@sentry/junior-memory 0.91.0 → 0.92.1

package/dist/recall.d.ts

@@ -1,4 +1,4 @@
-import type { PromptMessage, Requester, Source } from "@sentry/junior-plugin-api";
+import type { PromptMessage, Actor, Source } from "@sentry/junior-plugin-api";
 import { type MemoryDb, type MemoryEmbeddingProvider } from "./store";
 export interface MemoryRecallContext {
     conversationId?: string;
@@ -6,7 +6,7 @@ export interface MemoryRecallContext {
     embedder?: MemoryEmbeddingProvider;
     /** Maximum cosine distance for vector recall. Passed through to the memory store. */
     maxVectorDistance?: number;
-    requester?: Requester;
+    actor?: Actor;
     source: Source;
     text: string;
 }

package/dist/store.d.ts

@@ -118,7 +118,7 @@ export interface MemoryStore {
     archiveExpiredMemories(input?: ArchiveExpiredMemoriesInput): Promise<ArchiveExpiredMemoriesResult>;
     /** Archive a visible memory in the current runtime context. */
     archiveMemory(input: ArchiveMemoryInput): Promise<MemoryRecord>;
-    /** Store a personal memory for the current requester. */
+    /** Store a personal memory for the current actor. */
     createMemory(input: CreateMemoryInput): Promise<CreateMemoryResult>;
     /** Store a conversation memory for the current source conversation. */
     createConversationMemory(input: CreateMemoryInput): Promise<CreateMemoryResult>;

package/dist/tools.d.ts

@@ -1,4 +1,4 @@
-import { type Source, type Requester } from "@sentry/junior-plugin-api";
+import { type Source, type Actor } from "@sentry/junior-plugin-api";
 import { type MemoryEmbeddingProvider, type MemoryDb, type MemorySupersessionDecider } from "./store";
 import { type MemoryAgent } from "./agent";
 export type MemoryReviewer = Pick<MemoryAgent, "reviewCreateRequest">;
@@ -8,7 +8,7 @@ export interface MemoryToolContext {
     conversationId?: string;
     db: MemoryDb;
     embedder?: MemoryEmbeddingProvider;
-    requester?: Requester;
+    actor?: Actor;
     source: Source;
     userText?: string;
 }

package/dist/types.d.ts

@@ -13,7 +13,7 @@ export type MemoryEmbeddingMetric = (typeof MEMORY_EMBEDDING_METRICS)[number];
 /** Runtime-owned memory invocation fields used for scope and source authority. */
 export declare const slackMemoryRuntimeContextSchema: z.ZodObject<{
     conversationId: z.ZodOptional<z.ZodString>;
-    requester: z.ZodOptional<z.ZodObject<{
+    actor: z.ZodOptional<z.ZodObject<{
         platform: z.ZodLiteral<"slack">;
         teamId: z.ZodString;
         email: z.ZodOptional<z.ZodString>;
@@ -36,7 +36,7 @@ export declare const slackMemoryRuntimeContextSchema: z.ZodObject<{
 /** Runtime-owned local memory invocation fields used for scope and source authority. */
 export declare const localMemoryRuntimeContextSchema: z.ZodObject<{
     conversationId: z.ZodOptional<z.ZodString>;
-    requester: z.ZodOptional<z.ZodObject<{
+    actor: z.ZodOptional<z.ZodObject<{
         platform: z.ZodLiteral<"local">;
         email: z.ZodOptional<z.ZodString>;
         fullName: z.ZodOptional<z.ZodString>;
@@ -52,7 +52,7 @@ export declare const localMemoryRuntimeContextSchema: z.ZodObject<{
 /** Runtime-owned memory invocation fields accepted by memory store operations. */
 export declare const memoryRuntimeContextSchema: z.ZodUnion<readonly [z.ZodObject<{
     conversationId: z.ZodOptional<z.ZodString>;
-    requester: z.ZodOptional<z.ZodObject<{
+    actor: z.ZodOptional<z.ZodObject<{
         platform: z.ZodLiteral<"slack">;
         teamId: z.ZodString;
         email: z.ZodOptional<z.ZodString>;
@@ -73,7 +73,7 @@ export declare const memoryRuntimeContextSchema: z.ZodUnion<readonly [z.ZodObjec
     }, z.core.$strict>;
 }, z.core.$strict>, z.ZodObject<{
     conversationId: z.ZodOptional<z.ZodString>;
-    requester: z.ZodOptional<z.ZodObject<{
+    actor: z.ZodOptional<z.ZodObject<{
         platform: z.ZodLiteral<"local">;
         email: z.ZodOptional<z.ZodString>;
         fullName: z.ZodOptional<z.ZodString>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-memory",
-  "version": "0.91.0",
+  "version": "0.92.1",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -27,7 +27,7 @@
     "commander": "^14.0.3",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.91.0"
+    "@sentry/junior-plugin-api": "0.92.1"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",

