@sema-agent/core 5.53.0 → 5.55.0

package/dist/core/memory-engine/tools.js

@@ -1,9 +1,10 @@
 import { Type } from "typebox";
 import { errorResult } from "../tools.js";
-import { defuseFenceMarkers, delimitUntrusted, inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
+import { defuseFenceMarkers, delimitUntrusted, FENCED_LANE_ENVELOPE_TAGS, inlineUntrusted, sanitizeUntrustedText } from "../untrusted-text.js";
 import { formatMemoryAge } from "../memory-recall.js";
 import { committedOriginOf } from "./frontmatter.js";
 import { MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, MEMORY_PROVENANCE_SEARCH_SENTENCE, MEMORY_SEARCH_BAND_ORDER_HEADER } from "./provenance-wording.js";
+import { deriveSupersededSet, memorySupersededNote, MEMORY_SEARCH_SUPERSEDED_TAG } from "./consolidation.js";
 export const MEMORY_SEARCH_TOOL_NAME = "memory_search";
 export const MEMORY_GET_TOOL_NAME = "memory_get";
 export const MEMORY_ENGINE_TOOL_NAMES = [MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME];
@@ -122,6 +123,13 @@ export function createMemoryEngineTools(opts) {
         const scopeSet = new Set(plane.scopes);
         return (await plane.backend.getByIds(ids)).filter((e) => scopeSet.has(e.scope) && e.frontmatter.deleted !== true);
     };
+    const supersededOf = async (plane, exclusions) => {
+        if (plane.scopes.length === 0)
+            return new Map();
+        const face = plane.backend.retrievalView?.() ?? plane.backend;
+        const headers = await face.listHeaders(plane.scopes);
+        return deriveSupersededSet(headers, { excluded: (id) => exclusions?.has(id) === true });
+    };
     const searchTool = {
         name: MEMORY_SEARCH_TOOL_NAME,
         description: carry ? `${SEARCH_DESCRIPTION}\n\n${MEMORY_PROVENANCE_SEARCH_SENTENCE}` : SEARCH_DESCRIPTION,
@@ -129,13 +137,16 @@ export function createMemoryEngineTools(opts) {
         defer: true,
         offload: false,
         contentOrigin: "local",
-        contract: { contractId: "core.memory_search@1", implementationRevision: "4" },
+        contract: { contractId: "core.memory_search@1", implementationRevision: "5" },
         parameters: Type.Object({
             query: Type.String({ description: "Keywords to look for (lexical match against entry names, descriptions and bodies)." }),
             limit: Type.Optional(Type.Number({ description: `Maximum hits to return (default ${MEMORY_SEARCH_DEFAULT_LIMIT}, max ${MEMORY_SEARCH_MAX_LIMIT}).` })),
+            includeSuperseded: Type.Optional(Type.Boolean({
+                description: "Also return entries a newer consolidated entry has superseded (kept as evidence; hidden from results by default). Superseded hits are tagged, with the superseding entry's id.",
+            })),
         }, { additionalProperties: false }),
         execute: async (args, ctx) => {
-            const { query, limit: rawLimit } = args;
+            const { query, limit: rawLimit, includeSuperseded } = args;
             const signal = ctx.signal;
             if (query.trim() === "") {
                 return refusedSearch("empty_query", "query must be non-empty — pass the concrete keywords a past memory entry would contain.");
@@ -150,17 +161,32 @@ export function createMemoryEngineTools(opts) {
                     return refusedSearch("challenge_ledger_unavailable", "Memory search is unavailable: the challenge ledger for a mounted memory plane cannot be read (fail-closed). Report this to the operator.", "failed");
                 }
             }
+            const supersededMaps = [];
+            try {
+                for (let i = 0; i < planes.length; i++) {
+                    const plane = planes[i];
+                    supersededMaps.push(plane === undefined ? new Map() : await supersededOf(plane, exclusions[i]));
+                }
+            }
+            catch (err) {
+                if (signal?.aborted === true)
+                    throw err;
+                return refusedSearch("error", "Memory search is unavailable: the header listing behind the superseded-entry filter could not be read. Try again, and report the failure if it persists.", "failed");
+            }
             const merged = [];
             try {
                 for (let i = 0; i < planes.length; i++) {
                     const plane = planes[i];
                     if (plane.scopes.length === 0)
                         continue;
-                    const askFor = carry ? limit + (exclusions[i]?.size ?? 0) : limit;
+                    const supersededSlots = includeSuperseded === true ? 0 : supersededMaps[i]?.size ?? 0;
+                    const askFor = (carry ? limit + (exclusions[i]?.size ?? 0) : limit) + supersededSlots;
                     const hits = await plane.backend.search(query, plane.scopes, { limit: askFor, ...(carry ? { exposureBands: true } : {}) });
                     for (const h of hits) {
                         if (exclusions[i]?.has(h.id))
                             continue;
+                        if (includeSuperseded !== true && supersededMaps[i]?.has(h.id))
+                            continue;
                         merged.push({ ...h, planeIndex: i });
                     }
                 }
@@ -219,10 +245,12 @@ export function createMemoryEngineTools(opts) {
             for (let i = 0; i < live.length; i++) {
                 const h = live[i];
                 const exposed = exposedFlags[i];
+                const supersededBy = supersededMaps[h.planeIndex]?.get(h.id);
