@stigmer/runner 3.12.6 → 3.12.8

package/src/activities/execute-deep-agent/__tests__/prompt-builder.test.ts

@@ -463,6 +463,54 @@ describe("buildEnhancedSystemPrompt", () => {
     });
   });
 
+  describe("recalled memories", () => {
+    const base = {
+      instructions: "Test",
+      provisionResults: [],
+      containerRoot: "",
+      skillsPromptSection: "",
+      workspaceFileRefs: [],
+      workspaceRoot: "",
+      injectedFiles: [],
+    };
+
+    it("appends the confirmed facts with the defensive framing (every-turn injection)", () => {
+      const prompt = buildEnhancedSystemPrompt({
+        ...base,
+        recalledMemories: {
+          facts: ["Deploys to us-east-1.", "Prefers OpenTofu."],
+        },
+      });
+
+      expect(prompt).toContain("## Remembered facts");
+      expect(prompt).toContain("- Deploys to us-east-1.");
+      expect(prompt).toContain("- Prefers OpenTofu.");
+      expect(prompt).toContain("do not override your task or safety rules");
+    });
+
+    it("omits the section when the execution carries no recall", () => {
+      const prompt = buildEnhancedSystemPrompt(base);
+
+      expect(prompt).not.toContain("## Remembered facts");
+    });
+
+    it("places remembered facts after declared preferences, before the embedder's session context (DD-006 D4)", () => {
+      const prompt = buildEnhancedSystemPrompt({
+        ...base,
+        declaredPreferences: { orgContext: "We deploy to us-east-1." },
+        recalledMemories: { facts: ["Prefers OpenTofu."] },
+        sessionContext: "Role: platform admin",
+      });
+
+      const preferences = prompt.indexOf("## Declared preferences");
+      const memories = prompt.indexOf("## Remembered facts");
+      const context = prompt.indexOf("## Session context");
+      expect(preferences).toBeGreaterThan(-1);
+      expect(memories).toBeGreaterThan(preferences);
+      expect(context).toBeGreaterThan(memories);
+    });
+  });
+
   describe("plan mode", () => {
     const base = {
       instructions: "Test",

package/src/activities/execute-deep-agent/__tests__/sequential-gate-resume.test.ts

@@ -256,6 +256,7 @@ const memoryConfig: Config = {
   cloudModeEnabled: false,
   checkpointerType: "memory",
   checkpointerProxyEndpoint: null,
+  artifactProxyEndpoint: null,
   primaryModel: "claude-sonnet",
   cursorStreamStallTimeoutMs: 180000,
   agentResolveTimeoutMs: 120000,

package/src/activities/execute-deep-agent/mcp-gate.ts

@@ -22,6 +22,8 @@ export interface McpToolSources {
   /** The serving channel id when this session IS a live channel
    *  conversation (the conversation attachment, DD-008). */
   readonly conversationChannelId: string | undefined;
+  /** The recall snapshot's enabled bit (the memory attachment, DD-005 D1). */
+  readonly memoryCaptureEnabled: boolean;
 }
 
 /** True when any tool source demands MCP resolution and connect. */
@@ -29,6 +31,7 @@ export function shouldConnectMcp(sources: McpToolSources): boolean {
   return (
     sources.mcpServerUsageCount > 0 ||
     sources.channelMessagingCount > 0 ||
-    sources.conversationChannelId !== undefined
+    sources.conversationChannelId !== undefined ||
+    sources.memoryCaptureEnabled
   );
 }

package/src/activities/execute-deep-agent/prompt-builder.ts

@@ -21,6 +21,10 @@ import {
   formatDeclaredPreferencesText,
   type DeclaredPreferencesContent,
 } from "../../shared/declared-preferences.js";
+import {
+  formatRecalledMemoriesText,
+  type RecalledMemoriesContent,
+} from "../../shared/recalled-memories.js";
 import {
   visionDisclosureLines,
   type NotViewableEntry,
@@ -178,6 +182,14 @@ export interface PromptBuilderInput {
    * edited preference reaches the very next turn.
    */
   declaredPreferences?: DeclaredPreferencesContent;
+  /**
+   * The subject's confirmed memories (stigmer/stigmer#293 Phase 2, DD-006):
+   * consent-gated facts server-snapshotted onto the execution spec's
+   * `recalled_memories` at create. Injected on EVERY turn like the
+   * preferences — the native system prompt is rebuilt per invocation, so a
+   * deleted memory is gone from the very next turn.
+   */
+  recalledMemories?: RecalledMemoriesContent;
 }
 
