@stigmer/runner 3.12.8 → 3.12.9

package/dist/shared/memory-retrieval.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Semantic selection of recalled memories (stigmer/stigmer#293 Phase 3a,
+ * DD-008): when a subject's confirmed-fact set outgrows what wholesale
+ * injection should carry, select the most relevant facts for THIS
+ * execution instead of injecting everything.
+ *
+ * Sibling of recalled-memories.ts (which owns presentation) — this module
+ * owns SELECTION: which subset of the server-composed candidate set
+ * (`spec.recalled_memories`, the auditable snapshot both editions' compose
+ * steps stamp) actually rides the prompt. The compose steps never change;
+ * selection is a runner concern because the runner owns prompt assembly,
+ * provider credentials, and the metered proxy lane (DD-008 D1 — the
+ * titling-convergence doctrine: control-plane-adjacent LLM work runs once,
+ * in the shared runner, for both editions).
+ *
+ * Mechanism (DD-008 D2/D3): embed-on-read, no stored vectors anywhere.
+ * Selection activates ONLY above RETRIEVAL_K candidates; below that,
+ * top-k degenerates to wholesale, so no embeddings call is made and the
+ * shipped Phase 2 path runs untouched. When active: ONE batched
+ * embeddings call (query + all candidates), in-process cosine ranking,
+ * top-k by relevance, presented in snapshot order (relevance order would
+ * carry no information the model needs and would churn the prompt prefix).
+ * The query is the execution's `spec.message` — the current turn.
+ *
+ * The audit contract (DD-008 D5): the selection outcome is recorded in a
+ * runner-owned `RecalledMemoriesReport` on the execution status (the
+ * streaming_usage posture — one writer, written at prompt build). A report
+ * is returned whenever facts are injected, wholesale or selected; when
+ * nothing is injected (recall absent/disabled/empty) there is no report —
+ * absent report = wholesale, true by construction, so pre-3a executions
+ * read identically.
+ *
+ * Written-once across re-invocations: the same execution's prompt is
+ * rebuilt on approval resume (native) and fresh-agent recovery (cursor).
+ * Re-running selection there could pick a DIFFERENT subset mid-execution —
+ * so when the loaded execution already carries a report, this module
+ * REPLAYS it (selected ids resolved against the snapshot, or wholesale
+ * for a selection_active=false report) instead of re-embedding. Selection
+ * is computed at most once per execution, by construction.
+ *
+ * Failure posture: selection is an optimization. ANY failure — no
+ * embedder, HTTP error, timeout, malformed response — degrades to
+ * wholesale injection with a selection_active=false report, never a
+ * failed or degraded execution (DD-008 D3). Deployments with no
+ * embeddings-capable credential (Anthropic-only, Cursor-only OSS) run
+ * Phase 2 behavior unchanged, forever.
+ */
+import type { RecalledMemories } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+import { type RecalledMemoriesReport } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { RecalledMemoriesContent } from "./recalled-memories.js";
+/**
+ * Selection activates only when the candidate set EXCEEDS this many facts;
+ * at or below it, top-k degenerates to wholesale and no embeddings call is
+ * made. 20 is comfortably above the dozens-scale where wholesale is fine
+ * (activation is rare) and comfortably below the 100-record cap (activation
+ * is meaningful): at 500-char facts, 20 facts ≈ 10KB of prompt. One
+ * constant, one place, deliberately not adaptive or per-org configurable
+ * in v1 (DD-008 D3).
+ */
+export declare const RETRIEVAL_K = 20;
+/**
+ * The v1 embedder (DD-008 D4). OpenAI-only: resolved through the Stigmer
+ * proxy when one is configured (cloud — platform key, metered), else the
+ * operator's direct OpenAI key (OSS). NOTE: llm-proxy's `inferProvider`
+ * does not know the `text-*` prefix — this module never infers; the
+ * provider is fixed alongside the model.
