@remnic/core 9.69.45 → 9.69.47

package/src/extraction-evidence-class.test.ts

@@ -0,0 +1,355 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  EVIDENCE_CLASSES,
+  applyEvidenceClassRules,
+  classifyEvidenceClasses,
+  deriveFactEvidenceClass,
+  deriveTurnEvidenceClass,
+  echoQuoteKey,
+  evidenceTurnInput,
+  type EvidenceClass,
+  type EvidenceClassTurnInput,
+} from "./extraction-evidence-class.js";
+
+function turn(overrides: Partial<EvidenceClassTurnInput> & Pick<EvidenceClassTurnInput, "content">): EvidenceClassTurnInput {
+  return { role: "assistant", ...overrides };
+}
+
+// ---------------------------------------------------------------------------
+// Deterministic turn-class derivation — table-driven across all classes
+// ---------------------------------------------------------------------------
+
+const DERIVATION_TABLE: ReadonlyArray<{
+  label: string;
+  input: Partial<EvidenceClassTurnInput>;
+  expected: EvidenceClass;
+}> = [
+  { label: "user role", input: { role: "user" }, expected: "user" },
+  { label: "user role despite stray tool flags", input: { role: "user", toolResult: true, toolCall: true }, expected: "user" },
+  { label: "assistant with tool result", input: { role: "assistant", toolResult: true }, expected: "tool" },
+  { label: "assistant with tool result outranks tool call", input: { role: "assistant", toolResult: true, toolCall: true }, expected: "tool" },
+  { label: "assistant with tool call only", input: { role: "assistant", toolCall: true }, expected: "action" },
+  { label: "assistant prose", input: { role: "assistant" }, expected: "agent" },
+  { label: "explicit false flags", input: { role: "assistant", toolResult: false, toolCall: false }, expected: "agent" },
+];
+
+test("deriveTurnEvidenceClass: table-driven classes", () => {
+  for (const row of DERIVATION_TABLE) {
+    const input = turn({ content: "x", ...row.input });
+    assert.equal(
+      deriveTurnEvidenceClass(input),
+      row.expected,
+      `${row.label}: expected ${row.expected}`,
+    );
+  }
+});
+
+test("deriveTurnEvidenceClass: same input always yields the same class (determinism regression)", () => {
+  for (const row of DERIVATION_TABLE) {
+    const input = turn({ content: "x", ...row.input });
+    const first = deriveTurnEvidenceClass(input);
+    for (let i = 0; i < 50; i++) {
+      assert.equal(deriveTurnEvidenceClass(input), first, `${row.label}: call ${i} diverged`);
+    }
+    // A structurally identical clone must not change the class either.
+    const clone = turn({ content: "x", ...row.input });
+    assert.equal(deriveTurnEvidenceClass(clone), first, `${row.label}: clone diverged`);
+  }
+});
+
+test("deriveTurnEvidenceClass: unrelated fields never change the class", () => {
+  const base = turn({ content: "deploy finished", role: "user" });
+  const first = deriveTurnEvidenceClass(base);
+  const noisy: EvidenceClassTurnInput = {
+    ...base,
+    content: "completely different content of a different length",
+  };
+  assert.equal(deriveTurnEvidenceClass(noisy), first);
+});
+
+// ---------------------------------------------------------------------------
+// Buffer-turn adapter — tool part flags map mechanically
+// ---------------------------------------------------------------------------
+
+test("evidenceTurnInput: tool_result part flags the turn as machine output", () => {
+  const input = evidenceTurnInput({
+    role: "assistant",
+    content: "exit 0, 3 files changed",
+    parts: [{ kind: "tool_result" }, { kind: "text" }],
+  });
+  assert.equal(input.toolResult, true);
+  assert.equal(input.toolCall, undefined);
+  assert.equal(deriveTurnEvidenceClass(input), "tool");
+});
+
+test("evidenceTurnInput: tool_call part flags an invocation", () => {
+  const input = evidenceTurnInput({
+    role: "assistant",
+    content: "running the test suite",
+    parts: [{ kind: "tool_call" }],
+  });
+  assert.equal(input.toolCall, true);
+  assert.equal(deriveTurnEvidenceClass(input), "action");
+});
+
+test("evidenceTurnInput: plain parts derive agent prose", () => {
+  const input = evidenceTurnInput({
+    role: "assistant",
+    content: "I think this looks fine",
+    parts: [{ kind: "text" }],
+  });
+  assert.equal(deriveTurnEvidenceClass(input), "agent");
+});
+
+test("evidenceTurnInput: user role passes through", () => {
+  const input = evidenceTurnInput({ role: "user", content: "ship it Friday" });
+  assert.deepEqual(input, { role: "user", content: "ship it Friday" });
