@remnic/core 9.54.4 → 9.54.5

package/src/access-service.ts

@@ -110,6 +110,11 @@ import {
   memorySearchThroughScope,
 } from "./access-memory-search-fanout.js";
 import { isSearchExcludedPath } from "./orchestration/generic-recall-paths.js";
+import { createSupportPassportPrivateFileExclusion, isSupportPassportPrivateMemory } from "./support-passport/card-projection.js";
+import {
+  applySupportPassportOfflineSyncChangeset,
+  applySupportPassportOfflineSyncFileContent,
+} from "./support-passport/offline-sync-guard.js";
 import {
   buildQualityScore,
   buildProposedActions,
@@ -281,9 +286,7 @@ import {
   type CapsuleListEntry,
 } from "./capsule-cli.js";
 import {
-  applyOfflineSyncFileContentChunk,
   compileOfflineSyncExcludeGlobs,
-  applyOfflineSyncChangeset,
   buildOfflineSyncSnapshot,
   buildOfflineSyncSnapshotFromBase,
   buildOfflineSyncSnapshotForPaths,
@@ -3000,9 +3003,7 @@ export class EngramAccessService {
     const resolvedNamespace = this.resolveReadableNamespace(namespace, principal);
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     const memory = await storage.getMemoryById(resolvedId);
-    if (!memory) {
-      return { found: false, namespace: resolvedNamespace };
-    }
+    if (!memory || isSupportPassportPrivateMemory(memory)) return { found: false, namespace: resolvedNamespace };
     return {
       found: true,
       namespace: resolvedNamespace,
@@ -3371,6 +3372,7 @@ export class EngramAccessService {
       query,
       status: statusFilter,
       category: categoryFilter,
+      excludePrivateRecords: true,
       sort,
       limit,
       offset,
@@ -3389,6 +3391,7 @@ export class EngramAccessService {
 
     let memories = [...await storage.readAllMemories(), ...await storage.readArchivedMemories()];
     memories = memories.filter((memory) => {
+      if (isSupportPassportPrivateMemory(memory)) return false;
       const status = inferMemoryStatus(memory.frontmatter, toMemoryPathRel(storage.dir, memory.path)).toLowerCase();
       if (statusFilter && status !== statusFilter) return false;
       if (categoryFilter && memory.frontmatter.category.toLowerCase() !== categoryFilter) return false;
@@ -3427,6 +3430,8 @@ export class EngramAccessService {
   ): Promise<EngramAccessTimelineResponse> {
     const resolvedNamespace = this.resolveReadableNamespace(namespace, principal);
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
+    const memory = await storage.getMemoryByIdIncludingArchived(memoryId);
+    if (!memory || isSupportPassportPrivateMemory(memory)) return { found: false, namespace: resolvedNamespace, count: 0, timeline: [] };
     const timeline = await storage.getMemoryTimeline(memoryId, limit);
     return {
       found: timeline.length > 0,
@@ -3918,7 +3923,7 @@ export class EngramAccessService {
     );
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     const memory = await storage.getMemoryById(memoryId);
-    if (!memory) {
+    if (!memory || isSupportPassportPrivateMemory(memory)) {
       throw new EngramAccessInputError(`memory not found: ${memoryId}`);
     }
 
@@ -4546,8 +4551,6 @@ export class EngramAccessService {
     );
   }
 
-  // ── Shared Context / Compounding ────────────────────────────────────────
-
   async sharedContextWriteOutput(request: {
     agentId: string;
     title: string;
@@ -4678,8 +4681,6 @@ export class EngramAccessService {
     });
   }
 
