@remnic/core 9.69.9 → 9.69.11

package/src/shared-context/iso-instant.ts

@@ -0,0 +1,43 @@
+/**
+ * Strict ISO-8601 instant validation for shared-context envelopes
+ * (issue #1957 review round 3).
+ *
+ * `Date.parse` is permissive: under the supported Node runtime it reads
+ * `"2026-02-30"` as March 2 and `"1"` as January 1 2001. A caller-supplied
+ * expiry would therefore be silently reinterpreted into a governance deadline
+ * the caller never asked for. Validate the ISO shape AND the calendar
+ * components against the exact input, and reject rather than normalize.
+ *
+ * Extracted from `provenance.ts` so the envelope write path and the
+ * provenance stamp share one validator instead of two copies.
+ */
+
+// Linear ISO instant. No nested quantifiers.
+const ISO_INSTANT =
+  /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+
+/**
+ * True only for a calendar-valid ISO-8601 instant carrying an explicit zone.
+ * Non-strings and non-finite parses are rejected explicitly, never coerced.
+ */
+export function isStrictIsoInstant(value: unknown): boolean {
+  if (typeof value !== "string") return false;
+  const match = ISO_INSTANT.exec(value);
+  if (!match) return false;
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  const hour = Number(match[4]);
+  const minute = Number(match[5]);
+  const second = Number(match[6]);
+  const utc = new Date(Date.UTC(year, month - 1, day, hour, minute, second));
+  return (
+    Number.isFinite(Date.parse(value)) &&
+    utc.getUTCFullYear() === year &&
+    utc.getUTCMonth() === month - 1 &&
+    utc.getUTCDate() === day &&
+    utc.getUTCHours() === hour &&
+    utc.getUTCMinutes() === minute &&
+    utc.getUTCSeconds() === second
+  );
+}

package/src/shared-context/manager.ts

@@ -7,6 +7,14 @@ import type { PluginConfig } from "../types.js";
 import { expandTildePath } from "../utils/path.js";
 import { resolveConversationContextCapabilities } from "../capabilities.js";
 import { throwIfAborted } from "../abort-error.js";
+import {
+  composeWriteEnvelope,
+  envelopeFromScalars,
+  envelopeToFrontmatterLines,
+  resolveReadAuthority,
+  resolveWriteOrigin,
+} from "./envelope-io.js";
+import type { SharedAuthority, SharedEnvelope } from "./governance.js";
 
 export const SharedFeedbackEntrySchema = z.object({
   agent: z.string().min(1),
@@ -311,6 +319,10 @@ interface SharedCrossSignalSource {
   path: string;
   title: string;
   topics: string[];
+  /** Resolved least-privilege authority from the item's envelope (issue #1957). */
+  authority: SharedAuthority;
+  /** Envelope origin agent id; legacy items fall back to the agent field. */
+  sharedBy: string;
 }
 
 interface SharedCrossSignalOverlap {
@@ -436,6 +448,7 @@ export class SharedContextManager {
   private readonly feedbackDir: string;
   private readonly feedbackInboxPath: string;
   private readonly crossSignalsDir: string;
+  private readonly allowBindingAuthority: boolean;
   private readonly dailySynthesisChains = new Map<string, Promise<void>>();
 
   constructor(private readonly config: PluginConfig) {
@@ -449,6 +462,7 @@ export class SharedContextManager {
     this.feedbackDir = path.join(base, "feedback");
     this.feedbackInboxPath = path.join(this.feedbackDir, "inbox.jsonl");
     this.crossSignalsDir = path.join(base, "cross-signals");
+    this.allowBindingAuthority = config.sharedContextAllowBindingAuthority === true;
   }
 
