@remnic/core 9.69.60 → 9.69.61

package/dist/verified-recall.js

@@ -1,16 +1,16 @@
 import {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
-} from "./chunk-OINFRHLR.js";
+} from "./chunk-NRTVZSPO.js";
 import "./chunk-B7RWBZXW.js";
-import "./chunk-2T2RF5ZK.js";
+import "./chunk-5QZHDS4X.js";
 import "./chunk-46WM6JX2.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-D5F7TKMH.js";
-import "./chunk-W6YK672C.js";
-import "./chunk-IAZPYX6W.js";
+import "./chunk-JTTLH646.js";
+import "./chunk-NRVGODSE.js";
 import "./chunk-WPGR3RW4.js";
-import "./chunk-6KTXE6A3.js";
+import "./chunk-Z4TXB4K7.js";
 import "./chunk-D7MAYFQP.js";
 import "./chunk-KVO2BTA4.js";
 import "./chunk-CYEPCZN5.js";
@@ -50,7 +50,7 @@ import "./chunk-ZLQ37WJX.js";
 import "./chunk-IUM3VSHI.js";
 import "./chunk-C64XATK7.js";
 import "./chunk-42JKGUFJ.js";
-import "./chunk-6Q3ZTEF6.js";
+import "./chunk-23G5P7TA.js";
 import "./chunk-ZTHGFTMW.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
@@ -79,7 +79,7 @@ import "./chunk-C7HJ3NEI.js";
 import "./chunk-NB3LRY4T.js";
 import "./chunk-5FVVY2EB.js";
 import "./chunk-FFAZ2XFU.js";
-import "./chunk-FNQEXI3D.js";
+import "./chunk-F5O6WEDO.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-PWPIERBM.js";
 import "./chunk-JDSVLVCG.js";
@@ -87,7 +87,7 @@ import "./chunk-5GKPFL3S.js";
 import "./chunk-JAKIDQB2.js";
 import "./chunk-P7FMDTKL.js";
 import "./chunk-VUFL7X3H.js";
-import "./chunk-JUOZ62Y7.js";
+import "./chunk-BMXEBWBT.js";
 import "./chunk-ZEFVK7XC.js";
 import "./chunk-6KH5NLQS.js";
 import "./chunk-P2QRMMVQ.js";

package/dist/who-knows-cli.js

@@ -4,16 +4,16 @@ import {
   renderWhoKnows,
   renderWhoKnowsJson,
   renderWhoKnowsText
-} from "./chunk-XX2IGMCB.js";
-import "./chunk-NYVECYCF.js";
-import "./chunk-2T2RF5ZK.js";
+} from "./chunk-KV44HTMJ.js";
+import "./chunk-HNOKNHFO.js";
+import "./chunk-5QZHDS4X.js";
 import "./chunk-46WM6JX2.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-D5F7TKMH.js";
-import "./chunk-W6YK672C.js";
-import "./chunk-IAZPYX6W.js";
+import "./chunk-JTTLH646.js";
+import "./chunk-NRVGODSE.js";
 import "./chunk-WPGR3RW4.js";
-import "./chunk-6KTXE6A3.js";
+import "./chunk-Z4TXB4K7.js";
 import "./chunk-D7MAYFQP.js";
 import "./chunk-KVO2BTA4.js";
 import "./chunk-CYEPCZN5.js";
@@ -53,7 +53,7 @@ import "./chunk-ZLQ37WJX.js";
 import "./chunk-IUM3VSHI.js";
 import "./chunk-C64XATK7.js";
 import "./chunk-42JKGUFJ.js";
-import "./chunk-6Q3ZTEF6.js";
+import "./chunk-23G5P7TA.js";
 import "./chunk-ZTHGFTMW.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
@@ -82,7 +82,7 @@ import "./chunk-C7HJ3NEI.js";
 import "./chunk-NB3LRY4T.js";
 import "./chunk-5FVVY2EB.js";
 import "./chunk-FFAZ2XFU.js";
-import "./chunk-FNQEXI3D.js";
+import "./chunk-F5O6WEDO.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-PWPIERBM.js";
 import "./chunk-JDSVLVCG.js";
@@ -90,7 +90,7 @@ import "./chunk-5GKPFL3S.js";
 import "./chunk-JAKIDQB2.js";
 import "./chunk-P7FMDTKL.js";
 import "./chunk-VUFL7X3H.js";
-import "./chunk-JUOZ62Y7.js";
+import "./chunk-BMXEBWBT.js";
 import "./chunk-ZEFVK7XC.js";
 import "./chunk-6KH5NLQS.js";
 import "./chunk-P2QRMMVQ.js";

