@remnic/core 9.54.4 → 9.54.6

package/src/config.ts

@@ -66,6 +66,7 @@ import { parseProvenanceConfig } from "./provenance.js";
 import { parseBoundedJsonlStateConfig } from "./bounded-jsonl-state.js";
 import { parseCodingKnowledgeConfig } from "./coding/coding-knowledge-config.js";
 import { parseChatConfig } from "./chat/chat-config.js";
+import { parseSupportPassportConfig } from "./support-passport/config.js";
 import { parseCorrectionIntentConfig, parseFaithfulnessGateConfig } from "./faithfulness-config.js";
 import { parseOfflineSyncExcludes } from "./offline-sync.js";
 import { parseExternalWikiRoots } from "./external-wiki-config.js";
@@ -469,23 +470,27 @@ export function resolveEnvVars(value: string): string {
 }
 
 function normalizeOpenaiBaseUrl(value: string | undefined, source: "config" | "env"): string | undefined {
-  if (!value) return undefined;
+  if (value === undefined) return undefined;
   const trimmed = value.trim();
-  if (trimmed.length === 0) return undefined;
+  if (trimmed.length === 0) {
+    throw new Error(`${source === "env" ? "OPENAI_BASE_URL" : "openaiBaseUrl"} must be an absolute HTTP or HTTPS URL`);
+  }
 
   let parsed: URL;
   try {
     parsed = new URL(trimmed);
   } catch {
-    log.warn(`ignoring invalid openaiBaseUrl from ${source}: not a valid URL`);
-    return undefined;
+    throw new Error(`${source === "env" ? "OPENAI_BASE_URL" : "openaiBaseUrl"} must be an absolute HTTP or HTTPS URL`);
   }
 
   if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    log.warn(
-      `ignoring openaiBaseUrl from ${source}: unsupported URL scheme (${parsed.protocol.replace(":", "")})`,
+    throw new Error(`${source === "env" ? "OPENAI_BASE_URL" : "openaiBaseUrl"} must use HTTP or HTTPS`);
+  }
+
+  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+    throw new Error(
+      `${source === "env" ? "OPENAI_BASE_URL" : "openaiBaseUrl"} must not include credentials, query parameters, or fragments`,
     );
-    return undefined;
   }
 
   if (parsed.protocol === "http:") {
@@ -1461,9 +1466,12 @@ export function parseConfig(
   };
 
   let baseUrl: string | undefined;
-  if (typeof cfg.openaiBaseUrl === "string" && cfg.openaiBaseUrl.length > 0) {
+  if (cfg.openaiBaseUrl !== undefined && typeof cfg.openaiBaseUrl !== "string") {
+    throw new Error("openaiBaseUrl must be a string");
+  }
+  if (cfg.openaiBaseUrl !== undefined) {
     baseUrl = normalizeOpenaiBaseUrl(resolveEnvVars(cfg.openaiBaseUrl), "config");
-  } else {
+  } else if (apiKey !== undefined) {
     baseUrl = normalizeOpenaiBaseUrl(readEnvVar("OPENAI_BASE_URL"), "env");
   }
 
@@ -2325,6 +2333,7 @@ export function parseConfig(
     codexCompat,
     codingKnowledge: parseCodingKnowledgeConfig(cfg.codingKnowledge),
     chat: parseChatConfig(cfg.chat),
+    supportPassport: parseSupportPassportConfig(cfg.supportPassport),
     hourlySummariesEnabled: cfg.hourlySummariesEnabled !== false, // default: true
     daySummaryEnabled: cfg.daySummaryEnabled !== false, // default: true
     hourlySummaryCronAutoRegister: cfg.hourlySummaryCronAutoRegister === true,

package/src/connectors/codex-materialize-runner.ts

@@ -15,6 +15,7 @@ import { log } from "../logger.js";
 import { resolveNamespaceChildRoot } from "../namespaces/path.js";
 import { isSafeRouteNamespace } from "../routing/engine.js";
 import { StorageManager } from "../storage.js";
+import { excludeSupportPassportPrivateMemories } from "../support-passport/card-projection.js";
 import type { PluginConfig, MemoryFile } from "../types.js";
 import {
   hasCodexMaterializeSentinel,
@@ -106,6 +107,7 @@ export async function runCodexMaterialize(
     const storage = new StorageManager(nsDir);
     memories = await storage.readAllMemories();
   }
+  memories = excludeSupportPassportPrivateMemories(memories);
 
