@remnic/core 9.54.7 → 9.55.0

package/dist/write-envelope.d.ts

@@ -1,4 +1,4 @@
-import { w as MemoryCategory } from './types-ed-SvS2t.js';
+import { w as MemoryCategory } from './types-CbXieHKr.js';
 import './message-parts/index.js';
 import './bounded-jsonl-state.js';
 import './operator-doctor-types.js';
@@ -59,6 +59,8 @@ interface MemoryWriteInput {
     validAt?: string;
     /** Connector identity that produced this write (issue #1852). */
     sourceConnector?: string;
+    /** Origin class stamped at creation time (issue #1955). */
+    origin?: string;
     /** Human-readable provenance note. */
     sourceReason?: string;
 }
@@ -146,6 +148,7 @@ interface SealedMemoryEnvelope {
     readonly ttl: string | undefined;
     readonly validAt: string | undefined;
     readonly sourceConnector: string | undefined;
+    readonly origin: string | undefined;
     readonly sourceReason: string | undefined;
     readonly source: string;
     /** ISO timestamp the envelope was composed (from ctx.now). */
@@ -223,7 +226,7 @@ declare const WRITE_FINGERPRINT_FIELDS: readonly ["content", "category", "tags",
  * is a visible, reviewable decision — this list exists so the exhaustiveness
  * guard can force every new `MemoryWriteInput` field to be classified.
  */
-declare const FINGERPRINT_EXEMPT_FIELDS: readonly ["confidence", "sourceReason"];
+declare const FINGERPRINT_EXEMPT_FIELDS: readonly ["confidence", "origin", "sourceReason"];
 /** Scope keys always folded into the fingerprint payload. */
 declare const FINGERPRINT_SCOPE_FIELDS: readonly ["surface", "namespace", "principal", "codingContext"];
 /**

package/dist/write-envelope.js

@@ -11,7 +11,7 @@ import {
   isMemoryCategory,
   isSealedMemoryEnvelope,
   sealedWriteToLegacyArgs
-} from "./chunk-NSVDUN76.js";
+} from "./chunk-LCU5R6TQ.js";
 import "./chunk-BT7NVCML.js";
 import "./chunk-JDSVLVCG.js";
 import "./chunk-5GKPFL3S.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.54.7",
+  "version": "9.55.0",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3136,7 +3136,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.54.7"
+    "@remnic/coding-graph": "^9.55.0"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/bitemporal-frontmatter.test.ts

@@ -2,7 +2,7 @@ import test from "node:test";
 import assert from "node:assert/strict";
 import os from "node:os";
 import path from "node:path";
-import { mkdtemp, rm } from "node:fs/promises";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
 
 import { StorageManager } from "./storage.js";
 import { isValidityExpiredNow } from "./temporal-validity.js";
@@ -54,6 +54,25 @@ test("round-trip: observedAt + eventTimeSource + valid_at survive write → read
     await rm(dir, { recursive: true, force: true });
   }
 });
+test("writeMemory normalizes arbitrary origin strings to unknown", async () => {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "remnic-origin-normalize-"));
+  try {
+    const storage = new StorageManager(dir);
+    await storage.ensureDirectories();
+
+    const { id } = await storage.writeMemory("fact", "Origin boundary test.", {
+      origin: "weird\nvalue",
+    });
+    const written = (await storage.readAllMemories()).find((memory) => memory.frontmatter.id === id);
+    assert.ok(written);
+    const raw = await readFile(written!.path, "utf8");
+    assert.match(raw, /^origin: unknown$/m);
+    assert.doesNotMatch(raw, /weird/);
+    assert.equal(written!.frontmatter.origin, "unknown");
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
 
 test("round-trip: invalid_at + forgottenAt coexist with observedAt/eventTimeSource (parser not corrupted)", async () => {
   // Exercises the full serialize→parse round trip through the

