@remnic/core 9.3.732 → 9.3.734

package/src/access-service.ts

@@ -5,7 +5,12 @@ import { readdirSync, unlinkSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { ZodError } from "zod";
 import { AccessIdempotencyStore, hashAccessIdempotencyPayload } from "./access-idempotency.js";
-import { resolveMemoryLifecycleCapabilities } from "./capabilities.js";
+import {
+  resolveNamespaceCapabilities,
+  resolveMemoryLifecycleCapabilities,
+  resolveQmdCapabilities,
+  resolveIdentityContinuityCapabilities,
+} from "./capabilities.js";
 import { AccessAuditAdapter, type AccessAuditConfig, type AccessAuditResult } from "./access-audit.js";
 import type { AnomalyDetectorResult } from "./recall-audit-anomaly.js";
 import { resolveGitContext } from "./coding/git-context.js";
@@ -1339,7 +1344,7 @@ export class EngramAccessService {
   private resolveNamespace(namespace?: string): string {
     const requested = namespace?.trim();
     if (!requested) return this.orchestrator.config.defaultNamespace;
-    if (!this.orchestrator.config.namespacesEnabled && requested !== this.orchestrator.config.defaultNamespace) {
+    if (!resolveNamespaceCapabilities(this.orchestrator.config).namespaces && requested !== this.orchestrator.config.defaultNamespace) {
       throw new EngramAccessInputError(`unsupported namespace: ${requested}`);
     }
     return requested;
@@ -1458,14 +1463,14 @@ export class EngramAccessService {
       typeof request.sessionKey === "string" && request.sessionKey.length > 0;
     const codingContext =
       hasSession &&
-      this.orchestrator.config.namespacesEnabled &&
+      resolveNamespaceCapabilities(this.orchestrator.config).namespaces &&
       this.orchestrator.config.codingMode?.projectScope
         ? this.orchestrator.getCodingContextForSession(request.sessionKey) ??
           (await this.resolveCodingContextFromOptions(request))
         : null;
     const overlay =
       hasSession &&
-      this.orchestrator.config.namespacesEnabled &&
+      resolveNamespaceCapabilities(this.orchestrator.config).namespaces &&
       this.orchestrator.config.codingMode?.projectScope
         ? resolveCodingNamespaceOverlay(
             codingContext,
@@ -1686,7 +1691,7 @@ export class EngramAccessService {
       typeof request.sessionKey === "string" && request.sessionKey.length > 0;
     const overlayEligible =
       hasSession &&
-      this.orchestrator.config.namespacesEnabled === true &&
+      resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true &&
       this.orchestrator.config.codingMode?.projectScope === true;
 
     // Resolve the coding context the overlay must use: the session's ATTACHED
@@ -1822,7 +1827,7 @@ export class EngramAccessService {
         this.orchestrator.config.objectiveStateSnapshotWritesEnabled === true;
       if (
         willWriteObjectiveState &&
-        this.orchestrator.config.namespacesEnabled === true &&
+        resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true &&
         !canWriteNamespace(principal, baseNamespace, this.orchestrator.config)
       ) {
         clearSeededContext();
@@ -1897,7 +1902,7 @@ export class EngramAccessService {
     memoryDir: string;
     objectiveStateStoreDir?: string;
   }> {
-    if (!this.orchestrator.config.namespacesEnabled) {
+    if (!resolveNamespaceCapabilities(this.orchestrator.config).namespaces) {
       return {
         memoryDir: this.orchestrator.config.memoryDir,
         objectiveStateStoreDir: this.orchestrator.config.objectiveStateStoreDir,
@@ -1909,7 +1914,7 @@ export class EngramAccessService {
       objectiveStateStoreDir: objectiveStateStoreOverrideForNamespace({
         memoryDir: this.orchestrator.config.memoryDir,
         configuredStoreDir: this.orchestrator.config.objectiveStateStoreDir,
-        namespacesEnabled: this.orchestrator.config.namespacesEnabled,
+        namespacesEnabled: resolveNamespaceCapabilities(this.orchestrator.config).namespaces,
         namespace,
       }),
     };
@@ -1917,7 +1922,7 @@ export class EngramAccessService {
 
   private resolveReadableNamespace(namespace: string | undefined, principal?: string): string {
     const resolved = this.resolveNamespace(namespace);
-    const namespacesEnabled = this.orchestrator.config.namespacesEnabled;
+    const namespacesEnabled = resolveNamespaceCapabilities(this.orchestrator.config).namespaces;
 
     if (!namespacesEnabled) {
       // Namespaces are disabled globally — no ACL needed for any caller.
@@ -1946,7 +1951,7 @@ export class EngramAccessService {
       return [this.resolveReadableNamespace(requested, principal)];
     }
 
