@remnic/core 9.3.734 → 9.3.736

package/src/capabilities.test.ts

@@ -9,12 +9,22 @@ import {
   resolveQmdCapabilities,
   resolveIdentityContinuityCapabilities,
   resolveLocalLlmCapabilities,
+  resolveSecurityCapabilities,
+  resolveEvalCapabilities,
+  resolveUtilityLearningCapabilities,
+  resolveObjectiveStateCapabilities,
+  resolveCompressionCapabilities,
   type CapabilitySet,
   type AccessSetupCapabilitySet,
   type NamespaceCapabilitySet,
   type QmdCapabilitySet,
   type IdentityContinuityCapabilitySet,
   type LocalLlmCapabilitySet,
+  type SecurityCapabilitySet,
+  type EvalCapabilitySet,
+  type UtilityLearningCapabilitySet,
+  type ObjectiveStateCapabilitySet,
+  type CompressionCapabilitySet,
 } from "./capabilities.js";
 
 /**
@@ -824,3 +834,190 @@ test("resolveLocalLlmCapabilities: result is frozen", () => {
   const caps = resolveLocalLlmCapabilities(config);
   assert.ok(Object.isFrozen(caps), "LocalLlmCapabilitySet must be frozen");
 });
+
+// ---------------------------------------------------------------------------
+// SecurityCapabilitySet — gate-parity tests (issue #1523 batch 7).
+// ---------------------------------------------------------------------------
+
+const SECURITY_FIELD_TO_FLAG: Record<keyof SecurityCapabilitySet, string> = {
+  trustZones: "trustZonesEnabled",
+  quarantinePromotion: "quarantinePromotionEnabled",
+  memoryPoisoningDefense: "memoryPoisoningDefenseEnabled",
+  trustZoneRecall: "trustZoneRecallEnabled",
+};
+
+const SECURITY_FIELDS = Object.keys(SECURITY_FIELD_TO_FLAG) as Array<keyof SecurityCapabilitySet>;
+
+test("resolveSecurityCapabilities projects every field from its flag (true variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(SECURITY_FIELD_TO_FLAG)) overrides[flag] = true;
+  const config = parseConfig(overrides);
+  const caps = resolveSecurityCapabilities(config);
+  for (const field of SECURITY_FIELDS) {
+    assert.equal(caps[field], true, `${field} must be true`);
+  }
+});
+
+test("resolveSecurityCapabilities projects every field from its flag (false variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(SECURITY_FIELD_TO_FLAG)) overrides[flag] = false;
+  const config = parseConfig(overrides);
+  const caps = resolveSecurityCapabilities(config);
+  for (const field of SECURITY_FIELDS) {
+    assert.equal(caps[field], false, `${field} must be false`);
+  }
+});
+
+test("resolveSecurityCapabilities returns a frozen object", () => {
+  const caps = resolveSecurityCapabilities(parseConfig({}));
+  assert.equal(Object.isFrozen(caps), true, "SecurityCapabilitySet must be frozen");
+});
+
+// ---------------------------------------------------------------------------
+// EvalCapabilitySet — gate-parity tests (issue #1523 batch 7).
+// ---------------------------------------------------------------------------
+
+const EVAL_FIELD_TO_FLAG: Record<keyof EvalCapabilitySet, string> = {
+  evalHarness: "evalHarnessEnabled",
+  evalShadowMode: "evalShadowModeEnabled",
+  benchmarkBaselineSnapshots: "benchmarkBaselineSnapshotsEnabled",
+  benchmarkDeltaReporter: "benchmarkDeltaReporterEnabled",
+  memoryRedTeamBench: "memoryRedTeamBenchEnabled",
+};
+
+const EVAL_FIELDS = Object.keys(EVAL_FIELD_TO_FLAG) as Array<keyof EvalCapabilitySet>;
+
+test("resolveEvalCapabilities projects every field from its flag (true variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(EVAL_FIELD_TO_FLAG)) overrides[flag] = true;
+  const config = parseConfig(overrides);
+  const caps = resolveEvalCapabilities(config);
+  for (const field of EVAL_FIELDS) {
+    assert.equal(caps[field], true, `${field} must be true`);
+  }
+});
+
+test("resolveEvalCapabilities projects every field from its flag (false variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(EVAL_FIELD_TO_FLAG)) overrides[flag] = false;
+  const config = parseConfig(overrides);
+  const caps = resolveEvalCapabilities(config);
+  for (const field of EVAL_FIELDS) {
+    assert.equal(caps[field], false, `${field} must be false`);
+  }
+});
+
+test("resolveEvalCapabilities returns a frozen object", () => {
+  const caps = resolveEvalCapabilities(parseConfig({}));
+  assert.equal(Object.isFrozen(caps), true, "EvalCapabilitySet must be frozen");
+});
+
+// ---------------------------------------------------------------------------
+// UtilityLearningCapabilitySet — gate-parity tests (issue #1523 batch 7).
+// ---------------------------------------------------------------------------
+
+const UTILITY_FIELD_TO_FLAG: Record<keyof UtilityLearningCapabilitySet, string> = {
+  memoryUtilityLearning: "memoryUtilityLearningEnabled",
+  promotionByOutcome: "promotionByOutcomeEnabled",