package/dist/who-knows.js

@@ -9,15 +9,15 @@ import {
   loadWhoKnowsEntities,
   tokenizeTopic,
   validateWhoKnowsInput
-} from "./chunk-NYVECYCF.js";
-import "./chunk-2T2RF5ZK.js";
+} from "./chunk-HNOKNHFO.js";
+import "./chunk-5QZHDS4X.js";
 import "./chunk-46WM6JX2.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-D5F7TKMH.js";
-import "./chunk-W6YK672C.js";
-import "./chunk-IAZPYX6W.js";
+import "./chunk-JTTLH646.js";
+import "./chunk-NRVGODSE.js";
 import "./chunk-WPGR3RW4.js";
-import "./chunk-6KTXE6A3.js";
+import "./chunk-Z4TXB4K7.js";
 import "./chunk-D7MAYFQP.js";
 import "./chunk-KVO2BTA4.js";
 import "./chunk-CYEPCZN5.js";
@@ -57,7 +57,7 @@ import "./chunk-ZLQ37WJX.js";
 import "./chunk-IUM3VSHI.js";
 import "./chunk-C64XATK7.js";
 import "./chunk-42JKGUFJ.js";
-import "./chunk-6Q3ZTEF6.js";
+import "./chunk-23G5P7TA.js";
 import "./chunk-ZTHGFTMW.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
@@ -86,7 +86,7 @@ import "./chunk-C7HJ3NEI.js";
 import "./chunk-NB3LRY4T.js";
 import "./chunk-5FVVY2EB.js";
 import "./chunk-FFAZ2XFU.js";
-import "./chunk-FNQEXI3D.js";
+import "./chunk-F5O6WEDO.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-PWPIERBM.js";
 import "./chunk-JDSVLVCG.js";
@@ -94,7 +94,7 @@ import "./chunk-5GKPFL3S.js";
 import "./chunk-JAKIDQB2.js";
 import "./chunk-P7FMDTKL.js";
 import "./chunk-VUFL7X3H.js";
-import "./chunk-JUOZ62Y7.js";
+import "./chunk-BMXEBWBT.js";
 import "./chunk-ZEFVK7XC.js";
 import "./chunk-6KH5NLQS.js";
 import "./chunk-P2QRMMVQ.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.69.60",
+  "version": "9.69.61",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3307,7 +3307,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.69.60"
+    "@remnic/coding-graph": "^9.69.61"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/buffer-turn-helpers.ts

@@ -58,6 +58,9 @@ export function copyBufferTurn(turn: BufferTurn): BufferTurn {
   if (typeof turn.sourceConnector === "string") {
     copy.sourceConnector = turn.sourceConnector;
   }
+  if (turn.originRole === "user" || turn.originRole === "assistant" || turn.originRole === "tool") {
+    copy.originRole = turn.originRole;
+  }
   if (typeof turn.ambientCapture === "boolean") {
     copy.ambientCapture = turn.ambientCapture;
   }
@@ -77,6 +80,7 @@ export function bufferTurnsEqual(left: BufferTurn | undefined, right: BufferTurn
     left.turnFingerprint === right.turnFingerprint &&
     left.persistProcessedFingerprint === right.persistProcessedFingerprint &&
     left.sourceConnector === right.sourceConnector &&
+    left.originRole === right.originRole &&
     left.ambientCapture === right.ambientCapture
   );
 }

