@sema-agent/core 7.31.0 → 7.31.1

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 7.31.1 — 2026-09-25
+
+### Fix — a credential slot in the host shell's `SEMA_` namespace is withheld from spawned children (#1099; security; `SecretEnvFindingKind` +1 member `namespace-rule`; +0 exports; @cli @server)
+
+- **Before.** The D1 scrub read only a name's LAST word (`…_KEY`, `…_TOKEN`, an optional `_<n>` / `_ID` after it). The shell stores a model entry's key under `SEMA_MODEL_KEY_<ENTRY>` (a websearch provider's under `SEMA_WEBSEARCH_KEY_<PROVIDER>`): the credential word in the middle, a caller-chosen entry after it. Every such slot reached tool shells and language servers, and a model-chosen `env | grep` printed the key into the transcript.
+- **One rule.** Inside the `SEMA_` namespace, and only there, a credential word as any `_`-separated segment makes the name a credential (`SEMA_NAMESPACE_SECRET_RE`). It reads the one credential-word alternation the suffix rule reads (`CREDENTIAL_WORD`, one definition), the count-word reading of `TOKENS` included (`SEMA_MAX_TOKENS` is kept). It is consulted after the two exact-name lists and the suffix rule, so no existing finding changes kind. The alternation no longer lists `ACCESS_KEY` / `SESSION_TOKEN`: every name they matched ends in `_KEY` / `_TOKEN`, which `KEY` / `TOKEN` match.
+- **Unchanged.** Every name outside `SEMA_` (verdict and kind pinned against the v7.31.0 regex over a generated set of about 80,000 names); both exact-name lists; the count-word ledger. The withheld-keys notice (`config.secret_env_scrubbed`, `detail.names`) lists the slot like any other withheld name; values are never carried.
+- **Who is hurt.** A `SEMA_` name with a credential-word segment that a child needed. The ones found in the neighbouring trees are paths to a credential file, not values: `SEMA_REGISTRY_TOKEN_FILE` (server config catalog) and `SEMA_LLM_KEY_DB` (the shell's live-test scripts) no longer reach a spawned tool shell or language server. `SEMA_CODE_*` — the shell's brand-renamed twin of CC's `CLAUDE_CODE_*` namespace — matches the same way: six non-credential knobs the shell's own code reads (`SEMA_CODE_IDLE_TOKEN_THRESHOLD`, `SEMA_CODE_API_KEY_HELPER_TTL_MS`, `SEMA_CODE_ENABLE_TOKEN_USAGE_ATTACHMENT`, `SEMA_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR`, `SEMA_CODE_API_KEY_FILE_DESCRIPTOR`, `SEMA_SESSION_INGRESS_TOKEN_FILE`) are withheld from a nested `sema` started inside the tool shell (a `CLAUDE_CODE_` twin, when present, reseeds it), and one real credential, `SEMA_CODE_CLIENT_KEY_PASSPHRASE`, is newly withheld (@cli: check the six). An `inheritEnv` allowlist, `shellEnv` / a per-exec env, and a host-supplied LSP `env` still pass a name verbatim.
+- **Finding kind.** `SecretEnvFinding.kind` gains `namespace-rule` (confidence `medium`). A consumer that totals over the kind (a metrics label, an exhaustive switch) sees a third value.
+- **Pickup.** @cli: nothing to change; the slots stop reaching children once this core is in the bundle. @server: `secret_env_scrubbed_total{kind}` can carry `namespace-rule`; `SEMA_REGISTRY_TOKEN_FILE` is withheld from the model-driven host shell and from the LSP spawn env (`LSP_ENV_ALLOW` names it back if a language server needs it).
+- Pins: `test/backlog1099-sema-namespace-secret-env.test.ts`.
+
+### Fix — a tilde in an assignment value, a literal tilde and every member of a `:` list meet the deny rows at the declared home (#1100; security; behavior: tightening — no verdict loosens against 7.31.0, flip list below; +0 exports; @cli @server)
+
+- **Before.** In `F=~/.ssh/id_rsa; cat "$F"` the station cannot resolve `"$F"`, so the assignment is the only place the path is in the text, and a value that expands a leading tilde was placed only when a program in the SAME segment could open it (7.26.2). The command landed on an approvable card (mandated) while `F="$HOME/.ssh/id_rsa"` and `F=/home/u/.ssh/id_rsa` were refused on the deny row. Two more gaps of the same kind: a LITERAL tilde (quoted, escaped, after an option's `=`) is a relative path to bash, but a program that expands `~` itself (npm reads `npm_config_userconfig="~/x"`, `--userconfig "~/x"`, `--userconfig="~/x"` as `$HOME/x`) opened the home file with no card at all (measured headless on 7.31.0: the sentinel leaked); and a `:` list named no candidate once a member expanded a tilde, so `F=<deny path>:~; cat "${F%%:*}"` was a card where `F=<deny path>:/x` was refused under a directory-prefix deny row (under an exact-file row the literal `:` form was a card too, and moves M → R here).
+- **Three rules, one mechanism (the deny floor of #1064 ⑬).** (1) The opener condition is gone from the value reading (`pushAssignment` loses `opensValue`; `segmentFactsRead` / `unlistedWords` stop computing it): an environment value with a leading tilde is placed against the declared home whether or not a program opens it, and the refusal names the real file. (2) Every candidate spelled `./~…` — the one literal-tilde spelling, from an assignment value, an operand, an option value or payload, a redirection — also carries its declared-home spelling as a deny-only view (`floorSpelled`; `spelledWithHome` reads `./~` as it reads `~`): refused on a deny row, never a containment question, nothing added where no deny row matches. (3) A value holding `:` hands each member as a deny-only candidate (a tilde member placed against the home); the whole value is still no containment candidate. The plan's candidate dedupe keys on the word as written (`raw`) as well as its spelling, so two words spelling one path keep their own deny floors. With no declared home nothing is spelled: a later read stays unestablishable (mandated), as before — unless a deny row's own pattern matches the unexpanded spelling (an any-prefix row such as `**/<dir>/**` matches the relative `~/<dir>/…` itself), which refuses as any matching spelling does (criteria car, measured).
+- **Flip list (station, open / roots × bash_off / bash_classify; deny row anchored at the home).** V → R: `npm_config_userconfig="~/<deny>" npm config list`, `export npm_config_userconfig="~/<deny>"; npm config list`, `env npm_config_userconfig="~/<deny>" npm …`, `npm --userconfig "~/<deny>" …`, `npm … --userconfig="~/<deny>"` (real lane: LEAK → refused), `npm_config_userconfig=\~/<deny> npm …`, `F+="~/<deny>"; true`, `cat "~/<deny>"`, `cat < "~/<deny>"`, `HOME=/x; cat '~/<deny>'`, `A=~/.env; true`, `A=~/'.env' true`, `A=~/.env; cat safe.txt`, `GIT_CONFIG_GLOBAL=~/.env echo hi`, `A=a:~/.env cat safe.txt`. M → R: `F=~/<deny>; cat "$F"`, `F+=~/<deny>; cat "$F"`, `F="~/<deny>"; cat "$F"`, `F+="~/<deny>"; cat "$F"`, `A[0]+="~/<deny>"; cat "${A[0]}"`, `F=<deny>:~; cat "${F%%:*}"`, `F=<deny>:~/x; …`, `F=~/<deny>:; cat "${F%:}"`, `F=/x:~/<deny>; IFS=:; cat $F`. R → R: `npm_config_userconfig+="~/<deny>" npm …` and `env A+="~/<deny>" npm …` (refused on 7.31.0; an intermediate build of this release read them V, restored here), every literal `:` form. No R → M / V and no M → V: the dual-run corpus (4,421 tree-fixture inputs × 4 cells, under its own deny configuration) moves 3 inputs, all V → R, and 19 under four deny configurations, all V → R or M → R (the car's 4,447-input run adds 26 inputs of its own; same 3); the F5 shell-read corpus reads the same on all 276 rows, LEAK 0. Controls unchanged: a benign literal tilde (`F+="~/ok"; true`, `npm_config_userconfig="~/ok" npm …`, `cat "~/ok"`) still vouches; `F+="~/ok"; cat "$F"` still asks.
+- **Unchanged.** An environment value is still no containment candidate (KL-945a). An operand-slot value (`dd if=~/x`) still asks both ways (KL-993b ②). `$(…)` and loop variables are not touched (#1102).
+- **Supersedes part of #1004 (7.26.2).** #1004 ruled that an unsettled environment value in front of no opener names nothing (`A=~/.env; true`, `A=~/'.env' true`, `GIT_CONFIG_GLOBAL=~/.env echo hi` vouched, `A=a:~/.env cat x` vouched). They now refuse, naming the real file. #1004's other half (a refusal names a path, never the assignment word) stands; its pins are updated in `test/backlog1004-assignment-word-not-a-path.test.ts`.
+- **Who is hurt.** A text whose value or literal-tilde operand names a deny row under the declared home and is never read that way is now refused, as its `$HOME` and literal spellings already were. Under the built-in table the new refusals are `:` lists and literal tildes that name a deny row without reading it: `KUBECONFIG=~/.kube/config:~/.kube/dev kubectl get pods`, `HISTFILE=/tmp/h:~/.zsh_history true`, `F=~/.netrc; echo hi` (V → R); `cat "~/.ssh/id_rsa"` was already refused on 7.31.0 under the built-in `.ssh` row and stays so (cat opens the relative `./~/…`; KL-1100a); a deployment's own deny row makes `LABEL=a:<row> true` a refusal (KL-1100b). Not reached (a card, as before): a tilde set through `${X:-~/x}`, `printf -v`, `read <<<`, a brace or a pattern substitution — #1102's family.
+- **Pickup.** @cli @server: nothing to change; the refusal is the existing `read_path_denied` shape.
+- Pins: `test/backlog1100-tilde-assignment-deny.test.ts` (station + real lane, npm included); `test/backlog1004-assignment-word-not-a-path.test.ts` ①③④⑦, `test/backlog714-home-expansion-precise.test.ts` (one more checked path), `test/backlog7300-shell-reentry.test.ts` (`HOME=/x; cat '~/key.txt'` refuses) re-pinned.
+
+### Fix — a memory store act is judged by where it lands: erase, delete, write and journal replay no longer follow a directory replaced by a link out of the store (#1094; security; +1 error code `memory.target_outside_store`; +0 exports; @server)