-  // ── Compression Guidelines ────────────────────────────────────────────
-
   async compressionGuidelinesOptimize(request: {
     dryRun?: boolean;
     eventLimit?: number;
@@ -4705,7 +4706,6 @@ export class EngramAccessService {
       expectedGuidelineVersion: request.expectedGuidelineVersion,
     });
   }
-  // ── Memory search & debug ─────────────────────────────────────────────
 
   async memorySearch(request: {
     query: string;
@@ -4719,6 +4719,7 @@ export class EngramAccessService {
     return memorySearchThroughScope(
       {
         namespacesEnabled: resolveNamespaceCapabilities(config).namespaces,
+        memoryCollections: [config.qmdCollection, config.qmdColdCollection ?? "openclaw-engram-cold"],
         // `0` is preserved, never coerced: a zero limit is a runtime
         // compatibility guarantee (AGENTS.md guardrail 4), and it means the
         // same thing here as an explicit `maxResults: 0` from the caller - an
@@ -4736,9 +4737,8 @@ export class EngramAccessService {
             { ...config, requestedCollection: request.collection?.trim() || undefined },
             "qmd",
           ),
-        authorizeFlatCorpus: (namespace, principal) => {
-          this.resolveReadableNamespace(namespace, principal);
-        },
+        filterPrivate: this.orchestrator.filterPrivateSearchResults,
+        authorizeFlatCorpus: (namespace, principal) => void this.resolveReadableNamespace(namespace, principal),
         authorizeNamespaces: async (namespace, principal, collection) =>
           this.resolveMemorySearchNamespacesForCollection(
             collection,
@@ -5483,6 +5483,7 @@ export class EngramAccessService {
       signal: options.signal,
       userExcludeRegexps: this.offlineSyncUserExcludes,
       deletions,
+      excludeFile: createSupportPassportPrivateFileExclusion(storage),
     });
     return {
       namespace: resolvedNamespace,
@@ -5519,6 +5520,7 @@ export class EngramAccessService {
         readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),
         signal: options.signal,
         userExcludeRegexps: this.offlineSyncUserExcludes,
+        excludeFile: createSupportPassportPrivateFileExclusion(storage),
       }),
     };
   }
@@ -5551,6 +5553,7 @@ export class EngramAccessService {
         includeTranscripts: options.includeTranscripts !== false,
         readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
         userExcludeRegexps: this.offlineSyncUserExcludes,
+        excludeFile: createSupportPassportPrivateFileExclusion(storage),
       });
       return {
         namespace: resolvedNamespace,
@@ -5583,6 +5586,7 @@ export class EngramAccessService {
         includeTranscripts: options.includeTranscripts !== false,
         readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
         userExcludeRegexps: this.offlineSyncUserExcludes,
+        excludeFile: createSupportPassportPrivateFileExclusion(storage),
       });
       return {
         namespace: resolvedNamespace,
@@ -5613,23 +5617,7 @@ export class EngramAccessService {
     );
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     try {
-      const result = await applyOfflineSyncFileContentChunk({
-        root: storage.dir,
-        sourceId: options.sourceId,
-        path: options.path,
-        sha256: options.sha256,
-        bytes: options.bytes,
-        mtimeMs: options.mtimeMs,
-        offset: options.offset,
-        baseSha256: options.baseSha256,
-        content: options.content,
-        includeTranscripts: options.includeTranscripts !== false,
-        readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
-        readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),
-        writeFile: async ({ filePath, content }) => storage.writeOfflineSyncFile(filePath, content),
-        writeStagingFile: async ({ filePath, content }) => storage.writeOfflineSyncStagingFile(filePath, content),
-        writeFileChunks: async ({ filePath, chunks }) => storage.writeOfflineSyncFileChunks(filePath, chunks),
-      });
+      const result = await applySupportPassportOfflineSyncFileContent(storage, options);
       return {
         namespace: resolvedNamespace,
         ...result,
@@ -5687,18 +5675,7 @@ export class EngramAccessService {
     );
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     try {
-      const result = await applyOfflineSyncChangeset({
-        root: storage.dir,
-        changeset: options.changeset,
-        returnCurrentFiles: options.returnCurrentFiles,
-        readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
-        readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),
-        writeFile: async ({ filePath, content }) => storage.writeOfflineSyncFile(filePath, content),
-        deleteFile: async ({ filePath, mtimeMs }) =>
-          storage.deleteOfflineSyncFile(filePath, mtimeMs ?? null),
-        recordDeletionRevision: async ({ filePath, mtimeMs }) =>
-          storage.recordReplicatedDeletionRevision(filePath, mtimeMs),
-      });
+      const result = await applySupportPassportOfflineSyncChangeset(storage, options);
       return {
         namespace: resolvedNamespace,
         ...result,