package/src/briefing-window.ts

@@ -0,0 +1,27 @@
+import { log } from "./logger.js";
+import type { MemoryFile } from "./types.js";
+type BriefingMemoryReader = {
+  readMemoriesWindow?: (options: { updatedAfter?: Date }) => Promise<{ memories: MemoryFile[] }>;
+  readAllMemories: () => Promise<MemoryFile[]>;
+};
+import type { ParsedBriefingWindow } from "./briefing.js";
+
+/** Read only the memories needed by a briefing, with compatibility fallback. */
+export async function safeReadMemories(
+  storage: BriefingMemoryReader,
+  window: ParsedBriefingWindow
+): Promise<MemoryFile[]> {
+  try {
+    // A briefing only needs memories inside its lookback window. Avoid parsing
+    // the full corpus on cache misses; keep the full-read fallback for custom
+    // StorageManager-compatible callers that predate readMemoriesWindow().
+    if (typeof storage.readMemoriesWindow === "function") {
+      const result = await storage.readMemoriesWindow({ updatedAfter: window.from });
+      return result.memories;
+    }
+    return await storage.readAllMemories();
+  } catch (err) {
+    log.warn(`briefing: read memories failed: ${err}`);
+    return [];
+  }
+}

package/src/briefing.test.ts

@@ -913,6 +913,35 @@ function makeEmptyStorage(): StorageManager {
     readAllEntityFiles: async () => [],
   } as unknown as StorageManager;
 }
+test("buildBriefing reads only memories updated inside the briefing window", async () => {
+  let readWindowOptions: { updatedAfter?: Date } | undefined;
+  const atWindowStart = makeMemory("2026-04-10T00:00:00.000Z");
+  const atWindowEnd = makeMemory("2026-04-11T00:00:00.000Z");
+  const storage = {
+    readAllMemories: async () => {
+      throw new Error("full corpus read must not be used by briefing");
+    },
+    readMemoriesWindow: async (options: { updatedAfter?: Date }) => {
+      readWindowOptions = options;
+      return {
+        memories: [atWindowStart, atWindowEnd],
+        filePaths: [atWindowStart.path, atWindowEnd.path],
+      };
+    },
+    readAllEntityFiles: async () => [],
+  } as unknown as StorageManager;
+
+  const result = await buildBriefing({
+    storage,
+    window: makeWindow("2026-04-10T00:00:00.000Z", "2026-04-11T00:00:00.000Z"),
+    allowLlm: false,
+    now: new Date("2026-04-11T10:00:00.000Z"),
+  });
+
+  assert.equal(readWindowOptions?.updatedAfter?.toISOString(), "2026-04-10T00:00:00.000Z");
+  assert.equal(result.sections.activeThreads.length, 1);
+});
+
 
 test("buildBriefing excludes support passport records from generated context", async () => {
   const generatedPrompts: unknown[] = [];

package/src/briefing.ts

@@ -23,6 +23,7 @@ import { extractJsonCandidates } from "./json-extract.js";
 import { drainPassiveCorrectionNotifications } from "./correction/passive-correction-notifications.js";
 import { excludeSupportPassportPrivateMemories } from "./support-passport/card-projection.js";
 import { normalizeEntityName, StorageManager } from "./storage.js";
+import { safeReadMemories } from "./briefing-window.js";
 import { readEnvVar, resolveHomeDir } from "./runtime/env.js";
 import type {
   BriefingActiveThread,
@@ -834,7 +835,7 @@ export async function buildBriefing(options: BuildBriefingOptions): Promise<Brie
   const focus = options.focus ?? null;
 
   const [allMemories, allEntities] = await Promise.all([
-    safeReadMemories(options.storage),
+    safeReadMemories(options.storage, window).then(excludeSupportPassportPrivateMemories),
     safeReadEntities(options.storage),
   ]);
 
@@ -977,14 +978,6 @@ function defaultWindow(now: Date): ParsedBriefingWindow {
   return { from: new Date(now.getTime() - DAY_MS), to: now, label: "yesterday" };
 }
 
-async function safeReadMemories(storage: StorageManager): Promise<MemoryFile[]> {
-  try {
-    return excludeSupportPassportPrivateMemories(await storage.readAllMemories());
-  } catch (err) { log.warn(`briefing: readAllMemories failed: ${err}`);
-    return [];
-  }
-}
-
 async function safeReadEntities(storage: StorageManager): Promise<EntityFile[]> {
   try {
     return await storage.readAllEntityFiles();

package/src/capabilities.test.ts

@@ -857,6 +857,8 @@ const SECURITY_FIELD_TO_FLAG: Record<keyof SecurityCapabilitySet, string> = {
   trustZones: "trustZonesEnabled",
   quarantinePromotion: "quarantinePromotionEnabled",
   memoryPoisoningDefense: "memoryPoisoningDefenseEnabled",
+  originAuthority: "originAuthorityEnabled",
+  injectionScreen: "injectionScreenEnabled",
   trustZoneRecall: "trustZoneRecallEnabled",
 };
 

