationHooks {
+  /** HTTP write-quota gate; throws to reject the write when exhausted. */
+  readonly enforceWriteQuota?: () => void | Promise<void>;
+}
+
+// ---------------------------------------------------------------------------
+// Operation spec + bound operation
+// ---------------------------------------------------------------------------
+
+export interface OperationSpec<In, Out> {
+  /** Canonical operation id; matches an {@link OperationName}. */
+  readonly name: OperationName;
+  readonly description: string;
+  /** Zod schema validating the raw request envelope. */
+  readonly schema: z.ZodType<In>;
+  /** Handler invoked with the parsed input; throws EngramAccessInputError for domain faults. */
+  readonly handler: (input: In, ctx: OperationContext) => Promise<Out>;
+}
+
+export interface BoundOperation<In = unknown, Out = unknown> {
+  readonly spec: OperationSpec<In, Out>;
+  /** Validate the raw envelope, then invoke the handler. Throws EngramAccessInputError on any validation failure. */
+  readonly run: (rawInput: unknown, ctx: OperationContext) => Promise<Out>;
+}
+
+// ---------------------------------------------------------------------------
+// Shared normalizers the boundary owns (rules 17, 28, 36, 48, 51)
+// ---------------------------------------------------------------------------
+
+/**
+ * Coerce boolean-like strings at the edge (rule 36). Accepts actual booleans
+ * and the string spellings clients send ("true"/"false"/"1"/"0"/"yes"/"no"/
+ * "on"/"off", case-insensitive). Rejects anything else loudly — `Boolean("false")`
+ * would silently be `true`, which is the bug rule 36 exists to prevent.
+ *
+ * `undefined`/`null`/`""` → `undefined`, so callers can keep treating an
+ * absent flag as "use the default" without a separate presence check.
+ */
+export function coerceBooleanLike(value: unknown): boolean | undefined {
+  if (value === undefined || value === null || value === "") return undefined;
+  if (typeof value === "boolean") return value;
+  if (typeof value === "string") {
+    const lower = value.trim().toLowerCase();
+    if (lower === "true" || lower === "1" || lower === "yes" || lower === "on") return true;
+    if (lower === "false" || lower === "0" || lower === "no" || lower === "off") return false;
+  }
+  throw new EngramAccessInputError(
+    `expected a boolean-like value (true|false|1|0|yes|no|on|off); got ${JSON.stringify(value)}`,
+  );
+}
+
+/**
+ * Coerce + validate a positive integer from a numeric string or number
+ * (rule 28). Loosely-typed MCP/CLI clients send `"5"`; `typeof saved === "number"`
+ * on read-back would reject it later, so we coerce at the edge and reject
+ * booleans/objects loudly (`Number(true) === 1` would silently pass otherwise).
+ *
+ * `undefined`/`null`/`""` → `undefined`.
+ */
+export function coercePositiveInteger(value: unknown, label: string): number | undefined {
+  if (value === undefined || value === null || value === "") return undefined;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value) || value <= 0 || !Number.isInteger(value)) {
+      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
+    }
+    return value;
+  }
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (!/^[+-]?\d+$/.test(trimmed)) {
+      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
+    }
+    const parsed = Number(trimmed);
+    if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
+    }
+    return parsed;
+  }
+  throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
+}
+
+/**
+ * Expand `~` in a path-shaped input (rule 17). Node `fs` does NOT expand `~`;
+ * ad-hoc regex drifts. `undefined`/`null`/`""` → `undefined`.
+ */
+export function normalizeOptionalPath(value: unknown): string | undefined {
+  if (value === undefined || value === null || value === "") return undefined;
+  if (typeof value !== "string") {
+    throw new EngramAccessInputError(`expected a path string; got ${JSON.stringify(value)}`);
+  }
+  return expandTildePath(value);
+}
+
+// ---------------------------------------------------------------------------
+// Error formatting — rule 51: list valid options, never silently default
+// ---------------------------------------------------------------------------
+
+/**
+ * Turn a zod failure into an {@link EngramAccessInputError} whose message
+ * names the offending field and — for enum/union issues — lists the valid
+ * options, so the caller can correct rather than guess (rule 51).
+ */
+export function formatZodIssues(error: z.ZodError): string {
+  const parts: string[] = [];
+  for (const issue of error.issues) {
+    const path = issue.path.length > 0 ? issue.path.join(".") : "(root)";
+    const options = enumOptionsFromIssue(issue);
+    const suffix = options ? `. Valid: ${options.join(", ")}` : "";
+    parts.push(`${path}: ${issue.message}${suffix}`);
+  }
+  return parts.length > 0
+    ? `request validation failed: ${parts.join("; ")}`
+    : "request validation failed";
+}
+
+function enumOptionsFromIssue(issue: z.ZodIssue): readonly string[] | undefined {
+  // zod exposes accepted enum values on the issue for ZodEnum / ZodNativeEnum
+  // and on the options of invalid_union discriminators. Reading them here
+  // keeps "list valid options" in ONE place rather than per handler.
+  if (issue.code === z.ZodIssueCode.invalid_enum_value) {
+    const rawOptions = (issue as { options?: unknown }).options;
+    if (Array.isArray(rawOptions)) {
+      return rawOptions.map((opt) => String(opt));
+    }
+  }
+  return undefined;
+}
+
+// ---------------------------------------------------------------------------
+// Registry
+// ---------------------------------------------------------------------------
+
+const registry = new Map<OperationName, BoundOperation>();
+
+/**
+ * Register an operation. Throws if the name is already registered — duplicate
+ * registration is a programming error, not a runtime input fault, so it throws
+ * a plain Error (not the input-error class surfaces translate for clients).
+ */
+export function defineOperation<In, Out>(spec: OperationSpec<In, Out>): BoundOperation<In, Out> {
+  if (registry.has(spec.name)) {
+    throw new Error(`access-boundary: operation already registered: ${spec.name}`);
+  }
+  const bound: BoundOperation<In, Out> = {
+    spec,
+    run: async (rawInput, ctx) => {
+      const parseResult = spec.schema.safeParse(rawInput);
+      if (!parseResult.success) {
+        throw new EngramAccessInputError(formatZodIssues(parseResult.error));
+      }
+      return spec.handler(parseResult.data, ctx);
+    },
+  };
+  // Store under the canonical name; the cast is safe because In/Out are
+  // erased at the registry boundary and recovered by callers via getOperation.
+  registry.set(spec.name, bound as unknown as BoundOperation);
+  return bound;
+}
+
+/** Look up a registered operation by canonical name. */
+export function getOperation(name: OperationName): BoundOperation | undefined {
+  return registry.get(name);
+}
+
+/** All registered operation names. */
+export function listRegisteredOperations(): readonly OperationName[] {
+  return [...registry.keys()];
+}
+
+/** Test-only: clear the registry so pilot definitions can be re-registered. */
+export function __resetRegistryForTest(): void {
+  registry.clear();
+}

