@remnic/core 9.7.15 → 9.9.0

package/dist/write-envelope.d.ts

@@ -0,0 +1,282 @@
+import { w as MemoryCategory } from './types-D_fG2ix8.js';
+import './message-parts/index.js';
+import './bounded-jsonl-state.js';
+import './types-continuity.js';
+
+/**
+ * Sealed memory-write envelope (issue #1989, umbrella #1988).
+ *
+ * THE single stamping point for cross-cutting memory-creation fields.
+ *
+ * Why this exists: PR #1852 needed 27 rework commits because adding one
+ * cross-cutting field (`sourceConnector`) required hand-editing every
+ * write call site and every idempotency payload, and reviewers discovered
+ * missed sites one round at a time. This module removes the fan-out:
+ *
+ *   1. `composeMemoryEnvelope()` is the only way to mint a
+ *      `SealedMemoryEnvelope` — the brand is a non-exported `unique symbol`,
+ *      so a hand-built object literal fails `tsc` (`npm run check-types`
+ *      is already a required repo-wide gate; the type system IS the fence).
+ *   2. `buildWriteIdempotencyPayload()` derives every access-surface
+ *      idempotency payload from ONE ordered field registry
+ *      (`WRITE_FINGERPRINT_FIELDS`). Adding a fingerprint-relevant field is
+ *      a one-line registry change picked up by every surface; forgetting to
+ *      classify a new `MemoryWriteInput` field is a compile error (see the
+ *      exhaustiveness guards at the bottom of this file).
+ *
+ * PR1 scope (no call-site changes): the composer, the registry, and the
+ * payload builder, fully tested. PR2–PR4 migrate storage entry points and
+ * the write call sites onto this module (see #1989 for the slicing).
+ */
+
+/**
+ * Every cross-cutting memory-creation field lives HERE and only here.
+ *
+ * When you add a field you MUST also add it to either
+ * `WRITE_FINGERPRINT_FIELDS` or `FINGERPRINT_EXEMPT_FIELDS` — the
+ * exhaustiveness guard below makes forgetting a compile error.
+ */
+interface MemoryWriteInput {
+    /** Raw memory content. Must be non-empty after trimming. */
+    content: string;
+    /** Memory category — validated against the canonical category set. */
+    category: MemoryCategory;
+    /** Free-form labels; normalized (trim/dedupe) and capped, see TAG_LIMITS. */
+    tags?: string[];
+    /** String→string structured attributes; non-string values are rejected. */
+    structuredAttributes?: Record<string, string>;
+    /** Entity file reference (e.g. `person-jane-doe`). */
+    entityRef?: string;
+    /** Extraction confidence in [0, 1]. */
+    confidence?: number;
+    /** Opaque TTL expression (e.g. `90d` or an ISO date) — validated non-empty. */
+    ttl?: string;
+    /** Event-time validity start (ISO 8601). */
+    validAt?: string;
+    /** Connector identity that produced this write (issue #1852). */
+    sourceConnector?: string;
+    /** Human-readable provenance note. */
+    sourceReason?: string;
+}
+/** Context supplied by the write path, not by the payload author. */
+interface WriteContext {
+    /** Frontmatter `source` string (e.g. `extraction`, `wearable:bee`). */
+    source: string;
+    /** Clock override for tests. */
+    now?: () => Date;
+}
+/** Scope facts that participate in idempotency but never in frontmatter. */
+interface FingerprintScope {
+    /** Access surface performing the write (e.g. `memory_store`, `observe`). */
+    surface: string;
+    namespace?: string;
+    principal?: string;
+    codingContext?: string;
+}
+declare const TAG_LIMITS: Readonly<{
+    /** Maximum number of tags persisted per memory. */
+    maxTags: 50;
+    /** Maximum length of a single tag. */
+    maxTagLength: 256;
+}>;
+declare const STRUCTURED_ATTRIBUTE_LIMITS: Readonly<{
+    /** Maximum number of structured attributes per memory. */
+    maxEntries: 64;
+    /** Maximum length of one attribute key. */
+    maxKeyLength: 128;
+    /** Maximum length of one attribute value. */
+    maxValueLength: 1024;
+}>;
+declare function isMemoryCategory(value: string): value is MemoryCategory;
+declare const sealed: unique symbol;
+/**
+ * A normalized, validated memory-write envelope.
+ *
+ * Opaque: only `composeMemoryEnvelope()` can mint one. Storage creation
+ * entry points accept this type (PR2), so every write path is forced
+ * through the composer at compile time.
+ */
+interface SealedMemoryEnvelope {
+    readonly [sealed]: true;
+    /**
+     * Caller-supplied content VERBATIM (validated non-empty-after-trim).
+     * `StorageManager.writeMemory` persists content byte-for-byte (callers
+     * that trim, e.g. explicit capture, do so before composing), so the
+     * envelope must not transform it — the earlier compose-time trim/sanitize