package/src/buffer.ts

@@ -918,6 +918,9 @@ export class SmartBuffer {
             copy.persistProcessedFingerprint = t.persistProcessedFingerprint;
           }
           if (typeof t.sourceConnector === "string") copy.sourceConnector = t.sourceConnector;
+          if (t.originRole === "user" || t.originRole === "assistant" || t.originRole === "tool") {
+            copy.originRole = t.originRole;
+          }
           return copy;
         });
       }

package/src/capabilities.test.ts

@@ -853,7 +853,10 @@ test("resolveLocalLlmCapabilities: result is frozen", () => {
 // SecurityCapabilitySet — gate-parity tests (issue #1523 batch 7).
 // ---------------------------------------------------------------------------
 
-const SECURITY_FIELD_TO_FLAG: Record<keyof SecurityCapabilitySet, string> = {
+// Boolean-flag parity only: `injectionScreenProfile` is an enum projection
+// (#1962), not a gate — its custom->default / named-mode->hardened mapping is
+// pinned in config.test.ts.
+const SECURITY_FIELD_TO_FLAG: Record<Exclude<keyof SecurityCapabilitySet, "injectionScreenProfile">, string> = {
   trustZones: "trustZonesEnabled",
   quarantinePromotion: "quarantinePromotionEnabled",
   memoryPoisoningDefense: "memoryPoisoningDefenseEnabled",

package/src/capabilities.ts

@@ -20,15 +20,12 @@
  * the CapabilitySet itself (rule 30 governs behavior changes; resolving and
  * threading a capability projection must stay behavior-preserving).
  *
- * Flag-retirement audit (#1780, 2026-07-08): all projected fields across 18
- * capability sets were verified for live consumers. Two dead projections found
- * and removed: recallGraph (RecallEnhancementCapabilitySet — production reads
- * recallGraphEnabled directly via graph-recall.ts) and behaviorLoopAutoTune
- * (ConversationContextCapabilitySet — production reads behaviorLoopAutoTuneEnabled
- * directly via cli.ts). The flags themselves remain alive.
+ * Flag-retirement audit (#1780, 2026-07-08): all projected fields verified for
+ * live consumers; dead projections removed.
  */
 
 import type { PluginConfig } from "./types.js";
+import type { InjectionScreenProfile } from "./security/injection-screen.js";
 
 /**
  * Frozen projection of recall-operation feature gates.
@@ -638,6 +635,8 @@ export interface SecurityCapabilitySet {
   readonly originAuthority: boolean;
   /** `injectionScreenEnabled` — quarantine deterministic injection findings. */
   readonly injectionScreen: boolean;
+  /** Injection-screen profile weighting (#1962). */
+  readonly injectionScreenProfile: InjectionScreenProfile;
   /** `trustZoneRecallEnabled` — restrict recall to trusted zones. */
   readonly trustZoneRecall: boolean;
 }
@@ -645,7 +644,7 @@ export interface SecurityCapabilitySet {
 /** Config projection consumed by {@link resolveSecurityCapabilities}. */
 export type SecurityConfigProjection = Pick<PluginConfig,
   | "trustZonesEnabled" | "quarantinePromotionEnabled" | "memoryPoisoningDefenseEnabled"
-  | "originAuthorityEnabled" | "injectionScreenEnabled" | "trustZoneRecallEnabled">;
+  | "originAuthorityEnabled" | "injectionScreenEnabled" | "injectionScreenProfile" | "trustZoneRecallEnabled">;
 
