@remnic/core 9.3.726 → 9.3.728

package/src/provenance-extraction.test.ts

@@ -836,3 +836,269 @@ test("toStrictIsoTimestamp path: valid MM/DD/YYYY still normalizes (thread dH47
     /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/,
   );
 });
+
+
+// ---------------------------------------------------------------------------
+// Regression: issue #1657 — partial year-led timestamps must not be admitted
+// as fabricated complete dates. Date.parse fills in missing calendar
+// components ("2026-05" -> May 1) and the ymd guard misparses the date/time
+// boundary ("2026-05T10:00" reads the hour as the day). The normalization
+// path must reject any year-led shape with fewer than three complete calendar
+// components rather than persisting a fabricated observedAt.
+// ---------------------------------------------------------------------------
+
+test("toStrictIsoTimestamp path: partial YYYY-MM timestamp is rejected, not fabricated (issue #1657)", () => {
+  // "2026-05" is Date.parse-able (-> 2026-05-01) and passes the separator
+  // guard, so pre-fix the write path persisted a fabricated observedAt of
+  // 2026-05-01T00:00:00.000Z. Reject it so the source is dropped.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-05" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  // No verified source: the only matching turn has a partial timestamp.
+  assert.equal(result.provenance, "unverified");
+  assert.ok(result.sources);
+  assert.notEqual(
+    result.sources![0]!.observedAt,
+    "2026-05-01T00:00:00.000Z",
+    "partial YYYY-MM timestamp must not fabricate May 1",
+  );
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "rejected partial timestamp falls back to epoch",
+  );
+});
+
+test("toStrictIsoTimestamp path: partial YYYY-MM T HH:MM is rejected, not misparsed (issue #1657)", () => {
+  // "2026-05T10:00" is Date.parse-able; the ymd regex grabs the hour "10" as
+  // the day across the date/time boundary, so pre-fix the write path persisted
+  // a fabricated observedAt (on May 10, shifted by timezone). Reject it.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-05T10:00" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "unverified");
+  assert.ok(result.sources);
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "partial YYYY-MM T HH:MM timestamp must fall back to epoch, not a fabricated date",
+  );
+});
+
+test("toStrictIsoTimestamp path: complete YYYY-MM-DD (no time) still normalizes (issue #1657 non-regression)", () => {
+  // A complete calendar date with no time component must still round-trip
+  // through Date.parse to strict ISO. This is the boundary the partial-date
+  // guard must NOT over-reject.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-05-03" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "verified");
+  assert.ok(result.sources);
+  assert.equal(
+    result.sources![0]!.observedAt,
+    "2026-05-03T00:00:00.000Z",
+    "complete date-only timestamp normalizes to UTC midnight",
+  );
+});
+
+test("toStrictIsoTimestamp path: space-separated partial YYYY-MM HH:MM is rejected (issue #1657, codex r2)", () => {
+  // "2026-05 10:00" is Date.parse-able; the date separator must be a real
+  // date separator (- or /), not the space that precedes the time component.
+  // Pre-fix the guard treated the space as a date separator and captured the
+  // hour "10" as the day, persisting a fabricated 2026-05-(10) source.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-05 10:00" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "unverified");
+  assert.ok(result.sources);
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "space-separated partial timestamp must fall back to epoch, not a fabricated date",
+  );
+});
+
+test("toStrictIsoTimestamp path: leading-whitespace partial timestamp is rejected (issue #1657, codex r3)", () => {
+  // Date.parse trims leading whitespace, so " 2026-05" parses as May 1 —
+  // but the ^\d{4} guard anchored at the start would not recognize the
+  // string as year-led, bypassing the partial-date rejection. Trim first.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: " 2026-05" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "unverified");
+  assert.ok(result.sources);
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "leading-whitespace partial timestamp must fall back to epoch, not a fabricated date",
+  );
+});
+