package/src/active-memory-bridge.test.ts

@@ -6,9 +6,12 @@ import {
   recallForActiveMemory,
 } from "./active-memory-bridge.js";
 
+const keepVisibleSearchResults = async <T>(results: T[]): Promise<T[]> => results;
+
 test("recallForActiveMemory caps limit, truncates snippets, and strips internal scoring fields", async () => {
   const orchestrator = {
     resolveSelfNamespace: (_sessionKey?: string) => "resolved-namespace",
+    filterPrivateSearchResults: keepVisibleSearchResults,
     searchAcrossNamespaces: async (_params: unknown) => [
       {
         id: "mem-1",
@@ -54,6 +57,9 @@ test("recallForActiveMemory caps limit, truncates snippets, and strips internal
 test("recallForActiveMemory truncates snippets without splitting surrogate pairs", async () => {
   const orchestrator = {
     resolveSelfNamespace: () => "resolved-namespace",
+    getStorageForNamespace: async () => ({
+      getMemoryById: async () => ({ content: "emoji memory", frontmatter: {} } as never),
+    }),
     searchAcrossNamespaces: async () => [
       {
         id: "mem-emoji",
@@ -95,6 +101,7 @@ test("recallForActiveMemory prioritizes an explicit namespace filter over the se
   let receivedNamespaces: string[] | undefined;
   const orchestrator = {
     resolveSelfNamespace: () => "session-namespace",
+    filterPrivateSearchResults: keepVisibleSearchResults,
     searchAcrossNamespaces: async (params: { namespaces?: string[] }) => {
       receivedNamespaces = params.namespaces;
       return [];
@@ -165,6 +172,7 @@ test("recallForActiveMemory denies blank session keys when namespaces are enable
 test("recallForActiveMemory marks results truncated when the underlying recall exceeds the requested limit", async () => {
   const orchestrator = {
     resolveSelfNamespace: () => "session-namespace",
+    filterPrivateSearchResults: keepVisibleSearchResults,
     searchAcrossNamespaces: async () =>
       Array.from({ length: 3 }, (_, index) => ({
         id: `mem-${index + 1}`,
@@ -187,6 +195,7 @@ test("recallForActiveMemory marks results truncated when the underlying recall e
 test("recallForActiveMemory excludes artifact-backed hits before applying the visible result cap", async () => {
   const orchestrator = {
     resolveSelfNamespace: () => "session-namespace",
+    filterPrivateSearchResults: keepVisibleSearchResults,
     searchAcrossNamespaces: async () => [
       {
         id: "artifact-1",
@@ -226,6 +235,128 @@ test("recallForActiveMemory excludes artifact-backed hits before applying the vi
   );
 });
 