+                const supersededSuffix = supersededBy !== undefined ? ` ${MEMORY_SEARCH_SUPERSEDED_TAG}` : "";
                 if (exposed) {
-                    hits.push({ exposure: "external", id: h.id, scope: h.scope, score: h.score, mtimeMs: h.mtimeMs, sizeBytes: h.sizeBytes });
+                    hits.push({ exposure: "external", id: h.id, scope: h.scope, score: h.score, mtimeMs: h.mtimeMs, sizeBytes: h.sizeBytes, ...(supersededBy !== undefined ? { supersededBy } : {}) });
                     lines.push("");
-                    lines.push(`${i + 1}. [mem:${h.id}] ${MEMORY_EXPOSURE_HANDLE_TAG} (scope ${inlineUntrusted(h.scope, 80)}, score ${h.score.toFixed(3)}, ${ageOf(now, h.mtimeMs)}) — read it with ${MEMORY_GET_TOOL_NAME} id ${h.id}`);
+                    lines.push(`${i + 1}. [mem:${h.id}] ${MEMORY_EXPOSURE_HANDLE_TAG}${supersededSuffix} (scope ${inlineUntrusted(h.scope, 80)}, score ${h.score.toFixed(3)}, ${ageOf(now, h.mtimeMs)}) — read it with ${MEMORY_GET_TOOL_NAME} id ${h.id}`);
                     continue;
                 }
                 hits.push({
@@ -234,10 +262,11 @@ export function createMemoryEngineTools(opts) {
                     score: h.score,
                     mtimeMs: h.mtimeMs,
                     sizeBytes: h.sizeBytes,
+                    ...(supersededBy !== undefined ? { supersededBy } : {}),
                 });
                 const hook = h.description ? ` — ${inlineUntrusted(h.description, 200)}` : "";
                 lines.push("");
-                lines.push(`${i + 1}. ${entryPath(h.scope, h.slug)}${hook} (id ${h.id}, score ${h.score.toFixed(3)}, ${ageOf(now, h.mtimeMs)})`);
+                lines.push(`${i + 1}. ${entryPath(h.scope, h.slug)}${supersededSuffix}${hook} (id ${h.id}, score ${h.score.toFixed(3)}, ${ageOf(now, h.mtimeMs)})`);
                 const body = (entryById.get(h.id)?.body ?? "").trim();
                 if (body !== "")
                     lines.push(delimitUntrusted(`memory entry ${h.slug}`, body, MEMORY_SEARCH_SNIPPET_CAP));
@@ -253,7 +282,7 @@ export function createMemoryEngineTools(opts) {
         defer: true,
         offload: false,
         contentOrigin: "local",
-        contract: { contractId: "core.memory_get@1", implementationRevision: "4" },
+        contract: { contractId: "core.memory_get@1", implementationRevision: "5" },
         parameters: Type.Object({
             id: Type.Optional(Type.String({ description: "Entry id (exact lookup). Pass either id or slug, not both." })),
             slug: Type.Optional(Type.String({ description: "Entry slug (its file path without .md). Ambiguous across scopes unless scope is also passed." })),
@@ -352,6 +381,15 @@ export function createMemoryEngineTools(opts) {
                 });
             }
             const exposed = carry && exposedEntry(entry);
+            let supersededBy;
+            if (entryPlane !== undefined) {
+                try {
+                    supersededBy = (await supersededOf(entryPlane, entryPlane.challengeExclusions?.())).get(entry.id);
+                }
+                catch {
+                    supersededBy = undefined;
+                }
+            }
             try {
                 entryPlane?.recordRetrieved([entry.id]);
             }
@@ -365,6 +403,7 @@ export function createMemoryEngineTools(opts) {
             const head = [
                 `Memory entry ${entryPath(entry.scope, entry.slug)} (id ${entry.id}${mtimeMs !== undefined ? `, ${ageOf(now, mtimeMs)}` : ""})`,
                 ...(exposed ? [MEMORY_EXPOSURE_BANNER] : []),
+                ...(supersededBy !== undefined ? [memorySupersededNote(supersededBy)] : []),
                 ...(fm.name !== undefined ? [`name: ${inlineUntrusted(fm.name, 120)}`] : []),
                 ...(fm.description !== undefined ? [`description: ${inlineUntrusted(fm.description, 200)}`] : []),
                 ...(fm.type !== undefined ? [`type: ${inlineUntrusted(fm.type, 40)}`] : []),
@@ -380,8 +419,11 @@ export function createMemoryEngineTools(opts) {
                     return refusedGet("taint_mark_failed", `Memory entry ${entry.id.slice(0, 64)} was not delivered: its external-origin take-up could not be recorded for this session (fail-closed). Report this to the operator and retry.`, "failed", { id: entry.id });
                 }
             }
+            const neutralLines = defuseFenceMarkers(sanitizeUntrustedText(entry.body, [...FENCED_LANE_ENVELOPE_TAGS])).split("\n");
+            if (neutralLines.length > 0 && neutralLines[neutralLines.length - 1] === "")
+                neutralLines.pop();
             if (lineCursor > 0 && totalLines > 0) {
-                const line = defuseFenceMarkers(sanitizeUntrustedText(allLines[offset]));
+                const line = neutralLines[offset];
                 const tail = skipBytes(line, lineCursor);
                 const cut = cutToBytes(tail.text, MEMORY_GET_PAGE_CAP_BYTES);
                 const shown = Buffer.byteLength(cut.text, "utf8");
@@ -405,23 +447,24 @@ export function createMemoryEngineTools(opts) {
                     lineCursor: tail.skippedBytes,
                     ...(nextLineCursor !== undefined ? { nextLineCursor } : {}),
                     ...(exposed ? { exposure: "external" } : {}),
+                    ...(supersededBy !== undefined ? { supersededBy } : {}),
                 };
                 return { content: head.join("\n"), details };
             }
