@stigmer/runner 3.12.7 → 3.12.8

package/dist/shared/memory-attachment.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The runner-synthesized memory capture attachment (DD-005 D1).
+ *
+ * When the execution's recall snapshot says memory is on
+ * (`spec.recalled_memories.enabled` — the ONE server-owned field that
+ * serves both the recall and capture sides, stamped by the create
+ * pipeline's compose step), the runner synthesizes ONE MCP attachment
+ * serving the `remember` tool. No discovery RPC exists on this path:
+ * unlike the channel attachment's registry read, the enablement answer
+ * is already on the spec — a free, synchronous read (the
+ * conversation-attachment session-label precedent). The enabled bit with
+ * ZERO facts is a meaningful state: memory is on, nothing stored yet —
+ * the tool is offered so the first fact can be proposed.
+ *
+ * Two connection shapes, one roster (the channels pattern):
+ *   - Bridge endpoint configured (cloud): Streamable HTTP against the
+ *     bridge's /memory route with the execution's own session-scoped
+ *     credential as the Bearer token, plus the capture context as
+ *     per-request headers.
+ *   - No bridge endpoint (OSS/local): a spawned `stigmer mcp-server`
+ *     stdio child with STIGMER_MCP_ROSTER=memory, plus the capture
+ *     context as STIGMER_MEMORY_* env.
+ *
+ * The capture context (org + agent/session/execution ids) is
+ * attribution, never authorization (the Stage 3 provenance decision,
+ * owner-ratified 2026-08-22): the cloud create handler accepts it only
+ * from a session-sandbox credential and overrides session/org with the
+ * token's own claims; the OSS server stores it under the local
+ * single-user trust model. The subject is never threaded — the server
+ * derives it from the credential (DD-005 D2).
+ *
+ * Approval-free by construction (the synthesized-attachment contract):
+ * the tool only ever creates a PROPOSAL the user must confirm through
+ * the control plane, so gating the propose call would stack a second
+ * consent gate in front of the real one (DD-005 D3: consent is the
+ * confirm RPC, not tool approval). Callers inject AFTER resolve +
+ * backfill.
+ *
+ * Failure posture: the attachment is synthesized from values already in
+ * hand, so the only failure mode is the create RPC refusing at call
+ * time — which the mcp-server's memory error mapper relays honestly.
+ * When the snapshot is absent or disabled: no tool, honest absence.
+ */
+import type { RecalledMemories } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+import type { ResolvedMcpServer } from "./mcp-resolver.js";
+import { type SynthesizedAttachmentOptions } from "./synthesized-attachment.js";
+/**
+ * The synthesized attachment's slug. Reserved: a user McpServer with
+ * this slug is shadowed by the synthesized attachment, with a warning.
+ * Runner-internal (the resolved-server name and shadow key — the
+ * mcp-server never sees it); pinned by this module's test. The ROUTE
+ * and the context keys below are cross-repo strings, pinned on both
+ * sides (the TOOL_CALL_LIMIT precedent).
+ */
+export declare const MEMORY_ATTACHMENT_SLUG = "stigmer-memory";
+/** The bridge route serving the memory-only roster (mcp-server twin: MEMORY_ROUTE). */
+export declare const MEMORY_ROUTE = "/memory";
+/**
+ * The capture-context carriers, mirrored byte-for-byte by the
+ * mcp-server's memory domain (domains/memory/context.ts): headers on
+ * the bridge's per-request path, env on the stdio child — the same
+ * per-request-then-startup split the credential itself uses.
+ */
+export declare const MEMORY_ORG_HEADER = "x-stigmer-memory-org";
+export declare const MEMORY_AGENT_ID_HEADER = "x-stigmer-memory-agent-id";
+export declare const MEMORY_SESSION_ID_HEADER = "x-stigmer-memory-session-id";
+export declare const MEMORY_EXECUTION_ID_HEADER = "x-stigmer-memory-execution-id";
+export declare const MEMORY_ORG_ENV = "STIGMER_MEMORY_ORG";
+export declare const MEMORY_AGENT_ID_ENV = "STIGMER_MEMORY_AGENT_ID";
+export declare const MEMORY_SESSION_ID_ENV = "STIGMER_MEMORY_SESSION_ID";
+export declare const MEMORY_EXECUTION_ID_ENV = "STIGMER_MEMORY_EXECUTION_ID";
+/**
+ * Where a proposed memory comes from — threaded to the mcp-server so
+ * the create request carries org addressing and provenance. Empty
+ * fields are omitted from the carrier (best-effort attribution; the
+ * server treats absent as empty).
+ */
+export interface MemoryCaptureContext {
+    readonly org: string;
+    readonly agentId: string;
+    readonly sessionId: string;
+    readonly agentExecutionId: string;
+}
+/**
+ * Reports whether the execution's recall snapshot offers the remember
+ * tool (DD-005 D1: the snapshot's enabled bit IS the runner's injection
+ * signal — one server-owned field, no parallel flag, no discovery
+ * round-trip). Exposed for the harnesses' MCP gates, which must open
+ * MCP resolution for a memory-only agent.
+ */
+export declare function memoryCaptureEnabled(recalled: RecalledMemories | undefined): boolean;
+/**
+ * Synthesize the memory capture attachment. Returns undefined when the
+ * recall snapshot is absent or disabled — the attachment exists exactly
+ * when the server-composed snapshot says memory is on.
+ */
+export declare function synthesizeMemoryAttachment(recalled: RecalledMemories | undefined, context: MemoryCaptureContext, options: SynthesizedAttachmentOptions): ResolvedMcpServer | undefined;