+  assert.equal(deriveTurnEvidenceClass(input), "user");
+});
+
+// ---------------------------------------------------------------------------
+// Fact-level span classification — reuses the provenance matcher
+// ---------------------------------------------------------------------------
+
+const USER_TURN = turn({ role: "user", content: "we renewed the license for 40 seats" });
+const TOOL_TURN = turn({ role: "assistant", toolResult: true, content: "invoice total: 40 seats, $12,800 per year" });
+const AGENT_TURN = turn({ role: "assistant", content: "the team seems happy with the current vendor" });
+
+test("classifyEvidenceClasses: quote located in a user turn classifies user", () => {
+  const classes = classifyEvidenceClasses({
+    quote: "renewed the license",
+    turns: [USER_TURN, TOOL_TURN, AGENT_TURN],
+  });
+  assert.deepEqual(classes, ["user"]);
+});
+
+test("classifyEvidenceClasses: quote in tool output classifies tool", () => {
+  const classes = classifyEvidenceClasses({
+    quote: "$12,800 per year",
+    turns: [USER_TURN, TOOL_TURN, AGENT_TURN],
+  });
+  assert.deepEqual(classes, ["tool"]);
+});
+
+test("classifyEvidenceClasses: quote echoed in user and agent turns returns canonical order", () => {
+  const shared = turn({ role: "user", content: "the cache TTL is 300 seconds" });
+  const echo = turn({ role: "assistant", content: "as noted, the cache TTL is 300 seconds" });
+  const classes = classifyEvidenceClasses({ quote: "the cache TTL is 300 seconds", turns: [echo, shared] });
+  assert.deepEqual(classes, ["user", "agent"], "input order must not leak into output order");
+});
+
+test("classifyEvidenceClasses: leading prompt role label is stripped before matching", () => {
+  const classes = classifyEvidenceClasses({
+    quote: "[user] we renewed the license",
+    turns: [USER_TURN],
+  });
+  assert.deepEqual(classes, ["user"]);
+});
+
+test("classifyEvidenceClasses: whitespace and case differences still locate (shared matcher)", () => {
+  const classes = classifyEvidenceClasses({
+    quote: "Invoice  Total:  40 SEATS",
+    turns: [TOOL_TURN],
+  });
+  assert.deepEqual(classes, ["tool"]);
+});
+
+test("classifyEvidenceClasses: no quote and unlocatable quote both yield no classes", () => {
+  assert.deepEqual(classifyEvidenceClasses({ quote: "", turns: [USER_TURN] }), []);
+  assert.deepEqual(classifyEvidenceClasses({ quote: undefined, turns: [USER_TURN] }), []);
+  assert.deepEqual(classifyEvidenceClasses({ quote: "never said this", turns: [USER_TURN] }), []);
+});
+
+test("classifyEvidenceClasses: determinism regression over repeated and reordered calls", () => {
+  const input = { quote: "the cache TTL is 300 seconds", turns: [USER_TURN, TOOL_TURN, AGENT_TURN] };
+  const first = classifyEvidenceClasses(input);
+  for (let i = 0; i < 50; i++) {
+    assert.deepEqual(classifyEvidenceClasses(input), first, `call ${i} diverged`);
+  }
+  const reordered = { quote: input.quote, turns: [...input.turns].reverse() };
+  assert.deepEqual(classifyEvidenceClasses(reordered), first, "turn order must not change the class set");
+});
+
+// ---------------------------------------------------------------------------
+// Fact-level single class — strongest present license wins
+// ---------------------------------------------------------------------------
+
+test("deriveFactEvidenceClass: strongest class present wins in fixed order", () => {
+  assert.equal(deriveFactEvidenceClass(["user", "agent"]), "user");
+  assert.equal(deriveFactEvidenceClass(["tool", "agent"]), "tool");
+  assert.equal(deriveFactEvidenceClass(["action", "agent"]), "action");
+  assert.equal(deriveFactEvidenceClass(["agent"]), "agent");
+});
+
+test("deriveFactEvidenceClass: no located span means agent-asserted", () => {
+  assert.equal(deriveFactEvidenceClass([]), "agent");
+});
+
+test("deriveFactEvidenceClass: every class round-trips through the canonical order", () => {
+  const all = EVIDENCE_CLASSES.slice();
+  for (const cls of all) {
+    assert.equal(deriveFactEvidenceClass([cls, "agent"]), cls);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Deterministic post-extraction rules — each case a smuggling attempt
+// ---------------------------------------------------------------------------
+
+test("rule: agent-asserted user decision never passes (assertion loop)", () => {
+  // The agent asserts the human decided something; the only surviving span is
+  // agent prose. This is the self-reinforcing loop the rules must break.
