@remnic/core 9.69.60 → 9.69.63

package/dist/verified-recall.js

@@ -1,16 +1,16 @@
 import {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
-} from "./chunk-OINFRHLR.js";
+} from "./chunk-NRTVZSPO.js";
 import "./chunk-B7RWBZXW.js";
-import "./chunk-2T2RF5ZK.js";
+import "./chunk-5QZHDS4X.js";
 import "./chunk-46WM6JX2.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-D5F7TKMH.js";
-import "./chunk-W6YK672C.js";
-import "./chunk-IAZPYX6W.js";
+import "./chunk-JTTLH646.js";
+import "./chunk-NRVGODSE.js";
 import "./chunk-WPGR3RW4.js";
-import "./chunk-6KTXE6A3.js";
+import "./chunk-Z4TXB4K7.js";
 import "./chunk-D7MAYFQP.js";
 import "./chunk-KVO2BTA4.js";
 import "./chunk-CYEPCZN5.js";
@@ -50,7 +50,7 @@ import "./chunk-ZLQ37WJX.js";
 import "./chunk-IUM3VSHI.js";
 import "./chunk-C64XATK7.js";
 import "./chunk-42JKGUFJ.js";
-import "./chunk-6Q3ZTEF6.js";
+import "./chunk-23G5P7TA.js";
 import "./chunk-ZTHGFTMW.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
@@ -79,7 +79,7 @@ import "./chunk-C7HJ3NEI.js";
 import "./chunk-NB3LRY4T.js";
 import "./chunk-5FVVY2EB.js";
 import "./chunk-FFAZ2XFU.js";
-import "./chunk-FNQEXI3D.js";
+import "./chunk-F5O6WEDO.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-PWPIERBM.js";
 import "./chunk-JDSVLVCG.js";
@@ -87,7 +87,7 @@ import "./chunk-5GKPFL3S.js";
 import "./chunk-JAKIDQB2.js";
 import "./chunk-P7FMDTKL.js";
 import "./chunk-VUFL7X3H.js";
-import "./chunk-JUOZ62Y7.js";
+import "./chunk-BMXEBWBT.js";
 import "./chunk-ZEFVK7XC.js";
 import "./chunk-6KH5NLQS.js";
 import "./chunk-P2QRMMVQ.js";

package/dist/who-knows-cli.js

@@ -4,16 +4,16 @@ import {
   renderWhoKnows,
   renderWhoKnowsJson,
   renderWhoKnowsText
-} from "./chunk-XX2IGMCB.js";
-import "./chunk-NYVECYCF.js";
-import "./chunk-2T2RF5ZK.js";
+} from "./chunk-KV44HTMJ.js";
+import "./chunk-HNOKNHFO.js";
+import "./chunk-5QZHDS4X.js";
 import "./chunk-46WM6JX2.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-D5F7TKMH.js";
-import "./chunk-W6YK672C.js";
-import "./chunk-IAZPYX6W.js";
+import "./chunk-JTTLH646.js";
+import "./chunk-NRVGODSE.js";
 import "./chunk-WPGR3RW4.js";
-import "./chunk-6KTXE6A3.js";
+import "./chunk-Z4TXB4K7.js";
 import "./chunk-D7MAYFQP.js";
 import "./chunk-KVO2BTA4.js";
 import "./chunk-CYEPCZN5.js";
@@ -53,7 +53,7 @@ import "./chunk-ZLQ37WJX.js";
 import "./chunk-IUM3VSHI.js";
 import "./chunk-C64XATK7.js";
 import "./chunk-42JKGUFJ.js";
-import "./chunk-6Q3ZTEF6.js";
+import "./chunk-23G5P7TA.js";
 import "./chunk-ZTHGFTMW.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
@@ -82,7 +82,7 @@ import "./chunk-C7HJ3NEI.js";
 import "./chunk-NB3LRY4T.js";
 import "./chunk-5FVVY2EB.js";
 import "./chunk-FFAZ2XFU.js";
-import "./chunk-FNQEXI3D.js";
+import "./chunk-F5O6WEDO.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-PWPIERBM.js";
 import "./chunk-JDSVLVCG.js";
@@ -90,7 +90,7 @@ import "./chunk-5GKPFL3S.js";
 import "./chunk-JAKIDQB2.js";
 import "./chunk-P7FMDTKL.js";
 import "./chunk-VUFL7X3H.js";
-import "./chunk-JUOZ62Y7.js";
+import "./chunk-BMXEBWBT.js";
 import "./chunk-ZEFVK7XC.js";
 import "./chunk-6KH5NLQS.js";
 import "./chunk-P2QRMMVQ.js";

