@remnic/core 9.69.60 → 9.69.63

package/src/orchestration/extraction-injection-gate.ts

@@ -2,6 +2,7 @@ import { parseOriginClass } from "../security/origin-authority.js";
 import { normalizeAttributePairs } from "../structured-attributes.js";
 import { buildProcedurePersistBody } from "../procedural/procedure-types.js";
 import { screenCandidateFact } from "../security/injection-screen.js";
+import type { InjectionScreenProfile } from "../security/injection-screen.js";
 import type { EntityStructuredSection } from "../types.js";
 
 export interface InjectionScreenCandidate {
@@ -41,11 +42,12 @@ export function serializeInjectionScreenCandidate(candidate: InjectionScreenCand
 export function evaluateInjectionScreen(
   candidate: InjectionScreenCandidate | string,
   enabled: boolean,
+  profile: InjectionScreenProfile = "default",
 ): InjectionScreenGateResult {
   if (!enabled) return { tags: [] };
   const content =
     typeof candidate === "string" ? candidate : serializeInjectionScreenCandidate(candidate);
-  const result = screenCandidateFact(content);
+  const result = screenCandidateFact(content, profile);
   return {
     status: result.quarantine === true ? "pending_review" : undefined,
     tags: result.quarantine === true
@@ -63,6 +65,7 @@ export function evaluateInjectionScreen(
 export function withholdScreenedStrings(
   values: readonly unknown[],
   enabled: boolean,
+  profile: InjectionScreenProfile = "default",
 ): { kept: string[]; withheldRules: string[] } {
   const kept: string[] = [];
   const withheldRules: string[] = [];
@@ -72,7 +75,7 @@ export function withholdScreenedStrings(
       kept.push(value);
       continue;
     }
-    const screened = screenCandidateFact(value);
+    const screened = screenCandidateFact(value, profile);
     if (screened.quarantine) {
       withheldRules.push(...screened.findings.map((finding) => `injection-screen:${finding.rule}`));
     } else {
@@ -99,20 +102,20 @@ export interface ScreenedEntityWrite {
  * `withheldRules` (entities carry no review status; routing is #2397).
  * Returns null for entities without a usable name/type.
  */
-export function screenEntityForIndex(entity: unknown, enabled: boolean): ScreenedEntityWrite | null {
+export function screenEntityForIndex(entity: unknown, enabled: boolean, profile: InjectionScreenProfile = "default"): ScreenedEntityWrite | null {
   const record = entity as { name?: unknown; type?: unknown; source?: unknown; facts?: unknown; structuredSections?: unknown } | null;
   const name = record?.name;
   const type = record?.type;
   if (typeof name !== "string" || !name.trim() || typeof type !== "string" || !type.trim()) return null;
   // #1955 review: the raw name is emitted as the entity target outside the
   // snippet fence — a flagged name withholds the whole entity from the index.
-  const nameScreen = withholdScreenedStrings([name], enabled);
-  const factScreen = withholdScreenedStrings(Array.isArray(record?.facts) ? record.facts : [], enabled);
+  const nameScreen = withholdScreenedStrings([name], enabled, profile);
+  const factScreen = withholdScreenedStrings(Array.isArray(record?.facts) ? record.facts : [], enabled, profile);
   const rawSections: EntityStructuredSection[] | undefined = Array.isArray(record?.structuredSections)
     ? (record.structuredSections as EntityStructuredSection[])
     : undefined;
   const sectionScreens = enabled && rawSections
-    ? rawSections.map((section) => ({ section, screen: withholdScreenedStrings(section?.facts ?? [], true) }))
+    ? rawSections.map((section) => ({ section, screen: withholdScreenedStrings(section?.facts ?? [], true, profile) }))
     : undefined;
   return {
     name,
@@ -155,8 +158,9 @@ export function screenEntityForIndex(entity: unknown, enabled: boolean): Screene
 export function screenPersistStrings(
   values: readonly string[],
   enabled: boolean,
+  profile: InjectionScreenProfile = "default",
 ): { kept: string[]; warning?: string } {
-  const screen = withholdScreenedStrings(values, enabled);
+  const screen = withholdScreenedStrings(values, enabled, profile);
   return {
     kept: screen.kept,
     ...(screen.withheldRules.length > 0