   async ensureStructure(): Promise<void> {
@@ -553,25 +567,61 @@ export class SharedContextManager {
     title: string;
     content: string;
     createdAt?: Date;
+    /** Envelope authority class (issue #1957). Unrecognized values throw. */
+    authority?: string;
+    /** Optional ISO-8601 expiry stamped on the item. */
+    expiresAt?: string;
+    /** Optional id of the shared item this output supersedes. */
+    supersedes?: string;
+    /**
+     * Server-resolved identity of the caller, supplied by the access
+     * surface (issue #1957 review). When present it IS both the producer
+     * and the envelope origin; a disagreeing caller-supplied `agentId` is
+     * rejected so no caller can publish as another agent.
+     */
+    authenticatedIdentity?: string;
+    /**
+     * Server-owned origin token for a write that crosses an external
+     * boundary but resolved no identity (issue #1957 review round 4).
+     * Stamped as the envelope origin (`sharedBy`); the caller label stays
+     * the producer so grouping never collapses.
+     */
+    unattributedOrigin?: string;
   }): Promise<string> {
+    const identity = resolveWriteOrigin({
+      agentId: opts.agentId,
+      authenticatedIdentity: opts.authenticatedIdentity,
+      unattributedOrigin: opts.unattributedOrigin,
+    });
     const createdAt = opts.createdAt ?? new Date();
     const date = ymd(createdAt);
     const time = createdAt.toISOString().slice(11, 19).replace(/:/g, "");
     const slug = safeSlug(opts.title);
-    const agentPathSegment = safePathSegment(opts.agentId, "agentId");
+    const agentPathSegment = safePathSegment(identity.agent, "agentId");
+
+    const envelope = composeWriteEnvelope({
+      origin: identity.origin,
+      authority: opts.authority,
+      expiresAt: opts.expiresAt,
+      supersedes: opts.supersedes,
+      allowBinding: this.allowBindingAuthority,
+    });
 
     const dir = path.join(this.outputsDir, agentPathSegment, date);
     await mkdir(dir, { recursive: true });
 
-    const body =
-      `---\n` +
-      `kind: agent_output\n` +
-      `agent: ${formatFrontmatterScalar(opts.agentId)}\n` +
-      `createdAt: ${createdAt.toISOString()}\n` +
-      `title: ${formatFrontmatterScalar(opts.title.replace(/\n/g, " ").slice(0, 200))}\n` +
-      `---\n\n` +
-      opts.content.trimEnd() +
-      "\n";
+    const body = [
+      "---",
+      "kind: agent_output",
+      `agent: ${formatFrontmatterScalar(identity.agent)}`,
+      `createdAt: ${createdAt.toISOString()}`,
+      `title: ${formatFrontmatterScalar(opts.title.replace(/\n/g, " ").slice(0, 200))}`,
+      ...envelopeToFrontmatterLines(envelope),
+      "---",
+      "",
+      opts.content.trimEnd(),
+      "",
+    ].join("\n");
 
     for (let attempt = 0; attempt < 100; attempt++) {
       const suffix = attempt === 0 ? "" : `-${attempt + 1}`;
@@ -585,7 +635,7 @@ export class SharedContextManager {
       }
     }
 
-    throw new Error(`Unable to allocate unique shared-context output path for ${opts.agentId}`);
+    throw new Error(`Unable to allocate unique shared-context output path for ${identity.agent}`);
   }
 
   async appendFeedback(entry: SharedFeedbackEntry): Promise<void> {
@@ -643,7 +693,7 @@ export class SharedContextManager {
     const maxSummaryItems = Math.max(1, opts.maxSummaryItems ?? 8);
 