+     * broke byte-parity with extraction writes and was removed in PR2.
+     */
+    readonly content: string;
+    /**
+     * The exact body persistence will write: attribute-suffix enrichment then
+     * combined sanitization, produced by the SAME `assemblePersistedBody`
+     * helper `writeMemory` uses (issue #1989 PR2; AGENTS.md §13). This is the
+     * form write-idempotency fingerprints hash.
+     */
+    readonly persistedBody: string;
+    /** Injection patterns matched during body assembly (empty = clean). */
+    readonly sanitizeViolations: readonly string[];
+    /**
+     * Salvage-mode hygiene notes (empty in strict mode): each dropped/clamped
+     * invalid optional field is recorded here — visible, never silent
+     * (repo rule 34). Callers persisting machine-generated input log these.
+     */
+    readonly salvageNotes: readonly string[];
+    readonly category: MemoryCategory;
+    readonly tags: readonly string[];
+    /**
+     * CANONICAL attributes (keys trim+lowercase, values trim) — the form
+     * fingerprints and downstream consumers use; stable across caller casing.
+     */
+    readonly structuredAttributes: Readonly<Record<string, string>> | undefined;
+    /**
+     * The validated ORIGINAL attribute map, byte-preserved. `writeMemory`
+     * persists frontmatter attributes raw (canonicalizing only the body
+     * suffix via normalizeAttributePairs) — a pre-existing raw/canonical
+     * inconsistency (supersession keys read the raw form). The sealed path
+     * preserves those bytes; canonicalizing the frontmatter at the storage
+     * boundary is a follow-up once the legacy path retires (#1989 PR4).
+     */
+    readonly rawStructuredAttributes: Readonly<Record<string, string>> | undefined;
+    readonly entityRef: string | undefined;
+    readonly confidence: number | undefined;
+    readonly ttl: string | undefined;
+    readonly validAt: string | undefined;
+    readonly sourceConnector: string | undefined;
+    readonly sourceReason: string | undefined;
+    readonly source: string;
+    /** ISO timestamp the envelope was composed (from ctx.now). */
+    readonly composedAt: string;
+}
+/**
+ * Compose-time input hygiene mode (issue #1989 PR2, review round on #2014).
+ *
+ * - `strict` (default): every invalid field throws — correct for OPERATOR
+ *   and API input (explicit capture, memory_store), where a bad value is a
+ *   caller bug that must surface.
+ * - `salvage`: for MACHINE-GENERATED input (LLM extraction, wearable
+ *   ingestion). One malformed fact from an extractor must not abort a whole
+ *   persistence batch that legacy `writeMemory` would have accepted.
+ *   Invalid tags/attributes/optional fields are DROPPED with a note pushed
+ *   to `envelope.salvageNotes` — visible, never silent (repo rule 34);
+ *   callers log the notes. Content, category, ctx.source, and validAt stay
+ *   FATAL in both modes (legacy writeMemory also throws on bad validAt, and
+ *   a write without valid content/category cannot proceed).
+ */
+interface ComposeEnvelopeOptions {
+    salvage?: boolean;
+}
+/**
+ * Compose (normalize + validate + seal) a memory-write envelope.
+ *
+ * Strict mode (default) throws on any invalid input — never silently
+ * defaults (AGENTS.md §1/§39). Salvage mode (`{ salvage: true }`, for
+ * machine-generated input like LLM extraction) drops invalid OPTIONAL
+ * fields with notes on `envelope.salvageNotes` instead of aborting the
+ * batch; content/category/source/validAt stay fatal in both modes.
+ */
+declare function composeMemoryEnvelope(input: MemoryWriteInput, ctx: WriteContext, opts?: ComposeEnvelopeOptions): SealedMemoryEnvelope;
+/**
+ * Runtime check (belt) — the compile-time brand is the real fence.
+ *
+ * Fast path: WeakSet membership (same module graph). Fallback: RE-COMPOSITION
+ * EQUIVALENCE — Node resolves `@remnic/core` through `dist/` for built
+ * consumers and `src/` for tsx-loaded tests, and each graph gets its OWN
+ * WeakSet, so identity alone would reject genuinely-sealed envelopes that
+ * crossed a build boundary. The structural arm requires frozen DATA-only
+ * properties (no accessors — TOCTOU guard, round 4), then re-runs the
+ * STRICT composer on the candidate's own inputs and demands every envelope
+ * field reproduce exactly (#2014 round 2: shape-only validation admitted
+ * lookalikes with 51 tags or out-of-range confidence). A value that
+ * survives has, by construction, passed every composer invariant, and its
+ * fields cannot change between validation and the write that follows.
+ *
+ * `salvageNotes` is deliberately NOT compared: a legitimately salvage-minted
+ * envelope carries notes while the strict re-composition of its (already