+
+- **Before.** `FileMemoryEngineBackend` joined `<root>/<scope>/<slug>.md` and acted on it: `rmSync` (erasure, `applyPatches` delete, including the bound-path arm when the entry's file had moved) and `renameSync` of a staged write (add, update, slug rename). Nothing re-read where that spelling resolved. A directory under the store replaced by a link to a directory elsewhere kept the spelling while the act followed the link: `eraseMemoryEntries` deleted a same-named file OUTSIDE the store and answered `complete`, a delete did the same, and a write landed the entry outside (staged file and created directories included). Measured on 7.31.0 with real links: erase, bound-path delete, add under the link and slug-rename update all escaped. Journal replay was already refused at construction, by the journal validator's containment check, which is physical.
+- **One verdict, every act.** `storeTargetEscape(physicalRoot, target)` (memory layout, internal): the target's directory, resolved through every link on its existing prefix, must be inside the physically resolved store root. The final component is not judged: `rm` removes a link standing there, `rename` replaces it, and the engine's in-place writes refuse it (`ELOOP`), so what the link points at is never touched (rm and rename complete; the write is refused). The root's physical form is taken once, when the backend opens the store: a store mounted through a link is not refused. Every face (both recovery legs, the lock-free faces' layout seat and the adoption face) first checks that the root still resolves there (the refusal says to open a new backend on the directory you mean) (both sides resolved from the normalized spelling every child path carries); a root re-pointed since refuses the face before it reads, adopts, sweeps or restores anything, and an act judges against the root as opened even when the root is re-pointed mid-call. A directory that cannot be resolved (`EACCES`, `ELOOP`, `ENOTDIR`) stops the act with that fault, thrown as itself: never reported as the containment code, and never taken as leave to act (on macOS a link whose own mode refuses resolution is still followed by `unlink` and `rename`). The verdict covers the target and, for a write, its staged file. It runs over the whole batch at the commit point, before the journal is written (`applyPatches` removes the staged files it created, matched by identity, never a same-named file reached through a directory swapped since; the refusal is clean: no journal, the account unchanged), and per op at each act: `applyPatches` staging (which creates the directory and a file at the target) and execute, erasure execute, and journal replay, where the whole journal is judged before its first act too. After the marker a refusal keeps the journal, and the journal replays once the path resolves inside the store again.
+- **The same verdict at four of the acts the engine performs itself** (the remaining engine write sites — the scan-derived containment writes judged once at scan time by a canonical-spelling comparison, and the old `repo_file` projection's `rmSync` — are #1104; their window is in KL-1094-a). Each of these also landed through a directory replaced by a link; all four were measured on 7.31.0.
+  - `MemoryEngine`'s copy-out projection write (a non-file backend projected into the memory dir) projected entries outside the tree.
+  - The harvest's missing-file restore rebuilt a file the scan could not see (the scan never follows links, so the file read as "missing") from its committed copy, wherever the link pointed.
+  - The read-only layer restore overwrote a same-named file outside with committed content.
+  - Four `MEMORY.md` writes (index rebuild, the derived-index gate's clear, the capture opt-out residue sweep, the erasure's index rewrite) wrote through a write home replaced by a link. The fifth, the polluted-index restore, keeps its own containment check (predates #1094, unchanged): it refuses an ordinary directory link, but it compares canonical spellings from a total resolver that falls back to the lexical spelling when a component cannot be resolved (`EACCES`, `ELOOP`), where the verdict above throws the fault as itself — on macOS a directory link with mode 000 (`lchmod`) fails `realpath` yet is followed by `open`, so that site (and the engine's other canonical-spelling gates) still writes through such a link (KL-1094-f; the class fix is #1104).
+  The restores reached the file backend's zero-copy mode as well. All now pass the verdict first, judged against the mount's root: the engine takes its memory dir's physical form at its first mount, and a later mount of the same engine whose memory dir now resolves elsewhere refuses with the code ("open a new engine on the directory you mean"). The erasure's index rewrite can run on an engine that never mounted, so it is judged against the memory dir as it resolves when the rewrite runs — also on an engine that HAS mounted, where a root re-pointed since is refused by the next mount but still rewritten by an erasure (KL-1094-i; #1104 takes the pinned root when there is one). The mount's own handle re-resolves its roots after the backend's first call, so a root re-pointed inside that first mount is followed by the handle's writes (same KL). Each refusal is not performed and goes to the site's existing failure lane, carrying the code:
+  - a refused projection throws, so the mount fails loud (the runner's memory-less arm reports it through `onError`);
+  - a refused restore goes to `could NOT be restored` warnings;
+  - a refused index write goes to warnings or the sweep's failure list, except the erasure's index rewrite, whose lane (`residuals.indexUncleared`) lists paths only.
+- **Hard links.** `writeFileNoFollow` is the engine's in-place write for restores, projections and the index. It already refused a link at the final component (ELOOP); it now also refuses a file with more than one name, because an in-place write would change those bytes under the other name too, possibly outside the store. The refusal takes the same lanes and names the file (`<path> has N names (a hard link) — …; not written`; no code). The check reads the opened descriptor before anything is truncated, so there is no window. An ordinary file is rewritten in place exactly as before: same inode, same mode, the new bytes. A file that ALREADY has a second name is refused at every in-place write until the extra name is removed: a `cp -al` snapshot of the store, or an instruction-file restore interrupted between its link and its unlink (`noReplaceRestore` leaves the `.staging` name in custody). For a copy-out projection that refusal fails the mount; the message names the file but not the remedy (KL-1094-g; #1105).
+- **Refusal shape.** A plain `Error` with `code: "memory.target_outside_store"`; the message starts with the code and names the op, the path and where it resolves. `applyPatches` refuses the WHOLE batch (it throws; no per-patch conflict row), so a harvest reports `incident.kind: "sidecar_corrupt"` with that text. `eraseMemoryEntries` throws it with nothing deleted and nothing recorded. The code is registered in `NON_GOVERNANCE_MEMORY_CODES` (CONTROL-PLANE IO: operator attention on the store's tree, never a verdict on the caller).
+- **Unchanged.** A tree with no links behaves byte-identically: the outcome fingerprint of writes, deletes and an erasure over the store and the control plane matches 7.31.0, as does a copy-out projection's; a file deleted inside the tree is still restored byte-for-byte. No API, journal format or ledger change. The journal validator (`journalOpInvalid`) keeps its own containment check and runs first.
+- **Who is affected.** A deployment whose memory store holds a link under its root (placed by a session with shell access to the store, or by hand). An act that used to follow a directory link out of the store is now refused until the link is removed; a link at the final component is removed or replaced as the act requires (it used to be too). A harvest over a file-backend store whose whole directory was replaced by a link during the session used to report one `outside_root` rejection per file. It now reports `ok: false`, `incident.kind: "sidecar_corrupt"`, detail carrying the code; nothing is committed either way. A copy-out (non-file) backend still gets the per-file `outside_root` rejections. Known limits: `KL-1094-a` (check→act window), `KL-1094-b` (a replayed journal whose directory became a link surfaces as the validator's corruption error, not this code), `KL-1094-c` (a directory link that stays inside the store is not refused), `KL-1094-d` (a root re-pointed before a backend opens it is taken as the store; measured on 7.31.0 and here: an add then moves that directory's top-level files into `<dir>/<scope>/`), `KL-1094-e` (a root opened under another case spelling on a case-insensitive volume and then deleted refuses until reopened). `KL-1094-f` (a canonical-spelling gate falls back to the lexical spelling under a resolution fault), `KL-1094-g` (a file with a second name is refused in place until that name is removed), `KL-1094-h` (the mount's root check runs after the memory dir is created, so a re-pointed link gets an empty directory before the refusal).
+- **Pickup.** @server: map `memory.target_outside_store` on every face it reaches (the wire sheet lists each and how it arrives). The NP-4 pre-check stopgap is no longer needed for this form once this core is in the bundle.
+
 ## 7.31.0 — 2026-09-25
 