package/src/orchestration/extraction-origin-context.ts

@@ -20,7 +20,7 @@ export function deriveExtractionOriginContext(
   targetTurns: readonly BufferTurn[],
   fallbackConnector?: string,
 ): Pick<ExtractionSourceContext, "turnRole" | "importAdapter" | "sourceConnector" | "originConflict"> {
-  const originRoles = new Set(targetTurns.map((turn) => turn.role));
+  const originRoles = new Set(targetTurns.map((turn) => turn.originRole ?? turn.role));
   const turnRole = originRoles.size === 1 ? [...originRoles][0] : undefined;
   const originConnectors = new Set(
     targetTurns

package/src/orchestration/extraction-persist.ts

@@ -1623,7 +1623,7 @@ export class ExtractionPersistCoordinator {
         entityRef: fact.entityRef,
         validAt: biTemporal?.validFrom ?? sourceContext?.validAt,
       };
-      const { status: injectionScreenStatus, tags: injectionScreenTags } = evaluateInjectionScreen({ content: fact.content, category: writeCategory, structuredAttributes: fact.structuredAttributes, procedureSteps: fact.procedureSteps }, resolveSecurityCapabilities(this.deps.config).injectionScreen);
+      const { status: injectionScreenStatus, tags: injectionScreenTags } = evaluateInjectionScreen({ content: fact.content, category: writeCategory, structuredAttributes: fact.structuredAttributes, procedureSteps: fact.procedureSteps }, resolveSecurityCapabilities(this.deps.config).injectionScreen, resolveSecurityCapabilities(this.deps.config).injectionScreenProfile);
       // #1669 redaction-rule gate: consult BOTH source and target namespace
       // rules before any write. A never-store pattern registered under the
       // source namespace must survive scope-routing to a different target
@@ -2841,12 +2841,12 @@ export class ExtractionPersistCoordinator {
       durableNonFactTouchRecorded = true;
       touchBaseNonFactNamespace();
     };
-    // #1955 review: entity fields recall via entity hints — screened before
-    // entering the index (screenEntityForIndex); withheld fields are logged.
+    // #1955 review: entity fields are screened before entering the index (screenEntityForIndex).
     const entityScreenOn = resolveSecurityCapabilities(this.deps.config).injectionScreen;
+    const entityScreenProfile = resolveSecurityCapabilities(this.deps.config).injectionScreenProfile;
     for (const entity of entities) {
       try {
-        const screened = screenEntityForIndex(entity, entityScreenOn);
+        const screened = screenEntityForIndex(entity, entityScreenOn, entityScreenProfile);
         if (!screened) continue;
         if (screened.withheldRules.length > 0) log.warn(`persistExtraction: injection screen withheld ${screened.withheldRules.length} entity field(s) for "${screened.name}" [${screened.withheldRules.join(", ")}]`);
         if (screened.withheld) continue;
@@ -2874,7 +2874,7 @@ export class ExtractionPersistCoordinator {
       for (const rel of result.relationships.slice(0, 5)) {
         if (!rel.source || !rel.target || !rel.label) continue;
         const relScreen = screenPersistStrings([`${rel.source}\n${rel.label}\n${rel.target}`,
-          `${rel.target}\n${rel.label} (reverse)\n${rel.source}`], entityScreenOn);
+          `${rel.target}\n${rel.label} (reverse)\n${rel.source}`], entityScreenOn, entityScreenProfile);
         if (relScreen.warning) {
           log.warn(`persistExtraction(relationship): ${relScreen.warning}`);
           continue;
@@ -2911,7 +2911,7 @@ export class ExtractionPersistCoordinator {
     }
     // #1955 review: profile + questions render verbatim into model context —
     // screened; questions screen question+context JOINED (routing: #2397).
-    const profileScreen = screenPersistStrings(profileUpdates, entityScreenOn);
+    const profileScreen = screenPersistStrings(profileUpdates, entityScreenOn, entityScreenProfile);
     if (profileScreen.warning) log.warn(`persistExtraction(profile): ${profileScreen.warning}`);
     if (profileScreen.kept.length > 0) {
       await storage.appendToProfile(profileScreen.kept);
@@ -2919,7 +2919,7 @@ export class ExtractionPersistCoordinator {
     }
 