   // Intentionally NOT catching here: per the JSDoc contract above,
   // schema-validation and I/O errors from `materializeForNamespace` must

package/src/contradiction/contradiction-scan.ts

@@ -32,6 +32,7 @@ import {
 } from "./contradiction-review.js";
 import type { LocalLlmClient } from "../local-llm.js";
 import type { FallbackLlmClient } from "../fallback-llm.js";
+import { isSupportPassportPrivateMemory } from "../support-passport/card-projection.js";
 
 // ── Types ──────────────────────────────────────────────────────────────────────
 
@@ -450,6 +451,7 @@ async function loadEligibleMemories(storage: StorageManager): Promise<MemoryFile
 
   return all.filter((mem) => {
     const fm = mem.frontmatter;
+    if (isSupportPassportPrivateMemory(mem)) return false;
     // Only active memories (rule 53: explicit ACTIVE_STATUSES set)
     const status = (fm.status as MemoryStatus) ?? "active";
     if (!ACTIVE_STATUSES.has(status)) return false;

package/src/contradiction/contradiction.test.ts

@@ -970,6 +970,48 @@ test("runContradictionScan loads memories from namespace-scoped storage", async
   }
 });
 
+test("runContradictionScan excludes support passport private records", async () => {
+  const { dir, cleanup } = await makeTempDir();
+  try {
+    const visibleA = makeMemory("visible-a", "preference");
+    visibleA.frontmatter.entityRef = "entity:shared";
+    const visibleB = makeMemory("visible-b", "preference");
+    visibleB.frontmatter.entityRef = "entity:shared";
+    const passport = makeMemory("passport-card", "preference");
+    passport.frontmatter.entityRef = "entity:shared";
+    passport.frontmatter.tags = ["support-passport-card"];
+    passport.content = "Private support passport statement.";
+
+    const storage = makeScanStorage([visibleA, passport, visibleB]);
+    const config = parseConfig({
+      memoryDir: dir,
+      contradictionScan: {
+        enabled: true,
+        maxPairsPerRun: 10,
+        topicOverlapFloor: 0,
+        similarityFloor: 0,
+      },
+    });
+
+    const result = await runContradictionScan({
+      storage,
+      config,
+      memoryDir: dir,
+      localLlm: null,
+      fallbackLlm: null,
+    });
+
+    assert.equal(result.scanned, 2);
+    assert.equal(result.candidates, 1);
+    assert.deepEqual(listPairs(dir, { filter: "all" }).pairs[0]?.memoryIds, [
+      "visible-a",
+      "visible-b",
+    ]);
+  } finally {
+    await cleanup();
+  }
+});
+
 test("runContradictionScan caps candidates during generation and preserves strategy priority", async () => {
   const { dir, cleanup } = await makeTempDir();
   try {

package/src/correction/correction-access-wiring.ts

@@ -48,6 +48,7 @@ import {
 import { type ExecutorDeps, type ExecutorMemory } from "./correction-executor.js";
 import { CorrectionService, type CorrectionServiceDeps } from "./correction-service.js";
 import { resolveRecallAuxiliaryCapabilities } from "../capabilities.js";
+import { isSupportPassportPrivateMemory } from "../support-passport/card-projection.js";
 