 ### The durable park row carries the mandate twin — `PendingAction.tool_approval.mandated` + `CheckpointSummary.mandated` (#1079; additive; +0 exports; +2 optional type keys; no checkpoint-version bump) — and the facts of the judgment that adjudicated the stored shape (#1088; behavior: tightening only) (@cli @client-core @server)

package/dist/core/governance-codes.js

@@ -83,6 +83,7 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.capture_optout_unpersisted",
     "memory.capture_optout_unavailable",
     "memory.capture_optout_sweep_failed",
+    "memory.target_outside_store",
 ]);
 export function governanceRetryClass(code) {
     if (Object.prototype.hasOwnProperty.call(GOVERNANCE_CODES, code)) {

package/dist/core/memory-engine/engine.d.ts

@@ -833,6 +833,8 @@ export interface SessionMemoryStatus {
 export declare class MemoryEngine {
     private readonly backend;
     private readonly memoryDir;
+    /** {@link memoryDir}'s physical form as this engine first mounted it; every later mount compares, never re-resolves. */
+    private mountedRoot;
     private readonly controlDir;
     private readonly now;
     private readonly perScopeBudgetBytes;
@@ -1776,10 +1778,17 @@ export declare class MemoryEngine {
      * @returns the rejection to report, or `undefined` when the index is clean/absent.
      */
     private gateDerivedIndex;
+    /** The file backend's verdict at an act the engine itself performs on a store path ({@link
+     *  storeTargetEscape}): throws `memory.target_outside_store` when `path` would land outside `root`;
+     *  each caller's existing failure lane reports it. `root` is the mount's canonical root where a
+     *  handle exists, so a root re-pointed after the mount is judged against the one it mounted. */
+    private refuseOutsideStore;
     /** Projection write: reads the target to skip a no-op, then writes — the same check-then-use shape
      *  as the containment restores, so it takes the same no-follow write. A link at a projection path
      *  is never a supported layout (the harvest scan refuses symlinked entry files outright), and this
-     *  site already reports write failures by throwing, so ELOOP joins the failures it already had. */
+     *  site already reports write failures by throwing, so ELOOP joins the failures it already had. A
+     *  target whose directory resolves outside `root` (a directory on the path is a link) is refused
+     *  the same way, before anything is read or written ({@link storeTargetEscape}). */
     private writeIfChanged;
     /** Persist the canonical projection back to the session file (id minting / frontmatter completion).
      *  C-F6 (S2-0): called ONLY after the backend transaction committed — never ahead of the journal

