@remnic/core 9.54.4 → 9.54.6

package/src/access-surface-catalog.test.ts

@@ -36,6 +36,8 @@ import {
   type HttpRouteEntry,
   type McpToolEntry,
 } from "./access-surface-catalog.js";
+import { SUPPORT_PASSPORT_OWNER_HTTP_ROUTES } from "./support-passport/access-http.js";
+import { SUPPORT_PASSPORT_PUBLIC_HTTP_ROUTES } from "./support-passport/public-http.js";
 
 // #1668: all remaining MCP tools migrated through the strict-schema boundary
 // (recall, capsule, continuity, work, shared-context, peer, dreams, etc.).
@@ -62,7 +64,7 @@ function shortToolName(advertised: string): string {
 
 /** Spin up a server with emitLegacyTools=true and read the deduped short names. */
 async function liveMcpToolShortNames(): Promise<ReadonlySet<string>> {
-  const stub = { briefingEnabled: true } as unknown as EngramAccessService;
+  const stub = { briefingEnabled: true, supportPassportEnabled: true } as unknown as EngramAccessService;
   const server = new EngramMcpServer(stub, { emitLegacyTools: true, codingDecisionVisible: true, architectureCardVisible: true, codegraphVisible: true, sessionDeltaVisible: true, chatVisible: true });
   const response = await server.handleRequest({ jsonrpc: "2.0", id: 1, method: "tools/list" });
   const result = (response as { result?: { tools?: Array<{ name: string }> } }).result;
@@ -142,22 +144,35 @@ function formatViolations(violations: readonly CoverageViolation[]): string {
  * catalog row is not a false migration — the surface code must also wire
  * the dispatch.
  */
-function extractMcpDispatchMap(): Map<string, string> {
-  const source = readFileSync(
-    new URL("./access-mcp.ts", import.meta.url),
-    "utf-8",
-  );
+function extractMcpOperationMap(
+  sourceUrl: URL,
+  constantName: string,
+): Map<string, string> {
+  const source = readFileSync(sourceUrl, "utf-8");
   const blockMatch = source.match(
-    /MCP_MIGRATED_OPERATIONS[^{]*\{([\s\S]*?)\}/,
+    new RegExp(`(?:export\\s+)?const\\s+${constantName}[^=]*=\\s*\\{([\\s\\S]*?)\\}\\s*(?:as const)?;`),
   );
-  const body = blockMatch?.[1] ?? "";
+  assert.ok(blockMatch, `could not find ${constantName} in ${sourceUrl.pathname}`);
   const map = new Map<string, string>();
-  for (const m of body.matchAll(/"engram\.(\w+)"\s*:\s*"(\w+)"/g)) {
+  for (const m of blockMatch[1]!.matchAll(/"engram\.(\w+)"\s*:\s*"(\w+)"/g)) {
     map.set(m[1]!, m[2]!);
   }
   return map;
 }
 
+function extractMcpDispatchMap(): Map<string, string> {
+  return new Map([
+    ...extractMcpOperationMap(
+      new URL("./access-mcp.ts", import.meta.url),
+      "MCP_MIGRATED_OPERATIONS",
+    ),
+    ...extractMcpOperationMap(
+      new URL("./support-passport/mcp-tools.ts", import.meta.url),
+      "SUPPORT_PASSPORT_MCP_MIGRATED_OPERATIONS",
+    ),
+  ]);
+}
+
 /**
  * Normalize a regex route body (e.g. `\/engram\/v1\/peers\/([^/]+)`) to the
  * catalog pathname form (`/engram/v1/peers/:id`).
@@ -302,6 +317,21 @@ function extractHttpRouteDispatchMap(): Map<string, Set<string>> {
       }
     }
   }
+  for (const [sourcePath, routes] of [
+    ["./support-passport/access-http.ts", SUPPORT_PASSPORT_OWNER_HTTP_ROUTES],
+    ["./support-passport/public-http.ts", SUPPORT_PASSPORT_PUBLIC_HTTP_ROUTES],
+  ] as const) {
+    const routeSource = readFileSync(new URL(sourcePath, import.meta.url), "utf-8");
+    for (const route of routes) {
+      const dynamicCardMutation =
+        route.operation.startsWith("support_passport_card_") &&
+        routeSource.includes("operation = `support_passport_card_${cardMatch[2]}`");
+      const publicDispatch = new RegExp(`runPublicOperation\\(\\s*service,\\s*"${route.operation}"`).test(routeSource);
+      if (routeSource.includes(`operation = "${route.operation}"`) || dynamicCardMutation || publicDispatch) {
+        routeOps.set(`${route.method} ${route.pathname}`, new Set([route.operation]));
+      }
+    }
+  }
   return routeOps;
 }
 