             const page = [];
             let bytes = 0;
-            for (let i = offset; i < Math.min(totalLines, offset + limit); i++) {
-                const lineBytes = Buffer.byteLength(allLines[i], "utf8") + 1;
+            for (const neutralizedLine of neutralLines.slice(offset, offset + limit)) {
+                const lineBytes = Buffer.byteLength(neutralizedLine, "utf8") + 1;
                 if (page.length > 0 && bytes + lineBytes > MEMORY_GET_PAGE_CAP_BYTES)
                     break;
-                page.push(allLines[i]);
+                page.push(neutralizedLine);
                 bytes += lineBytes;
                 if (bytes > MEMORY_GET_PAGE_CAP_BYTES)
                     break;
             }
             const end = offset + page.length;
             head.push(`body lines ${totalLines === 0 ? 0 : offset + 1}-${end} of ${totalLines}:`);
-            const neutralized = defuseFenceMarkers(sanitizeUntrustedText(page.join("\n")));
+            const neutralized = defuseFenceMarkers(sanitizeUntrustedText(page.join("\n"), [...FENCED_LANE_ENVELOPE_TAGS]));
             const cut = cutToBytes(neutralized, MEMORY_GET_PAGE_CAP_BYTES);
             head.push(delimitUntrusted(`memory entry ${entry.slug}`, cut.text));
             let nextLineCursor;
@@ -446,6 +489,7 @@ export function createMemoryEngineTools(opts) {
                 totalLines,
                 ...(nextLineCursor !== undefined ? { nextLineCursor } : {}),
                 ...(exposed ? { exposure: "external" } : {}),
+                ...(supersededBy !== undefined ? { supersededBy } : {}),
             };
             return { content: head.join("\n"), details };
         },

package/dist/core/memory-engine/types.d.ts

@@ -27,6 +27,55 @@ export interface MemoryEntryOrigin {
     cause?: MemoryOriginCause;
     at: number;
 }
+/**
+ * design/339 §1.4 — one input-lineage row of a distilled (consolidation-produced) entry.
+ * `superseded: true` rows are the SUPERSESSION EDGES (this product replaces that input in the
+ * default read face — rev-anchored, see {@link MemoryEntryDistilled}); rows without the flag are
+ * evidence-only inputs (episodic sources, net-new distillation material) that are never suppressed.
+ */
+export interface MemoryEntryDistilledInput {
+    /** The input entry's immutable id. */
+    id: string;
+    /** The input's committed rev AT PLAN FREEZE — the edge's rev anchor (design/339 D-2a): the edge
+     *  is valid only while the target's committed rev still equals this, so a later legitimate edit
+     *  of the superseded entry REVIVES it (new information must never stay suppressed). */
+    rev: string;
+    /** Present ⇔ this row is a supersession edge (the product replaces this input in the active set). */
+    superseded?: true;
+}
+/**
+ * design/339 §1.4 — the ENGINE-MINTED supersession/lineage carrier riding ON the distilled product
+ * entry itself (typed frontmatter member, the `origin` carriage family). The block is authored
+ * exclusively by the consolidation protocol's plan freeze — a harvest never adopts one off the
+ * model-writable plane (stripped with a report warning, same law as `origin`), and once committed
+ * it is immutable: every later op must carry it forward DEEP-EQUAL (strip or member rewrite =
+ * malformed-refusal; the one legal exit is the committed tombstone). Riding on the product makes
+ * the edge publish ATOMIC for free (per-entry atomicity = edge atomicity; a partial apply can never
+ * suppress a target whose replacement is missing — the edge IS the replacement's bytes), and makes
+ * the lineage TRAVEL with the entry across backend/sync/bundle seams (retroactive challenge
+ * propagation stays mechanical on a deployment that never saw the plan file).
+ */
+export interface MemoryEntryDistilled {
+    /** Minting plan (audit anchor; opaque on a deployment the entry traveled to). */
+    planId: string;
+    /** Mint time, ms epoch — fixed at plan freeze (a replay re-adds the exact same bytes). */
+    at: number;
+    /**
+     * The CARRIER-side rev anchor (design/339 r3-2): the product's own committed rev at plan freeze.
+     * NON-CIRCULAR BY CONSTRUCTION: this member is excluded from the rev's canonical tuple
+     * ({@link import("./frontmatter.js").computeEntryRev}), so at freeze it simply EQUALS the entry's
+     * committed rev. An edge is valid only while the carrier's committed rev still equals this —
+     * a legitimate edit of the product (which may rewrite or retract what it integrated) SUSPENDS
+     * its edges and revives the inputs (the only accurate copy must never hide outside the default
+     * read face). Idempotent re-adds / deep-carrying updates don't move the rev, so untouched
+     * carriers keep their edges. Tamper is closed by the immutability law: a rewrite of this member
+     * is a malformed-refusal regardless of the rev arithmetic.
+     */
+    carrierRev: string;
+    /** The product's COMPLETE input lineage (id + freeze-time rev; `superseded` rows are the edges).
+     *  Bounded at freeze by `maxInputsPerProduct` (§6.1). */
+    inputs: MemoryEntryDistilledInput[];
+}
 /**
  * Structured header fields of one memory entry (the CC frontmatter shape: `name`/`description`/
  * `metadata.type`). `extra` preserves any additional frontmatter lines VERBATIM (round-trip safety:
@@ -93,6 +142,19 @@ export interface MemoryEntryFrontmatter {
      * deliberately no `"clean"` spelling to upgrade to (the `trust: "untrusted"` single-value law).
