@remnic/core 9.3.733 → 9.3.735

package/src/capabilities.ts

@@ -404,3 +404,406 @@ export function resolveCreationMemoryCapabilities(
     commitmentLifecycle: config.commitmentLifecycleEnabled,
   });
 }
+
+// ---------------------------------------------------------------------------
+// Namespace capability set (issue #1523 batch 5).
+//
+// `namespacesEnabled` is the single most-scattered config flag in the codebase
+// (101 read sites outside config.ts across 18 files — orchestrator, access-service,
+// namespace modules, maintenance, CLI, admin). It gates whether the multi-namespace
+// system is active at all: every namespace resolution, storage path, recall budget,
+// and maintenance fanout checks it. Like the other projections above it gets its own
+// resolver invoked ONCE per operation entry rather than re-derived at each site.
+//
+// The field is a non-optional boolean in PluginConfig, so no coercion is needed.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of namespace feature gates (issue #1523 batch 5).
+ *
+ * Every field is `readonly boolean`. Composition lives ONLY in
+ * {@link resolveNamespaceCapabilities}.
+ */
+export interface NamespaceCapabilitySet {
+  /** `namespacesEnabled` — multi-namespace system master switch. */
+  readonly namespaces: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveNamespaceCapabilities}.
+ */
+export type NamespaceConfigProjection = Pick<PluginConfig, "namespacesEnabled">;
+
+/**
+ * Resolve the {@link NamespaceCapabilitySet} from parsed config.
+ *
+ * Call this ONCE at operation entry and thread the result down. The flag is a
+ * non-optional boolean so the projection is a pure pass-through.
+ */
+export function resolveNamespaceCapabilities(
+  config: NamespaceConfigProjection,
+): NamespaceCapabilitySet {
+  return Object.freeze({
+    namespaces: config.namespacesEnabled,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// QMD capability set (issue #1523 batch 6).
+//
+// The twelve QMD (query-managed database) flags are the largest remaining
+// scattered cluster after batch 5. They gate every aspect of the tiered
+// memory system: master switch, tier migration, cold tier, daemon, auto-embed,
+// maintenance, query rerank, intent hints, explain, auto-upgrade, and parity
+// graph. Read sites span orchestrator, operator-toolkit, access-service, and
+// search/factory. All flags are non-optional booleans on PluginConfig (defaults
+// resolved at the parse boundary), so the projection is pure pass-through.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of QMD feature gates (issue #1523 batch 6).
+ *
+ * Every field is `readonly boolean`. Composition lives ONLY in
+ * {@link resolveQmdCapabilities}.
+ */
+export interface QmdCapabilitySet {
+  /** `qmdEnabled` — QMD tiered-memory master switch. */
+  readonly qmd: boolean;
+  /** `qmdTierMigrationEnabled` — automatic tier promotion/demotion. */
+  readonly qmdTierMigration: boolean;
+  /** `qmdTierAutoBackfillEnabled` — backfill stale tier entries. */
+  readonly qmdTierAutoBackfill: boolean;
+  /** `qmdAutoEmbedEnabled` — auto-embed documents on write. */
+  readonly qmdAutoEmbed: boolean;
+  /** `qmdMaintenanceEnabled` — QMD maintenance pass runner. */
+  readonly qmdMaintenance: boolean;
+  /** `qmdColdTierEnabled` — cold-tier storage. */
+  readonly qmdColdTier: boolean;
+  /** `qmdDaemonEnabled` — background QMD daemon. */
+  readonly qmdDaemon: boolean;
+  /** `qmdTierParityGraphEnabled` — tier parity graph. */
+  readonly qmdTierParityGraph: boolean;
+  /** `qmdQueryRerankEnabled` — QMD query reranking. */
+  readonly qmdQueryRerank: boolean;
+  /** `qmdIntentHintsEnabled` — QMD intent hint extraction. */
+  readonly qmdIntentHints: boolean;
+  /** `qmdExplainEnabled` — QMD explain output. */
+  readonly qmdExplain: boolean;
+  /** `qmdAutoUpgradeEnabled` — QMD auto-upgrade tiers. */
+  readonly qmdAutoUpgrade: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveQmdCapabilities}.
