@remnic/core 9.69.9 → 9.69.11

package/src/harmonic-retrieval.ts

@@ -14,6 +14,7 @@ import { countRecallTokenOverlap, normalizeRecallTokens } from "./recall-tokeniz
 import { stripAttributesSuffix } from "./structured-attributes.js";
 import { isValidityExpiredNow } from "./temporal-validity.js";
 import { isRecord } from "./store-contract.js";
+import { isSupportPassportPrivateMemory } from "./support-passport/card-projection.js";
 import type { MemoryFile } from "./types.js";
 
 type SourceMemoryMap = Map<string, MemoryFile>;
@@ -73,6 +74,11 @@ function projectSourceBackedNode(
     const memory = sourceMemories.get(memoryId);
     return (
       memory !== undefined &&
+      // #2332: a private support-passport record leaves the eligible set the
+      // same way a rejected one does — a node title or anchor attribution
+      // rebuilt from it would leak governed metadata into the deep-recall
+      // frontier (and every other graph reader) before any content check runs.
+      !isSupportPassportPrivateMemory(memory) &&
       inferMemoryStatus(memory.frontmatter, toMemoryPathRel(memoryDir, memory.path)) === "active" &&
       (temporalExpiredInInjection || !isValidityExpiredNow(memory.frontmatter, nowMs))
     );
@@ -232,7 +238,7 @@ function scoreAnchor(
   return { score, matchedFields };
 }
 
-async function readAbstractionNodes(options: {
+export async function readAbstractionNodes(options: {
   memoryDir: string;
   abstractionNodeStoreDir?: string;
 }): Promise<AbstractionNode[]> {
@@ -249,7 +255,7 @@ async function readAbstractionNodes(options: {
   return nodes;
 }
 
-async function readCueAnchors(options: {
+export async function readCueAnchors(options: {
   memoryDir: string;
   abstractionNodeStoreDir?: string;
 }): Promise<CueAnchor[]> {
@@ -267,27 +273,46 @@ async function readCueAnchors(options: {
   return anchors;
 }
 