package/src/capabilities.ts

@@ -616,13 +616,12 @@ export function resolveLocalLlmCapabilities(
 }
 
 // ---------------------------------------------------------------------------
-// Security capability set (issue #1523 batch 7).
-//
-// The four security/trust-zone flags gate quarantine promotion, poisoning
-// defense, and trust-zone recall. Read sites span orchestrator, access-service,
-// CLI, and research-status commands. All flags are non-optional booleans on
-// PluginConfig (defaults resolved at the parse boundary), so the projection is
-// a pure pass-through.
+// Security capability set (issue #1523 batch 7). The six security/trust-zone
+// flags gate quarantine promotion, poisoning defense, origin authority,
+// injection screening, and trust-zone recall. Read sites span orchestrator,
+// access-service, CLI, and research-status commands. All flags are
+// non-optional booleans on PluginConfig (defaults resolved at the parse
+// boundary), so the projection is a pure pass-through.
 // ---------------------------------------------------------------------------
 
 /**
@@ -635,26 +634,27 @@ export interface SecurityCapabilitySet {
   readonly quarantinePromotion: boolean;
   /** `memoryPoisoningDefenseEnabled` — detect and defend against memory poisoning. */
   readonly memoryPoisoningDefense: boolean;
+  /** `originAuthorityEnabled` — preserve origin-bound write authority. */
+  readonly originAuthority: boolean;
+  /** `injectionScreenEnabled` — quarantine deterministic injection findings. */
+  readonly injectionScreen: boolean;
   /** `trustZoneRecallEnabled` — restrict recall to trusted zones. */
   readonly trustZoneRecall: boolean;
 }
 
-/**
- * Config projection consumed by {@link resolveSecurityCapabilities}.
- */
-export type SecurityConfigProjection = Pick<
-  PluginConfig,
-  "trustZonesEnabled" | "quarantinePromotionEnabled" | "memoryPoisoningDefenseEnabled" | "trustZoneRecallEnabled"
->;
+/** Config projection consumed by {@link resolveSecurityCapabilities}. */
+export type SecurityConfigProjection = Pick<PluginConfig,
+  | "trustZonesEnabled" | "quarantinePromotionEnabled" | "memoryPoisoningDefenseEnabled"
+  | "originAuthorityEnabled" | "injectionScreenEnabled" | "trustZoneRecallEnabled">;
 
-/**
- * Resolve the {@link SecurityCapabilitySet} from parsed config.
- */
+/** Resolve the {@link SecurityCapabilitySet} from parsed config. */
 export function resolveSecurityCapabilities(config: SecurityConfigProjection): SecurityCapabilitySet {
   return Object.freeze({
     trustZones: config.trustZonesEnabled,
     quarantinePromotion: config.quarantinePromotionEnabled,
     memoryPoisoningDefense: config.memoryPoisoningDefenseEnabled,
+    originAuthority: config.originAuthorityEnabled,
+    injectionScreen: config.injectionScreenEnabled,
     trustZoneRecall: config.trustZoneRecallEnabled,
   });
 }

package/src/cli.ts

@@ -66,6 +66,11 @@ import {
   restoreMemoryGovernanceRun,
   runMemoryGovernance,
 } from "./maintenance/memory-governance.js";
+import {
+  auditMemoryStore,
+  type AuditMemoryStoreOptions,
+} from "./security/audit-memory.js";
+import { registerSecurityCommands } from "./security/audit-memory-cli.js";
 import {
   rebuildMemoryProjection,
   repairMemoryProjection,
@@ -534,6 +539,8 @@ export interface MemoryReviewDispositionCliCommandOptions {
   now?: Date;
 }
 
+export interface AuditMemoryCliCommandOptions extends AuditMemoryStoreOptions {}
+
 export interface MigrateObservationsCliCommandOptions {
   memoryDir: string;
   write?: boolean;
@@ -1130,6 +1137,11 @@ export async function runMemoryReviewDispositionCliCommand(
     reasonCode: options.reasonCode,
   };
 }
+export async function runAuditMemoryCliCommand(
+  options: AuditMemoryCliCommandOptions,
+) {
+  return auditMemoryStore(options);
+}
 
 export async function runMigrateObservationsCliCommand(
   options: MigrateObservationsCliCommandOptions,
@@ -7187,6 +7199,8 @@ export function registerCli(
           console.log("OK");
         });
 