+};
+
+const UTILITY_FIELDS = Object.keys(UTILITY_FIELD_TO_FLAG) as Array<keyof UtilityLearningCapabilitySet>;
+
+test("resolveUtilityLearningCapabilities projects every field from its flag (true variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(UTILITY_FIELD_TO_FLAG)) overrides[flag] = true;
+  const config = parseConfig(overrides);
+  const caps = resolveUtilityLearningCapabilities(config);
+  for (const field of UTILITY_FIELDS) {
+    assert.equal(caps[field], true, `${field} must be true`);
+  }
+});
+
+test("resolveUtilityLearningCapabilities projects every field from its flag (false variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(UTILITY_FIELD_TO_FLAG)) overrides[flag] = false;
+  const config = parseConfig(overrides);
+  const caps = resolveUtilityLearningCapabilities(config);
+  for (const field of UTILITY_FIELDS) {
+    assert.equal(caps[field], false, `${field} must be false`);
+  }
+});
+
+test("resolveUtilityLearningCapabilities returns a frozen object", () => {
+  const caps = resolveUtilityLearningCapabilities(parseConfig({}));
+  assert.equal(Object.isFrozen(caps), true, "UtilityLearningCapabilitySet must be frozen");
+});
+
+// ---------------------------------------------------------------------------
+// ObjectiveStateCapabilitySet — gate-parity tests (issue #1523 batch 7).
+// ---------------------------------------------------------------------------
+
+const OBJECTIVE_FIELD_TO_FLAG: Record<keyof ObjectiveStateCapabilitySet, string> = {
+  objectiveStateMemory: "objectiveStateMemoryEnabled",
+  objectiveStateSnapshotWrites: "objectiveStateSnapshotWritesEnabled",
+  objectiveStateRecall: "objectiveStateRecallEnabled",
+};
+
+const OBJECTIVE_FIELDS = Object.keys(OBJECTIVE_FIELD_TO_FLAG) as Array<keyof ObjectiveStateCapabilitySet>;
+
+test("resolveObjectiveStateCapabilities projects every field from its flag (true variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(OBJECTIVE_FIELD_TO_FLAG)) overrides[flag] = true;
+  const config = parseConfig(overrides);
+  const caps = resolveObjectiveStateCapabilities(config);
+  for (const field of OBJECTIVE_FIELDS) {
+    assert.equal(caps[field], true, `${field} must be true`);
+  }
+});
+
+test("resolveObjectiveStateCapabilities projects every field from its flag (false variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(OBJECTIVE_FIELD_TO_FLAG)) overrides[flag] = false;
+  const config = parseConfig(overrides);
+  const caps = resolveObjectiveStateCapabilities(config);
+  for (const field of OBJECTIVE_FIELDS) {
+    assert.equal(caps[field], false, `${field} must be false`);
+  }
+});
+
+test("resolveObjectiveStateCapabilities returns a frozen object", () => {
+  const caps = resolveObjectiveStateCapabilities(parseConfig({}));
+  assert.equal(Object.isFrozen(caps), true, "ObjectiveStateCapabilitySet must be frozen");
+});
+
+// ---------------------------------------------------------------------------
+// CompressionCapabilitySet — gate-parity tests (issue #1523 batch 7).
+// ---------------------------------------------------------------------------
+
+const COMPRESSION_FIELD_TO_FLAG: Record<keyof CompressionCapabilitySet, string> = {
+  compressionGuidelineLearning: "compressionGuidelineLearningEnabled",
+  compressionGuidelineSemanticRefinement: "compressionGuidelineSemanticRefinementEnabled",
+  contextCompressionActions: "contextCompressionActionsEnabled",
+};
+
+const COMPRESSION_FIELDS = Object.keys(COMPRESSION_FIELD_TO_FLAG) as Array<keyof CompressionCapabilitySet>;
+
+test("resolveCompressionCapabilities projects every field from its flag (true variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(COMPRESSION_FIELD_TO_FLAG)) overrides[flag] = true;
+  const config = parseConfig(overrides);
+  const caps = resolveCompressionCapabilities(config);
+  for (const field of COMPRESSION_FIELDS) {
+    assert.equal(caps[field], true, `${field} must be true`);
+  }
+});
+
+test("resolveCompressionCapabilities projects every field from its flag (false variant)", () => {
+  const overrides: Record<string, boolean> = {};
+  for (const flag of Object.values(COMPRESSION_FIELD_TO_FLAG)) overrides[flag] = false;
+  const config = parseConfig(overrides);
+  const caps = resolveCompressionCapabilities(config);
+  for (const field of COMPRESSION_FIELDS) {
+    assert.equal(caps[field], false, `${field} must be false`);
+  }
+});
+
+test("resolveCompressionCapabilities returns a frozen object", () => {
+  const caps = resolveCompressionCapabilities(parseConfig({}));
+  assert.equal(Object.isFrozen(caps), true, "CompressionCapabilitySet must be frozen");
+});