     // Collect outputs for the day (best-effort).
-    const outputs: Array<{ agent: string; path: string; title: string; raw: string }> = [];
+    const outputs: Array<{ agent: string; path: string; title: string; raw: string; envelope: SharedEnvelope }> = [];
     try {
       const agents = (await readdir(this.outputsDir, { withFileTypes: true }))
         .sort((a, b) => a.name.localeCompare(b.name));
@@ -657,7 +707,13 @@ export class SharedContextManager {
             const raw = await readFile(p, "utf-8");
             const title = readFrontmatterScalar(raw, "title") ?? f;
             const agent = readFrontmatterScalar(raw, "agent") ?? safeDecodePathSegment(a.name);
-            outputs.push({ agent, path: p, title, raw });
+            const envelope = envelopeFromScalars({
+              sharedBy: readFrontmatterScalar(raw, "sharedBy"),
+              authority: readFrontmatterScalar(raw, "authority"),
+              expiresAt: readFrontmatterScalar(raw, "expiresAt"),
+              supersedes: readFrontmatterScalar(raw, "supersedes"),
+            });
+            outputs.push({ agent, path: p, title, raw, envelope });
           }
         } catch {
           // no outputs for this agent/date
@@ -699,6 +755,8 @@ export class SharedContextManager {
         path: output.path,
         title: output.title,
         topics: extractTopicTokens(`${output.title}\n${body}`),
+        authority: resolveReadAuthority(output.envelope, this.allowBindingAuthority),
+        sharedBy: output.envelope.sharedBy ?? output.agent,
       };
     });
 
@@ -831,7 +889,7 @@ export class SharedContextManager {
       "",
       "## Sources",
       ...(sources.length === 0 ? ["- (none)"] : sources.map((source) =>
-        `- [${markdownLineText(source.agent)}] ${markdownLineText(source.title)} (${markdownLineText(source.path)})`
+        `- [${markdownLineText(source.agent)}] ${markdownLineText(source.title)} (${markdownLineText(source.path)}) [authority: ${source.authority}; sharedBy: ${markdownLineText(source.sharedBy)}]`
       )),
       "",
     ].join("\n");
@@ -870,7 +928,8 @@ export class SharedContextManager {
       "## Notable Agent Outputs",
       ...(crossSignals.report.sources.length === 0
         ? ["- (none)"]
-        : crossSignals.report.sources.map((source) => `- ${source.title} (${source.path})`)),
+        : crossSignals.report.sources.map((source) =>
+            `- ${markdownLineText(source.title)} (${markdownLineText(source.path)}) [authority: ${source.authority}; sharedBy: ${markdownLineText(source.sharedBy)}]`)),
       "",
       "## Feedback (Approve/Reject)",
       ...feedbackLines,

package/src/shared-context/provenance.ts

@@ -5,6 +5,8 @@
  * comes later. Does not mutate the input.
  */
 
+import { isStrictIsoInstant } from "./iso-instant.js";
+
 export interface ProvenanceStamp {
   actor: string;
   at: string;
@@ -15,31 +17,6 @@ export interface StampProvenanceOptions {
   at: string;
 }
 
-// Linear ISO instant. No nested quantifiers.
-const ISO_INSTANT =
-  /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
-
-function isStrictIsoTimestamp(value: string): boolean {
-  const match = ISO_INSTANT.exec(value);
-  if (!match) return false;
-  const year = Number(match[1]);
-  const month = Number(match[2]);
-  const day = Number(match[3]);
-  const hour = Number(match[4]);
-  const minute = Number(match[5]);
-  const second = Number(match[6]);
-  const utc = new Date(Date.UTC(year, month - 1, day, hour, minute, second));
-  return (
-    Number.isFinite(Date.parse(value)) &&
-    utc.getUTCFullYear() === year &&
-    utc.getUTCMonth() === month - 1 &&
-    utc.getUTCDate() === day &&
-    utc.getUTCHours() === hour &&
-    utc.getUTCMinutes() === minute &&
-    utc.getUTCSeconds() === second
-  );
-}
-
 function requireActor(actor: string): string {
   if (typeof actor !== "string" || actor.trim().length === 0) {
     throw new Error("stampProvenance: actor must be a non-empty string");
@@ -48,7 +25,7 @@ function requireActor(actor: string): string {
 }
 
 function requireAt(at: unknown): string {
-  if (typeof at !== "string" || !isStrictIsoTimestamp(at)) {
+  if (typeof at !== "string" || !isStrictIsoInstant(at)) {
     throw new Error("stampProvenance: at must be a valid ISO-8601 timestamp");
   }
   return at;