@@ -824,4 +854,4 @@ test("memory_get operation resolves through the boundary without hooks (read par
     { service },
   )) as { result: { found: boolean } };
   assert.equal(output.result.found, false);
-});
+});

package/src/access-surface-catalog.ts

@@ -22,6 +22,8 @@
  */
 
 import type { OperationName } from "./access-boundary.js";
+import { SUPPORT_PASSPORT_OWNER_HTTP_ROUTES } from "./support-passport/access-http.js";
+import { SUPPORT_PASSPORT_PUBLIC_HTTP_ROUTES } from "./support-passport/public-http.js";
 
 /**
  * One row per MCP tool, keyed by the canonical SHORT name (no `engram.`/
@@ -162,6 +164,17 @@ export const MCP_TOOLS: readonly McpToolEntry[] = [
   { tool: "console_state", operation: "console_state" },
   { tool: "dreams_status", operation: "dreams_status" },
   { tool: "dreams_run", operation: "dreams_run" },
+  { tool: "support_passport_memory_preview", operation: "support_passport_memory_preview" },
+  { tool: "support_passport_cards_list", operation: "support_passport_cards_list" },
+  { tool: "support_passport_draft_create", operation: "support_passport_draft_create" },
+  { tool: "support_passport_drafts_generate", operation: "support_passport_drafts_generate" },
+  { tool: "support_passport_card_replace", operation: "support_passport_card_replace" },
+  { tool: "support_passport_card_approve", operation: "support_passport_card_approve" },
+  { tool: "support_passport_card_reject", operation: "support_passport_card_reject" },
+  { tool: "support_passport_card_withdraw", operation: "support_passport_card_withdraw" },
+  { tool: "support_passport_grant_create", operation: "support_passport_grant_create" },
+  { tool: "support_passport_grants_list", operation: "support_passport_grants_list" },
+  { tool: "support_passport_grant_revoke", operation: "support_passport_grant_revoke" },
 ];
 
 // Each route below corresponds 1:1 to a service-invoking route branch in
@@ -260,6 +273,8 @@ export const HTTP_ROUTES: readonly HttpRouteEntry[] = [
   { method: "GET", pathname: "/engram/v1/graph/events", operation: "graph_events" },
   { method: "POST", pathname: "/engram/v1/chat/message", operation: "chat_message" },
   { method: "GET", pathname: "/engram/v1/chat/events/:id", operation: "chat_events" },
+  ...SUPPORT_PASSPORT_OWNER_HTTP_ROUTES,
+  ...SUPPORT_PASSPORT_PUBLIC_HTTP_ROUTES,
 ];
 
 /**

package/src/active-memory-bridge.test.ts

@@ -6,9 +6,12 @@ import {
   recallForActiveMemory,
 } from "./active-memory-bridge.js";
 
