@remnic/core 9.4.1 → 9.5.0

package/src/access-mcp.test.ts

@@ -13,6 +13,7 @@ import path from "node:path";
 import test from "node:test";
 
 import { EngramMcpServer } from "./access-mcp.js";
+import { tokenCapabilityStore } from "./access-token-capabilities.js";
 import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
 import { parseConfig } from "./config.js";
 import { readPair, writePair } from "./contradiction/contradiction-review.js";
@@ -979,3 +980,266 @@ test("emitLegacyTools=false still allows calling tools under BOTH names (adverti
     "legacy engram.recall call still works (callability preserved)",
   );
 });
+
+// ──────────────────────────────────────────────────────────────────────────
+// Issue #1850 round 5 (finding 3): tools/list must reflect the token's ops scope
+// ──────────────────────────────────────────────────────────────────────────
+
+test("tools/list: deny-all (ops:[]) token sees NO tools (issue #1850 finding 3)", async () => {
+  const server = new EngramMcpServer(makeMockService(), { emitLegacyTools: false });
+  const names = await tokenCapabilityStore.run({ version: 1, ops: [] }, async () =>
+    listToolNames(await server.handleRequest(TOOLS_LIST_REQUEST)),
+  );
+  assert.deepEqual(names, [], "a deny-all token must enumerate zero tools");
+});
+
+test("tools/list: ops-scoped token sees ONLY its permitted tools (issue #1850 finding 3)", async () => {
+  const server = new EngramMcpServer(makeMockService(), { emitLegacyTools: false });
+  const names = await tokenCapabilityStore.run({ version: 1, ops: ["recall", "memory_get"] }, async () =>
+    listToolNames(await server.handleRequest(TOOLS_LIST_REQUEST)),
+  );
+  assert.ok(names.includes("remnic.recall"), "permitted recall tool advertised");
+  assert.ok(names.includes("remnic.memory_get"), "permitted memory_get tool advertised");
+  assert.ok(!names.includes("remnic.memory_store"), "non-permitted tool must NOT be advertised");
+  assert.ok(!names.includes("remnic.observe"), "non-permitted tool must NOT be advertised");
+  assert.equal(names.length, 2, "exactly the two permitted tools advertised");
+});
+
+test("tools/list: unrestricted token (ops axis absent) sees the FULL surface (unchanged)", async () => {
+  const server = new EngramMcpServer(makeMockService(), { emitLegacyTools: false });
+  // No capability context at all (stdio / direct call) ⇒ full surface.
+  const noContext = listToolNames(await server.handleRequest(TOOLS_LIST_REQUEST));
+  // Explicit-unrestricted record (version present, no ops axis) ⇒ same surface.
+  const explicitUnrestricted = await tokenCapabilityStore.run({ version: 1 }, async () =>
+    listToolNames(await server.handleRequest(TOOLS_LIST_REQUEST)),
+  );
+  assert.deepEqual(explicitUnrestricted, noContext, "unrestricted record sees the same surface as legacy/no-context");
+  assert.ok(noContext.length > 10, "sanity: the full tool surface is non-trivial");
+});
+
+// ===========================================================================
+// Issue #1850 round 9 — MCP review_resolve namespace allow-list gate.
+// Mirror of the HTTP review/resolve namespace gate (access-http.test.ts).
+// review_resolve selects its target BY pairId, so the pair's namespace comes
+// from the record — NOT a request param the MCP-over-HTTP tools/call gate
+// (toolAcceptsNamespace) already enforces, because this tool's schema carries
+// no `namespace` property. A namespace-scoped bearer must NOT mutate a pair in
+// a namespace outside its allow-list. Both canonical (remnic.*) and legacy
+// (engram.*) tool-name aliases route through the SAME handler/gate.