 // ---------------------------------------------------------------------------
 // Public entry: build a fully-wired CorrectionService
@@ -223,7 +224,7 @@ async function resolveTargetMemories(
     for (const ns of namespaces) {
       const storage = await wiring.orchestrator.getStorage(ns);
       const m = await storage.getMemoryById(id);
-      if (m) {
+      if (m && isEligibleCorrectionCandidate(m)) {
         found = toCandidate(m, ns, 1);
         break;
       }
@@ -261,7 +262,11 @@ async function expandEntityNeighbors(
     const storage = await wiring.orchestrator.getStorage(ns);
     const all = await storage.readAllMemories();
     for (const m of all) {
-      if (seedIds.includes(m.frontmatter.id) && m.frontmatter.entityRef) {
+      if (
+        seedIds.includes(m.frontmatter.id) &&
+        m.frontmatter.entityRef &&
+        isEligibleCorrectionCandidate(m)
+      ) {
         seedRefs.add(m.frontmatter.entityRef);
       }
     }
@@ -859,6 +864,7 @@ function toCandidate(m: MemoryFile, namespace: string, score: number): PlannerCa
  * stays consistent with the rescope/retire apply-time guards.
  */
 function isEligibleCorrectionCandidate(m: MemoryFile): boolean {
+  if (isSupportPassportPrivateMemory(m)) return false;
   if (m.frontmatter.status && m.frontmatter.status !== "active") return false;
   if (typeof m.frontmatter.archivedAt === "string" && m.frontmatter.archivedAt.length > 0) return false;
   return true;

package/src/correction/correction-storage-integration.test.ts

@@ -86,6 +86,13 @@ test("#1672 item 2: isEligibleCorrectionCandidate rejects archived memory with n
   assert.equal(isEligibleCorrectionCandidate(m), false);
 });
 
+test("support passport records are not correction candidates", () => {
+  for (const tag of ["support-passport-card", "support-passport-audit"]) {
+    const memory = fakeMemoryFile({ id: tag, status: "active", tags: [tag] });
+    assert.equal(isEligibleCorrectionCandidate(memory), false);
+  }
+});
+
 // ---------------------------------------------------------------------------
 // item 3: contentHash recomputed on edit
 // ---------------------------------------------------------------------------

package/src/explicit-capture.test.ts

@@ -52,6 +52,7 @@ type StoredMemory = {
     category: string;
     status?: string;
     tags?: string[];
+    structuredAttributes?: Record<string, string>;
     sourceConnector?: string;
     blockedBy?: string;
   };
@@ -1147,3 +1148,26 @@ test("explicit capture scans active rows when the blocked index is unavailable",
   assert.equal(result.duplicateOf, "active-existing");
   assert.equal(probe.envelopes.length, 0);
 });
+
+test("explicit capture never deduplicates against private support-passport records", async () => {
+  const probe = createInlineCaptureProcessorProbe();
+  const candidate = validateExplicitCaptureInput({
+    content: "The same words can exist in an owner-controlled passport card.",
+    category: "preference",
+  });
+  probe.memories.push({
+    frontmatter: {
+      id: "private-passport-card",
+      category: "preference",
+      status: "active",
+      structuredAttributes: { "support-passport-owner": "private-owner" },
+    },
+    content: candidate.content,
+  });
+
+  const result = await persistExplicitCapture(probe.orchestrator, candidate, "memory_store");
+
+  assert.equal(result.duplicateOf, undefined);
+  assert.equal(probe.envelopes.length, 1);
+  assert.notEqual(result.id, "private-passport-card");
+});

package/src/explicit-capture.ts

@@ -12,6 +12,7 @@ import {
   normalizeExplicitCaptureContent,
 } from "./storage/tombstone-blocked-capture-index.js";
 import type { StorageManager } from "./storage.js";
+import { isSupportPassportPrivateMemory } from "./support-passport/card-projection.js";
 
 export type ExplicitCaptureInput = {
   content: string;
@@ -480,6 +481,7 @@ async function findDuplicateExplicitCapture(
   const existing = [...hotMemories, ...coldMemories];
   const normalizedCandidate = normalizeExplicitCaptureContent(candidate.content);
   const match = existing.find((memory) => {
+    if (isSupportPassportPrivateMemory(memory)) return false;
     const status = memory.frontmatter.status ?? "active";
     if (status !== "active" && (status !== "pending_review" || !memory.frontmatter.blockedBy)) {
       return false;

package/src/fallback-llm.test.ts

@@ -4,6 +4,7 @@ import test from "node:test";
 
 import { FallbackLlmClient, gatewayTaskChainOptions } from "./fallback-llm.js";
 import { __codexCliFallbackTestHooks } from "./cli-fallback.js";
+import { initLogger, resetLogger } from "./logger.js";
 import { clearModelsJsonCache, __setModelsJsonForTest } from "./models-json.js";
 import {
   __setGatewayRuntimeAuthForModelForTest,
@@ -1654,6 +1655,59 @@ test("fallback llm does NOT append default for a primary-less override that fall
   }
 });
 