package/src/shared-context/write-origin.test.ts

@@ -0,0 +1,145 @@
+/**
+ * Regression: shared-context write origin is server-derived (issue #1957
+ * review rounds 2-4). A caller-supplied `agentId` must never decide the
+ * governance envelope's origin: when the surface resolved an authenticated
+ * identity, that identity is stamped as `sharedBy`, and an `agentId` naming
+ * a different agent is rejected instead of silently overridden. An
+ * authenticated access write that resolved NO principal (round 4) stamps the
+ * reserved server-owned `unattributed:access-surface` origin — never the
+ * client's `agentId`, which survives only as the producer label that feeds
+ * grouping and display.
+ *
+ * Exercises the REAL manager write path, the REAL access-service adapter, and
+ * the REAL operation registry — no stubbed provenance.
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+import os from "node:os";
+import path from "node:path";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+
+import "../access-operations.js";
+import { getOperation } from "../access-boundary.js";
+import { EngramAccessInputError, EngramAccessService, type EngramAccessService as Service } from "../access-service.js";
+import type { Orchestrator } from "../orchestrator.js";
+import { SharedContextManager } from "./manager.js";
+import { parseConfig } from "../config.js";
+
+async function makeManager() {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "remnic-shared-origin-"));
+  const config = parseConfig({ sharedContextEnabled: true, sharedContextDir: dir, memoryDir: dir });
+  const manager = new SharedContextManager(config);
+  await manager.ensureStructure();
+  return { manager, dir, config };
+}
+
+test("manager: authenticated identity is the origin and a mismatched agentId is rejected", async (t) => {
+  const { manager, dir } = await makeManager();
+  t.after(() => rm(dir, { recursive: true, force: true }));
+
+  await assert.rejects(
+    manager.writeAgentOutput({
+      agentId: "victim-agent",
+      title: "Spoofed",
+      content: "x",
+      authenticatedIdentity: "real-agent",
+    }),
+    /write origin mismatch/,
+  );
+
+  const fp = await manager.writeAgentOutput({
+    agentId: "",
+    title: "Owned",
+    content: "x",
+    authenticatedIdentity: "real-agent",
+  });
+  const raw = await readFile(fp, "utf-8");
+  assert.match(raw, /^sharedBy: "real-agent"$/m);
+  assert.match(raw, /^agent: "real-agent"$/m);
+  assert.ok(
+    fp.includes(`${path.sep}agent-outputs${path.sep}real-agent${path.sep}`),
+    "the write lands in the authenticated agent's directory",
+  );
+
+  // No resolvable identity (in-process caller): the supplied agent id stands.
+  const local = await manager.writeAgentOutput({ agentId: "local-agent", title: "Local", content: "x" });
+  assert.match(await readFile(local, "utf-8"), /^sharedBy: "local-agent"$/m);
+});
+
+test("access service: the authenticated principal, not the request, stamps the origin", async (t) => {
+  const { manager, dir, config } = await makeManager();
+  t.after(() => rm(dir, { recursive: true, force: true }));
+  const service = new EngramAccessService({ config, sharedContext: manager } as unknown as Orchestrator);
+
+  await assert.rejects(
+    () =>
+      service.sharedContextWriteOutput({
+        agentId: "victim-agent",
+        title: "Spoofed",
+        content: "x",
+        principal: "real-principal",
+      }) as Promise<unknown>,
+    (error: unknown) => {
+      assert.ok(error instanceof EngramAccessInputError, "a spoofed origin is a client input error");
+      assert.match(error.message, /write origin mismatch/);
+      return true;
+    },
+  );
+
+  const result = (await service.sharedContextWriteOutput({
+    agentId: "real-principal",
+    title: "Owned",
+    content: "x",
+
+    principal: "real-principal",
+  })) as { written: boolean; path: string };
+  assert.equal(result.written, true);
+  assert.match(await readFile(result.path, "utf-8"), /^sharedBy: "real-principal"$/m);
+});
+
+test("access service: a principal-less authenticated write never stamps the caller's agentId as sharedBy", async (t) => {
+  const { manager, dir, config } = await makeManager();
+  t.after(() => rm(dir, { recursive: true, force: true }));
+  const service = new EngramAccessService({ config, sharedContext: manager } as unknown as Orchestrator);
+
+  // The default request-identity path: bearer-authenticated surface, no
+  // configured principal, no adapter identity — principal resolves to
+  // undefined. The client's `agentId` must not become audit metadata.
+  const result = (await service.sharedContextWriteOutput({
+    agentId: "claimed-agent",
+    title: "Principal-less",
+    content: "x",
+  })) as { written: boolean; path: string };
+  assert.equal(result.written, true);
+  const raw = await readFile(result.path, "utf-8");
+  assert.match(raw, /^sharedBy: "unattributed:access-surface"$/m);
+  assert.doesNotMatch(raw, /^sharedBy: "claimed-agent"$/m);
+  // The producer label survives for grouping/display — it is not audit
+  // metadata and collapsing it would erase multi-agent overlaps.
+  assert.match(raw, /^agent: "claimed-agent"$/m);
+});
+
+test("operation: shared_context_write_output forwards the authenticated principal", async () => {
+  let received: { agentId: string; principal?: string } | undefined;
+  const service = {
+    sharedContextWriteOutput: async (request: {
+      agentId: string;
+      title: string;
+      content: string;
+      principal?: string;
+    }) => {
+      received = request;
+      return { written: true, path: "written.md" };
+    },
+  } as unknown as Service;
+  const operation = getOperation("shared_context_write_output");
+  assert.ok(operation);
+
+  await operation.run(
+    { agentId: "claimed-agent", title: "t", content: "c" },
+    { service, authenticatedPrincipal: "real-principal" },
+  );
+  assert.equal(received?.principal, "real-principal");
+  assert.equal(received?.agentId, "claimed-agent");
+});