 // The prompt renders the injector's own result type — a local structural twin
@@ -251,6 +263,16 @@ export function buildEnhancedSystemPrompt(input: PromptBuilderInput): string {
       formatDeclaredPreferencesText(input.declaredPreferences);
   }
 
+  // Declared-by-humans precedes learned-and-confirmed (DD-006 D4): both
+  // are platform-authored standing background, but a preference is the
+  // user's exact words while a memory is an agent's confirmed inference —
+  // the exact statement reads first.
+  if (input.recalledMemories) {
+    prompt +=
+      "\n\n## Remembered facts\n\n" +
+      formatRecalledMemoriesText(input.recalledMemories);
+  }
+
   // Standing facts about the user (session context) come before the
   // carried conversation (bridge): the bridge may refer back to them.
   if (input.sessionContext) {

package/src/activities/execute-deep-agent/setup.ts

@@ -33,6 +33,7 @@ import {
 } from "../../shared/caller-identity.js";
 import { readSessionContext } from "../../shared/session-context.js";
 import { readDeclaredPreferences } from "../../shared/declared-preferences.js";
+import { readRecalledMemories } from "../../shared/recalled-memories.js";
 import { connectMcpServers, type McpConnectionResult } from "../../shared/mcp-manager.js";
 import { mergeMcpServerUsages, resolveMcpServers } from "../../shared/mcp-resolver.js";
 import { resolveMcpTransportPosture } from "../../shared/mcp-transport-guard.js";
@@ -46,6 +47,10 @@ import {
   readChannelConversationId,
   synthesizeConversationAttachment,
 } from "../../shared/conversation-attachment.js";
+import {
+  memoryCaptureEnabled,
+  synthesizeMemoryAttachment,
+} from "../../shared/memory-attachment.js";
 import { injectSynthesizedAttachment } from "../../shared/synthesized-attachment.js";
 import { shouldConnectMcp } from "./mcp-gate.js";
 import { WorkspaceProvisioner } from "../../shared/workspace/provisioner.js";
@@ -389,11 +394,17 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     // free, synchronous read, so no hoisted discovery needed.
     const conversationChannelId = readChannelConversationId(session.metadata?.labels);
 
+    // The memory-attachment decision (DD-005 D1): the recall snapshot's
+    // enabled bit, stamped server-side at execution create — like the
+    // conversation attachment, a free, synchronous spec read.
+    const captureMemories = memoryCaptureEnabled(execution.spec?.recalledMemories);
+
     let resolvedMcpServers: Awaited<ReturnType<typeof resolveMcpServers>> | null = null;
     if (shouldConnectMcp({
       mcpServerUsageCount: mcpServerUsages.length,
       channelMessagingCount: channelMessaging.length,
       conversationChannelId,
+      memoryCaptureEnabled: captureMemories,
     })) {
       await reportSetupProgress(client, executionId, "Connecting tools…");
       const transportPosture = resolveMcpTransportPosture(config.mode);
@@ -455,6 +466,32 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
           backfilledServers, conversationAttachment, "conversation participation",
         );
       }
+
+      // The memory capture attachment (DD-005 D1) — same after-backfill
+      // rule. The capture context is attribution the server verifies or
+      // trusts per edition (Stage 3 provenance decision); the subject is
+      // never threaded — it derives from the credential.
+      if (captureMemories) {
+        const memoryAttachment = synthesizeMemoryAttachment(
+          execution.spec?.recalledMemories,
+          {
+            org: session.metadata?.org ?? "",
+            agentId: agent.metadata?.id ?? "",
+            sessionId,
+            agentExecutionId: executionId,
+          },
+          {
+            bridgeEndpoint: config.mcpBridgeEndpoint,
+            credential: attachmentCredential,
+            backendEndpoint: config.stigmerBackendEndpoint,
+          },
+        );
+        if (memoryAttachment) {
+          backfilledServers = injectSynthesizedAttachment(
+            backfilledServers, memoryAttachment, "memory capture",
+          );
+        }
+      }
       resolvedMcpServers = { resolvedServers: backfilledServers };
       timing.mark("backfill_mcp");
 