package/dist/who-knows.js

@@ -9,15 +9,15 @@ import {
   loadWhoKnowsEntities,
   tokenizeTopic,
   validateWhoKnowsInput
-} from "./chunk-NYVECYCF.js";
-import "./chunk-2T2RF5ZK.js";
+} from "./chunk-HNOKNHFO.js";
+import "./chunk-5QZHDS4X.js";
 import "./chunk-46WM6JX2.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-D5F7TKMH.js";
-import "./chunk-W6YK672C.js";
-import "./chunk-IAZPYX6W.js";
+import "./chunk-JTTLH646.js";
+import "./chunk-NRVGODSE.js";
 import "./chunk-WPGR3RW4.js";
-import "./chunk-6KTXE6A3.js";
+import "./chunk-Z4TXB4K7.js";
 import "./chunk-D7MAYFQP.js";
 import "./chunk-KVO2BTA4.js";
 import "./chunk-CYEPCZN5.js";
@@ -57,7 +57,7 @@ import "./chunk-ZLQ37WJX.js";
 import "./chunk-IUM3VSHI.js";
 import "./chunk-C64XATK7.js";
 import "./chunk-42JKGUFJ.js";
-import "./chunk-6Q3ZTEF6.js";
+import "./chunk-23G5P7TA.js";
 import "./chunk-ZTHGFTMW.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
@@ -86,7 +86,7 @@ import "./chunk-C7HJ3NEI.js";
 import "./chunk-NB3LRY4T.js";
 import "./chunk-5FVVY2EB.js";
 import "./chunk-FFAZ2XFU.js";
-import "./chunk-FNQEXI3D.js";
+import "./chunk-F5O6WEDO.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-PWPIERBM.js";
 import "./chunk-JDSVLVCG.js";
@@ -94,7 +94,7 @@ import "./chunk-5GKPFL3S.js";
 import "./chunk-JAKIDQB2.js";
 import "./chunk-P7FMDTKL.js";
 import "./chunk-VUFL7X3H.js";
-import "./chunk-JUOZ62Y7.js";
+import "./chunk-BMXEBWBT.js";
 import "./chunk-ZEFVK7XC.js";
 import "./chunk-6KH5NLQS.js";
 import "./chunk-P2QRMMVQ.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.69.60",
+  "version": "9.69.63",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -2620,6 +2620,16 @@
       "remnic-source": "./src/session-integrity.ts",
       "import": "./dist/session-integrity.js"
     },
+    "./recall-handles": {
+      "types": "./dist/recall-handles.d.ts",
+      "remnic-source": "./src/recall-handles.ts",
+      "import": "./dist/recall-handles.js"
+    },
+    "./recall-handles.js": {
+      "types": "./dist/recall-handles.d.ts",
+      "remnic-source": "./src/recall-handles.ts",
+      "import": "./dist/recall-handles.js"
+    },
     "./session-namespace-bindings": {
       "types": "./dist/session-namespace-bindings.d.ts",
       "remnic-source": "./src/session-namespace-bindings.ts",
@@ -3307,7 +3317,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.69.60"
+    "@remnic/coding-graph": "^9.69.63"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/buffer-turn-helpers.ts

@@ -58,6 +58,9 @@ export function copyBufferTurn(turn: BufferTurn): BufferTurn {
   if (typeof turn.sourceConnector === "string") {
     copy.sourceConnector = turn.sourceConnector;
   }
+  if (turn.originRole === "user" || turn.originRole === "assistant" || turn.originRole === "tool") {
+    copy.originRole = turn.originRole;
+  }
   if (typeof turn.ambientCapture === "boolean") {
     copy.ambientCapture = turn.ambientCapture;
   }
@@ -77,6 +80,7 @@ export function bufferTurnsEqual(left: BufferTurn | undefined, right: BufferTurn
     left.turnFingerprint === right.turnFingerprint &&
     left.persistProcessedFingerprint === right.persistProcessedFingerprint &&
     left.sourceConnector === right.sourceConnector &&
+    left.originRole === right.originRole &&
     left.ambientCapture === right.ambientCapture
   );
 }