+// ===========================================================================
+
+test("MCP review_resolve: namespace-scoped token cannot mutate a pair in a disallowed namespace (issue #1850 round 9)", async () => {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "remnic-mcp-review-resolve-scoped-"));
+  const allowedPair = writePair(dir, {
+    namespace: "ns_a",
+    memoryIds: ["a-1", "a-2"],
+    verdict: "contradicts",
+    rationale: "pair in the allowed namespace",
+    confidence: 0.9,
+    detectedAt: new Date().toISOString(),
+  });
+  const deniedPair = writePair(dir, {
+    namespace: "ns_b",
+    memoryIds: ["b-1", "b-2"],
+    verdict: "contradicts",
+    rationale: "pair in a denied namespace",
+    confidence: 0.9,
+    detectedAt: new Date().toISOString(),
+  });
+  const storage = { dir } as unknown as StorageManager;
+  const service = {
+    ...makeMockService(),
+    configRef: parseConfig({
+      memoryDir: dir,
+      namespacesEnabled: true,
+      defaultNamespace: "default",
+    }),
+    memoryDir: dir,
+    storageRef: storage,
+    getWritableStorageForNamespace: async (namespace: string | undefined) => ({
+      namespace: namespace ?? "default",
+      storage,
+    }),
+  } as unknown as EngramAccessService;
+  const server = new EngramMcpServer(service, { principal: "writer" });
+  const readOutcome = (response: unknown): { isError: boolean; text: string } => {
+    if (typeof response !== "object" || response === null || !("result" in response)) {
+      return { isError: false, text: "" };
+    }
+    const result = response.result;
+    if (typeof result !== "object" || result === null) return { isError: false, text: "" };
+    const isError = "isError" in result && result.isError === true;
+    let text = "";
+    if ("content" in result && Array.isArray(result.content)) {
+      const entry = result.content[0];
+      if (entry != null && typeof entry === "object" && "text" in entry && typeof entry.text === "string") {
+        text = entry.text;
+      }
+    }
+    return { isError, text };
+  };
+  try {
+    // ── scoped to ns_a: denied-namespace pair → isError (fail closed), NOT mutated ──
+    const denied = await tokenCapabilityStore.run({ version: 1, namespaces: ["ns_a"] }, async () =>
+      readOutcome(await server.handleRequest(makeToolRequest("engram.review_resolve", { pairId: deniedPair.pairId, verb: "both-valid" }))),
+    );
+    assert.equal(denied.isError, true, "scoped resolve: a pair in an unlisted namespace must be denied");
+    assert.match(denied.text, /ns_b/, "denial message names the forbidden namespace");
+    assert.notEqual(
+      readPair(dir, deniedPair.pairId)?.resolution,
+      "both-valid",
+      "scoped resolve: the denied pair must remain unresolved (no mutation leak)",
+    );
+
+    // ── scoped to ns_a: allowed-namespace pair → resolves, mutated ──
+    const allowed = await tokenCapabilityStore.run({ version: 1, namespaces: ["ns_a"] }, async () =>
+      readOutcome(await server.handleRequest(makeToolRequest("engram.review_resolve", { pairId: allowedPair.pairId, verb: "both-valid" }))),
+    );
+    assert.equal(allowed.isError, false, "scoped resolve: a pair in the allowed namespace must succeed");
+    assert.equal(
+      readPair(dir, allowedPair.pairId)?.resolution,
+      "both-valid",
+      "scoped resolve: the allowed pair is marked resolved",
+    );
+
+    // ── canonical alias (remnic.review_resolve) routes through the SAME gate ──
+    const deniedCanonical = writePair(dir, {
+      namespace: "ns_b",
+      memoryIds: ["b-3", "b-4"],
+      verdict: "contradicts",
+      rationale: "pair for canonical-alias denial",
+      confidence: 0.9,
+      detectedAt: new Date().toISOString(),
+    });
+    const deniedViaCanonical = await tokenCapabilityStore.run({ version: 1, namespaces: ["ns_a"] }, async () =>
+      readOutcome(await server.handleRequest(makeToolRequest("remnic.review_resolve", { pairId: deniedCanonical.pairId, verb: "both-valid" }))),
+    );
+    assert.equal(deniedViaCanonical.isError, true, "canonical alias remnic.review_resolve must also be gated");
+    assert.match(deniedViaCanonical.text, /ns_b/, "canonical-alias denial names the forbidden namespace");
+    assert.notEqual(
+      readPair(dir, deniedCanonical.pairId)?.resolution,
+      "both-valid",
+      "canonical-alias denied pair must remain unresolved",
+    );
+
+    // ── unrestricted token (no namespaces axis): the denied-namespace pair is reachable ──
+    const unrestrictedDenied = await tokenCapabilityStore.run({ version: 1 }, async () =>
+      readOutcome(await server.handleRequest(makeToolRequest("engram.review_resolve", { pairId: deniedPair.pairId, verb: "both-valid" }))),
+    );
+    assert.equal(unrestrictedDenied.isError, false, "unrestricted token: the denied-namespace pair is reachable");
+    assert.equal(
+      readPair(dir, deniedPair.pairId)?.resolution,
+      "both-valid",
+      "unrestricted token resolves the previously-denied pair",
+    );
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+// ===========================================================================
+// Issue #1850 round 10 — fleet-wide maintenance ops namespace gate.
+// These ops run ACROSS ALL namespaces (or a global non-namespaced layer) and
+// carry NO `namespace` arg, so the MCP tools/call effective-namespace
+// chokepoint (toolAcceptsNamespace) never fires. The `fleetWide` flag on each
+// op makes defineOperation's run wrapper reject a namespace-scoped token
+// BEFORE the handler — no side effect on denial; unrestricted/legacy allowed.
+// Both canonical (remnic.*) and legacy (engram.*) aliases route through the
+// SAME gate.
+// ===========================================================================
+
+function readCallToolOutcome(response: unknown): { isError: boolean; text: string } {
+  if (typeof response !== "object" || response === null || !("result" in response)) {
+    return { isError: false, text: "" };
+  }
+  const result = response.result;
+  if (typeof result !== "object" || result === null) return { isError: false, text: "" };
+  const isError = "isError" in result && result.isError === true;
+  let text = "";
+  if ("content" in result && Array.isArray(result.content)) {
+    const entry = result.content[0];
+    if (entry != null && typeof entry === "object" && "text" in entry && typeof entry.text === "string") {
+      text = entry.text;
+    }
+  }
+  return { isError, text };
+}
+
+const FLEET_WIDE_MAINTENANCE_TOOLS = [
+  "graph_edge_decay_run",
+  "memory_summarize_hourly",
+  "conversation_index_update",
+  "live_connectors_run",
+  "continuity_audit_generate",
+  "shared_context_cross_signals_run",
+  "shared_context_curate_daily",
+  "compounding_weekly_synthesize",
+  "compounding_promote_candidate",
+  "compression_guidelines_optimize",
+  "compression_guidelines_activate",
+] as const;
+
+test("MCP fleet-wide maintenance ops: namespace-scoped token denied for every op, no side effect (issue #1850 round 10)", async () => {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "remnic-mcp-fleetwide-scoped-"));
+  let sideEffects = 0;
+  // Every fleet-wide op that dispatches to a service method routes through
+  // this tracker; graph_edge_decay_run short-circuits via graphEdgeDecayEnabled
+  // false. Under a scoped token NONE may run — the guard throws first.