package/src/access-cli.ts

@@ -7,6 +7,10 @@ import { EngramAccessService } from "./access-service.js";
 import { readEnvVar, resolveHomeDir } from "./runtime/env.js";
 import { resolvePluginEntry } from "./plugin-entry-resolver.js";
 import { expandTildePath } from "./utils/path.js";
+import { getOperation } from "./access-boundary.js";
+// Importing access-operations registers the pilot boundary operations as a
+// side effect; the store command dispatches through the registry (issue #1525).
+import "./access-operations.js";
 
 const OPENCLAW_REMNIC_PLUGIN_IDS = ["openclaw-remnic", "openclaw-engram"] as const;
 
@@ -428,21 +432,34 @@ async function runStore(args: ParsedArgs, preferredId?: string): Promise<void> {
   };
 
   const { config, service } = buildRuntime(preferredId);
-  const result = await service.memoryStore({
-    namespace: storeArgs.namespace,
-    sessionKey: storeArgs.sessionKey,
-    authenticatedPrincipal: getLastOption(args, "principal") ?? config.agentAccessHttp.principal,
-    content: storeArgs.content,
-    category: storeArgs.category,
-    confidence: storeArgs.confidence,
-    tags: storeArgs.tags,
-    entityRef: storeArgs.entityRef,
-    ttl: storeArgs.ttl,
-    sourceReason: storeArgs.sourceReason,
-    idempotencyKey: storeArgs.idempotencyKey,
-    dryRun: storeArgs.dryRun,
-  });
-  console.log(JSON.stringify(result, null, 2));
+  // Migrated through the access boundary (issue #1525): the store command
+  // dispatches through the same registry entry as the MCP tool and HTTP
+  // route, so validation/normalization is owned in ONE place. The CLI has no
+  // write-quota hook (it is a one-shot process), so no hooks are forwarded.
+  const op = getOperation("memory_store");
+  if (!op) {
+    throw new Error("access-boundary: operation not registered: memory_store");
+  }
+  const output = (await op.run(
+    {
+      namespace: storeArgs.namespace,
+      sessionKey: storeArgs.sessionKey,
+      content: storeArgs.content,
+      category: storeArgs.category,
+      confidence: storeArgs.confidence,
+      tags: storeArgs.tags,
+      entityRef: storeArgs.entityRef,
+      ttl: storeArgs.ttl,
+      sourceReason: storeArgs.sourceReason,
+      idempotencyKey: storeArgs.idempotencyKey,
+      dryRun: storeArgs.dryRun,
+    },
+    {
+      service,
+      authenticatedPrincipal: getLastOption(args, "principal") ?? config.agentAccessHttp.principal,
+    },
+  )) as { result: unknown };
+  console.log(JSON.stringify(output.result, null, 2));
 }
 