+ */
+export declare const EMBEDDING_MODEL = "text-embedding-3-small";
+/**
+ * Upper bound on the query text sent to the embedder. Facts are write-time
+ * capped at 500 chars, but the query is `spec.message` — unbounded. A giant
+ * pasted message would blow the embedder's per-input token limit (8192 for
+ * text-embedding-3-small) and 400 the WHOLE batched call, silently forcing
+ * wholesale on exactly the executions where selection matters. 20K chars
+ * sits safely under the limit at worst-case chars-per-token; selection
+ * intent is dominated by the message head, and a truncated query beats no
+ * selection.
+ */
+export declare const QUERY_MAX_CHARS = 20000;
+/**
+ * One batched embeddings call: one vector per input, in input order.
+ * The seam unit tests inject through, and the boundary a stored-vector
+ * optimization would slot behind if caps ever grow (DD-008 D2).
+ */
+export type EmbedFn = (inputs: readonly string[]) => Promise<number[][]>;
+export interface MemoryRetrievalOptions {
+    /** Null/undefined when the deployment has no proxy (direct mode). */
+    readonly proxyEndpoint: string | null | undefined;
+    /** Bearer for proxy mode; unused in direct mode. */
+    readonly stigmerToken: string | null | undefined;
+    /** Scopes the proxied call for FGA authorization and billing attribution. */
+    readonly executionId: string;
+    /**
+     * The report a PREVIOUS invocation of this same execution recorded, if
+     * any (`execution.status.recalled_memories_report`). Presence replays
+     * the recorded outcome instead of re-selecting — the written-once rule.
+     */
+    readonly priorReport?: RecalledMemoriesReport;
+    /** Test seam; defaults to the proxy/direct embedder resolution. */
+    readonly embed?: EmbedFn;
+}
+export interface MemorySelectionResult {
+    /**
+     * The facts to inject, in snapshot order — undefined when recall is
+     * absent, disabled, or empty (render nothing, exactly the
+     * readRecalledMemories contract).
+     */
+    readonly content: RecalledMemoriesContent | undefined;
+    /**
+     * The injection outcome to stamp on the execution status. Undefined
+     * exactly when `content` is undefined: no injection, no report.
+     */
+    readonly report: RecalledMemoriesReport | undefined;
+}
+/**
+ * Select the facts to inject for one execution.
+ *
+ * This is the ONE entry point both harnesses call at prompt build, replacing
+ * their direct `readRecalledMemories` reads on the injection path (the read
+ * function remains the presentation-side authority; this module reads the
+ * proto itself because selection needs `memory_id`, which the render
+ * boundary deliberately strips).
+ *
+ * Never throws: every failure path returns wholesale.
+ */
+export declare function selectRecalledFacts(recalled: RecalledMemories | undefined, queryText: string, options: MemoryRetrievalOptions): Promise<MemorySelectionResult>;

package/dist/shared/memory-retrieval.js

@@ -0,0 +1,293 @@
+/**
+ * Semantic selection of recalled memories (stigmer/stigmer#293 Phase 3a,
+ * DD-008): when a subject's confirmed-fact set outgrows what wholesale
+ * injection should carry, select the most relevant facts for THIS
+ * execution instead of injecting everything.
+ *
+ * Sibling of recalled-memories.ts (which owns presentation) — this module
+ * owns SELECTION: which subset of the server-composed candidate set
+ * (`spec.recalled_memories`, the auditable snapshot both editions' compose
+ * steps stamp) actually rides the prompt. The compose steps never change;
+ * selection is a runner concern because the runner owns prompt assembly,
+ * provider credentials, and the metered proxy lane (DD-008 D1 — the
+ * titling-convergence doctrine: control-plane-adjacent LLM work runs once,
+ * in the shared runner, for both editions).
+ *
+ * Mechanism (DD-008 D2/D3): embed-on-read, no stored vectors anywhere.
+ * Selection activates ONLY above RETRIEVAL_K candidates; below that,
+ * top-k degenerates to wholesale, so no embeddings call is made and the
+ * shipped Phase 2 path runs untouched. When active: ONE batched
+ * embeddings call (query + all candidates), in-process cosine ranking,
+ * top-k by relevance, presented in snapshot order (relevance order would
+ * carry no information the model needs and would churn the prompt prefix).
+ * The query is the execution's `spec.message` — the current turn.