+  const track = (): Promise<{ ok: true }> => { sideEffects += 1; return Promise.resolve({ ok: true }); };
+  const service = {
+    ...makeMockService(),
+    configRef: parseConfig({ memoryDir: dir, graphEdgeDecayEnabled: false }),
+    memoryDir: dir,
+    memorySummarizeHourly: track,
+    conversationIndexUpdate: track,
+    liveConnectorsRun: track,
+    continuityAuditGenerate: track,
+    sharedContextCrossSignalsRun: track,
+    sharedContextCurateDaily: track,
+    compoundingWeeklySynthesize: track,
+    compoundingPromoteCandidate: track,
+    compressionGuidelinesOptimize: track,
+    compressionGuidelinesActivate: track,
+  } as unknown as EngramAccessService;
+  const server = new EngramMcpServer(service, { principal: "ops" });
+  try {
+    for (const tool of FLEET_WIDE_MAINTENANCE_TOOLS) {
+      // Legacy alias (engra.*).
+      const legacy = await tokenCapabilityStore.run({ version: 1, namespaces: ["ns_a"] }, async () =>
+        readCallToolOutcome(await server.handleRequest(makeToolRequest("engram." + tool))),
+      );
+      assert.equal(legacy.isError, true, `engram.${tool}: a namespace-scoped token must be denied`);
+      assert.match(legacy.text, /across all namespaces/, `engram.${tool}: denial names the fleet-wide restriction`);
+      // Canonical alias (remnic.*) routes through the SAME gate.
+      const canonical = await tokenCapabilityStore.run({ version: 1, namespaces: ["ns_a"] }, async () =>
+        readCallToolOutcome(await server.handleRequest(makeToolRequest("remnic." + tool))),
+      );
+      assert.equal(canonical.isError, true, `remnic.${tool}: canonical alias must also be gated`);
+    }
+    assert.equal(sideEffects, 0, "no fleet-wide maintenance service method may run for a namespace-scoped token");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("MCP graph_edge_decay_run: unrestricted and legacy tokens reach the handler (issue #1850 round 10)", async () => {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "remnic-mcp-decay-unrestricted-"));
+  try {
+    const service = {
+      ...makeMockService(),
+      configRef: parseConfig({ memoryDir: dir, graphEdgeDecayEnabled: false }),
+      memoryDir: dir,
+    } as unknown as EngramAccessService;
+    const server = new EngramMcpServer(service, { principal: "ops" });
+    // Explicit-unrestricted record (version present, no namespaces axis).
+    const unrestricted = await tokenCapabilityStore.run({ version: 1 }, async () =>
+      readCallToolOutcome(await server.handleRequest(makeToolRequest("engram.graph_edge_decay_run"))),
+    );
+    assert.equal(unrestricted.isError, false, "unrestricted token reaches the handler");
+    // Legacy / no ALS at all (cron, internal caller) — same path.
+    const legacy = readCallToolOutcome(await server.handleRequest(makeToolRequest("remnic.graph_edge_decay_run")));
+    assert.equal(legacy.isError, false, "legacy token (no ALS) reaches the handler");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});

package/src/access-mcp.ts

@@ -5,6 +5,7 @@ import type { Readable, Writable } from "node:stream";
 // (memory_get / memory_search / memory_store) as a side effect; callTool
 // dispatches migrated tools through the registry (issue #1525).
 import { type OperationName, getOperation } from "./access-boundary.js";
+import { assertOperationAllowed, capabilityAllowsOp, enforceNamespaceAllowList, tokenCapabilityStore } from "./access-token-capabilities.js";
 import {
   type ActionConfidenceRequest,
   type CapsuleExportRequest,
@@ -20,6 +21,7 @@ import { EngramAccessInputError, type EngramAccessRecallResponse, type EngramAcc
 import "./access-operations.js";
 import { validateBriefingFormat } from "./briefing.js";
 import { processChatMessage } from "./chat/chat-factory.js";
+import { enforceChatSessionNamespace } from "./chat/chat-session.js";
 import { type CitationMetadata, buildCitationGuidance } from "./citations.js";
 import { projectTagProjectId } from "./coding/coding-namespace.js";
 import {
@@ -37,6 +39,7 @@ import type { RecallDisclosure, RecallPlanMode } from "./types.js";
 import { expandTildePath } from "./utils/path.js";
 
 import { applyToolOutputSchemas } from "./access-mcp-output-schemas.js";
+import { MCP_READ_ONLY_TOOL_SUFFIXES } from "./mcp-read-only-tools.js";
 type JsonRpcId = string | number | null;
 
 type JsonRpcRequest = {
@@ -79,68 +82,6 @@ type McpResource = {
   _meta?: Record<string, unknown>;
 };
 
-/**
- * Conservative allowlist of canonical MCP tool suffixes that are
- * unambiguously read-only. Tools in this set are tagged with
- * `annotations: { readOnlyHint: true }` so ChatGPT (and other MCP
- * clients that honor the hint) can skip per-call confirmation.