-    if (!this.orchestrator.config.namespacesEnabled) {
+    if (!resolveNamespaceCapabilities(this.orchestrator.config).namespaces) {
       return [this.resolveNamespace(undefined)];
     }
 
@@ -1998,7 +2003,7 @@ export class EngramAccessService {
     namespaces: string[],
     collectionPrincipal?: string,
   ): string[] {
-    if (!this.orchestrator.config.namespacesEnabled) {
+    if (!resolveNamespaceCapabilities(this.orchestrator.config).namespaces) {
       return namespaces;
     }
 
@@ -2702,7 +2707,7 @@ export class EngramAccessService {
     const resolvedNamespace = this.resolveNamespace(namespace);
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     const searchBackend = this.orchestrator.config.searchBackend ?? "qmd";
-    const qmdEnabled = this.orchestrator.config.qmdEnabled === true;
+    const qmdEnabled = resolveQmdCapabilities(this.orchestrator.config).qmd === true;
     let projectionAvailable = false;
     try {
       await stat(getMemoryProjectionPath(storage.dir));
@@ -2714,7 +2719,7 @@ export class EngramAccessService {
     return {
       ok: true,
       memoryDir: storage.dir,
-      namespacesEnabled: this.orchestrator.config.namespacesEnabled === true,
+      namespacesEnabled: resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true,
       defaultNamespace: this.orchestrator.config.defaultNamespace,
       searchBackend,
       qmdEnabled,
@@ -2730,7 +2735,7 @@ export class EngramAccessService {
   }
 
   private qmdCollectionForHealth(namespace: string, storageDir: string): string {
-    if (this.orchestrator.config.namespacesEnabled !== true) {
+    if (resolveNamespaceCapabilities(this.orchestrator.config).namespaces !== true) {
       return this.orchestrator.config.qmdCollection;
     }
 