+ *
+ * The audit contract (DD-008 D5): the selection outcome is recorded in a
+ * runner-owned `RecalledMemoriesReport` on the execution status (the
+ * streaming_usage posture — one writer, written at prompt build). A report
+ * is returned whenever facts are injected, wholesale or selected; when
+ * nothing is injected (recall absent/disabled/empty) there is no report —
+ * absent report = wholesale, true by construction, so pre-3a executions
+ * read identically.
+ *
+ * Written-once across re-invocations: the same execution's prompt is
+ * rebuilt on approval resume (native) and fresh-agent recovery (cursor).
+ * Re-running selection there could pick a DIFFERENT subset mid-execution —
+ * so when the loaded execution already carries a report, this module
+ * REPLAYS it (selected ids resolved against the snapshot, or wholesale
+ * for a selection_active=false report) instead of re-embedding. Selection
+ * is computed at most once per execution, by construction.
+ *
+ * Failure posture: selection is an optimization. ANY failure — no
+ * embedder, HTTP error, timeout, malformed response — degrades to
+ * wholesale injection with a selection_active=false report, never a
+ * failed or degraded execution (DD-008 D3). Deployments with no
+ * embeddings-capable credential (Anthropic-only, Cursor-only OSS) run
+ * Phase 2 behavior unchanged, forever.
+ */
+import { create } from "@bufbuild/protobuf";
+import { RecalledMemoriesReportSchema, } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { resolveProxyBaseUrl, buildProxyHeaders } from "./llm-proxy.js";
+import { checkDirectCredentials } from "./llm-backend.js";
+import { getRunnerSecret } from "./runner-credential-store.js";
+/**
+ * Selection activates only when the candidate set EXCEEDS this many facts;
+ * at or below it, top-k degenerates to wholesale and no embeddings call is
+ * made. 20 is comfortably above the dozens-scale where wholesale is fine
+ * (activation is rare) and comfortably below the 100-record cap (activation
+ * is meaningful): at 500-char facts, 20 facts ≈ 10KB of prompt. One
+ * constant, one place, deliberately not adaptive or per-org configurable
+ * in v1 (DD-008 D3).
+ */
+export const RETRIEVAL_K = 20;
+/**
+ * The v1 embedder (DD-008 D4). OpenAI-only: resolved through the Stigmer
+ * proxy when one is configured (cloud — platform key, metered), else the
+ * operator's direct OpenAI key (OSS). NOTE: llm-proxy's `inferProvider`
+ * does not know the `text-*` prefix — this module never infers; the
+ * provider is fixed alongside the model.
+ */
+export const EMBEDDING_MODEL = "text-embedding-3-small";
+/**
+ * Upper bound on the query text sent to the embedder. Facts are write-time
+ * capped at 500 chars, but the query is `spec.message` — unbounded. A giant
+ * pasted message would blow the embedder's per-input token limit (8192 for
+ * text-embedding-3-small) and 400 the WHOLE batched call, silently forcing
+ * wholesale on exactly the executions where selection matters. 20K chars
+ * sits safely under the limit at worst-case chars-per-token; selection
+ * intent is dominated by the message head, and a truncated query beats no
+ * selection.
+ */
+export const QUERY_MAX_CHARS = 20_000;
+/**
+ * Bound on the single embeddings round trip. Generous relative to the
+ * observed 200–400ms typical latency: this exists to keep a hung
+ * connection from stalling prompt build, not to race the provider.
+ */
+const EMBED_TIMEOUT_MS = 15_000;
+/** The OpenAI SDK-default base, used only in direct (unproxied) mode. */
+const DIRECT_OPENAI_BASE_URL = "https://api.openai.com/v1";
+/**
+ * Select the facts to inject for one execution.
+ *
+ * This is the ONE entry point both harnesses call at prompt build, replacing
+ * their direct `readRecalledMemories` reads on the injection path (the read
+ * function remains the presentation-side authority; this module reads the
+ * proto itself because selection needs `memory_id`, which the render
+ * boundary deliberately strips).
+ *
+ * Never throws: every failure path returns wholesale.
+ */
+export async function selectRecalledFacts(recalled, queryText, options) {
+    const candidates = readCandidates(recalled);
+    if (candidates.length === 0) {
+        return { content: undefined, report: undefined };
+    }
+    // Written-once: a prior invocation of this execution already decided.
