hippo-memory 1.48.0 → 1.50.0

package/dist/api.d.ts

@@ -11,6 +11,7 @@ import { deleteEntry, loadAllEntries, type TaskSnapshot, type SessionEvent } fro
 import { type RejectedValueRow } from './rejection.js';
 import { type DormantMemory, type ListDormantOpts } from './dormant.js';
 import { type TokenSummary, type TokenSurface } from './token-ledger.js';
+import { type QuarantineStatus } from './quarantine.js';
 import { type FailureSummary } from './failure-log.js';
 import { type SessionHandoff } from './handoff.js';
 import { type MemoryKind, type MemoryEntry } from './memory.js';
@@ -40,6 +41,8 @@ export interface Actor {
     /** 'cli' | 'localhost:cli' | 'api_key:<key_id>' | 'mcp' | 'connector:slack' | 'connector:github' */
     subject: string;
     role: 'admin' | 'member';
+    /** EI2: restricted scopes a member key may read (auth.ts grantScope). Unused for admin actors. */
+    scopes?: readonly string[];
 }
 export interface Context {
     hippoRoot: string;
@@ -108,11 +111,17 @@ export interface RememberOpts {
      * back and the error is rethrown.
      */
     afterWrite?: (db: DatabaseSyncLike, memoryId: string) => void;
+    /** CD5: connector-ingested content an agent doesn't control; gates detectInstruction. CLI/HTTP/MCP never set this. */
+    untrusted?: boolean;
 }
 export interface RememberResult {
     id: string;
     kind: MemoryKind;
     tenantId: string;
+    /** Set only when untrusted content was flagged and quarantined instead of stored under its requested scope. */
+    quarantined?: {
+        reason: string;
+    };
 }
 export declare function remember(ctx: Context, opts: RememberOpts): RememberResult;
 export interface RecallOpts {
@@ -875,6 +884,14 @@ export interface AuthRevokeResult {
     revokedAt: string;
 }
 export declare function authRevoke(ctx: Context, keyId: string): AuthRevokeResult;
+/** Shared result shape for authGrant/authUngrant, named per the file's oxlint anti-slop rule. */
+export interface AuthGrantResult {
+    ok: true;
+}
+/** Grant `keyId` read access to one restricted `scope` (ROADMAP Part VIII EI2). Admin only. */
+export declare function authGrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
+/** Revoke `keyId`'s grant on `scope`. Same authorization and lookup rules as authGrant. */
+export declare function authUngrant(ctx: Context, keyId: string, scope: string): AuthGrantResult;
 export interface AuditListOpts {
     op?: AuditOp;
     /** ISO timestamp lower bound. */
@@ -1051,6 +1068,25 @@ export declare function restoreDormant(ctx: Context, id: string): MemoryEntry;
 export declare function forgetDormant(ctx: Context, id: string): void;
 /** Whether the tenant holds a dormant memory with this id (for "not found" hints). */
 export declare function isDormant(ctx: Context, id: string): boolean;
+export interface QuarantineListItem {
+    id: string;
+    originalScope: string | null;
+    reason: string;
+    status: QuarantineStatus;
+    quarantinedAt: string;
+    decidedAt: string | null;
+    decidedBy: string | null;
+    contentPreview: string;
+}
+/** A tenant's quarantined memories, newest first. Default `status` is 'pending' (the review queue). */
+export declare function quarantineList(ctx: Context, opts?: {
+    status?: QuarantineStatus | 'all';
+    limit?: number;
+}): QuarantineListItem[];
+/** Release a quarantined memory to its original scope. Admin only; the scope guard refuses a row moved since (mirrors restoreDormant). */
+export declare function quarantineApprove(ctx: Context, id: string): void;
+/** Keep a quarantined memory hidden for good. Admin only; the raw row is untouched (append-only). */
+export declare function quarantineReject(ctx: Context, id: string): void;
 export interface SleepResult {
     active: number;
     removed: number;

package/dist/api.js

@@ -13,6 +13,8 @@ import { RejectedValueError } from './rejection.js';
 import { rejectValue, unrejectValue, listRejectionsForTenant } from './reject-flow.js';
 import { listDormantRows, readDormantSnapshot, deleteDormantRow, hasDormantRow, } from './dormant.js';
 import { recordTokenUse, summarizeTokenUse } from './token-ledger.js';
+import { detectInstruction } from './instruction-detect.js';
+import { quarantineScopeFor, recordQuarantine, getQuarantineRow, listQuarantineRows, approveQuarantineRow, rejectQuarantineRow, } from './quarantine.js';
 import { summarizeFailures } from './failure-log.js';
 import { formatHandoffEvidenceLine } from './handoff.js';
 import { createMemory, applyOutcome, calculateStrength, Layer, } from './memory.js';
@@ -21,7 +23,7 @@ import { promoteToGlobal, getGlobalRoot, autoShare, searchBothHybrid } from './s
 import { writeRecallTrace, writeRecallTraceAtRoot, recordTraceOutcome } from './recall-trace.js';
 import { evalNow } from './ablation.js';
 import { archiveRawMemory } from './raw-archive.js';
-import { createApiKey, listApiKeys, revokeApiKey, } from './auth.js';
+import { createApiKey, listApiKeys, revokeApiKey, grantScope, ungrantScope, } from './auth.js';
 import { applyGoalStackBoost } from './goals.js';
 import { markRetrieved, estimateTokens, hybridSearch, physicsSearch } from './search.js';
 import { compareEntryIdentity, compareScoredResults } from './compare.js';
@@ -87,7 +89,7 @@ export class ForbiddenError extends Error {
 // back-compat (`api.isPrivateScope`, test imports). NOTE: the import statement
 // is required — a bare `export { x } from` re-export does not bind the local
 // names this module's ~9 call sites use.