package/src/agent.ts

@@ -1,10 +1,14 @@
-import type { PluginModel } from "@sentry/junior-plugin-api";
+import { actorSchema, type PluginModel } from "@sentry/junior-plugin-api";
 import { z } from "zod";
 import type {
   MemorySupersessionDecision,
   MemorySupersessionInput,
 } from "./store";
-import { MEMORY_KINDS, memoryRuntimeContextSchema } from "./types";
+import {
+  MEMORY_KINDS,
+  memoryRuntimeContextSchema,
+  type MemoryKind,
+} from "./types";
 
 const memoryKindSchema = z.enum(MEMORY_KINDS);
 const memoryRejectReasonSchema = z.enum([
@@ -30,6 +34,17 @@ const createMemoryRequestSchema = z
       .optional(),
   })
   .strict();
+const transcriptProvenanceSchema = z
+  .object({
+    authority: z.enum(["instruction", "context"]),
+    actor: actorSchema.optional(),
+  })
+  .strict();
+const evidenceMessageIndicesSchema = z
+  .array(z.number().int().nonnegative())
+  .min(1)
+  .max(10)
+  .describe("Indices from <run-transcript> that directly support this memory.");
 const extractSessionRequestSchema = z
   .object({
     existingMemories: z
@@ -42,6 +57,7 @@ const extractSessionRequestSchema = z
       )
       .max(10)
       .default([]),
+    actors: z.array(actorSchema),
     runtimeContext: memoryRuntimeContextSchema,
     transcript: z
       .array(
@@ -51,6 +67,8 @@ const extractSessionRequestSchema = z
               type: z.literal("message"),
               role: z.enum(["user", "assistant"]),
               text: z.string().min(1),
+              provenance: transcriptProvenanceSchema.optional(),
+              isRunActor: z.boolean().optional(),
             })
             .strict(),
           z
@@ -117,13 +135,13 @@ const memoryReviewResponseSchema = z.discriminatedUnion("decision", [
     .object({
       decision: z.literal("store"),
       kind: memoryKindSchema.describe(
-        "Use preference only for requester-owned personal preferences, opinions, habits, or workflows. Use procedure for reusable task or process instructions. Use knowledge for shared project, channel, operational, or runbook facts.",
+        "Use preference only for actor-owned personal preferences, opinions, habits, or workflows. Use procedure for reusable task or process instructions. Use knowledge for shared project, channel, operational, or runbook facts.",
       ),
       canonicalFact: z
         .string()
         .min(1)
         .describe(
-          "Stored memory text. It must be self-contained and must not include requester names, requester/user labels, source labels, or first- or second-person wording.",
+          "Stored memory text. It must be self-contained and must not include actor names, actor/user labels, source labels, or first- or second-person wording.",
         ),
       expiresAtMs: expiresAtMsSchema,
     })
@@ -138,15 +156,16 @@ const memoryReviewResponseSchema = z.discriminatedUnion("decision", [
 const extractedMemorySchema = z
   .object({
     kind: memoryKindSchema.describe(
-      "Use preference only for requester-owned personal preferences, opinions, habits, or workflows. Use procedure for reusable task or process instructions. Use knowledge for shared project, channel, operational, or runbook facts.",
+      "Use preference only for actor-owned personal preferences, opinions, habits, or workflows. Use procedure for reusable task or process instructions. Use knowledge for shared project, channel, operational, or runbook facts.",
     ),
     canonicalFact: z
       .string()
       .min(1)
       .describe(
-        "Stored memory text as one self-contained fact. It must not include requester names, requester/user labels, source labels, or first- or second-person wording.",
+        "Stored memory text as one self-contained fact. It must not include actor names, actor/user labels, source labels, or first- or second-person wording.",
       ),
     expiresAtMs: expiresAtMsSchema,
+    evidenceMessageIndices: evidenceMessageIndicesSchema,
   })
   .strict();
 const extractedMemoryResultSchema = z
@@ -154,6 +173,7 @@ const extractedMemoryResultSchema = z
     content: z.string().min(1),
     expiresAtMs: expiresAtMsSchema,
     kind: memoryKindSchema,
+    evidenceMessageIndices: evidenceMessageIndicesSchema,
   })
   .strict();
 const extractMemoriesResponseSchema = z
@@ -220,7 +240,7 @@ const MEMORY_EXTRACTION_SYSTEM = [
 ].join("\n");
 const MEMORY_SUPERSESSION_SYSTEM = [
   "You are Junior's memory supersession agent.",
-  "Decide whether a new requester preference clearly replaces existing active requester preferences.",
+  "Decide whether a new actor preference clearly replaces existing active actor preferences.",
   "Return supersedes_old only for obvious changed preferences about the same mutable slot.",
   "If the facts are additive, different topics, duplicate, broader/narrower without direct replacement, or uncertain, do not supersede.",
 ].join("\n");
@@ -229,9 +249,9 @@ const CANONICAL_CONTENT_RULES = [
   "- Store the minimum useful assertion supported by source evidence; do not add adjacent steps, caveats, or generalized advice.",
   "- Do not return both concise and expanded variants of the same source assertion; keep the shortest self-contained canonical memory.",
   "- Put ownership in structured fields, not prose.",
-  "- For requester memories, omit the subject and write a stable fact such as 'Prefers X', 'Uses Y', or 'Thinks Z'.",
+  "- For actor memories, omit the subject and write a stable fact such as 'Prefers X', 'Uses Y', or 'Thinks Z'.",
   "- Drop perspective/provenance markers while preserving useful context.",
-  "- Remove requester names, display names, requester/user labels, first- or second-person wording, thread labels, channel labels, and source labels.",
+  "- Remove actor names, display names, actor/user labels, first- or second-person wording, thread labels, channel labels, and source labels.",
 ];
 