+    if (options.priorReport !== undefined) {
+        const replayed = replayReport(candidates, options.priorReport);
+        if (replayed !== undefined) {
+            return replayed;
+        }
+        // Unreplayable (recorded ids missing from the immutable snapshot —
+        // structurally impossible, defended anyway): fall through and select
+        // fresh rather than inject nothing.
+        log(`prior report for execution ${options.executionId} did not resolve ` +
+            `against the snapshot; re-selecting`);
+    }
+    if (candidates.length <= RETRIEVAL_K) {
+        return wholesale(candidates);
+    }
+    const embed = options.embed ?? resolveEmbedder(options);
+    if (embed === undefined) {
+        // No embeddings-capable credential: the recorded no-embedder posture
+        // (DD-008 D4) — Phase 2 behavior, honestly reported.
+        return wholesale(candidates);
+    }
+    try {
+        const query = queryText.slice(0, QUERY_MAX_CHARS);
+        const vectors = await embed([query, ...candidates.map((c) => c.content)]);
+        if (vectors.length !== candidates.length + 1) {
+            throw new Error(`embedder returned ${vectors.length} vectors for ` +
+                `${candidates.length + 1} inputs`);
+        }
+        const [queryVector, ...factVectors] = vectors;
+        const selected = topKBySimilarity(queryVector, factVectors, RETRIEVAL_K);
+        return {
+            content: { facts: selected.map((i) => candidates[i].content) },
+            report: create(RecalledMemoriesReportSchema, {
+                selectionActive: true,
+                injectedMemoryIds: selected.map((i) => candidates[i].memoryId),
+                embeddingModel: EMBEDDING_MODEL,
+            }),
+        };
+    }
+    catch (err) {
+        log(`selection failed for execution ${options.executionId}, degrading to ` +
+            `wholesale: ${err instanceof Error ? err.message : String(err)}`);
+        return wholesale(candidates);
+    }
+}
+/**
+ * The snapshot's renderable candidates, in snapshot order. Same semantics
+ * as readRecalledMemories (disabled → none; blank contents dropped
+ * defensively) but keeping `memory_id` — the report's audit link.
+ */
+function readCandidates(recalled) {
+    if (!recalled?.enabled) {
+        return [];
+    }
+    return (recalled.facts ?? [])
+        .map((fact) => ({
+        memoryId: fact.memoryId ?? "",
+        content: fact.content?.trim() ?? "",
+    }))
+        .filter((c) => c.content !== "");
+}
+/**
+ * Replay a previously recorded outcome so a re-invocation injects exactly
+ * what the first invocation did. A selection_active=false report replays
+ * as wholesale (including the case where a transient embed failure was
+ * recorded — retrying could select a subset and diverge the prompt).
+ * Returns undefined when a recorded id no longer resolves.
+ */
+function replayReport(candidates, prior) {
+    if (!prior.selectionActive) {
+        return wholesale(candidates);
+    }
+    const byId = new Map(candidates.map((c) => [c.memoryId, c.content]));
+    const facts = [];
+    for (const id of prior.injectedMemoryIds) {
+        const content = byId.get(id);
+        if (content === undefined) {
+            return undefined;
+        }
+        facts.push(content);
+    }
+    if (facts.length === 0) {
+        return undefined;
+    }
+    return { content: { facts }, report: prior };
+}
+/** Wholesale injection of the full candidate set, honestly reported. */
+function wholesale(candidates) {
+    return {
+        content: { facts: candidates.map((c) => c.content) },
+        report: create(RecalledMemoriesReportSchema, { selectionActive: false }),
+    };
+}
+/**
+ * The credential lanes, in the platform's standing precedence (the
+ * titling-lane idiom): proxy when configured — the runner authenticates
+ * with its Stigmer token and the proxy owns the provider key — else the
+ * operator's direct OpenAI key, else no embedder.