+ */
+export type QmdConfigProjection = Pick<
+  PluginConfig,
+  | "qmdEnabled"
+  | "qmdTierMigrationEnabled"
+  | "qmdTierAutoBackfillEnabled"
+  | "qmdAutoEmbedEnabled"
+  | "qmdMaintenanceEnabled"
+  | "qmdColdTierEnabled"
+  | "qmdDaemonEnabled"
+  | "qmdTierParityGraphEnabled"
+  | "qmdQueryRerankEnabled"
+  | "qmdIntentHintsEnabled"
+  | "qmdExplainEnabled"
+  | "qmdAutoUpgradeEnabled"
+>;
+
+/**
+ * Resolve the {@link QmdCapabilitySet} from parsed config.
+ *
+ * Call this ONCE at operation entry and thread the result down. Eleven flags
+ * are non-optional booleans (pure pass-through); `qmdColdTierEnabled` is
+ * optional and coerced with `=== true` (matching the pre-migration call sites).
+ */
+export function resolveQmdCapabilities(config: QmdConfigProjection): QmdCapabilitySet {
+  return Object.freeze({
+    qmd: config.qmdEnabled,
+    qmdTierMigration: config.qmdTierMigrationEnabled,
+    qmdTierAutoBackfill: config.qmdTierAutoBackfillEnabled,
+    qmdAutoEmbed: config.qmdAutoEmbedEnabled,
+    qmdMaintenance: config.qmdMaintenanceEnabled,
+    qmdColdTier: config.qmdColdTierEnabled === true,
+    qmdDaemon: config.qmdDaemonEnabled,
+    qmdTierParityGraph: config.qmdTierParityGraphEnabled,
+    qmdQueryRerank: config.qmdQueryRerankEnabled,
+    qmdIntentHints: config.qmdIntentHintsEnabled,
+    qmdExplain: config.qmdExplainEnabled,
+    qmdAutoUpgrade: config.qmdAutoUpgradeEnabled,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Identity-continuity capability set (issue #1523 batch 6).
+//
+// `identityContinuityEnabled` gates the identity/continuity system (agent
+// identity tracking, continuity incident logging). Its 13 read sites span
+// orchestrator, access-service, and CLI. The flag is a non-optional boolean
+// on PluginConfig, so the projection is a pure pass-through.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of identity-continuity feature gates (issue #1523 batch 6).
+ */
+export interface IdentityContinuityCapabilitySet {
+  /** `identityContinuityEnabled` — identity-continuity master switch. */
+  readonly identityContinuity: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveIdentityContinuityCapabilities}.
+ */
+export type IdentityContinuityConfigProjection = Pick<PluginConfig, "identityContinuityEnabled">;
+
+/**
+ * Resolve the {@link IdentityContinuityCapabilitySet} from parsed config.
+ */
+export function resolveIdentityContinuityCapabilities(
+  config: IdentityContinuityConfigProjection,
+): IdentityContinuityCapabilitySet {
+  return Object.freeze({
+    identityContinuity: config.identityContinuityEnabled,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Local-LLM capability set (issue #1523 batch 6).
+//
+// `localLlmEnabled` gates whether a local (on-device) LLM is used for
+// summarization, embedding fallback, extraction, and search. Its 11 read
+// sites span orchestrator, extraction, embedding-fallback, local-llm,
+// search/embed-helper, and summarizer. The flag is a non-optional boolean.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of local-LLM feature gates (issue #1523 batch 6).
+ */
+export interface LocalLlmCapabilitySet {
+  /** `localLlmEnabled` — local (on-device) LLM master switch. */
+  readonly localLlm: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveLocalLlmCapabilities}.
+ */
+export type LocalLlmConfigProjection = Pick<PluginConfig, "localLlmEnabled">;
+
+/**
+ * Resolve the {@link LocalLlmCapabilitySet} from parsed config.
+ */
+export function resolveLocalLlmCapabilities(
+  config: LocalLlmConfigProjection,
+): LocalLlmCapabilitySet {
+  return Object.freeze({
+    localLlm: config.localLlmEnabled,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Security capability set (issue #1523 batch 7).
+//
+// The four security/trust-zone flags gate quarantine promotion, poisoning
+// defense, and trust-zone recall. Read sites span orchestrator, access-service,
+// CLI, and research-status commands. All flags are non-optional booleans on
+// PluginConfig (defaults resolved at the parse boundary), so the projection is
+// a pure pass-through.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of security/trust-zone feature gates (issue #1523 batch 7).