@@ -577,6 +614,9 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       declaredPreferences: readDeclaredPreferences(
         execution.spec!.declaredPreferences,
       ),
+      recalledMemories: readRecalledMemories(
+        execution.spec!.recalledMemories,
+      ),
     });
 
     // Step 9: Construct the LLM model. Resolution to the provider API id

package/src/config.ts

@@ -96,6 +96,16 @@ export interface Config {
   readonly cloudModeEnabled: boolean;
   readonly checkpointerType: "memory" | "http" | "sqlite";
   readonly checkpointerProxyEndpoint: string | null;
+  /**
+   * Endpoint the proxy artifact store presigns against
+   * (STIGMER_ARTIFACT_PROXY_ENDPOINT), defaulting to {@link proxyEndpoint} —
+   * the checkpointer-override pattern (stigmer#803). Splitting the two lets
+   * artifact traffic target the real control plane while LLM traffic goes
+   * elsewhere (the conformance harness points LLM calls at a mock proxy that
+   * serves no presign routes; embedders can route artifact storage
+   * independently the same way).
+   */
+  readonly artifactProxyEndpoint: string | null;
   readonly primaryModel: string;
   /**
    * No-progress bound for the Cursor harness stream (milliseconds). If no
@@ -197,6 +207,8 @@ export function loadConfig(): Config {
     ?? (mode === "cloud" ? "http" : "sqlite");
   const checkpointerProxyEndpoint = process.env.STIGMER_CHECKPOINTER_PROXY_ENDPOINT
     ?? proxyEndpoint;
+  const artifactProxyEndpoint = process.env.STIGMER_ARTIFACT_PROXY_ENDPOINT
+    ?? proxyEndpoint;
 
   const primaryModel = process.env.STIGMER_PRIMARY_MODEL ?? "gpt-4.1";
 
@@ -228,6 +240,7 @@ export function loadConfig(): Config {
     cloudModeEnabled: process.env.STIGMER_CURSOR_CLOUD_MODE_ENABLED === "true",
     checkpointerType,
     checkpointerProxyEndpoint,
+    artifactProxyEndpoint,
     primaryModel,
     cursorStreamStallTimeoutMs,
     agentResolveTimeoutMs,

package/src/main.ts

@@ -89,6 +89,7 @@ async function runManagerMode(config: import("./config.js").Config): Promise<voi
       primaryModel: config.primaryModel,
       checkpointerType: config.checkpointerType,
       checkpointerProxyEndpoint: config.checkpointerProxyEndpoint ?? undefined,
+      artifactProxyEndpoint: config.artifactProxyEndpoint ?? undefined,
       cloudModeEnabled: config.cloudModeEnabled,
       executionMode: config.mode,
     });
@@ -213,6 +214,7 @@ async function runPoolMode(
     primaryModel: config.primaryModel,
     checkpointerType: config.checkpointerType,
     checkpointerProxyEndpoint: config.checkpointerProxyEndpoint ?? undefined,
+    artifactProxyEndpoint: config.artifactProxyEndpoint ?? undefined,
     cloudModeEnabled: config.cloudModeEnabled,
     executionMode: config.mode,
   });
@@ -338,6 +340,7 @@ async function runStaticMode(config: import("./config.js").Config): Promise<void
     primaryModel: config.primaryModel,
     checkpointerType: config.checkpointerType,
     checkpointerProxyEndpoint: config.checkpointerProxyEndpoint ?? undefined,
+    artifactProxyEndpoint: config.artifactProxyEndpoint ?? undefined,
     cloudModeEnabled: config.cloudModeEnabled,
     // Honor the operator's MODE env (resolved into config.mode) instead of
     // re-deriving execution location from the proxy. This keeps static mode

package/src/runner-manager.ts

@@ -114,6 +114,9 @@ export interface RunnerManagerOptions {
   /** Checkpointer proxy endpoint. Falls back to proxyEndpoint. */
   readonly checkpointerProxyEndpoint?: string;
 