-export async function searchHarmonicRetrieval(options: {
+export interface ProjectedHarmonicGraph {
+  nodes: AbstractionNode[];
+  anchors: CueAnchor[];
+}
+
+/**
+ * Read nodes + anchors and project BOTH against the namespace's current active
+ * memories. This is the single projection every graph reader shares: a raw
+ * `readAbstractionNodes` / `readCueAnchors` pair still carries the stored title,
+ * summary, tags, and anchor attribution of a memory that was later rejected,
+ * quarantined, or otherwise moved out of the active set, so a second reader
+ * that skipped the projection could leak governed metadata even when the
+ * memory itself is excluded from the final results.
+ *
+ * - A node whose every source memory left the active set is dropped.
+ * - A surviving node's title/summary/tags/entityRefs are rebuilt from its
+ *   active sources only.
+ * - An anchor keeps a node reference only while its attribution runs through
+ *   one of that node's surviving active sources, and is dropped once no
+ *   reference survives.
+ */
+export async function readProjectedHarmonicGraph(options: {
   memoryDir: string;
   abstractionNodeStoreDir?: string;
-  query: string;
-  maxResults: number;
-  sessionKey?: string;
   anchorsEnabled: boolean;
   abortSignal?: AbortSignal;
   temporalExpiredInInjection?: boolean;
-}): Promise<HarmonicRetrievalResult[]> {
+  nowMs?: number;
+}): Promise<ProjectedHarmonicGraph> {
   throwIfAborted(options.abortSignal, "harmonic retrieval aborted");
-  const queryTokens = new Set(normalizeRecallTokens(options.query, ["what", "which"]));
-  if (queryTokens.size === 0 || options.maxResults <= 0) return [];
-
   const nodes = await readAbstractionNodes(options);
-  const sourceBackedNodes = nodes.filter((node) => (node.sourceMemoryIds?.length ?? 0) > 0);
-  const sourceMemories: SourceMemoryMap =
-    sourceBackedNodes.length > 0 ? await readSourceMemories(options) : new Map<string, MemoryFile>();
+  const sourceBacked = nodes.some((node) => (node.sourceMemoryIds?.length ?? 0) > 0);
+  const sourceMemories: SourceMemoryMap = sourceBacked
+    ? await readSourceMemories(options)
+    : new Map<string, MemoryFile>();
+  const nowMs = options.nowMs ?? Date.now();
+  // A node whose full stored source set survived projection keeps legacy
+  // anchor attribution (an anchor written before per-node source ids existed).
   const legacyCompatibleNodeRefs = new Set<string>();
-  const nowMs = Date.now();
-  const eligibleNodes = nodes.flatMap((node) => {
+  const projectedNodes = nodes.flatMap((node) => {
     const projected = projectSourceBackedNode(
       node,
       sourceMemories,
@@ -304,6 +329,40 @@ export async function searchHarmonicRetrieval(options: {
     }
     return projected ? [projected] : [];
   });
+  if (!options.anchorsEnabled) return { nodes: projectedNodes, anchors: [] };
+  throwIfAborted(options.abortSignal, "harmonic retrieval aborted");
+  const nodeIndex = new Map(projectedNodes.map((node) => [node.nodeId, node]));
+  const anchors = (await readCueAnchors(options)).flatMap((anchor) => {
+    throwIfAborted(options.abortSignal, "harmonic retrieval aborted");
+    const nodeRefs = anchor.nodeRefs.filter((nodeRef) => {
+      const node = nodeIndex.get(nodeRef);
+      return (
+        node !== undefined &&
+        anchorMatchesProjectedNode(anchor, nodeRef, node, legacyCompatibleNodeRefs.has(nodeRef))
+      );
+    });
+    return nodeRefs.length > 0 ? [{ ...anchor, nodeRefs }] : [];
+  });
+  return { nodes: projectedNodes, anchors };
+}
+
+export async function searchHarmonicRetrieval(options: {
+  memoryDir: string;
+  abstractionNodeStoreDir?: string;
+  query: string;
+  maxResults: number;
+  sessionKey?: string;
+  anchorsEnabled: boolean;
+  abortSignal?: AbortSignal;
+  temporalExpiredInInjection?: boolean;
+}): Promise<HarmonicRetrievalResult[]> {
+  throwIfAborted(options.abortSignal, "harmonic retrieval aborted");
+  const queryTokens = new Set(normalizeRecallTokens(options.query, ["what", "which"]));
+  if (queryTokens.size === 0 || options.maxResults <= 0) return [];
+
+  // One projection for every graph reader: nodes and anchors both arrive
+  // already narrowed to the namespace's current active memories.
+  const { nodes: eligibleNodes, anchors } = await readProjectedHarmonicGraph(options);
   const candidates = new Map<string, HarmonicCandidate>();
 
   for (const node of eligibleNodes) {
@@ -321,19 +380,13 @@ export async function searchHarmonicRetrieval(options: {
 
   if (options.anchorsEnabled) {
     throwIfAborted(options.abortSignal, "harmonic retrieval aborted");
-    const anchors = await readCueAnchors(options);
     const nodeIndex = new Map(eligibleNodes.map((node) => [node.nodeId, node]));
     for (const anchor of anchors) {
       throwIfAborted(options.abortSignal, "harmonic retrieval aborted");
- const eligibleNodeRefs = anchor.nodeRefs.filter((nodeRef) => {
- const node = nodeIndex.get(nodeRef);
- return (
- node !== undefined &&
- anchorMatchesProjectedNode(anchor, nodeRef, node, legacyCompatibleNodeRefs.has(nodeRef))
- );
- });
- const eligibleNodeTags = new Set(eligibleNodeRefs.flatMap((nodeRef) => nodeIndex.get(nodeRef)?.tags ?? []));
- const eligibleAnchorTags = anchor.tags?.filter((tag) => eligibleNodeTags.has(tag)) ?? [];
+      // `nodeRefs` are the projection's surviving references already.
+      const eligibleNodeRefs = anchor.nodeRefs;
+      const eligibleNodeTags = new Set(eligibleNodeRefs.flatMap((nodeRef) => nodeIndex.get(nodeRef)?.tags ?? []));
+      const eligibleAnchorTags = anchor.tags?.filter((tag) => eligibleNodeTags.has(tag)) ?? [];
       const { score, matchedFields } = scoreAnchor(anchor, queryTokens, eligibleAnchorTags);
       if (score <= 0) continue;
       for (const nodeRef of eligibleNodeRefs) {