+test("toStrictIsoTimestamp path: complete year-first textual-month date is preserved (issue #1657, codex r4)", () => {
+  // A complete year-first TEXTUAL-month date ("2026-Jan-15") is normalized by
+  // Date.parse and must stay verified — the unified guard must not reject a
+  // complete textual month. Date.parse parses this non-ISO form in the LOCAL
+  // timezone, so assert the source is preserved (verified, not the epoch
+  // fallback) and normalized to strict ISO — without assuming the UTC day,
+  // which shifts across timezones (codex r7).
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-Jan-15" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "verified", "complete textual-month date must stay verified");
+  assert.ok(result.sources);
+  const observedAt = result.sources![0]!.observedAt;
+  assert.match(
+    observedAt,
+    /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/,
+    "textual-month observedAt must normalize to strict ISO",
+  );
+  assert.notEqual(
+    observedAt,
+    new Date(0).toISOString(),
+    "complete textual-month date must not fall back to the epoch (it was accepted, not rejected)",
+  );
+});
+
+test("toStrictIsoTimestamp path: partial textual year-month is rejected (issue #1657, codex r5)", () => {
+  // "2026-Jan" is Date.parse-able (-> Jan 1) — a partial year-led TEXTUAL
+  // month that must be rejected just like the numeric "2026-05", not
+  // fabricated. The unified year-led guard covers textual months too.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-Jan" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "unverified");
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "partial textual year-month must fall back to epoch, not a fabricated Jan 1",
+  );
+});
+
+test("toStrictIsoTimestamp path: partial textual year-month with time is rejected (issue #1657, codex r5)", () => {
+  // "2026-Jan 10:00" — the hour must not be captured as the day across the
+  // date/time boundary (textual analogue of "2026-05 10:00").
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-Jan 10:00" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "unverified");
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "partial textual year-month with time must fall back to epoch",
+  );
+});
+
+test("toStrictIsoTimestamp path: textual-month calendar overflow is rejected (issue #1657, codex r5)", () => {
+  // "2026-Feb-30" is a COMPLETE textual date but Feb 30 overflows — Date.parse
+  // shifts it to March 2. The unified guard validates the textual month's
+  // calendar day too, so this is rejected rather than fabricated (textual
+  // analogue of the numeric dANc overflow).
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-Feb-30" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "unverified");
+  assert.notEqual(
+    result.sources![0]!.observedAt,
+    "2026-03-02T00:00:00.000Z",
+    "textual-month overflow must not be silently shifted to March 2",
+  );
+  assert.equal(
+    result.sources![0]!.observedAt,
+    new Date(0).toISOString(),
+    "textual-month overflow falls back to epoch",
+  );
+});
+
+test("toStrictIsoTimestamp path: full month name is preserved (issue #1657, codex r6)", () => {
+  // Date.parse accepts full month names ("2026-January-15"), so the textual
+  // month map must include both abbreviations and full names — otherwise a
+  // complete, valid full-name date is dropped to an unverified epoch source.
+  // Date.parse parses this non-ISO form in the LOCAL timezone, so assert the
+  // source is preserved (verified, not epoch) without a UTC-day assumption.
+  const turns = [
+    makeTurn("We migrated the production database to pgBouncer.", {
+      timestamp: "2026-January-15" as unknown as string,
+    }),
+  ];
+  const result = buildFactProvenance(
+    "migrated the production database to pgBouncer",
+    turns,
+    DEFAULT_CONFIG,
+  );
+  assert.equal(result.provenance, "verified", "full-name textual month must stay verified");
+  assert.ok(result.sources);
+  const observedAt = result.sources![0]!.observedAt;
+  assert.match(
+    observedAt,
+    /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/,
+    "full-name textual month observedAt must normalize to strict ISO",
+  );
+  assert.notEqual(
+    observedAt,
+    new Date(0).toISOString(),
+    "full-name textual month must not fall back to the epoch (it was accepted, not rejected)",
+  );
+});