      */
     origin?: MemoryEntryOrigin;
+    /**
+     * design/339 §1.4 — the consolidation lineage/supersession carrier (see
+     * {@link MemoryEntryDistilled}). Engine-minted at plan freeze ONLY; model-written spellings
+     * (typed or suspect `extra` form) are stripped at harvest with a report warning, and a committed
+     * block is immutable under every touching op (deep-equal carry-forward, the `origin` I-2 seat's
+     * third member). Threat direction is the INVERSE of `origin`'s (design/339 §1.4.4): the
+     * dangerous act is ADDING an edge (a forged edge suppresses good memory — the delete-attack
+     * surface add-only exists to close), so only the pristine TYPED seat ever produces edges —
+     * suspect `extra`-form bytes are preserved verbatim but INERT (they mint no edge; fewer edges
+     * is the safe direction), while the immutability law still protects the committed typed block
+     * (stripping it would whitewash the product's lineage out of retroactive challenge reach).
+     */
+    distilled?: MemoryEntryDistilled;
     /** Unknown frontmatter lines preserved verbatim (order kept), re-serialized on projection. */
     extra?: string[];
 }
@@ -134,6 +196,23 @@ export interface MemoryEntryHeader {
      * question. Absent ⇔ no marker (the entry was never judged exposed — not "proven clean").
      */
     exposure?: "external";
+    /**
+     * design/339 §4.1-3 — the committed DISTILLED fact, carried on BOTH header faces (`listHeaders`
+     * and `search`, one projection): present ⇔ the committed entry carries a typed `distilled` block.
+     * `supersedes` is the block's edge PROJECTION (the `superseded: true` input rows — the minimal
+     * set the engine's active-set derivation needs; the full lineage stays off the header, payload
+     * bounded), `carrierRev` the block's carrier-side rev anchor (edge validity needs it beside the
+     * header's own `rev`). A DATA fact, not a mode — the backend reports what is stored; active-set
+     * derivation and every read-face treatment live in the engine/tool layer (same law as
+     * {@link exposure}).
+     */
+    distilled?: {
+        carrierRev: string;
+        supersedes: Array<{
+            id: string;
+            rev: string;
+        }>;
+    };
 }
 /** A scored search hit (FileBackend = lexical floor; PgBackend = design/81 vector rungs, S3). */
 export interface ScoredMemoryEntry extends MemoryEntryHeader {
@@ -254,10 +333,19 @@ export interface MemoryBackend {
      *   earlier delete in the same batch does not blank the baseline). The one legal exit is the
      *   COMMITTED tombstone: after a delete commits, the marker's life ends with the id (a fresh id —
      *   or the same id in a LATER batch — starts an unmarked life; the engine re-judges its session);
+     * - design/339 §4.1-1 `distilled` 不可变律 (the I-2 seat's third member): when the id's PRE-BATCH
+     *   committed state carries a typed `frontmatter.distilled` block, ANY op spelling that touches
+     *   the id (`update`, plain re-`add`, `guard: "absent"` add, same-batch delete-then-re-add) must
+     *   carry it forward DEEP-EQUAL (planId + at + carrierRev + every input row, order included); a
+     *   strip or member rewrite is refused with reason matching /malformed patch refused/. Judged
+     *   against the PRE-BATCH committed state; the one legal exit is the COMMITTED tombstone (the
+     *   block's life ends with the id). Suspect `extra`-form distilled bytes are NOT this law's
+     *   subject (they are inert verbatim leftovers — they mint no edge and carry like any `extra`);
      * - PRECEDENCE (FAM-1 #5, every whitewash spelling): the malformed judgment answers BEFORE
      *   guard/CAS arithmetic — a strip riding a stale `baseRev` (or a guard conflict) still answers
      *   /malformed patch refused/, never the ordinary rev-mismatch conflict (a whitewash is illegal
      *   at ANY rev, and the weaker conflict would tell the caller's ladder to rebase and retry it);
+     *   design/339 c37: the same precedence covers the `distilled` law;
      * - design/336 §4 hold protocol: the backend is hold-UNAWARE — instruction holds live on the
      *   ENGINE's control plane, so a held id keeps serving reads and ordinary add/update patches for
      *   it apply plainly (no queueing, no refusal). The settlement-period write interaction resolves
@@ -460,6 +548,17 @@ export interface HarvestReport {
      * (`memory.hold_opened` / `memory.hold_released` / `memory.hold_disposed`) is derived from the
      * three hold seats.
      */
+    /**
+     * design/339 §2.2 — the consolidation RECOMMENDATION edge (advisory, additive): this harvest's
+     * engine-minted session count crossed the configured thresholds (time gate open ∧ enough
+     * distinct sessions ∧ the once-per-crossing edge armed). Present at most once per crossing;
+     * absent always when consolidation is OFF (the default — zero gate state exists then). The
+     * recommendation NEVER executes anything: the host owns the verbs.