+      registerSecurityCommands(cmd, orchestrator);
+
       cmd
         .command("governance-run")
         .description("Run memory governance in shadow/apply mode and write audit artifacts")

package/src/config-security.ts

@@ -0,0 +1,131 @@
+import { coerceBool } from "./connectors/coerce.js";
+import { readEnvVar } from "./runtime/env.js";
+import { DEFAULT_UNTRUSTED_ORIGINS } from "./security/origin-authority.js";
+
+// Memory-poisoning hardening (#1955): preserve explicit config, but let env
+// values replace schema-materialized defaults from the host config loader.
+function resolveSecurityBooleanConfig(
+  value: unknown,
+  rawOperatorConfig: Record<string, unknown> | null | undefined,
+  flagName: string,
+  envName: string,
+  defaultValue: boolean,
+): boolean {
+  const rawAuthored =
+    rawOperatorConfig !== undefined &&
+    rawOperatorConfig !== null &&
+    Object.prototype.hasOwnProperty.call(rawOperatorConfig, flagName) &&
+    rawOperatorConfig[flagName] !== undefined &&
+    rawOperatorConfig[flagName] !== null;
+  const schemaDefaultMaterialized =
+    rawOperatorConfig !== undefined &&
+    !rawAuthored &&
+    value === defaultValue;
+  if (!schemaDefaultMaterialized && value !== undefined && value !== null) {
+    return resolveBooleanConfig(value, defaultValue, flagName);
+  }
+  if (rawAuthored) {
+    return resolveBooleanConfig(value ?? rawOperatorConfig?.[flagName], defaultValue, flagName);
+  }
+  const envValue = readEnvVar(envName);
+  return envValue === undefined
+    ? defaultValue
+    : resolveBooleanConfig(envValue, defaultValue, flagName);
+}
+
+function resolveBooleanConfig(
+  value: unknown,
+  defaultValue: boolean,
+  keyName: string,
+): boolean {
+  if (value === undefined || value === null) return defaultValue;
+  const coerced = coerceBool(value);
+  if (coerced === undefined) {
+    throw new Error(
+      `${keyName} must be a boolean-like value (true/false/1/0/yes/no/on/off); got ${JSON.stringify(value)}`,
+    );
+  }
+  return coerced;
+}
+
+// Memory-poisoning hardening (#1955): keep origin allow-list parsing in the
+// parser module so config-contract extraction covers this delegated surface.
+function resolveUntrustedOrigins(
+  value: unknown,
+  rawOperatorConfig: Record<string, unknown> | null | undefined,
+): string[] {
+  const rawAuthored =
+    rawOperatorConfig !== undefined &&
+    rawOperatorConfig !== null &&
+    Object.prototype.hasOwnProperty.call(rawOperatorConfig, "untrustedOrigins") &&
+    rawOperatorConfig.untrustedOrigins !== undefined &&
+    rawOperatorConfig.untrustedOrigins !== null;
+  const schemaDefaultMaterialized =
+    rawOperatorConfig !== undefined &&
+    !rawAuthored &&
+    Array.isArray(value) &&
+    value.length === DEFAULT_UNTRUSTED_ORIGINS.length &&
+    value.every((entry, index) => entry === DEFAULT_UNTRUSTED_ORIGINS[index]);
+  const configValue = schemaDefaultMaterialized ? undefined : value;
+  const fromEnv = configValue === undefined || configValue === null;
+  const envValue = fromEnv ? readEnvVar("REMNIC_UNTRUSTED_ORIGINS") : undefined;
+  const source = fromEnv ? envValue : configValue;
+  if (source === undefined || source === null) return [...DEFAULT_UNTRUSTED_ORIGINS];
+
+  let entries: unknown[];
+  if (Array.isArray(source)) {
+    entries = source;
+  } else if (fromEnv && typeof source === "string" && source.trim().length > 0) {
+    const trimmed = source.trim();
+    if (trimmed.startsWith("[")) {
+      try {
+        const parsed: unknown = JSON.parse(trimmed);
+        if (!Array.isArray(parsed)) throw new Error("not an array");
+        entries = parsed;
+      } catch {
+        throw new Error("untrustedOrigins must be an array of strings");
+      }
+    } else {
+      entries = trimmed.split(",");
+    }
+  } else {
+    throw new Error("untrustedOrigins must be an array of strings");
+  }
+
+  const normalized: string[] = [];
+  for (const entry of entries) {
+    if (typeof entry !== "string") {
+      throw new Error("untrustedOrigins must be an array of strings");
+    }
+    const trimmed = entry.trim();
+    if (trimmed.length > 0) normalized.push(trimmed);
+  }
+  return normalized.length > 0 ? normalized : [...DEFAULT_UNTRUSTED_ORIGINS];
+}
+
+export function parseSecurityConfig(
+  cfg: Record<string, unknown>,
+  rawOperatorConfig: Record<string, unknown> | null | undefined,
+): {
+  originAuthorityEnabled: boolean;
+  injectionScreenEnabled: boolean;
+  untrustedOrigins: string[];
+} {
+  return {
+    originAuthorityEnabled: resolveSecurityBooleanConfig(
+      cfg.originAuthorityEnabled,
+      rawOperatorConfig,
+      "originAuthorityEnabled",
+      "REMNIC_ORIGIN_AUTHORITY_ENABLED",
+      false,
+    ),
+    injectionScreenEnabled: resolveSecurityBooleanConfig(
+      cfg.injectionScreenEnabled,
+      rawOperatorConfig,
+      "injectionScreenEnabled",
+      "REMNIC_INJECTION_SCREEN_ENABLED",
+      true,
+    ),
+    untrustedOrigins: resolveUntrustedOrigins(cfg.untrustedOrigins, rawOperatorConfig),
+  };
+}