package/src/mcp-read-only-tools.ts

@@ -27,6 +27,7 @@ export const MCP_READ_ONLY_TOOL_SUFFIXES: Readonly<Record<string, true>> = {
   location_day: true,
   meetings_list: true,
   meetings_get: true,
+  deep_recall: true,
   standup: true,
   action_confidence: true,
   capsule_list: true,

package/src/shared-context/envelope-at.test.ts

@@ -17,3 +17,26 @@ test("empty at is missing_at", () => {
 test("invalid at is invalid_at", () => {
   assert.deepEqual(parseEnvelopeAt("not-a-date"), { ok: false, error: "invalid_at" });
 });
+
+/**
+ * Regression (issue #1957 review round 3): permissive `Date.parse` accepted
+ * these and silently reinterpreted them — "2026-02-30" as March 2 2026, "1"
+ * as January 1 2001 — so the persisted governance deadline differed from the
+ * caller's input. The calendar components are validated against the exact
+ * value now, and an out-of-range or non-string input is rejected.
+ */
+test("Date.parse-permissive expiries are rejected, not reinterpreted", () => {
+  for (const value of ["2026-02-30T00:00:00.000Z", "2026-02-30", "1", "2026-13-01T00:00:00Z", "2026-08-18T25:00:00Z"]) {
+    assert.deepEqual(parseEnvelopeAt(value), { ok: false, error: "invalid_at" }, value);
+  }
+  // Non-finite / non-string inputs an in-process JS caller can still pass.
+  for (const value of [Number.NaN, Number.POSITIVE_INFINITY, 1, null, undefined, {}]) {
+    assert.deepEqual(parseEnvelopeAt(value as never), { ok: false, error: "invalid_at" }, String(value));
+  }
+  // A whitespace-padded timestamp is not the value the caller supplied.
+  assert.deepEqual(parseEnvelopeAt(` ${AT} `), { ok: false, error: "invalid_at" });
+  // Valid ISO instants still pass through unchanged.
+  assert.deepEqual(parseEnvelopeAt(AT), { ok: true, at: AT });
+  assert.deepEqual(parseEnvelopeAt("2026-02-28T23:59:59Z"), { ok: true, at: "2026-02-28T23:59:59.000Z" });
+  assert.deepEqual(parseEnvelopeAt("2024-02-29T00:00:00Z"), { ok: true, at: "2024-02-29T00:00:00.000Z" });
+});

package/src/shared-context/envelope-at.ts

@@ -1,17 +1,23 @@
 /**
  * Shared-item envelope at parse (issue #1957 leftover).
  *
- * Pure. Empty is missing_at. Invalid Date.parse is invalid_at.
+ * Pure. Blank is missing_at. Anything that is not a calendar-valid ISO-8601
+ * instant is invalid_at — including values permissive `Date.parse` would
+ * silently reinterpret (`"2026-02-30"` -> March 2, `"1"` -> January 1 2001),
+ * a whitespace-padded timestamp, and any non-string or non-finite input
+ * (review round 3). `trim()` only detects blankness; validation reads the
+ * exact value, so normalization can never widen what passes.
  */
 
+import { isStrictIsoInstant } from "./iso-instant.js";
+
 export type ParseEnvelopeAtResult =
   | { ok: true; at: string }
   | { ok: false; error: "missing_at" | "invalid_at" };
 
 export function parseEnvelopeAt(value: string): ParseEnvelopeAtResult {
-  const raw = value.trim();
-  if (raw.length === 0) return { ok: false, error: "missing_at" };
-  const ms = Date.parse(raw);
-  if (!Number.isFinite(ms)) return { ok: false, error: "invalid_at" };
-  return { ok: true, at: new Date(ms).toISOString() };
+  if (typeof value !== "string") return { ok: false, error: "invalid_at" };
+  if (value.trim().length === 0) return { ok: false, error: "missing_at" };
+  if (!isStrictIsoInstant(value)) return { ok: false, error: "invalid_at" };
+  return { ok: true, at: new Date(Date.parse(value)).toISOString() };
 }