     for (const q of questions) {
-      const qScreen = screenPersistStrings([`${q.question}\n${q.context ?? ""}`], entityScreenOn);
+      const qScreen = screenPersistStrings([`${q.question}\n${q.context ?? ""}`], entityScreenOn, entityScreenProfile);
       if (qScreen.warning) {
         log.warn(`persistExtraction(question): ${qScreen.warning}`);
         continue;
@@ -2934,7 +2934,7 @@ export class ExtractionPersistCoordinator {
     // Persist identity reflection (screened — #1955): durable namespace-local
     // state; identity-ONLY extraction still counts as durable non-fact (NIIly).
     if (resolveRecallEnhancementCapabilities(this.deps.config).identity && result.identityReflection) {
-      const idScreen = screenPersistStrings([result.identityReflection], entityScreenOn);
+      const idScreen = screenPersistStrings([result.identityReflection], entityScreenOn, entityScreenProfile);
       if (idScreen.warning) log.warn(`persistExtraction(identity): ${idScreen.warning}`);
       else {
         try {

package/src/orchestration/extraction-security.test.ts

@@ -187,6 +187,18 @@ test("mixed connector identities resolve to unknown origin", () => {
   assert.equal(classifyExtractionOrigin(context), "unknown");
 });
 
+test("trusted originRole preserves tool authority independently of conversation role", () => {
+  const turns: BufferTurn[] = [{
+    role: "user",
+    originRole: "tool",
+    content: "Tool result rendered into conversation context.",
+    timestamp: "2026-01-01T00:00:00Z",
+  }];
+  const context = deriveExtractionOriginContext(turns);
+  assert.equal(context.turnRole, "tool");
+  assert.equal(classifyExtractionOrigin(context), "tool_output");
+});
+
 test("empty import source labels do not create adapter origins", () => {
   const turns: BufferTurn[] = [{
     role: "user",

package/src/orchestration/turn-ingestion.ts

@@ -274,6 +274,7 @@ export class TurnIngestionCoordinator {
         rawContent: turn.rawContent,
         sourceFormat: turn.sourceFormat,
         sourceConnector: turn.sourceConnector,
+        ...(turn.originRole ? { originRole: turn.originRole } : {}),
       });
       bySession.set(key, list);
     }
@@ -461,6 +462,7 @@ export class TurnIngestionCoordinator {
         turnFingerprint: turn.turnFingerprint,
         persistProcessedFingerprint: turn.persistProcessedFingerprint === true,
         ...(turn.sourceConnector ? { sourceConnector: turn.sourceConnector } : {}),
+        ...(turn.originRole ? { originRole: turn.originRole } : {}),
       });
     }
     if (sessionTurns.length === 0) {

package/src/profiling.test.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { existsSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import test, { describe } from "node:test";
@@ -283,4 +283,23 @@ describe("ProfilingCollector", () => {
       cleanup(dir);
     }
   });
+
+  test("construction never creates the storage dir; the first persist does", () => {
+    const dir = tempDir();
+    const storageDir = join(dir, "profiling");
+    try {
+      const collector = new ProfilingCollector({ enabled: true, storageDir, maxTraces: 10 });
+      // Constructing a collector happens on every plugin registration, including
+      // read-only discovery passes, so it must not touch the memory dir.
+      assert.equal(existsSync(storageDir), false, "no dir before a trace is written");
+      collector.startTrace("recall", "test-session");
+      collector.startSpan("qmd-search");
+      collector.endSpan("qmd-search");
+      collector.endTrace();
+      assert.equal(existsSync(storageDir), true, "the first persisted trace creates it");
+      assert.equal(readdirSync(storageDir).length, 1);
+    } finally {
+      cleanup(dir);
+    }
+  });
 });