+ * clean) surviving fields yields none. Notes are advisory provenance, not
+ * identity — every load-bearing field is still verified.
+ */
+declare function isSealedMemoryEnvelope(value: unknown): value is SealedMemoryEnvelope;
+/**
+ * The ONE mapping from a sealed envelope (+ extras) to the legacy
+ * `writeMemory(category, content, options)` argument shape. Used by
+ * `StorageManager.writeSealedMemory` AND by test doubles that stub storage —
+ * so mock fidelity (AGENTS.md §21) cannot drift from production.
+ */
+declare function sealedWriteToLegacyArgs(envelope: SealedMemoryEnvelope, extras?: Record<string, unknown>): {
+    category: MemoryCategory;
+    content: string;
+    options: Record<string, unknown>;
+};
+/**
+ * Ordered registry of envelope fields that participate in write-idempotency
+ * fingerprints. Adding a fingerprint-relevant field = one entry here; every
+ * surface that builds its payload via `buildWriteIdempotencyPayload()` picks
+ * it up automatically.
+ */
+declare const WRITE_FINGERPRINT_FIELDS: readonly ["content", "category", "tags", "structuredAttributes", "entityRef", "ttl", "validAt", "sourceConnector"];
+/**
+ * Envelope fields deliberately EXCLUDED from fingerprints. Exempting a field
+ * is a visible, reviewable decision — this list exists so the exhaustiveness
+ * guard can force every new `MemoryWriteInput` field to be classified.
+ */
+declare const FINGERPRINT_EXEMPT_FIELDS: readonly ["confidence", "sourceReason"];
+/** Scope keys always folded into the fingerprint payload. */
+declare const FINGERPRINT_SCOPE_FIELDS: readonly ["surface", "namespace", "principal", "codingContext"];
+/**
+ * Build the canonical write-idempotency payload for a sealed envelope.
+ *
+ * Determinism guarantees (AGENTS.md §26):
+ *   - tags are SORTED in the payload (tag order never changes identity);
+ *   - structured attributes are serialized key-sorted by the existing
+ *     `stableStringify` inside `hashAccessIdempotencyPayload`;
+ *   - the payload shape is versioned (`v: 1`) so a future field-semantics
+ *     change can migrate stored idempotency state explicitly instead of
+ *     silently colliding.
+ *
+ * Feed the result to `hashAccessIdempotencyPayload()` — this module does
+ * not hash so surfaces keep a single hashing implementation.
+ */
+declare function buildWriteIdempotencyPayload(envelope: SealedMemoryEnvelope, scope: FingerprintScope): Record<string, unknown>;
+/** The raw request fields the write surfaces fingerprint (legacy shape). */
+interface AccessWriteFingerprintParts {
+    schemaVersion: number;
+    namespace: string;
+    content: string;
+    category?: string;
+    confidence?: number;
+    tags?: string[];
+    entityRef?: string;
+    ttl?: string;
+    sourceReason?: string;
+    sourceConnector?: string;
+}
+/**
+ * Fingerprint payload for `memory_store` / `suggestion_submit` (write AND
+ * peek paths — both MUST call this so peek can never diverge from the
+ * write it predicts). Key set and values reproduce the historical inline
+ * literals exactly; `hashAccessIdempotencyPayload`'s stableStringify sorts
+ * keys and drops `undefined`, so optional absent fields hash identically
+ * to the old shape.
+ */
+declare function buildAccessWriteRequestFingerprint(parts: AccessWriteFingerprintParts): Record<string, unknown>;
+/** The raw request fields the observe surface fingerprints (legacy shape). */
+interface ObserveFingerprintParts {
+    sessionKey: string;
+    messages: unknown;
+    namespace?: string;
+    skipExtraction?: boolean;
+    authenticatedPrincipal?: string;
+    cwd?: string;
+    projectTag?: string;
+    /** Resolved coding context — `null` (not undefined) when absent, matching the historical literal. */
+    effectiveCodingContext: unknown;
+    sourceConnector?: string;
+}
+/**
+ * Fingerprint payload for `observe` — turn ingestion, not a memory write,
+ * so it fingerprints session/message identity rather than MemoryWriteInput
+ * fields. Shape reproduces the historical inline literal exactly.
+ */
+declare function buildObserveRequestFingerprint(parts: ObserveFingerprintParts): Record<string, unknown>;
+
+export { type AccessWriteFingerprintParts, type ComposeEnvelopeOptions, FINGERPRINT_EXEMPT_FIELDS, FINGERPRINT_SCOPE_FIELDS, type FingerprintScope, type MemoryWriteInput, type ObserveFingerprintParts, STRUCTURED_ATTRIBUTE_LIMITS, type SealedMemoryEnvelope, TAG_LIMITS, WRITE_FINGERPRINT_FIELDS, type WriteContext, buildAccessWriteRequestFingerprint, buildObserveRequestFingerprint, buildWriteIdempotencyPayload, composeMemoryEnvelope, isMemoryCategory, isSealedMemoryEnvelope, sealedWriteToLegacyArgs };