@@ -2766,7 +2771,7 @@ export class EngramAccessService {
       };
     }
 
-    if (this.orchestrator.config.namespacesEnabled === true) {
+    if (resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true) {
       const namespaceHealth = await this.namespaceQmdHealth(searchBackend, qmdEnabled, namespace, collection);
       if (namespaceHealth) return namespaceHealth;
     }
@@ -3224,7 +3229,7 @@ export class EngramAccessService {
     const normalizedRequest = { ...request, query };
     const authenticatedPrincipal = request.authenticatedPrincipal?.trim();
     const principal = this.resolveRequestPrincipal(request.sessionKey, authenticatedPrincipal);
-    if (this.orchestrator.config.namespacesEnabled && !principal) {
+    if (resolveNamespaceCapabilities(this.orchestrator.config).namespaces && !principal) {
       throw new EngramAccessInputError(
         "authentication required: namespaces are enabled and no principal was supplied",
       );
@@ -3307,7 +3312,7 @@ export class EngramAccessService {
     // accounting (Codex P1: budget recorded before mode validation).
     const mode = this.normalizeRecallMode(request.mode);
     const maybePrincipal = this.resolveRequestPrincipal(request.sessionKey, authenticatedPrincipal);
-    if (this.orchestrator.config.namespacesEnabled && !maybePrincipal) {
+    if (resolveNamespaceCapabilities(this.orchestrator.config).namespaces && !maybePrincipal) {
       throw new EngramAccessInputError(
         "authentication required: namespaces are enabled and no principal was supplied",
       );
@@ -3321,7 +3326,7 @@ export class EngramAccessService {
     const profileCodingOverlay =
       !namespaceOverride &&
       profileCodingContext &&
-      this.orchestrator.config.namespacesEnabled &&
+      resolveNamespaceCapabilities(this.orchestrator.config).namespaces &&
       this.orchestrator.config.codingMode?.projectScope
         ? resolveCodingNamespaceOverlay(
             profileCodingContext,
@@ -3725,7 +3730,7 @@ export class EngramAccessService {
         return { found: false };
       }
     } else if (
-      this.orchestrator.config.namespacesEnabled
+      resolveNamespaceCapabilities(this.orchestrator.config).namespaces
       && !principal
     ) {
       return { found: false };
@@ -3744,7 +3749,7 @@ export class EngramAccessService {
         return candidate.namespace === requestedNamespace ? candidate : null;
       })();
     const readableSnapshot = (() => {
-      if (!snapshot || !this.orchestrator.config.namespacesEnabled) return snapshot;
+      if (!snapshot || !resolveNamespaceCapabilities(this.orchestrator.config).namespaces) return snapshot;
       const snapshotNamespace = snapshot.namespace ?? this.orchestrator.config.defaultNamespace;
       return canReadNamespace(principal, snapshotNamespace, this.orchestrator.config)
         ? snapshot
@@ -3754,7 +3759,7 @@ export class EngramAccessService {
       if (requestedNamespace) return requestedNamespace;
       if (readableSnapshot?.namespace) return readableSnapshot.namespace;
       const fallbackNamespace = this.orchestrator.config.defaultNamespace;
-      if (!this.orchestrator.config.namespacesEnabled) return fallbackNamespace;
+      if (!resolveNamespaceCapabilities(this.orchestrator.config).namespaces) return fallbackNamespace;
       return canReadNamespace(principal, fallbackNamespace, this.orchestrator.config)
         ? fallbackNamespace
         : null;
@@ -3773,7 +3778,7 @@ export class EngramAccessService {
     namespace?: string,
     authenticatedPrincipal?: string,
   ) {
-    const namespacesEnabled = this.orchestrator.config.namespacesEnabled;
+    const namespacesEnabled = resolveNamespaceCapabilities(this.orchestrator.config).namespaces;
     const requestedNamespace = namespace?.trim()
       ? this.resolveNamespace(namespace)
       : undefined;
@@ -3882,7 +3887,7 @@ export class EngramAccessService {
       );
     }
 
-    const namespacesEnabled = this.orchestrator.config.namespacesEnabled;
+    const namespacesEnabled = resolveNamespaceCapabilities(this.orchestrator.config).namespaces;
     const requestedNamespace = request.namespace?.trim()
       ? this.resolveNamespace(request.namespace)
       : undefined;
@@ -5983,7 +5988,7 @@ export class EngramAccessService {
       // namespace to one store, so leaving the override undefined preserves the
       // existing single-store routing byte-for-byte.
       const writeNamespaceOverride =
-        this.orchestrator.config.namespacesEnabled === true
+        resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true
           ? writeNamespace
           : undefined;
       // Pin provenance PRINCIPAL to the scope plan's resolved principal (#1505
@@ -6188,7 +6193,7 @@ export class EngramAccessService {
       (typeof request.sessionKey === "string" &&
         request.sessionKey.length > 0) ||
       lcmSessionPrefixes.some((prefix) => typeof prefix === "string" && prefix.length > 0);
-    if (!hasScopedSession && this.orchestrator.config.namespacesEnabled === true) {
+    if (!hasScopedSession && resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true) {
       return {
         query: request.query,
         namespace,
@@ -6483,7 +6488,7 @@ export class EngramAccessService {
     principal: string | undefined,
   ): string | undefined {
     const config = this.orchestrator.config;
-    if (!config.namespacesEnabled) return config.defaultNamespace;
+    if (!resolveNamespaceCapabilities(config).namespaces) return config.defaultNamespace;
     // PROCEED when `default` is readable (single-store / readable-default flows)
     // — the LCM prefix resolves to the overlay when self-authorized, else the
     // default raw key.
@@ -6824,7 +6829,7 @@ export class EngramAccessService {
     period?: "weekly" | "monthly";
     key?: string;
   }): Promise<{ enabled: boolean; reason?: string; period?: string; key?: string; reportPath?: string }> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled. Enable `identityContinuityEnabled: true`." };
     }
     if (!this.orchestrator.config.continuityAuditEnabled) {
@@ -6846,7 +6851,7 @@ export class EngramAccessService {
     triggerWindow?: string;
     suspectedCause?: string;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled. Enable `identityContinuityEnabled: true`." };
     }
     if (!this.orchestrator.config.continuityIncidentLoggingEnabled) {
@@ -6872,7 +6877,7 @@ export class EngramAccessService {
     verificationResult: string;
     preventiveRule?: string;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled." };
     }
     if (!this.orchestrator.config.continuityIncidentLoggingEnabled) {
@@ -6901,7 +6906,7 @@ export class EngramAccessService {
     principal?: string;
     limit?: number;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled." };
     }
     const state = request.state === "closed" || request.state === "all" ? request.state : "open";
@@ -6923,7 +6928,7 @@ export class EngramAccessService {
     lastReviewed?: string;
     notes?: string;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled." };
     }
     const resolvedNs = this.writableNamespaceFor(request.namespace, undefined, request.principal);
@@ -6948,7 +6953,7 @@ export class EngramAccessService {
     notes?: string;
     reviewedAt?: string;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled." };
     }
     const id = request.id?.trim();
@@ -6968,7 +6973,7 @@ export class EngramAccessService {
     namespace?: string;
     principal?: string;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled." };
     }
     const resolvedNs = this.resolveReadableNamespace(request.namespace, request.principal);
@@ -6994,7 +6999,7 @@ export class EngramAccessService {
     operatingPrinciples?: string;
     continuityNotes?: string;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled." };
     }
 