package/src/capabilities.ts

@@ -601,3 +601,209 @@ export function resolveLocalLlmCapabilities(
     localLlm: config.localLlmEnabled,
   });
 }
+
+// ---------------------------------------------------------------------------
+// Security capability set (issue #1523 batch 7).
+//
+// The four security/trust-zone flags gate quarantine promotion, poisoning
+// defense, and trust-zone recall. Read sites span orchestrator, access-service,
+// CLI, and research-status commands. All flags are non-optional booleans on
+// PluginConfig (defaults resolved at the parse boundary), so the projection is
+// a pure pass-through.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of security/trust-zone feature gates (issue #1523 batch 7).
+ */
+export interface SecurityCapabilitySet {
+  /** `trustZonesEnabled` — master switch for trust-zone enforcement. */
+  readonly trustZones: boolean;
+  /** `quarantinePromotionEnabled` — promote quarantined memories after review. */
+  readonly quarantinePromotion: boolean;
+  /** `memoryPoisoningDefenseEnabled` — detect and defend against memory poisoning. */
+  readonly memoryPoisoningDefense: boolean;
+  /** `trustZoneRecallEnabled` — restrict recall to trusted zones. */
+  readonly trustZoneRecall: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveSecurityCapabilities}.
+ */
+export type SecurityConfigProjection = Pick<
+  PluginConfig,
+  "trustZonesEnabled" | "quarantinePromotionEnabled" | "memoryPoisoningDefenseEnabled" | "trustZoneRecallEnabled"
+>;
+
+/**
+ * Resolve the {@link SecurityCapabilitySet} from parsed config.
+ */
+export function resolveSecurityCapabilities(config: SecurityConfigProjection): SecurityCapabilitySet {
+  return Object.freeze({
+    trustZones: config.trustZonesEnabled,
+    quarantinePromotion: config.quarantinePromotionEnabled,
+    memoryPoisoningDefense: config.memoryPoisoningDefenseEnabled,
+    trustZoneRecall: config.trustZoneRecallEnabled,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Eval/benchmark capability set (issue #1523 batch 7).
+//
+// The five eval/benchmark flags gate the evaluation harness, shadow mode,
+// baseline snapshot management, delta reporting, and red-team benchmarking.
+// Read sites span orchestrator, CLI, and operator-toolkit. All flags are
+// non-optional booleans on PluginConfig.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of eval/benchmark feature gates (issue #1523 batch 7).
+ */
+export interface EvalCapabilitySet {
+  /** `evalHarnessEnabled` — master switch for the eval harness. */
+  readonly evalHarness: boolean;
+  /** `evalShadowModeEnabled` — run evaluations in shadow mode. */
+  readonly evalShadowMode: boolean;
+  /** `benchmarkBaselineSnapshotsEnabled` — manage baseline snapshots. */
+  readonly benchmarkBaselineSnapshots: boolean;
+  /** `benchmarkDeltaReporterEnabled` — report benchmark deltas. */
+  readonly benchmarkDeltaReporter: boolean;
+  /** `memoryRedTeamBenchEnabled` — red-team benchmarking of memory. */
+  readonly memoryRedTeamBench: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveEvalCapabilities}.
+ */
+export type EvalConfigProjection = Pick<
+  PluginConfig,
+  "evalHarnessEnabled" | "evalShadowModeEnabled" | "benchmarkBaselineSnapshotsEnabled" | "benchmarkDeltaReporterEnabled" | "memoryRedTeamBenchEnabled"
+>;
+
+/**
+ * Resolve the {@link EvalCapabilitySet} from parsed config.
+ */
+export function resolveEvalCapabilities(config: EvalConfigProjection): EvalCapabilitySet {
+  return Object.freeze({
+    evalHarness: config.evalHarnessEnabled,
+    evalShadowMode: config.evalShadowModeEnabled,
+    benchmarkBaselineSnapshots: config.benchmarkBaselineSnapshotsEnabled,
+    benchmarkDeltaReporter: config.benchmarkDeltaReporterEnabled,
+    memoryRedTeamBench: config.memoryRedTeamBenchEnabled,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Utility-learning capability set (issue #1523 batch 7).
+//
+// The two utility-learning flags gate memory utility learning and
+// promotion-by-outcome. Read sites span orchestrator, CLI research-status
+// commands, and maintenance files. Both flags are non-optional booleans.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of utility-learning feature gates (issue #1523 batch 7).