- *
- * The list is suffix-based so it covers both the `remnic.*` and
- * `engram.*` naming forms. Anything not on it stays unannotated:
- * uncertainty is resolved as "might mutate".
- *
- * Excluded by construction: anything that writes, runs a pipeline,
- * flushes, applies, records, imports, or destructively deletes.
- */
-const MCP_READ_ONLY_TOOL_SUFFIXES: Readonly<Record<string, true>> = {
-  recall: true,
-  recall_explain: true,
-  recall_tier_explain: true,
-  recall_xray: true,
-  briefing: true,
-  wearables_status: true,
-  transcript_day: true,
-  transcript_search: true,
-  transcript_memories: true,
-  action_confidence: true,
-  capsule_list: true,
-  procedural_stats: true,
-  memory_get: true,
-  memory_timeline: true,
-  entity_get: true,
-  review_queue_list: true,
-  lcm_search: true,
-  continuity_incident_list: true,
-  identity_anchor_get: true,
-  memory_identity: true,
-  memory_search: true,
-  memory_profile: true,
-  memory_entities_list: true,
-  memory_questions: true,
-  memory_last_recall: true,
-  memory_intent_debug: true,
-  memory_qmd_debug: true,
-  memory_graph_explain: true,
-  graph_snapshot: true,
-  review_list: true,
-  profiling_report: true,
-  peer_list: true,
-  peer_get: true,
-  peer_profile_get: true,
-  console_state: true,
-  dreams_status: true,
-  codegraph_list_projects: true,
-  codegraph_index_status: true,
-  codegraph_search_graph: true,
-  codegraph_trace_path: true,
-  codegraph_detect_changes: true,
-  codegraph_query_graph: true,
-  codegraph_get_schema: true,
-  codegraph_get_snippet: true,
-  codegraph_get_architecture: true,
-  codegraph_search_code: true,
-};
-
 /**
  * MCP protocol versions this server understands, ordered newest → oldest.
  * Exported so the HTTP transport can validate the `MCP-Protocol-Version`
@@ -2592,13 +2533,15 @@ export class EngramMcpServer {
       };
     }
     if (method === "tools/list") {
-      return {
-        jsonrpc: "2.0",
-        id,
-        result: {
-          tools: this.tools,
-        },
-      };
+      // Issue #1850 round 5 (finding 3): a scoped/deny-all token must not
+      // enumerate the full tool surface — filter advertised tools by the
+      // token's ops allow-list via the same map callTool uses. Unrestricted
+      // tokens (ops axis absent) see everything; unmapped tool ⇒ "" ⇒ hidden.
+      const caps = tokenCapabilityStore.getStore();
+      const tools = caps?.ops === undefined
+        ? this.tools
+        : this.tools.filter((t) => capabilityAllowsOp(caps, MCP_MIGRATED_OPERATIONS[toLegacyToolName(t.name)] ?? ""));
+      return { jsonrpc: "2.0", id, result: { tools } };
     }
     if (method === "resources/list") {
       return {
@@ -2838,6 +2781,19 @@ export class EngramMcpServer {
     return inputSchema?.additionalProperties === true;
   }
 
+  /**
+   * Whether a tool accepts a `namespace` argument — i.e. it is a
+   * namespace-scoped operation whose effective namespace MUST be gated by the
+   * per-token allow-list. Exposed (public) so the HTTP MCP transport can run
+   * the SAME effective-namespace enforcement the REST surface runs, without
+   * duplicating the tool-schema introspection (issue #1850). Namespace-
+   * agnostic tools (peer/wearables/etc.) return false and stay ungated,
+   * matching the REST surface where those routes never call resolveNamespace.
+   */
+  toolAcceptsNamespace(name: string): boolean {
+    return this.toolAcceptsArgument(name, "namespace");
+  }
+
   /**
    * Determine whether oai-mem-citation guidance should be appended to recall.
    * Returns true when explicitly enabled via config OR when auto-detect is
@@ -2931,10 +2887,29 @@ export class EngramMcpServer {
     } else if (migrated.startsWith("codegraph_")) {
       envelope = { ...args, tool: migrated.slice("codegraph_".length) };
     } else if (migrated === "chat_message") {
-      // memory_chat dispatches to processChatMessage, not a pure service call.
+      // memory_chat bypasses op.run(); gate op + resumed-session namespace like the HTTP route (#1850 r6).