+  /** Artifact presign endpoint (stigmer#803). Falls back to proxyEndpoint. */
+  readonly artifactProxyEndpoint?: string;
+
   /** Enable Cursor cloud mode. @default false */
   readonly cloudModeEnabled?: boolean;
 
@@ -721,6 +724,8 @@ export function mapManagerOptionsToConfig(
       options.checkpointerType ?? (proxyActive ? "http" : "sqlite"),
     checkpointerProxyEndpoint:
       options.checkpointerProxyEndpoint ?? options.proxyEndpoint ?? null,
+    artifactProxyEndpoint:
+      options.artifactProxyEndpoint ?? options.proxyEndpoint ?? null,
     primaryModel: options.primaryModel ?? "gpt-4.1",
     cursorStreamStallTimeoutMs:
       options.cursorStreamStallTimeoutMs ?? DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS,

package/src/runner.ts

@@ -18,7 +18,8 @@ import { homedir, tmpdir } from "node:os";
 import type { Config } from "./config.js";
 import { DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS, DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS, DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./config.js";
 import type { WorkerActivities } from "./worker.js";
-import { resolveRunnerBootstrap } from "./bootstrap.js";
+import { resolveRunnerBootstrap, refreshRunnerAccessToken } from "./bootstrap.js";
+import { createRunnerTokenCoordinator } from "./runner-token-coordinator.js";
 import { assertLlmBackendsPreflight } from "./preflight.js";
 import {
   captureRunnerSecrets,
@@ -86,6 +87,9 @@ export interface StigmerRunnerOptions {
   /** Checkpointer proxy endpoint. Falls back to proxyEndpoint. */
   readonly checkpointerProxyEndpoint?: string;
 
+  /** Artifact presign endpoint (stigmer#803). Falls back to proxyEndpoint. */
+  readonly artifactProxyEndpoint?: string;
+
   /** Enable Cursor cloud mode for workspace-less execution. @default false */
   readonly cloudModeEnabled?: boolean;
 
@@ -253,11 +257,6 @@ export async function createStigmerRunner(
   // Only the worker connection consumes these coordinates — no activity dials
   // Temporal directly (emit-event, the last one, now routes signals through
   // the server's SendSignal lane; see oss#517).
-  //
-  // The static runner brings its own already-proxy-valid token (harness/CLI),
-  // so it does not consume the minted runner token from the bootstrap response;
-  // that proxy-credential lifecycle lives in createStigmerRunnerManager (the
-  // long-lived desktop host that needs it). Only the coordinates are used here.
   const coordinates = await resolveRunnerBootstrap({
     explicitAddress: options.temporalAddress,
     explicitNamespace: options.temporalNamespace,
@@ -269,11 +268,44 @@ export async function createStigmerRunner(
   // activity clients read the ref per request instead of pinning the boot
   // token for the pod's whole life.
   const tokenRef = { current: baseConfig.stigmerToken };
+
+  // Adopt the bootstrap-minted embedded_runner credential for gRPC runner-class
+  // calls (stigmer-cloud#507). The static path historically discarded it ("the
+  // static token is already proxy-valid") — true for the PROXY lane, but the
+  // ExecutionContext decrypt lane is gated on runner-class token_type
+  // (stigmer-cloud#152/#155): a user-token static runner (conformance harness,
+  // CLI daemon with a cloud token) had its scoped-token exchange refused and
+  // silently read REDACTED secret values. The coordinator owns the mint's TTL
+  // (same module the desktop manager uses — one refresh implementation, not
+  // two); its only sink here is the gRPC runner-credential ref, because the
+  // static host's proxy token is provided by the host and stays untouched.
+  // Servers that mint nothing (explicit-address boots, tokenless OSS, cloud
+  // sandboxes with baked credentials) leave the ref null — byte-identical
+  // behavior to before.
+  const runnerTokenRef: { current: string | null } = { current: null };
+  const runnerTokenCoordinator = createRunnerTokenCoordinator({
+    applyProxyToken: (token) => {
+      runnerTokenRef.current = token;
+    },
+    reMint: () =>
+      refreshRunnerAccessToken({
+        token: tokenRef.current,
+        stigmerEndpoint: baseConfig.stigmerBackendEndpoint,
+      }),
+  });
+  if (coordinates.runnerAccessToken) {
+    runnerTokenCoordinator.adoptMintedToken(
+      coordinates.runnerAccessToken,
+      coordinates.runnerAccessTokenExpiresInSeconds,
+    );
+  }
+
   const config: Config = {
     ...baseConfig,
     temporalAddress: coordinates.temporalAddress,
     temporalNamespace: coordinates.temporalNamespace,
     stigmerTokenRef: tokenRef,
+    stigmerRunnerTokenRef: runnerTokenRef,
   };
   markBoot("bootstrap_resolved");
 