+ */
+export interface SecurityCapabilitySet {
+  /** `trustZonesEnabled` — master switch for trust-zone enforcement. */
+  readonly trustZones: boolean;
+  /** `quarantinePromotionEnabled` — promote quarantined memories after review. */
+  readonly quarantinePromotion: boolean;
+  /** `memoryPoisoningDefenseEnabled` — detect and defend against memory poisoning. */
+  readonly memoryPoisoningDefense: boolean;
+  /** `trustZoneRecallEnabled` — restrict recall to trusted zones. */
+  readonly trustZoneRecall: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveSecurityCapabilities}.
+ */
+export type SecurityConfigProjection = Pick<
+  PluginConfig,
+  "trustZonesEnabled" | "quarantinePromotionEnabled" | "memoryPoisoningDefenseEnabled" | "trustZoneRecallEnabled"
+>;
+
+/**
+ * Resolve the {@link SecurityCapabilitySet} from parsed config.
+ */
+export function resolveSecurityCapabilities(config: SecurityConfigProjection): SecurityCapabilitySet {
+  return Object.freeze({
+    trustZones: config.trustZonesEnabled,
+    quarantinePromotion: config.quarantinePromotionEnabled,
+    memoryPoisoningDefense: config.memoryPoisoningDefenseEnabled,
+    trustZoneRecall: config.trustZoneRecallEnabled,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Eval/benchmark capability set (issue #1523 batch 7).
+//
+// The five eval/benchmark flags gate the evaluation harness, shadow mode,
+// baseline snapshot management, delta reporting, and red-team benchmarking.
+// Read sites span orchestrator, CLI, and operator-toolkit. All flags are
+// non-optional booleans on PluginConfig.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of eval/benchmark feature gates (issue #1523 batch 7).
+ */
+export interface EvalCapabilitySet {
+  /** `evalHarnessEnabled` — master switch for the eval harness. */
+  readonly evalHarness: boolean;
+  /** `evalShadowModeEnabled` — run evaluations in shadow mode. */
+  readonly evalShadowMode: boolean;
+  /** `benchmarkBaselineSnapshotsEnabled` — manage baseline snapshots. */
+  readonly benchmarkBaselineSnapshots: boolean;
+  /** `benchmarkDeltaReporterEnabled` — report benchmark deltas. */
+  readonly benchmarkDeltaReporter: boolean;
+  /** `memoryRedTeamBenchEnabled` — red-team benchmarking of memory. */
+  readonly memoryRedTeamBench: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveEvalCapabilities}.
+ */
+export type EvalConfigProjection = Pick<
+  PluginConfig,
+  "evalHarnessEnabled" | "evalShadowModeEnabled" | "benchmarkBaselineSnapshotsEnabled" | "benchmarkDeltaReporterEnabled" | "memoryRedTeamBenchEnabled"
+>;
+
+/**
+ * Resolve the {@link EvalCapabilitySet} from parsed config.
+ */
+export function resolveEvalCapabilities(config: EvalConfigProjection): EvalCapabilitySet {
+  return Object.freeze({
+    evalHarness: config.evalHarnessEnabled,
+    evalShadowMode: config.evalShadowModeEnabled,
+    benchmarkBaselineSnapshots: config.benchmarkBaselineSnapshotsEnabled,
+    benchmarkDeltaReporter: config.benchmarkDeltaReporterEnabled,
+    memoryRedTeamBench: config.memoryRedTeamBenchEnabled,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Utility-learning capability set (issue #1523 batch 7).
+//
+// The two utility-learning flags gate memory utility learning and
+// promotion-by-outcome. Read sites span orchestrator, CLI research-status
+// commands, and maintenance files. Both flags are non-optional booleans.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of utility-learning feature gates (issue #1523 batch 7).
+ */
+export interface UtilityLearningCapabilitySet {
+  /** `memoryUtilityLearningEnabled` — learn memory utility weights from outcomes. */
+  readonly memoryUtilityLearning: boolean;
+  /** `promotionByOutcomeEnabled` — promote memories by outcome tracking. */
+  readonly promotionByOutcome: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveUtilityLearningCapabilities}.
+ */
+export type UtilityLearningConfigProjection = Pick<
+  PluginConfig,
+  "memoryUtilityLearningEnabled" | "promotionByOutcomeEnabled"
+>;
+
+/**
+ * Resolve the {@link UtilityLearningCapabilitySet} from parsed config.