+const keepVisibleSearchResults = async <T>(results: T[]): Promise<T[]> => results;
+
 test("recallForActiveMemory caps limit, truncates snippets, and strips internal scoring fields", async () => {
   const orchestrator = {
     resolveSelfNamespace: (_sessionKey?: string) => "resolved-namespace",
+    filterPrivateSearchResults: keepVisibleSearchResults,
     searchAcrossNamespaces: async (_params: unknown) => [
       {
         id: "mem-1",
@@ -54,6 +57,9 @@ test("recallForActiveMemory caps limit, truncates snippets, and strips internal
 test("recallForActiveMemory truncates snippets without splitting surrogate pairs", async () => {
   const orchestrator = {
     resolveSelfNamespace: () => "resolved-namespace",
+    getStorageForNamespace: async () => ({
+      getMemoryById: async () => ({ content: "emoji memory", frontmatter: {} } as never),
+    }),
     searchAcrossNamespaces: async () => [
       {
         id: "mem-emoji",
@@ -95,6 +101,7 @@ test("recallForActiveMemory prioritizes an explicit namespace filter over the se
   let receivedNamespaces: string[] | undefined;
   const orchestrator = {
     resolveSelfNamespace: () => "session-namespace",
+    filterPrivateSearchResults: keepVisibleSearchResults,
     searchAcrossNamespaces: async (params: { namespaces?: string[] }) => {
       receivedNamespaces = params.namespaces;
       return [];
@@ -165,6 +172,7 @@ test("recallForActiveMemory denies blank session keys when namespaces are enable
 test("recallForActiveMemory marks results truncated when the underlying recall exceeds the requested limit", async () => {
   const orchestrator = {
     resolveSelfNamespace: () => "session-namespace",
+    filterPrivateSearchResults: keepVisibleSearchResults,
     searchAcrossNamespaces: async () =>
       Array.from({ length: 3 }, (_, index) => ({
         id: `mem-${index + 1}`,
@@ -187,6 +195,7 @@ test("recallForActiveMemory marks results truncated when the underlying recall e
 test("recallForActiveMemory excludes artifact-backed hits before applying the visible result cap", async () => {
   const orchestrator = {
     resolveSelfNamespace: () => "session-namespace",
+    filterPrivateSearchResults: keepVisibleSearchResults,
     searchAcrossNamespaces: async () => [
       {
         id: "artifact-1",
@@ -226,6 +235,128 @@ test("recallForActiveMemory excludes artifact-backed hits before applying the vi
   );
 });
 
+test("recallForActiveMemory excludes support passport records before applying the visible result cap", async () => {
+  const memories = new Map([
+    ["/tmp/memory/preferences/card.md", {
+      content: "Give me time to answer.",
+      frontmatter: { tags: ["support-passport-card"] },
+    } as never],
+    ["/tmp/memory/corrections/audit.md", {
+      content: "Superseded: Give me time to answer.",
+      frontmatter: { tags: ["support-passport-audit"] },
+    } as never],
+    ["/tmp/memory/facts/safe.md", {
+      content: "Safe memory.",
+      frontmatter: { tags: [] },
+    } as never],
+  ]);
+  const orchestrator = {
+    resolveSelfNamespace: () => "session-namespace",
+    getStorageForNamespace: async () => ({
+      readMemoryByPath: async (memoryPath: string) => memories.get(memoryPath) ?? null,
+    }),
+    filterPrivateSearchResults: async (results: Array<{ path: string }>) =>
+      results.filter((result) => !result.path.includes("/preferences/card.md") && !result.path.includes("/corrections/audit.md")),
+    searchAcrossNamespaces: async () => [
+      { id: "card", score: 0.99, path: "/tmp/memory/preferences/card.md", snippet: "private card" },
+      { id: "audit", score: 0.98, path: "/tmp/memory/corrections/audit.md", snippet: "private audit" },
+      { id: "safe", score: 0.8, path: "/tmp/memory/facts/safe.md", snippet: "safe memory" },
+    ],
+  };
+
+  const result = await recallForActiveMemory(orchestrator as never, {
+    query: "support",
+    limit: 2,
+    sessionKey: "session-b",
+  });
+
+  assert.deepEqual(result.results.map((entry) => entry.id), ["safe"]);
+  assert.equal(result.truncated, false);
+});
+
+test("recallForActiveMemory pages past private passport records", async () => {
+  const corpus = [
+    ...Array.from({ length: 40 }, (_, index) => ({
+      id: `private-${index}`,
+      score: 1 - index / 100,
+      path: `/tmp/memory/preferences/private-${index}.md`,
+      snippet: "private support card",
+    })),
+    { id: "safe", score: 0.5, path: "/tmp/memory/facts/safe.md", snippet: "safe memory" },
+  ];
+  const limits: number[] = [];
+  const orchestrator = {
+    resolveSelfNamespace: () => "session-namespace",
+    filterPrivateSearchResults: async (results: Array<{ path: string }>) =>
+      results.filter((result) => result.path.endsWith("safe.md")),
+    searchAcrossNamespaces: async ({ maxResults }: { maxResults?: number }) => {
+      limits.push(maxResults ?? corpus.length);
+      return corpus.slice(0, maxResults);
+    },
+  };
+
+  const result = await recallForActiveMemory(orchestrator as never, {
+    query: "support",
+    limit: 1,
+    sessionKey: "session-b",
+  });
+
+  assert.deepEqual(result.results.map((entry) => entry.id), ["safe"]);
+  assert.ok(limits.length > 1);
+  assert.equal(result.truncated, false);
+});
+
+test("recallForActiveMemory resolves collection-prefixed paths through the private-result filter", async () => {
+  const calls: Array<{ paths: string[]; namespaces: readonly string[] | undefined }> = [];
+  const orchestrator = {
+    resolveSelfNamespace: () => "session-namespace",
+    getStorageForNamespace: async () => ({
+      readMemoryByPath: async () => {
+        throw new Error("direct path reads must not decide QMD visibility");
+      },
+    }),
+    filterPrivateSearchResults: async (
+      results: Array<{ path: string }>,
+      namespaces: readonly string[] | undefined,
+    ) => {
+      calls.push({ paths: results.map((result) => result.path), namespaces });
+      return results.filter((result) => result.path.endsWith("safe.md"));
+    },
+    searchAcrossNamespaces: async () => [
+      { id: "card", score: 0.99, path: "openclaw-engram/preferences/card.md", snippet: "private card" },
+      { id: "safe", score: 0.8, path: "openclaw-engram/facts/safe.md", snippet: "safe memory" },
+    ],
+  };
+
+  const result = await recallForActiveMemory(orchestrator as never, {
+    query: "support",
+    sessionKey: "session-b",
+  });
+
+  assert.deepEqual(result.results.map((entry) => entry.id), ["safe"]);
+  assert.deepEqual(calls, [{
+    paths: ["openclaw-engram/preferences/card.md", "openclaw-engram/facts/safe.md"],
+    namespaces: ["session-namespace"],
+  }]);
+});
+
+test("recallForActiveMemory fails closed when candidate storage cannot be resolved", async () => {
+  const orchestrator = {
+    resolveSelfNamespace: () => "session-namespace",
+    searchAcrossNamespaces: async () => [
+      { id: "unresolved-path", path: "openclaw-engram/preferences/card.md", snippet: "private path" },
+      { id: "unresolved-id", snippet: "private id" },
+    ],
+  };
+
+  const result = await recallForActiveMemory(orchestrator as never, {
+    query: "support",
+    sessionKey: "session-b",
+  });
+
+  assert.deepEqual(result, { results: [], truncated: false });
+});
+
 test("getMemoryForActiveMemory returns not_found instead of throwing", async () => {
   const orchestrator = {
     resolveSelfNamespace: () => "readable-session",
@@ -238,6 +369,26 @@ test("getMemoryForActiveMemory returns not_found instead of throwing", async ()
   assert.deepEqual(result, { error: "not_found" });
 });
 