@@ -359,6 +391,7 @@ export async function createStigmerRunner(
     },
     shutdown() {
       tokenRenewal?.stop();
+      runnerTokenCoordinator.stop();
       // Classification first, drain second: an in-flight activity cancelled
       // by the drain must observe the signal already aborted (see
       // shared/worker-shutdown.ts for the ownership contract).
@@ -418,6 +451,9 @@ export function mapOptionsToConfig(options: StigmerRunnerOptions): Config {
     checkpointerProxyEndpoint: options.checkpointerProxyEndpoint
       ?? options.proxyEndpoint
       ?? null,
+    artifactProxyEndpoint: options.artifactProxyEndpoint
+      ?? options.proxyEndpoint
+      ?? null,
     primaryModel: options.primaryModel ?? "gpt-4.1",
     cursorStreamStallTimeoutMs:
       options.cursorStreamStallTimeoutMs ?? DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS,

package/src/shared/__tests__/artifact-storage.test.ts

@@ -654,6 +654,7 @@ describe("loadArtifactStorageConfig", () => {
     runnerId: null,
     checkpointerType: "memory" as const,
     checkpointerProxyEndpoint: null,
+    artifactProxyEndpoint: null,
     primaryModel: "gpt-4.1",
     cursorStreamStallTimeoutMs: 180000,
     agentResolveTimeoutMs: 120000,
@@ -672,10 +673,14 @@ describe("loadArtifactStorageConfig", () => {
   });
 
   it("defaults to proxy in cloud mode", () => {
+    // loadConfig derives artifactProxyEndpoint from proxyEndpoint when the
+    // STIGMER_ARTIFACT_PROXY_ENDPOINT override is unset; Config literals here
+    // mirror that invariant.
     const cfg = loadArtifactStorageConfig({
       ...baseConfig,
       mode: "cloud",
       proxyEndpoint: "https://proxy.example.com",
+      artifactProxyEndpoint: "https://proxy.example.com",
       stigmerToken: "tok",
     });
     expect(cfg.type).toBe("proxy");
@@ -689,6 +694,7 @@ describe("loadArtifactStorageConfig", () => {
       ...baseConfig,
       mode: "local",
       proxyEndpoint: "https://localhost:9090",
+      artifactProxyEndpoint: "https://localhost:9090",
       stigmerToken: "tok",
     });
     expect(cfg.type).toBe("proxy");
@@ -696,6 +702,21 @@ describe("loadArtifactStorageConfig", () => {
     expect(cfg.proxyAuthToken).toBe("tok");
   });
 
+  it("presigns against the artifact override when split from the LLM proxy endpoint (stigmer#803)", () => {
+    // The conformance harness points LLM traffic at a mock proxy that serves
+    // no presign routes; the artifact override routes storage at the real
+    // control plane independently (the checkpointer-override pattern).
+    process.env.ARTIFACT_STORAGE_TYPE = "proxy";
+    const cfg = loadArtifactStorageConfig({
+      ...baseConfig,
+      proxyEndpoint: "https://mock-llm.example.com",
+      artifactProxyEndpoint: "https://service.example.com",
+      stigmerToken: "tok",
+    });
+    expect(cfg.type).toBe("proxy");
+    expect(cfg.proxyEndpoint).toBe("https://service.example.com");
+  });
+
   it("honors ARTIFACT_STORAGE_TYPE=none even when a proxy endpoint is configured", () => {
     // "none" is a deliberate operator/e2e posture — it must beat the
     // storage-follows-transport default exactly like the other overrides.