+ */
+export function resolveUtilityLearningCapabilities(config: UtilityLearningConfigProjection): UtilityLearningCapabilitySet {
+  return Object.freeze({
+    memoryUtilityLearning: config.memoryUtilityLearningEnabled,
+    promotionByOutcome: config.promotionByOutcomeEnabled,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Objective-state capability set (issue #1523 batch 7).
+//
+// The three objective-state flags gate objective-state memory, snapshot
+// writes, and recall. Read sites span orchestrator, access-service, CLI
+// creation-ledger commands, and research-status commands. All flags are
+// non-optional booleans.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of objective-state feature gates (issue #1523 batch 7).
+ */
+export interface ObjectiveStateCapabilitySet {
+  /** `objectiveStateMemoryEnabled` — store objective-state memories. */
+  readonly objectiveStateMemory: boolean;
+  /** `objectiveStateSnapshotWritesEnabled` — write objective-state snapshots. */
+  readonly objectiveStateSnapshotWrites: boolean;
+  /** `objectiveStateRecallEnabled` — recall objective-state memories. */
+  readonly objectiveStateRecall: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveObjectiveStateCapabilities}.
+ */
+export type ObjectiveStateConfigProjection = Pick<
+  PluginConfig,
+  "objectiveStateMemoryEnabled" | "objectiveStateSnapshotWritesEnabled" | "objectiveStateRecallEnabled"
+>;
+
+/**
+ * Resolve the {@link ObjectiveStateCapabilitySet} from parsed config.
+ */
+export function resolveObjectiveStateCapabilities(config: ObjectiveStateConfigProjection): ObjectiveStateCapabilitySet {
+  return Object.freeze({
+    objectiveStateMemory: config.objectiveStateMemoryEnabled,
+    objectiveStateSnapshotWrites: config.objectiveStateSnapshotWritesEnabled,
+    objectiveStateRecall: config.objectiveStateRecallEnabled,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Compression capability set (issue #1523 batch 7).
+//
+// The three compression flags gate guideline learning, semantic refinement,
+// and context-compression actions. Read sites span orchestrator,
+// access-service, and the compression-guideline coordinator. All flags are
+// non-optional booleans.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of compression feature gates (issue #1523 batch 7).
+ */
+export interface CompressionCapabilitySet {
+  /** `compressionGuidelineLearningEnabled` — learn compression guidelines. */
+  readonly compressionGuidelineLearning: boolean;
+  /** `compressionGuidelineSemanticRefinementEnabled` — semantically refine guidelines. */
+  readonly compressionGuidelineSemanticRefinement: boolean;
+  /** `contextCompressionActionsEnabled` — apply context-compression actions. */
+  readonly contextCompressionActions: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveCompressionCapabilities}.
+ */
+export type CompressionConfigProjection = Pick<
+  PluginConfig,
+  "compressionGuidelineLearningEnabled" | "compressionGuidelineSemanticRefinementEnabled" | "contextCompressionActionsEnabled"
+>;
+
+/**
+ * Resolve the {@link CompressionCapabilitySet} from parsed config.