 function escapeXml(value: string): string {
@@ -245,18 +265,18 @@ function runtimeDescription(
   request: Pick<CreateMemoryRequest, "expiresAtMs" | "runtimeContext">,
 ): string {
   const runtime = request.runtimeContext;
-  const requester =
-    runtime.requester?.platform === "slack"
-      ? `slack:${runtime.requester.teamId}:${runtime.requester.userId}`
-      : runtime.requester?.platform === "local"
-        ? `local:${runtime.requester.userId}`
+  const actor =
+    runtime.actor?.platform === "slack"
+      ? `slack:${runtime.actor.teamId}:${runtime.actor.userId}`
+      : runtime.actor?.platform === "local"
+        ? `local:${runtime.actor.userId}`
         : "none";
   const source =
     runtime.source.platform === "slack"
       ? `slack:${runtime.source.teamId}:${runtime.source.channelId}`
       : `local:${runtime.source.conversationId}`;
   const lines = [
-    `- requester: ${escapeXml(requester)}`,
+    `- actor: ${escapeXml(actor)}`,
     `- source: ${escapeXml(source)}`,
     `- has_conversation: ${runtime.conversationId ? "true" : "false"}`,
     `- expires_at: ${
@@ -295,14 +315,29 @@ function existingMemoriesContext(request: ExtractSessionRequest): string {
   ].join("\n");
 }
 