package/dist/shared/memory-attachment.js

@@ -0,0 +1,136 @@
+/**
+ * The runner-synthesized memory capture attachment (DD-005 D1).
+ *
+ * When the execution's recall snapshot says memory is on
+ * (`spec.recalled_memories.enabled` — the ONE server-owned field that
+ * serves both the recall and capture sides, stamped by the create
+ * pipeline's compose step), the runner synthesizes ONE MCP attachment
+ * serving the `remember` tool. No discovery RPC exists on this path:
+ * unlike the channel attachment's registry read, the enablement answer
+ * is already on the spec — a free, synchronous read (the
+ * conversation-attachment session-label precedent). The enabled bit with
+ * ZERO facts is a meaningful state: memory is on, nothing stored yet —
+ * the tool is offered so the first fact can be proposed.
+ *
+ * Two connection shapes, one roster (the channels pattern):
+ *   - Bridge endpoint configured (cloud): Streamable HTTP against the
+ *     bridge's /memory route with the execution's own session-scoped
+ *     credential as the Bearer token, plus the capture context as
+ *     per-request headers.
+ *   - No bridge endpoint (OSS/local): a spawned `stigmer mcp-server`
+ *     stdio child with STIGMER_MCP_ROSTER=memory, plus the capture
+ *     context as STIGMER_MEMORY_* env.
+ *
+ * The capture context (org + agent/session/execution ids) is
+ * attribution, never authorization (the Stage 3 provenance decision,
+ * owner-ratified 2026-08-22): the cloud create handler accepts it only
+ * from a session-sandbox credential and overrides session/org with the
+ * token's own claims; the OSS server stores it under the local
+ * single-user trust model. The subject is never threaded — the server
+ * derives it from the credential (DD-005 D2).
+ *
+ * Approval-free by construction (the synthesized-attachment contract):
+ * the tool only ever creates a PROPOSAL the user must confirm through
+ * the control plane, so gating the propose call would stack a second
+ * consent gate in front of the real one (DD-005 D3: consent is the
+ * confirm RPC, not tool approval). Callers inject AFTER resolve +
+ * backfill.
+ *
+ * Failure posture: the attachment is synthesized from values already in
+ * hand, so the only failure mode is the create RPC refusing at call
+ * time — which the mcp-server's memory error mapper relays honestly.
+ * When the snapshot is absent or disabled: no tool, honest absence.
+ */
+import { grpcTarget } from "./synthesized-attachment.js";
+/**
+ * The synthesized attachment's slug. Reserved: a user McpServer with
+ * this slug is shadowed by the synthesized attachment, with a warning.
+ * Runner-internal (the resolved-server name and shadow key — the
+ * mcp-server never sees it); pinned by this module's test. The ROUTE
+ * and the context keys below are cross-repo strings, pinned on both
+ * sides (the TOOL_CALL_LIMIT precedent).
+ */
+export const MEMORY_ATTACHMENT_SLUG = "stigmer-memory";
+/** The bridge route serving the memory-only roster (mcp-server twin: MEMORY_ROUTE). */
+export const MEMORY_ROUTE = "/memory";
+/**
+ * The capture-context carriers, mirrored byte-for-byte by the
+ * mcp-server's memory domain (domains/memory/context.ts): headers on
+ * the bridge's per-request path, env on the stdio child — the same