package/dist/core/memory-engine/engine.js

@@ -17,7 +17,7 @@ import { landedUndecided, layerDigest, layerObservationLookup, readOnlyLayerCand
 import { markOriginClearanceTombstoned, openOriginClearance, readOriginClearances, settleOriginClearance } from "./origin-clearance.js";
 import { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, canonicalJsonStringify, captureErasureInput, erasureRequestInvalid, erasureSelectHash, scanEntryFiles, } from "./file-backend.js";
 import { assembleMemoryExportBundle, computeMemoryBundleHash, memoryBundleInvalid, } from "./export-bundle.js";
-import { QUARANTINE_DIR, SCAN_FUSE_THRESHOLD, quarantineAndTombstone, restoreContainedBaseline, readIndexRevs, writeIndexRevs, bumpScanFuse, scanFuseKey, canonicalize, adoptRootScopeLayout, clearScanFuse, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, ensureDirExists, markSessionPolluted, readSessionPollution, fileSessionCaptureRecordStore, recordRetrievedAccount, writeFileNoFollow, withPermissionRemedy, permissionRemedyOf, readRetrievedAccount, registerScope, registeredScopes, resolveMemoryEngineRoot, scopeDirFor, appendChallengeEvents, appendLineageAudit, rebuildStrictControlPlaneLedger, isStrictControlPlaneLedgerCorrupt, CHALLENGE_LEDGER_MAX_EVENTS, adjudicateLineagePending, challengedEntryIds, clearLineageForEntries, discardLineagePending, lineageAccountOfEntry, lineageContributionsOfSession, lineageLatchedIds, promoteLineagePending, readChallengeEvents, readChallengedHistory, readLineageRecord, recordChallengedHistory, recordLineageCredential, reconcileLineage, readProjectionDebts, resolveChallengeEvent, settleProjectionDebts, stageLineagePending, stageProjectionDebts, } from "./layout.js";
+import { QUARANTINE_DIR, SCAN_FUSE_THRESHOLD, quarantineAndTombstone, restoreContainedBaseline, readIndexRevs, writeIndexRevs, bumpScanFuse, scanFuseKey, canonicalize, landingPathOf, storeTargetEscape, TARGET_OUTSIDE_STORE, adoptRootScopeLayout, clearScanFuse, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, ensureDirExists, markSessionPolluted, readSessionPollution, fileSessionCaptureRecordStore, recordRetrievedAccount, writeFileNoFollow, withPermissionRemedy, permissionRemedyOf, readRetrievedAccount, registerScope, registeredScopes, resolveMemoryEngineRoot, scopeDirFor, appendChallengeEvents, appendLineageAudit, rebuildStrictControlPlaneLedger, isStrictControlPlaneLedgerCorrupt, CHALLENGE_LEDGER_MAX_EVENTS, adjudicateLineagePending, challengedEntryIds, clearLineageForEntries, discardLineagePending, lineageAccountOfEntry, lineageContributionsOfSession, lineageLatchedIds, promoteLineagePending, readChallengeEvents, readChallengedHistory, readLineageRecord, recordChallengedHistory, recordLineageCredential, reconcileLineage, readProjectionDebts, resolveChallengeEvent, settleProjectionDebts, stageLineagePending, stageProjectionDebts, } from "./layout.js";
 import { createSessionIncarnationSeat, recalledForAnyIdentity, recalledForIdentity, rememberForIdentity } from "./session-incarnation.js";
 import { scanMemoryFileName, scanMemoryWrite, scanRemediation } from "./scan.js";
 import { writableRootOf } from "./types.js";
@@ -310,6 +310,7 @@ const STALE_LEG_NOTE = "memory session account: this harvest belongs to an earli
 export class MemoryEngine {
     backend;
     memoryDir;
+    mountedRoot;
     controlDir;
     now;
     perScopeBudgetBytes;
@@ -427,7 +428,7 @@ export class MemoryEngine {
         }
         return this.backend.readCommittedShadow?.(id) ?? readSafe(join(this.controlDir, "shadow", `${id}.md`));
     }
-    async restoreReadOnlyLayers(candidates, report, selfLeg) {
+    async restoreReadOnlyLayers(candidates, report, selfLeg, root) {
         let writers;
         for (const c of candidates) {
             const text = readSafe(c.path);
@@ -450,6 +451,7 @@ export class MemoryEngine {
                 continue;
             }
             try {
+                this.refuseOutsideStore(root, c.path, "restoring the read-only layer file");
                 writeFileNoFollow(c.path, committed);
                 report.restored.push(c.relPath);
             }
@@ -755,6 +757,7 @@ export class MemoryEngine {
             const indexPath = join(writableRoot, MEMORY_INDEX_FILENAME);
             const baseline = handle.planeBaseline !== undefined ? handle.planeBaseline.index : handle.indexText;
             try {
+                this.refuseOutsideStore(handle.memoryDir, indexPath, "sweeping the index");
                 const first = existsSync(indexPath) ? readSafe(indexPath) : undefined;
                 if (first !== undefined && first !== baseline) {
                     const onDisk = readSafe(indexPath);
@@ -1088,6 +1091,7 @@ export class MemoryEngine {
                 if (kept.length === lines.length)
                     continue;
                 try {
+                    this.refuseOutsideStore(landingPathOf(this.memoryDir), indexPath, "rewriting the index");
                     writeFileNoFollow(indexPath, kept.join("\n"));
                 }
                 catch {
@@ -1409,6 +1413,13 @@ export class MemoryEngine {
     }
     async materializeCore(scopes, writeScope, opts, legSeat) {
         ensureDirExists(this.memoryDir);
+        const physicalRoot = landingPathOf(this.memoryDir);
+        this.mountedRoot ??= physicalRoot;
+        if (physicalRoot !== this.mountedRoot) {
+            const e = new Error(`${TARGET_OUTSIDE_STORE}: the memory dir ${this.memoryDir} now resolves to ${physicalRoot}, not ${this.mountedRoot} where this engine first mounted it — refused; open a new engine on the directory you mean`);
+            e.code = TARGET_OUTSIDE_STORE;
+            throw e;
+        }
         ensureDirExists(this.controlDir);
         await this.adoptLayoutBeforeMount(writeScope);
         const restricted = opts?.adoptionRestricted === true;
@@ -1593,6 +1604,7 @@ export class MemoryEngine {
         if (handle.writableRoot !== null)
             ensureDirExists(handle.writableRoot);
         const zeroCopy = this.backendPinnedRoot !== undefined && canonicalize(this.backendPinnedRoot) === canonicalize(this.memoryDir);
+        const projectionRoot = zeroCopy ? undefined : this.mountedRoot;
         for (const [scope, dir] of scopeDirs) {
             const scopeEntries = (byScope.get(scope) ?? []).slice();
             scopeEntries.sort((a, b) => (mtimeById.get(b.id) ?? 0) - (mtimeById.get(a.id) ?? 0));
@@ -1614,8 +1626,8 @@ export class MemoryEngine {
                 const { deleted: _stubDrop, ...stubFm } = entry.frontmatter;
                 const text = stub ? serializeEntryFile({ id: entry.id, frontmatter: stubFm, body: STUB_ARCHIVED_LINE }) : fullText;
                 const target = join(dir, `${entry.slug}.md`);
-                if (!zeroCopy)
-                    this.writeIfChanged(target, text);
+                if (projectionRoot !== undefined)
+                    this.writeIfChanged(target, text, projectionRoot);
                 const onDiskRev = stub ? revOfText(text, entry.id) : entry.rev;
                 const path = canonicalize(target);
                 handle.materialized.push({
@@ -2176,7 +2188,7 @@ export class MemoryEngine {
                 signalContainment((c) => (c.indexRolledBack = true));
             report.warnings.push(`memory harvest refused by an incident while this session is marked externally exposed — no entries were committed; instruction-form files were withheld and the derived index rolled back: ${inlineUntrusted(pollutedReason, 200)}`);
         };
-        await this.restoreReadOnlyLayers(readOnlyRestorable, report, handle.accountLeg);
+        await this.restoreReadOnlyLayers(readOnlyRestorable, report, handle.accountLeg, handle.memoryDir);
         const missingWritable = writable.filter((m) => !recordByPath.has(m.path) && !existsSync(m.path) && !presentIds.has(m.id));
         report.missing.push(...missingWritable.map((m) => m.relPath));
         if (writable.length > 0 && missingWritable.length / writable.length > MASS_DELETION_FUSE_RATIO) {
@@ -2203,6 +2215,7 @@ export class MemoryEngine {
             if (content === undefined)
                 continue;
             try {
+                this.refuseOutsideStore(handle.memoryDir, m.path, "restoring");
                 mkdirSync(dirname(m.path), { recursive: true });
                 writeFileNoFollow(m.path, content);
                 report.restored.push(m.relPath);
@@ -4818,6 +4831,7 @@ export class MemoryEngine {
         if (opts.write) {
             let wrote = false;
             try {
+                this.refuseOutsideStore(handle.memoryDir, indexPath, "writing the index");
                 mkdirSync(dirname(indexPath), { recursive: true });
                 if (readNoFollowSafe(indexPath) !== text)
                     writeFileNoFollow(indexPath, text);
@@ -4908,6 +4922,7 @@ export class MemoryEngine {
         }
         let cleared = false;
         try {
+            this.refuseOutsideStore(handle.memoryDir, indexPath, "clearing the index");
             writeFileNoFollow(indexPath, "");
             cleared = true;
         }
@@ -4927,7 +4942,16 @@ export class MemoryEngine {
             contained: cleared,
         };
     }
-    writeIfChanged(target, text) {
+    refuseOutsideStore(root, path, act) {
+        const escape = storeTargetEscape(root, path);
+        if (escape === undefined)
+            return;
+        const e = new Error(`${TARGET_OUTSIDE_STORE}: ${act} ${path} was refused — ${escape}; not performed`);
+        e.code = TARGET_OUTSIDE_STORE;
+        throw e;
+    }
+    writeIfChanged(target, text, root) {
+        this.refuseOutsideStore(root, target, "the projection write of");
         const current = readNoFollowSafe(target);
         if (current === text)
             return;

package/dist/core/memory-engine/file-backend.d.ts

@@ -353,6 +353,8 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      *  NEVER under {@link directoryRoot}, always on the config-root side even for an in-repo memory dir.
      *  The engine picks this up (like `directoryRoot`) so both sides share ONE control plane. */
     readonly controlPlaneRoot: string;
+    /** {@link directoryRoot}'s physical form at construction — the root every act on a store path is judged against. */
+    private readonly physicalRoot;
     /** Injected clock (opus 1.258 LOW: match the engine's `this.now` determinism discipline). */
     private readonly now;
     /** The construction-time incident sink (partition adoption, layout adoption on the standalone faces). */
@@ -679,6 +681,19 @@ export declare class FileMemoryEngineBackend implements MemoryBackend {
      *  §3.1 ⓪ (r5-①): "no lock" is ENOENT-only — a stat FAILURE folded into "nobody is committing"
      *  let a transient EIO run the unlocked recovery (and its staged sweep) over a live transaction. */
     private txnInFlight;
+    /**
+     * The act gate for store paths ({@link storeTargetEscape}) over `ops`' writes and deletes — shadow
+     * ops name control-plane files, not store paths. Refuses with `memory.target_outside_store` at the
+     * first op that would land outside the store, naming the op and where it resolves. Runs over a
+     * whole batch before its commit marker (no journal is written; a caller that staged files removes
+     * them) and per op at the act itself; past the marker a refusal keeps the journal, which replays
+     * once the path resolves inside the store again.
+     */
+    private refuseEscapingTargets;
+    /** At the head of every face (both recovery legs, the lock-free faces' layout seat, the adoption face):
+     *  the store root still resolves to the directory this backend opened. A root re-pointed since would
+     *  carry every read, adoption, sweep and restore — not only the journal's acts — into another directory. */
+    private assertRootIntact;
     /** Remove orphaned `.stage-*` files (a crash BEFORE the journal rename = clean rollback: nothing
      *  was committed, the staged tmps are litter). Dotfiles are invisible to entry scans regardless. */
     private sweepStagedFiles;