package/src/profiling.ts

@@ -118,13 +118,6 @@ export class ProfilingCollector {
     this.enabled = config.enabled;
     this.storageDir = config.storageDir;
     this.maxTraces = Math.max(0, config.maxTraces);
-
-    if (this.enabled) {
-      if (!existsSync(this.storageDir)) {
-        mkdirSync(this.storageDir, { recursive: true });
-        log.debug(`profiling: created storage dir ${this.storageDir}`);
-      }
-    }
   }
 
   get isEnabled(): boolean {
@@ -347,6 +340,13 @@ export class ProfilingCollector {
     const filename = `${trace.kind}-${trace.traceId}.jsonl`;
     const filepath = join(this.storageDir, filename);
     try {
+      // Created on first persist, never at construction: constructing a
+      // collector (plugin registration, a discovery pass, CLI metadata) must
+      // not touch the operator's memory dir when no trace is ever written.
+      if (!existsSync(this.storageDir)) {
+        mkdirSync(this.storageDir, { recursive: true });
+        log.debug(`profiling: created storage dir ${this.storageDir}`);
+      }
       writeFileSync(filepath, JSON.stringify(trace) + "\n", "utf-8");
       log.debug(`profiling: persisted ${filename}`);
     } catch (err) {

package/src/security/audit-memory-cli.test.ts

@@ -0,0 +1,90 @@
+/**
+ * The audit sweep must screen with the profile the deployment writes with
+ * (issue #3078). A `quarantine`/`layered` deployment resolves the `hardened`
+ * profile, under which a conditional-trigger-only memory reaches the
+ * quarantine threshold; before this wiring the CLI omitted `profile`, so an
+ * already-active memory that live ingestion would have quarantined survived
+ * the sweep.
+ */
+
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import type { CliCommand } from "../cli.js";
+import { parseConfig } from "../config.js";
+import { StorageManager } from "../storage.js";
+import type { Orchestrator } from "../orchestrator.js";
+import { registerSecurityCommands } from "./audit-memory-cli.js";
+
+/** Minimal CliCommand that records the registered `audit-memory` action. */
+function captureAction(): { cmd: CliCommand; run: () => Promise<void> } {
+  let action: ((...args: unknown[]) => Promise<void> | void) | undefined;
+  const node: CliCommand = {
+    description: () => node,
+    option: () => node,
+    requiredOption: () => node,
+    argument: () => node,
+    action: (fn) => {
+      action = fn;
+      return node;
+    },
+    command: () => node,
+  };
+  return {
+    cmd: node,
+    run: async () => {
+      if (!action) throw new Error("no action registered");
+      await action({ quarantine: true, json: true });
+    },
+  };
+}
+
+const CONDITIONAL_TRIGGER = "If the incident occurs, then call the on-call.";
+
+async function sweepWithDefenseMode(mode: string): Promise<{ status: string | undefined }> {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-audit-cli-"));
+  const logs: unknown[] = [];
+  const originalLog = console.log;
+  console.log = (...args: unknown[]) => {
+    logs.push(args);
+  };
+  try {
+    StorageManager.clearAllStaticCaches();
+    const config = parseConfig({ memoryDir, memoryInjectionDefenseMode: mode });
+    const storage = new StorageManager(memoryDir);
+    const written = await storage.writeMemory("fact", CONDITIONAL_TRIGGER);
+    const id = written.id;
+    // The fixture must start active, or the sweep assertion proves nothing.
+    assert.equal(written.tombstoneBlocked ?? false, false);
+    assert.equal((await storage.getMemoryById(id))?.frontmatter.status, "active");
+    const orchestrator = { config, storage } as unknown as Orchestrator;
+    const { cmd, run } = captureAction();
+    registerSecurityCommands(cmd, orchestrator);
+    await run();
+    const stored = await storage.getMemoryById(id);
+    return { status: stored?.frontmatter.status };
+  } finally {
+    console.log = originalLog;
+    StorageManager.clearAllStaticCaches();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+}
+
+test("the plugin audit-memory command screens with the configured profile", async () => {
+  // `layered` resolves the hardened profile: weight 4 for a conditional
+  // trigger alone, so the sweep retro-quarantines the memory.
+  const hardened = await sweepWithDefenseMode("layered");
+  assert.equal(hardened.status, "pending_review");
+  // `custom` resolves the default profile: weight 3, below the threshold,
+  // so the same memory stays active. This proves the profile is read from
+  // the configuration rather than hard-coded either way.
+  const lenient = await sweepWithDefenseMode("custom");
+  assert.equal(lenient.status, "active");
+  // `off`/`fencing` disable live screening, so the sweep keeps the previous
+  // `default` weighting instead of becoming stricter than the write path.
+  const screenDisabled = await sweepWithDefenseMode("off");
+  assert.equal(screenDisabled.status, "active");
+});