+     */
+    consolidationRecommended?: {
+        scope: string;
+        sessionsSince: number;
+    };
     containment?: {
         /** The derived index (MEMORY.md) was restored to its materialize-time baseline this harvest
          *  (the session's prose additions were captured and dropped). */

package/dist/core/memory-recall.js

@@ -1,3 +1,4 @@
+import { MEMORY_INJECTION_TAGS } from "./memory.js";
 import { sanitizeUntrustedText } from "./untrusted-text.js";
 export const DEFAULT_MAX_SELECTED = 5;
 export const DEFAULT_MAX_LINKED = 3;
@@ -107,8 +108,8 @@ export function composeSelectiveBody(manifestText, selected, nowMs, linked = [],
         const ageMs = nowMs - r.mtimeMs;
         const verify = r.timestampMissing || ageMs > ONE_DAY_MS ? " — verify it's still current" : "";
         const stale = r.timestampMissing ? ` (write time unknown${verify})` : ` (written ${formatMemoryAge(ageMs)}${verify})`;
-        const prefix = label ? `${sanitizeUntrustedText(label, ["user_memory"])} ` : "";
-        return `- ${prefix}${sanitizeUntrustedText(r.text, ["user_memory"])}${stale}`;
+        const prefix = label ? `${sanitizeUntrustedText(label, [...MEMORY_INJECTION_TAGS])} ` : "";
+        return `- ${prefix}${sanitizeUntrustedText(r.text, [...MEMORY_INJECTION_TAGS])}${stale}`;
     };
     let body = selected.map((r) => renderNote(r)).join("\n");
     if (linked.length > 0) {
@@ -126,7 +127,7 @@ export function composeSelectiveBody(manifestText, selected, nowMs, linked = [],
     const selectedSection = selected.length > 0 ? `\n\nRelevant notes:\n${body}` : "\n\n(no notes selected as relevant to this task)";
     const recallCall = recallToolName !== undefined ? `call ${recallToolName}` : `search the memory-recall tool bound to this scope`;
     const manifestSection = recallable
-        ? `Memory index — to load a note in full, ${recallCall} with keywords from its description:\n${sanitizeUntrustedText(manifestText, ["user_memory"])}`
+        ? `Memory index — to load a note in full, ${recallCall} with keywords from its description:\n${sanitizeUntrustedText(manifestText, [...MEMORY_INJECTION_TAGS])}`
         : "";
     return `${manifestSection}${selectedSection}`;
 }

package/dist/core/memory.d.ts

@@ -541,12 +541,42 @@ export declare function normalizeMemorySpec(input: MemorySpecInput | undefined):
  *  Exported so the inject-all de-dup seeding (prepare-task.ts) can detect truncation and NOT seed dropped
  *  (truncated-out) note ids as "already surfaced" — see the MINOR-1 audit fix there. */
 export declare const MAX_MEMORY_BYTES: number;
-/** The wrapper-tag family the memory injection fences neutralize (`<system-reminder>` is ALWAYS
+/** The wrapper-tag family the memory ADMISSION gate rejects on (`<system-reminder>` is ALWAYS
  *  included by {@link sanitizeUntrustedText} itself). Single source (design/138 S2-C, C-F10/O-F11):
  *  the memory write-time scan (`memory-engine/scan.ts`) detects break-out markup by diffing
- *  `sanitizeUntrustedText(text, MEMORY_WRAPPER_TAGS)` against the raw text, so the scan rules and
- *  the ACTUAL injection boundary (this file's compose* fences) can never drift apart. */
+ *  `sanitizeUntrustedText(text, MEMORY_WRAPPER_TAGS)` against the raw text.
+ *
+ *  ADMISSION half — deliberately UNCHANGED at the single outer wrapper. See
+ *  {@link MEMORY_INJECTION_TAGS} for the (wider) containment half and for why the two are allowed to
+ *  differ in exactly one direction. */
 export declare const MEMORY_WRAPPER_TAGS: readonly string[];
+/**
+ * The tag family the memory injection fences actually NEUTRALIZE — the whole authority-envelope
+ * census (untrusted-text.ts `ENGINE_ENVELOPES`), a deliberate SUPERSET of {@link MEMORY_WRAPPER_TAGS}.
+ *
+ * Two reproduced findings drove the widening:
+ *  ① `<scope>` — {@link composeLayeredMemoryBlock} renders a `<scope name="…">` SUB-ENVELOPE per
+ *    layer, but the neutralized list named only the outer wrapper, so a layer payload could close its
+ *    own `</scope>` and open a fresh `<scope name="managed">`: a forged higher-authority layer landing
+ *    at the END of the block, where this function's own contract puts the highest-priority layer.
+ *    Project-scope content is repository-controlled by our own stated posture
+ *    (PROJECT_CONTEXT_FRAMING), i.e. attacker-reachable.
+ *  ② the SIBLING envelopes — nesting a forged `<task-notification>` or `<new-diagnostics>` inside
+ *    `<user_memory>` does not make it inert: the TAG is what a model reads as harness speech, and
+ *    this payload lands in the SYSTEM PROMPT. Widening is safe precisely here because the sanitizer
+ *    runs on the PAYLOAD, before this file assembles the engine's own wrappers around it — it can
+ *    never defuse our own fences.
+ *
+ * WHY THE ADMISSION LIST DID NOT WIDEN WITH IT (the asymmetry is the point). The write scan
+ * (`memory-engine/scan.ts`) diffs against {@link MEMORY_WRAPPER_TAGS} and REFUSES on a difference,
+ * and it runs on re-serialization / sync / import paths as well as on fresh writes. Widening it would
+ * retroactively refuse ALREADY-STORED entries — and `<scope>test</scope>` is a Maven POM element, so
+ * the false-rejection is not hypothetical. The drift therefore runs in the one safe direction:
+ * containment ⊇ admission. A note the gate accepts is neutralized on the way in to the prompt; the
+ * dangerous drift would be the reverse (admission accepting what containment does not defuse), and
+ * that one is structurally impossible while this constant is a superset.