package/src/shared-context/envelope-io.ts

@@ -0,0 +1,184 @@
+/**
+ * Shared-item envelope wiring (issue #1957, control 1: origin + authority).
+ *
+ * Bridges the pure envelope helpers onto the markdown frontmatter the
+ * shared-context manager reads and writes.
+ *
+ * Write side rejects invalid input (an unrecognized authority or a binding
+ * request without the config opt-in throws — never silently reinterpreted).
+ * Read side resolves least privilege: a missing, malformed, or unrecognized
+ * authority never resolves above informational, and stored binding
+ * downgrades to advisory unless config opted in.
+ */
+
+import { applyDefaultEnvelope, parseSharedEnvelope, type SharedEnvelope } from "./governance.js";
+import { resolveSharedAuthority } from "./authority-precedence.js";
+import type { SharedAuthority } from "./governance.js";
+import { parseEnvelopeActor } from "./envelope-actor.js";
+import { parseEnvelopeAt } from "./envelope-at.js";
+import { parseEnvelopeId } from "./envelope-id.js";
+
+export interface ComposeWriteEnvelopeInput {
+  /** Governance origin. Becomes the envelope's `sharedBy`. */
+  origin: string;
+  /** Requested authority class. Unrecognized values throw. */
+  authority?: string;
+  /** Optional ISO-8601 expiry. Invalid timestamps throw. */
+  expiresAt?: string;
+  /** Optional id of the item this one supersedes. */
+  supersedes?: string;
+  /** Config opt-in (`sharedContextAllowBindingAuthority`). Binding throws without it. */
+  allowBinding: boolean;
+}
+
+function requireEnvelopeActor(agentId: string): string {
+  const parsed = parseEnvelopeActor(agentId);
+  if (!parsed.ok) {
+    throw new Error(`composeWriteEnvelope: agentId must be a non-blank single-line string (${parsed.error})`);
+  }
+  return parsed.actor;
+}
+
+function optionalEnvelopeAt(expiresAt: string | undefined): string | undefined {
+  if (expiresAt === undefined) return undefined;
+  const parsed = parseEnvelopeAt(expiresAt);
+  if (!parsed.ok) {
+    throw new Error(`composeWriteEnvelope: expiresAt must be a valid ISO-8601 timestamp (${parsed.error})`);
+  }
+  return parsed.at;
+}
+
+function optionalEnvelopeId(supersedes: string | undefined): string | undefined {
+  if (supersedes === undefined) return undefined;
+  const parsed = parseEnvelopeId(supersedes);
+  if (!parsed.ok) {
+    throw new Error(`composeWriteEnvelope: supersedes must be a non-blank single-line id (${parsed.error})`);
+  }
+  return parsed.id;
+}
+
+/**
+ * Reserved governance origin for an authenticated external access write that
+ * resolved no principal (`agentAccessHttp.principal` unset, no adapter
+ * identity). Server-owned: the caller cannot mint or influence it, and the
+ * caller-supplied `agentId` never becomes audit metadata on that path.
+ */
+export const UNATTRIBUTED_ACCESS_WRITE_ORIGIN = "unattributed:access-surface";
+
+export interface ResolvedWriteIdentity {
+  /**
+   * Producer identity: frontmatter `agent`, on-disk segment, and the
+   * cross-signals grouping key. Self-declared by the caller only on
+   * surfaces that resolved no server identity; never decides authority.
+   */
+  agent: string;
+  /** Governance origin stamped as the envelope's `sharedBy`. */
+  origin: string;
+}
+
+/**
+ * Resolve the producer identity and governance origin for a shared-context
+ * write. They are different fields with different trust requirements:
+ *
+ * - The origin (`sharedBy`) is audit metadata and is always server-derived.
+ *   When the surface resolved an authenticated identity, that identity IS the
+ *   origin; when it resolved none but the write crosses an external
+ *   boundary, the caller-supplied `unattributedOrigin` token is stamped
+ *   instead — never the caller's value. Only a trusted in-process caller
+ *   (no identity, no token) may stamp its own id as the origin.
+ * - The producer (`agent`) drives grouping and display only. When an
+ *   authenticated identity exists it is also the producer, and a