package/src/security/audit-memory-cli.ts

@@ -7,6 +7,7 @@
 import type { CliCommand } from "../cli.js";
 import { runAuditMemoryCliCommand } from "../cli.js";
 import type { Orchestrator } from "../orchestrator.js";
+import { auditScreenProfile } from "./audit-memory.js";
 import { formatAuditMemoryReport } from "./audit-memory.js";
 
 export function registerSecurityCommands(
@@ -32,6 +33,12 @@ export function registerSecurityCommands(
           ? options.since.trim()
           : undefined,
         quarantine: options.quarantine === true,
+        // Screen with the profile live ingestion uses, or a memory this
+        // deployment would quarantine on write stays active once stored
+        // (#3078). A deployment with the screen DISABLED keeps the previous
+        // `default` weighting: the sweep must not be stricter than the
+        // write path the operator configured.
+        profile: auditScreenProfile(orchestrator.config),
       });
       if (options.json === true) {
         console.log(JSON.stringify(report, null, 2));

package/src/security/audit-memory.test.ts

@@ -162,27 +162,38 @@ test("auditMemoryStore audits legacy missing-status memories and excludes archiv
   }
 });
 
-test("auditMemoryStore reports sub-threshold injection findings without quarantining", async () => {
+test("auditMemoryStore quarantines a single-rule finding and leaves benign prose untouched", async () => {
+  // The hardened profile keeps every rule at weight >= INJECTION_SCREEN_THRESHOLD,
+  // so one finding is sufficient to quarantine; the default profile keeps
+  // conditional triggers sub-threshold (#1962).
   const root = await mkdtemp(path.join(tmpdir(), "remnic-audit-memory-threshold-"));
   try {
-    const memory = makeMemory(
+    const trigger = makeMemory(
       root,
-      "borderline",
-      "session-borderline",
+      "trigger",
+      "session-trigger",
       "If the incident occurs, then call the on-call.",
     );
+    const benign = makeMemory(
+      root,
+      "benign",
+      "session-benign",
+      "Meeting notes: if the build fails, the release is delayed.",
+    );
     const report = await auditMemoryStore({
       memoryDir: root,
-      storage: memoryStorage([memory]),
+      storage: memoryStorage([trigger, benign]),
       quarantine: true,
+      profile: "hardened",
     });
     assert.deepEqual(
-      report.findings.map(({ category, rule }) => ({ category, rule })),
-      [{ category: "injection-signature", rule: "conditional-trigger" }],
+      report.findings.map(({ memoryId, category, rule }) => ({ memoryId, category, rule })),
+      [{ memoryId: "trigger", category: "injection-signature", rule: "conditional-trigger" }],
     );
-    assert.deepEqual(report.quarantinedMemoryIds, []);
-    assert.equal(report.transitions, 0);
-    assert.equal(memory.frontmatter.status, "active");
+    assert.deepEqual(report.quarantinedMemoryIds, ["trigger"]);
+    assert.equal(report.transitions, 1);
+    assert.equal(trigger.frontmatter.status, "pending_review");
+    assert.equal(benign.frontmatter.status, "active");
   } finally {
     await rm(root, { recursive: true, force: true });
   }