 /** Resolve the {@link SecurityCapabilitySet} from parsed config. */
 export function resolveSecurityCapabilities(config: SecurityConfigProjection): SecurityCapabilitySet {
@@ -655,6 +654,7 @@ export function resolveSecurityCapabilities(config: SecurityConfigProjection): S
     memoryPoisoningDefense: config.memoryPoisoningDefenseEnabled,
     originAuthority: config.originAuthorityEnabled,
     injectionScreen: config.injectionScreenEnabled,
+    injectionScreenProfile: config.injectionScreenProfile,
     trustZoneRecall: config.trustZoneRecallEnabled,
   });
 }

package/src/config-security.ts

@@ -1,6 +1,11 @@
 import { coerceBool } from "./connectors/coerce.js";
 import { readEnvVar } from "./runtime/env.js";
-import { DEFAULT_UNTRUSTED_ORIGINS } from "./security/origin-authority.js";
+import {
+  DEFAULT_UNTRUSTED_ORIGINS,
+  HARDENED_UNTRUSTED_ORIGINS,
+} from "./security/origin-authority.js";
+import type { MemoryInjectionDefenseMode } from "./security/types.js";
+import type { InjectionScreenProfile } from "./security/injection-screen.js";
 
 // Memory-poisoning hardening (#1955): preserve explicit config, but let env
 // values replace schema-materialized defaults from the host config loader.
@@ -103,29 +108,111 @@ function resolveUntrustedOrigins(
   return normalized.length > 0 ? normalized : [...DEFAULT_UNTRUSTED_ORIGINS];
 }
 