package/dist/write-envelope.js

@@ -0,0 +1,35 @@
+import {
+  FINGERPRINT_EXEMPT_FIELDS,
+  FINGERPRINT_SCOPE_FIELDS,
+  STRUCTURED_ATTRIBUTE_LIMITS,
+  TAG_LIMITS,
+  WRITE_FINGERPRINT_FIELDS,
+  buildAccessWriteRequestFingerprint,
+  buildObserveRequestFingerprint,
+  buildWriteIdempotencyPayload,
+  composeMemoryEnvelope,
+  isMemoryCategory,
+  isSealedMemoryEnvelope,
+  sealedWriteToLegacyArgs
+} from "./chunk-CGASUJVP.js";
+import "./chunk-R3DJVOSM.js";
+import "./chunk-BT7NVCML.js";
+import "./chunk-5GKPFL3S.js";
+import "./chunk-JAKIDQB2.js";
+import "./chunk-P7FMDTKL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  FINGERPRINT_EXEMPT_FIELDS,
+  FINGERPRINT_SCOPE_FIELDS,
+  STRUCTURED_ATTRIBUTE_LIMITS,
+  TAG_LIMITS,
+  WRITE_FINGERPRINT_FIELDS,
+  buildAccessWriteRequestFingerprint,
+  buildObserveRequestFingerprint,
+  buildWriteIdempotencyPayload,
+  composeMemoryEnvelope,
+  isMemoryCategory,
+  isSealedMemoryEnvelope,
+  sealedWriteToLegacyArgs
+};
+//# sourceMappingURL=write-envelope.js.map