package/dist/core/memory-engine/file-backend.js

@@ -1,4 +1,4 @@
-import { existsSync, linkSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, openSync, fsyncSync, closeSync, utimesSync } from "node:fs";
+import { existsSync, fstatSync, linkSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, openSync, fsyncSync, closeSync, utimesSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { dirname, join, relative } from "node:path";
 import { jaccardDistance, termSet } from "../memory-vector.js";
@@ -8,7 +8,7 @@ import { ambiguousOriginRepresentation, committedDistilledOf, committedOriginOf,
 import { convertV1SidecarKeys } from "./delegation-settlement.js";
 import { layerObservationLookup, observedDivergenceNotice } from "./layer-observations.js";
 import { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, scanEntryFiles } from "./entry-scan.js";
-import { ControlPlaneCorruptError, CURSORS_FILE, QUARANTINE_DIR, CHALLENGES_FILE, IMPORT_RECEIPTS_DIR, LINEAGE_FILE, SESSION_POLLUTION_DIR, appendChallengeEvents, atomicWriteFileSync, quarantineAndTombstone, captureAndClearLineageForEntries, adoptRootScopeLayout, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, ensureDirExists, enqueueMemoryAnnouncement, importLatchTxnId, importLineageCommitted, importSessionPollution, isContainedIn, permissionRemedyOf, withPermissionRemedy, lineageContributionsOfSession, listSessionPollution, readChallengeEvents, readLineageRecord, registerScope, registeredScopes, releaseImportLatch, layoutNeedsAdoption, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, scopeRegistryShape, stageImportLatch, writeAllSync, } from "./layout.js";
+import { ControlPlaneCorruptError, CURSORS_FILE, QUARANTINE_DIR, CHALLENGES_FILE, IMPORT_RECEIPTS_DIR, LINEAGE_FILE, SESSION_POLLUTION_DIR, appendChallengeEvents, atomicWriteFileSync, quarantineAndTombstone, captureAndClearLineageForEntries, adoptRootScopeLayout, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, ensureDirExists, enqueueMemoryAnnouncement, importLatchTxnId, importLineageCommitted, importSessionPollution, isContainedIn, permissionRemedyOf, withPermissionRemedy, lineageContributionsOfSession, listSessionPollution, readChallengeEvents, readLineageRecord, registerScope, registeredScopes, releaseImportLatch, layoutNeedsAdoption, resolveMemoryEngineRoot, scopeDirFor, scopeDirName, scopeRegistryShape, stageImportLatch, landingPathOf, storeTargetEscape, TARGET_OUTSIDE_STORE, writeAllSync, } from "./layout.js";
 import { screenInboundEntries } from "./data-plane.js";
 import { scanMemoryFileName, scanMemoryWrite } from "./scan.js";
 import { thrownText } from "../thrown-value.js";
@@ -522,6 +522,7 @@ function probeProjection(absPath, id) {
 export class FileMemoryEngineBackend {
     directoryRoot;
     controlPlaneRoot;
+    physicalRoot;
     now;
     onIncident;
     ledger;
@@ -545,6 +546,7 @@ export class FileMemoryEngineBackend {
             adoptCanonicalKeyedControlDir(resolveMemoryEngineRoot(), dir, opts.onIncident);
         this.controlPlaneRoot = opts.controlDir ?? deriveControlPlaneDir(resolveMemoryEngineRoot(), dir);
         ensureDirExists(dir);
+        this.physicalRoot = landingPathOf(dir);
         ensureDirExists(this.controlPlaneRoot);
         this.recoverJournal({ unlocked: true });
         try {
@@ -577,6 +579,7 @@ export class FileMemoryEngineBackend {
         });
     }
     ensureLayout(ownerCandidate) {
+        this.assertRootIntact();
         if (!layoutNeedsAdoption(this.directoryRoot, this.controlPlaneRoot))
             return;
         const lock = this.tryAcquireTxnLockSync();
@@ -591,6 +594,7 @@ export class FileMemoryEngineBackend {
         }
     }
     async adoptRootScopeLayout(opts = {}) {
+        this.assertRootIntact();
         if (!layoutNeedsAdoption(this.directoryRoot, this.controlPlaneRoot))
             return;
         const lock = await this.acquireTxnLock();
@@ -1211,6 +1215,7 @@ export class FileMemoryEngineBackend {
         }
     }
     recoverJournal(fence) {
+        this.assertRootIntact();
         if (fence.token === undefined) {
             if (this.txnInFlight())
                 return;
@@ -1399,7 +1404,10 @@ export class FileMemoryEngineBackend {
                 }
             }
             this.assertTxnLockOwnership(fenceToken);
+            const replayAt = `the journal replay (journal kept at ${jp})`;
+            this.refuseEscapingTargets(journal.ops, replayAt);
             for (const op of journal.ops) {
+                this.refuseEscapingTargets([op], replayAt);
                 try {
                     if (op.kind === "write" && op.content !== undefined) {
                         atomicWriteFileSync(op.target, op.content);
@@ -1457,6 +1465,24 @@ export class FileMemoryEngineBackend {
             throw new ControlPlaneCorruptError(`txn lock state could not be probed (${code ?? "io error"}) at ${this.txnLockDir()} — a probe failure is not "no writer" (fail-closed)`);
         }
     }
+    refuseEscapingTargets(ops, at) {
+        for (const op of ops) {
+            if (op.kind !== "write" && op.kind !== "delete")
+                continue;
+            for (const path of op.staged === undefined ? [op.target] : [op.target, op.staged]) {
+                const escape = storeTargetEscape(this.physicalRoot, path);
+                if (escape === undefined)
+                    continue;
+                throw erasureCodedError(`${TARGET_OUTSIDE_STORE}: ${at} refused a ${op.kind} of ${op.target}${path === op.target ? "" : ` (its staged file ${path})`} — ${escape}; not performed`, TARGET_OUTSIDE_STORE);
+            }
+        }
+    }
+    assertRootIntact() {
+        const now = landingPathOf(this.directoryRoot);
+        if (now === this.physicalRoot)
+            return;
+        throw erasureCodedError(`${TARGET_OUTSIDE_STORE}: the store root ${this.directoryRoot} now resolves to ${now}, not ${this.physicalRoot} where this backend opened it — refused; open a new backend on the directory you mean`, TARGET_OUTSIDE_STORE);
+    }
     sweepStagedFiles() {
         const walk = (d, depth) => {
             let names;
@@ -2366,16 +2392,37 @@ export class FileMemoryEngineBackend {
             return report;
         }
         const txn = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        const stagedFiles = [];
+        const refuseUnstaging = (batch, at) => {
+            try {
+                this.refuseEscapingTargets(batch, at);
+            }
+            catch (err) {
+                for (const f of stagedFiles) {
+                    try {
+                        const st = lstatSync(f.path);
+                        if (st.dev === f.dev && st.ino === f.ino)
+                            rmSync(f.path, { force: true });
+                    }
+                    catch {
+                    }
+                }
+                throw err;
+            }
+        };
         let n = 0;
         for (const op of ops) {
             if (op.kind !== "write" || op.content === undefined)
                 continue;
+            refuseUnstaging([op], "applyPatches (staging)");
             const staged = join(dirname(op.target), `.stage-${txn}-${n++}`);
             mkdirSync(dirname(op.target), { recursive: true });
             const fd = openSync(staged, "w", 0o600);
             try {
                 writeAllSync(fd, op.content);
                 fsyncSync(fd);
+                const st = fstatSync(fd);
+                stagedFiles.push({ path: staged, dev: st.dev, ino: st.ino });
             }
             finally {
                 closeSync(fd);
@@ -2393,8 +2440,10 @@ export class FileMemoryEngineBackend {
         if (coherentTransfers.length > 0)
             this.precheckTransfersAppendable();
         const journal = { txn, ops, ledger2: ledgerEnvelope(rows, this.envelopeExtras), ...(coherentTransfers.length > 0 ? { transfers: coherentTransfers } : {}) };
+        refuseUnstaging(ops, "applyPatches (commit point)");
         atomicWriteFileSync(join(this.controlPlaneRoot, JOURNAL_FILE), JSON.stringify(journal));
         for (const op of ops) {
+            this.refuseEscapingTargets([op], "applyPatches (after the commit point; the journal is kept)");
             if (op.kind === "write" && op.staged) {
                 renameSync(op.staged, op.target);
             }
@@ -2819,8 +2868,10 @@ export class FileMemoryEngineBackend {
                 this.assertTxnLockOwnership(lock.token);
                 this.precheckTransfersAppendable();
                 const journal = { txn, ops, ledger2: ledgerEnvelope(rows, this.envelopeExtras), transfers };
+                this.refuseEscapingTargets(ops, "eraseWithEvidence (commit point)");
                 atomicWriteFileSync(join(this.controlPlaneRoot, JOURNAL_FILE), JSON.stringify(journal));
                 for (const op of ops) {
+                    this.refuseEscapingTargets([op], "eraseWithEvidence (after the commit point; the journal is kept)");
                     if (op.kind === "delete") {
                         rmSync(op.target, { force: true });
                     }