+function validateDefenseMode(value: unknown): MemoryInjectionDefenseMode {
+  if (
+    value === "custom"
+    || value === "off"
+    || value === "fencing"
+    || value === "quarantine"
+    || value === "layered"
+  ) {
+    return value;
+  }
+  throw new Error(
+    `memoryInjectionDefenseMode must be custom|off|fencing|quarantine|layered; got ${JSON.stringify(value)}`,
+  );
+}
+
+function isOperatorAuthored(
+  rawOperatorConfig: Record<string, unknown> | null | undefined,
+  key: string,
+): boolean {
+  return rawOperatorConfig !== undefined
+    && rawOperatorConfig !== null
+    && Object.prototype.hasOwnProperty.call(rawOperatorConfig, key)
+    && (rawOperatorConfig as Record<string, unknown>)[key] !== undefined
+    && (rawOperatorConfig as Record<string, unknown>)[key] !== null;
+}
+
+function resolveMemoryInjectionDefenseMode(
+  value: unknown,
+  rawOperatorConfig: Record<string, unknown> | null | undefined,
+): MemoryInjectionDefenseMode {
+  // Precedence: operator-authored config, then the environment, then a
+  // host-materialized schema default. A host that fills in the manifest
+  // default must not shadow an operator's environment override.
+  if (isOperatorAuthored(rawOperatorConfig, "memoryInjectionDefenseMode")) {
+    return validateDefenseMode(
+      (rawOperatorConfig as Record<string, unknown>).memoryInjectionDefenseMode,
+    );
+  }
+  const envValue = readEnvVar("REMNIC_MEMORY_INJECTION_DEFENSE_MODE");
+  if (envValue !== undefined && rawOperatorConfig !== undefined) return validateDefenseMode(envValue);
+  if (value !== undefined && value !== null) return validateDefenseMode(value);
+  if (envValue !== undefined) return validateDefenseMode(envValue);
+  return "custom";
+}
+
+function hasExplicitUntrustedOrigins(
+  cfg: Record<string, unknown>,
+  rawOperatorConfig: Record<string, unknown> | null | undefined,
+): boolean {
+  const configAuthored = rawOperatorConfig === undefined
+    ? Object.prototype.hasOwnProperty.call(cfg, "untrustedOrigins")
+    : rawOperatorConfig !== null
+      && Object.prototype.hasOwnProperty.call(rawOperatorConfig, "untrustedOrigins");
+  return configAuthored || readEnvVar("REMNIC_UNTRUSTED_ORIGINS") !== undefined;
+}
+
 export function parseSecurityConfig(
   cfg: Record<string, unknown>,
   rawOperatorConfig: Record<string, unknown> | null | undefined,
 ): {
+  memoryInjectionDefenseMode: MemoryInjectionDefenseMode;
   originAuthorityEnabled: boolean;
   injectionScreenEnabled: boolean;
+  injectionScreenProfile: InjectionScreenProfile;
   untrustedOrigins: string[];
 } {
+  const memoryInjectionDefenseMode = resolveMemoryInjectionDefenseMode(
+    cfg.memoryInjectionDefenseMode,
+    rawOperatorConfig,
+  );
+  const customOriginAuthority = resolveSecurityBooleanConfig(
+    cfg.originAuthorityEnabled,
+    rawOperatorConfig,
+    "originAuthorityEnabled",
+    "REMNIC_ORIGIN_AUTHORITY_ENABLED",
+    false,
+  );
+  const customInjectionScreen = resolveSecurityBooleanConfig(
+    cfg.injectionScreenEnabled,
+    rawOperatorConfig,
+    "injectionScreenEnabled",
+    "REMNIC_INJECTION_SCREEN_ENABLED",
+    true,
+  );
+  const flags = {
+    custom: [customOriginAuthority, customInjectionScreen],
+    off: [false, false],
+    fencing: [true, false],
+    quarantine: [false, true],
+    layered: [true, true],
+  } satisfies Record<MemoryInjectionDefenseMode, readonly [boolean, boolean]>;
+  const [originAuthorityEnabled, injectionScreenEnabled] = flags[memoryInjectionDefenseMode];
+  const injectionScreenProfile: InjectionScreenProfile =
+    memoryInjectionDefenseMode === "custom" ? "default" : "hardened";
+  const configuredOrigins = resolveUntrustedOrigins(cfg.untrustedOrigins, rawOperatorConfig);
+  const untrustedOrigins =
+    memoryInjectionDefenseMode !== "custom"
+      && !hasExplicitUntrustedOrigins(cfg, rawOperatorConfig)
+      ? [...HARDENED_UNTRUSTED_ORIGINS]
+      : configuredOrigins;
   return {
-    originAuthorityEnabled: resolveSecurityBooleanConfig(
-      cfg.originAuthorityEnabled,
-      rawOperatorConfig,
-      "originAuthorityEnabled",
-      "REMNIC_ORIGIN_AUTHORITY_ENABLED",
-      false,
-    ),
-    injectionScreenEnabled: resolveSecurityBooleanConfig(
-      cfg.injectionScreenEnabled,
-      rawOperatorConfig,
-      "injectionScreenEnabled",
-      "REMNIC_INJECTION_SCREEN_ENABLED",
-      true,
-    ),
-    untrustedOrigins: resolveUntrustedOrigins(cfg.untrustedOrigins, rawOperatorConfig),
+    memoryInjectionDefenseMode,
+    originAuthorityEnabled,
+    injectionScreenEnabled,
+    injectionScreenProfile,
+    untrustedOrigins,
   };
 }