+test("fallback llm redacts provider error bodies for sensitive calls", { concurrency: false }, async () => {
+  clearModelsJsonCache();
+  clearSecretCache();
+  const privateMarker = "private-support-note-must-not-log";
+  const lines: string[] = [];
+  initLogger(
+    {
+      info: (message) => lines.push(message),
+      warn: (message) => lines.push(message),
+      error: (message) => lines.push(message),
+      debug: (message) => lines.push(message),
+    },
+    true,
+    { timestamps: false },
+  );
+  const llm = new FallbackLlmClient({
+    agents: { defaults: { model: { primary: "private-provider/test-model" } } },
+    models: {
+      providers: {
+        "private-provider": {
+          baseUrl: "https://private-provider.example/v1",
+          api: "openai-completions",
+          apiKey: "test-key",
+          models: [],
+        },
+      },
+    },
+  });
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async () =>
+    new Response(JSON.stringify({ error: { message: privateMarker } }), {
+      status: 400,
+      headers: { "content-type": "application/json" },
+    })) as typeof fetch;
+
+  try {
+    assert.equal(
+      await llm.chatCompletion(
+        [{ role: "user", content: privateMarker }],
+        { redactProviderErrors: true },
+      ),
+      null,
+    );
+    assert.equal(lines.join("\n").includes(privateMarker), false);
+    assert.match(lines.join("\n"), /provider error details redacted/);
+  } finally {
+    globalThis.fetch = originalFetch;
+    resetLogger();
+    clearModelsJsonCache();
+    clearSecretCache();
+  }
+});
+
 function disableGatewaySecretResolverForTest(): void {
   __setGatewayResolverForTest(async () => null);
 }

package/src/fallback-llm.ts

@@ -23,12 +23,22 @@ export interface FallbackLlmOptions {
   maxTokens?: number;
   timeoutMs?: number;
   signal?: AbortSignal;
+  /** Set the Responses API storage policy. Other transports ignore this value. */
+  store?: boolean;
+  /** Request strict JSON output when a route uses the Responses API. */
+  responsesJsonSchema?: { name: string; schema: Record<string, unknown> };
+  /** Hide provider error details that could echo private request content. */
+  redactProviderErrors?: boolean;
   /** Explicit "provider/model" override to try before the configured chain. */
   model?: string;
   /** Explicit model chain override to use instead of the configured agent/default chain. */
   modelChain?: AgentPersonaModelConfig;
+  /** Append the gateway default chain after an explicit model chain. */
+  includeDefaultModelFallback?: boolean;
   /** Override which agent persona's model chain to use (by ID from agents.list[]). */
   agentId?: string;
+  /** Reject a transport-successful response and continue through the configured model chain. */
+  acceptResponse?: (response: FallbackLlmResponse) => boolean;
 }
 