package/dist/core/memory-engine/layout.d.ts

@@ -259,6 +259,28 @@ export declare function adoptRootScopeLayout(rootPath: string, controlDir: strin
 export declare const canonicalize: typeof physicalPathOfExisting;
 /** True iff `child` (canonicalized) is `root` or inside it. */
 export declare function isContainedIn(root: string, child: string): boolean;
+/** The code an act on a store path is refused with when it would land outside the store ({@link storeTargetEscape}). */
+export declare const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
+/** Where an act at `p` lands: the physical path of its normalized spelling (the spelling a child path
+ *  joined under it carries), a MISSING tail rejoined under the deepest existing directory (what the act
+ *  creates). Any other resolution fault (EACCES, ELOOP, ENOTDIR) is THROWN as itself: an act that
+ *  cannot be placed is not performed — a failed resolution never implies the act would fail too
+ *  (a link whose own mode refuses `realpath` is still followed by `unlink` and `rename`). */
+export declare function landingPathOf(p: string): string;
+/**
+ * Where a write, rename or delete at `target` would physically LAND, judged against the store's
+ * `physicalRoot`: `undefined` = inside, otherwise the reason. The target's directory, resolved through
+ * every link on its existing prefix (a missing tail is what the act creates, under the deepest existing
+ * directory), must be the root or inside it. `physicalRoot` is the root's physical form as the store
+ * was opened and is not re-resolved here: a store mounted through a link is judged by what the link
+ * resolved to, and a root spelling re-pointed after opening moves the acts, not the store. The final
+ * component is not judged: `rename` and `unlink` act on it and never through it, and the engine's
+ * writes open it no-follow — a link there is replaced, removed or refused, and what it points at is
+ * untouched. A lexical spelling under the root proves nothing: a directory under it replaced by a link
+ * keeps the spelling while the act follows the link out. A directory that cannot be resolved throws its
+ * fault ({@link landingPathOf}).
+ */
+export declare function storeTargetEscape(physicalRoot: string, target: string): string | undefined;
 /** mkdir -p convenience used by the engine/backend (0o700 like the file stores). */
 export declare function ensureDirExists(dir: string): void;
 /** The one remedy every surfaced permission refusal carries — `undefined` unless `err` is a write
@@ -324,10 +346,13 @@ export interface QuarantineOutcome {
  * without native bindings. What this buys is the leaf variant, which is the cheap one; the ancestor
  * variant stays open and is recorded with the rest of the family rather than papered over.
  *
- * Throws like `writeFileSync`, including ELOOP when the final component IS a symlink. The write
- * itself goes through `writeFileSync` on the open descriptor, which writes every byte or throws —
- * a bare `writeSync` may short-write, and reporting a truncated restore as contained (after
- * `O_TRUNC` already destroyed the destination) is the failure this guard exists to prevent.
+ * Throws like `writeFileSync`, including ELOOP when the final component IS a symlink. A HARD link is the
+ * same tamper by other means — the file's bytes live under a second name, possibly outside the store, and
+ * an in-place write would change them there too — so an opened file with more than one name is refused
+ * the same way, before anything is truncated (the check reads the opened descriptor: no window). The
+ * write itself goes through `writeFileSync` on the open descriptor, which writes every byte or throws —
+ * a bare `writeSync` may short-write, and reporting a truncated restore as contained (after the
+ * truncation already destroyed the destination) is the failure this guard exists to prevent.
  */
 export declare function writeFileNoFollow(path: string, content: string): void;
 /** {@link writeFileNoFollow}'s NO-REPLACE twin: write `content` only if nothing is at `path`. `"written"`

package/dist/core/memory-engine/layout.js

@@ -1,10 +1,10 @@
-import { closeSync, constants as fsConstants, copyFileSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync, writeSync } from "node:fs";
-const { O_WRONLY, O_RDONLY, O_CREAT, O_TRUNC, O_NOFOLLOW, O_NONBLOCK, O_EXCL } = fsConstants;
+import { closeSync, constants as fsConstants, copyFileSync, existsSync, fstatSync, fsyncSync, ftruncateSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync, writeSync } from "node:fs";
+const { O_WRONLY, O_RDONLY, O_CREAT, O_NOFOLLOW, O_NONBLOCK, O_EXCL } = fsConstants;
 import { homedir } from "node:os";
 import { createHash } from "node:crypto";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { MEMORY_ORIGIN_CAUSES } from "./types.js";
-import { physicalPathOfExisting, priorCallerCasedPathOf } from "../physical-path.js";
+import { physicalPathOf, physicalPathOfExisting, priorCallerCasedPathOf } from "../physical-path.js";
 import { thrownLabel, thrownText } from "../thrown-value.js";
 const SCOPES_FILE = "scopes.json";
 export const CURSORS_FILE = "cursors.json";
@@ -724,6 +724,22 @@ export function isContainedIn(root, child) {
     const c = canonicalize(child);
     return c === r || c.startsWith(`${r}${sep}`);
 }
+export const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
+export function landingPathOf(p) {
+    const normalized = resolve(p);
+    try {
+        return physicalPathOf(normalized);
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+        return canonicalize(normalized);
+    }
+}
+export function storeTargetEscape(physicalRoot, target) {
+    const dir = landingPathOf(dirname(target));
+    return dir === physicalRoot || dir.startsWith(`${physicalRoot}${sep}`) ? undefined : `its directory resolves to ${dir}, outside the store root ${physicalRoot}`;
+}
 export function ensureDirExists(dir) {
     if (!existsSync(dir))
         mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -749,8 +765,12 @@ export function withPermissionRemedy(err, memoryDir) {
 export const QUARANTINE_DIR = "quarantine";
 const DELETED_TOMBSTONE = "---\ndeleted: true\n---\n";
 export function writeFileNoFollow(path, content) {
-    const fd = openSync(path, O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW, 0o644);
+    const fd = openSync(path, O_WRONLY | O_CREAT | O_NOFOLLOW, 0o644);
     try {
+        const links = fstatSync(fd).nlink;
+        if (links > 1)
+            throw Object.assign(new Error(`${path} has ${links} names (a hard link) — a write through one name changes the file under the others; not written`), { path });
+        ftruncateSync(fd, 0);
         writeFileSync(fd, content, "utf8");
     }
     finally {

package/dist/core/secret-env.d.ts

@@ -19,7 +19,7 @@
 import type { RedactionConfidence, RedactionSource } from "./arg-summary.js";
 import { type EngineNotice } from "./engine-notice.js";
 /** Which rule classified a key as secret-shaped — the env arm's `kind` vocabulary. */
-export type SecretEnvFindingKind = "suffix-rule" | "exact-name";
+export type SecretEnvFindingKind = "suffix-rule" | "namespace-rule" | "exact-name";
 /** One env entry the `scrub` policy dropped: the key (the VALUE is never carried — this record is meant
  *  to be loggable), the rule that classified it, how strong that claim is, and the minting module. */
 export interface SecretEnvFinding {