+ *   caller-supplied `agentId` naming a different agent is REJECTED, so a
+ *   caller can never publish an item attributed to another agent. Without a
+ *   server identity the caller's label stands as the producer — collapsing
+ *   it instead would merge every writer into one agent and erase
+ *   multi-agent overlaps from `synthesizeCrossSignals`.
+ */
+export function resolveWriteOrigin(input: {
+  agentId: string;
+  authenticatedIdentity?: string;
+  unattributedOrigin?: string;
+}): ResolvedWriteIdentity {
+  const identity = input.authenticatedIdentity?.trim() ?? "";
+  if (identity.length > 0) {
+    const requested = input.agentId.trim();
+    if (requested.length > 0 && requested !== identity) {
+      throw new Error(
+        `shared-context write origin mismatch: authenticated identity ${JSON.stringify(identity)} cannot publish as ${JSON.stringify(requested)}`,
+      );
+    }
+    return { agent: identity, origin: identity };
+  }
+  const unattributed = input.unattributedOrigin?.trim() ?? "";
+  if (unattributed.length > 0) {
+    const label = input.agentId.trim();
+    return {
+      agent: label.length > 0 ? requireProducer(label) : requireProducer(unattributed),
+      origin: requireProducer(unattributed),
+    };
+  }
+  const actor = requireProducer(input.agentId);
+  return { agent: actor, origin: actor };
+}
+
+function requireProducer(value: string): string {
+  const parsed = parseEnvelopeActor(value);
+  if (!parsed.ok) {
+    throw new Error(`shared-context write producer must be a non-blank single-line string (${parsed.error})`);
+  }
+  return parsed.actor;
+}
+
+/**
+ * Validate and compose the envelope for a shared-context write.
+ * `sharedBy` is stamped from the server-derived origin — provenance is
+ * never injected through item content or the caller's producer label.
+ */
+export function composeWriteEnvelope(input: ComposeWriteEnvelopeInput): SharedEnvelope {
+  const sharedBy = requireEnvelopeActor(input.origin);
+  const expiresAt = optionalEnvelopeAt(input.expiresAt);
+  const supersedes = optionalEnvelopeId(input.supersedes);
+  return applyDefaultEnvelope(
+    { sharedBy, authority: input.authority, expiresAt, supersedes },
+    { binding: input.allowBinding },
+  );
+}
+
+/** Serialize an envelope into frontmatter lines (caller adds the `---` fences). */
+export function envelopeToFrontmatterLines(envelope: SharedEnvelope): string[] {
+  const line = (key: string, value: string) => `${key}: ${JSON.stringify(value)}`;
+  const lines = [line("sharedBy", envelope.sharedBy ?? ""), line("authority", envelope.authority)];
+  if (envelope.expiresAt !== undefined) lines.push(line("expiresAt", envelope.expiresAt));
+  if (envelope.supersedes !== undefined) lines.push(line("supersedes", envelope.supersedes));
+  return lines;
+}
+
+/**
+ * Build an envelope from frontmatter scalars already read off a stored item.
+ * Missing scalars (legacy items) compose to informational with no expiry.
+ */
+export function envelopeFromScalars(scalars: {
+  sharedBy: string | null;
+  authority: string | null;
+  expiresAt: string | null;
+  supersedes: string | null;
+}): SharedEnvelope {
+  const record: Record<string, string> = {};
+  if (scalars.sharedBy !== null) record.sharedBy = scalars.sharedBy;
+  if (scalars.authority !== null) record.authority = scalars.authority;
+  if (scalars.expiresAt !== null) record.expiresAt = scalars.expiresAt;
+  if (scalars.supersedes !== null) record.supersedes = scalars.supersedes;
+  return parseSharedEnvelope(record);
+}
+
+/**
+ * Resolve a stored envelope's authority for read-side consumption.
+ * Least privilege: unrecognized/missing stays informational; binding
+ * requires the config opt-in or downgrades to advisory.
+ */
+export function resolveReadAuthority(
+  envelope: Pick<SharedEnvelope, "authority">,
+  allowBinding: boolean,
+): SharedAuthority {
+  return resolveSharedAuthority({ authority: envelope.authority, allowBinding });
+}