package/src/security/audit-memory.ts

@@ -1,5 +1,7 @@
 import type { MemoryFile, MemoryFrontmatter } from "../types.js";
 import { screenCandidateFact } from "./injection-screen.js";
+import type { InjectionScreenProfile } from "./injection-screen.js";
+import { resolveSecurityCapabilities, type SecurityConfigProjection } from "../capabilities.js";
 import { inferMemoryStatus, isArchivedMemoryPath, toMemoryPathRel } from "../memory-lifecycle-ledger-utils.js";
 import { parseStrictCliDate } from "../training-export/date-parse.js";
 
@@ -36,6 +38,8 @@ export interface AuditMemoryStoreOptions {
   memoryDir: string;
   since?: string | Date;
   quarantine?: boolean;
+  /** Screen profile; defaults to "default" (named defense modes pass "hardened"). */
+  profile?: InjectionScreenProfile;
   now?: Date;
   storage: AuditMemoryStorage;
 }
@@ -203,6 +207,19 @@ function writeBurstStats(groups: Map<string, MemoryFile[]>): AuditMemoryReport["
   };
 }
 
+/**
+ * The screen profile an audit sweep must use, resolved through the shared
+ * security capability plan (#1523) rather than read off config (#3078). The
+ * sweep matches the live write path, so a memory this deployment would
+ * quarantine on write does not survive once stored; a deployment with the
+ * screen DISABLED keeps the `default` weighting, because the sweep must
+ * never be stricter than the configured write path.
+ */
+export function auditScreenProfile(config: SecurityConfigProjection): InjectionScreenProfile {
+  const capabilities = resolveSecurityCapabilities(config);
+  return capabilities.injectionScreen ? capabilities.injectionScreenProfile : "default";
+}
+
 export async function auditMemoryStore(options: AuditMemoryStoreOptions): Promise<AuditMemoryReport> {
   const since = parseSince(options.since);
   const storage = options.storage;
@@ -214,9 +231,10 @@ export async function auditMemoryStore(options: AuditMemoryStoreOptions): Promis
   );
   const findings: AuditMemoryFinding[] = [];
   const quarantinePaths = new Map<string, { injection: boolean; burst: boolean }>();
+  const profile = options.profile ?? "default";
 
   for (const memory of activeMemories) {
-    const screened = screenCandidateFact(memory.content);
+    const screened = screenCandidateFact(memory.content, profile);
     if (screened.quarantine === true) quarantinePaths.set(memory.path, { injection: true, burst: false });
     for (const screenFinding of screened.findings) {
       findings.push({
@@ -268,7 +286,7 @@ export async function auditMemoryStore(options: AuditMemoryStoreOptions): Promis
       // the live record first.
       const memory = await storage.readMemoryByPath(staleMemory.path);
       if (!memory || !isActive(memory, options.memoryDir)) continue;
-      if (qInfo.injection && !qInfo.burst && !screenCandidateFact(memory.content).quarantine) continue;
+      if (qInfo.injection && !qInfo.burst && !screenCandidateFact(memory.content, profile).quarantine) continue;
       const changed = await storage.writeMemoryFrontmatterIfUnchanged(memory, {
         status: "pending_review",
         updated: now,