package/dist/core/secret-env.js

@@ -1,6 +1,8 @@
 import { deliverEngineNotice } from "./engine-notice.js";
 const TOKEN_COUNT_WORDS = ["MAX", "OUTPUT", "INPUT", "THINKING", "NUM", "TOTAL"];
-const SECRET_ENV_RE = new RegExp(`(^|_)(KEY|KEYS|TOKEN|(?<!(?:^|_)(?:${TOKEN_COUNT_WORDS.join("|")})_)TOKENS|SECRET|SECRETS|PASSWORD|PASSWORDS|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATEKEY|APIKEY|ACCESS_KEY|SESSION_TOKEN)(?:_(?:\\d+|ID))?$`, "i");
+const CREDENTIAL_WORD = `KEY|KEYS|TOKEN|(?<!(?:^|_)(?:${TOKEN_COUNT_WORDS.join("|")})_)TOKENS|SECRET|SECRETS|PASSWORD|PASSWORDS|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATEKEY|APIKEY`;
+const SECRET_ENV_RE = new RegExp(`(^|_)(${CREDENTIAL_WORD})(?:_(?:\\d+|ID))?$`, "i");
+const SEMA_NAMESPACE_SECRET_RE = new RegExp(`^SEMA_(?:.*_)?(?:${CREDENTIAL_WORD})(?:_|$)`, "is");
 const SECRET_ENV_EXACT_NAMES = new Set([
     "DATABASE_URL", "CONNECTION_STRING", "DSN", "NPM_AUTH",
     "PGPASSWORD", "MYSQL_PWD", "SSHPASS", "GPG_PASSPHRASE", "GH_PAT", "GITHUB_PAT",
@@ -16,6 +18,7 @@ const NON_SECRET_ENV_EXACT_NAMES = new Set([
 const SECRET_ENV_KIND_CONFIDENCE = {
     "exact-name": "high",
     "suffix-rule": "medium",
+    "namespace-rule": "medium",
 };
 export function classifyExactEnvName(key, credentialNames, exemptNames) {
     const upper = key.toUpperCase();
@@ -31,7 +34,9 @@ function classifySecretEnvKey(key) {
         return "exact-name";
     if (byExactName === "exempt")
         return undefined;
-    return SECRET_ENV_RE.test(key) ? "suffix-rule" : undefined;
+    if (SECRET_ENV_RE.test(key))
+        return "suffix-rule";
+    return SEMA_NAMESPACE_SECRET_RE.test(key) ? "namespace-rule" : undefined;
 }
 export function isSecretEnvKey(key) {
     return classifySecretEnvKey(key) !== undefined;

package/dist/tools/fs/shell-read-plan.d.ts

@@ -62,8 +62,8 @@ export interface ReadCandidate {
      *  A deny row is a floor, so the judge resolves the spelling against these for deny rows ONLY — never to
      *  establish a read. `cd sub && cd $'\x2e' && cat <deny row under sub>` (bash: `cd .`) is refused through it. */
     readonly floorBases?: readonly string[];
-    /** A home word the plan does not place (the text may rebind `HOME`, or it sits in a value): spelled with the DECLARED
-     *  home. A deny row is a floor: the judge reads it for deny rows ONLY, never to establish a read. */
+    /** A home word the plan does not place (the text may rebind `HOME`, it sits in a value, or it is a literal tilde the
+     *  program may expand itself): spelled with the DECLARED home. The judge reads it for deny rows ONLY. */
     readonly floorSpelled?: string;
     /** A deny-floor shadow of a `floorSpelled` spelling, established as a read and judged for deny rows only. */
     readonly denyOnly?: true;

package/dist/tools/fs/shell-read-plan.js

@@ -193,7 +193,7 @@ function segmentFacts(segment, p, decl, home, nestedPlan) {
             unresolvedRaw.add(w.raw);
     }
     const homeWithheld = home === undefined && decl.homeDir !== undefined;
-    const floor = (c) => { const f = c.expands === "unresolvable" && decl.homeDir !== undefined ? spelledWithHome(c.spelled, c.raw, decl.homeDir) : undefined; return f === undefined ? c : { ...c, floorSpelled: f }; };
+    const floor = (c) => { const f = (c.expands === "unresolvable" || c.spelled.startsWith("./~")) && decl.homeDir !== undefined ? spelledWithHome(c.spelled, c.raw, decl.homeDir) : undefined; return f === undefined ? c : { ...c, floorSpelled: f }; };
     const unsettle = (c) => floor((unresolvedRaw.has(c.raw) || (homeWithheld && c.spelled.startsWith("~"))) && c.expands !== "unresolvable" ? { ...c, expands: "unresolvable" } : c);
     const move = facts.baseMove;
     return {
@@ -268,9 +268,8 @@ function segmentFactsRead(segment, p, decl, home, nestedPlan) {
     const basename = program?.basename;
     const listed = basename !== undefined && (decl.readers.has(basename) || basename === "cd");
     const verb = program === undefined ? undefined : { name: program.name, basename: program.basename, listed };
-    const envOpens = basename !== undefined && !NO_PATH_OPERAND_COMMANDS.has(basename);
     for (const k of pos.assignments)
-        pushAssignment(reads, toks[k].word, "env_assignment", envOpens);
+        pushAssignment(reads, toks[k].word, "env_assignment");
     for (const l of pos.launchers) {
         const r = toks[l.index];
         if (isPathShapedToken(r.folded))
@@ -313,7 +312,7 @@ function segmentFactsRead(segment, p, decl, home, nestedPlan) {
                 continue;
             }
             if (r.word.assignment !== undefined) {
-                pushAssignment(reads, r.word, "env_assignment", envOpens);
+                pushAssignment(reads, r.word, "env_assignment");
                 continue;
             }
             reads.push(bare(r, "unlisted_word"));
@@ -462,7 +461,7 @@ function dedupe(reads) {
     const seen = new Set();
     const out = [];
     for (const c of reads) {
-        const key = `${c.provenance}\u0000${c.spelled}\u0000${c.expands}\u0000${c.denyOnly === true}`;
+        const key = `${c.provenance}\u0000${c.spelled}\u0000${c.expands}\u0000${c.raw}\u0000${c.denyOnly === true}`;
         if (seen.has(key))
             continue;
         seen.add(key);
@@ -488,7 +487,7 @@ function redirectFact(r, home) {
         return { op: r.op, direction: "in" };
     return { op: r.op, direction: "out", target: bare(readsOf([r.target], home)[0], "write_redirect_target") };
 }
-function pushAssignment(reads, w, provenance, opensValue = true) {
+function pushAssignment(reads, w, provenance) {
     const a = w.assignment;
     if (a === undefined)
         return;
@@ -498,13 +497,19 @@ function pushAssignment(reads, w, provenance, opensValue = true) {
     const named = a.value.folded === "" || (a.op === "+=" ? expandsTilde : !settled) ? undefined : value;
     if (a.value.folded === "" && settled)
         return;
-    const v = { spelled: a.value.folded, raw: a.bare ? a.value.raw : w.raw, provenance };
+    const v = { spelled: value, raw: a.bare ? a.value.raw : w.raw, provenance };
     const unsettled = provenance !== "env_assignment" ? { ...v, expands: "unresolvable" } : v.spelled.startsWith("~") && !v.spelled.includes(":") ? { ...v, expands: expandsOf(a.value) } : undefined;
-    if (!settled && opensValue && unsettled !== undefined)
+    if (!settled && unsettled !== undefined)
         reads.push(unsettled);
     const substitutes = a.value.expansions.some((p) => p.expansion?.kind === "command" || p.expansion?.kind === "process" || p.expansion?.kind === "arithmetic");
     if (named !== undefined && !substitutes)
         reads.push({ spelled: named, raw: w.raw, provenance, expands: expandsOf(w) });
+    if (a.value.folded.includes(":"))
+        for (const m of a.value.folded.split(":"))
+            if (m !== "") {
+                const r = readOfText(m);
+                reads.push({ spelled: r.folded, raw: r.raw, provenance, expands: r.expands, denyOnly: true });
+            }
     if (a.form === "compound")
         for (const e of compoundArrayElements(a.value))
             reads.push({ spelled: e.folded, raw: e.raw, provenance, expands: e.expands, ...(e.denyOnly === true ? { denyOnly: true } : {}) });
@@ -527,7 +532,7 @@ function unlistedWords(reads, toks, from, launcherIndices, provenance, program)
         expanding.add(j);
         reads.push(bare(toks[j], j === argvStart ? "program_path" : provenance));
         if (j < argvStart)
-            pushAssignment(reads, toks[j].word, "env_assignment", slotVerb !== undefined && !noPathOperands);
+            pushAssignment(reads, toks[j].word, "env_assignment");
         else if (j > argvStart && !declaredNotPaths)
             pushAssignment(reads, toks[j].word, provenance);
     }
@@ -605,7 +610,7 @@ function unlistedWords(reads, toks, from, launcherIndices, provenance, program)
         }
         reads.push(bare(r, j === argvStart ? "program_path" : provenance));
         if (j < argvStart)
-            pushAssignment(reads, r.word, "env_assignment", slotVerb !== undefined && !noPathOperands);
+            pushAssignment(reads, r.word, "env_assignment");
         else if (!declaredNotPaths)
             pushAssignment(reads, r.word, provenance);
     }