+ */
+export declare const MEMORY_INJECTION_TAGS: readonly string[];
 /**
  * Wrap memory content in a `<user_memory>` block. This is the **variable tail** of the system prompt
  * (per-user, scoped, timestamped) — the default prompt provider places it LAST so the stable base

package/dist/core/memory.js

@@ -1,7 +1,8 @@
 import { uuidv7 } from "../internal/harness.js";
 import { parseScopeKey } from "./memory-engine/scope-contract.js";
 import { termSet } from "./memory-vector.js";
-import { sanitizeUntrustedText } from "./untrusted-text.js";
+import { attrEscape } from "./task-notification.js";
+import { sanitizeUntrustedText, ENGINE_AUTHORITY_ENVELOPE_TAGS } from "./untrusted-text.js";
 export function supportsConsolidation(store) {
     return (typeof store.searchScored === "function" &&
         typeof store.update === "function" &&
@@ -402,6 +403,7 @@ export function normalizeMemorySpec(input) {
 }
 export const MAX_MEMORY_BYTES = 100 * 1024;
 export const MEMORY_WRAPPER_TAGS = ["user_memory"];
+export const MEMORY_INJECTION_TAGS = [...ENGINE_AUTHORITY_ENVELOPE_TAGS];
 export function composeMemoryBlock(content, scope) {
     const trimmed = (content ?? "").trim();
     if (!trimmed) {
@@ -418,7 +420,7 @@ export function composeMemoryBlock(content, scope) {
         const head = buf.subarray(0, cut).toString("utf8");
         payload = `${head}\n<truncated bytes=${bytes - cut}>`;
     }
-    return `<user_memory scope="${scope}">\n${sanitizeUntrustedText(payload, [...MEMORY_WRAPPER_TAGS])}\n</user_memory>`;
+    return `<user_memory scope="${attrEscape(scope)}">\n${sanitizeUntrustedText(payload, [...MEMORY_INJECTION_TAGS])}\n</user_memory>`;
 }
 export function composeLayeredMemoryBlock(layers) {
     const sections = [];
@@ -435,8 +437,8 @@ export function composeLayeredMemoryBlock(layers) {
                 cut--;
             payload = `${buf.subarray(0, cut).toString("utf8")}\n<truncated bytes=${bytes - cut}>`;
         }
-        sections.push(`<scope name="${sanitizeUntrustedText(layer.scope, [...MEMORY_WRAPPER_TAGS])}">\n` +
-            `${sanitizeUntrustedText(payload, [...MEMORY_WRAPPER_TAGS])}\n` +
+        sections.push(`<scope name="${attrEscape(layer.scope)}">\n` +
+            `${sanitizeUntrustedText(payload, [...MEMORY_INJECTION_TAGS])}\n` +
             `</scope>`);
     }
     if (sections.length === 0)

package/dist/core/permission-rule-model.d.ts

@@ -7,19 +7,36 @@
  * semantics; who may mint one, where it is stored, and where in the gate it is consumed live in
  * `permission-rule-store.ts`, `permission-rule-consent.ts` and `hooks.ts` respectively.
  *
- * ## The floor: only a single simple command can ever be matched
+ * ## The floor: what a rule may name, and what a rule may match
  *
- * Everything a shell can use to run a SECOND program behind an admitted first one — operators,
- * substitution, subshells, backgrounding, and **redirection** — puts the command outside this lane
- * entirely: it falls back to the pre-existing chain and asks. That includes redirection specifically,
- * which is a deliberate registered divergence from upstream (upstream strips redirections before
- * matching; with this repo's write gate not covering the shell tool, stripping would turn a rule as
- * innocuous as `Bash(ls)` into a licence for `ls > ~/.ssh/authorized_keys`).
+ * Everything a shell can use to run a program the text does not NAME — substitution, subshells,
+ * backgrounding, escapes, line breaks, and **redirection** — puts the command outside this lane
+ * entirely: it falls back to the pre-existing chain and asks. Redirection specifically is a deliberate
+ * registered divergence from upstream (upstream strips redirections before matching; with this repo's
+ * write gate not covering the shell tool, stripping would turn a rule as innocuous as `Bash(ls)` into a
+ * licence for `ls > ~/.ssh/authorized_keys`).
  *
- * The floor is `parseLeadingCommandName` — the one simple-command parser already shared by the
- * read-only classifier, the reversibility probe, the coarse command-name policy and the skill tool
- * specifier. A second tokenizer would drift, and drift on a loosening face shows up as a circumvention rather
- * than as a test failure.
+ * CONNECTORS are the one construct the lane does speak for, and only in the EXACT form. `./gradlew
+ * build && ./gradlew test` is one thing a person reads and approves in one glance, and the whole of it
+ * is written into the rule; nothing is admitted that the rule text does not spell out end to end. The
+ * PREFIX form stays single-command on both sides — as a rule BODY (`Bash(a && b:*)` is refused) and as
+ * a MATCH (`Bash(npm:*)` does not admit `npm test && curl evil.example`, which is the whole reason the
+ * two forms are separated here rather than sharing one matcher arm). Upstream reaches the same
+ * placement through a per-segment evaluation of its full decision chain, where a segment DENY is
+ * returned strictly before any whole-string allow; this lane's equivalent is that the deny/ask layer
+ * (`permission-rule-org.ts`) judges every segment and runs ahead of the allow lane at the gate.
+ *
+ * The floor is `parseLeadingCommandName` + `splitShellCompoundSegments` — the one simple-command parser
+ * and the one segmentation, both already shared with the read-only classifier, the reversibility probe,
+ * the coarse command-name policy and the skill tool specifier. A second tokenizer would drift, and drift
+ * on a loosening face shows up as a circumvention rather than as a test failure.