+ */
+function resolveEmbedder(options) {
+    if (options.proxyEndpoint) {
+        return fetchEmbedder(resolveProxyBaseUrl(options.proxyEndpoint, "openai"), buildProxyHeaders(options.stigmerToken ?? "", {
+            executionId: options.executionId,
+        }));
+    }
+    if (checkDirectCredentials("openai") === null) {
+        return fetchEmbedder(DIRECT_OPENAI_BASE_URL, {
+            Authorization: `Bearer ${getRunnerSecret("OPENAI_API_KEY") ?? ""}`,
+        });
+    }
+    return undefined;
+}
+/**
+ * The real embedder: one POST {base}/embeddings. A plain typed fetch, not
+ * LangChain's OpenAIEmbeddings — the SDK wrapper discards the response
+ * `usage` block and adds nothing over a single request. Proxy-side
+ * metering reads the JSON usage from the relayed body.
+ */
+function fetchEmbedder(baseUrl, headers) {
+    return async (inputs) => {
+        const response = await fetch(`${baseUrl}/embeddings`, {
+            method: "POST",
+            headers: { ...headers, "Content-Type": "application/json" },
+            body: JSON.stringify({ model: EMBEDDING_MODEL, input: inputs }),
+            signal: AbortSignal.timeout(EMBED_TIMEOUT_MS),
+        });
+        if (!response.ok) {
+            const body = await response.text().catch(() => "");
+            throw new Error(`embeddings request failed: HTTP ${response.status} ${body.slice(0, 300)}`);
+        }
+        const parsed = (await response.json());
+        if (!Array.isArray(parsed.data)) {
+            throw new Error("embeddings response carries no data array");
+        }
+        // Place by the response's own index field — the API documents input
+        // order, but the contract names the index as authoritative.
+        const vectors = new Array(inputs.length);
+        for (const item of parsed.data) {
+            const index = item.index ?? -1;
+            if (index < 0 || index >= inputs.length || !Array.isArray(item.embedding)) {
+                throw new Error("embeddings response entry is malformed");
+            }
+            vectors[index] = item.embedding;
+        }
+        if (vectors.some((v) => v === undefined)) {
+            throw new Error("embeddings response is missing entries");
+        }
+        return vectors;
+    };
+}
+/**
+ * Indices of the top-k facts by cosine similarity to the query, returned
+ * ASCENDING — i.e. re-sorted to snapshot order (DD-008 D3: selection is by
+ * relevance, presentation stays oldest-first). Ties break toward the lower
+ * snapshot index, so equal scores never reorder across invocations.
+ */
+function topKBySimilarity(queryVector, factVectors, k) {
+    return factVectors
+        .map((vector, index) => ({ index, score: cosineSimilarity(queryVector, vector) }))
+        .sort((a, b) => b.score - a.score || a.index - b.index)
+        .slice(0, k)
+        .map((entry) => entry.index)
+        .sort((a, b) => a - b);
+}
+/**
+ * Plain cosine. OpenAI embeddings arrive unit-normalized (a dot product
+ * would suffice today), but normalizing here keeps ranking correct under
+ * any future embedder without a silent provider assumption.
+ */
+function cosineSimilarity(a, b) {
+    let dot = 0;
+    let normA = 0;
+    let normB = 0;
+    const length = Math.min(a.length, b.length);
+    for (let i = 0; i < length; i++) {
+        dot += a[i] * b[i];
+        normA += a[i] * a[i];
+        normB += b[i] * b[i];
+    }
+    if (normA === 0 || normB === 0) {
+        return 0;
+    }
+    return dot / (Math.sqrt(normA) * Math.sqrt(normB));
+}
+function log(msg) {
+    console.warn(`[memory-retrieval] ${msg}`);
+}
+//# sourceMappingURL=memory-retrieval.js.map