 export interface FallbackLlmAvailabilityOptions {
@@ -177,7 +187,12 @@ export class FallbackLlmClient {
     messages: Array<{ role: "system" | "user" | "assistant"; content: string }>,
     options: FallbackLlmOptions = {},
   ): Promise<FallbackLlmResponse | null> {
-    const models = this.getModelChain(options.agentId, options.model, options.modelChain);
+    const models = this.getModelChain(
+      options.agentId,
+      options.model,
+      options.modelChain,
+      options.includeDefaultModelFallback,
+    );
     if (models.length === 0) {
       log.warn("fallback LLM: no models configured in gateway");
       return null;
@@ -186,6 +201,7 @@ export class FallbackLlmClient {
     const runChain = async (
       runOptions: FallbackLlmOptions,
     ): Promise<FallbackLlmResponse | null> => {
+      let lastRejectedResponse: FallbackLlmResponse | null = null;
       // Try each model in the chain
       for (let i = 0; i < models.length; i++) {
         if (runOptions.signal?.aborted) {
@@ -197,27 +213,37 @@ export class FallbackLlmClient {
         try {
           const result = await this.tryModel(model, messages, runOptions);
           if (result) {
-            if (isFallback) {
-              log.debug(`fallback LLM: succeeded using ${model.modelString} (fallback ${i})`);
-            }
-            return {
+            const response = {
               content: result.content,
               modelUsed: model.modelString,
               usage: result.usage,
             };
+            if (runOptions.acceptResponse && !runOptions.acceptResponse(response)) {
+              lastRejectedResponse = response;
+              log.debug(`fallback LLM: ${model.modelString} returned rejected output, trying next...`);
+              continue;
+            }
+            if (isFallback) {
+              log.debug(`fallback LLM: succeeded using ${model.modelString} (fallback ${i})`);
+            }
+            return response;
           }
         } catch (err) {
           if (runOptions.signal?.aborted) {
             throw abortReason(runOptions.signal);
           }
-          const errorMsg = err instanceof Error ? err.message : String(err);
+          const errorMsg = runOptions.redactProviderErrors
+            ? "provider error details redacted"
+            : err instanceof Error
+              ? err.message
+              : String(err);
           log.debug(`fallback LLM: ${model.modelString} failed (${errorMsg}), trying next...`);
           // Continue to next model in chain
         }
       }
 
       log.warn(`fallback LLM: all ${models.length} models in chain failed`);
-      return null;
+      return lastRejectedResponse;
     };
 
     if (typeof options.timeoutMs === "number") {
@@ -301,7 +327,12 @@ export class FallbackLlmClient {
       // Disambiguate via the resolved model chain so the retry layer can pick
       // the right failure class.
       const hasModels =
-        this.getModelChain(options.agentId, options.model, options.modelChain).length > 0;
+        this.getModelChain(
+          options.agentId,
+          options.model,
+          options.modelChain,
+          options.includeDefaultModelFallback,
+        ).length > 0;
       return { result: null, failureReason: hasModels ? "http_error" : "no_models" };
     }
 
@@ -335,6 +366,7 @@ export class FallbackLlmClient {
     agentId?: string,
     modelOverride?: string,
     modelChainOverride?: AgentPersonaModelConfig,
+    includeDefaultModelFallback = true,
   ): ModelRef[] {
     const chain: ModelRef[] = [];
     const providers = this.gatewayConfig?.models?.providers ?? {};
@@ -402,7 +434,7 @@ export class FallbackLlmClient {
     // the SAME activation condition chain resolution uses above — so a
     // primary-less override (e.g. {}) that falls through to a persona/default
     // chain does NOT get the default appended (gotcha #39). Issue #1365 / PR #1370.
-    if (modelChainOverride?.primary && modelStrings.length > 0) {
+    if (includeDefaultModelFallback && modelChainOverride?.primary && modelStrings.length > 0) {
       // Append the FULL gateway default chain (primary + fallbacks), not just
       // the primary — if the default primary is also unreachable, a listed
       // default fallback may still succeed (cursor review #1425).
@@ -858,6 +890,19 @@ export class FallbackLlmClient {
       ...buildChatCompletionTemperature(modelId, options.temperature ?? 0.3, {
         assumeOpenAI: shouldAssumeOpenAiChatCompletions(config.baseUrl),
       }),
+      ...(options.store === undefined ? {} : { store: options.store }),
+      ...(options.responsesJsonSchema
+        ? {
+            text: {
+              format: {
+                type: "json_schema",
+                name: options.responsesJsonSchema.name,
+                strict: true,
+                schema: options.responsesJsonSchema.schema,
+              },
+            },
+          }
+        : {}),
     };
     if (instructions.length > 0) {
       body.instructions = instructions;

package/src/index.ts

@@ -48,6 +48,7 @@ export {
   defaultWorkspaceDir,
 } from "./orchestrator.js";
 export * from "./memory-projection-format.js";
+export { searchWithGenericExclusion } from "./access-memory-search-fanout.js";
 export * from "./model-registry.js";
 export * from "./contradiction/index.js";
 
@@ -404,6 +405,7 @@ export {
   type RemnicAdminModelOption,
 } from "./access-http.js";
 export { EngramMcpServer } from "./access-mcp.js";
+export * from "./support-passport/index.js";
 