+      assertOperationAllowed(tokenCapabilityStore.getStore(), migrated);
       const message = typeof args.message === "string" ? args.message : "";
       if (!message) throw new EngramAccessInputError("message is required");
       const chatSessionId = typeof args.chatSessionId === "string" ? args.chatSessionId : undefined;
+      if (chatSessionId) {
+        await enforceChatSessionNamespace(this.service, chatSessionId);
+      } else {
+        // NEW chat session (no chatSessionId): processChatMessage mints a fresh
+        // session under the EFFECTIVE namespace (scope.namespace OR server
+        // default). Unlike the HTTP chat handler (which forwards no namespace),
+        // the MCP scope CAN carry one (Thread 17), so route it through the SAME
+        // effective-namespace chokepoint as the HTTP new-chat path
+        // (enforceNamespaceAllowList maps undefined → default) — a namespace-
+        // scoped token CANNOT start a chat in a namespace outside its allow-
+        // list, including an unconfigured/forbidden server default. Fail closed;
+        // no-op for unrestricted/legacy tokens (issue #1850 round 8).
+        enforceNamespaceAllowList(
+          tokenCapabilityStore.getStore(),
+          scope?.namespace,
+          this.service.configRef?.defaultNamespace,
+        );
+      }
       const chatResult = await processChatMessage({
         service: this.service,
         config: this.service.configRef?.chat,

package/src/access-operations-batch.ts

@@ -16,6 +16,7 @@ import type { RemnicChatGptMemoryInspectorInput } from "./mcp-memory-inspector-a
 import { defineOperation } from "./access-boundary.js";
 import { EngramAccessForbiddenError } from "./access-errors.js";
 import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
+import { enforceNamespaceAllowList, tokenCapabilityStore } from "./access-token-capabilities.js";
 import { projectTagProjectId } from "./coding/coding-namespace.js";
 import { expandTildePath } from "./utils/path.js";
 import { resolvePrincipal } from "./namespaces/principal.js";
@@ -25,7 +26,7 @@ import {
   buildChatGptMemoryInspectorActionRequest,
   buildChatGptMemoryInspectorResult,
 } from "./mcp-memory-inspector-app.js";
-import { listPairs, isDefaultReviewNamespace } from "./contradiction/contradiction-review.js";
+import { listPairs, isDefaultReviewNamespace, readPair } from "./contradiction/contradiction-review.js";
 import { executeResolution, isValidResolutionVerb } from "./contradiction/resolution.js";
 import { runContradictionScan } from "./contradiction/contradiction-scan.js";
 import { runGraphEdgeDecayMaintenanceAcrossNamespaces } from "./maintenance/graph-edge-decay.js";
@@ -166,7 +167,7 @@ defineOperation({ name: "lcm_compaction_flush", description: "Flush LCM compacti
 defineOperation({ name: "lcm_compaction_record", description: "Record LCM compaction.", schema: strictSchema({ sessionKey: S.str, namespace: S.str, tokensBefore: S.num, tokensAfter: S.num }), handler: async (input, ctx) => ({ result: await ctx.service.lcmCompactionRecord({ sessionKey: optStr(input.sessionKey) ?? "", namespace: optStr(input.namespace), tokensBefore: optNum(input.tokensBefore) ?? 0, tokensAfter: optNum(input.tokensAfter) ?? 0, authenticatedPrincipal: ctx.authenticatedPrincipal }) }) });
 
 // === CONTINUITY/IDENTITY ===
-defineOperation({ name: "continuity_audit_generate", description: "Continuity audit.", schema: strictSchema({ period: S.str, key: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.continuityAuditGenerate({ period: optStr(input.period) === "monthly" ? "monthly" : optStr(input.period) === "weekly" ? "weekly" : undefined, key: optStr(input.key) }) }) });
+defineOperation({ name: "continuity_audit_generate", description: "Continuity audit.", fleetWide: true, schema: strictSchema({ period: S.str, key: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.continuityAuditGenerate({ period: optStr(input.period) === "monthly" ? "monthly" : optStr(input.period) === "weekly" ? "weekly" : undefined, key: optStr(input.key) }) }) });
 defineOperation({ name: "continuity_incident_open", description: "Open incident.", schema: strictSchema({ symptom: S.str, namespace: S.str, triggerWindow: S.str, suspectedCause: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.continuityIncidentOpen({ symptom: optStr(input.symptom) ?? "", namespace: optStr(input.namespace), triggerWindow: optStr(input.triggerWindow), suspectedCause: optStr(input.suspectedCause), principal: ctx.authenticatedPrincipal }) }) });
 defineOperation({ name: "continuity_incident_close", description: "Close incident.", schema: strictSchema({ id: S.str, namespace: S.str, fixApplied: S.str, verificationResult: S.str, preventiveRule: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.continuityIncidentClose({ id: optStr(input.id) ?? "", namespace: optStr(input.namespace), fixApplied: optStr(input.fixApplied) ?? "", verificationResult: optStr(input.verificationResult) ?? "", preventiveRule: optStr(input.preventiveRule), principal: ctx.authenticatedPrincipal }) }) });