package/src/types.ts

@@ -12,6 +12,7 @@ import type { GraphPathScoringConfig } from "./graph-path-scoring-config.js";
 export type { ContradictionLocalizationConfig, ContradictionScanConfig } from "./contradiction-config.js";
 export type { GraphPathScoringConfig } from "./graph-path-scoring-config.js";
 import type { DriftDetectionSettings, MemoryDriftProvenance, RecallDriftAnnotation } from "./preferences/drift-types.js";
+import type { DeepRecallSettings } from "./deep-recall-config.js";
 import type { ProceduralMaintenanceConfig } from "./procedural/maintenance-config.js";
 import type { SkillProjectionConfig } from "./procedural/skill-projection.js";
 import type { ActionGateConfig } from "./coding/action-gate.js";
@@ -682,7 +683,7 @@ export interface SemanticChunkingConfigShape {
   fallbackToRecursive: boolean;
 }
 
-export interface PluginConfig extends BoundedJsonlStateConfig, SecurityConfig, DriftDetectionSettings, ActiveContextConfigFields {
+export interface PluginConfig extends BoundedJsonlStateConfig, SecurityConfig, DriftDetectionSettings, ActiveContextConfigFields, DeepRecallSettings {
   openaiApiKey: string | undefined;
   openaiBaseUrl: string | undefined;
   model: string;
@@ -1806,6 +1807,7 @@ export interface PluginConfig extends BoundedJsonlStateConfig, SecurityConfig, D
   sharedContextEnabled: boolean;
   sharedContextDir?: string;
   sharedContextMaxInjectChars: number;
+  sharedContextAllowBindingAuthority: boolean;
   crossSignalsSemanticEnabled: boolean;
   crossSignalsSemanticTimeoutMs: number;
   sharedCrossSignalSemanticEnabled?: boolean;