+ */
+export function resolveCompressionCapabilities(config: CompressionConfigProjection): CompressionCapabilitySet {
+  return Object.freeze({
+    compressionGuidelineLearning: config.compressionGuidelineLearningEnabled,
+    compressionGuidelineSemanticRefinement: config.compressionGuidelineSemanticRefinementEnabled,
+    contextCompressionActions: config.contextCompressionActionsEnabled,
+  });
+}

package/src/cli/creation-ledger-commands.ts

@@ -20,7 +20,7 @@ import type { CliCommand } from "../cli.js";
 import type { CommitmentLedgerEntry } from "../commitment-ledger.js";
 import type { WorkProductLedgerEntry } from "../work-product-ledger.js";
 import type { ResumeBundle } from "../resume-bundles.js";
-import { resolveCreationMemoryCapabilities } from "../capabilities.js";
+import { resolveCreationMemoryCapabilities, resolveObjectiveStateCapabilities} from "../capabilities.js";
 import {
   runResumeBundleStatusCliCommand,
   runResumeBundleRecordCliCommand,
@@ -131,7 +131,7 @@ cmd
       creationMemoryEnabled: resolveCreationMemoryCapabilities(orchestrator.config).creationMemory,
       resumeBundlesEnabled: resolveCreationMemoryCapabilities(orchestrator.config).resumeBundles,
       transcriptEnabled: orchestrator.config.transcriptEnabled,
-      objectiveStateMemoryEnabled: orchestrator.config.objectiveStateMemoryEnabled,
+      objectiveStateMemoryEnabled: resolveObjectiveStateCapabilities(orchestrator.config).objectiveStateMemory,
       commitmentLedgerEnabled: resolveCreationMemoryCapabilities(orchestrator.config).commitmentLedger,
       bundleId: String(options.bundleId ?? ""),
       recordedAt: String(options.recordedAt ?? ""),

package/src/cli/research-status-commands.ts

@@ -18,7 +18,7 @@
  */
 
 import type { Orchestrator } from "../orchestrator.js";
-import { resolveCapabilities } from "../capabilities.js";
+import { resolveCapabilities, resolveSecurityCapabilities, resolveUtilityLearningCapabilities, resolveObjectiveStateCapabilities} from "../capabilities.js";
 import type { CliCommand } from "../cli.js";
 import type { UtilityTelemetryEvent } from "../utility-telemetry.js";
 import {
@@ -53,8 +53,8 @@ cmd
     const status = await runObjectiveStateStatusCliCommand({
       memoryDir: orchestrator.config.memoryDir,
       objectiveStateStoreDir: orchestrator.config.objectiveStateStoreDir,
-      objectiveStateMemoryEnabled: orchestrator.config.objectiveStateMemoryEnabled,
-      objectiveStateSnapshotWritesEnabled: orchestrator.config.objectiveStateSnapshotWritesEnabled,
+      objectiveStateMemoryEnabled: resolveObjectiveStateCapabilities(orchestrator.config).objectiveStateMemory,
+      objectiveStateSnapshotWritesEnabled: resolveObjectiveStateCapabilities(orchestrator.config).objectiveStateSnapshotWrites,
     });
     console.log(JSON.stringify(status, null, 2));
     console.log("OK");
@@ -80,9 +80,9 @@ cmd
     const status = await runTrustZoneStatusCliCommand({
       memoryDir: orchestrator.config.memoryDir,
       trustZoneStoreDir: orchestrator.config.trustZoneStoreDir,
-      trustZonesEnabled: orchestrator.config.trustZonesEnabled,
-      quarantinePromotionEnabled: orchestrator.config.quarantinePromotionEnabled,
-      memoryPoisoningDefenseEnabled: orchestrator.config.memoryPoisoningDefenseEnabled,
+      trustZonesEnabled: resolveSecurityCapabilities(orchestrator.config).trustZones,
+      quarantinePromotionEnabled: resolveSecurityCapabilities(orchestrator.config).quarantinePromotion,
+      memoryPoisoningDefenseEnabled: resolveSecurityCapabilities(orchestrator.config).memoryPoisoningDefense,
     });
     console.log(JSON.stringify(status, null, 2));
     console.log("OK");
@@ -99,7 +99,7 @@ cmd
     const result = await runTrustZoneDemoSeedCliCommand({
       memoryDir: orchestrator.config.memoryDir,
       trustZoneStoreDir: orchestrator.config.trustZoneStoreDir,
-      trustZonesEnabled: orchestrator.config.trustZonesEnabled,
+      trustZonesEnabled: resolveSecurityCapabilities(orchestrator.config).trustZones,
       scenario: typeof options.scenario === "string" ? options.scenario : undefined,
       recordedAt: typeof options.recordedAt === "string" ? options.recordedAt : undefined,
       dryRun: options.dryRun === true,
@@ -167,8 +167,8 @@ cmd