-import { isPrivateScope, passesScopeFilterForRecall, assertScopeRequestAllowed } from './recall-scope.js';
+import { isPrivateScope, passesScopeFilterForRecall, assertScopeRequestAllowed, isRestrictedScope } from './recall-scope.js';
 export { isPrivateScope, passesScopeFilterForRecall };
 export { passesCliRecallScopeFilter, ScopeForbiddenError } from './recall-scope.js';
 // v39: classifyOriginProject lives in project-identity.ts (leaf) so
@@ -140,9 +142,11 @@ function loadAmbientEntries(hippoRoot, tenantId, pinnedOnly, includeRecent, admi
     return loadAmbientCandidates(hippoRoot, tenantId, includeRecent, admitAmbient);
 }
 export function remember(ctx, opts) {
+    const detection = opts.untrusted ? detectInstruction(opts.content) : { flagged: false, reason: null };
+    const requestedScope = opts.scope ?? null;
     const entry = createMemory(opts.content, {
         kind: opts.kind ?? 'distilled',
-        scope: opts.scope ?? null,
+        scope: detection.flagged ? quarantineScopeFor(requestedScope) : requestedScope,
         owner: opts.owner ?? null,
         artifact_ref: opts.artifactRef ?? null,
         tags: opts.tags,
@@ -151,8 +155,23 @@ export function remember(ctx, opts) {
     });
     // writeEntry threads ctx.actor.subject into its internal audit hook, so exactly
     // one 'remember' event lands in the log with the supplied actor.
-    writeEntry(ctx.hippoRoot, entry, { actor: ctx.actor.subject, afterWrite: opts.afterWrite });
-    return { id: entry.id, kind: entry.kind, tenantId: ctx.tenantId };
+    const afterWrite = detection.flagged
+        ? (db, memoryId) => {
+            recordQuarantine(db, {
+                tenantId: ctx.tenantId,
+                memoryId,
+                originalScope: requestedScope,
+                reason: detection.reason ?? 'unknown',
+                actor: ctx.actor.subject,
+            });
+            opts.afterWrite?.(db, memoryId);
+        }
+        : opts.afterWrite;
+    writeEntry(ctx.hippoRoot, entry, { actor: ctx.actor.subject, afterWrite });
+    const result = { id: entry.id, kind: entry.kind, tenantId: ctx.tenantId };
+    if (detection.flagged)
+        result.quarantined = { reason: detection.reason ?? 'unknown' };
+    return result;
 }
 /**
  * Shared construction helper for `RecallSuppressionSummary`. Used by
@@ -188,13 +207,13 @@ export function buildSuppressionSummary(counts) {
  */
 export function recall(ctx, opts) {
     // A member key may not unlock a private or quarantined scope by naming it.
-    assertScopeRequestAllowed(ctx.actor.role, opts.scope);
+    assertScopeRequestAllowed(ctx.actor, opts.scope);
     const windowSize = recallWindowSize(opts);
     return recallFrom(ctx, opts, windowSize, loadRecallSearchEntries(ctx.hippoRoot, opts.query, windowSize, ctx.tenantId, opts.scope, 'exact', false));
 }
 /** Mode-aware recall that strengthens each returned row; never writes last_retrieval_ids (v1.11.5 lock). */
 export async function retrieve(ctx, opts) {
-    assertScopeRequestAllowed(ctx.actor.role, opts.scope);
+    assertScopeRequestAllowed(ctx.actor, opts.scope);
     const windowSize = recallWindowSize(opts);
     let candidates = loadRecallSearchEntries(ctx.hippoRoot, opts.query, windowSize, ctx.tenantId, opts.scope, 'exact', false);
     if (opts.mode === 'hybrid' || opts.mode === 'physics') {
@@ -288,7 +307,7 @@ function recallFrom(ctx, opts, windowSize, all) {
         // anchored `<source>:private:*` rule (v1.2.1 generalization) and
         // defense-in-depth: connector authors cannot silently surface private
         // rows to no-scope callers even if the SQL clause regresses.
-        entries = current.filter((e) => !isPrivateScope(e.scope ?? null));
+        entries = current.filter((e) => !isRestrictedScope(e.scope ?? null));
     }
     // v1.12.13 / C5 — WYSIATI dropped_pre_rank counter (JS scope filter drops
     // for api.recall; cmdRecall pipeline rolls --outcome/--layer/--as-of/etc.