+ */
+export interface UtilityLearningCapabilitySet {
+  /** `memoryUtilityLearningEnabled` — learn memory utility weights from outcomes. */
+  readonly memoryUtilityLearning: boolean;
+  /** `promotionByOutcomeEnabled` — promote memories by outcome tracking. */
+  readonly promotionByOutcome: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveUtilityLearningCapabilities}.
+ */
+export type UtilityLearningConfigProjection = Pick<
+  PluginConfig,
+  "memoryUtilityLearningEnabled" | "promotionByOutcomeEnabled"
+>;
+
+/**
+ * Resolve the {@link UtilityLearningCapabilitySet} from parsed config.
+ */
+export function resolveUtilityLearningCapabilities(config: UtilityLearningConfigProjection): UtilityLearningCapabilitySet {
+  return Object.freeze({
+    memoryUtilityLearning: config.memoryUtilityLearningEnabled,
+    promotionByOutcome: config.promotionByOutcomeEnabled,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Objective-state capability set (issue #1523 batch 7).
+//
+// The three objective-state flags gate objective-state memory, snapshot
+// writes, and recall. Read sites span orchestrator, access-service, CLI
+// creation-ledger commands, and research-status commands. All flags are
+// non-optional booleans.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of objective-state feature gates (issue #1523 batch 7).
+ */
+export interface ObjectiveStateCapabilitySet {
+  /** `objectiveStateMemoryEnabled` — store objective-state memories. */
+  readonly objectiveStateMemory: boolean;
+  /** `objectiveStateSnapshotWritesEnabled` — write objective-state snapshots. */
+  readonly objectiveStateSnapshotWrites: boolean;
+  /** `objectiveStateRecallEnabled` — recall objective-state memories. */
+  readonly objectiveStateRecall: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveObjectiveStateCapabilities}.
+ */
+export type ObjectiveStateConfigProjection = Pick<
+  PluginConfig,
+  "objectiveStateMemoryEnabled" | "objectiveStateSnapshotWritesEnabled" | "objectiveStateRecallEnabled"
+>;
+
+/**
+ * Resolve the {@link ObjectiveStateCapabilitySet} from parsed config.
+ */
+export function resolveObjectiveStateCapabilities(config: ObjectiveStateConfigProjection): ObjectiveStateCapabilitySet {
+  return Object.freeze({
+    objectiveStateMemory: config.objectiveStateMemoryEnabled,
+    objectiveStateSnapshotWrites: config.objectiveStateSnapshotWritesEnabled,
+    objectiveStateRecall: config.objectiveStateRecallEnabled,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Compression capability set (issue #1523 batch 7).
+//
+// The three compression flags gate guideline learning, semantic refinement,
+// and context-compression actions. Read sites span orchestrator,
+// access-service, and the compression-guideline coordinator. All flags are
+// non-optional booleans.
+// ---------------------------------------------------------------------------
+
+/**
+ * Frozen projection of compression feature gates (issue #1523 batch 7).
+ */
+export interface CompressionCapabilitySet {
+  /** `compressionGuidelineLearningEnabled` — learn compression guidelines. */
+  readonly compressionGuidelineLearning: boolean;
+  /** `compressionGuidelineSemanticRefinementEnabled` — semantically refine guidelines. */
+  readonly compressionGuidelineSemanticRefinement: boolean;
+  /** `contextCompressionActionsEnabled` — apply context-compression actions. */
+  readonly contextCompressionActions: boolean;
+}
+
+/**
+ * Config projection consumed by {@link resolveCompressionCapabilities}.
+ */
+export type CompressionConfigProjection = Pick<
+  PluginConfig,
+  "compressionGuidelineLearningEnabled" | "compressionGuidelineSemanticRefinementEnabled" | "contextCompressionActionsEnabled"
+>;
+
+/**
+ * Resolve the {@link CompressionCapabilitySet} from parsed config.
+ */
+export function resolveCompressionCapabilities(config: CompressionConfigProjection): CompressionCapabilitySet {
+  return Object.freeze({
+    compressionGuidelineLearning: config.compressionGuidelineLearningEnabled,
+    compressionGuidelineSemanticRefinement: config.compressionGuidelineSemanticRefinementEnabled,
+    contextCompressionActions: config.contextCompressionActionsEnabled,
+  });
+}