package/src/config.test.ts

@@ -35,14 +35,39 @@ test("parseConfig memory-poisoning hardening defaults and validation (#1955)", (
   const previousOrigin = process.env.REMNIC_ORIGIN_AUTHORITY_ENABLED;
   const previousInjection = process.env.REMNIC_INJECTION_SCREEN_ENABLED;
   const previousOrigins = process.env.REMNIC_UNTRUSTED_ORIGINS;
+  const previousMode = process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE;
   delete process.env.REMNIC_ORIGIN_AUTHORITY_ENABLED;
   delete process.env.REMNIC_INJECTION_SCREEN_ENABLED;
   delete process.env.REMNIC_UNTRUSTED_ORIGINS;
+  delete process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE;
   try {
     const defaults = parseConfig({});
+    assert.equal(defaults.memoryInjectionDefenseMode, "custom");
     assert.equal(defaults.originAuthorityEnabled, false);
     assert.equal(defaults.injectionScreenEnabled, true);
-    assert.deepEqual(defaults.untrustedOrigins, ["tool_output", "import:*", "unknown"]);
+    assert.equal(defaults.injectionScreenProfile, "default");
+
+    for (const [mode, originAuthorityEnabled, injectionScreenEnabled] of [
+      ["off", false, false],
+      ["fencing", true, false],
+      ["quarantine", false, true],
+      ["layered", true, true],
+    ] as const) {
+      const resolved = parseConfig({ memoryInjectionDefenseMode: mode });
+      assert.equal(resolved.memoryInjectionDefenseMode, mode);
+      assert.equal(resolved.originAuthorityEnabled, originAuthorityEnabled);
+      assert.equal(resolved.injectionScreenEnabled, injectionScreenEnabled);
+      assert.equal(resolved.injectionScreenProfile, "hardened");
+      assert.deepEqual(
+        resolved.untrustedOrigins,
+        ["user", "tool_output", "connector:*", "import:*", "unknown"],
+      );
+    }
+    const customizedMode = parseConfig({
+      memoryInjectionDefenseMode: "fencing",
+      untrustedOrigins: ["tool_output"],
+    });
+    assert.deepEqual(customizedMode.untrustedOrigins, ["tool_output"]);
 
     const configured = parseConfig({
       originAuthorityEnabled: "true",
@@ -83,6 +108,10 @@ test("parseConfig memory-poisoning hardening defaults and validation (#1955)", (
       () => parseConfig({ untrustedOrigins: "unknown" }),
       /untrustedOrigins must be an array of strings/,
     );
+    assert.throws(
+      () => parseConfig({ memoryInjectionDefenseMode: "automatic" }),
+      /memoryInjectionDefenseMode must be/,
+    );
   } finally {
     if (previousOrigin === undefined) delete process.env.REMNIC_ORIGIN_AUTHORITY_ENABLED;
     else process.env.REMNIC_ORIGIN_AUTHORITY_ENABLED = previousOrigin;
@@ -90,6 +119,34 @@ test("parseConfig memory-poisoning hardening defaults and validation (#1955)", (
     else process.env.REMNIC_INJECTION_SCREEN_ENABLED = previousInjection;
     if (previousOrigins === undefined) delete process.env.REMNIC_UNTRUSTED_ORIGINS;
     else process.env.REMNIC_UNTRUSTED_ORIGINS = previousOrigins;
+    if (previousMode === undefined) delete process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE;
+    else process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE = previousMode;
+  }
+});
+
+test("parseConfig honors REMNIC_MEMORY_INJECTION_DEFENSE_MODE when the operator omits the field", () => {
+  const previousMode = process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE;
+  delete process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE;
+  try {
+    process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE = "layered";
+    const resolved = parseConfig({});
+    assert.equal(resolved.memoryInjectionDefenseMode, "layered");
+    assert.equal(resolved.originAuthorityEnabled, true);
+    assert.equal(resolved.injectionScreenEnabled, true);
+    assert.equal(resolved.injectionScreenProfile, "hardened");
+    // A host that materializes the manifest default into cfg while the
+    // operator's raw config omits the key must not shadow the env override.
+    const materialized = parseConfig({ memoryInjectionDefenseMode: "custom" }, {});
+    assert.equal(materialized.memoryInjectionDefenseMode, "layered");
+    // An operator-authored value still outranks the environment.
+    const authored = parseConfig(
+      { memoryInjectionDefenseMode: "fencing" },
+      { memoryInjectionDefenseMode: "fencing" },
+    );
+    assert.equal(authored.memoryInjectionDefenseMode, "fencing");
+  } finally {
+    if (previousMode === undefined) delete process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE;
+    else process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE = previousMode;
   }
 });
 

package/src/connector-provenance-lifecycle.test.ts

@@ -13,6 +13,7 @@ import path from "node:path";
 import test from "node:test";
 
 import { SmartBuffer } from "./buffer.js";
+import { bufferTurnsEqual, copyBufferTurn } from "./buffer-turn-helpers.js";
 import {
   ExtractionRunCoordinator,
   type ExtractionRunCoordinatorDeps,
@@ -238,6 +239,7 @@ test("ingestReplayBatch: sourceConnector preserved through replay ingestion", as
         content: "hello from chatgpt",
         timestamp: "2026-07-12T00:00:00Z",
         sourceConnector: "chatgpt",
+        originRole: "tool",
       },
     ]);
 