 function expandOptionalPath(value: string | undefined): string | undefined {

package/src/access-http.ts

@@ -7,7 +7,7 @@ import path from "node:path";
 import { fileURLToPath, URL } from "node:url";
 import { gunzipSync } from "node:zlib";
 import { log } from "./logger.js";
-import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
+import { EngramAccessInputError, type EngramAccessService, type EngramAccessMemoryResponse, type EngramAccessWriteResponse } from "./access-service.js";
 import { WearablesInputError } from "./wearables/errors.js";
 import { EngramMcpServer } from "./access-mcp.js";
 import { validateRequest, type SchemaName, type SchemaTypeFor } from "./access-schema.js";
@@ -27,6 +27,11 @@ import {
 } from "./graph-events.js";
 import { expandTildePath } from "./utils/path.js";
 import { projectTagProjectId } from "./coding/coding-namespace.js";
+import { getOperation } from "./access-boundary.js";
+// Importing access-operations registers the pilot boundary operations
+// (memory_get / memory_store) as a side effect; the HTTP handlers below
+// dispatch the migrated routes through the registry (issue #1525).
+import "./access-operations.js";
 
 export interface EngramAccessHttpServerOptions {
   service: EngramAccessService;
@@ -1297,35 +1302,28 @@ export class EngramAccessHttpServer {
     }
 
     if (req.method === "POST" && pathname === "/engram/v1/memories") {
+      // Migrated through the access boundary (issue #1525): the registry
+      // entry owns schema validation, normalization, and service dispatch.
+      // The HTTP transport resolves the request-scoped namespace and principal
+      // BEFORE the boundary re-validates the cleaned envelope. The write-quota
+      // hook is forwarded via ctx.hooks so it still fires atomically inside
+      // the service's idempotent-write lock — never before, never on a replay
+      // (#1434 invariant preserved by the boundary migration).
       const body = await this.readValidatedBody(req, "memoryStore");
-      const request = {
-        schemaVersion: body.schemaVersion,
-        idempotencyKey: body.idempotencyKey,
-        dryRun: body.dryRun === true,
-        sessionKey: body.sessionKey,
-        authenticatedPrincipal: this.resolveRequestPrincipal(req),
-        content: body.content,
-        category: body.category,
-        confidence: body.confidence,
+      const envelope = {
+        ...body,
         namespace: this.resolveNamespace(req, body.namespace),
-        tags: body.tags,
-        entityRef: body.entityRef,
-        ttl: body.ttl,
-        sourceReason: body.sourceReason,
-        cwd: body.cwd,
-        projectTag: body.projectTag,
       };
-      // Rate-limit enforcement is SOLELY authoritative inside memoryStore via
-      // enforceWriteQuota: it runs atomically with the real idempotency-miss
-      // determination (and the real resolved namespace), and is never invoked
-      // for a replay. We deliberately do NOT pre-check here: the write namespace
-      // is resolved from mutable session/git context, so a stale peek could
-      // report "miss" for a request that is actually an idempotent replay in the
-      // now-scoped namespace and hard-reject a safe replay with 429 (#1434 Codex
-      // review). Letting the in-lock hook be the only hard gate avoids that.
-      const response = await this.service.memoryStore(request, {
-        enforceWriteQuota: () => this.ensureWriteRateLimitAvailable(),
-      });
+      const op = getOperation("memory_store");
+      if (!op) {
+        throw new EngramAccessInputError("access-boundary: operation not registered: memory_store");
+      }
+      const output = (await op.run(envelope, {
+        service: this.service,
+        authenticatedPrincipal: this.resolveRequestPrincipal(req),
+        hooks: { enforceWriteQuota: () => this.ensureWriteRateLimitAvailable() },
+      })) as { result: EngramAccessWriteResponse };
+      const response = output.result;
       if (this.shouldCountWriteRateLimit(response as { dryRun?: boolean; idempotencyReplay?: boolean })) {
         this.recordWriteRateLimitHit();
       }
@@ -1387,7 +1385,19 @@ export class EngramAccessHttpServer {
     if (req.method === "GET" && memoryMatch) {
       const memoryId = decodeURIComponent(memoryMatch[1] ?? "");
       const namespace = parsed.searchParams.get("namespace") ?? undefined;
-      const response = await this.service.memoryGet(memoryId, namespace, this.resolveRequestPrincipal(req));
+      // Migrated through the access boundary (issue #1525): the registry
+      // entry owns memoryId presence/shape validation (rule 51: reject empty
+      // ids loudly instead of silently passing "" into the service) and the
+      // service dispatch.
+      const op = getOperation("memory_get");
+      if (!op) {
+        throw new EngramAccessInputError("access-boundary: operation not registered: memory_get");
+      }
+      const output = (await op.run(
+        { memoryId, namespace: namespace ?? null },
+        { service: this.service, authenticatedPrincipal: this.resolveRequestPrincipal(req) },
+      )) as { result: EngramAccessMemoryResponse };
+      const response = output.result;
       this.respondJson(res, response.found ? 200 : 404, response);
       return;
     }