+  const findings = applyEvidenceClassRules({
+    content: "The user decided to migrate the database to Postgres",
+    category: "decision",
+    evidenceClasses: ["agent"],
+  });
+  assert.equal(findings.length, 1);
+  assert.equal(findings[0]!.rule, "user_attribution_without_user_span");
+  assert.equal(findings[0]!.action, "refuse");
+});
+
+test("rule: user decision backed by a user span passes the attribution gate", () => {
+  const findings = applyEvidenceClassRules({
+    content: "The user decided to migrate the database to Postgres",
+    category: "decision",
+    evidenceClasses: ["user"],
+  });
+  assert.deepEqual(findings, []);
+});
+
+test("rule: agent-own decision honestly attributed is not refused", () => {
+  const findings = applyEvidenceClassRules({
+    content: "The agent chose the conservative retry policy",
+    category: "decision",
+    subject: "agent",
+    evidenceClasses: ["agent"],
+  });
+  assert.deepEqual(findings, []);
+});
+
+test("rule: preference and commitment are decision-like too", () => {
+  for (const category of ["preference", "commitment"]) {
+    const findings = applyEvidenceClassRules({ content: "wants weekly digests", category, evidenceClasses: ["agent"] });
+    assert.equal(findings[0]?.rule, "user_attribution_without_user_span", category);
+  }
+  const factCategory = applyEvidenceClassRules({ content: "wants weekly digests", category: "fact", evidenceClasses: ["agent"] });
+  assert.deepEqual(factCategory, [], "plain facts are not user attributions");
+});
+
+test("rule: number without tool or action evidence is demoted", () => {
+  const findings = applyEvidenceClassRules({
+    content: "The cluster holds 5000 documents",
+    category: "fact",
+    evidenceClasses: ["agent"],
+  });
+  assert.equal(findings.length, 1);
+  assert.equal(findings[0]!.rule, "numeric_without_tool_evidence");
+  assert.equal(findings[0]!.action, "demote");
+});
+
+test("rule: number with tool evidence passes", () => {
+  assert.deepEqual(
+    applyEvidenceClassRules({ content: "The cluster holds 5000 documents", category: "fact", evidenceClasses: ["tool"] }),
+    [],
+  );
+});
+
+test("rule: number with action evidence passes", () => {
+  assert.deepEqual(
+    applyEvidenceClassRules({ content: "The cluster holds 5000 documents", category: "fact", evidenceClasses: ["action"] }),
+    [],
+  );
+});
+
+test("rule: number in a user-spanned fact still demotes — the human is not a licit number source", () => {
+  const findings = applyEvidenceClassRules({
+    content: "We bought 40 seats",
+    category: "fact",
+    evidenceClasses: ["user"],
+  });
+  assert.equal(findings[0]?.rule, "numeric_without_tool_evidence");
+});
+
+test("rule: no evidence classes at all demotes numeric content", () => {
+  const findings = applyEvidenceClassRules({ content: "cost is 5000", category: "fact", evidenceClasses: [] });
+  assert.equal(findings[0]?.rule, "numeric_without_tool_evidence");
+});
+
+test("rule: echo of existing store content is refused", () => {
+  const existing = new Set([echoQuoteKey("the cache TTL is 300 seconds")]);
+  const findings = applyEvidenceClassRules({
+    content: "The cache TTL is 300 seconds",
+    category: "fact",
+    evidenceClasses: ["tool"],
+    quoteKeys: [echoQuoteKey("the cache TTL is 300 seconds")],
+    existingQuoteKeys: existing,
+  });
+  assert.equal(findings.length, 1);
+  assert.equal(findings[0]!.rule, "echo_of_existing_content");
+  assert.equal(findings[0]!.action, "refuse");
+});
+
+test("rule: one fresh quote survives echo suppression", () => {
+  const existing = new Set([echoQuoteKey("old quote")]);
+  const findings = applyEvidenceClassRules({
+    content: "something new",
+    category: "fact",
+    evidenceClasses: ["tool"],
+    quoteKeys: [echoQuoteKey("old quote"), echoQuoteKey("a brand new observation")],
+    existingQuoteKeys: existing,
+  });
+  assert.deepEqual(findings, []);
+});
+