-function memoryKindsContext(): string {
-  return [
-    "<memory-kinds>",
-    "- preference: a durable first-person personal preference, opinion, habit, or workflow owned by the current requester. Stored as requester memory.",
+/**
+ * Passive extraction offers personal preferences only on single-actor runs.
+ * Multi-actor runs restrict extraction to conversation-scoped kinds.
+ */
+function allowedExtractionKinds(actorCount: number): Set<MemoryKind> {
+  return actorCount === 1
+    ? new Set<MemoryKind>(MEMORY_KINDS)
+    : new Set<MemoryKind>(["procedure", "knowledge"]);
+}
+
+function memoryKindsContext(allowedKinds: Set<MemoryKind>): string {
+  const lines = ["<memory-kinds>"];
+  if (allowedKinds.has("preference")) {
+    lines.push(
+      "- preference: a durable first-person personal preference, opinion, habit, or workflow owned by the current actor. Stored as actor memory.",
+    );
+  }
+  lines.push(
     "- procedure: reusable instructions for how a task, lookup, investigation, process, triage flow, or runbook should be done. Store the method, source-of-truth, prerequisite, or decision path when it took effort to discover. Stored as conversation memory.",
-    "- knowledge: stable shared project, channel, operational, or runbook fact that is not a personal requester preference. Direct answers to user inquiries qualify only when they are durable beyond this run. Stored as conversation memory.",
+    "- knowledge: stable shared project, channel, operational, or runbook fact that is not a personal actor preference. Direct answers to user inquiries qualify only when they are durable beyond this run. Stored as conversation memory.",
     "</memory-kinds>",
-  ].join("\n");
+  );
+  return lines.join("\n");
 }
 
 function reviewPrompt(request: CreateMemoryRequest): string {
@@ -321,17 +356,17 @@ function reviewPrompt(request: CreateMemoryRequest): string {
     "<rules>",
     "- Return store only when the candidate is public/shareable, durable, and self-contained.",
     "- First classify the memory kind: preference, procedure, or knowledge.",
-    "- Use kind=preference only for first-person facts authored by the current requester about their own preference, opinion, habit, identity, or workflow.",
-    "- Reject named third-person personal facts such as another person's preference, opinion, habit, identity, relationship, or workflow. Do not assume a named person is the current requester.",
+    "- Use kind=preference only for first-person facts authored by the current actor about their own preference, opinion, habit, identity, or workflow.",
+    "- Reject named third-person personal facts such as another person's preference, opinion, habit, identity, relationship, or workflow. Do not assume a named person is the current actor.",
     "- Use kind=procedure for reusable task/process/runbook instructions.",
     "- Use kind=knowledge for shared project, channel, operational, or runbook facts.",
     "- When current-user-message contains an explicit memory request with a concrete fact or procedure, extract from current-user-message even if the candidate is vague, incomplete, or phrased as an instruction.",
-    "- A candidate may be badly phrased by an outer assistant or extraction pass. When current-user-message contains the requester's own first-person memory fact, treat that as requester-authored source evidence and canonicalize the fact instead of rejecting for third-person wording.",
+    "- A candidate may be badly phrased by an outer assistant or extraction pass. When current-user-message contains the actor's own first-person memory fact, treat that as actor-authored source evidence and canonicalize the fact instead of rejecting for third-person wording.",
     "- When candidate wording personalizes a shared task, process, runbook, project, channel, or operational fact, use current-user-message to recover the shared fact and classify it as procedure or knowledge.",
     "- Explicit procedure requests are valid when the source text contains both task context and action. Canonicalize them as shared procedure facts instead of rejecting them as vague.",
     "- Store content as person-less, source-less canonical knowledge. Ownership and source live in structured metadata, not prose.",
-    "- For requester memories, omit the subject and write the content as a stable fact such as 'Prefers X', 'Uses Y', or 'Thinks Z'.",
-    "- Remove requester names, display names, requester/user labels, first- or second-person wording, thread labels, channel labels, and source labels from stored content.",
+    "- For actor memories, omit the subject and write the content as a stable fact such as 'Prefers X', 'Uses Y', or 'Thinks Z'.",
+    "- Remove actor names, display names, actor/user labels, first- or second-person wording, thread labels, channel labels, and source labels from stored content.",
     "- Reject third-party personal profile facts, even if they mention a name.",
     "- Reject vague content such as 'remember this' unless the candidate or current-user-message contains the concrete fact.",
     "- Preserve the requested expiration when one exists; otherwise set expiresAtMs to null.",
@@ -342,6 +377,20 @@ function reviewPrompt(request: CreateMemoryRequest): string {
   return sections.join("\n");
 }
 