package/src/provenance.ts

@@ -188,33 +188,39 @@ function isStrictIsoTimestamp(s: string): boolean {
  */
 function toStrictIsoTimestamp(ts: string | undefined | null): string | undefined {
   if (typeof ts !== "string" || ts.length === 0) return undefined;
-  if (isStrictIsoTimestamp(ts)) return ts;
-  const parsed = Date.parse(ts);
+  // Trim surrounding whitespace: Date.parse accepts leading/trailing
+  // whitespace, so an imported " 2026-05" would otherwise bypass the
+  // year-led partial-date guard below and fabricate May 1
+  // (chatgpt-codex-connector review on #1714, issue #1657).
+  const value = ts.trim();
+  if (value.length === 0) return undefined;
+  if (isStrictIsoTimestamp(value)) return value;
+  const parsed = Date.parse(value);
   if (Number.isNaN(parsed)) return undefined;
   // Reject bare-year / numeric-only strings that Date.parse accepts (e.g.
   // "123") — isStrictIsoTimestamp already rejected them, and the round-trip
   // below would otherwise resurrect them. Require at least one date/time
   // separator so a plain number never round-trips into a fake epoch.
-  if (!/[-:T]/.test(ts)) return undefined;
-  // Reject calendar-overflow dates (chatgpt-codex-connector thread dANc):
-  // Date.parse silently rolls over invalid components — "2026-02-30" becomes
-  // 2026-03-02 — fabricating the observation date. For strings that carry an
-  // explicit numeric Y/M/D prefix (the common import/provider shape), validate
-  // the calendar components are in range before accepting the shifted result.
-  // isStrictIsoTimestamp already does this for full ISO strings; this closes
-  // the gap for the non-ISO normalization path.
-  const ymd = /^(\d{4})\D(\d{1,2})\D(\d{1,2})/.exec(ts);
-  if (ymd) {
-    const [_, ys, ms, ds] = ymd;
-    const y = Number(ys), mo = Number(ms), da = Number(ds);
-    if (!isValidCalendarDate(y, mo, da)) return undefined;
+  if (!/[-:T]/.test(value)) return undefined;
+  // Reject year-led timestamps that are not a COMPLETE, calendar-valid date
+  // (issue #1657). Date.parse silently fills missing components ("2026-05" ->
+  // May 1, "2026-Jan" -> Jan 1) and rolls overflow ("2026-02-30" and
+  // "2026-Feb-30" -> March 2), fabricating observedAt. `parseYearLedDatePrefix`
+  // requires a complete three-component date — numeric OR textual month — with
+  // real date separators (not T/:, and not the space that precedes a time
+  // component, so the hour is never captured as the day) and a calendar-valid
+  // day, in one rule (subsumes the prior partial-numeric and numeric-overflow
+  // checks, and extends them to textual months). Non-year-led shapes
+  // ("Jan 15 2026", "02/30/2026") fall through to Date.parse / the mdy check.
+  if (/^\d{4}\D/.test(value) && parseYearLedDatePrefix(value) === null) {
+    return undefined;
   }
   // Also validate M/D/Y or D/M/Y formats (provider/import common shapes:
   // 02/30/2026, 30-02-2026, etc.). Date.parse silently shifts overflow in
   // these too. Try both month-first and day-first interpretations; if
   // neither is a valid calendar date, reject (chatgpt-codex-connector thread
   // dH47 — non-YMD overflow timestamps).
-  const mdy = /^(\d{1,2})\D(\d{1,2})\D(\d{4})/.exec(ts);
+  const mdy = /^(\d{1,2})\D(\d{1,2})\D(\d{4})/.exec(value);
   if (mdy) {
     const a = Number(mdy[1]), b = Number(mdy[2]), yr = Number(mdy[3]);
     if (!isValidCalendarDate(yr, a, b) && !isValidCalendarDate(yr, b, a)) {
@@ -238,6 +244,50 @@ function isValidCalendarDate(y: number, mo: number, da: number): boolean {
   return da <= daysInMonth[mo - 1]!;
 }
 