+ * per-request-then-startup split the credential itself uses.
+ */
+export const MEMORY_ORG_HEADER = "x-stigmer-memory-org";
+export const MEMORY_AGENT_ID_HEADER = "x-stigmer-memory-agent-id";
+export const MEMORY_SESSION_ID_HEADER = "x-stigmer-memory-session-id";
+export const MEMORY_EXECUTION_ID_HEADER = "x-stigmer-memory-execution-id";
+export const MEMORY_ORG_ENV = "STIGMER_MEMORY_ORG";
+export const MEMORY_AGENT_ID_ENV = "STIGMER_MEMORY_AGENT_ID";
+export const MEMORY_SESSION_ID_ENV = "STIGMER_MEMORY_SESSION_ID";
+export const MEMORY_EXECUTION_ID_ENV = "STIGMER_MEMORY_EXECUTION_ID";
+/**
+ * Reports whether the execution's recall snapshot offers the remember
+ * tool (DD-005 D1: the snapshot's enabled bit IS the runner's injection
+ * signal — one server-owned field, no parallel flag, no discovery
+ * round-trip). Exposed for the harnesses' MCP gates, which must open
+ * MCP resolution for a memory-only agent.
+ */
+export function memoryCaptureEnabled(recalled) {
+    return recalled?.enabled === true;
+}
+/**
+ * Synthesize the memory capture attachment. Returns undefined when the
+ * recall snapshot is absent or disabled — the attachment exists exactly
+ * when the server-composed snapshot says memory is on.
+ */
+export function synthesizeMemoryAttachment(recalled, context, options) {
+    if (!memoryCaptureEnabled(recalled)) {
+        return undefined;
+    }
+    // Approval-free by construction + backfill-proof: see file header.
+    const base = {
+        slug: MEMORY_ATTACHMENT_SLUG,
+        toolApprovals: [],
+        pinnedToolApprovals: [],
+        toolApprovalOverrides: [],
+        discoveredCapabilitiesEmpty: false,
+    };
+    if (options.bridgeEndpoint !== null && options.bridgeEndpoint !== "") {
+        return {
+            ...base,
+            connectionType: "http",
+            url: options.bridgeEndpoint.replace(/\/+$/, "") + MEMORY_ROUTE,
+            headers: {
+                ...(options.credential !== null && options.credential !== ""
+                    ? { Authorization: `Bearer ${options.credential}` }
+                    : undefined),
+                ...nonEmptyEntries([
+                    [MEMORY_ORG_HEADER, context.org],
+                    [MEMORY_AGENT_ID_HEADER, context.agentId],
+                    [MEMORY_SESSION_ID_HEADER, context.sessionId],
+                    [MEMORY_EXECUTION_ID_HEADER, context.agentExecutionId],
+                ]),
+            },
+        };
+    }
+    return {
+        ...base,
+        connectionType: "stdio",
+        command: "stigmer",
+        args: ["mcp-server"],
+        env: {
+            STIGMER_MCP_ROSTER: "memory",
+            STIGMER_SERVER_ADDRESS: grpcTarget(options.backendEndpoint),
+            ...nonEmptyEntries([
+                [MEMORY_ORG_ENV, context.org],
+                [MEMORY_AGENT_ID_ENV, context.agentId],
+                [MEMORY_SESSION_ID_ENV, context.sessionId],
+                [MEMORY_EXECUTION_ID_ENV, context.agentExecutionId],
+            ]),
+        },
+    };
+}
+/** The non-empty context fields as carrier entries (absent means empty). */
+function nonEmptyEntries(pairs) {
+    return Object.fromEntries(pairs.filter(([, value]) => value !== ""));
+}
+//# sourceMappingURL=memory-attachment.js.map