+ *
+ * argv[0] may carry a PATH prefix here (`./gradlew`, `/usr/bin/git`) — opt-in at the shared parser and
+ * used by this lane alone. The bare-name requirement belongs to the argv[0]-NAME filters, which compare
+ * one token against a name set; this lane compares the whole command line, so a path prefix is not a way
+ * past anything — it IS the text that was approved. No basename folding follows from it: `./gradlew`
+ * and `gradlew` stay two different commands to the matcher. The single place a basename is taken is the
+ * interpreter refusal below, which must read `/usr/bin/node` as `node`.
  *
  * ## Normalization order is load-bearing
  *
@@ -121,11 +138,64 @@ export declare const MAX_RULE_TEXT_CHARS = 512;
  * any program you like" — that is not a shape a single click can be understood to have authorized.
  *
  * The check is on argv[0] of the prefix, not on the prefix being exactly one word: `node -e:*` is the
- * same licence spelled longer. Deliberately strict-side — it costs the ability to persist a rule like
+ * same licence spelled longer. It is on argv[0]'s BASENAME, not its spelling: `/usr/bin/node:*` and
+ * `./node:*` grant precisely what `node:*` grants, and a table consulted with the full path would be a
+ * table any path prefix walks around (upstream takes the same basename before consulting its own
+ * interpreter set). Deliberately strict-side — it costs the ability to persist a rule like
  * `python manage.py migrate:*` (which an import reports as skipped rather than dropping silently), and
  * an EXACT rule naming a whole interpreter command line stays legal, since it authorizes one command.
+ *
+ * TWO groups, and the distinction matters when the table is next edited:
+ *  · LANGUAGE interpreters (`node`, `python`, `ruby`, …) — the argument IS a program. This half is
+ *    wider than upstream's own set, deliberately, and is the argument the paragraph above makes.
+ *  · LAUNCHERS — a program whose argument is another program to run: the shells, the environment and
+ *    privilege wrappers, the schedulers and resource wrappers, the tracers, and the shell BUILTINS
+ *    that dispatch (`command`, `builtin`). This half is upstream's set, adopted verbatim rather than
+ *    reasoned out row by row: it is the same question upstream answers with the same mechanism (its
+ *    set is consulted on argv[0]'s basename too), and every row passes this table's own first axis —
+ *    a body whose use is naming a program to execute is refused. They were missing, and each was one
+ *    token in front of the licence the language half already refuses: `command node:*`, `timeout 9
+ *    node:*` and `nice node:*` all grant exactly what `node:*` grants.
+ *
+ * KNOWN RESIDUAL, stated rather than hidden, and it is a property of the instrument rather than of this
+ * particular list: a positive list of NAMES cannot be made complete, and two independent review rounds
+ * enumerated escapes faster than rows could be added. Three shapes, none of which a longer list fixes:
+ *  · a version- or distribution-suffixed spelling of a listed interpreter (`python3.12`, `nodejs`);
+ *  · a launcher nobody listed — the set of programs that run another program has no boundary, and each
+ *    round produced more of them;
+ *  · a spelling that defeats the NAME question entirely: `/proc/self/exe` (basename `exe`, the running
+ *    shell), a symlink or a renamed binary, a BusyBox applet, a dynamic loader invoked directly.
+ * Matching a family would need a pattern rather than a set, with its own false-positive surface
+ * (`node-gyp`, `timeout-monitor`), and no pattern addresses the third shape at all. What carries the
+ * residue is therefore NOT this table: it is the three standing fences — the org deny/ask layer runs
+ * ahead of this lane and cannot be silenced by it, a mandated ask is not rule-clearable, and the
+ * narrower exact candidate (plus minting nothing) is always on the same card. This table's job is to
+ * keep the OBVIOUS one-token licence off a card a person clicks once, not to be a boundary.
  */
 export declare const BARE_INTERPRETER_NAMES: ReadonlySet<string>;
+/**
+ * Shell KEYWORDS, refused as a segment's `argv[0]` everywhere this lane reads a command.
+ *
+ * The floor this lane stands on extracts the first TOKEN of a segment and calls it the command name.
+ * That identification is what every comparison here rests on — the interpreter refusal, the deny/ask
+ * layer's per-segment judgement, and a person's reading of the rule text. For a control structure it is
+ * simply false. `for x in once; do curl evil.example; done` splits into three segments whose first
+ * tokens are `for`, `do` and `done`; all three are ordinary bare words, so the floor accepts each,
+ * `curl` is named by nothing, and a published `deny Bash(curl:*)` matches none of them while bash runs
+ * curl. A whole loop body — any number of programs — hides behind three tokens that name no program.
+ *
+ * Refusing the keyword puts the whole command outside the lane, which is the honest answer: no rule can
+ * be minted for it and no rule matches it, so it asks. Recovering these shapes properly needs a real
+ * shell grammar (upstream has one — it parses to a syntax tree and reads the commands out of the
+ * structure, so a keyword is never mistaken for a program); a token-level lane cannot, and pretending
+ * otherwise is the loosening direction.
+ *
+ * `!` is here for the same reason with a sharper edge: it is a keyword that PREFIXES a real command, so
+ * `! node -e …` is the `node` licence the interpreter table exists to refuse, wearing one extra token.
+ * `{`/`}`/`[[`/`]]` are already refused by the floor's argv[0] metacharacter rule; listed anyway,
+ * because that rule belongs to another module and is not this lane's to depend on.
+ */
+export declare const SHELL_RESERVED_WORDS: ReadonlySet<string>;
 /**
  * design/185 §1 — the reviewed command/subcommand grammar the PREFIX suggestion is generated from
  * (exactly the "reviewed command/subcommand grammar" the generator's history note names as the one
@@ -215,10 +285,46 @@ export declare function formatAllowRuleText(command: string, match: PersistedRul
  * Does this rule's command pattern admit `command`?