+test("recallForActiveMemory excludes support passport records before applying the visible result cap", async () => {
+  const memories = new Map([
+    ["/tmp/memory/preferences/card.md", {
+      content: "Give me time to answer.",
+      frontmatter: { tags: ["support-passport-card"] },
+    } as never],
+    ["/tmp/memory/corrections/audit.md", {
+      content: "Superseded: Give me time to answer.",
+      frontmatter: { tags: ["support-passport-audit"] },
+    } as never],
+    ["/tmp/memory/facts/safe.md", {
+      content: "Safe memory.",
+      frontmatter: { tags: [] },
+    } as never],
+  ]);
+  const orchestrator = {
+    resolveSelfNamespace: () => "session-namespace",
+    getStorageForNamespace: async () => ({
+      readMemoryByPath: async (memoryPath: string) => memories.get(memoryPath) ?? null,
+    }),
+    filterPrivateSearchResults: async (results: Array<{ path: string }>) =>
+      results.filter((result) => !result.path.includes("/preferences/card.md") && !result.path.includes("/corrections/audit.md")),
+    searchAcrossNamespaces: async () => [
+      { id: "card", score: 0.99, path: "/tmp/memory/preferences/card.md", snippet: "private card" },
+      { id: "audit", score: 0.98, path: "/tmp/memory/corrections/audit.md", snippet: "private audit" },
+      { id: "safe", score: 0.8, path: "/tmp/memory/facts/safe.md", snippet: "safe memory" },
+    ],
+  };
+
+  const result = await recallForActiveMemory(orchestrator as never, {
+    query: "support",
+    limit: 2,
+    sessionKey: "session-b",
+  });
+
+  assert.deepEqual(result.results.map((entry) => entry.id), ["safe"]);
+  assert.equal(result.truncated, false);
+});
+
+test("recallForActiveMemory pages past private passport records", async () => {
+  const corpus = [
+    ...Array.from({ length: 40 }, (_, index) => ({
+      id: `private-${index}`,
+      score: 1 - index / 100,
+      path: `/tmp/memory/preferences/private-${index}.md`,
+      snippet: "private support card",
+    })),
+    { id: "safe", score: 0.5, path: "/tmp/memory/facts/safe.md", snippet: "safe memory" },
+  ];
+  const limits: number[] = [];
+  const orchestrator = {
+    resolveSelfNamespace: () => "session-namespace",
+    filterPrivateSearchResults: async (results: Array<{ path: string }>) =>
+      results.filter((result) => result.path.endsWith("safe.md")),
+    searchAcrossNamespaces: async ({ maxResults }: { maxResults?: number }) => {
+      limits.push(maxResults ?? corpus.length);
+      return corpus.slice(0, maxResults);
+    },
+  };
+
+  const result = await recallForActiveMemory(orchestrator as never, {
+    query: "support",
+    limit: 1,
+    sessionKey: "session-b",
+  });
+
+  assert.deepEqual(result.results.map((entry) => entry.id), ["safe"]);
+  assert.ok(limits.length > 1);
+  assert.equal(result.truncated, false);
+});
+
+test("recallForActiveMemory resolves collection-prefixed paths through the private-result filter", async () => {
+  const calls: Array<{ paths: string[]; namespaces: readonly string[] | undefined }> = [];
+  const orchestrator = {
+    resolveSelfNamespace: () => "session-namespace",
+    getStorageForNamespace: async () => ({
+      readMemoryByPath: async () => {
+        throw new Error("direct path reads must not decide QMD visibility");
+      },
+    }),
+    filterPrivateSearchResults: async (
+      results: Array<{ path: string }>,
+      namespaces: readonly string[] | undefined,
+    ) => {
+      calls.push({ paths: results.map((result) => result.path), namespaces });
+      return results.filter((result) => result.path.endsWith("safe.md"));
+    },
+    searchAcrossNamespaces: async () => [
+      { id: "card", score: 0.99, path: "openclaw-engram/preferences/card.md", snippet: "private card" },
+      { id: "safe", score: 0.8, path: "openclaw-engram/facts/safe.md", snippet: "safe memory" },
+    ],
+  };
+
+  const result = await recallForActiveMemory(orchestrator as never, {
+    query: "support",
+    sessionKey: "session-b",
+  });
+
+  assert.deepEqual(result.results.map((entry) => entry.id), ["safe"]);
+  assert.deepEqual(calls, [{
+    paths: ["openclaw-engram/preferences/card.md", "openclaw-engram/facts/safe.md"],
+    namespaces: ["session-namespace"],
+  }]);
+});
+
+test("recallForActiveMemory fails closed when candidate storage cannot be resolved", async () => {
+  const orchestrator = {
+    resolveSelfNamespace: () => "session-namespace",
+    searchAcrossNamespaces: async () => [
+      { id: "unresolved-path", path: "openclaw-engram/preferences/card.md", snippet: "private path" },
+      { id: "unresolved-id", snippet: "private id" },
+    ],
+  };
+
+  const result = await recallForActiveMemory(orchestrator as never, {
+    query: "support",
+    sessionKey: "session-b",
+  });
+
+  assert.deepEqual(result, { results: [], truncated: false });
+});
+
 test("getMemoryForActiveMemory returns not_found instead of throwing", async () => {
   const orchestrator = {
     resolveSelfNamespace: () => "readable-session",
@@ -238,6 +369,26 @@ test("getMemoryForActiveMemory returns not_found instead of throwing", async ()
   assert.deepEqual(result, { error: "not_found" });
 });
 