 // Remnic Relay — host-agnostic mission evidence and receipt contract.
 export {
@@ -873,6 +875,7 @@ export {
   type OfflineSyncDeletionRevision,
   type OfflineSyncFileDeleteTarget,
   type OfflineSyncFileDigest,
+  type OfflineSyncExcludeFile,
   type OfflineSyncFileRecord,
   type OfflineSyncFileContentChunk,
   type OfflineSyncRecordDeletionRevision,

package/src/inline-script.ts

@@ -0,0 +1,6 @@
+export function serializeInlineScriptValue(value: string): string {
+  return JSON.stringify(value)
+    .replaceAll("<", "\\u003c")
+    .replaceAll("\u2028", "\\u2028")
+    .replaceAll("\u2029", "\\u2029");
+}

package/src/local-llm-headers-timeout.test.ts

@@ -13,6 +13,7 @@ import {
 
 import { LocalLlmClient } from "./local-llm.js";
 import { ChatTransport } from "./local-llm-transport.js";
+import { initLogger, resetLogger } from "./logger.js";
 import type { PluginConfig } from "./types.js";
 
 /**
@@ -511,3 +512,44 @@ test("availability probes stop after the caller aborts", async () => {
     await new Promise<void>((resolve) => server.close(() => resolve()));
   }
 });
+
+test("sensitive local requests do not log provider error bodies", { concurrency: false }, async () => {
+  const original = globalThis.fetch;
+  const privateMarker = "private-local-support-note-must-not-log";
+  const privateStatusText = "private-provider-status-must-not-log";
+  const lines: string[] = [];
+  initLogger(
+    {
+      info: (message) => lines.push(message),
+      warn: (message) => lines.push(message),
+      error: (message) => lines.push(message),
+      debug: (message) => lines.push(message),
+    },
+    true,
+    { timestamps: false },
+  );
+  globalThis.fetch = (async () =>
+    new Response(JSON.stringify({ error: { message: privateMarker } }), {
+      status: 400,
+      statusText: privateStatusText,
+      headers: { "content-type": "application/json" },
+    })) as typeof fetch;
+  const client = new LocalLlmClient(createConfig());
+
+  try {
+    primeClient(client);
+    assert.equal(
+      await client.chatCompletion(
+        [{ role: "user", content: privateMarker }],
+        { redactProviderErrors: true },
+      ),
+      null,
+    );
+    assert.equal(lines.join("\n").includes(privateMarker), false);
+    assert.equal(lines.join("\n").includes(privateStatusText), false);
+  } finally {
+    globalThis.fetch = original;
+    resetLogger();
+    await dispatcherOf(client).close();
+  }
+});

package/src/local-llm.ts

@@ -235,8 +235,8 @@ interface LocalLlmChatCompletionOptions {
   disableThinking?: boolean;
   priority?: LocalLlmRequestPriority;
   signal?: AbortSignal;
+  redactProviderErrors?: boolean;
 }
-
 interface LocalLlmQueuedRequest {
   messages: Array<{ role: string; content: string }>;
   options: LocalLlmChatCompletionOptions;
@@ -917,7 +917,7 @@ export class LocalLlmClient {
           enqueuedAtMs: next.enqueuedAtMs,
         });
       } catch (err) {
-        log.warn(`local LLM queue drain failed open: ${err instanceof Error ? err.message : String(err)}`);
+        log.warn(`local LLM queue drain failed open: ${next.options.redactProviderErrors ? "provider error details redacted" : err instanceof Error ? err.message : String(err)}`);
       }
       next.resolve(result);
     } finally {
@@ -1071,7 +1071,7 @@ export class LocalLlmClient {
             break;
           }
           if (response && !response.ok) {
-            log.debug(`local LLM failed to read ${response.status} response body: ${error.message}`);
+            log.debug(`local LLM failed to read ${response.status} response body: ${options.redactProviderErrors ? "details redacted" : error.message}`);
           } else {
             response = null;
             if (!isAbortError(err)) throw err;
@@ -1132,10 +1132,10 @@ export class LocalLlmClient {
           const parsed = JSON.parse(responseBody) as { error?: { message?: string } };
           reason = parsed?.error?.message ? ` — ${parsed.error.message}` : "";
         } catch {
-          log.debug(`local LLM error body: ${responseBody.slice(0, 500)}`);
+          if (!options.redactProviderErrors) log.debug(`local LLM error body: ${responseBody.slice(0, 500)}`);
         }
         log.warn(
-          `local LLM request failed: ${response.status} ${response.statusText}${reason} ` +
+          `local LLM request failed: ${response.status}${options.redactProviderErrors ? "" : ` ${response.statusText}${reason}`} ` +
           `(op=${operation}, model=${this.config.localLlmModel}, url=${chatUrl}, promptChars=${promptChars}, maxTokens=${requestBody.max_tokens as number})`,
         );
         const nonRecoverableReason =
@@ -1187,7 +1187,7 @@ export class LocalLlmClient {
       const msg = data.choices?.[0]?.message;
       const content = msg?.content || msg?.reasoning_content || "";
       if (!content) {
-        log.warn(`local LLM returned empty content. choices=${JSON.stringify(data.choices)?.slice(0, 200)}`);
+        log.warn(`local LLM returned empty content.${options.redactProviderErrors ? "" : ` choices=${JSON.stringify(data.choices)?.slice(0, 200)}`}`);
         return null;
       }
 