package/src/shared-context/envelope-wiring.test.ts

@@ -0,0 +1,193 @@
+/**
+ * Regression: shared-item authority envelope wiring (issue #1957, control 1).
+ *
+ * Exercises the REAL manager write/read paths end to end:
+ * writeAgentOutput stamps `sharedBy`/`authority` (+ optional `expiresAt`/
+ * `supersedes`) frontmatter; cross-signals and daily curation resolve and
+ * surface them. Least privilege holds everywhere: a missing, unrecognized,
+ * or un-flagged binding authority denies — it never elevates.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import os from "node:os";
+import path from "node:path";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { SharedContextManager } from "./manager.js";
+import { parseConfig } from "../config.js";
+
+async function makeManager(overrides: Record<string, unknown> = {}) {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "remnic-shared-envelope-"));
+  const config = parseConfig({
+    sharedContextEnabled: true,
+    sharedContextDir: dir,
+    ...overrides,
+  });
+  const manager = new SharedContextManager(config);
+  await manager.ensureStructure();
+  return { manager, dir };
+}
+
+function today(): string {
+  return new Date().toISOString().slice(0, 10);
+}
+
+test("authority envelope round-trips write -> cross-signals -> curation", async (t) => {
+  const { manager, dir } = await makeManager();
+  t.after(() => rm(dir, { recursive: true, force: true }));
+
+  const fp = await manager.writeAgentOutput({
+    agentId: "agent-alpha",
+    title: "Deploy checklist",
+    content: "Verified the deploy checklist end to end.",
+    authority: "advisory",
+    expiresAt: "2099-01-01T00:00:00.000Z",
+    supersedes: "out-0001",
+  });
+
+  const raw = await readFile(fp, "utf-8");
+  assert.match(raw, /^kind: agent_output$/m);
+  assert.match(raw, /^sharedBy: "agent-alpha"$/m);
+  assert.match(raw, /^authority: "advisory"$/m);
+  assert.match(raw, /^expiresAt: "2099-01-01T00:00:00\.000Z"$/m);
+  assert.match(raw, /^supersedes: "out-0001"$/m);
+
+  const signals = await manager.synthesizeCrossSignals({ date: today() });
+  const source = signals.report.sources.find((s) => s.path === fp);
+  assert.ok(source, "written output must appear in cross-signals sources");
+  assert.equal(source.authority, "advisory");
+  assert.equal(source.sharedBy, "agent-alpha");
+  const curation = await manager.curateDaily({ date: today() });
+  const roundtable = await readFile(curation.roundtablePath, "utf-8");
+  assert.match(roundtable, /authority: advisory; sharedBy: agent-alpha/);
+  assert.ok(roundtable.includes(fp), "roundtable cites the source path");
+});
+
+test("missing or unrecognized authority denies — never elevates", async (t) => {
+  const { manager, dir } = await makeManager();
+  t.after(() => rm(dir, { recursive: true, force: true }));
+
+  // Unrecognized authority at write time is rejected, not reinterpreted.
+  await assert.rejects(
+    manager.writeAgentOutput({
+      agentId: "agent-alpha",
+      title: "Malformed",
+      content: "x",
+      authority: " BINDING ",
+    }),
+    /authority must be informational, advisory, or binding/,
+  );
+
+  // Legacy item with no envelope resolves least-privileged on read.
+  const date = today();
+  const legacyDir = path.join(dir, "agent-outputs", "agent-legacy", date);
+  await mkdir(legacyDir, { recursive: true });
+  const legacyPath = path.join(legacyDir, "120000-legacy.md");
+  await writeFile(
+    legacyPath,
+    '---\nkind: agent_output\nagent: "agent-legacy"\ntitle: "Legacy"\n---\n\nOld item.\n',
+    "utf-8",
+  );
+
+  const signals = await manager.synthesizeCrossSignals({ date });
+  const legacy = signals.report.sources.find((s) => s.path === legacyPath);
+  assert.ok(legacy, "legacy item still appears in sources");
+  assert.equal(legacy.authority, "informational");
+  assert.equal(legacy.sharedBy, "agent-legacy");
+
+  // A stored unrecognized authority value also denies on read.
+  const bogusPath = path.join(legacyDir, "120100-bogus.md");
+  await writeFile(
+    bogusPath,