package/dist/shared/memory-attachment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-attachment.js","sourceRoot":"","sources":["../../src/shared/memory-attachment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAIH,OAAO,EAAE,UAAU,EAAqC,MAAM,6BAA6B,CAAC;AAE5F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEvD,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AACtE,MAAM,CAAC,MAAM,0BAA0B,GAAG,+BAA+B,CAAC;AAE1E,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AACjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,6BAA6B,CAAC;AAerE;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAsC;IACzE,OAAO,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAsC,EACtC,OAA6B,EAC7B,OAAqC;IAErC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,sBAAsB;QAC5B,aAAa,EAAE,EAAE;QACjB,mBAAmB,EAAE,EAAE;QACvB,qBAAqB,EAAE,EAAE;QACzB,2BAA2B,EAAE,KAAK;KACnC,CAAC;IAEF,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,CAAC,cAAc,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO;YACL,GAAG,IAAI;YACP,cAAc,EAAE,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,YAAY;YAC9D,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE;oBAC1D,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,UAAU,EAAE,EAAE;oBACnD,CAAC,CAAC,SAAS,CAAC;gBACd,GAAG,eAAe,CAAC;oBACjB,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC;oBAChC,CAAC,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC;oBACzC,CAAC,wBAAwB,EAAE,OAAO,CAAC,SAAS,CAAC;oBAC7C,CAAC,0BAA0B,EAAE,OAAO,CAAC,gBAAgB,CAAC;iBACvD,CAAC;aACH;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,cAAc,EAAE,OAAO;QACvB,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,GAAG,EAAE;YACH,kBAAkB,EAAE,QAAQ;YAC5B,sBAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC;YAC3D,GAAG,eAAe,CAAC;gBACjB,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC;gBAC7B,CAAC,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC;gBACtC,CAAC,qBAAqB,EAAE,OAAO,CAAC,SAAS,CAAC;gBAC1C,CAAC,uBAAuB,EAAE,OAAO,CAAC,gBAAgB,CAAC;aACpD,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,eAAe,CACtB,KAA+C;IAE/C,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC"}

package/dist/shared/tool-kind.js

@@ -12,6 +12,7 @@
  * this table and that fixture in lockstep.
  */
 import { ToolKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { MEMORY_ATTACHMENT_SLUG } from "./memory-attachment.js";
 // Bare tool name -> ToolKind, covering both harness naming conventions. A name
 // found here is a built-in and wins over a non-empty mcp_server_slug (an MCP
 // server is not expected to shadow a built-in name; matching the legacy resolver).
@@ -68,6 +69,14 @@ const TOOL_NAME_TO_KIND = new Map([
  * back to a name lookup, so this is never worse than no classification).
  */
 export function classifyTool(name, mcpServerSlug) {
+    // The first-party remember tool (DD-005), slug-scoped on purpose: it is
+    // served by the synthesized memory attachment, so only that reserved
+    // slug earns the MEMORY kind (and its consent-chip rendering) — a
+    // third-party MCP server's coincidental `remember` stays a plain MCP
+    // tool, and a bare `remember` with no slug stays unclassified.
+    if (name === "remember" && mcpServerSlug === MEMORY_ATTACHMENT_SLUG) {
+        return ToolKind.MEMORY;
+    }
     const builtin = TOOL_NAME_TO_KIND.get(name);
     if (builtin !== undefined) {
         return builtin;