+function transcriptActorLabel(
+  actor: z.output<typeof actorSchema> | undefined,
+): string {
+  if (!actor) {
+    return "none";
+  }
+  if (actor.platform === "system") {
+    return `system:${actor.name}`;
+  }
+  return actor.platform === "slack"
+    ? `slack:${actor.teamId}:${actor.userId}`
+    : `local:${actor.userId}`;
+}
+
 function runTranscriptContext(request: ExtractSessionRequest): string {
   return [
     "<run-transcript>",
@@ -353,8 +402,11 @@ function runTranscriptContext(request: ExtractSessionRequest): string {
           "</tool-result>",
         ].join("\n");
       }
+      const authority = entry.provenance?.authority ?? "context";
+      const isRunActor = entry.isRunActor === true;
+      const actor = transcriptActorLabel(entry.provenance?.actor);
       return [
-        `<message index="${index}" role="${entry.role}">`,
+        `<message index="${index}" role="${entry.role}" authority="${authority}" is_run_actor="${isRunActor ? "true" : "false"}" actor="${escapeXml(actor)}">`,
         escapeXml(entry.text),
         "</message>",
       ].join("\n");
@@ -364,6 +416,8 @@ function runTranscriptContext(request: ExtractSessionRequest): string {
 }
 
 function sessionExtractionPrompt(request: ExtractSessionRequest): string {
+  const allowedKinds = allowedExtractionKinds(request.actors.length);
+  const allowsPreference = allowedKinds.has("preference");
   return [
     "<memory-extraction-input>",
     "Extract durable memories from this completed agent run using the runtime-owned context below.",
@@ -374,12 +428,21 @@ function sessionExtractionPrompt(request: ExtractSessionRequest): string {
     "",
     existingMemoriesContext(request),
     "",
-    memoryKindsContext(),
+    memoryKindsContext(allowedKinds),
     "",
     runTranscriptContext(request),
     "",
     "<rules>",
     "- Return at most five memories.",
+    "- Every returned memory must cite one or more evidenceMessageIndices from <run-transcript>.",
+    "- Cite only indices that directly support the stored fact; do not cite assistant messages as independent evidence.",
+    "- Each transcript message exposes authority (instruction or context), is_run_actor, and an actor id. Use these to classify evidence.",
+    ...(allowsPreference
+      ? [
+          "- For a preference, cite only messages with authority=instruction and is_run_actor=true; a preference must be the run actor's own first-person fact.",
+        ]
+      : []),
+    "- For a procedure or knowledge memory, cite run-actor instruction messages, public context messages, or successful tool results.",
     "- Use user messages and successful tool results as source evidence for storable facts.",
     "- Use failed tool results only when the failure reveals durable process knowledge, not transient errors.",
     "- Use assistant messages only as context; do not store the assistant's claims unless supported by user messages or tool results.",
@@ -391,9 +454,20 @@ function sessionExtractionPrompt(request: ExtractSessionRequest): string {
     "- A user question asking how, what, where, or whether to do something is not source evidence for the answer. Store the answer only when supported by a user-authored factual statement or a tool result.",
     "- Set kind=procedure for reusable task/process/runbook instructions.",
     "- Set kind=knowledge for shared team, project, channel, runbook, or operational facts.",
-    "- Set kind=preference only for clear durable first-person facts authored by the current requester about their own preference, opinion, habit, identity, or workflow.",
-    "- Reject named third-person personal facts such as another person's preference, opinion, habit, identity, relationship, or workflow. Do not assume a named person is the current requester.",
-    "- User-authored task instructions are procedures, not preferences, unless they explicitly describe the requester's personal preference or habit.",
+    ...(allowsPreference
+      ? [
+          "- Set kind=preference only for clear durable first-person facts authored by the current actor about their own preference, opinion, habit, identity, or workflow.",
+          "- A single task request or ask-for-help is never a durable preference, even when phrased as an ongoing action for this run (for example 'help me capture takeaways as we go'). Do not convert a one-off ask into a 'Prefers ...' memory.",
+          "- A durable preference requires explicitly stated, generalizable first-person phrasing such as 'I prefer ...', 'I always ...', or 'I never ...' that describes how the actor wants things done in general, not just for the current task.",
+        ]
+      : [
+          "- This completed run has multiple run actors. Return only conversation-scoped procedure or knowledge memories.",
+          "- Do not return personal preferences, opinions, habits, identity facts, or workflow preferences from any actor in this run.",
+          "- Do not convert a personal first-person statement into shared knowledge or procedure. Statements like 'I prefer ...', 'I use ...', 'I always ...', or 'I never ...' are not memory evidence in this run.",
+          "- Shared team, channel, repository, or operational norms are eligible only when the source states them as collective practice or durable operational fact, not as one individual's preference.",
+        ]),
+    "- Reject named third-person personal facts such as another person's preference, opinion, habit, identity, relationship, or workflow. Do not assume a named person is the current actor.",
+    "- User-authored task instructions are procedures, not preferences, unless they explicitly describe the actor's personal preference or habit.",
     "- Procedural statements such as 'for X, do Y', 'when X, do Y', and 'to accomplish X, do Y' belong in procedures.",
     ...CANONICAL_CONTENT_RULES,
     "- Skip a candidate when existing-memories already cover the same durable fact.",
@@ -505,6 +579,7 @@ function extractedMemoriesFromResponse(
       content: memory.canonicalFact,
       expiresAtMs: memory.expiresAtMs,
       kind: memory.kind,
+      evidenceMessageIndices: memory.evidenceMessageIndices,
     });
   return response.memories.map(toMemory);
 }