+    '---\nkind: agent_output\nagent: "agent-legacy"\ntitle: "Bogus"\nsharedBy: "agent-legacy"\nauthority: "imperative"\n---\n\nBogus item.\n',
+    "utf-8",
+  );
+  const reread = await manager.synthesizeCrossSignals({ date });
+  const bogus = reread.report.sources.find((s) => s.path === bogusPath);
+  assert.equal(bogus?.authority, "informational");
+});
+
+test("binding authority requires the config opt-in at write and on read", async (t) => {
+  const gated = await makeManager();
+  t.after(() => rm(gated.dir, { recursive: true, force: true }));
+
+  // Default config: a binding request is denied at the write boundary.
+  await assert.rejects(
+    gated.manager.writeAgentOutput({
+      agentId: "agent-alpha",
+      title: "Directive",
+      content: "x",
+      authority: "binding",
+    }),
+    /requires an explicit binding flag/,
+  );
+
+  // Stored binding without the flag downgrades to advisory on read.
+  const date = today();
+  const bindingDir = path.join(gated.dir, "agent-outputs", "agent-alpha", date);
+  await mkdir(bindingDir, { recursive: true });
+  const bindingPath = path.join(bindingDir, "130000-directive.md");
+  await writeFile(
+    bindingPath,
+    '---\nkind: agent_output\nagent: "agent-alpha"\ntitle: "Directive"\nsharedBy: "agent-alpha"\nauthority: "binding"\n---\n\nDirective.\n',
+    "utf-8",
+  );
+  const gatedSignals = await gated.manager.synthesizeCrossSignals({ date });
+  const stored = gatedSignals.report.sources.find((s) => s.path === bindingPath);
+  assert.equal(stored?.authority, "advisory", "un-flagged stored binding must downgrade");
+
+  // Opt-in config: binding writes succeed and resolve as binding on read.
+  const open = await makeManager({ sharedContextAllowBindingAuthority: true });
+  t.after(() => rm(open.dir, { recursive: true, force: true }));
+  const fp = await open.manager.writeAgentOutput({
+    agentId: "agent-alpha",
+    title: "Directive",
+    content: "x",
+    authority: "binding",
+  });
+  const raw = await readFile(fp, "utf-8");
+  assert.match(raw, /^authority: "binding"$/m);
+  const openSignals = await open.manager.synthesizeCrossSignals({ date });
+  const source = openSignals.report.sources.find((s) => s.path === fp);
+  assert.equal(source?.authority, "binding");
+});
+
+test("a whitespace-padded stored authority stays informational even with binding enabled", async (t) => {
+  // Regression (issue #1957 review): the stored token is validated EXACTLY.
+  // Trimming first would let `" binding "` resolve as binding when the opt-in
+  // is on, and as advisory when it is off — both above informational.
+  const date = today();
+  for (const allowBinding of [false, true]) {
+    const { manager, dir } = await makeManager({ sharedContextAllowBindingAuthority: allowBinding });
+    t.after(() => rm(dir, { recursive: true, force: true }));
+    const paddedDir = path.join(dir, "agent-outputs", "agent-padded", date);
+    await mkdir(paddedDir, { recursive: true });
+    const paddedPath = path.join(paddedDir, "140000-padded.md");
+    await writeFile(
+      paddedPath,
+      '---\nkind: agent_output\nagent: "agent-padded"\ntitle: "Padded"\nsharedBy: "agent-padded"\nauthority: " binding "\n---\n\nPadded item.\n',
+      "utf-8",
+    );
+    const signals = await manager.synthesizeCrossSignals({ date });
+    const padded = signals.report.sources.find((s) => s.path === paddedPath);
+    assert.equal(
+      padded?.authority,
+      "informational",
+      `padded authority must stay informational (allowBinding=${allowBinding})`,
+    );
+  }
+
+  // The same exactness holds at the write boundary: padded is rejected, not
+  // normalized into a privileged class.
+  const open = await makeManager({ sharedContextAllowBindingAuthority: true });
+  t.after(() => rm(open.dir, { recursive: true, force: true }));
+  await assert.rejects(
+    open.manager.writeAgentOutput({
+      agentId: "agent-padded",
+      title: "Padded",
+      content: "x",
+      authority: " binding ",
+    }),
+    /authority must be informational, advisory, or binding/,
+  );
+});