   .action(async () => {
     const status = await runUtilityTelemetryStatusCliCommand({
       memoryDir: orchestrator.config.memoryDir,
-      memoryUtilityLearningEnabled: orchestrator.config.memoryUtilityLearningEnabled,
-      promotionByOutcomeEnabled: orchestrator.config.promotionByOutcomeEnabled,
+      memoryUtilityLearningEnabled: resolveUtilityLearningCapabilities(orchestrator.config).memoryUtilityLearning,
+      promotionByOutcomeEnabled: resolveUtilityLearningCapabilities(orchestrator.config).promotionByOutcome,
     });
     console.log(JSON.stringify(status, null, 2));
     console.log("OK");
@@ -196,7 +196,7 @@ cmd
       : Number.NaN;
     const filePath = await runUtilityTelemetryRecordCliCommand({
       memoryDir: orchestrator.config.memoryDir,
-      memoryUtilityLearningEnabled: orchestrator.config.memoryUtilityLearningEnabled,
+      memoryUtilityLearningEnabled: resolveUtilityLearningCapabilities(orchestrator.config).memoryUtilityLearning,
       event: {
         schemaVersion: 1,
         eventId: String(options.eventId ?? ""),
@@ -223,8 +223,8 @@ cmd
   .action(async () => {
     const status = await runUtilityLearningStatusCliCommand({
       memoryDir: orchestrator.config.memoryDir,
-      memoryUtilityLearningEnabled: orchestrator.config.memoryUtilityLearningEnabled,
-      promotionByOutcomeEnabled: orchestrator.config.promotionByOutcomeEnabled,
+      memoryUtilityLearningEnabled: resolveUtilityLearningCapabilities(orchestrator.config).memoryUtilityLearning,
+      promotionByOutcomeEnabled: resolveUtilityLearningCapabilities(orchestrator.config).promotionByOutcome,
     });
     console.log(JSON.stringify(status, null, 2));
     console.log("OK");
@@ -249,7 +249,7 @@ cmd
       : 0.35;
     const result = await runUtilityLearningCliCommand({
       memoryDir: orchestrator.config.memoryDir,
-      memoryUtilityLearningEnabled: orchestrator.config.memoryUtilityLearningEnabled,
+      memoryUtilityLearningEnabled: resolveUtilityLearningCapabilities(orchestrator.config).memoryUtilityLearning,
       learningWindowDays,
       minEventCount,
       maxWeightMagnitude,

package/src/cli.ts

@@ -4,7 +4,11 @@ import { access, lstat, readFile, readdir, realpath, unlink } from "node:fs/prom
 import { createHash } from "node:crypto";
 import type { Readable, Writable } from "node:stream";
 import type { Orchestrator } from "./orchestrator.js";
-import { resolveMemoryLifecycleCapabilities } from "./capabilities.js";
+import {
+  resolveNamespaceCapabilities,
+  resolveMemoryLifecycleCapabilities,
+  resolveIdentityContinuityCapabilities,
+  resolveSecurityCapabilities, resolveEvalCapabilities} from "./capabilities.js";
 import { ThreadingManager } from "./threading.js";
 import { utcDayRange } from "./transcript.js";
 import { runWearablesCliCommand } from "./wearables/cli.js";
@@ -2361,7 +2365,7 @@ export function hasDestructivePurgeFailures(
 
 function resolvePolicySignalNamespaces(orchestrator: PolicyTuningCliOrchestrator): string[] {
   const names = new Set<string>([orchestrator.config.defaultNamespace]);
-  if (orchestrator.config.namespacesEnabled) {
+  if (resolveNamespaceCapabilities(orchestrator.config).namespaces) {
     names.add(orchestrator.config.sharedNamespace);
     for (const policy of orchestrator.config.namespacePolicies) {
       if (policy?.name) names.add(policy.name);
@@ -2520,7 +2524,7 @@ function resolveAuditNamespaces(
   }
 
   const names = new Set<string>([orchestrator.config.defaultNamespace]);
-  if (orchestrator.config.namespacesEnabled) {
+  if (resolveNamespaceCapabilities(orchestrator.config).namespaces) {
     names.add(orchestrator.config.sharedNamespace);
     for (const policy of orchestrator.config.namespacePolicies) {
       if (policy?.name) names.add(policy.name);
@@ -3319,7 +3323,7 @@ export async function resolveMemoryDirForNamespace(
   const ns = (namespace ?? "").trim();
   if (!ns) return orchestrator.config.memoryDir;
   assertSafeNamespaceSegment(ns);
-  if (!orchestrator.config.namespacesEnabled) {
+  if (!resolveNamespaceCapabilities(orchestrator.config).namespaces) {
     if (options?.rejectUnsupportedOverride && ns !== orchestrator.config.defaultNamespace) {
       throw new Error(`namespaces are disabled; cannot target namespace: ${ns}`);