+test("rule: no quote keys or no index means echo rule stays silent", () => {
+  assert.deepEqual(
+    applyEvidenceClassRules({ content: "x", category: "fact", evidenceClasses: ["tool"] }),
+    [],
+  );
+  assert.deepEqual(
+    applyEvidenceClassRules({
+      content: "x", category: "fact", evidenceClasses: ["tool"], quoteKeys: [echoQuoteKey("q")],
+    }),
+    [],
+  );
+});
+
+test("rule: combined smuggling — agent-asserted decision carrying a number", () => {
+  const findings = applyEvidenceClassRules({
+    content: "The user approved a budget of 9000 for the migration",
+    category: "decision",
+    evidenceClasses: ["agent"],
+  });
+  assert.deepEqual(
+    findings.map((f) => f.rule),
+    ["numeric_without_tool_evidence", "user_attribution_without_user_span"],
+  );
+});
+
+test("rule: same input always yields the same findings (determinism regression)", () => {
+  const input = {
+    content: "The user approved a budget of 9000 for the migration",
+    category: "decision" as const,
+    evidenceClasses: ["agent"] as const,
+    quoteKeys: [echoQuoteKey("q1")] as const,
+    existingQuoteKeys: new Set([echoQuoteKey("q1")]),
+  };
+  const first = applyEvidenceClassRules(input);
+  for (let i = 0; i < 50; i++) {
+    assert.deepEqual(applyEvidenceClassRules(input), first, `call ${i} diverged`);
+  }
+  // Findings order is canonical (rule id order), not input-order dependent.
+  assert.deepEqual(first.map((f) => f.rule), [
+    "numeric_without_tool_evidence",
+    "user_attribution_without_user_span",
+    "echo_of_existing_content",
+  ]);
+});
+
+test("echoQuoteKey is case- and whitespace-insensitive and stable", () => {
+  assert.equal(echoQuoteKey("The  Cache TTL"), echoQuoteKey("the cache ttl"));
+  assert.equal(echoQuoteKey("x"), echoQuoteKey("x"));
+  assert.equal(echoQuoteKey("  spaced  out  "), "spaced out");
+});

package/src/extraction-evidence-class.ts

@@ -0,0 +1,241 @@
+/**
+ * Deterministic evidence provenance classes (issue #2973).
+ *
+ * Every extracted candidate is backed by spans located in buffered turns.
+ * The CLASS of a span — whose words it records — decides what the span can
+ * license (learned from distill-kura's measured self-reinforcing assertion
+ * loop: an agent asserts, the extractor records, the next agent reads it back
+ * as ground truth and repeats it with more confidence):
+ *
+ *   - `user`:   the human's own words. Licenses user attributions.
+ *   - `tool`:   machine output. The ONLY licit source for numbers.
+ *   - `action`: a tool was invoked. Weaker than reading its output.
+ *   - `agent`:  agent prose. Licenses a first-person judgement, never a
+ *               bare fact.
+ *
+ * Derivation is pure and total: turn role plus tool-part flags in, one class
+ * out, no clock, no randomness, no I/O. The same input always yields the
+ * same class. Span matching reuses `locateQuoteOffsets` /
+ * `stripLeadingRolePrefix` from `provenance.ts` so class location and
+ * provenance building can never disagree (issue #1575 pitfall: one matcher,
+ * not two).
+ *
+ * The post-extraction rules (`applyEvidenceClassRules`) are deterministic
+ * string/flag checks — no LLM — designed to run before the judge. Each
+ * returns a stable rule id for shadow-mode telemetry. Not yet wired into the
+ * extraction pipeline; see the issue's rollout plan.
+ */
+
+import { locateQuoteOffsets, stripLeadingRolePrefix } from "./provenance.js";
+import type { MemorySubject } from "./types.js";
+import { collapseWhitespace } from "./whitespace.js";
+
+export type EvidenceClass = "user" | "tool" | "action" | "agent";
+
+/** Canonical class order: strongest license first. Fixed; never reorder. */
+export const EVIDENCE_CLASSES: readonly EvidenceClass[] = ["user", "tool", "action", "agent"];
+
+/**
+ * A buffered turn reduced to what class derivation needs. Callers map
+ * `BufferTurn`s via {@link evidenceTurnInput}; `role` and the tool flags are
+ * the only fields that influence the class.