package/dist/write-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/write-quarantine.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Dead-letter quarantine for writes rejected by the namespace write-ACL
+ * (issue #1888).
+ *
+ * When `observe` / `memory_store` / `suggestion_submit` fail namespace
+ * authorization, the payload used to be dropped with no recoverable copy: a
+ * client configured with a namespace that matches no policy (and is not the
+ * default/shared namespace) had every write in the window silently destroyed.
+ * The ACL rejection is CORRECT and stays fail-closed; this store only
+ * preserves the payload so it can be replayed after the config is fixed,
+ * following the AGENTS.md "reject loudly but never destroy state" posture
+ * (patterns 14/42).
+ *
+ * Records live OUTSIDE any memory namespace at
+ * `<memoryDir>/state/quarantine/<principalSafe>/<timestamp>-<id>.json`, keyed
+ * by the encoded principal, and are bounded per principal by count and age.
+ * Every path is resolved from `memoryDir` through `resolveSafeStoragePath`, so
+ * a symlinked `state`/`quarantine` cannot redirect writes outside the memory
+ * directory. The store never re-routes a payload into a writable namespace.
+ */
+type QuarantineOperation = "observe" | "memory_store" | "suggestion_submit";
+interface QuarantineEntryInput {
+    operation: QuarantineOperation;
+    /** Authenticated principal the write was attributed to, if any. */
+    principal: string | undefined;
+    /** Namespace the caller attempted to write and was denied. */
+    attemptedNamespace: string;
+    /** The original request payload, preserved verbatim for replay. */
+    payload: unknown;
+    /** ISO timestamp; defaults to now. Injectable for deterministic tests. */
+    timestamp?: string;
+}
+interface QuarantinedRecord {
+    operation: QuarantineOperation;
+    principal: string | null;
+    attemptedNamespace: string;
+    timestamp: string;
+    payload: unknown;
+}
+/** A quarantined record paired with the absolute on-disk path it was read from. */
+interface QuarantineEntry {
+    record: QuarantinedRecord;
+    path: string;
+}
+interface QuarantineCaps {
+    /** Keep at most this many records per principal (newest win). */
+    maxEntriesPerPrincipal: number;
+    /** Drop records older than this many milliseconds. */
+    maxAgeMs: number;
+}
+declare const DEFAULT_QUARANTINE_CAPS: QuarantineCaps;
+declare class WriteQuarantineStore {
+    private readonly caps;
+    private readonly memoryDir;
+    constructor(memoryDir: string, caps?: QuarantineCaps);
+    /** Absolute quarantine root (`<memoryDir>/state/quarantine`). */
+    get root(): string;
+    /**
+     * Resolve a path under the quarantine root, checked for containment and
+     * symlink traversal from `memoryDir` down — so a symlinked `state` or
+     * `quarantine` component that escapes the memory directory is rejected.
+     */
+    private safeDir;
+    /**
+     * Park a rejected write. Returns the absolute path of the record written.
+     * Prunes the principal's bucket to the configured caps afterward.
+     */
+    quarantine(input: QuarantineEntryInput): Promise<string>;
+    /**
+     * All valid, non-expired quarantined records across every principal, oldest
+     * first, each paired with its absolute on-disk path. Expired records are
+     * deleted on read (lazy GC), so an inactive principal bucket with no
+     * follow-up write is still bounded by age.
+     */
+    entries(): Promise<QuarantineEntry[]>;
+    /** As {@link entries} but projected to records only (backward-compatible view). */
+    list(): Promise<QuarantinedRecord[]>;
+    /**
+     * Delete one quarantined entry by its absolute on-disk path (as returned by
+     * {@link entries}). The path MUST resolve inside the quarantine root, mirroring
+     * the store's containment posture; a path outside the root — or one already
+     * absent — removes nothing. Returns true only when a file was actually deleted.
+     */
+    removeEntry(entryPath: string): Promise<boolean>;
+    /** Total valid, non-expired quarantined record count across every principal. */
+    count(): Promise<number>;
+    /** lstat (no symlink follow): true only for a real directory. */
+    private isRealDir;
+    private principalDirs;
+    private entryFiles;
+    private pruneDir;
+}
+
+export { DEFAULT_QUARANTINE_CAPS, type QuarantineCaps, type QuarantineEntry, type QuarantineEntryInput, type QuarantineOperation, type QuarantinedRecord, WriteQuarantineStore };

package/dist/write-quarantine.js

@@ -0,0 +1,11 @@
+import {
+  DEFAULT_QUARANTINE_CAPS,
+  WriteQuarantineStore
+} from "./chunk-PJSK6OJM.js";
+import "./chunk-FF4KLI5W.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DEFAULT_QUARANTINE_CAPS,
+  WriteQuarantineStore
+};
+//# sourceMappingURL=write-quarantine.js.map