package/src/cli/creation-ledger-commands.ts

@@ -20,7 +20,7 @@ import type { CliCommand } from "../cli.js";
 import type { CommitmentLedgerEntry } from "../commitment-ledger.js";
 import type { WorkProductLedgerEntry } from "../work-product-ledger.js";
 import type { ResumeBundle } from "../resume-bundles.js";
-import { resolveCreationMemoryCapabilities } from "../capabilities.js";
+import { resolveCreationMemoryCapabilities, resolveObjectiveStateCapabilities} from "../capabilities.js";
 import {
   runResumeBundleStatusCliCommand,
   runResumeBundleRecordCliCommand,
@@ -131,7 +131,7 @@ cmd
       creationMemoryEnabled: resolveCreationMemoryCapabilities(orchestrator.config).creationMemory,
       resumeBundlesEnabled: resolveCreationMemoryCapabilities(orchestrator.config).resumeBundles,
       transcriptEnabled: orchestrator.config.transcriptEnabled,
-      objectiveStateMemoryEnabled: orchestrator.config.objectiveStateMemoryEnabled,
+      objectiveStateMemoryEnabled: resolveObjectiveStateCapabilities(orchestrator.config).objectiveStateMemory,
       commitmentLedgerEnabled: resolveCreationMemoryCapabilities(orchestrator.config).commitmentLedger,
       bundleId: String(options.bundleId ?? ""),
       recordedAt: String(options.recordedAt ?? ""),