package/dist/tools/fs/shell-read-word.d.ts

@@ -25,10 +25,11 @@ export declare function readsOf(words: readonly LexedWord[], home: string | unde
 export declare const rewritten: (r: Read) => boolean;
 /** The reading of a text that came out of a word (a sed script's file operand): one shell word, or unresolvable. */
 export declare function readOfText(text: string): Read;
-/** A home-rooted candidate spelled with `home`: a leading `~` / `~/` (a literal tilde is spelled `./~` before this
- *  point, so a leading `~` IS the expansion), or a `$HOME` / `${HOME}` word as {@link homeExpansionOf} reads it —
- *  read off the VALUE's pieces when the word is assignment-shaped (`A="$HOME/x"`, `dd if="$HOME/x"`: the candidate is
- *  the value, quotes kept); `undefined` for any other (`~user`, a payload, a word that is no home word). */
+/** A home-rooted candidate spelled with `home`: a leading `~` / `~/` — the shell's expansion, or the literal-tilde
+ *  spelling `./~` of one it leaves alone (quoted, escaped, after an option's `=`), which the program it reaches may
+ *  expand itself — or a `$HOME` / `${HOME}` word as {@link homeExpansionOf} reads it, read off the VALUE's pieces when
+ *  the word is assignment-shaped (`A="$HOME/x"`, `dd if="$HOME/x"`: the candidate is the value, quotes kept);
+ *  `undefined` for any other (`~user`, a word that is no home word). */
 export declare function spelledWithHome(spelled: string, raw: string, home: string): string | undefined;
 /** A function definition's head names nothing that runs here and is dropped from a segment's tokens, in place:
  *  `NAME ( )` (an identifier), and `function NAME [( )]` — a bare `function` at command position, a name of any

package/dist/tools/fs/shell-read-word.js

@@ -20,8 +20,9 @@ export function readOfText(text) {
     return { word, raw: text, folded: text, expands: expandsOf(word) };
 }
 export function spelledWithHome(spelled, raw, home) {
-    if (spelled.startsWith("~"))
-        return /^~(?:\/|$)/.test(spelled) ? `${home}${spelled.slice(1)}` : undefined;
+    const tilde = spelled.startsWith("./~") ? spelled.slice(2) : spelled;
+    if (tilde.startsWith("~"))
+        return /^~(?:\/|$)/.test(tilde) ? `${home}${tilde.slice(1)}` : undefined;
     if (!raw.includes("HOME"))
         return undefined;
     const w = readOfText(raw).word;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.31.0",
+  "version": "7.31.1",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.31.1.json

@@ -0,0 +1,189 @@
+{
+  "repo": "core",
+  "version": "7.31.1",
+  "from": "289b2d1998a3e890f6a8659ffc4397074ddd720a",
+  "to": "v7.31.1",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#1094, memory store; +1 error code `memory.target_outside_store`, registered in `NON_GOVERNANCE_MEMORY_CODES`; +0 exports, +0 wire keys): an act at a memory store path is judged by where it LANDS, not by how it is spelled. One verdict — the target's DIRECTORY, resolved through every link on its existing prefix, must be the store root's physical form or inside it (the final component is not judged: the backend's `rm` removes a link standing there and `rename` replaces it, the engine's in-place writes refuse it with `ELOOP` — none follows it) — gates `FileMemoryEngineBackend.applyPatches` (per op at staging, the whole batch at the commit point, per op at each act), erasure (`MemoryEngine.eraseMemoryEntries`: commit point and act), journal replay (the whole journal before its first act, each op again at its act), and the engine's own writes at store paths: the copy-out projection, the harvest's missing-file restore, the read-only layer restore and the `MEMORY.md` index writes. The backend takes its root's physical form when it opens the store and re-checks it at the head of every face; the engine takes its memory dir's physical form at its first mount and a later mount that resolves elsewhere is refused. Separately, the engine's in-place write refuses a file with more than one name (a hard link), before anything is truncated. A refused `applyPatches` / erasure throws a plain `Error` whose `.code` is the new code — before the commit marker nothing is written and no journal is left, after it the journal is kept and replays once the path resolves inside again; a refused mount throws the code; a refused restore or index write is not performed and is reported on `HarvestReport.warnings` (or `incident.detail`) with the code, a hard-link refusal names the file. WHO IS HURT: a deployment whose store holds a directory link under its root, or a hard-linked memory file — the act that used to follow it is refused until it is removed. Known limits KL-1094-a … i."
+    },
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#1099, spawned-environment scrub; `SecretEnvFindingKind` +1 member `namespace-rule`, confidence `medium`; +0 exports, +0 wire keys): inside the host shell's `SEMA_` namespace, and only there, a credential word as ANY `_`-separated segment makes the name a credential (`SEMA_NAMESPACE_SECRET_RE`, over the one `CREDENTIAL_WORD` alternation the suffix rule reads, the count-word reading of `TOKENS` included) — so `SEMA_MODEL_KEY_<ENTRY>`, `SEMA_WEBSEARCH_KEY_<PROVIDER>` and `SEMA_REGISTRY_TOKEN_FILE` no longer reach a tool's child shell or a language server, and the one `config.secret_env_scrubbed` notice lists them in `detail.names`. The rule is consulted after the two exact-name lists and the suffix rule, so no existing finding changes kind, and every name outside `SEMA_` keeps its v7.31.0 verdict and kind. WHO IS HURT: a `SEMA_` name with a credential-word segment that a child needed (`SEMA_REGISTRY_TOKEN_FILE`, `SEMA_LLM_KEY_DB`, six `SEMA_CODE_*` knobs a nested `sema` reads); an `inheritEnv` allowlist, `shellEnv` / a per-exec env and a host-supplied LSP `env` still pass a name verbatim."
+    },
+    {
+      "id": "F3",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING (#1100, shell read boundary; tightening only — no verdict loosens against 7.31.0; +0 exports, +0 wire keys; supersedes #1004's no-opener ruling for tilde values): three rules on one mechanism, the declared-home deny floor. (1) The opener condition leaves the assignment-value reading: an environment value with a leading tilde is placed against the declared home whether or not a program opens it, so `F=~/<deny row>; cat \"$F\"` meets the deny judge exactly as its `$HOME` and literal spellings already did. (2) A LITERAL tilde (quoted, escaped, after an option's `=`) — a relative `./~…` path to bash, but a program such as npm expands it itself — also carries its declared-home spelling as a deny-only view: refused on a deny row, never a containment question. (3) Each member of a `:` list meets the deny rows (a tilde member placed against the home); the whole value is still no containment candidate. Where no deny row is hit nothing changes. WHO IS HURT: a text whose value or literal-tilde operand names a deny row under the declared home and is never read that way is refused, as its `$HOME` and literal spellings already were (KL-1100a / KL-1100b)."
+    }
+  ],
+  "closedSetMembers": [
+    {
+      "set": "SecretEnvFindingKind",
+      "at": [
+        "src/core/secret-env.ts:181"
+      ],
+      "newSet": false,
+      "added": [
+        "namespace-rule"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 216,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "engineNoticeCode",
+      "name": "config.secret_env_scrubbed",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.mandated",
+      "assertions": [
+        "G3.a",
+        "G3.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "EngineNotice.detail",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "FileMemoryEngineBackend.applyPatches",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "HarvestReport.incident",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "HarvestReport.ok",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "HarvestReport.restored",
+      "assertions": [
+        "G1.a",
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "HarvestReport.warnings",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "MemoryEngine.eraseMemoryEntries",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "MemoryEngine.materialize",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "MemoryErasureAttestation.status",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "PatchReport.applied",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.confidence",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.key",
+      "assertions": [
+        "G2.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "SecretEnvFinding.kind",
+      "assertions": [
+        "G2.a",
+        "G2.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ShellReadVerdict.disposition",
+      "assertions": [
+        "G3.a",
+        "G3.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ShellReadVerdict.finding",
+      "assertions": [
+        "G3.a",
+        "G3.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ShellReadVerdict.readRootCandidate",
+      "assertions": [
+        "G3.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@4e593722 server@c60beebe sdk@a9440f2 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it. Ledger files (**/docs/core-consumption/**, **/docs/wire-consumption/**, **/*LEDGER*.json) are not evidence of use — server: 1 name(s) matched ONLY in bookkeeping files and were set aside (SecretEnvFindingKind)"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "c7c5484e2ab1b4abcba1297de62424e71306e66c"
+}