+test("getMemoryForActiveMemory hides support passport records", async () => {
+  for (const tag of ["support-passport-card", "support-passport-audit"]) {
+    const orchestrator = {
+      resolveSelfNamespace: () => "readable-session",
+      getStorageForNamespace: async () => ({
+        getMemoryById: async () => ({
+          content: "owner-controlled content",
+          frontmatter: { tags: [tag] },
+        } as never),
+      }),
+    };
+
+    assert.deepEqual(
+      await getMemoryForActiveMemory(orchestrator as never, "private-record"),
+      { error: "not_found" },
+      tag,
+    );
+  }
+});
+
 test("getMemoryForActiveMemory reads via the session-derived namespace storage", async () => {
   let readNamespace: string | undefined;
   const orchestrator = {

package/src/active-memory-bridge.ts

@@ -1,8 +1,9 @@
 import { resolveNamespaceCapabilities } from "./capabilities.js";
 import { canReadNamespace, defaultNamespaceForPrincipal, resolvePrincipal } from "./namespaces/principal.js";
-import type { MemoryFile, PluginConfig } from "./types.js";
-import { collapseWhitespace, truncateCodePointSafe } from "./whitespace.js";
 import { isHandleToken } from "./recall-handles.js";
+import { isSupportPassportPrivateMemory } from "./support-passport/card-projection.js";
+import type { MemoryFile, PluginConfig, QmdSearchResult } from "./types.js";
+import { collapseWhitespace, truncateCodePointSafe } from "./whitespace.js";
 
 export interface ActiveMemoryMetadata {
   type?: "fact" | "preference";
@@ -38,10 +39,22 @@ export interface ActiveMemoryRecallParams {
   snippetMaxChars?: number;
 }
 