package/dist/shared/tool-kind.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-kind.js","sourceRoot":"","sources":["../../src/shared/tool-kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,8DAA8D,CAAC;AAExF,+EAA+E;AAC/E,6EAA6E;AAC7E,mFAAmF;AACnF,MAAM,iBAAiB,GAAkC,IAAI,GAAG,CAAC;IAC/D,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC;IAC5B,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC;IAE5B,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC;IAC9B,CAAC,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC;IACnC,CAAC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC;IACpC,CAAC,gBAAgB,EAAE,QAAQ,CAAC,UAAU,CAAC;IACvC,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC;IAE9B,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC;IAC5B,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,SAAS,CAAC;IAC1C,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC;IAClC,CAAC,cAAc,EAAE,QAAQ,CAAC,SAAS,CAAC;IAEpC,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC;IAChC,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC;IACrC,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC;IACrC,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC;IAEhC,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC;IACzB,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC;IAC3B,CAAC,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC;IACnC,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC;IAC/B,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC;IAC5B,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC;IAEzB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC;IAC3B,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC;IAC5B,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC;IAC/B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC;IAEnC,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;IACrB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC;IAEjC,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC;IAC7B,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC;IAC5B,CAAC,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC;IAElC,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC;IAEzB,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC;IAC9B,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC;IAC9B,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC;IAE5B,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;CAC5B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,aAAsB;IAC/D,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,QAAQ,CAAC,WAAW,CAAC;AAC9B,CAAC;AAqBD,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,QAAQ,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,KAAK,QAAQ,CAAC,UAAU,CAAC;QACzB,KAAK,QAAQ,CAAC,SAAS;YACrB,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ,CAAC,WAAW;YACvB,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ,CAAC,KAAK;YACjB,OAAO,OAAO,CAAC;QACjB,yEAAyE;QACzE,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,+CAA+C;QAC/C;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"tool-kind.js","sourceRoot":"","sources":["../../src/shared/tool-kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,8DAA8D,CAAC;AAExF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,+EAA+E;AAC/E,6EAA6E;AAC7E,mFAAmF;AACnF,MAAM,iBAAiB,GAAkC,IAAI,GAAG,CAAC;IAC/D,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC;IAC5B,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC;IAE5B,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC;IAC9B,CAAC,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC;IACnC,CAAC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC;IACpC,CAAC,gBAAgB,EAAE,QAAQ,CAAC,UAAU,CAAC;IACvC,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC;IAE9B,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC;IAC5B,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,SAAS,CAAC;IAC1C,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC;IAClC,CAAC,cAAc,EAAE,QAAQ,CAAC,SAAS,CAAC;IAEpC,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC;IAChC,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC;IACrC,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC;IACrC,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC;IAEhC,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC;IACzB,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC;IAC3B,CAAC,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC;IACnC,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC;IAC/B,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC;IAC5B,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC;IAEzB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC;IAC3B,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC;IAC5B,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC;IAC/B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC;IAEnC,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;IACrB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC;IAEjC,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC;IAC7B,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC;IAC5B,CAAC,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC;IAElC,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC;IAEzB,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC;IAC9B,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC;IAC9B,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC;IAE5B,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;CAC5B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,aAAsB;IAC/D,wEAAwE;IACxE,qEAAqE;IACrE,kEAAkE;IAClE,qEAAqE;IACrE,+DAA+D;IAC/D,IAAI,IAAI,KAAK,UAAU,IAAI,aAAa,KAAK,sBAAsB,EAAE,CAAC;QACpE,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,QAAQ,CAAC,WAAW,CAAC;AAC9B,CAAC;AAqBD,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,QAAQ,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,KAAK,QAAQ,CAAC,UAAU,CAAC;QACzB,KAAK,QAAQ,CAAC,SAAS;YACrB,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ,CAAC,WAAW;YACvB,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ,CAAC,KAAK;YACjB,OAAO,OAAO,CAAC;QACjB,yEAAyE;QACzE,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,+CAA+C;QAC/C;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/runner",
-  "version": "3.12.7",
+  "version": "3.12.8",
   "description": "Embeddable Temporal worker for the Stigmer AI agent platform — handles agent execution, workflow orchestration, and MCP server management",
   "license": "Apache-2.0",
   "type": "module",
@@ -94,7 +94,7 @@
     "@opentelemetry/sdk-metrics": "^2.0.0",
     "@opentelemetry/sdk-trace-base": "^2.0.0",
     "@opentelemetry/sdk-trace-node": "^2.0.0",
-    "@stigmer/protos": "3.12.7",
+    "@stigmer/protos": "3.12.8",
     "@temporalio/activity": "1.16.2",
     "@temporalio/common": "1.16.2",
     "@temporalio/interceptors-opentelemetry": "1.16.2",

package/src/activities/execute-cursor/index.ts

@@ -84,6 +84,7 @@ import {
   readChannelConversationId,
   synthesizeConversationAttachment,
 } from "../../shared/conversation-attachment.js";
+import { synthesizeMemoryAttachment } from "../../shared/memory-attachment.js";
 import { injectSynthesizedAttachment } from "../../shared/synthesized-attachment.js";
 import { mergeApprovalPolicies } from "./approval-policy.js";
 import { deriveActiveLeases, isUnattendedApprovalMode } from "../../shared/approval-policy.js";
@@ -717,6 +718,33 @@ async function executeCursorInner(
         resolvedMcpServers, conversationAttachment, "conversation participation",
       );
     }
+
+    // Phase 4a5: Synthesize the memory capture attachment (DD-005 D1) —
+    // the fourth sibling. The recall snapshot's enabled bit IS the
+    // attachment decision (server-stamped at execution create; a free
+    // local read, like the conversation attachment's session label). The
+    // capture context is attribution the server verifies or trusts per
+    // edition (Stage 3 provenance decision); the subject is never
+    // threaded — it derives from the credential.
+    const memoryAttachment = synthesizeMemoryAttachment(
+      execution.spec?.recalledMemories,
+      {
+        org: session.metadata?.org ?? "",
+        agentId: blueprint.agent.metadata?.id ?? "",
+        sessionId,
+        agentExecutionId: executionId,
+      },
+      {
+        bridgeEndpoint: config.mcpBridgeEndpoint,
+        credential: attachmentCredential,
+        backendEndpoint: config.stigmerBackendEndpoint,
+      },
+    );
+    if (memoryAttachment) {
+      resolvedMcpServers = injectSynthesizedAttachment(
+        resolvedMcpServers, memoryAttachment, "memory capture",
+      );
+    }
     // The one projection point: every mutation above is now visible in the
     // Cursor SDK config by construction (no per-mutation rebuild to forget).
     const mcpConfig = toCursorMcpConfig(resolvedMcpServers);