+ */
+export interface EvidenceClassTurnInput {
+  content: string;
+  role: "user" | "assistant";
+  /** Turn carries machine output (a tool_result part). */
+  toolResult?: boolean;
+  /** Turn records a tool invocation (a tool_call part). */
+  toolCall?: boolean;
+}
+
+/**
+ * Derive a turn's evidence class. Total and deterministic:
+ *   - `role: "user"` → `"user"` (the human's words, regardless of stray
+ *     part flags a connector may attach).
+ *   - `role: "assistant"` with `toolResult` → `"tool"`; machine output
+ *     outranks the invocation that produced it.
+ *   - else with `toolCall` → `"action"`.
+ *   - else → `"agent"` (agent prose — the weakest license).
+ */
+export function deriveTurnEvidenceClass(turnInput: EvidenceClassTurnInput): EvidenceClass {
+  if (turnInput.role === "user") return "user";
+  if (turnInput.toolResult === true) return "tool";
+  if (turnInput.toolCall === true) return "action";
+  return "agent";
+}
+
+/**
+ * Map a buffered turn (structural subset of `BufferTurn`) to
+ * {@link EvidenceClassTurnInput}. Tool flags derive mechanically from part
+ * kinds — no content inspection, no heuristics.
+ */
+export function evidenceTurnInput(bufferTurn: {
+  role: "user" | "assistant";
+  content: string;
+  parts?: ReadonlyArray<{ kind: string }>;
+}): EvidenceClassTurnInput {
+  let toolResult = false;
+  let toolCall = false;
+  if (bufferTurn.parts) {
+    for (const part of bufferTurn.parts) {
+      if (part.kind === "tool_result") toolResult = true;
+      else if (part.kind === "tool_call") toolCall = true;
+    }
+  }
+  return {
+    role: bufferTurn.role,
+    content: bufferTurn.content,
+    ...(toolResult ? { toolResult: true } : {}),
+    ...(toolCall ? { toolCall: true } : {}),
+  };
+}
+
+/**
+ * Resolve which quote `buildFactProvenance` would search for: the raw quote
+ * when it matches at least one turn, else the leading prompt role label
+ * stripped (mirrors the raw-preferred contract in `provenance.ts`).
+ */
+function resolveSearchableQuote(
+  quote: string | null | undefined,
+  turns: ReadonlyArray<EvidenceClassTurnInput>,
+): string {
+  const rawQuote = typeof quote === "string" ? quote.trim() : "";
+  if (rawQuote.length === 0) return "";
+  const stripped = stripLeadingRolePrefix(rawQuote);
+  if (rawQuote === stripped) return rawQuote;
+  const rawMatches = turns.some(
+    (t) => typeof t?.content === "string" && t.content.length > 0 && locateQuoteOffsets(rawQuote, t.content).matched,
+  );
+  return rawMatches ? rawQuote : stripped;
+}
+
+/**
+ * Classify the evidence backing a fact: the classes of every turn in which
+ * its quote was located, in canonical `EVIDENCE_CLASSES` order regardless of
+ * turn order. Deterministic — the same `(quote, turns)` pair always yields
+ * the same array. An absent or unlocatable quote yields `[]` (no evidence
+ * class; the extractor's own assertion is all that backs the fact).
+ */
+export function classifyEvidenceClasses(input: {
+  quote: string | null | undefined;
+  turns: ReadonlyArray<EvidenceClassTurnInput>;
+}): EvidenceClass[] {
+  const quote = resolveSearchableQuote(input.quote, input.turns);
+  if (quote.length === 0) return [];
+  const present = new Set<EvidenceClass>();
+  for (const turn of input.turns) {
+    if (!turn || typeof turn.content !== "string" || turn.content.length === 0) continue;
+    if (locateQuoteOffsets(quote, turn.content).matched) {
+      present.add(deriveTurnEvidenceClass(turn));
+    }
+  }
+  return EVIDENCE_CLASSES.filter((cls) => present.has(cls));
+}
+
+/**
+ * Collapse a fact's evidence classes to the single strongest license present.
+ * No located span (`[]`) collapses to `"agent"`: the fact is agent-asserted.