  *
  * `command` is the raw tool argument: the floor and the folding happen HERE, in that order, so no
- * caller can accidentally match a folded compound. Returns false for anything that is not a single
- * simple command — including every redirection form.
+ * caller can match a command this lane has not read. Returns false for every redirection, substitution,
+ * subshell, backgrounded or escaped form.
+ *
+ * **A PREFIX rule never admits a compound.** This is the single load-bearing line of the connector
+ * widening, and it is checked on the MATCH side rather than left to the mint side: `Bash(npm:*)` is an
+ * ordinary, legitimately mintable rule, and if the "does this command start with `npm `" arm were
+ * allowed to see a compound at all, that rule would admit `npm test && curl evil.example` — one stored
+ * yes to a build command turned into a standing yes to whatever is chained behind it. An EXACT rule has
+ * no such reach by construction: it admits one string, the one it spells.
  */
 export declare function ruleAdmitsCommand(rule: Pick<PersistedAllowRule, "match" | "command">, command: string): boolean;
+/**
+ * The same match, asked the DENY/ASK layer's question — "does this rule speak about this program run?".
+ *
+ * Split from {@link ruleAdmitsCommand} because the two differ on one axis that decides real cases: a
+ * quoted operator. `curl "https://x/?a=1&b=2"` is ONE command bash runs, and the `&` in a query string
+ * is not a connector; the matching side refuses it anyway (a rule text is a spelling with no operator
+ * characters in it at all — the historical rule-face contract), and the deny side inheriting that
+ * refusal made `deny Bash(curl:*)` silent on the commonest spelling of the very program it names
+ * (adversarial round 3).
+ *
+ * The asymmetry only ever runs one way: this predicate reads MORE commands than the matching one, never
+ * fewer. A shape only the ALLOW side could read would be a standing approval no published policy could
+ * see — the inversion this whole ticket exists to prevent.
+ */
+export declare function ruleAdmitsProgramRun(rule: Pick<PersistedAllowRule, "match" | "command">, command: string): boolean;
+/**
+ * The segments of `command` as the deny/ask layer must judge them, or `undefined` for a command this
+ * lane cannot read.
+ *
+ * A tightening rule speaks about a PROGRAM RUN, and a compound runs several. `Bash(curl:*)` published
+ * as a deny means "this machine does not make that call", and reading `npm test && curl evil.example`
+ * as one unmatched blob answered that with silence — the shape the widening above would otherwise make
+ * permanently approvable. Exported (rather than folded into a matcher here) because the layer that
+ * needs it holds the rules: this module owns what a command IS, `permission-rule-org.ts` owns what the
+ * organization says about each part of it.
+ *
+ * A single simple command yields a one-element list, so a deny that matched before matches identically.
+ */
+export declare function ruleLaneSegmentsOf(command: string): readonly string[] | undefined;
 /**
  * Is `path` inside (or equal to) `root`? Word-boundary containment on the path separator, so `/a` does
  * not contain `/ab`. Both sides are expected to be canonical already.
@@ -271,13 +377,26 @@ export interface RuleSuggestion {
  * shear a quoted segment — harmless in this direction, because the sheared pieces carry quote
  * characters and can never equal a bare lexicon word; every suspicious shape lands on "no prefix".
  *
- * Every produced candidate must survive the round trip — parse as a rule AND admit the very command
- * it was minted from. True by construction (a word-boundary lexicon prefix of a folded simple command
- * is exactly the matcher's two arms); enforced anyway, fail-closed: a candidate that would not
- * round-trip is silently not offered, since offering an option redemption would refuse is worse than
- * offering one fewer.
+ * Every produced candidate must survive the round trip — parse as a rule, come back as the match form
+ * this seat is offering, AND admit the very command it was minted from. Enforced on BOTH seats,
+ * fail-closed: a candidate that would not round-trip is silently not offered, since offering an option
+ * redemption would refuse is worse than offering one fewer.
+ *
+ * The FORM half of that check is not decoration. A command may end in the rule grammar's own prefix
+ * marker — `rm :*` is a legal thing to type — and wrapping it as an exact rule produces the text
+ * `Bash(rm :*)`, which the validator reads back as the PREFIX rule `Bash(rm:*)` over the command `rm`.
+ * Trusting the exact seat's own intent and labelling that result `match: "exact"` put a blanket
+ * every-`rm` rule on the card under the narrowest option's name, one click from being persisted (and,
+ * for a lexicon command like `git status :*`, emitted twice — once mislabelled, once as the real prefix
+ * candidate). The seat therefore believes the PARSER about what it got back, never its own request.
+ *
+ * A COMPOUND (`./gradlew build && ./gradlew test`) fills the exact seat and only that one: the offered
+ * rule spells the whole chain and admits exactly it. That is the shape this seat was missing — the
+ * ordinary build invocation is a connector chain, and a card that could offer nothing for it made every
+ * such command a fresh question forever, with no way for an answer to accumulate.
  *
- * Returns an empty array for anything the rule lane cannot speak for (compounds, redirections,
- * substitutions) — the card then simply carries no "don't ask again" option, which is the honest answer.
+ * Returns an empty array for anything the rule lane cannot speak for (redirections, substitutions,
+ * subshells, backgrounding) — the card then simply carries no "don't ask again" option, which is the
+ * honest answer.
  */
 export declare function suggestRulesForCommand(command: string): RuleSuggestion[];