@@ -247,6 +249,11 @@ test("ingestReplayBatch: sourceConnector preserved through replay ingestion", as
       "chatgpt",
       "ingestReplayBatch must preserve sourceConnector on rebuilt BufferTurn"
     );
+    assert.equal(
+      capturedTurns[0].originRole,
+      "tool",
+      "ingestReplayBatch must preserve the authenticated originRole so origin authority fences tool content"
+    );
   } finally {
     StorageManager.clearAllStaticCaches();
     await rm(baseDir, { recursive: true, force: true });
@@ -699,3 +706,15 @@ test("runExtraction: the Source agent header connector equals the persisted sour
     await rm(baseDir, { recursive: true, force: true });
   }
 });
+
+test("copyBufferTurn and bufferTurnsEqual carry originRole", () => {
+  const turn = makeTurn({ content: "tool output", originRole: "tool" });
+  const copy = copyBufferTurn(turn);
+  assert.equal(copy.originRole, "tool", "extraction snapshots must keep the authenticated origin role");
+  assert.equal(bufferTurnsEqual(copy, turn), true);
+  assert.equal(
+    bufferTurnsEqual(copy, makeTurn({ content: "tool output", originRole: "user" })),
+    false,
+    "a turn re-attributed to another origin is not the same turn",
+  );
+});

package/src/index.ts

@@ -387,8 +387,8 @@ export {
   type TrustZoneRecordKind,
   type TrustZoneSourceClass,
 } from "./trust-zones.js";
-export { DEFAULT_UNTRUSTED_ORIGINS, classifyOrigin, isUntrustedOrigin, parseOriginClass, renderAuthorityFence, type OriginClass } from "./security/origin-authority.js";
-export { INJECTION_SCREEN_THRESHOLD, screenCandidateFact, type InjectionScreenFinding, type InjectionScreenResult } from "./security/injection-screen.js";
+export { DEFAULT_UNTRUSTED_ORIGINS, HARDENED_UNTRUSTED_ORIGINS, classifyOrigin, isUntrustedOrigin, parseOriginClass, renderAuthorityFence, type MemoryInjectionDefenseMode, type OriginClass } from "./security/origin-authority.js";
+export { INJECTION_SCREEN_THRESHOLD, screenCandidateFact, type InjectionScreenFinding, type InjectionScreenProfile, type InjectionScreenResult } from "./security/injection-screen.js";
 export { auditMemoryStore, formatAuditMemoryReport, type AuditMemoryReport } from "./security/audit-memory.js";
 // Access layer (HTTP + MCP + schema validation)
 // ---------------------------------------------------------------------------

package/src/orchestration/extraction-injection-gate.ts

@@ -2,6 +2,7 @@ import { parseOriginClass } from "../security/origin-authority.js";
 import { normalizeAttributePairs } from "../structured-attributes.js";
 import { buildProcedurePersistBody } from "../procedural/procedure-types.js";
 import { screenCandidateFact } from "../security/injection-screen.js";
+import type { InjectionScreenProfile } from "../security/injection-screen.js";
 import type { EntityStructuredSection } from "../types.js";
 