+ */
+export function deriveFactEvidenceClass(classes: readonly EvidenceClass[]): EvidenceClass {
+  for (const cls of EVIDENCE_CLASSES) {
+    if (classes.includes(cls)) return cls;
+  }
+  return "agent";
+}
+
+// ---------------------------------------------------------------------------
+// Deterministic post-extraction rules (no LLM; run before the judge)
+// ---------------------------------------------------------------------------
+
+export type EvidenceRuleId =
+  | "numeric_without_tool_evidence"
+  | "user_attribution_without_user_span"
+  | "echo_of_existing_content";
+
+export interface EvidenceRuleFinding {
+  rule: EvidenceRuleId;
+  /** `demote` routes the fact to `pending_review`; `refuse` drops it. */
+  action: "demote" | "refuse";
+  reason: string;
+}
+
+/** Categories that attribute a choice or commitment to the modeled subject. */
+const DECISION_LIKE_CATEGORIES: Record<string, true> = {
+  decision: true,
+  preference: true,
+  commitment: true,
+};
+
+/**
+ * Normalize a quote for echo comparison. Casefold plus whitespace collapse —
+ * the same normalization `locateQuoteOffsets` matches with, via the single
+ * shared normalizer in `whitespace.ts`.
+ */
+export function echoQuoteKey(quote: string): string {
+  return collapseWhitespace(quote.toLowerCase());
+}
+
+/**
+ * Apply the three deterministic evidence rules to one extracted fact.
+ * Pure; findings come back in canonical rule-id order. A fact triggers:
+ *
+ *   1. `numeric_without_tool_evidence` — content carries a digit but no
+ *      `tool`/`action` span backs it. The human and the agent are both
+ *      illicit sources for numbers; demote to review rather than refuse
+ *      (the number may be real — it is just unproven).
+ *   2. `user_attribution_without_user_span` — a decision-like fact about the
+ *      user (absent `subject` reads as `"user"`, mirroring the promotion
+ *      guard's fail-closed default) with no `user` span. This is the
+ *      assertion-loop gate: an agent-asserted "the user decided X" is
+ *      refused, never promoted to active.
+ *   3. `echo_of_existing_content` — every quote backing the fact already
+ *      exists in the store index, so the "evidence" is the store reading
+ *      itself back through a tool result. Refused: not new material.
+ */
+export function applyEvidenceClassRules(input: {
+  content: string;
+  category?: string;
+  subject?: MemorySubject;
+  evidenceClasses?: readonly EvidenceClass[];
+  /** Normalized keys (`echoQuoteKey`) of the fact's surviving quotes. */
+  quoteKeys?: readonly string[];
+  /** Normalized keys of quotes already present in the content-hash index. */
+  existingQuoteKeys?: ReadonlySet<string>;
+}): EvidenceRuleFinding[] {
+  const classes = input.evidenceClasses ?? [];
+  const findings: EvidenceRuleFinding[] = [];
+
+  if (/\d/.test(input.content) && !classes.some((c) => c === "tool" || c === "action")) {
+    findings.push({
+      rule: "numeric_without_tool_evidence",
+      action: "demote",
+      reason: "content carries a number but no tool or action evidence span backs it",
+    });
+  }
+
+  const decisionLike = input.category !== undefined && DECISION_LIKE_CATEGORIES[input.category] === true;
+  const subject = input.subject ?? "user";
+  if (decisionLike && subject === "user" && !classes.includes("user")) {
+    findings.push({
+      rule: "user_attribution_without_user_span",
+      action: "refuse",
+      reason: "decision-like fact about the user with no user-role evidence span",
+    });
+  }
+
+  const quoteKeys = input.quoteKeys ?? [];
+  if (
+    quoteKeys.length > 0
+    && input.existingQuoteKeys !== undefined
+    && quoteKeys.every((key) => input.existingQuoteKeys!.has(key))
+  ) {
+    findings.push({
+      rule: "echo_of_existing_content",
+      action: "refuse",
+      reason: "every evidence quote already exists in the store (echo, not new material)",
+    });
+  }
+
+  return findings;
+}

package/src/index.ts

@@ -49,6 +49,7 @@ export { searchWithGenericExclusion } from "./access-memory-search-fanout.js";
 export * from "./model-registry.js";
 export * from "./contradiction/index.js";
 export * from "./recall-state-view.js";
+export * from "./standing-memory-block.js";
 
 export {
   buildEvidencePack,

package/src/mcp-read-only-tools.ts

@@ -30,6 +30,9 @@ export const MCP_READ_ONLY_TOOL_SUFFIXES: Readonly<Record<string, true>> = {
   deep_recall: true,
   memory_expand: true,
   memory_traverse: true,
+  memory_ls: true,
+  memory_tree: true,
+  memory_find: true,
   standup: true,
   action_confidence: true,
   capsule_list: true,