     }
@@ -5380,10 +5384,10 @@ export function registerCli(
           const status = await runBenchmarkStatusCliCommand({
             memoryDir: orchestrator.config.memoryDir,
             evalStoreDir: orchestrator.config.evalStoreDir,
-            evalHarnessEnabled: orchestrator.config.evalHarnessEnabled,
-            evalShadowModeEnabled: orchestrator.config.evalShadowModeEnabled,
-            benchmarkBaselineSnapshotsEnabled: orchestrator.config.benchmarkBaselineSnapshotsEnabled,
-            memoryRedTeamBenchEnabled: orchestrator.config.memoryRedTeamBenchEnabled,
+            evalHarnessEnabled: resolveEvalCapabilities(orchestrator.config).evalHarness,
+            evalShadowModeEnabled: resolveEvalCapabilities(orchestrator.config).evalShadowMode,
+            benchmarkBaselineSnapshotsEnabled: resolveEvalCapabilities(orchestrator.config).benchmarkBaselineSnapshots,
+            memoryRedTeamBenchEnabled: resolveEvalCapabilities(orchestrator.config).memoryRedTeamBench,
           });
           console.log(JSON.stringify(status, null, 2));
           console.log("OK");
@@ -5411,11 +5415,11 @@ export function registerCli(
             config: {
               memoryDir: orchestrator.config.memoryDir,
               evalStoreDir: orchestrator.config.evalStoreDir,
-              evalHarnessEnabled: orchestrator.config.evalHarnessEnabled,
-              evalShadowModeEnabled: orchestrator.config.evalShadowModeEnabled,
-              benchmarkBaselineSnapshotsEnabled: orchestrator.config.benchmarkBaselineSnapshotsEnabled,
-              benchmarkDeltaReporterEnabled: orchestrator.config.benchmarkDeltaReporterEnabled,
-              memoryRedTeamBenchEnabled: orchestrator.config.memoryRedTeamBenchEnabled,
+              evalHarnessEnabled: resolveEvalCapabilities(orchestrator.config).evalHarness,
+              evalShadowModeEnabled: resolveEvalCapabilities(orchestrator.config).evalShadowMode,
+              benchmarkBaselineSnapshotsEnabled: resolveEvalCapabilities(orchestrator.config).benchmarkBaselineSnapshots,
+              benchmarkDeltaReporterEnabled: resolveEvalCapabilities(orchestrator.config).benchmarkDeltaReporter,
+              memoryRedTeamBenchEnabled: resolveEvalCapabilities(orchestrator.config).memoryRedTeamBench,
             },
             validatePath: typeof options.validate === "string" ? options.validate : undefined,
             baseEvalStoreDir: typeof options.base === "string" ? options.base : undefined,
@@ -6124,7 +6128,7 @@ export function registerCli(
           const inputPath = args[0];
           const summary = await runBenchmarkValidateCliCommand({
             path: typeof inputPath === "string" ? inputPath : "",
-            memoryRedTeamBenchEnabled: orchestrator.config.memoryRedTeamBenchEnabled,
+            memoryRedTeamBenchEnabled: resolveEvalCapabilities(orchestrator.config).memoryRedTeamBench,
           });
           console.log(JSON.stringify(summary, null, 2));
           console.log("OK");
@@ -6142,7 +6146,7 @@ export function registerCli(
           const summary = await runBenchmarkBaselineSnapshotCliCommand({
             memoryDir: orchestrator.config.memoryDir,
             evalStoreDir: orchestrator.config.evalStoreDir,
-            benchmarkBaselineSnapshotsEnabled: orchestrator.config.benchmarkBaselineSnapshotsEnabled,
+            benchmarkBaselineSnapshotsEnabled: resolveEvalCapabilities(orchestrator.config).benchmarkBaselineSnapshots,
             snapshotId: typeof options.snapshotId === "string" ? options.snapshotId : "",
             createdAt: typeof options.createdAt === "string" ? options.createdAt : undefined,
             gitRef: typeof options.gitRef === "string" ? options.gitRef : undefined,
@@ -6165,7 +6169,7 @@ export function registerCli(
             memoryDir: orchestrator.config.memoryDir,
             evalStoreDir: orchestrator.config.evalStoreDir,
             force: options.force === true,
-            memoryRedTeamBenchEnabled: orchestrator.config.memoryRedTeamBenchEnabled,
+            memoryRedTeamBenchEnabled: resolveEvalCapabilities(orchestrator.config).memoryRedTeamBench,
           });
           console.log(JSON.stringify(summary, null, 2));
           console.log("OK");