package/src/buffer.ts

@@ -918,6 +918,9 @@ export class SmartBuffer {
             copy.persistProcessedFingerprint = t.persistProcessedFingerprint;
           }
           if (typeof t.sourceConnector === "string") copy.sourceConnector = t.sourceConnector;
+          if (t.originRole === "user" || t.originRole === "assistant" || t.originRole === "tool") {
+            copy.originRole = t.originRole;
+          }
           return copy;
         });
       }

package/src/capabilities.test.ts

@@ -853,7 +853,10 @@ test("resolveLocalLlmCapabilities: result is frozen", () => {
 // SecurityCapabilitySet — gate-parity tests (issue #1523 batch 7).
 // ---------------------------------------------------------------------------
 
-const SECURITY_FIELD_TO_FLAG: Record<keyof SecurityCapabilitySet, string> = {
+// Boolean-flag parity only: `injectionScreenProfile` is an enum projection
+// (#1962), not a gate — its custom->default / named-mode->hardened mapping is
+// pinned in config.test.ts.
+const SECURITY_FIELD_TO_FLAG: Record<Exclude<keyof SecurityCapabilitySet, "injectionScreenProfile">, string> = {
   trustZones: "trustZonesEnabled",
   quarantinePromotion: "quarantinePromotionEnabled",
   memoryPoisoningDefense: "memoryPoisoningDefenseEnabled",

package/src/capabilities.ts

@@ -20,15 +20,12 @@
  * the CapabilitySet itself (rule 30 governs behavior changes; resolving and
  * threading a capability projection must stay behavior-preserving).
  *
- * Flag-retirement audit (#1780, 2026-07-08): all projected fields across 18
- * capability sets were verified for live consumers. Two dead projections found
- * and removed: recallGraph (RecallEnhancementCapabilitySet — production reads
- * recallGraphEnabled directly via graph-recall.ts) and behaviorLoopAutoTune
- * (ConversationContextCapabilitySet — production reads behaviorLoopAutoTuneEnabled
- * directly via cli.ts). The flags themselves remain alive.
+ * Flag-retirement audit (#1780, 2026-07-08): all projected fields verified for
+ * live consumers; dead projections removed.
  */
 
 import type { PluginConfig } from "./types.js";
+import type { InjectionScreenProfile } from "./security/injection-screen.js";
 
 /**
  * Frozen projection of recall-operation feature gates.
@@ -638,6 +635,8 @@ export interface SecurityCapabilitySet {
   readonly originAuthority: boolean;
   /** `injectionScreenEnabled` — quarantine deterministic injection findings. */
   readonly injectionScreen: boolean;
+  /** Injection-screen profile weighting (#1962). */
+  readonly injectionScreenProfile: InjectionScreenProfile;
   /** `trustZoneRecallEnabled` — restrict recall to trusted zones. */
   readonly trustZoneRecall: boolean;
 }
@@ -645,7 +644,7 @@ export interface SecurityCapabilitySet {
 /** Config projection consumed by {@link resolveSecurityCapabilities}. */
 export type SecurityConfigProjection = Pick<PluginConfig,
   | "trustZonesEnabled" | "quarantinePromotionEnabled" | "memoryPoisoningDefenseEnabled"
-  | "originAuthorityEnabled" | "injectionScreenEnabled" | "trustZoneRecallEnabled">;
+  | "originAuthorityEnabled" | "injectionScreenEnabled" | "injectionScreenProfile" | "trustZoneRecallEnabled">;
 
 /** Resolve the {@link SecurityCapabilitySet} from parsed config. */
 export function resolveSecurityCapabilities(config: SecurityConfigProjection): SecurityCapabilitySet {
@@ -655,6 +654,7 @@ export function resolveSecurityCapabilities(config: SecurityConfigProjection): S
     memoryPoisoningDefense: config.memoryPoisoningDefenseEnabled,
     originAuthority: config.originAuthorityEnabled,
     injectionScreen: config.injectionScreenEnabled,
+    injectionScreenProfile: config.injectionScreenProfile,
     trustZoneRecall: config.trustZoneRecallEnabled,
   });
 }

package/src/config-security.ts

@@ -1,6 +1,11 @@
 import { coerceBool } from "./connectors/coerce.js";
 import { readEnvVar } from "./runtime/env.js";
-import { DEFAULT_UNTRUSTED_ORIGINS } from "./security/origin-authority.js";
+import {
+  DEFAULT_UNTRUSTED_ORIGINS,
+  HARDENED_UNTRUSTED_ORIGINS,
+} from "./security/origin-authority.js";
+import type { MemoryInjectionDefenseMode } from "./security/types.js";
+import type { InjectionScreenProfile } from "./security/injection-screen.js";
 