package/src/plugin.ts

@@ -15,7 +15,8 @@ import { createMemoryPromptMessages } from "./recall";
 import type { MemoryDb } from "./store";
 
 const MEMORY_MODEL_ENV = "AI_MEMORY_MODEL";
-const MEMORY_RECALL_MAX_VECTOR_DISTANCE_ENV = "MEMORY_RECALL_MAX_VECTOR_DISTANCE";
+const MEMORY_RECALL_MAX_VECTOR_DISTANCE_ENV =
+  "MEMORY_RECALL_MAX_VECTOR_DISTANCE";
 const DEFAULT_RECALL_MAX_VECTOR_DISTANCE = 0.45;
 
 export interface MemoryPluginOptions {
@@ -52,14 +53,14 @@ function memoryToolContext(ctx: {
   conversationId?: string;
   db: MemoryToolContext["db"];
   embedder?: MemoryToolContext["embedder"];
-  requester?: MemoryToolContext["requester"];
+  actor?: MemoryToolContext["actor"];
   source: MemoryToolContext["source"];
   userText?: string;
 }): MemoryToolContext {
   return {
     agent: ctx.agent,
     ...(ctx.conversationId ? { conversationId: ctx.conversationId } : {}),
-    ...(ctx.requester ? { requester: ctx.requester } : {}),
+    ...(ctx.actor ? { actor: ctx.actor } : {}),
     db: ctx.db,
     ...(ctx.embedder ? { embedder: ctx.embedder } : {}),
     source: ctx.source,
@@ -72,7 +73,7 @@ function memoryCreateToolContext(ctx: {
   conversationId?: string;
   db: MemoryCreateToolContext["db"];
   embedder?: MemoryCreateToolContext["embedder"];
-  requester?: MemoryCreateToolContext["requester"];
+  actor?: MemoryCreateToolContext["actor"];
   source: MemoryCreateToolContext["source"];
   supersessionDecider: MemoryCreateToolContext["supersessionDecider"];
   userText?: string;
@@ -133,7 +134,7 @@ export function createMemoryPlugin(options: MemoryPluginOptions = {}) {
       async userPrompt(ctx) {
         return await createMemoryPromptMessages({
           ...(ctx.conversationId ? { conversationId: ctx.conversationId } : {}),
-          ...(ctx.requester ? { requester: ctx.requester } : {}),
+          ...(ctx.actor ? { actor: ctx.actor } : {}),
           db: ctx.db as MemoryDb,
           embedder: ctx.embedder,
           maxVectorDistance: recallMaxVectorDistance(options),