package/src/activities/execute-deep-agent/__tests__/mcp-gate.test.ts

@@ -14,6 +14,7 @@ const nothing = {
   mcpServerUsageCount: 0,
   channelMessagingCount: 0,
   conversationChannelId: undefined,
+  memoryCaptureEnabled: false,
 };
 
 describe("shouldConnectMcp", () => {
@@ -34,4 +35,10 @@ describe("shouldConnectMcp", () => {
     // channel — the escalation tool is the ONLY source.
     expect(shouldConnectMcp({ ...nothing, conversationChannelId: "agch_1" })).toBe(true);
   });
+
+  it("enters on memory capture alone (the memory attachment)", () => {
+    // A tool-less agent whose user has memory on: the remember tool is
+    // the ONLY source, and skipping the block would silently drop it.
+    expect(shouldConnectMcp({ ...nothing, memoryCaptureEnabled: true })).toBe(true);
+  });
 });

package/src/activities/execute-deep-agent/mcp-gate.ts

@@ -22,6 +22,8 @@ export interface McpToolSources {
   /** The serving channel id when this session IS a live channel
    *  conversation (the conversation attachment, DD-008). */
   readonly conversationChannelId: string | undefined;
+  /** The recall snapshot's enabled bit (the memory attachment, DD-005 D1). */
+  readonly memoryCaptureEnabled: boolean;
 }
 
 /** True when any tool source demands MCP resolution and connect. */
@@ -29,6 +31,7 @@ export function shouldConnectMcp(sources: McpToolSources): boolean {
   return (
     sources.mcpServerUsageCount > 0 ||
     sources.channelMessagingCount > 0 ||
-    sources.conversationChannelId !== undefined
+    sources.conversationChannelId !== undefined ||
+    sources.memoryCaptureEnabled
   );
 }

package/src/activities/execute-deep-agent/setup.ts

@@ -47,6 +47,10 @@ import {
   readChannelConversationId,
   synthesizeConversationAttachment,
 } from "../../shared/conversation-attachment.js";
+import {
+  memoryCaptureEnabled,
+  synthesizeMemoryAttachment,
+} from "../../shared/memory-attachment.js";
 import { injectSynthesizedAttachment } from "../../shared/synthesized-attachment.js";
 import { shouldConnectMcp } from "./mcp-gate.js";
 import { WorkspaceProvisioner } from "../../shared/workspace/provisioner.js";
@@ -390,11 +394,17 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     // free, synchronous read, so no hoisted discovery needed.
     const conversationChannelId = readChannelConversationId(session.metadata?.labels);
 
+    // The memory-attachment decision (DD-005 D1): the recall snapshot's
+    // enabled bit, stamped server-side at execution create — like the
+    // conversation attachment, a free, synchronous spec read.
+    const captureMemories = memoryCaptureEnabled(execution.spec?.recalledMemories);
+
     let resolvedMcpServers: Awaited<ReturnType<typeof resolveMcpServers>> | null = null;
     if (shouldConnectMcp({
       mcpServerUsageCount: mcpServerUsages.length,
       channelMessagingCount: channelMessaging.length,
       conversationChannelId,
+      memoryCaptureEnabled: captureMemories,
     })) {
       await reportSetupProgress(client, executionId, "Connecting tools…");
       const transportPosture = resolveMcpTransportPosture(config.mode);
@@ -456,6 +466,32 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
           backfilledServers, conversationAttachment, "conversation participation",
         );
       }
+
+      // The memory capture attachment (DD-005 D1) — same after-backfill
+      // rule. The capture context is attribution the server verifies or
+      // trusts per edition (Stage 3 provenance decision); the subject is
+      // never threaded — it derives from the credential.
+      if (captureMemories) {
+        const memoryAttachment = synthesizeMemoryAttachment(
+          execution.spec?.recalledMemories,
+          {
+            org: session.metadata?.org ?? "",
+            agentId: agent.metadata?.id ?? "",
+            sessionId,
+            agentExecutionId: executionId,
+          },
+          {
+            bridgeEndpoint: config.mcpBridgeEndpoint,
+            credential: attachmentCredential,
+            backendEndpoint: config.stigmerBackendEndpoint,
+          },
+        );
+        if (memoryAttachment) {
+          backfilledServers = injectSynthesizedAttachment(
+            backfilledServers, memoryAttachment, "memory capture",
+          );
+        }
+      }
       resolvedMcpServers = { resolvedServers: backfilledServers };
       timing.mark("backfill_mcp");
 