 // Memory-poisoning hardening (#1955): preserve explicit config, but let env
 // values replace schema-materialized defaults from the host config loader.
@@ -103,29 +108,111 @@ function resolveUntrustedOrigins(
   return normalized.length > 0 ? normalized : [...DEFAULT_UNTRUSTED_ORIGINS];
 }
 
+function validateDefenseMode(value: unknown): MemoryInjectionDefenseMode {
+  if (
+    value === "custom"
+    || value === "off"
+    || value === "fencing"
+    || value === "quarantine"
+    || value === "layered"
+  ) {
+    return value;
+  }
+  throw new Error(
+    `memoryInjectionDefenseMode must be custom|off|fencing|quarantine|layered; got ${JSON.stringify(value)}`,
+  );
+}
+
+function isOperatorAuthored(
+  rawOperatorConfig: Record<string, unknown> | null | undefined,
+  key: string,
+): boolean {
+  return rawOperatorConfig !== undefined
+    && rawOperatorConfig !== null
+    && Object.prototype.hasOwnProperty.call(rawOperatorConfig, key)
+    && (rawOperatorConfig as Record<string, unknown>)[key] !== undefined
+    && (rawOperatorConfig as Record<string, unknown>)[key] !== null;
+}
+
+function resolveMemoryInjectionDefenseMode(
+  value: unknown,
+  rawOperatorConfig: Record<string, unknown> | null | undefined,
+): MemoryInjectionDefenseMode {
+  // Precedence: operator-authored config, then the environment, then a
+  // host-materialized schema default. A host that fills in the manifest
+  // default must not shadow an operator's environment override.
+  if (isOperatorAuthored(rawOperatorConfig, "memoryInjectionDefenseMode")) {
+    return validateDefenseMode(
+      (rawOperatorConfig as Record<string, unknown>).memoryInjectionDefenseMode,
+    );
+  }
+  const envValue = readEnvVar("REMNIC_MEMORY_INJECTION_DEFENSE_MODE");
+  if (envValue !== undefined && rawOperatorConfig !== undefined) return validateDefenseMode(envValue);
+  if (value !== undefined && value !== null) return validateDefenseMode(value);
+  if (envValue !== undefined) return validateDefenseMode(envValue);
+  return "custom";
+}
+
+function hasExplicitUntrustedOrigins(
+  cfg: Record<string, unknown>,
+  rawOperatorConfig: Record<string, unknown> | null | undefined,
+): boolean {
+  const configAuthored = rawOperatorConfig === undefined
+    ? Object.prototype.hasOwnProperty.call(cfg, "untrustedOrigins")
+    : rawOperatorConfig !== null
+      && Object.prototype.hasOwnProperty.call(rawOperatorConfig, "untrustedOrigins");
+  return configAuthored || readEnvVar("REMNIC_UNTRUSTED_ORIGINS") !== undefined;
+}
+
 export function parseSecurityConfig(
   cfg: Record<string, unknown>,
   rawOperatorConfig: Record<string, unknown> | null | undefined,
 ): {
+  memoryInjectionDefenseMode: MemoryInjectionDefenseMode;
   originAuthorityEnabled: boolean;
   injectionScreenEnabled: boolean;
+  injectionScreenProfile: InjectionScreenProfile;
   untrustedOrigins: string[];
 } {
+  const memoryInjectionDefenseMode = resolveMemoryInjectionDefenseMode(
+    cfg.memoryInjectionDefenseMode,
+    rawOperatorConfig,
+  );
+  const customOriginAuthority = resolveSecurityBooleanConfig(
+    cfg.originAuthorityEnabled,
+    rawOperatorConfig,
+    "originAuthorityEnabled",
+    "REMNIC_ORIGIN_AUTHORITY_ENABLED",
+    false,
+  );
+  const customInjectionScreen = resolveSecurityBooleanConfig(
+    cfg.injectionScreenEnabled,
+    rawOperatorConfig,
+    "injectionScreenEnabled",
+    "REMNIC_INJECTION_SCREEN_ENABLED",
+    true,
+  );
+  const flags = {
+    custom: [customOriginAuthority, customInjectionScreen],
+    off: [false, false],
+    fencing: [true, false],
+    quarantine: [false, true],
+    layered: [true, true],
+  } satisfies Record<MemoryInjectionDefenseMode, readonly [boolean, boolean]>;
+  const [originAuthorityEnabled, injectionScreenEnabled] = flags[memoryInjectionDefenseMode];
+  const injectionScreenProfile: InjectionScreenProfile =
+    memoryInjectionDefenseMode === "custom" ? "default" : "hardened";
+  const configuredOrigins = resolveUntrustedOrigins(cfg.untrustedOrigins, rawOperatorConfig);
+  const untrustedOrigins =
+    memoryInjectionDefenseMode !== "custom"
+      && !hasExplicitUntrustedOrigins(cfg, rawOperatorConfig)
+      ? [...HARDENED_UNTRUSTED_ORIGINS]
+      : configuredOrigins;
   return {
-    originAuthorityEnabled: resolveSecurityBooleanConfig(
-      cfg.originAuthorityEnabled,
-      rawOperatorConfig,
-      "originAuthorityEnabled",
-      "REMNIC_ORIGIN_AUTHORITY_ENABLED",
-      false,
-    ),
-    injectionScreenEnabled: resolveSecurityBooleanConfig(
-      cfg.injectionScreenEnabled,
-      rawOperatorConfig,
-      "injectionScreenEnabled",
-      "REMNIC_INJECTION_SCREEN_ENABLED",
-      true,
-    ),
-    untrustedOrigins: resolveUntrustedOrigins(cfg.untrustedOrigins, rawOperatorConfig),
+    memoryInjectionDefenseMode,
+    originAuthorityEnabled,
+    injectionScreenEnabled,
+    injectionScreenProfile,
+    untrustedOrigins,
   };
 }