package/dist/shared/memory-retrieval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-retrieval.js","sourceRoot":"","sources":["../../src/shared/memory-retrieval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EACL,4BAA4B,GAE7B,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AAEtC;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,yEAAyE;AACzE,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AA8C3D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAsC,EACtC,SAAiB,EACjB,OAA+B;IAE/B,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACnD,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,mEAAmE;QACnE,qEAAqE;QACrE,oCAAoC;QACpC,GAAG,CACD,8BAA8B,OAAO,CAAC,WAAW,mBAAmB;YACpE,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,qEAAqE;QACrE,qDAAqD;QACrD,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,qBAAqB,OAAO,CAAC,MAAM,eAAe;gBAClD,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,SAAS,CAClC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,WAAW,EAAE,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC;QAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QACzE,OAAO;YACL,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;YAC9D,MAAM,EAAE,MAAM,CAAC,4BAA4B,EAAE;gBAC3C,eAAe,EAAE,IAAI;gBACrB,iBAAiB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC9D,cAAc,EAAE,eAAe;aAChC,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CACD,kCAAkC,OAAO,CAAC,WAAW,iBAAiB;YACtE,cAAc,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjE,CAAC;QACF,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,QAAsC;IAC5D,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;SAC1B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;KACpC,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,UAAuB,EACvB,KAA6B;IAE7B,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC;AAED,wEAAwE;AACxE,SAAS,SAAS,CAAC,UAAuB;IACxC,OAAO;QACL,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;QACpD,MAAM,EAAE,MAAM,CAAC,4BAA4B,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAA+B;IACtD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,aAAa,CAClB,mBAAmB,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,EACpD,iBAAiB,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,sBAAsB,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,aAAa,CAAC,sBAAsB,EAAE;YAC3C,aAAa,EAAE,UAAU,eAAe,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,OAA+B;IACrE,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC/D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,mCAAmC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAEpC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,oEAAoE;QACpE,4DAA4D;QAC5D,MAAM,OAAO,GAAe,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;YAC/B,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,WAAqB,EACrB,WAAuB,EACvB,CAAS;IAET,OAAO,WAAW;SACf,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;SACjF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACtD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;SAC3B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,CAAW,EAAE,CAAW;IAChD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,IAAI,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/shared/runner-credential-keys.js

@@ -62,7 +62,8 @@ export const RUNNER_CREDENTIAL_ENV_KEYS = [
  * rotation bookkeeping, not secrets.
  */
 export const RUNNER_ENCRYPTION_ENV_KEYS = [
-    // Temporal payload-encryption keys (encryption/config.ts). An agent that
+    // Temporal payload-encryption keys (@stigmer/temporal-codecs' encryption
+    // config, read through the injected getRunnerSecret). An agent that
     // reads these could decrypt the runner's Temporal history payloads.
     "STIGMER_PAYLOAD_ENCRYPTION_KEY",
     "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY",

package/dist/shared/runner-credential-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner-credential-keys.js","sourceRoot":"","sources":["../../src/shared/runner-credential-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,wEAAwE;IACxE,iDAAiD;IACjD,4BAA4B;IAC5B,+DAA+D;IAC/D,sEAAsE;IACtE,eAAe;IACf,gEAAgE;IAChE,iDAAiD;IACjD,oBAAoB;IACpB,wEAAwE;IACxE,iCAAiC;IACjC,gBAAgB;IAChB,sEAAsE;IACtE,mBAAmB;IACnB,mEAAmE;IACnE,gBAAgB;IAChB,kDAAkD;IAClD,2BAA2B;IAC3B,iEAAiE;IACjE,0DAA0D;IAC1D,0BAA0B;CAC3B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,yEAAyE;IACzE,oEAAoE;IACpE,gCAAgC;IAChC,0CAA0C;CAC3C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,GAAG,0BAA0B;IAC7B,GAAG,0BAA0B;CAC9B,CAAC"}
+{"version":3,"file":"runner-credential-keys.js","sourceRoot":"","sources":["../../src/shared/runner-credential-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,wEAAwE;IACxE,iDAAiD;IACjD,4BAA4B;IAC5B,+DAA+D;IAC/D,sEAAsE;IACtE,eAAe;IACf,gEAAgE;IAChE,iDAAiD;IACjD,oBAAoB;IACpB,wEAAwE;IACxE,iCAAiC;IACjC,gBAAgB;IAChB,sEAAsE;IACtE,mBAAmB;IACnB,mEAAmE;IACnE,gBAAgB;IAChB,kDAAkD;IAClD,2BAA2B;IAC3B,iEAAiE;IACjE,0DAA0D;IAC1D,0BAA0B;CAC3B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,yEAAyE;IACzE,oEAAoE;IACpE,oEAAoE;IACpE,gCAAgC;IAChC,0CAA0C;CAC3C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,GAAG,0BAA0B;IAC7B,GAAG,0BAA0B;CAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/runner",