@@ -7419,7 +7424,7 @@ export class EngramAccessService {
     }
 
     let results: Array<{ path: string; score: number; snippet?: string }>;
-    if (!this.orchestrator.config.namespacesEnabled) {
+    if (!resolveNamespaceCapabilities(this.orchestrator.config).namespaces) {
       this.resolveReadableNamespace(namespace, principal);
       results = collection === "global"
         ? await this.orchestrator.qmd.searchGlobal(query, maxResults)
@@ -8162,7 +8167,7 @@ export class EngramAccessService {
     namespace: string;
     storage: StorageManager;
   }> {
-    if (this.orchestrator.config.namespacesEnabled && !principal?.trim()) {
+    if (resolveNamespaceCapabilities(this.orchestrator.config).namespaces && !principal?.trim()) {
       throw new EngramAccessInputError(
         "authentication required: namespaces are enabled and no principal was supplied",
       );
@@ -8902,7 +8907,7 @@ export class EngramAccessService {
     actor?: never; // ignored — actor is derived from the authenticated principal
   }) {
     const config = this.orchestrator.config;
-    const namespacesEnabled = config.namespacesEnabled === true;
+    const namespacesEnabled = resolveNamespaceCapabilities(config).namespaces === true;
     // Fix OdCl3: when no namespace is supplied, resolve the source via the
     // scope plan (principal self / scope-profile write layer / coding overlay)
     // instead of falling through to config.defaultNamespace. This matches the

package/src/active-memory-bridge.ts

@@ -1,3 +1,4 @@
+import { resolveNamespaceCapabilities } from "./capabilities.js";
 import { canReadNamespace, defaultNamespaceForPrincipal, resolvePrincipal } from "./namespaces/principal.js";
 import type { MemoryFile, PluginConfig } from "./types.js";
 import { collapseWhitespace, truncateCodePointSafe } from "./whitespace.js";
@@ -106,7 +107,7 @@ function resolveActiveMemoryNamespace(
     typeof orchestrator.resolvePrincipal === "function"
       ? orchestrator.resolvePrincipal(sessionKey)
       : resolvePrincipal(sessionKey, config);
-  if (config.namespacesEnabled && !principal) {
+  if (resolveNamespaceCapabilities(config).namespaces && !principal) {
     throw new Error("authentication required: namespaces are enabled and no principal was supplied");
   }
   if (explicitNamespace) {

package/src/admin/admin-surfaces.ts

@@ -23,6 +23,7 @@
  * NamespaceSearchRouter health. No new scope-resolution or namespace-listing
  * logic is introduced.
  */
+import { resolveNamespaceCapabilities } from "../capabilities.js";
 import path from "node:path";
 import type { NamespaceCatalog, NamespaceRecord } from "../namespaces/catalog.js";
 import { canReadNamespace, canWriteNamespace } from "../namespaces/principal.js";
@@ -190,7 +191,7 @@ export function inspectScope(options: InspectScopeOptions): ScopeInspection {
   const { config } = options;
   // Honour the pre-read flag when the caller supplied one (avoids a scattered
   // read here); fall back to the config flag for direct callers (tests/CLI).
-  const namespacesEnabled = options.namespacesEnabled ?? config.namespacesEnabled === true;
+  const namespacesEnabled = options.namespacesEnabled ?? resolveNamespaceCapabilities(config).namespaces === true;
 