package/src/config.test.ts

@@ -35,14 +35,39 @@ test("parseConfig memory-poisoning hardening defaults and validation (#1955)", (
   const previousOrigin = process.env.REMNIC_ORIGIN_AUTHORITY_ENABLED;
   const previousInjection = process.env.REMNIC_INJECTION_SCREEN_ENABLED;
   const previousOrigins = process.env.REMNIC_UNTRUSTED_ORIGINS;
+  const previousMode = process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE;
   delete process.env.REMNIC_ORIGIN_AUTHORITY_ENABLED;
   delete process.env.REMNIC_INJECTION_SCREEN_ENABLED;
   delete process.env.REMNIC_UNTRUSTED_ORIGINS;
+  delete process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE;
   try {
     const defaults = parseConfig({});
+    assert.equal(defaults.memoryInjectionDefenseMode, "custom");
     assert.equal(defaults.originAuthorityEnabled, false);
     assert.equal(defaults.injectionScreenEnabled, true);
-    assert.deepEqual(defaults.untrustedOrigins, ["tool_output", "import:*", "unknown"]);
+    assert.equal(defaults.injectionScreenProfile, "default");
+
+    for (const [mode, originAuthorityEnabled, injectionScreenEnabled] of [
+      ["off", false, false],
+      ["fencing", true, false],
+      ["quarantine", false, true],
+      ["layered", true, true],
+    ] as const) {
+      const resolved = parseConfig({ memoryInjectionDefenseMode: mode });
+      assert.equal(resolved.memoryInjectionDefenseMode, mode);
+      assert.equal(resolved.originAuthorityEnabled, originAuthorityEnabled);
+      assert.equal(resolved.injectionScreenEnabled, injectionScreenEnabled);
+      assert.equal(resolved.injectionScreenProfile, "hardened");
+      assert.deepEqual(
+        resolved.untrustedOrigins,
+        ["user", "tool_output", "connector:*", "import:*", "unknown"],
+      );
+    }
+    const customizedMode = parseConfig({
+      memoryInjectionDefenseMode: "fencing",
+      untrustedOrigins: ["tool_output"],
+    });
+    assert.deepEqual(customizedMode.untrustedOrigins, ["tool_output"]);
 