package/dist/write-quarantine.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/write-rate-limiter.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Per-principal write rate limiter for the access HTTP surface
+ * (issues #1937 / #2029).
+ *
+ * Extracted from access-http.ts so the limiter is a cohesive unit. Each
+ * principal (authenticated caller identity) gets its own rolling-window
+ * bucket, so one chatty connector cannot starve writes for the others;
+ * requests with no resolved principal share a single global bucket.
+ *
+ * Deliberately transport-agnostic: it never throws `HttpError` — callers
+ * translate a refusal into their own 429. It logs a sampled warning when it
+ * refuses a write, so a sustained limit condition is diagnosable server-side
+ * (previously the refusal was a bare throw with no trace).
+ */
+type Slot = {
+    readonly recordedAt: number;
+};
+declare class WriteRateLimiter {
+    readonly maxRequests: number;
+    readonly windowMs: number;
+    private readonly buckets;
+    private lastLogAt;
+    private suppressed;
+    constructor(maxRequests?: number, windowMs?: number);
+    private key;
+    private prune;
+    /** Prune every bucket to the current window; drop buckets that go empty. */
+    private sweep;
+    /** Live reservation/record count for a principal (test/introspection). */
+    slotsFor(principal?: string): ReadonlyArray<Slot>;
+    /** Total live reservations across all principals (test/introspection). */
+    totalSlots(): number;
+    /** True if a write may proceed for the principal. Logs (sampled) when not. */
+    hasCapacity(principal?: string): boolean;
+    /** Record a committed write against the principal's rolling window. */
+    record(principal?: string): void;
+    /**
+     * Reserve a slot for an in-flight write. Returns a release function, or
+     * `null` when the principal is already at the limit (caller raises its 429).
+     */
+    reserve(principal?: string): (() => void) | null;
+    private logRejected;
+}
+
+export { WriteRateLimiter };

package/dist/write-rate-limiter.js

@@ -0,0 +1,9 @@
+import {
+  WriteRateLimiter
+} from "./chunk-MKQBXQKU.js";
+import "./chunk-3WCASNQZ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  WriteRateLimiter
+};
+//# sourceMappingURL=write-rate-limiter.js.map

package/dist/write-rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.7.15",
+  "version": "9.9.0",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -16,6 +16,11 @@
       "remnic-source": "./src/abort-error.ts",
       "import": "./dist/abort-error.js"
     },
+    "./salvage-envelope": {
+      "types": "./dist/salvage-envelope.d.ts",
+      "remnic-source": "./src/salvage-envelope.ts",
+      "import": "./dist/salvage-envelope.js"
+    },
     "./abort-error.js": {
       "types": "./dist/abort-error.d.ts",
       "remnic-source": "./src/abort-error.ts",
@@ -1655,6 +1660,16 @@
       "remnic-source": "./src/objective-state.ts",
       "import": "./dist/objective-state.js"
     },
+    "./offline-sync-exclude-globs": {
+      "types": "./dist/offline-sync-exclude-globs.d.ts",
+      "remnic-source": "./src/offline-sync-exclude-globs.ts",
+      "import": "./dist/offline-sync-exclude-globs.js"
+    },
+    "./offline-sync-exclude-globs.js": {
+      "types": "./dist/offline-sync-exclude-globs.d.ts",
+      "remnic-source": "./src/offline-sync-exclude-globs.ts",
+      "import": "./dist/offline-sync-exclude-globs.js"
+    },
     "./openai-chat-compat": {
       "types": "./dist/openai-chat-compat.d.ts",
       "remnic-source": "./src/openai-chat-compat.ts",
@@ -2954,6 +2969,26 @@
       "types": "./dist/work/types.d.ts",
       "remnic-source": "./src/work/types.ts",
       "import": "./dist/work/types.js"
+    },
+    "./write-envelope": {
+      "types": "./dist/write-envelope.d.ts",
+      "remnic-source": "./src/write-envelope.ts",
+      "import": "./dist/write-envelope.js"
+    },
+    "./write-envelope.js": {
+      "types": "./dist/write-envelope.d.ts",
+      "remnic-source": "./src/write-envelope.ts",
+      "import": "./dist/write-envelope.js"
+    },
+    "./write-quarantine": {
+      "types": "./dist/write-quarantine.d.ts",
+      "remnic-source": "./src/write-quarantine.ts",
+      "import": "./dist/write-quarantine.js"
+    },
+    "./write-quarantine.js": {
+      "types": "./dist/write-quarantine.d.ts",
+      "remnic-source": "./src/write-quarantine.ts",
+      "import": "./dist/write-quarantine.js"
     }
   },
   "files": [
@@ -3010,7 +3045,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.7.15"
+    "@remnic/coding-graph": "^9.9.0"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/access-admin-ops-surface.ts