+test("getMemoryForActiveMemory hides support passport records", async () => {
+  for (const tag of ["support-passport-card", "support-passport-audit"]) {
+    const orchestrator = {
+      resolveSelfNamespace: () => "readable-session",
+      getStorageForNamespace: async () => ({
+        getMemoryById: async () => ({
+          content: "owner-controlled content",
+          frontmatter: { tags: [tag] },
+        } as never),
+      }),
+    };
+
+    assert.deepEqual(
+      await getMemoryForActiveMemory(orchestrator as never, "private-record"),
+      { error: "not_found" },
+      tag,
+    );
+  }
+});
+
 test("getMemoryForActiveMemory reads via the session-derived namespace storage", async () => {
   let readNamespace: string | undefined;
   const orchestrator = {

package/src/active-memory-bridge.ts

@@ -1,8 +1,9 @@
 import { resolveNamespaceCapabilities } from "./capabilities.js";
 import { canReadNamespace, defaultNamespaceForPrincipal, resolvePrincipal } from "./namespaces/principal.js";
-import type { MemoryFile, PluginConfig } from "./types.js";
+import type { MemoryFile, PluginConfig, QmdSearchResult } from "./types.js";
 import { collapseWhitespace, truncateCodePointSafe } from "./whitespace.js";
 import { isHandleToken } from "./recall-handles.js";
+import { isSupportPassportPrivateMemory } from "./support-passport/card-projection.js";
 
 export interface ActiveMemoryMetadata {
   type?: "fact" | "preference";
@@ -42,6 +43,16 @@ interface ActiveMemoryScopedOrchestrator {
   config?: PluginConfig;
   resolvePrincipal?: (sessionKey?: string) => string | undefined;
   resolveSelfNamespace?: (sessionKey?: string) => string;
+  getStorageForNamespace?: (namespace: string) => Promise<{
+    readMemoryByPath?: (path: string) => Promise<MemoryFile | null>;
+    getMemoryById?: (id: string) => Promise<MemoryFile | null>;
+  }>;
+  filterPrivateSearchResults?: (
+    results: QmdSearchResult[],
+    namespaces?: readonly string[],
+    preserveUnresolved?: boolean,
+    visibilityCache?: Map<string, boolean>,
+  ) => Promise<QmdSearchResult[]>;
 }
 
 type ActiveMemorySearchCandidate = {
@@ -57,6 +68,54 @@ function isArtifactPath(value: string | undefined): boolean {
   return typeof value === "string" && /(?:^|[\\/])artifacts(?:[\\/]|$)/i.test(value);
 }
 