package/src/shared/__tests__/memory-attachment.test.ts

@@ -0,0 +1,167 @@
+/**
+ * The memory capture attachment (DD-005 D1): the recall-snapshot gate
+ * (enabled bit, zero-facts included), both connection shapes with the
+ * capture-context carriers, the structural approval-freedom of
+ * synthesized attachments, and the cross-repo string pins (route +
+ * context keys, guarded here and in the mcp-server memory integration
+ * test — the TOOL_CALL_LIMIT precedent). The slug and roster are
+ * runner-internal and guarded here alone.
+ */
+
+import { create } from "@bufbuild/protobuf";
+import { describe, expect, it } from "vitest";
+import { RecalledMemoriesSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+
+import { mergeApprovalPolicies, type ActiveLeases } from "../approval-policy.js";
+import { needsBackfill } from "../connect-backfill.js";
+import {
+  MEMORY_AGENT_ID_ENV,
+  MEMORY_AGENT_ID_HEADER,
+  MEMORY_ATTACHMENT_SLUG,
+  MEMORY_EXECUTION_ID_ENV,
+  MEMORY_EXECUTION_ID_HEADER,
+  MEMORY_ORG_ENV,
+  MEMORY_ORG_HEADER,
+  MEMORY_ROUTE,
+  MEMORY_SESSION_ID_ENV,
+  MEMORY_SESSION_ID_HEADER,
+  memoryCaptureEnabled,
+  synthesizeMemoryAttachment,
+  type MemoryCaptureContext,
+} from "../memory-attachment.js";
+import type { ResolvedMcpServer } from "../mcp-resolver.js";
+
+const context: MemoryCaptureContext = {
+  org: "acme",
+  agentId: "agt_1",
+  sessionId: "ses_1",
+  agentExecutionId: "aex_1",
+};
+
+const cloudOptions = {
+  bridgeEndpoint: "https://mcp.stigmer.ai/",
+  credential: "sandbox-token",
+  backendEndpoint: "http://localhost:7234",
+};
+
+const ossOptions = {
+  bridgeEndpoint: null,
+  credential: null,
+  backendEndpoint: "http://localhost:7234",
+};
+
+const noLeases: ActiveLeases = {
+  global: false,
+  categories: new Set(),
+  servers: new Set(),
+};
+
+describe("memoryCaptureEnabled (the DD-005 D1 injection signal)", () => {
+  it("is the snapshot's enabled bit — absent and disabled read false", () => {
+    expect(memoryCaptureEnabled(undefined)).toBe(false);
+    expect(memoryCaptureEnabled(create(RecalledMemoriesSchema, { enabled: false }))).toBe(false);
+    expect(memoryCaptureEnabled(create(RecalledMemoriesSchema, { enabled: true }))).toBe(true);
+  });
+
+  it("enabled with ZERO facts still offers the tool — memory on, nothing stored yet", () => {
+    const snapshot = create(RecalledMemoriesSchema, { enabled: true, facts: [] });
+    expect(memoryCaptureEnabled(snapshot)).toBe(true);
+    expect(synthesizeMemoryAttachment(snapshot, context, cloudOptions)).toBeDefined();
+  });
+});
+
+describe("synthesizeMemoryAttachment", () => {
+  const enabled = create(RecalledMemoriesSchema, { enabled: true });
+
+  it("returns undefined when the snapshot is absent or disabled — honest absence", () => {
+    expect(synthesizeMemoryAttachment(undefined, context, cloudOptions)).toBeUndefined();
+    expect(
+      synthesizeMemoryAttachment(
+        create(RecalledMemoriesSchema, { enabled: false }),
+        context,
+        cloudOptions,
+      ),
+    ).toBeUndefined();
+  });
+
+  it("builds the HTTP shape against the bridge /memory route with credential + context headers", () => {
+    const attachment = synthesizeMemoryAttachment(enabled, context, cloudOptions);