package/src/process-session.ts

@@ -2,6 +2,8 @@ import { createHash } from "node:crypto";
 import {
   getSourceKey,
   isPrivateSource,
+  type PluginRunContext,
+  type PluginRunTranscriptEntry,
   type PluginTaskContext,
 } from "@sentry/junior-plugin-api";
 import { z } from "zod";
@@ -15,11 +17,7 @@ import {
   parseExtractedMemory,
   type ExtractedMemory,
 } from "./agent";
-import {
-  MEMORY_KINDS,
-  memoryRuntimeContextSchema,
-  type MemoryKind,
-} from "./types";
+import { MEMORY_KINDS, memoryRuntimeContextSchema } from "./types";
 
 const MEMORY_TOOL_NAMES = new Set([
   "createMemory",
@@ -34,21 +32,111 @@ const extractedMemoryCacheSchema = z.array(
       content: z.string().min(1),
       expiresAtMs: z.number().finite().nullable(),
       kind: z.enum(MEMORY_KINDS),
+      evidenceMessageIndices: z
+        .array(z.number().int().nonnegative())
+        .min(1)
+        .max(10),
     })
     .strict()
     .transform(parseExtractedMemory),
 );
 
-function targetForKind(kind: MemoryKind): "requester" | "conversation" {
-  if (kind === "preference") {
-    return "requester";
+/** Where a passively extracted memory may be stored, or dropped when unproven. */
+type MemoryRouteTarget = "drop" | "personal" | "conversation";
+
+/** A cited entry is a run-actor durable instruction evidence entry. */
+function isRunActorInstruction(entry: PluginRunTranscriptEntry): boolean {
+  return (
+    entry.type === "message" &&
+    entry.role === "user" &&
+    entry.provenance?.authority === "instruction" &&
+    entry.isRunActor === true
+  );
+}
+
+/** A cited entry is valid public conversation evidence for shared knowledge. */
+function isConversationEvidence(entry: PluginRunTranscriptEntry): boolean {
+  if (entry.type === "toolResult") {
+    return entry.isError === false && Boolean(entry.text?.trim());
+  }
+  if (
+    entry.type === "message" &&
+    entry.role === "user" &&
+    entry.provenance?.authority === "instruction" &&
+    entry.isRunActor === false
+  ) {
+    return Boolean(entry.provenance.actor);
+  }
+  return (
+    entry.type === "message" &&
+    entry.role === "user" &&
+    entry.provenance?.authority === "context"
+  );
+}
+
+/** Resolve the deduplicated cited transcript entries, failing on bad indices. */
+function citedEntries(
+  indices: number[],
+  transcript: PluginRunTranscriptEntry[],
+): { valid: boolean; entries: PluginRunTranscriptEntry[] } {
+  const seen = new Set<number>();
+  const entries: PluginRunTranscriptEntry[] = [];
+  for (const index of indices) {
+    if (seen.has(index)) {
+      continue;
+    }
+    seen.add(index);
+    const entry = transcript[index];
+    if (!entry) {
+      return { valid: false, entries: [] };
+    }
+    entries.push(entry);
   }
-  return "conversation";
+  return { valid: entries.length > 0, entries };
 }
 