package/src/config.test.ts

@@ -31,6 +31,67 @@ function withIsolatedConnectorsDir<T>(
     rmSync(root, { recursive: true, force: true });
   }
 }
+test("parseConfig memory-poisoning hardening defaults and validation (#1955)", () => {
+  const previousOrigin = process.env.REMNIC_ORIGIN_AUTHORITY_ENABLED;
+  const previousInjection = process.env.REMNIC_INJECTION_SCREEN_ENABLED;
+  const previousOrigins = process.env.REMNIC_UNTRUSTED_ORIGINS;
+  delete process.env.REMNIC_ORIGIN_AUTHORITY_ENABLED;
+  delete process.env.REMNIC_INJECTION_SCREEN_ENABLED;
+  delete process.env.REMNIC_UNTRUSTED_ORIGINS;
+  try {
+    const defaults = parseConfig({});
+    assert.equal(defaults.originAuthorityEnabled, false);
+    assert.equal(defaults.injectionScreenEnabled, true);
+    assert.deepEqual(defaults.untrustedOrigins, ["tool_output", "import:*", "unknown"]);
+
+    const configured = parseConfig({
+      originAuthorityEnabled: "true",
+      injectionScreenEnabled: "off",
+      untrustedOrigins: [" connector:calendar ", "unknown", ""],
+    });
+    assert.equal(configured.originAuthorityEnabled, true);
+    assert.equal(configured.injectionScreenEnabled, false);
+    assert.deepEqual(configured.untrustedOrigins, ["connector:calendar", "unknown"]);
+
+    process.env.REMNIC_ORIGIN_AUTHORITY_ENABLED = "yes";
+    process.env.REMNIC_INJECTION_SCREEN_ENABLED = "0";
+    process.env.REMNIC_UNTRUSTED_ORIGINS = "connector:calendar, import:legacy, unknown";
+    const fromEnv = parseConfig({});
+    assert.equal(fromEnv.originAuthorityEnabled, true);
+    assert.equal(fromEnv.injectionScreenEnabled, false);
+    assert.deepEqual(fromEnv.untrustedOrigins, ["connector:calendar", "import:legacy", "unknown"]);
+    const envWithSchemaDefaults = parseConfig(
+      {
+        originAuthorityEnabled: false,
+        injectionScreenEnabled: true,
+        untrustedOrigins: ["tool_output", "import:*", "unknown"],
+      },
+      {},
+    );
+    assert.equal(envWithSchemaDefaults.originAuthorityEnabled, true);
+    assert.equal(envWithSchemaDefaults.injectionScreenEnabled, false);
+    assert.deepEqual(
+      envWithSchemaDefaults.untrustedOrigins,
+      ["connector:calendar", "import:legacy", "unknown"],
+    );
+
+    assert.throws(
+      () => parseConfig({ originAuthorityEnabled: "maybe" }),
+      /originAuthorityEnabled must be a boolean-like value/,
+    );
+    assert.throws(
+      () => parseConfig({ untrustedOrigins: "unknown" }),
+      /untrustedOrigins must be an array of strings/,
+    );
+  } finally {
+    if (previousOrigin === undefined) delete process.env.REMNIC_ORIGIN_AUTHORITY_ENABLED;
+    else process.env.REMNIC_ORIGIN_AUTHORITY_ENABLED = previousOrigin;
+    if (previousInjection === undefined) delete process.env.REMNIC_INJECTION_SCREEN_ENABLED;
+    else process.env.REMNIC_INJECTION_SCREEN_ENABLED = previousInjection;
+    if (previousOrigins === undefined) delete process.env.REMNIC_UNTRUSTED_ORIGINS;
+    else process.env.REMNIC_UNTRUSTED_ORIGINS = previousOrigins;
+  }
+});
 