 export interface InjectionScreenCandidate {
@@ -41,11 +42,12 @@ export function serializeInjectionScreenCandidate(candidate: InjectionScreenCand
 export function evaluateInjectionScreen(
   candidate: InjectionScreenCandidate | string,
   enabled: boolean,
+  profile: InjectionScreenProfile = "default",
 ): InjectionScreenGateResult {
   if (!enabled) return { tags: [] };
   const content =
     typeof candidate === "string" ? candidate : serializeInjectionScreenCandidate(candidate);
-  const result = screenCandidateFact(content);
+  const result = screenCandidateFact(content, profile);
   return {
     status: result.quarantine === true ? "pending_review" : undefined,
     tags: result.quarantine === true
@@ -63,6 +65,7 @@ export function evaluateInjectionScreen(
 export function withholdScreenedStrings(
   values: readonly unknown[],
   enabled: boolean,
+  profile: InjectionScreenProfile = "default",
 ): { kept: string[]; withheldRules: string[] } {
   const kept: string[] = [];
   const withheldRules: string[] = [];
@@ -72,7 +75,7 @@ export function withholdScreenedStrings(
       kept.push(value);
       continue;
     }
-    const screened = screenCandidateFact(value);
+    const screened = screenCandidateFact(value, profile);
     if (screened.quarantine) {
       withheldRules.push(...screened.findings.map((finding) => `injection-screen:${finding.rule}`));
     } else {
@@ -99,20 +102,20 @@ export interface ScreenedEntityWrite {
  * `withheldRules` (entities carry no review status; routing is #2397).
  * Returns null for entities without a usable name/type.
  */
-export function screenEntityForIndex(entity: unknown, enabled: boolean): ScreenedEntityWrite | null {
+export function screenEntityForIndex(entity: unknown, enabled: boolean, profile: InjectionScreenProfile = "default"): ScreenedEntityWrite | null {
   const record = entity as { name?: unknown; type?: unknown; source?: unknown; facts?: unknown; structuredSections?: unknown } | null;
   const name = record?.name;
   const type = record?.type;
   if (typeof name !== "string" || !name.trim() || typeof type !== "string" || !type.trim()) return null;
   // #1955 review: the raw name is emitted as the entity target outside the
   // snippet fence — a flagged name withholds the whole entity from the index.
-  const nameScreen = withholdScreenedStrings([name], enabled);
-  const factScreen = withholdScreenedStrings(Array.isArray(record?.facts) ? record.facts : [], enabled);
+  const nameScreen = withholdScreenedStrings([name], enabled, profile);
+  const factScreen = withholdScreenedStrings(Array.isArray(record?.facts) ? record.facts : [], enabled, profile);
   const rawSections: EntityStructuredSection[] | undefined = Array.isArray(record?.structuredSections)
     ? (record.structuredSections as EntityStructuredSection[])
     : undefined;
   const sectionScreens = enabled && rawSections
-    ? rawSections.map((section) => ({ section, screen: withholdScreenedStrings(section?.facts ?? [], true) }))
+    ? rawSections.map((section) => ({ section, screen: withholdScreenedStrings(section?.facts ?? [], true, profile) }))
     : undefined;
   return {
     name,
@@ -155,8 +158,9 @@ export function screenEntityForIndex(entity: unknown, enabled: boolean): Screene
 export function screenPersistStrings(
   values: readonly string[],
   enabled: boolean,
+  profile: InjectionScreenProfile = "default",
 ): { kept: string[]; warning?: string } {
-  const screen = withholdScreenedStrings(values, enabled);
+  const screen = withholdScreenedStrings(values, enabled, profile);
   return {
     kept: screen.kept,
     ...(screen.withheldRules.length > 0

package/src/orchestration/extraction-origin-context.ts

@@ -20,7 +20,7 @@ export function deriveExtractionOriginContext(
   targetTurns: readonly BufferTurn[],
   fallbackConnector?: string,
 ): Pick<ExtractionSourceContext, "turnRole" | "importAdapter" | "sourceConnector" | "originConflict"> {
-  const originRoles = new Set(targetTurns.map((turn) => turn.role));
+  const originRoles = new Set(targetTurns.map((turn) => turn.originRole ?? turn.role));
   const turnRole = originRoles.size === 1 ? [...originRoles][0] : undefined;
   const originConnectors = new Set(
     targetTurns