package/src/cli/research-status-commands.ts

@@ -18,7 +18,7 @@
  */
 
 import type { Orchestrator } from "../orchestrator.js";
-import { resolveCapabilities } from "../capabilities.js";
+import { resolveCapabilities, resolveSecurityCapabilities, resolveUtilityLearningCapabilities, resolveObjectiveStateCapabilities} from "../capabilities.js";
 import type { CliCommand } from "../cli.js";
 import type { UtilityTelemetryEvent } from "../utility-telemetry.js";
 import {
@@ -53,8 +53,8 @@ cmd
     const status = await runObjectiveStateStatusCliCommand({
       memoryDir: orchestrator.config.memoryDir,
       objectiveStateStoreDir: orchestrator.config.objectiveStateStoreDir,
-      objectiveStateMemoryEnabled: orchestrator.config.objectiveStateMemoryEnabled,
-      objectiveStateSnapshotWritesEnabled: orchestrator.config.objectiveStateSnapshotWritesEnabled,
+      objectiveStateMemoryEnabled: resolveObjectiveStateCapabilities(orchestrator.config).objectiveStateMemory,
+      objectiveStateSnapshotWritesEnabled: resolveObjectiveStateCapabilities(orchestrator.config).objectiveStateSnapshotWrites,
     });
     console.log(JSON.stringify(status, null, 2));
     console.log("OK");
@@ -80,9 +80,9 @@ cmd
     const status = await runTrustZoneStatusCliCommand({
       memoryDir: orchestrator.config.memoryDir,
       trustZoneStoreDir: orchestrator.config.trustZoneStoreDir,
-      trustZonesEnabled: orchestrator.config.trustZonesEnabled,
-      quarantinePromotionEnabled: orchestrator.config.quarantinePromotionEnabled,
-      memoryPoisoningDefenseEnabled: orchestrator.config.memoryPoisoningDefenseEnabled,
+      trustZonesEnabled: resolveSecurityCapabilities(orchestrator.config).trustZones,
+      quarantinePromotionEnabled: resolveSecurityCapabilities(orchestrator.config).quarantinePromotion,
+      memoryPoisoningDefenseEnabled: resolveSecurityCapabilities(orchestrator.config).memoryPoisoningDefense,
     });
     console.log(JSON.stringify(status, null, 2));
     console.log("OK");
@@ -99,7 +99,7 @@ cmd
     const result = await runTrustZoneDemoSeedCliCommand({
       memoryDir: orchestrator.config.memoryDir,
       trustZoneStoreDir: orchestrator.config.trustZoneStoreDir,
-      trustZonesEnabled: orchestrator.config.trustZonesEnabled,
+      trustZonesEnabled: resolveSecurityCapabilities(orchestrator.config).trustZones,
       scenario: typeof options.scenario === "string" ? options.scenario : undefined,
       recordedAt: typeof options.recordedAt === "string" ? options.recordedAt : undefined,
       dryRun: options.dryRun === true,
@@ -167,8 +167,8 @@ cmd
   .action(async () => {
     const status = await runUtilityTelemetryStatusCliCommand({
       memoryDir: orchestrator.config.memoryDir,
-      memoryUtilityLearningEnabled: orchestrator.config.memoryUtilityLearningEnabled,
-      promotionByOutcomeEnabled: orchestrator.config.promotionByOutcomeEnabled,
+      memoryUtilityLearningEnabled: resolveUtilityLearningCapabilities(orchestrator.config).memoryUtilityLearning,
+      promotionByOutcomeEnabled: resolveUtilityLearningCapabilities(orchestrator.config).promotionByOutcome,
     });
     console.log(JSON.stringify(status, null, 2));
     console.log("OK");
@@ -196,7 +196,7 @@ cmd
       : Number.NaN;
     const filePath = await runUtilityTelemetryRecordCliCommand({
       memoryDir: orchestrator.config.memoryDir,
-      memoryUtilityLearningEnabled: orchestrator.config.memoryUtilityLearningEnabled,
+      memoryUtilityLearningEnabled: resolveUtilityLearningCapabilities(orchestrator.config).memoryUtilityLearning,
       event: {
         schemaVersion: 1,
         eventId: String(options.eventId ?? ""),
@@ -223,8 +223,8 @@ cmd
   .action(async () => {
     const status = await runUtilityLearningStatusCliCommand({
       memoryDir: orchestrator.config.memoryDir,
-      memoryUtilityLearningEnabled: orchestrator.config.memoryUtilityLearningEnabled,
-      promotionByOutcomeEnabled: orchestrator.config.promotionByOutcomeEnabled,
+      memoryUtilityLearningEnabled: resolveUtilityLearningCapabilities(orchestrator.config).memoryUtilityLearning,
+      promotionByOutcomeEnabled: resolveUtilityLearningCapabilities(orchestrator.config).promotionByOutcome,
     });
     console.log(JSON.stringify(status, null, 2));
     console.log("OK");
@@ -249,7 +249,7 @@ cmd
       : 0.35;
     const result = await runUtilityLearningCliCommand({
       memoryDir: orchestrator.config.memoryDir,
-      memoryUtilityLearningEnabled: orchestrator.config.memoryUtilityLearningEnabled,
+      memoryUtilityLearningEnabled: resolveUtilityLearningCapabilities(orchestrator.config).memoryUtilityLearning,
       learningWindowDays,
       minEventCount,
       maxWeightMagnitude,