+async function filterVisibleActiveMemoryCandidates(
+  orchestrator: ActiveMemoryScopedOrchestrator,
+  namespace: string,
+  storage: Awaited<ReturnType<NonNullable<ActiveMemoryScopedOrchestrator["getStorageForNamespace"]>>> | undefined,
+  candidates: ActiveMemorySearchCandidate[],
+  visibilityCache?: Map<string, boolean>,
+): Promise<ActiveMemorySearchCandidate[]> {
+  const visible = new Set<ActiveMemorySearchCandidate>();
+  const pathCandidates = candidates.filter(
+    (candidate) => typeof candidate.path === "string" && !isArtifactPath(candidate.path),
+  );
+  if (pathCandidates.length > 0 && typeof orchestrator.filterPrivateSearchResults === "function") {
+    const qmdCandidates = pathCandidates.map((candidate): QmdSearchResult => ({
+      docid: candidate.id ?? candidate.path!,
+      path: candidate.path!,
+      snippet: candidate.snippet ?? candidate.text ?? "",
+      score: typeof candidate.score === "number" ? candidate.score : 0,
+      namespace,
+    }));
+    const filtered = await orchestrator.filterPrivateSearchResults(
+      qmdCandidates,
+      [namespace],
+      false,
+      visibilityCache,
+    );
+    const visibleKeys = new Set(filtered.map((candidate) => `${candidate.docid}\0${candidate.path}`));
+    qmdCandidates.forEach((candidate, index) => {
+      if (visibleKeys.has(`${candidate.docid}\0${candidate.path}`)) visible.add(pathCandidates[index]!);
+    });
+  }
+
+  const idCandidates = candidates.filter(
+    (candidate) => candidate.path === undefined && typeof candidate.id === "string",
+  );
+  if (storage) {
+    const idVisibility = await Promise.all(
+      idCandidates.map(async (candidate) => {
+        const memory = await storage.getMemoryById?.(candidate.id!);
+        return memory !== null && memory !== undefined && !isSupportPassportPrivateMemory(memory);
+      }),
+    );
+    idCandidates.forEach((candidate, index) => {
+      if (idVisibility[index]) visible.add(candidate);
+    });
+  }
+  return candidates.filter((candidate) => visible.has(candidate));
+}
+
 function clampLimit(value: number | undefined): number {
   if (typeof value !== "number" || !Number.isFinite(value)) return 8;
   return Math.max(1, Math.min(50, Math.floor(value)));
@@ -127,6 +186,8 @@ export async function recallForActiveMemory(
     config?: PluginConfig;
     resolvePrincipal?: (sessionKey?: string) => string | undefined;
     resolveSelfNamespace?: (sessionKey?: string) => string;
+    getStorageForNamespace?: ActiveMemoryScopedOrchestrator["getStorageForNamespace"];
+    filterPrivateSearchResults?: ActiveMemoryScopedOrchestrator["filterPrivateSearchResults"];
     searchAcrossNamespaces: (params: {
       query: string;
       maxResults?: number;
@@ -137,7 +198,6 @@ export async function recallForActiveMemory(
   params: ActiveMemoryRecallParams,
 ): Promise<ActiveMemorySearchOutput> {
   const limit = clampLimit(params.limit);
-  const requestedResults = Math.min(200, limit + 20);
   const snippetMaxChars =
     typeof params.snippetMaxChars === "number" && Number.isFinite(params.snippetMaxChars)
       ? Math.max(1, Math.min(4000, Math.floor(params.snippetMaxChars)))
@@ -148,13 +208,29 @@ export async function recallForActiveMemory(
     typeof params.filters?.namespace === "string" ? params.filters.namespace : undefined,
   );
 