package/src/shared-context/governance.ts

@@ -1,8 +1,9 @@
 /**
  * Shared-item authority envelope (issue #1957).
  *
- * First slice: parse + default + expiry only. Write-path wiring and
- * curation come later. Binding is never inferred.
+ * Pure parse/default/expiry helpers over the authority classes. Binding is
+ * never inferred, and the authority token is validated exactly as supplied
+ * or stored — a padded value never resolves to a privileged class.
  */
 
 export const SHARED_AUTHORITIES = ["informational", "advisory", "binding"] as const;
@@ -36,6 +37,24 @@ function optionalString(value: unknown): string | undefined {
   return trimmed.length > 0 ? trimmed : undefined;
 }
 
+type AuthorityToken =
+  | { kind: "absent" }
+  | { kind: "invalid"; raw: string }
+  | { kind: "valid"; authority: SharedAuthority };
+
+/**
+ * Read the authority token EXACTLY as supplied or stored. A padded value
+ * such as `" binding "` is malformed data, never a normalized match for a
+ * privileged class: trimming first would let stored whitespace resolve as
+ * binding/advisory (AGENTS.md rule 45). Only the empty string counts as
+ * "unspecified"; whitespace-only is invalid.
+ */
+function readExactAuthority(value: unknown): AuthorityToken {
+  if (typeof value !== "string" || value.length === 0) return { kind: "absent" };
+  if (!isSharedAuthority(value)) return { kind: "invalid", raw: value };
+  return { kind: "valid", authority: value };
+}
+
 function withOptionalFields(
   authority: SharedAuthority,
   source: { sharedBy?: unknown; expiresAt?: unknown; supersedes?: unknown },
@@ -54,16 +73,16 @@ export function applyDefaultEnvelope(
   input: SharedEnvelopeInput = {},
   options: ApplyDefaultEnvelopeOptions = {},
 ): SharedEnvelope {
-  const requested = optionalString(input.authority);
-  if (requested !== undefined && !isSharedAuthority(requested)) {
+  const requested = readExactAuthority(input.authority);
+  if (requested.kind === "invalid") {
     throw new Error(
-      `applyDefaultEnvelope: authority must be informational, advisory, or binding; got ${JSON.stringify(requested)}`,
+      `applyDefaultEnvelope: authority must be informational, advisory, or binding; got ${JSON.stringify(requested.raw)}`,
     );
   }
-  if (requested === "binding" && options.binding !== true) {
+  if (requested.kind === "valid" && requested.authority === "binding" && options.binding !== true) {
     throw new Error("applyDefaultEnvelope: authority \"binding\" requires an explicit binding flag");
   }
-  return withOptionalFields(requested ?? "informational", input);
+  return withOptionalFields(requested.kind === "valid" ? requested.authority : "informational", input);
 }
 
 export function parseSharedEnvelope(raw: unknown): SharedEnvelope {
@@ -71,8 +90,8 @@ export function parseSharedEnvelope(raw: unknown): SharedEnvelope {
     return { authority: "informational" };
   }
   const record = raw as Record<string, unknown>;
-  const requested = optionalString(record.authority);
-  const authority = requested !== undefined && isSharedAuthority(requested) ? requested : "informational";
+  const requested = readExactAuthority(record.authority);
+  const authority = requested.kind === "valid" ? requested.authority : "informational";
   return withOptionalFields(authority, record);
 }