package/src/cli.ts

@@ -8,7 +8,7 @@ import {
   resolveNamespaceCapabilities,
   resolveMemoryLifecycleCapabilities,
   resolveIdentityContinuityCapabilities,
-} from "./capabilities.js";
+  resolveSecurityCapabilities, resolveEvalCapabilities} from "./capabilities.js";
 import { ThreadingManager } from "./threading.js";
 import { utcDayRange } from "./transcript.js";
 import { runWearablesCliCommand } from "./wearables/cli.js";
@@ -5384,10 +5384,10 @@ export function registerCli(
           const status = await runBenchmarkStatusCliCommand({
             memoryDir: orchestrator.config.memoryDir,
             evalStoreDir: orchestrator.config.evalStoreDir,
-            evalHarnessEnabled: orchestrator.config.evalHarnessEnabled,
-            evalShadowModeEnabled: orchestrator.config.evalShadowModeEnabled,
-            benchmarkBaselineSnapshotsEnabled: orchestrator.config.benchmarkBaselineSnapshotsEnabled,
-            memoryRedTeamBenchEnabled: orchestrator.config.memoryRedTeamBenchEnabled,
+            evalHarnessEnabled: resolveEvalCapabilities(orchestrator.config).evalHarness,
+            evalShadowModeEnabled: resolveEvalCapabilities(orchestrator.config).evalShadowMode,
+            benchmarkBaselineSnapshotsEnabled: resolveEvalCapabilities(orchestrator.config).benchmarkBaselineSnapshots,
+            memoryRedTeamBenchEnabled: resolveEvalCapabilities(orchestrator.config).memoryRedTeamBench,
           });
           console.log(JSON.stringify(status, null, 2));
           console.log("OK");
@@ -5415,11 +5415,11 @@ export function registerCli(
             config: {
               memoryDir: orchestrator.config.memoryDir,
               evalStoreDir: orchestrator.config.evalStoreDir,
-              evalHarnessEnabled: orchestrator.config.evalHarnessEnabled,
-              evalShadowModeEnabled: orchestrator.config.evalShadowModeEnabled,
-              benchmarkBaselineSnapshotsEnabled: orchestrator.config.benchmarkBaselineSnapshotsEnabled,
-              benchmarkDeltaReporterEnabled: orchestrator.config.benchmarkDeltaReporterEnabled,
-              memoryRedTeamBenchEnabled: orchestrator.config.memoryRedTeamBenchEnabled,
+              evalHarnessEnabled: resolveEvalCapabilities(orchestrator.config).evalHarness,
+              evalShadowModeEnabled: resolveEvalCapabilities(orchestrator.config).evalShadowMode,
+              benchmarkBaselineSnapshotsEnabled: resolveEvalCapabilities(orchestrator.config).benchmarkBaselineSnapshots,
+              benchmarkDeltaReporterEnabled: resolveEvalCapabilities(orchestrator.config).benchmarkDeltaReporter,
+              memoryRedTeamBenchEnabled: resolveEvalCapabilities(orchestrator.config).memoryRedTeamBench,
             },
             validatePath: typeof options.validate === "string" ? options.validate : undefined,
             baseEvalStoreDir: typeof options.base === "string" ? options.base : undefined,
@@ -6128,7 +6128,7 @@ export function registerCli(
           const inputPath = args[0];
           const summary = await runBenchmarkValidateCliCommand({
             path: typeof inputPath === "string" ? inputPath : "",
-            memoryRedTeamBenchEnabled: orchestrator.config.memoryRedTeamBenchEnabled,
+            memoryRedTeamBenchEnabled: resolveEvalCapabilities(orchestrator.config).memoryRedTeamBench,
           });
           console.log(JSON.stringify(summary, null, 2));
           console.log("OK");
@@ -6146,7 +6146,7 @@ export function registerCli(
           const summary = await runBenchmarkBaselineSnapshotCliCommand({
             memoryDir: orchestrator.config.memoryDir,
             evalStoreDir: orchestrator.config.evalStoreDir,
-            benchmarkBaselineSnapshotsEnabled: orchestrator.config.benchmarkBaselineSnapshotsEnabled,
+            benchmarkBaselineSnapshotsEnabled: resolveEvalCapabilities(orchestrator.config).benchmarkBaselineSnapshots,
             snapshotId: typeof options.snapshotId === "string" ? options.snapshotId : "",
             createdAt: typeof options.createdAt === "string" ? options.createdAt : undefined,
             gitRef: typeof options.gitRef === "string" ? options.gitRef : undefined,
@@ -6169,7 +6169,7 @@ export function registerCli(
             memoryDir: orchestrator.config.memoryDir,
             evalStoreDir: orchestrator.config.evalStoreDir,
             force: options.force === true,
-            memoryRedTeamBenchEnabled: orchestrator.config.memoryRedTeamBenchEnabled,
+            memoryRedTeamBenchEnabled: resolveEvalCapabilities(orchestrator.config).memoryRedTeamBench,
           });
           console.log(JSON.stringify(summary, null, 2));
           console.log("OK");
@@ -6202,7 +6202,7 @@ export function registerCli(
           const summary = await runBenchmarkBaselineReportCliCommand({
             memoryDir: orchestrator.config.memoryDir,
             evalStoreDir: orchestrator.config.evalStoreDir,
-            benchmarkDeltaReporterEnabled: orchestrator.config.benchmarkDeltaReporterEnabled,
+            benchmarkDeltaReporterEnabled: resolveEvalCapabilities(orchestrator.config).benchmarkDeltaReporter,
             snapshotId: typeof options.snapshotId === "string" ? options.snapshotId : "",
           });
           const { markdownReport, ...jsonSummary } = summary;
@@ -6232,9 +6232,9 @@ export function registerCli(
           const result = await runTrustZonePromoteCliCommand({
             memoryDir: orchestrator.config.memoryDir,
             trustZoneStoreDir: orchestrator.config.trustZoneStoreDir,
-            trustZonesEnabled: orchestrator.config.trustZonesEnabled,
-            quarantinePromotionEnabled: orchestrator.config.quarantinePromotionEnabled,
-            memoryPoisoningDefenseEnabled: orchestrator.config.memoryPoisoningDefenseEnabled,
+            trustZonesEnabled: resolveSecurityCapabilities(orchestrator.config).trustZones,
+            quarantinePromotionEnabled: resolveSecurityCapabilities(orchestrator.config).quarantinePromotion,
+            memoryPoisoningDefenseEnabled: resolveSecurityCapabilities(orchestrator.config).memoryPoisoningDefense,
             sourceRecordId: String(options.recordId ?? ""),
             targetZone: String(options.targetZone ?? "") as TrustZoneName,
             promotionReason: String(options.reason ?? ""),