-  const raw = await orchestrator.searchAcrossNamespaces({
-    query: params.query,
-    maxResults: requestedResults,
-    namespaces: [namespace],
-    mode: "search",
-  });
-  const visible = raw.filter((candidate) => !isArtifactPath(candidate.path));
+  const storage = await orchestrator.getStorageForNamespace?.(namespace);
+  const candidateCap = 25_000;
+  let requestedResults = Math.min(candidateCap, limit + 20);
+  let raw: ActiveMemorySearchCandidate[] = [];
+  let visible: ActiveMemorySearchCandidate[] = [];
+  const privateVisibilityCache = new Map<string, boolean>();
+  for (;;) {
+    raw = await orchestrator.searchAcrossNamespaces({
+      query: params.query,
+      maxResults: requestedResults,
+      namespaces: [namespace],
+      mode: "search",
+    });
+    visible = await filterVisibleActiveMemoryCandidates(
+      orchestrator,
+      namespace,
+      storage,
+      raw,
+      privateVisibilityCache,
+    );
+    if (visible.length > limit || raw.length < requestedResults || requestedResults >= candidateCap) break;
+    requestedResults = Math.min(candidateCap, requestedResults * 2);
+  }
 
   return {
     results: visible.slice(0, limit).map((candidate, index) => ({
@@ -163,7 +239,7 @@ export async function recallForActiveMemory(
       text: truncateSnippet(candidate.snippet ?? candidate.text ?? "", snippetMaxChars),
       metadata: pickMetadata(candidate.metadata),
     })),
-    truncated: visible.length > limit,
+    truncated: visible.length > limit || (raw.length === requestedResults && requestedResults >= candidateCap),
   };
 }
 
@@ -231,7 +307,7 @@ export async function getMemoryForActiveMemory(
     }
   }
   const memory = await storage?.getMemoryById?.(resolvedId);
-  if (!memory) return { error: "not_found" };
+  if (!memory || isSupportPassportPrivateMemory(memory)) return { error: "not_found" };
   return {
     id: resolvedId,
     text: collapseWhitespace(memory.content),

package/src/briefing.test.ts

@@ -914,6 +914,44 @@ function makeEmptyStorage(): StorageManager {
   } as unknown as StorageManager;
 }
 
+test("buildBriefing excludes support passport records from generated context", async () => {
+  const generatedPrompts: unknown[] = [];
+  const privateMemory: MemoryFile = {
+    ...makeMemory("2026-04-10T12:00:00.000Z"),
+    frontmatter: {
+      ...makeMemory("2026-04-10T12:00:00.000Z").frontmatter,
+      tags: ["support-passport-card"],
+    },
+    content: "Private support statement",
+  };
+  const publicMemory: MemoryFile = {
+    ...makeMemory("2026-04-10T13:00:00.000Z"),
+    frontmatter: {
+      ...makeMemory("2026-04-10T13:00:00.000Z").frontmatter,
+      id: "public-memory",
+    },
+    content: "Public project update",
+  };
+  const storage = {
+    readAllMemories: async () => [privateMemory, publicMemory],
+    readAllEntityFiles: async () => [],
+  } as unknown as StorageManager;
+
+  const result = await buildBriefing({
+    storage,
+    window: makeWindow("2026-04-10T00:00:00.000Z", "2026-04-11T00:00:00.000Z"),
+    followupGenerator: async (prompt) => {
+      generatedPrompts.push(prompt);
+      return [];
+    },
+    now: new Date("2026-04-11T10:00:00.000Z"),
+  });
+
+  assert.equal(result.markdown.includes(privateMemory.content), false);
+  assert.equal(JSON.stringify(generatedPrompts).includes(privateMemory.content), false);
+  assert.equal(result.markdown.includes(publicMemory.content), true);
+});
+
 test("buildBriefing: model-not-found 400 error produces user-friendly followupsUnavailableReason", async () => {
   // Inject a mock generator that throws an error resembling a Responses API
   // 400 "model does not exist" response.