     const configured = parseConfig({
       originAuthorityEnabled: "true",
@@ -83,6 +108,10 @@ test("parseConfig memory-poisoning hardening defaults and validation (#1955)", (
       () => parseConfig({ untrustedOrigins: "unknown" }),
       /untrustedOrigins must be an array of strings/,
     );
+    assert.throws(
+      () => parseConfig({ memoryInjectionDefenseMode: "automatic" }),
+      /memoryInjectionDefenseMode must be/,
+    );
   } finally {
     if (previousOrigin === undefined) delete process.env.REMNIC_ORIGIN_AUTHORITY_ENABLED;
     else process.env.REMNIC_ORIGIN_AUTHORITY_ENABLED = previousOrigin;
@@ -90,6 +119,34 @@ test("parseConfig memory-poisoning hardening defaults and validation (#1955)", (
     else process.env.REMNIC_INJECTION_SCREEN_ENABLED = previousInjection;
     if (previousOrigins === undefined) delete process.env.REMNIC_UNTRUSTED_ORIGINS;
     else process.env.REMNIC_UNTRUSTED_ORIGINS = previousOrigins;
+    if (previousMode === undefined) delete process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE;
+    else process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE = previousMode;
+  }
+});
+
+test("parseConfig honors REMNIC_MEMORY_INJECTION_DEFENSE_MODE when the operator omits the field", () => {
+  const previousMode = process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE;
+  delete process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE;
+  try {
+    process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE = "layered";
+    const resolved = parseConfig({});
+    assert.equal(resolved.memoryInjectionDefenseMode, "layered");
+    assert.equal(resolved.originAuthorityEnabled, true);
+    assert.equal(resolved.injectionScreenEnabled, true);
+    assert.equal(resolved.injectionScreenProfile, "hardened");
+    // A host that materializes the manifest default into cfg while the
+    // operator's raw config omits the key must not shadow the env override.
+    const materialized = parseConfig({ memoryInjectionDefenseMode: "custom" }, {});
+    assert.equal(materialized.memoryInjectionDefenseMode, "layered");
+    // An operator-authored value still outranks the environment.
+    const authored = parseConfig(
+      { memoryInjectionDefenseMode: "fencing" },
+      { memoryInjectionDefenseMode: "fencing" },
+    );
+    assert.equal(authored.memoryInjectionDefenseMode, "fencing");
+  } finally {
+    if (previousMode === undefined) delete process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE;
+    else process.env.REMNIC_MEMORY_INJECTION_DEFENSE_MODE = previousMode;
   }
 });
 

package/src/connector-provenance-lifecycle.test.ts

@@ -13,6 +13,7 @@ import path from "node:path";
 import test from "node:test";
 
 import { SmartBuffer } from "./buffer.js";
+import { bufferTurnsEqual, copyBufferTurn } from "./buffer-turn-helpers.js";
 import {
   ExtractionRunCoordinator,
   type ExtractionRunCoordinatorDeps,
@@ -238,6 +239,7 @@ test("ingestReplayBatch: sourceConnector preserved through replay ingestion", as
         content: "hello from chatgpt",
         timestamp: "2026-07-12T00:00:00Z",
         sourceConnector: "chatgpt",
+        originRole: "tool",
       },
     ]);
 
@@ -247,6 +249,11 @@ test("ingestReplayBatch: sourceConnector preserved through replay ingestion", as
       "chatgpt",
       "ingestReplayBatch must preserve sourceConnector on rebuilt BufferTurn"
     );
+    assert.equal(
+      capturedTurns[0].originRole,
+      "tool",
+      "ingestReplayBatch must preserve the authenticated originRole so origin authority fences tool content"
+    );
   } finally {
     StorageManager.clearAllStaticCaches();
     await rm(baseDir, { recursive: true, force: true });
@@ -699,3 +706,15 @@ test("runExtraction: the Source agent header connector equals the persisted sour
     await rm(baseDir, { recursive: true, force: true });
   }
 });
+
+test("copyBufferTurn and bufferTurnsEqual carry originRole", () => {
+  const turn = makeTurn({ content: "tool output", originRole: "tool" });
+  const copy = copyBufferTurn(turn);
+  assert.equal(copy.originRole, "tool", "extraction snapshots must keep the authenticated origin role");
+  assert.equal(bufferTurnsEqual(copy, turn), true);
+  assert.equal(
+    bufferTurnsEqual(copy, makeTurn({ content: "tool output", originRole: "user" })),
+    false,
+    "a turn re-attributed to another origin is not the same turn",
+  );
+});