+interface ActiveMemoryStorage {
+  readMemoryByPath?: (path: string) => Promise<MemoryFile | null>;
+  getMemoryById?: (id: string) => Promise<MemoryFile | null>;
+}
+
 interface ActiveMemoryScopedOrchestrator {
   config?: PluginConfig;
   resolvePrincipal?: (sessionKey?: string) => string | undefined;
   resolveSelfNamespace?: (sessionKey?: string) => string;
+  getStorageForNamespace?: (namespace: string) => Promise<ActiveMemoryStorage>;
+  filterPrivateSearchResults?: (
+    results: QmdSearchResult[],
+    namespaces?: readonly string[],
+    preserveUnresolved?: boolean,
+    visibilityCache?: Map<string, boolean>,
+  ) => Promise<QmdSearchResult[]>;
 }
 
 type ActiveMemorySearchCandidate = {
@@ -57,6 +70,54 @@ function isArtifactPath(value: string | undefined): boolean {
   return typeof value === "string" && /(?:^|[\\/])artifacts(?:[\\/]|$)/i.test(value);
 }
 
+async function filterVisibleActiveMemoryCandidates(
+  orchestrator: ActiveMemoryScopedOrchestrator,
+  namespace: string,
+  storage: ActiveMemoryStorage | undefined,
+  candidates: ActiveMemorySearchCandidate[],
+  visibilityCache?: Map<string, boolean>,
+): Promise<ActiveMemorySearchCandidate[]> {
+  const visible = new Set<ActiveMemorySearchCandidate>();
+  const pathCandidates = candidates.filter(
+    (candidate) => typeof candidate.path === "string" && !isArtifactPath(candidate.path)
+  );
+  if (pathCandidates.length > 0 && typeof orchestrator.filterPrivateSearchResults === "function") {
+    const qmdCandidates = pathCandidates.map((candidate): QmdSearchResult => ({
+      docid: candidate.id ?? candidate.path!,
+      path: candidate.path!,
+      snippet: candidate.snippet ?? candidate.text ?? "",
+      score: typeof candidate.score === "number" ? candidate.score : 0,
+      namespace,
+    }));
+    const filtered = await orchestrator.filterPrivateSearchResults(
+      qmdCandidates,
+      [namespace],
+      false,
+      visibilityCache,
+    );
+    const visibleKeys = new Set(filtered.map((candidate) => `${candidate.docid}\0${candidate.path}`));
+    qmdCandidates.forEach((candidate, index) => {
+      if (visibleKeys.has(`${candidate.docid}\0${candidate.path}`)) visible.add(pathCandidates[index]!);
+    });
+  }
+
+  const idCandidates = candidates.filter(
+    (candidate) => candidate.path === undefined && typeof candidate.id === "string"
+  );
+  if (storage) {
+    const idVisibility = await Promise.all(
+      idCandidates.map(async (candidate) => {
+        const memory = await storage.getMemoryById?.(candidate.id!);
+        return memory !== null && memory !== undefined && !isSupportPassportPrivateMemory(memory);
+      })
+    );
+    idCandidates.forEach((candidate, index) => {
+      if (idVisibility[index]) visible.add(candidate);
+    });
+  }
+  return candidates.filter((candidate) => visible.has(candidate));
+}
+
 function clampLimit(value: number | undefined): number {
   if (typeof value !== "number" || !Number.isFinite(value)) return 8;
   return Math.max(1, Math.min(50, Math.floor(value)));
@@ -80,7 +141,7 @@ function pickMetadata(value: Record<string, unknown> | undefined): ActiveMemoryM
 function resolveActiveMemoryNamespace(
   orchestrator: ActiveMemoryScopedOrchestrator,
   sessionKey: string | undefined,
-  requestedNamespace: string | undefined,
+  requestedNamespace: string | undefined
 ): string {
   const explicitNamespace =
     typeof requestedNamespace === "string" && requestedNamespace.trim().length > 0
@@ -127,6 +188,8 @@ export async function recallForActiveMemory(
     config?: PluginConfig;
     resolvePrincipal?: (sessionKey?: string) => string | undefined;
     resolveSelfNamespace?: (sessionKey?: string) => string;
+    getStorageForNamespace?: ActiveMemoryScopedOrchestrator["getStorageForNamespace"];
+    filterPrivateSearchResults?: ActiveMemoryScopedOrchestrator["filterPrivateSearchResults"];
     searchAcrossNamespaces: (params: {
       query: string;
       maxResults?: number;
@@ -134,10 +197,9 @@ export async function recallForActiveMemory(
       mode?: string;
     }) => Promise<ActiveMemorySearchCandidate[]>;
   },
-  params: ActiveMemoryRecallParams,
+  params: ActiveMemoryRecallParams
 ): Promise<ActiveMemorySearchOutput> {
   const limit = clampLimit(params.limit);
-  const requestedResults = Math.min(200, limit + 20);
   const snippetMaxChars =
     typeof params.snippetMaxChars === "number" && Number.isFinite(params.snippetMaxChars)
       ? Math.max(1, Math.min(4000, Math.floor(params.snippetMaxChars)))
@@ -145,16 +207,32 @@ export async function recallForActiveMemory(
   const namespace = resolveActiveMemoryNamespace(
     orchestrator,
     params.sessionKey,
-    typeof params.filters?.namespace === "string" ? params.filters.namespace : undefined,
+    typeof params.filters?.namespace === "string" ? params.filters.namespace : undefined
   );
 