@@ -17,6 +17,7 @@ import { type CapsuleListEntry, defaultCapsulesDir } from "./capsule-cli.js";
 import { resolveCodingNamespaceOverlay } from "./coding/coding-namespace.js";
 import { type GraphSnapshotNodeMetadata, type GraphSnapshotRequest, type GraphSnapshotResponse, buildGraphSnapshot } from "./graph-snapshot.js";
 import { log } from "./logger.js";
+import { composeMemoryEnvelope } from "./write-envelope.js";
 import { buildQualityScore, groupActionsByStatus, listMemoryGovernanceRuns, readMemoryGovernanceRunArtifact, runMemoryGovernance } from "./maintenance/memory-governance.js";
 import { resolveScopeProfilePlan } from "./namespaces/scope-profiles.js";
 import type { Orchestrator } from "./orchestrator.js";
@@ -779,21 +780,30 @@ export class AccessAdminOpsSurface {
       },
       writePromotedMemory: async (namespace, memory) => {
         const resolved = await this.deps.orchestrator.getStorage(namespace);
-        const { id, tombstoneBlocked } = await resolved.writeMemory(
-          memory.category,
-          memory.content,
+        // Sealed-envelope write (issue #1989 PR4): an admin promotion
+        // REPLAYS a stored memory into another namespace — legacy rows may
+        // predate current field limits, so salvage (drops warn-logged).
+        const promotionEnvelope = composeMemoryEnvelope(
           {
+            content: memory.content,
+            category: memory.category,
             confidence: memory.confidence,
             tags: memory.tags,
             entityRef: memory.entityRef,
-            source: `admin-promotion:${memory.sourceNamespace}:${memory.reason.slice(0, 120)}`,
-            lineage: memory.lineage,
-            sourceMemoryId: memory.sourceMemoryId,
-            actor: memory.actor,
             validAt: memory.validAt,
             ...(memory.sourceConnector ? { sourceConnector: memory.sourceConnector } : {}),
           },
+          { source: `admin-promotion:${memory.sourceNamespace}:${memory.reason.slice(0, 120)}` },
+          { salvage: true },
         );
+        if (promotionEnvelope.salvageNotes.length > 0) {
+          log.warn(`admin-promotion write salvaged invalid fields: ${promotionEnvelope.salvageNotes.join("; ")}`);
+        }
+        const { id, tombstoneBlocked } = await resolved.writeSealedMemory(promotionEnvelope, {
+          lineage: memory.lineage,
+          sourceMemoryId: memory.sourceMemoryId,
+          actor: memory.actor,
+        });
         // #1645: a tombstone-blocked promotion lands pending_review (no active
         // copy in the target). Report it as a failed promotion so the admin
         // sees an honest result — the content is queued for review, not

package/src/access-boundary.test.ts

@@ -272,3 +272,31 @@ test("fleetWide flag is inert for normal (non-fleet-wide) ops under a scoped tok
   assert.deepEqual(result, { ok: true });
   assert.equal(ran, true, "a non-fleet-wide op runs normally for a scoped token");
 });
+
+test("allowedByOps: an op is granted by any listed op, not just its own name", async () => {
+  let ran = false;
+  __resetRegistryForTest();
+  const op = defineOperation({
+    name: "namespace_writable",
+    description: "test allowedByOps",
+    allowedByOps: ["namespace_writable", "observe", "memory_store"],
+    schema: z.object({}),
+    handler: async () => {
+      ran = true;
+      return { ok: true };
+    },
+  });
+  // A token scoped to observe (but NOT namespace_writable) reaches the handler.
+  const result = await tokenCapabilityStore.run({ version: 1, ops: ["observe"] }, () =>
+    op.run({}, ctx(makeMockService())),
+  );
+  assert.deepEqual(result, { ok: true });
+  assert.equal(ran, true, "an observe-scoped token is granted via allowedByOps");
+  // A token carrying none of the granting ops is rejected before the handler.
+  ran = false;
+  await assert.rejects(
+    () => tokenCapabilityStore.run({ version: 1, ops: ["recall"] }, () => op.run({}, ctx(makeMockService()))),
+    (err: unknown) => err instanceof EngramAccessForbiddenError,
+  );
+  assert.equal(ran, false, "a token without any granting op is rejected before the handler");
+});