package/src/index.ts

@@ -387,9 +387,9 @@ export {
   type TrustZoneRecordKind,
   type TrustZoneSourceClass,
 } from "./trust-zones.js";
-export { DEFAULT_UNTRUSTED_ORIGINS, classifyOrigin, isUntrustedOrigin, parseOriginClass, renderAuthorityFence, type OriginClass } from "./security/origin-authority.js";
-export { INJECTION_SCREEN_THRESHOLD, screenCandidateFact, type InjectionScreenFinding, type InjectionScreenResult } from "./security/injection-screen.js";
-export { auditMemoryStore, formatAuditMemoryReport, type AuditMemoryReport } from "./security/audit-memory.js";
+export { DEFAULT_UNTRUSTED_ORIGINS, HARDENED_UNTRUSTED_ORIGINS, classifyOrigin, isUntrustedOrigin, parseOriginClass, renderAuthorityFence, type MemoryInjectionDefenseMode, type OriginClass } from "./security/origin-authority.js";
+export { INJECTION_SCREEN_THRESHOLD, screenCandidateFact, type InjectionScreenFinding, type InjectionScreenProfile, type InjectionScreenResult } from "./security/injection-screen.js";
+export { auditMemoryStore, auditScreenProfile, formatAuditMemoryReport, type AuditMemoryReport } from "./security/audit-memory.js";
 // Access layer (HTTP + MCP + schema validation)
 // ---------------------------------------------------------------------------
 

package/src/model-registry.test.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdtempSync, rmSync } from "node:fs";
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
@@ -36,3 +36,24 @@ test("calculateContextSizes ignores invalid or tiny override values before budge
     rmSync(dir, { recursive: true, force: true });
   }
 });
+
+test("construction never creates the registry dir; the first save does", () => {
+  const dir = mkdtempSync(join(tmpdir(), "remnic-model-registry-"));
+  const registryDir = join(dir, ".registry");
+  try {
+    const registry = new ModelRegistry(dir);
+    // Constructing a registry happens on every plugin registration, including
+    // read-only discovery passes, so it must not touch the memory dir.
+    assert.equal(existsSync(registryDir), false, "no dir before anything is cached");
+    registry.setCapabilities("local-model", {
+      maxPositionEmbeddings: 32_768,
+      contextWindow: 32_768,
+      supportsExtendedContext: false,
+      typicalOutputTokens: 2_048,
+      source: "manual",
+    });
+    assert.equal(existsSync(registryDir), true, "the first cached model creates it");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

package/src/model-registry.ts

@@ -5,7 +5,7 @@
 
 import { log } from "./logger.js";
 import fs from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
 export interface ModelCapabilities {
   modelId: string;
@@ -116,11 +116,7 @@ export class ModelRegistry {
   private readonly CACHE_TTL_DAYS = 7;
 
   constructor(memoryDir: string) {
-    const registryDir = join(memoryDir, ".registry");
-    if (!fs.existsSync(registryDir)) {
-      fs.mkdirSync(registryDir, { recursive: true });
-    }
-    this.registryPath = join(registryDir, "model-capabilities.json");
+    this.registryPath = join(memoryDir, ".registry", "model-capabilities.json");
     this.data = this.loadRegistry();
   }
 
@@ -140,6 +136,11 @@ export class ModelRegistry {
 
   private saveRegistry(): void {
     try {
+      // Created on first save, never at construction: building a registry
+      // happens on every plugin registration, including read-only discovery
+      // passes, and must not touch the operator's memory dir.
+      const registryDir = dirname(this.registryPath);
+      if (!fs.existsSync(registryDir)) fs.mkdirSync(registryDir, { recursive: true });
       fs.writeFileSync(this.registryPath, JSON.stringify(this.data, null, 2));
     } catch (err) {
       log.warn(`ModelRegistry: failed to save registry: ${err}`);