-  const raw = await orchestrator.searchAcrossNamespaces({
-    query: params.query,
-    maxResults: requestedResults,
-    namespaces: [namespace],
-    mode: "search",
-  });
-  const visible = raw.filter((candidate) => !isArtifactPath(candidate.path));
+  const storage = await orchestrator.getStorageForNamespace?.(namespace);
+  const candidateCap = 25_000;
+  let requestedResults = Math.min(candidateCap, limit + 20);
+  let raw: ActiveMemorySearchCandidate[] = [];
+  let visible: ActiveMemorySearchCandidate[] = [];
+  const privateVisibilityCache = new Map<string, boolean>();
+  for (;;) {
+    raw = await orchestrator.searchAcrossNamespaces({
+      query: params.query,
+      maxResults: requestedResults,
+      namespaces: [namespace],
+      mode: "search",
+    });
+    visible = await filterVisibleActiveMemoryCandidates(
+      orchestrator,
+      namespace,
+      storage,
+      raw,
+      privateVisibilityCache,
+    );
+    if (visible.length > limit || raw.length < requestedResults || requestedResults >= candidateCap) break;
+    requestedResults = Math.min(candidateCap, requestedResults * 2);
+  }
 
   return {
     results: visible.slice(0, limit).map((candidate, index) => ({
@@ -163,7 +241,7 @@ export async function recallForActiveMemory(
       text: truncateSnippet(candidate.snippet ?? candidate.text ?? "", snippetMaxChars),
       metadata: pickMetadata(candidate.metadata),
     })),
-    truncated: visible.length > limit,
+    truncated: visible.length > limit || (raw.length === requestedResults && requestedResults >= candidateCap),
   };
 }
 
@@ -201,13 +279,9 @@ export async function getMemoryForActiveMemory(
   options: {
     namespace?: string;
     sessionKey?: string;
-  } = {},
+  } = {}
 ): Promise<ActiveMemoryGetOutput> {
-  const namespace = resolveActiveMemoryNamespace(
-    orchestrator,
-    options.sessionKey,
-    options.namespace,
-  );
+  const namespace = resolveActiveMemoryNamespace(orchestrator, options.sessionKey, options.namespace);
 
   const storage =
     typeof orchestrator.getStorageForNamespace === "function"
@@ -231,7 +305,7 @@ export async function getMemoryForActiveMemory(
     }
   }
   const memory = await storage?.getMemoryById?.(resolvedId);
-  if (!memory) return { error: "not_found" };
+  if (!memory || isSupportPassportPrivateMemory(memory)) return { error: "not_found" };
   return {
     id: resolvedId,
     text: collapseWhitespace(memory.content),

package/src/briefing.test.ts

@@ -914,6 +914,44 @@ function makeEmptyStorage(): StorageManager {
   } as unknown as StorageManager;
 }
 