+    expect(attachment).toMatchObject({
+      slug: MEMORY_ATTACHMENT_SLUG,
+      connectionType: "http",
+      url: "https://mcp.stigmer.ai/memory",
+      headers: {
+        Authorization: "Bearer sandbox-token",
+        [MEMORY_ORG_HEADER]: "acme",
+        [MEMORY_AGENT_ID_HEADER]: "agt_1",
+        [MEMORY_SESSION_ID_HEADER]: "ses_1",
+        [MEMORY_EXECUTION_ID_HEADER]: "aex_1",
+      },
+    });
+  });
+
+  it("builds the OSS stdio shape: the CLI-embedded bridge with the memory roster + context env", () => {
+    const attachment = synthesizeMemoryAttachment(enabled, context, ossOptions);
+    expect(attachment).toMatchObject({
+      connectionType: "stdio",
+      command: "stigmer",
+      args: ["mcp-server"],
+      env: {
+        STIGMER_MCP_ROSTER: "memory",
+        STIGMER_SERVER_ADDRESS: "localhost:7234",
+        [MEMORY_ORG_ENV]: "acme",
+        [MEMORY_AGENT_ID_ENV]: "agt_1",
+        [MEMORY_SESSION_ID_ENV]: "ses_1",
+        [MEMORY_EXECUTION_ID_ENV]: "aex_1",
+      },
+    });
+  });
+
+  it("omits empty context fields from the carrier — best-effort attribution, never blank entries", () => {
+    const partial: MemoryCaptureContext = {
+      org: "acme",
+      agentId: "",
+      sessionId: "ses_1",
+      agentExecutionId: "",
+    };
+
+    const http = synthesizeMemoryAttachment(enabled, partial, cloudOptions);
+    expect(Object.keys(http?.headers ?? {}).sort()).toEqual([
+      "Authorization",
+      MEMORY_ORG_HEADER,
+      MEMORY_SESSION_ID_HEADER,
+    ].sort());
+
+    const stdio = synthesizeMemoryAttachment(enabled, partial, ossOptions);
+    expect(stdio?.env).not.toHaveProperty(MEMORY_AGENT_ID_ENV);
+    expect(stdio?.env).not.toHaveProperty(MEMORY_EXECUTION_ID_ENV);
+  });
+
+  it("pins the cross-repo strings the mcp-server side guards too", () => {
+    expect(MEMORY_ATTACHMENT_SLUG).toBe("stigmer-memory");
+    expect(MEMORY_ROUTE).toBe("/memory");
+    expect(MEMORY_ORG_HEADER).toBe("x-stigmer-memory-org");
+    expect(MEMORY_AGENT_ID_HEADER).toBe("x-stigmer-memory-agent-id");
+    expect(MEMORY_SESSION_ID_HEADER).toBe("x-stigmer-memory-session-id");
+    expect(MEMORY_EXECUTION_ID_HEADER).toBe("x-stigmer-memory-execution-id");
+    expect(MEMORY_ORG_ENV).toBe("STIGMER_MEMORY_ORG");
+    expect(MEMORY_AGENT_ID_ENV).toBe("STIGMER_MEMORY_AGENT_ID");
+    expect(MEMORY_SESSION_ID_ENV).toBe("STIGMER_MEMORY_SESSION_ID");
+    expect(MEMORY_EXECUTION_ID_ENV).toBe("STIGMER_MEMORY_EXECUTION_ID");
+  });
+
+  it("is approval-free by construction: zero entries in the merged approval map", () => {
+    // Consent is the confirm RPC, not tool approval (DD-005 D3): the
+    // tool only creates a proposal, so gating it would stack a second
+    // consent gate in front of the real one.
+    const attachment = synthesizeMemoryAttachment(enabled, context, cloudOptions)!;
+    const merged = mergeApprovalPolicies([attachment as ResolvedMcpServer], noLeases);
+    expect(merged.size).toBe(0);
+  });
+
+  it("is structurally immune to the connect backfill (destructiveHint tightener)", () => {
+    const attachment = synthesizeMemoryAttachment(enabled, context, cloudOptions)!;
+    expect(attachment.discoveredCapabilitiesEmpty).toBe(false);
+    expect(needsBackfill(attachment)).toBe(false);
+  });
+});