 test("parseConfig emitLegacyTools sticky-legacy default (issue #1550)", () => {
   // Fresh install (no legacy connector entries): canonical-only surface.

package/src/config.ts

@@ -55,6 +55,7 @@ import {
   parseQmdSubprocessStrategy,
   parseQmdSupportedVersion,
 } from "./config-qmd.js";
+import { parseSecurityConfig } from "./config-security.js";
 import {
   resolveEmitLegacyTools,
   resolveNamespaceCatalogEnabled,
@@ -357,7 +358,6 @@ function resolveBooleanConfig(
   return coerced;
 }
 
-
 function resolvePositiveIntegerConfig(
   value: unknown,
   defaultValue: number,
@@ -1554,6 +1554,7 @@ export function parseConfig(
     model,
     reasoningEffort,
     triggerMode,
+    ...parseSecurityConfig(cfg, rawOperatorConfig),
     bufferMaxTurns:
       typeof cfg.bufferMaxTurns === "number" ? cfg.bufferMaxTurns : 5,
     bufferMaxMinutes:

package/src/entity-retrieval.ts

@@ -1,4 +1,5 @@
 import { resolveNamespaceCapabilities } from "./capabilities.js";
+import { renderAuthorityBoundContent } from "./recall-context-composition.js";
 import { createHash } from "node:crypto";
 import { sanitizeMemoryContent } from "./sanitize.js";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -44,7 +45,7 @@ type EntityMentionIndexEntry = {
   relationships: Array<{ target: string; label: string }>;
   activity: Array<{ date: string; note: string }>;
   factCount: number;
-  memorySnippets: string[];
+  memorySnippets: string[]; memorySnippetOrigins?: Array<string | undefined>;
   nativeChunks: Array<{
     chunkId: string;
     title: string;
@@ -72,9 +73,8 @@ type EntityCandidate = {
 type EntityHintSnippet = {
   text: string;
   score: number;
-  kind: "summary" | "fact" | "section" | "relationship" | "activity" | "memory" | "native";
+  kind: "summary" | "fact" | "section" | "relationship" | "activity" | "memory" | "native"; origin?: string;
 };
-
 export interface BuildEntityRecallSectionOptions {
   config: PluginConfig;
   storage: StorageManager;
@@ -87,6 +87,7 @@ export interface BuildEntityRecallSectionOptions {
   maxRelatedEntities: number;
   maxChars: number;
   transcriptEntries: TranscriptEntry[];
+  originAuthorityEnabled?: boolean; untrustedOrigins?: readonly string[];
   /**
    * Cancels the build at its next checkpoint (issue #2291).  Entity recall reads
    * every entity and memory file across the recalled namespaces, which is
@@ -617,16 +618,13 @@ async function buildEntityMentionIndex(
   for (const memory of memories) {
     scanned += 1;
     await yieldEntityRecallScanEvery(scanned, abortSignal);
-    const entityRef = typeof memory.frontmatter.entityRef === "string" ? memory.frontmatter.entityRef : "";
-    if (!entityRef) continue;
-    const entry = entities.get(entityRef);
+    const entry = typeof memory.frontmatter.entityRef === "string" ? entities.get(memory.frontmatter.entityRef) : undefined;
     if (!entry) continue;
     const snippet = await readMemorySnippet(memory);
-    if (!entry.memorySnippets.includes(snippet)) {
-      entry.memorySnippets.push(snippet);
-    }
+    if (entry.memorySnippets.includes(snippet)) continue;
+    entry.memorySnippets.push(snippet);
+    entry.memorySnippetOrigins = [...(entry.memorySnippetOrigins ?? []), memory.frontmatter.origin];
   }
-
   // Each remaining phase is another synchronous pass over the whole index
   // (alias map, native-chunk merge, sort, two full serializations). Yield between
   // them so a section deadline can fire between passes instead of only after all
@@ -908,12 +906,8 @@ async function buildHintSnippets(
       });
     }
 