package/src/maintenance/first-start-migration.ts

@@ -21,7 +21,7 @@ import { access, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 import {
   resolveMemoryLifecycleCapabilities,
   resolveQmdCapabilities,
-} from "../capabilities.js";
+  resolveUtilityLearningCapabilities} from "../capabilities.js";
 import type { StorageManager } from "../storage.js";
 import type { PluginConfig } from "../types.js";
 import {
@@ -145,8 +145,8 @@ async function buildTierRoutingPolicy(config: PluginConfig): Promise<TierRouting
   };
   const runtime = await loadUtilityRuntimeValues({
     memoryDir: config.memoryDir,
-    memoryUtilityLearningEnabled: config.memoryUtilityLearningEnabled,
-    promotionByOutcomeEnabled: config.promotionByOutcomeEnabled,
+    memoryUtilityLearningEnabled: resolveUtilityLearningCapabilities(config).memoryUtilityLearning,
+    promotionByOutcomeEnabled: resolveUtilityLearningCapabilities(config).promotionByOutcome,
   });
   return applyUtilityPromotionRuntimePolicy(basePolicy, runtime);
 }

package/src/maintenance/tier-stats.ts

@@ -25,7 +25,7 @@ import {
   type TierRoutingPolicy,
   type TierTransitionDecision,
 } from "../tier-routing.js";
-import { resolveQmdCapabilities } from "../capabilities.js";
+import { resolveQmdCapabilities, resolveUtilityLearningCapabilities} from "../capabilities.js";
 import {
   applyUtilityPromotionRuntimePolicy,
   loadUtilityRuntimeValues,
@@ -90,8 +90,8 @@ async function tierRoutingPolicyFromConfig(
   };
   const runtime = await loadUtilityRuntimeValues({
     memoryDir: config.memoryDir,
-    memoryUtilityLearningEnabled: config.memoryUtilityLearningEnabled,
-    promotionByOutcomeEnabled: config.promotionByOutcomeEnabled,
+    memoryUtilityLearningEnabled: resolveUtilityLearningCapabilities(config).memoryUtilityLearning,
+    promotionByOutcomeEnabled: resolveUtilityLearningCapabilities(config).promotionByOutcome,
   });
   return applyUtilityPromotionRuntimePolicy(basePolicy, runtime);
 }