package/src/briefing.ts

@@ -21,6 +21,7 @@ import path from "node:path";
 import { log } from "./logger.js";
 import { extractJsonCandidates } from "./json-extract.js";
 import { drainPassiveCorrectionNotifications } from "./correction/passive-correction-notifications.js";
+import { excludeSupportPassportPrivateMemories } from "./support-passport/card-projection.js";
 import { normalizeEntityName, StorageManager } from "./storage.js";
 import { readEnvVar, resolveHomeDir } from "./runtime/env.js";
 import type {
@@ -978,9 +979,8 @@ function defaultWindow(now: Date): ParsedBriefingWindow {
 
 async function safeReadMemories(storage: StorageManager): Promise<MemoryFile[]> {
   try {
-    return await storage.readAllMemories();
-  } catch (err) {
-    log.warn(`briefing: readAllMemories failed: ${err}`);
+    return excludeSupportPassportPrivateMemories(await storage.readAllMemories());
+  } catch (err) { log.warn(`briefing: readAllMemories failed: ${err}`);
     return [];
   }
 }

package/src/cli.ts

@@ -236,6 +236,9 @@ import {
 import { resolveHomeDir } from "./runtime/env.js";
 import { expandTildePath } from "./utils/path.js";
 import { RECALL_FALLBACK_DIRS } from "./utils/category-dir.js";
+import {
+  isSupportPassportPrivateMemory,
+} from "./support-passport/card-projection.js";
 import { assertPathInsideRoot } from "./utils/path-containment.js";
 import { convertMemoriesToRecords } from "./training-export/converter.js";
 import { parseStrictCliDate as parseStrictCliDateShared } from "./training-export/date-parse.js";
@@ -1066,6 +1069,8 @@ export async function runMemoryTimelineCliCommand(
   options: MemoryTimelineCliCommandOptions,
 ) {
   const storage = new (await import("./storage.js")).StorageManager(options.memoryDir);
+  const memory = await storage.getMemoryByIdIncludingArchived(options.memoryId);
+  if (!memory || isSupportPassportPrivateMemory(memory)) return [];
   return storage.getMemoryTimeline(options.memoryId, options.limit);
 }
 
@@ -1382,7 +1387,7 @@ export async function runVerifiedRecallSearchCliCommand(options: {
 }
 
 export function isNormalRetrievalVisibleMemory(memory: MemoryFile): boolean {
-  return memory.frontmatter.status !== "forgotten";
+  return memory.frontmatter.status !== "forgotten" && !isSupportPassportPrivateMemory(memory);
 }
 
 export async function filterNormalMemorySearchResults(

package/src/connectors/codex-materialize-runner.ts

@@ -15,6 +15,7 @@ import { log } from "../logger.js";
 import { resolveNamespaceChildRoot } from "../namespaces/path.js";
 import { isSafeRouteNamespace } from "../routing/engine.js";
 import { StorageManager } from "../storage.js";
+import { excludeSupportPassportPrivateMemories } from "../support-passport/card-projection.js";
 import type { PluginConfig, MemoryFile } from "../types.js";
 import {
   hasCodexMaterializeSentinel,
@@ -106,6 +107,7 @@ export async function runCodexMaterialize(
     const storage = new StorageManager(nsDir);
     memories = await storage.readAllMemories();
   }
+  memories = excludeSupportPassportPrivateMemories(memories);
 
   // Intentionally NOT catching here: per the JSDoc contract above,
   // schema-validation and I/O errors from `materializeForNamespace` must

package/src/contradiction/contradiction-scan.ts

@@ -32,6 +32,7 @@ import {
 } from "./contradiction-review.js";
 import type { LocalLlmClient } from "../local-llm.js";
 import type { FallbackLlmClient } from "../fallback-llm.js";
+import { isSupportPassportPrivateMemory } from "../support-passport/card-projection.js";
 
 // ── Types ──────────────────────────────────────────────────────────────────────
 
@@ -450,6 +451,7 @@ async function loadEligibleMemories(storage: StorageManager): Promise<MemoryFile
 
   return all.filter((mem) => {
     const fm = mem.frontmatter;
+    if (isSupportPassportPrivateMemory(mem)) return false;
     // Only active memories (rule 53: explicit ACTIVE_STATUSES set)
     const status = (fm.status as MemoryStatus) ?? "active";
     if (!ACTIVE_STATUSES.has(status)) return false;