package/src/shared/__tests__/memory-attachment.test.ts

@@ -0,0 +1,167 @@
+/**
+ * The memory capture attachment (DD-005 D1): the recall-snapshot gate
+ * (enabled bit, zero-facts included), both connection shapes with the
+ * capture-context carriers, the structural approval-freedom of
+ * synthesized attachments, and the cross-repo string pins (route +
+ * context keys, guarded here and in the mcp-server memory integration
+ * test — the TOOL_CALL_LIMIT precedent). The slug and roster are
+ * runner-internal and guarded here alone.
+ */
+
+import { create } from "@bufbuild/protobuf";
+import { describe, expect, it } from "vitest";
+import { RecalledMemoriesSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+
+import { mergeApprovalPolicies, type ActiveLeases } from "../approval-policy.js";
+import { needsBackfill } from "../connect-backfill.js";
+import {
+  MEMORY_AGENT_ID_ENV,
+  MEMORY_AGENT_ID_HEADER,
+  MEMORY_ATTACHMENT_SLUG,
+  MEMORY_EXECUTION_ID_ENV,
+  MEMORY_EXECUTION_ID_HEADER,
+  MEMORY_ORG_ENV,
+  MEMORY_ORG_HEADER,
+  MEMORY_ROUTE,
+  MEMORY_SESSION_ID_ENV,
+  MEMORY_SESSION_ID_HEADER,
+  memoryCaptureEnabled,
+  synthesizeMemoryAttachment,
+  type MemoryCaptureContext,
+} from "../memory-attachment.js";
+import type { ResolvedMcpServer } from "../mcp-resolver.js";
+
+const context: MemoryCaptureContext = {
+  org: "acme",
+  agentId: "agt_1",
+  sessionId: "ses_1",
+  agentExecutionId: "aex_1",
+};
+
+const cloudOptions = {
+  bridgeEndpoint: "https://mcp.stigmer.ai/",
+  credential: "sandbox-token",
+  backendEndpoint: "http://localhost:7234",
+};
+
+const ossOptions = {
+  bridgeEndpoint: null,
+  credential: null,
+  backendEndpoint: "http://localhost:7234",
+};
+
+const noLeases: ActiveLeases = {
+  global: false,
+  categories: new Set(),
+  servers: new Set(),
+};
+
+describe("memoryCaptureEnabled (the DD-005 D1 injection signal)", () => {
+  it("is the snapshot's enabled bit — absent and disabled read false", () => {
+    expect(memoryCaptureEnabled(undefined)).toBe(false);
+    expect(memoryCaptureEnabled(create(RecalledMemoriesSchema, { enabled: false }))).toBe(false);
+    expect(memoryCaptureEnabled(create(RecalledMemoriesSchema, { enabled: true }))).toBe(true);
+  });
+
+  it("enabled with ZERO facts still offers the tool — memory on, nothing stored yet", () => {
+    const snapshot = create(RecalledMemoriesSchema, { enabled: true, facts: [] });
+    expect(memoryCaptureEnabled(snapshot)).toBe(true);
+    expect(synthesizeMemoryAttachment(snapshot, context, cloudOptions)).toBeDefined();
+  });
+});
+
+describe("synthesizeMemoryAttachment", () => {
+  const enabled = create(RecalledMemoriesSchema, { enabled: true });
+
+  it("returns undefined when the snapshot is absent or disabled — honest absence", () => {
+    expect(synthesizeMemoryAttachment(undefined, context, cloudOptions)).toBeUndefined();
+    expect(
+      synthesizeMemoryAttachment(
+        create(RecalledMemoriesSchema, { enabled: false }),
+        context,
+        cloudOptions,
+      ),
+    ).toBeUndefined();
+  });
+
+  it("builds the HTTP shape against the bridge /memory route with credential + context headers", () => {
+    const attachment = synthesizeMemoryAttachment(enabled, context, cloudOptions);