-    for (const memorySnippet of entry.memorySnippets.slice(0, Math.min(maxSupportingFacts, 4))) {
-      snippets.push({
-        text: memorySnippet,
-        score: 5,
-        kind: "memory",
-      });
+    for (const [index, memorySnippet] of entry.memorySnippets.slice(0, Math.min(maxSupportingFacts, 4)).entries()) {
+      snippets.push({ text: memorySnippet, score: 5, kind: "memory", origin: entry.memorySnippetOrigins?.[index] });
     }
 
     for (const chunk of entry.nativeChunks) {
@@ -968,9 +962,18 @@ function formatEntityHintSection(
   mode: EntityQueryMode,
   maxRelatedEntities: number,
   maxChars: number,
+  originAuthorityEnabled: boolean, untrustedOrigins: readonly string[],
 ): string | null {
   if (candidates.length === 0) return null;
   const lines: string[] = ["## entity_answer_hints", ""];
+  // #1955 review: non-native snippet kinds may embed extraction-written content
+  // without per-field origin — fence as unknown (least privilege; plumbing #2397).
+  const renderSnippet = (snippet: EntityHintSnippet): string => snippet.kind !== "native"
+    ? renderAuthorityBoundContent(snippet.text, snippet.origin, { enabled: originAuthorityEnabled, untrustedOrigins }) : snippet.text;
+  // (see comment above)
+  // #1955 review: inline fields (names/types/aliases/targets) cannot carry the
+  // multi-line block fence without collapsing the hint list structure —
+  // per-field origin plumbing is tracked in #2397.
   for (const { candidate, snippets, uncertainty } of candidates) {
     const hasSummary = Boolean(candidate.entry.summary?.trim());
     const preferredTopSnippets = hasSummary
@@ -1020,16 +1023,12 @@ function formatEntityHintSection(
     }
     const topSnippetTexts = new Set(topSnippets.map((snippet) => normalizeEntityText(snippet.text)));
     lines.push(`- target: ${candidate.entry.name} (${candidate.entry.type})`);
-    if (candidate.source === "recent_turn") {
-      lines.push(`- resolution: carried forward from recent turns via alias "${candidate.alias}"`);
-    } else {
-      lines.push(`- resolution: matched alias "${candidate.alias}" in the query`);
-    }
+    lines.push(`- resolution: ${candidate.source === "recent_turn" ? "carried forward from recent turns via alias" : "matched alias"} "${candidate.alias}"${candidate.source === "recent_turn" ? "" : " in the query"}`);
     if (uncertainty) lines.push(`- uncertainty: ${uncertainty}`);
     if (topSnippets.length > 0) {
       lines.push("- likely answer:");
       for (const snippet of topSnippets) {
-        lines.push(`  - ${snippet.text}`);
+        lines.push(`  - ${renderSnippet(snippet)}`);
       }
     }
     if (mode !== "direct") {
@@ -1039,7 +1038,7 @@ function formatEntityHintSection(
       if (fallbackTimeline.length > 0) {
         lines.push("- recent timeline:");
         for (const snippet of fallbackTimeline) {
-          lines.push(`  - ${snippet.text}`);
+          lines.push(`  - ${renderSnippet(snippet)}`);
         }
       }
     }
@@ -1172,7 +1171,15 @@ export async function buildEntityRecallSection(options: BuildEntityRecallSection
     }),
   );
 
-  const section = formatEntityHintSection(enriched, queryTokens, mode, options.maxRelatedEntities, options.maxChars);
+  const section = formatEntityHintSection(
+    enriched,
+    queryTokens,
+    mode,
+    options.maxRelatedEntities,
+    options.maxChars,
+    options.originAuthorityEnabled === true,
+    options.untrustedOrigins ?? [],
+  );
   // `entityRecallSectionAbsent` so a cancelled build is not recorded as a
   // successful section that simply found no entities.
   if (!section) return entityRecallSectionAbsent(options.abortSignal);