@@ -6198,7 +6202,7 @@ export function registerCli(
           const summary = await runBenchmarkBaselineReportCliCommand({
             memoryDir: orchestrator.config.memoryDir,
             evalStoreDir: orchestrator.config.evalStoreDir,
-            benchmarkDeltaReporterEnabled: orchestrator.config.benchmarkDeltaReporterEnabled,
+            benchmarkDeltaReporterEnabled: resolveEvalCapabilities(orchestrator.config).benchmarkDeltaReporter,
             snapshotId: typeof options.snapshotId === "string" ? options.snapshotId : "",
           });
           const { markdownReport, ...jsonSummary } = summary;
@@ -6228,9 +6232,9 @@ export function registerCli(
           const result = await runTrustZonePromoteCliCommand({
             memoryDir: orchestrator.config.memoryDir,
             trustZoneStoreDir: orchestrator.config.trustZoneStoreDir,
-            trustZonesEnabled: orchestrator.config.trustZonesEnabled,
-            quarantinePromotionEnabled: orchestrator.config.quarantinePromotionEnabled,
-            memoryPoisoningDefenseEnabled: orchestrator.config.memoryPoisoningDefenseEnabled,
+            trustZonesEnabled: resolveSecurityCapabilities(orchestrator.config).trustZones,
+            quarantinePromotionEnabled: resolveSecurityCapabilities(orchestrator.config).quarantinePromotion,
+            memoryPoisoningDefenseEnabled: resolveSecurityCapabilities(orchestrator.config).memoryPoisoningDefense,
             sourceRecordId: String(options.recordId ?? ""),
             targetZone: String(options.targetZone ?? "") as TrustZoneName,
             promotionReason: String(options.reason ?? ""),
@@ -7858,7 +7862,7 @@ export function registerCli(
         .option("--state <state>", "Filter by state: open|closed|all", "open")
         .option("--limit <number>", "Maximum incidents to list", "25")
         .action(async (...args: unknown[]) => {
-          if (!orchestrator.config.identityContinuityEnabled) {
+          if (!resolveIdentityContinuityCapabilities(orchestrator.config).identityContinuity) {
             console.log("Identity continuity is disabled.");
             return;
           }
@@ -7886,7 +7890,7 @@ export function registerCli(
         .option("--trigger-window <window>", "Optional incident trigger window")
         .option("--suspected-cause <text>", "Optional suspected cause")
         .action(async (...args: unknown[]) => {
-          if (!orchestrator.config.identityContinuityEnabled) {
+          if (!resolveIdentityContinuityCapabilities(orchestrator.config).identityContinuity) {
             console.log("Identity continuity is disabled.");
             return;
           }
@@ -7917,7 +7921,7 @@ export function registerCli(
         .option("--verification-result <text>", "Required verification result")
         .option("--preventive-rule <text>", "Optional preventive rule")
         .action(async (...args: unknown[]) => {
-          if (!orchestrator.config.identityContinuityEnabled) {
+          if (!resolveIdentityContinuityCapabilities(orchestrator.config).identityContinuity) {
             console.log("Identity continuity is disabled.");
             return;
           }
@@ -8507,7 +8511,7 @@ export function registerCli(
             mergedContent: cmdOpts.mergedContent,
             storageForNamespace: (namespace) => {
               const requested = namespace?.trim();
-              if (!orchestrator.config.namespacesEnabled) {
+              if (!resolveNamespaceCapabilities(orchestrator.config).namespaces) {
                 if (requested && requested !== orchestrator.config.defaultNamespace) {
                   throw new Error(`unsupported namespace: ${requested}`);
                 }
@@ -8554,7 +8558,7 @@ export function registerCli(
             storageForNamespace: async (namespace) => {
               const resolvedNamespace =
                 namespace?.trim() ||
-                (orchestrator.config.namespacesEnabled ? orchestrator.config.defaultNamespace : undefined);
+                (resolveNamespaceCapabilities(orchestrator.config).namespaces ? orchestrator.config.defaultNamespace : undefined);
               const storage = await orchestrator.getStorageForNamespace(resolvedNamespace);
               return { storage, namespace: resolvedNamespace };
             },