   const plan = resolveScopePlan({
     config,

package/src/capabilities.test.ts

@@ -5,8 +5,16 @@ import { parseConfig } from "./config.js";
 import {
   resolveCapabilities,
   resolveAccessSetupCapabilities,
+  resolveNamespaceCapabilities,
+  resolveQmdCapabilities,
+  resolveIdentityContinuityCapabilities,
+  resolveLocalLlmCapabilities,
   type CapabilitySet,
   type AccessSetupCapabilitySet,
+  type NamespaceCapabilitySet,
+  type QmdCapabilitySet,
+  type IdentityContinuityCapabilitySet,
+  type LocalLlmCapabilitySet,
 } from "./capabilities.js";
 
 /**
@@ -646,3 +654,173 @@ test("resolveCreationMemoryCapabilities matches pre-migration config reads (pari
     }
   }
 });
+
+// ---------------------------------------------------------------------------
+// Namespace capability set parity tests (issue #1523 batch 5).
+//
+// Guard: resolveNamespaceCapabilities(config).namespaces must always equal
+// config.namespacesEnabled. The flag is a non-optional boolean so no default
+// coercion is needed.
+// ---------------------------------------------------------------------------
+
+test("resolveNamespaceCapabilities: namespaces === config.namespacesEnabled (parity)", () => {
+  const cases = [
+    { label: "on", overrides: { namespacesEnabled: true } },
+    { label: "off", overrides: { namespacesEnabled: false } },
+  ];
+
+  for (const { label, overrides } of cases) {
+    const config = parseConfig(overrides);
+    const caps = resolveNamespaceCapabilities(config);
+    assert.equal(
+      caps.namespaces,
+      config.namespacesEnabled,
+      `[${label}] caps.namespaces must equal config.namespacesEnabled`,
+    );
+  }
+});
+
+test("resolveNamespaceCapabilities: result is frozen", () => {
+  const config = parseConfig({ namespacesEnabled: true });
+  const caps = resolveNamespaceCapabilities(config);
+  assert.ok(Object.isFrozen(caps), "NamespaceCapabilitySet must be frozen");
+});
+
+// ---------------------------------------------------------------------------
+// QmdCapabilitySet — gate-parity tests (issue #1523 batch 6).
+//
+// Same invariant: every caps field must project from its `<field>Enabled`
+// config flag. All twelve flags are required booleans on PluginConfig (defaults
+// resolved at the parse boundary), so the projection is pure passthrough.
+// ---------------------------------------------------------------------------
+
+const QMD_FIELD_TO_FLAG: Record<keyof QmdCapabilitySet, string> = {
+  qmd: "qmdEnabled",
+  qmdTierMigration: "qmdTierMigrationEnabled",
+  qmdTierAutoBackfill: "qmdTierAutoBackfillEnabled",
+  qmdAutoEmbed: "qmdAutoEmbedEnabled",
+  qmdMaintenance: "qmdMaintenanceEnabled",
+  qmdColdTier: "qmdColdTierEnabled",
+  qmdDaemon: "qmdDaemonEnabled",
+  qmdTierParityGraph: "qmdTierParityGraphEnabled",
+  qmdQueryRerank: "qmdQueryRerankEnabled",
+  qmdIntentHints: "qmdIntentHintsEnabled",
+  qmdExplain: "qmdExplainEnabled",
+  qmdAutoUpgrade: "qmdAutoUpgradeEnabled",
+};
+
+const QMD_FIELDS = Object.keys(QMD_FIELD_TO_FLAG) as Array<keyof QmdCapabilitySet>;
+
+test("resolveQmdCapabilities projects every field from its flag (true variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(QMD_FIELD_TO_FLAG)) overrides[flag] = true;
+  const config = parseConfig(overrides);
+  const caps = resolveQmdCapabilities(config);
+
+  for (const field of QMD_FIELDS) {
+    const flag = QMD_FIELD_TO_FLAG[field];
+    assert.equal(caps[field], true, `caps.${field} must be true when ${flag}=true`);
+  }
+});
+
+test("resolveQmdCapabilities projects every field from its flag (false variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(QMD_FIELD_TO_FLAG)) overrides[flag] = false;
+  const config = parseConfig(overrides);
+  const caps = resolveQmdCapabilities(config);