 defineOperation({ name: "continuity_incident_list", description: "List incidents.", schema: strictSchema({ state: S.str, namespace: S.str, limit: S.num }), handler: async (input, ctx) => { const st = optStr(input.state); return { result: await ctx.service.continuityIncidentList({ state: st === "closed" ? "closed" : st === "all" ? "all" : st === "open" ? "open" : undefined, namespace: optStr(input.namespace), limit: optNum(input.limit), principal: ctx.authenticatedPrincipal }) }; } });
@@ -183,12 +184,12 @@ defineOperation({ name: "work_board", description: "Manage work board.", schema:
 defineOperation({ name: "shared_context_write_output", description: "Write shared output.", schema: strictSchema({ agentId: S.str, title: S.str, content: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.sharedContextWriteOutput({ agentId: optStr(input.agentId) ?? "", title: optStr(input.title) ?? "", content: optStr(input.content) ?? "" }) }) });
 defineOperation({ name: "shared_feedback_record", description: "Record shared feedback.", schema: strictSchema({ agent: S.str, decision: S.str, reason: S.str, date: S.str, learning: S.str, outcome: S.str, severity: S.str, confidence: S.num, workflow: S.str, tags: S.strArr, evidenceWindowStart: S.str, evidenceWindowEnd: S.str, refs: S.strArr }), handler: async (input, ctx) => { const sv = optStr(input.severity); return { result: await ctx.service.sharedFeedbackRecord({ agent: optStr(input.agent) ?? "", decision: (optStr(input.decision) as "rejected" | "approved" | "approved_with_feedback") ?? "approved", reason: optStr(input.reason) ?? "", date: optStr(input.date), learning: optStr(input.learning), outcome: optStr(input.outcome), severity: sv === "low" || sv === "medium" || sv === "high" ? sv as "low" | "medium" | "high" : undefined, confidence: optNum(input.confidence), workflow: optStr(input.workflow), tags: optStrArr(input.tags), evidenceWindowStart: optStr(input.evidenceWindowStart), evidenceWindowEnd: optStr(input.evidenceWindowEnd), refs: optStrArr(input.refs) }) }; } });
 defineOperation({ name: "shared_priorities_append", description: "Append priorities.", schema: strictSchema({ agentId: S.str, text: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.sharedPrioritiesAppend({ agentId: optStr(input.agentId) ?? "", text: optStr(input.text) ?? "" }) }) });
-defineOperation({ name: "shared_context_cross_signals_run", description: "Run cross signals.", schema: strictSchema({ date: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.sharedContextCrossSignalsRun({ date: optStr(input.date) }) }) });
-defineOperation({ name: "shared_context_curate_daily", description: "Curate daily.", schema: strictSchema({ date: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.sharedContextCurateDaily({ date: optStr(input.date) }) }) });
-defineOperation({ name: "compounding_weekly_synthesize", description: "Weekly synthesize.", schema: strictSchema({ weekId: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.compoundingWeeklySynthesize({ weekId: optStr(input.weekId) }) }) });
-defineOperation({ name: "compounding_promote_candidate", description: "Promote candidate.", schema: strictSchema({ weekId: S.str, candidateId: S.str, dryRun: S.bool }), handler: async (input, ctx) => ({ result: await ctx.service.compoundingPromoteCandidate({ weekId: optStr(input.weekId) ?? "", candidateId: optStr(input.candidateId) ?? "", dryRun: input.dryRun === true }) }) });
-defineOperation({ name: "compression_guidelines_optimize", description: "Optimize guidelines.", schema: strictSchema({ dryRun: S.bool, eventLimit: S.num }), handler: async (input, ctx) => ({ result: await ctx.service.compressionGuidelinesOptimize({ dryRun: input.dryRun === true, eventLimit: optNum(input.eventLimit) }) }) });
-defineOperation({ name: "compression_guidelines_activate", description: "Activate guidelines.", schema: strictSchema({ expectedContentHash: S.str, expectedGuidelineVersion: S.num }), handler: async (input, ctx) => ({ result: await ctx.service.compressionGuidelinesActivate({ expectedContentHash: optStr(input.expectedContentHash), expectedGuidelineVersion: optNum(input.expectedGuidelineVersion) }) }) });
+defineOperation({ name: "shared_context_cross_signals_run", description: "Run cross signals.", fleetWide: true, schema: strictSchema({ date: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.sharedContextCrossSignalsRun({ date: optStr(input.date) }) }) });
+defineOperation({ name: "shared_context_curate_daily", description: "Curate daily.", fleetWide: true, schema: strictSchema({ date: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.sharedContextCurateDaily({ date: optStr(input.date) }) }) });
+defineOperation({ name: "compounding_weekly_synthesize", description: "Weekly synthesize.", fleetWide: true, schema: strictSchema({ weekId: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.compoundingWeeklySynthesize({ weekId: optStr(input.weekId) }) }) });
+defineOperation({ name: "compounding_promote_candidate", description: "Promote candidate.", fleetWide: true, schema: strictSchema({ weekId: S.str, candidateId: S.str, dryRun: S.bool }), handler: async (input, ctx) => ({ result: await ctx.service.compoundingPromoteCandidate({ weekId: optStr(input.weekId) ?? "", candidateId: optStr(input.candidateId) ?? "", dryRun: input.dryRun === true }) }) });