-  "version": "3.12.8",
+  "version": "3.12.9",
   "description": "Embeddable Temporal worker for the Stigmer AI agent platform — handles agent execution, workflow orchestration, and MCP server management",
   "license": "Apache-2.0",
   "type": "module",
@@ -94,7 +94,8 @@
     "@opentelemetry/sdk-metrics": "^2.0.0",
     "@opentelemetry/sdk-trace-base": "^2.0.0",
     "@opentelemetry/sdk-trace-node": "^2.0.0",
-    "@stigmer/protos": "3.12.8",
+    "@stigmer/protos": "3.12.9",
+    "@stigmer/temporal-codecs": "3.12.9",
     "@temporalio/activity": "1.16.2",
     "@temporalio/common": "1.16.2",
     "@temporalio/interceptors-opentelemetry": "1.16.2",

package/src/__tests__/history-encryption-e2e.test.ts

@@ -25,7 +25,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { loadWorkflowFromYaml } from "../workflow-engine/loader.js";
 import { evaluateExpressionBatch } from "../workflow-engine/expression.js";
-import { EncryptionPayloadCodec } from "../encryption/payload-codec.js";
+import { EncryptionPayloadCodec } from "@stigmer/temporal-codecs";
 import type { ExecuteServerlessWorkflowInput } from "../workflows/execute-serverless-workflow.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));

package/src/activities/execute-cursor/__tests__/build-prompt.test.ts

@@ -12,7 +12,7 @@ import { create } from "@bufbuild/protobuf";
 import { ApprovalAction, InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { PendingApprovalSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
 
-import { appendStructuredOutputDirective, buildPrompt, isHitlReinvocation, primarySendCarriesImages } from "../index.js";
+import { appendStructuredOutputDirective, buildPrompt, isHitlReinvocation, primarySendCarriesImages, promptCarriesStandingContext } from "../index.js";
 import type { BuildPromptInput } from "../index.js";
 import { buildReinvocationPrompt, formatInteractionModePrefix, formatImplementPlanSection, formatToolApprovalProtocol, buildToolApprovalRuleFile } from "../prompt-builder.js";
 import { PLAN_MODE_DIRECTIVE } from "../../../shared/plan-mode-prompt.js";
@@ -330,6 +330,45 @@ describe("buildPrompt", () => {
     expect(prompt).toContain("APPROVED");
   });
 
+  it("agrees with promptCarriesStandingContext on every resolution shape — the memory-selection gate can never drift from the routing (DD-008)", () => {
+    // The activity gates the (potentially embedding-backed) memory
+    // selection on this predicate; buildPrompt routes on the same one.
+    // Pin their agreement across the full reason × HITL matrix: memories
+    // reach the prompt exactly when the predicate says the prompt carries
+    // standing context.
+    const reasons: AgentResolutionReason[] = [
+      "created_first_execution",
+      "created_after_resume_failure",
+      "resumed_successfully",
+    ];
+    const hitlDecisions = new Map<string, ApprovalAction>([
+      ["tool-call-1", ApprovalAction.APPROVE],
+    ]);
+    const hitlApprovals = [
+      create(PendingApprovalSchema, {
+        toolCallId: "tool-call-1",
+        toolName: "Write",
+        message: "Write file: gated.txt",
+      }),
+    ];
+
+    for (const reason of reasons) {
+      for (const hitl of [false, true]) {
+        const prompt = buildPrompt(
+          input({
+            resolution: resolution("local", reason),
+            approvalDecisions: hitl ? hitlDecisions : undefined,
+            pendingApprovals: hitl ? hitlApprovals : [],
+            recalledMemories: { facts: ["Prefers OpenTofu."] },
+          }),
+        );
+        expect(prompt.includes("<recalled_memories>")).toBe(
+          promptCarriesStandingContext(reason),
+        );
+      }
+    }
+  });
+
   it("uses the reinvocation prompt for a HITL reinvocation (human-meaningful, no opaque ids)", () => {
     const approvalDecisions = new Map<string, ApprovalAction>([
       ["tool-call-1", ApprovalAction.APPROVE],