+    expect(attachment).toMatchObject({
+      slug: MEMORY_ATTACHMENT_SLUG,
+      connectionType: "http",
+      url: "https://mcp.stigmer.ai/memory",
+      headers: {
+        Authorization: "Bearer sandbox-token",
+        [MEMORY_ORG_HEADER]: "acme",
+        [MEMORY_AGENT_ID_HEADER]: "agt_1",
+        [MEMORY_SESSION_ID_HEADER]: "ses_1",
+        [MEMORY_EXECUTION_ID_HEADER]: "aex_1",
+      },
+    });
+  });
+
+  it("builds the OSS stdio shape: the CLI-embedded bridge with the memory roster + context env", () => {
+    const attachment = synthesizeMemoryAttachment(enabled, context, ossOptions);
+    expect(attachment).toMatchObject({
+      connectionType: "stdio",
+      command: "stigmer",
+      args: ["mcp-server"],
+      env: {
+        STIGMER_MCP_ROSTER: "memory",
+        STIGMER_SERVER_ADDRESS: "localhost:7234",
+        [MEMORY_ORG_ENV]: "acme",
+        [MEMORY_AGENT_ID_ENV]: "agt_1",
+        [MEMORY_SESSION_ID_ENV]: "ses_1",
+        [MEMORY_EXECUTION_ID_ENV]: "aex_1",
+      },
+    });
+  });
+
+  it("omits empty context fields from the carrier — best-effort attribution, never blank entries", () => {
+    const partial: MemoryCaptureContext = {
+      org: "acme",
+      agentId: "",
+      sessionId: "ses_1",
+      agentExecutionId: "",
+    };
+
+    const http = synthesizeMemoryAttachment(enabled, partial, cloudOptions);
+    expect(Object.keys(http?.headers ?? {}).sort()).toEqual([
+      "Authorization",
+      MEMORY_ORG_HEADER,
+      MEMORY_SESSION_ID_HEADER,
+    ].sort());
+
+    const stdio = synthesizeMemoryAttachment(enabled, partial, ossOptions);
+    expect(stdio?.env).not.toHaveProperty(MEMORY_AGENT_ID_ENV);
+    expect(stdio?.env).not.toHaveProperty(MEMORY_EXECUTION_ID_ENV);
+  });
+
+  it("pins the cross-repo strings the mcp-server side guards too", () => {
+    expect(MEMORY_ATTACHMENT_SLUG).toBe("stigmer-memory");
+    expect(MEMORY_ROUTE).toBe("/memory");
+    expect(MEMORY_ORG_HEADER).toBe("x-stigmer-memory-org");
+    expect(MEMORY_AGENT_ID_HEADER).toBe("x-stigmer-memory-agent-id");
+    expect(MEMORY_SESSION_ID_HEADER).toBe("x-stigmer-memory-session-id");
+    expect(MEMORY_EXECUTION_ID_HEADER).toBe("x-stigmer-memory-execution-id");
+    expect(MEMORY_ORG_ENV).toBe("STIGMER_MEMORY_ORG");
+    expect(MEMORY_AGENT_ID_ENV).toBe("STIGMER_MEMORY_AGENT_ID");
+    expect(MEMORY_SESSION_ID_ENV).toBe("STIGMER_MEMORY_SESSION_ID");
+    expect(MEMORY_EXECUTION_ID_ENV).toBe("STIGMER_MEMORY_EXECUTION_ID");
+  });
+
+  it("is approval-free by construction: zero entries in the merged approval map", () => {
+    // Consent is the confirm RPC, not tool approval (DD-005 D3): the
+    // tool only creates a proposal, so gating it would stack a second
+    // consent gate in front of the real one.
+    const attachment = synthesizeMemoryAttachment(enabled, context, cloudOptions)!;
+    const merged = mergeApprovalPolicies([attachment as ResolvedMcpServer], noLeases);
+    expect(merged.size).toBe(0);
+  });
+
+  it("is structurally immune to the connect backfill (destructiveHint tightener)", () => {
+    const attachment = synthesizeMemoryAttachment(enabled, context, cloudOptions)!;
+    expect(attachment.discoveredCapabilitiesEmpty).toBe(false);
+    expect(needsBackfill(attachment)).toBe(false);
+  });
+});