@@ -1216,11 +1216,11 @@ export class LocalLlmClient {
       const durationMs = Date.now() - startedAtMs;
       if (isAbortError(err)) {
         log.warn(
-          `local LLM request aborted: op=${operation} timeoutMs=${options.timeoutMs ?? this.config.localLlmTimeoutMs} model=${this.config.localLlmModel} durationMs=${durationMs} error=${errMsg}`,
+          `local LLM request aborted: op=${operation} timeoutMs=${options.timeoutMs ?? this.config.localLlmTimeoutMs} model=${this.config.localLlmModel} durationMs=${durationMs} error=${options.redactProviderErrors ? "provider error details redacted" : errMsg}`,
         );
         return null;
       }
-      log.warn(`local LLM request error: op=${operation} error=${errMsg}`);
+      log.warn(`local LLM request error: op=${operation} error=${options.redactProviderErrors ? "provider error details redacted" : errMsg}`);
       this.isAvailable = false; // Mark as unavailable on non-abort errors
       const nonRecoverableReason = extractNonRecoverableBackendReason(errMsg);
       if (nonRecoverableReason) {

package/src/maintenance/first-start-migration.ts

@@ -34,6 +34,7 @@ import {
   applyUtilityPromotionRuntimePolicy,
   loadUtilityRuntimeValues,
 } from "../utility-runtime.js";
+import { excludeSupportPassportPrivateMemories } from "../support-passport/card-projection.js";
 
 export const FIRST_START_DEMOTION_CAP = 50;
 export const LIFECYCLE_INIT_DONE_MARKER = ".lifecycle-init-done";
@@ -243,7 +244,7 @@ export async function runFirstStartMigration(
     return abortedResult();
   }
 
-  const hotMemories = await storage.readAllMemories();
+  const hotMemories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
   if (signal?.aborted) {
     return abortedResult();
   }

package/src/maintenance/memory-governance.test.ts

@@ -51,3 +51,28 @@ test("governance restore manifest pre-marks actions applied before mutation", as
     await rm(memoryDir, { recursive: true, force: true });
   }
 });
+
+test("governance excludes support-passport private records", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-governance-passport-"));
+  try {
+    const storage = new StorageManager(memoryDir);
+    const { id } = await storage.writeMemory("preference", "Give me advance notice.", {
+      source: "support-passport",
+      tags: ["support-passport-card"],
+      confidence: 0.9,
+    });
+    await storage.updateMemoryFrontmatter(id, { verificationState: "disputed" });
+
+    const result = await runMemoryGovernance({
+      memoryDir,
+      mode: "apply",
+      now: new Date("2026-08-13T12:00:00.000Z"),
+    });
+
+    assert.equal(result.summary.scannedMemories, 0);
+    assert.deepEqual(result.proposedActions, []);
+    assert.equal((await storage.getMemoryById(id))?.frontmatter.status, "active");
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});