+defineOperation({ name: "compression_guidelines_optimize", description: "Optimize guidelines.", fleetWide: true, schema: strictSchema({ dryRun: S.bool, eventLimit: S.num }), handler: async (input, ctx) => ({ result: await ctx.service.compressionGuidelinesOptimize({ dryRun: input.dryRun === true, eventLimit: optNum(input.eventLimit) }) }) });
+defineOperation({ name: "compression_guidelines_activate", description: "Activate guidelines.", fleetWide: true, schema: strictSchema({ expectedContentHash: S.str, expectedGuidelineVersion: S.num }), handler: async (input, ctx) => ({ result: await ctx.service.compressionGuidelinesActivate({ expectedContentHash: optStr(input.expectedContentHash), expectedGuidelineVersion: optNum(input.expectedGuidelineVersion) }) }) });
 
 // === MEMORY DEBUG/GRAPH/FEEDBACK ===
 defineOperation({ name: "memory_profile", description: "Memory profile.", schema: strictSchema({ namespace: S.str }), handler: async (input, ctx) => ({ result: await ctx.service.memoryProfile(optStr(input.namespace), ctx.authenticatedPrincipal) }) });
@@ -225,17 +226,38 @@ defineOperation({ name: "review_resolve", description: "Resolve pair.", schema:
     if (!pid) throw new EngramAccessInputError("pairId is required");
     if (!vb) throw new EngramAccessInputError("verb is required");
     if (!isValidResolutionVerb(vb)) throw new EngramAccessInputError("Invalid verb: " + vb);
+    // Per-token namespace enforcement (issue #1850 round 9): review_resolve
+    // selects its target BY pairId, so the affected namespace comes from the
+    // record — NOT a request param that the MCP-over-HTTP tools/call gate
+    // (toolAcceptsNamespace) already enforces (this tool's schema carries no
+    // `namespace` property). A namespace-scoped bearer must not mutate a
+    // contradiction pair in a namespace outside its allow-list. Load the pair
+    // to learn its namespace, enforce the token's scope via the SAME
+    // effective-namespace chokepoint the HTTP review/resolve route uses
+    // (enforceNamespaceAllowList maps undefined → default, so a scoped token
+    // whose allow-list INCLUDES the default can resolve a legacy pair), and
+    // fail closed BEFORE dispatching the (mutating) resolution. A missing pair
+    // falls through to executeResolution's existing not-found result. No-op for
+    // unrestricted/legacy tokens. Mirrors access-http.ts review/resolve exactly.
+    const targetPair = readPair(ctx.service.memoryDir, pid);
+    if (targetPair) {
+      enforceNamespaceAllowList(
+        tokenCapabilityStore.getStore(),
+        targetPair.namespace,
+        ctx.service.configRef?.defaultNamespace,
+      );
+    }
     return { result: await executeResolution(ctx.service.memoryDir, ctx.service.storageRef, pid, vb, { mergedMemoryId: optStr(input.mergedMemoryId), mergedContent: optStr(input.mergedContent), storageForNamespace: async (namespace) => { const r = await ctx.service.getWritableStorageForNamespace(namespace, ctx.authenticatedPrincipal); return r.storage; }, onMergedMemoryWritten: () => {} }) };
   },
 });
 defineOperation({ name: "contradiction_scan_run", description: "Run scan.", schema: strictSchema({ namespace: S.str }), handler: async (input, ctx) => ({ result: await runContradictionScan({ storage: ctx.service.storageRef, config: ctx.service.configRef, memoryDir: ctx.service.memoryDir, embeddingLookupFactory: ctx.service.embeddingLookupFactoryRef, storageForNamespace: (ns) => ctx.service.getWritableStorageForNamespace(ns ?? undefined, ctx.authenticatedPrincipal), localLlm: ctx.service.localLlmRef, fallbackLlm: ctx.service.fallbackLlmRef, namespace: optStr(input.namespace) }) }) });
-defineOperation({ name: "graph_edge_decay_run", description: "Run edge decay.", schema: strictSchema({ dryRun: S.bool }), handler: async (input, ctx) => { const cfg = ctx.service.configRef; if (!cfg.graphEdgeDecayEnabled) return { result: { ranAt: new Date().toISOString(), disabled: true, reason: "graphEdgeDecayEnabled is false" } }; return { result: { results: await runGraphEdgeDecayMaintenanceAcrossNamespaces(ctx.service.memoryDir, { windowMs: cfg.graphEdgeDecayWindowMs, perWindow: cfg.graphEdgeDecayPerWindow, floor: cfg.graphEdgeDecayFloor, visibilityThreshold: cfg.graphEdgeDecayVisibilityThreshold, dryRun: input.dryRun === true, namespacesEnabled: cfg.namespacesEnabled === true, defaultNamespace: cfg.defaultNamespace }) } }; } });
+defineOperation({ name: "graph_edge_decay_run", description: "Run edge decay.", fleetWide: true, schema: strictSchema({ dryRun: S.bool }), handler: async (input, ctx) => { const cfg = ctx.service.configRef; if (!cfg.graphEdgeDecayEnabled) return { result: { ranAt: new Date().toISOString(), disabled: true, reason: "graphEdgeDecayEnabled is false" } }; return { result: { results: await runGraphEdgeDecayMaintenanceAcrossNamespaces(ctx.service.memoryDir, { windowMs: cfg.graphEdgeDecayWindowMs, perWindow: cfg.graphEdgeDecayPerWindow, floor: cfg.graphEdgeDecayFloor, visibilityThreshold: cfg.graphEdgeDecayVisibilityThreshold, dryRun: input.dryRun === true, namespacesEnabled: cfg.namespacesEnabled === true, defaultNamespace: cfg.defaultNamespace }) } }; } });
 