+
+  for (const field of QMD_FIELDS) {
+    const flag = QMD_FIELD_TO_FLAG[field];
+    assert.equal(caps[field], false, `caps.${field} must be false when ${flag}=false`);
+  }
+});
+
+test("resolveQmdCapabilities returns a frozen object", () => {
+  const config = parseConfig({});
+  const caps = resolveQmdCapabilities(config);
+  assert.equal(Object.isFrozen(caps), true);
+});
+
+test("resolveQmdCapabilities matches pre-migration config reads (parity contract)", () => {
+  const cases: Record<string, Record<string, boolean>> = {
+    "all-off": Object.fromEntries(Object.values(QMD_FIELD_TO_FLAG).map((f) => [f, false])),
+    "all-on": Object.fromEntries(Object.values(QMD_FIELD_TO_FLAG).map((f) => [f, true])),
+    "qmd-on-rest-off": {
+      ...Object.fromEntries(Object.values(QMD_FIELD_TO_FLAG).map((f) => [f, false])),
+      qmdEnabled: true,
+    },
+    "tiers-on-qmd-off": {
+      ...Object.fromEntries(Object.values(QMD_FIELD_TO_FLAG).map((f) => [f, false])),
+      qmdTierMigrationEnabled: true,
+      qmdColdTierEnabled: true,
+    },
+  };
+
+  for (const [label, overrides] of Object.entries(cases)) {
+    const config = parseConfig(overrides);
+    const caps = resolveQmdCapabilities(config);
+
+    for (const field of QMD_FIELDS) {
+      const flag = QMD_FIELD_TO_FLAG[field];
+      assert.equal(
+        caps[field],
+        (config as unknown as Record<string, boolean>)[flag],
+        `[${label}] caps.${field} must equal config.${flag}`,
+      );
+    }
+  }
+});
+
+// ---------------------------------------------------------------------------
+// IdentityContinuityCapabilitySet — gate-parity tests (issue #1523 batch 6).
+// ---------------------------------------------------------------------------
+
+test("resolveIdentityContinuityCapabilities: identityContinuity === config.identityContinuityEnabled (parity)", () => {
+  const cases = [
+    { label: "on", overrides: { identityContinuityEnabled: true } },
+    { label: "off", overrides: { identityContinuityEnabled: false } },
+  ];
+
+  for (const { label, overrides } of cases) {
+    const config = parseConfig(overrides);
+    const caps = resolveIdentityContinuityCapabilities(config);
+    assert.equal(
+      caps.identityContinuity,
+      config.identityContinuityEnabled,
+      `[${label}] caps.identityContinuity must equal config.identityContinuityEnabled`,
+    );
+  }
+});
+
+test("resolveIdentityContinuityCapabilities: result is frozen", () => {
+  const config = parseConfig({ identityContinuityEnabled: true });
+  const caps = resolveIdentityContinuityCapabilities(config);
+  assert.ok(Object.isFrozen(caps), "IdentityContinuityCapabilitySet must be frozen");
+});
+
+// ---------------------------------------------------------------------------
+// LocalLlmCapabilitySet — gate-parity tests (issue #1523 batch 6).
+// ---------------------------------------------------------------------------
+
+test("resolveLocalLlmCapabilities: localLlm === config.localLlmEnabled (parity)", () => {
+  const cases = [
+    { label: "on", overrides: { localLlmEnabled: true } },
+    { label: "off", overrides: { localLlmEnabled: false } },
+  ];
+
+  for (const { label, overrides } of cases) {
+    const config = parseConfig(overrides);
+    const caps = resolveLocalLlmCapabilities(config);
+    assert.equal(
+      caps.localLlm,
+      config.localLlmEnabled,
+      `[${label}] caps.localLlm must equal config.localLlmEnabled`,
+    );
+  }
+});
+
+test("resolveLocalLlmCapabilities: result is frozen", () => {
+  const config = parseConfig({ localLlmEnabled: true });
+  const caps = resolveLocalLlmCapabilities(config);
+  assert.ok(Object.isFrozen(caps), "LocalLlmCapabilitySet must be frozen");
+});