+test("buildBriefing excludes support passport records from generated context", async () => {
+  const generatedPrompts: unknown[] = [];
+  const privateMemory: MemoryFile = {
+    ...makeMemory("2026-04-10T12:00:00.000Z"),
+    frontmatter: {
+      ...makeMemory("2026-04-10T12:00:00.000Z").frontmatter,
+      tags: ["support-passport-card"],
+    },
+    content: "Private support statement",
+  };
+  const publicMemory: MemoryFile = {
+    ...makeMemory("2026-04-10T13:00:00.000Z"),
+    frontmatter: {
+      ...makeMemory("2026-04-10T13:00:00.000Z").frontmatter,
+      id: "public-memory",
+    },
+    content: "Public project update",
+  };
+  const storage = {
+    readAllMemories: async () => [privateMemory, publicMemory],
+    readAllEntityFiles: async () => [],
+  } as unknown as StorageManager;
+
+  const result = await buildBriefing({
+    storage,
+    window: makeWindow("2026-04-10T00:00:00.000Z", "2026-04-11T00:00:00.000Z"),
+    followupGenerator: async (prompt) => {
+      generatedPrompts.push(prompt);
+      return [];
+    },
+    now: new Date("2026-04-11T10:00:00.000Z"),
+  });
+
+  assert.equal(result.markdown.includes(privateMemory.content), false);
+  assert.equal(JSON.stringify(generatedPrompts).includes(privateMemory.content), false);
+  assert.equal(result.markdown.includes(publicMemory.content), true);
+});
+
 test("buildBriefing: model-not-found 400 error produces user-friendly followupsUnavailableReason", async () => {
   // Inject a mock generator that throws an error resembling a Responses API
   // 400 "model does not exist" response.

package/src/briefing.ts

@@ -21,6 +21,7 @@ import path from "node:path";
 import { log } from "./logger.js";
 import { extractJsonCandidates } from "./json-extract.js";
 import { drainPassiveCorrectionNotifications } from "./correction/passive-correction-notifications.js";
+import { excludeSupportPassportPrivateMemories } from "./support-passport/card-projection.js";
 import { normalizeEntityName, StorageManager } from "./storage.js";
 import { readEnvVar, resolveHomeDir } from "./runtime/env.js";
 import type {
@@ -978,9 +979,8 @@ function defaultWindow(now: Date): ParsedBriefingWindow {
 
 async function safeReadMemories(storage: StorageManager): Promise<MemoryFile[]> {
   try {
-    return await storage.readAllMemories();
-  } catch (err) {
-    log.warn(`briefing: readAllMemories failed: ${err}`);
+    return excludeSupportPassportPrivateMemories(await storage.readAllMemories());
+  } catch (err) { log.warn(`briefing: readAllMemories failed: ${err}`);
     return [];
   }
 }

package/src/cli.ts

@@ -236,6 +236,9 @@ import {
 import { resolveHomeDir } from "./runtime/env.js";
 import { expandTildePath } from "./utils/path.js";
 import { RECALL_FALLBACK_DIRS } from "./utils/category-dir.js";
+import {
+  isSupportPassportPrivateMemory,
+} from "./support-passport/card-projection.js";
 import { assertPathInsideRoot } from "./utils/path-containment.js";
 import { convertMemoriesToRecords } from "./training-export/converter.js";
 import { parseStrictCliDate as parseStrictCliDateShared } from "./training-export/date-parse.js";
@@ -1066,6 +1069,8 @@ export async function runMemoryTimelineCliCommand(
   options: MemoryTimelineCliCommandOptions,
 ) {
   const storage = new (await import("./storage.js")).StorageManager(options.memoryDir);
+  const memory = await storage.getMemoryByIdIncludingArchived(options.memoryId);
+  if (!memory || isSupportPassportPrivateMemory(memory)) return [];
   return storage.getMemoryTimeline(options.memoryId, options.limit);
 }
 
@@ -1382,7 +1387,7 @@ export async function runVerifiedRecallSearchCliCommand(options: {
 }
 
 export function isNormalRetrievalVisibleMemory(memory: MemoryFile): boolean {
-  return memory.frontmatter.status !== "forgotten";
+  return memory.frontmatter.status !== "forgotten" && !isSupportPassportPrivateMemory(memory);
 }
 
 export async function filterNormalMemorySearchResults(