 // === SUMMARIZE/PROFILING/PEERS/CONSOLE/DREAMS ===
-defineOperation({ name: "memory_summarize_hourly", description: "Hourly summarize.", schema: strictSchema({}), handler: async (_i, ctx) => ({ result: await ctx.service.memorySummarizeHourly() }) });
-defineOperation({ name: "conversation_index_update", description: "Update conv index.", schema: strictSchema({ sessionKey: S.str, hours: S.num, embed: S.bool }), handler: async (input, ctx) => { if (input.sessionKey !== undefined && typeof input.sessionKey !== "string") throw new EngramAccessInputError("sessionKey must be a string when provided"); return { result: await ctx.service.conversationIndexUpdate({ sessionKey: optStr(input.sessionKey), hours: optNum(input.hours), embed: optBool(input.embed) }) }; } });
+defineOperation({ name: "memory_summarize_hourly", description: "Hourly summarize.", fleetWide: true, schema: strictSchema({}), handler: async (_i, ctx) => ({ result: await ctx.service.memorySummarizeHourly() }) });
+defineOperation({ name: "conversation_index_update", description: "Update conv index.", fleetWide: true, schema: strictSchema({ sessionKey: S.str, hours: S.num, embed: S.bool }), handler: async (input, ctx) => { if (input.sessionKey !== undefined && typeof input.sessionKey !== "string") throw new EngramAccessInputError("sessionKey must be a string when provided"); return { result: await ctx.service.conversationIndexUpdate({ sessionKey: optStr(input.sessionKey), hours: optNum(input.hours), embed: optBool(input.embed) }) }; } });
 defineOperation({ name: "profiling_report", description: "Profiling report.", schema: strictSchema({ format: S.str, limit: S.num }), handler: async (input, ctx) => { if (input.format !== undefined && typeof input.format !== "string") throw new EngramAccessInputError("format must be a string when provided"); if (input.limit !== undefined && typeof input.limit !== "number") throw new EngramAccessInputError("limit must be a number when provided"); return { result: await ctx.service.profilingReport({ format: optStr(input.format), limit: optNum(input.limit) }) }; } });
-defineOperation({ name: "live_connectors_run", description: "Run connectors.", schema: strictSchema({ force: S.bool }), handler: async (input, ctx) => ({ result: await ctx.service.liveConnectorsRun({ authenticatedPrincipal: ctx.authenticatedPrincipal, force: input.force === true }, ctx.authenticatedPrincipal) }) });
+defineOperation({ name: "live_connectors_run", description: "Run connectors.", fleetWide: true, schema: strictSchema({ force: S.bool }), handler: async (input, ctx) => ({ result: await ctx.service.liveConnectorsRun({ authenticatedPrincipal: ctx.authenticatedPrincipal, force: input.force === true }, ctx.authenticatedPrincipal) }) });
 defineOperation({ name: "peer_list", description: "List peers.", schema: strictSchema({}), handler: async (_i, ctx) => ({ result: await ctx.service.peerList() }) });
 defineOperation({ name: "peer_get", description: "Get peer.", schema: strictSchema({ id: S.str }), handler: async (input, ctx) => { const id = defStr(input.id, ""); if (!id) throw new EngramAccessInputError("peer_get: id is required"); return { result: await ctx.service.peerGet(id) }; } });
 defineOperation({ name: "peer_set", description: "Set peer.", schema: strictSchema({ id: S.str, kind: S.str, displayName: S.str, notes: S.str }), handler: async (input, ctx) => { const id = defStr(input.id, ""); if (!id) throw new EngramAccessInputError("peer_set: id is required"); if (input.kind !== undefined && typeof input.kind !== "string") throw new EngramAccessInputError("peer_set: kind must be a string when provided"); if (input.displayName !== undefined && typeof input.displayName !== "string") throw new EngramAccessInputError("peer_set: displayName must be a string when provided"); if (input.notes !== undefined && typeof input.notes !== "string") throw new EngramAccessInputError("peer_set: notes must be a string when provided"); return { result: await ctx.service.peerSet({ id, kind: optStr(input.kind), displayName: optStr(input.displayName), notes: optStr(input.notes) }) }; } });
@@ -287,3 +309,4 @@ defineOperation({ name: "offline_sync_snapshot_stream", description: "SSE stream
 defineOperation({ name: "graph_events", description: "SSE graph events.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { stream: "sse" } }) });
 defineOperation({ name: "chat_message", description: "Chat message.", schema: strictSchema({ message: S.str, chatSessionId: S.str }), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
 defineOperation({ name: "chat_events", description: "SSE chat events.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { stream: "sse" } }) });
+defineOperation({ name: "adapters_status", description: "Adapter registry metadata (issue #1850 round 5). Marker op: the HTTP transport builds the response from its own adapterRegistry, but the op still must be registered so it appears in listRegisteredOperations and enforceTokenOp can gate it for scoped tokens.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { ok: true } }) });