+/**
+ * Recognized month-name → number map for year-led textual-month dates
+ * (issue #1657). Both the 3-letter abbreviations and the full names that
+ * Date.parse accepts for year-first shapes (e.g. "2026-Jan-15",
+ * "2026-January-15", "2026 February 2").
+ */
+const MONTH_NAMES: Record<string, number> = {
+  jan: 1, january: 1,
+  feb: 2, february: 2,
+  mar: 3, march: 3,
+  apr: 4, april: 4,
+  may: 5,
+  jun: 6, june: 6,
+  jul: 7, july: 7,
+  aug: 8, august: 8,
+  sep: 9, september: 9,
+  sept: 9,
+  oct: 10, october: 10,
+  nov: 11, november: 11,
+  dec: 12, december: 12,
+};
+
+/**
+ * Parse a complete, calendar-valid year-led date prefix from `s`
+ * (issue #1657): `YYYY <sep> (MM | MonthName) <sep> DD` where the separators
+ * are real date separators (non-digit, non-T, non-colon) and the day is a
+ * true calendar day — not the hour before a `:` time separator (the
+ * `(?![\d:])` lookahead rejects "2026-05 10:00" capturing "10" as the day).
+ * Returns the numeric components for a complete, valid date; `null` for an
+ * incomplete ("2026-05", "2026-Jan"), overflowed ("2026-02-30",
+ * "2026-Feb-30"), or non-year-led prefix. Centralizes the fabricated-date
+ * rejection for the toStrictIsoTimestamp normalization path across numeric
+ * and textual months in one rule.
+ */
+function parseYearLedDatePrefix(s: string): { y: number; mo: number; da: number } | null {
+  const m = /^(\d{4})[^0-9T](\d{1,2}|[A-Za-z]{3,})[^0-9T:](\d{1,2})(?![\d:])/.exec(s);
+  if (!m) return null;
+  const y = Number(m[1]);
+  const da = Number(m[3]);
+  const mo = /^\d+$/.test(m[2]) ? Number(m[2]) : (MONTH_NAMES[m[2]!.toLowerCase()] ?? -1);
+  if (!isValidCalendarDate(y, mo, da)) return null;
+  return { y, mo, da };
+}
+
 /**
  * Zod schema for a single `ProvenanceSource` entry (issue #1575).  Parsed
  * JSON from frontmatter is external data, so each entry is validated here

package/src/search/embed-helper.ts

@@ -1,4 +1,5 @@
 import { log } from "../logger.js";
+import { resolveMemoryLifecycleCapabilities } from "../capabilities.js";
 import type { PluginConfig } from "../types.js";
 import { isAbortError } from "../abort-error.js";
 import { withTimeoutSignal } from "./abort.js";
@@ -209,7 +210,7 @@ export class EmbedHelper {
   }
 
   private resolveProvider(options: { includeHost?: boolean } = {}): ProviderConfig | null {
-    if (!this.config.embeddingFallbackEnabled) return null;
+    if (!resolveMemoryLifecycleCapabilities(this.config).embeddingFallback) return null;
 
     if (
       options.includeHost !== false &&
@@ -244,7 +245,7 @@ export class EmbedHelper {
   }
 
   private resolveFallbackProviderForIdentity(identity: EmbedProviderIdentity): ProviderConfig | null {
-    if (!this.config.embeddingFallbackEnabled) return null;
+    if (!resolveMemoryLifecycleCapabilities(this.config).embeddingFallback) return null;
     const separator = identity.indexOf(":");
     if (separator <= 0 || separator === identity.length - 1) return null;
     const type = identity.slice(0, separator);

package/src/types.ts

@@ -1222,6 +1222,14 @@ export interface PluginConfig {
   extractionFaithfulnessContextChars: number;
   /** Per-batch timeout in ms; timeout → tagged error, never blocks writes. Default 8000. */
   extractionFaithfulnessTimeoutMs: number;
+  /**
+   * Resilient-fallback toggle for the local model-lab endpoint (issue #1700
+   * nit #6). When the local endpoint returns 200 with non-verdict JSON, the
+   * default (false) surfaces `malformed_output` so a misconfigured endpoint is
+   * visible to the operator. Set true to instead fall back to the configured
+   * chain on local parse failure (pre-validated via parseFaithfulnessResponse).
+   */
+  extractionFaithfulnessLocalParseFallback: boolean;
   /**
    * Correction-intent model-lab pointer (issue #1581 / #1585). When both this
    * and `correctionIntentBaseUrl` are set, the detection path can route to a