-function memoryIdempotencySuffix(memory: ExtractedMemory): string {
+/**
+ * Verify an extracted memory against runtime-owned provenance on its cited
+ * evidence. This is a deterministic authority boundary, not a model decision:
+ * personal preferences require a single-actor run whose citations are all
+ * run-actor instructions, conversation knowledge requires run-actor instruction
+ * or valid public conversation evidence, and anything unproven (including
+ * missing provenance) is dropped. Multi-actor runs interleave first-person
+ * statements from different people, so they never store a preference regardless
+ * of citations; a personal preference can wait for a single-actor run.
+ */
+function routeExtractedMemory(
+  memory: ExtractedMemory,
+  transcript: PluginRunTranscriptEntry[],
+  run: Pick<PluginRunContext, "actor" | "actors">,
+): MemoryRouteTarget {
+  const cited = citedEntries(memory.evidenceMessageIndices, transcript);
+  if (!cited.valid) {
+    return "drop";
+  }
+  if (memory.kind === "preference") {
+    // Only a run attributed to exactly one run actor may store a preference; an
+    // empty actor set (system runs) fails closed to "drop".
+    const exactlyOneRunActor = Boolean(run.actor) && run.actors.length === 1;
+    if (!exactlyOneRunActor) {
+      return "drop";
+    }
+    // Never downgrade an unproven first-person preference to conversation scope.
+    return cited.entries.every(isRunActorInstruction) ? "personal" : "drop";
+  }
+  return cited.entries.every(
+    (entry) => isRunActorInstruction(entry) || isConversationEvidence(entry),
+  )
+    ? "conversation"
+    : "drop";
+}
+
+function memoryIdempotencySuffix(
+  memory: ExtractedMemory,
+  target: MemoryRouteTarget,
+): string {
   return createHash("sha256")
-    .update(targetForKind(memory.kind))
+    .update(target)
     .update("\0")
     .update(memory.kind)
     .update("\0")
@@ -63,10 +151,11 @@ function passiveInput(
   sessionId: string,
   memory: ExtractedMemory,
   sourceKey: string,
+  target: MemoryRouteTarget,
 ): CreateMemoryInput {
   return {
     content: memory.content,
-    idempotencyKey: `session:${sourceKey}:${sessionId}:${memoryIdempotencySuffix(memory)}`,
+    idempotencyKey: `session:${sourceKey}:${sessionId}:${memoryIdempotencySuffix(memory, target)}`,
     kind: memory.kind,
     ...(memory.expiresAtMs !== null ? { expiresAtMs: memory.expiresAtMs } : {}),
   };
@@ -79,7 +168,11 @@ async function getTaskMemories(
   const cacheKey = `memory-extraction:${context.id}`;
   const cached = await context.state.get(cacheKey);
   if (cached !== undefined) {
-    return extractedMemoryCacheSchema.parse(cached);
+    const parsed = extractedMemoryCacheSchema.safeParse(cached);
+    if (parsed.success) {
+      return parsed.data;
+    }
+    await context.state.delete(cacheKey);
   }
   const memories = await extract();
   if (memories.length > 0) {
@@ -132,7 +225,7 @@ export async function processMemorySession(
 
   const runtimeContext = memoryRuntimeContextSchema.parse({
     conversationId: run.conversationId,
-    ...(run.requester ? { requester: run.requester } : {}),
+    ...(run.actor ? { actor: run.actor } : {}),
     source: run.source,
   });
   const agent = createMemoryAgent(context.model);
@@ -150,6 +243,7 @@ export async function processMemorySession(
       existingMemories: existingMemories.map((memory) => ({
         content: memory.content,
       })),
+      actors: run.actors,
       transcript,
       runtimeContext,
     });
@@ -159,12 +253,16 @@ export async function processMemorySession(
   }
 
   for (const memory of memories) {
-    const input = passiveInput(run.runId, memory, sourceKey);
-    if (targetForKind(memory.kind) === "conversation") {
-      await store.createConversationMemory(input);
+    // The routing gate stays even though extraction is also actor-gated:
+    // getTaskMemories caches extraction output for 7 days, so a retry can replay
+    // preference proposals cached before this gate existed.
+    const target = routeExtractedMemory(memory, transcript, run);
+    if (target === "drop") {
       continue;
     }
-    if (!run.requester) {
+    const input = passiveInput(run.runId, memory, sourceKey, target);
+    if (target === "conversation") {
+      await store.createConversationMemory(input);
       continue;
     }
     await store.createMemory(input);