@@ -725,7 +744,7 @@ function recallFrom(ctx, opts, windowSize, all) {
  *   - all rows fail the scope/tenant filter
  */
 export function assemble(ctx, sessionId, opts = {}) {
-    assertScopeRequestAllowed(ctx.actor.role, opts.scope);
+    assertScopeRequestAllowed(ctx.actor, opts.scope);
     const budget = opts.budget ?? 4000;
     const freshTailCount = opts.freshTailCount ?? 10;
     const summarizeOlder = opts.summarizeOlder ?? true;
@@ -1152,6 +1171,7 @@ export function supersede(ctx, oldId, newContent) {
         source: old.source,
         confidence: 'verified',
         tenantId: ctx.tenantId,
+        scope: old.scope,
     });
     // Race-safe transition: open a fresh db handle, BEGIN IMMEDIATE, run all
     // three steps (CAS on old + writeEntryDbOnly(new) + supersede audit row)
@@ -1401,6 +1421,50 @@ export function authRevoke(ctx, keyId) {
         closeHippoDb(db);
     }
 }
+/** Grant `keyId` read access to one restricted `scope` (ROADMAP Part VIII EI2). Admin only. */
+export function authGrant(ctx, keyId, scope) {
+    return changeScopeGrant(ctx, keyId, scope, 'auth_grant');
+}
+/** Revoke `keyId`'s grant on `scope`. Same authorization and lookup rules as authGrant. */
+export function authUngrant(ctx, keyId, scope) {
+    return changeScopeGrant(ctx, keyId, scope, 'auth_ungrant');
+}
+function changeScopeGrant(ctx, keyId, scope, op) {
+    if (ctx.actor.role !== 'admin') {
+        throw new ForbiddenError('Only an admin key can change scope grants');
+    }
+    const db = openHippoDb(ctx.hippoRoot);
+    try {
+        // SAFETY: row's shape matches the single tenant_id column in the SELECT.
+        const row = db
+            .prepare(`SELECT tenant_id, revoked_at FROM api_keys WHERE key_id = ?`)
+            .get(keyId);
+        if (!row || row.tenant_id !== ctx.tenantId) {
+            throw new Error(`Unknown key_id: ${keyId}`);
+        }
+        if (op === 'auth_grant' && row.revoked_at) {
+            throw new Error(`${keyId} is revoked; a grant on it would never apply`);
+        }
+        if (!isRestrictedScope(scope)) {
+            throw new Error(`${scope} is not a restricted scope; it is already readable by default`);
+        }
+        if (op === 'auth_grant')
+            grantScope(db, keyId, scope);
+        else
+            ungrantScope(db, keyId, scope);
+        try {
+            appendAuditEvent(db, { tenantId: ctx.tenantId, actor: ctx.actor.subject, op, targetId: keyId, metadata: { scope } });
+        }
+        catch (err) {
+            // Audit must not undo a grant change that already committed; surface it instead.
+            console.error(`auth: audit write failed for ${op} ${keyId}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return { ok: true };
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
 /**
  * Read audit events scoped to `ctx.tenantId`. Read-only — no audit emit (matches
  * A5: cmdAuditList does not record a 'recall'-style read event).
@@ -2045,6 +2109,118 @@ export function isDormant(ctx, id) {
         closeHippoDb(db);
     }
 }
+const QUARANTINE_PREVIEW_CHARS = 200;
+/** A tenant's quarantined memories, newest first. Default `status` is 'pending' (the review queue). */
+export function quarantineList(ctx, opts = {}) {
+    const db = openHippoDb(ctx.hippoRoot);
+    try {
+        const rows = listQuarantineRows(db, ctx.tenantId, opts.status ?? 'pending', opts.limit);
+        return rows.map((row) => {
+            const entry = readEntry(ctx.hippoRoot, row.memoryId, ctx.tenantId);
+            return {
+                id: row.memoryId,
+                originalScope: row.originalScope,
+                reason: row.reason,
+                status: row.status,
+                quarantinedAt: row.quarantinedAt,
+                decidedAt: row.decidedAt,
+                decidedBy: row.decidedBy,
+                contentPreview: entry ? entry.content.slice(0, QUARANTINE_PREVIEW_CHARS) : '',
+            };
+        });
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
+function loadPendingQuarantineRow(db, tenantId, id) {
+    const row = getQuarantineRow(db, tenantId, id);
+    if (!row)
+        throw new Error(`not quarantined: ${id}`);
+    if (row.status !== 'pending')
+        throw new Error(`${id} is already ${row.status}`);
+    return row;
+}
+/** Release a quarantined memory to its original scope. Admin only; the scope guard refuses a row moved since (mirrors restoreDormant). */
+export function quarantineApprove(ctx, id) {
+    if (ctx.actor.role !== 'admin') {
+        throw new ForbiddenError('Only an admin key can approve a quarantined memory');
+    }
+    const db = openHippoDb(ctx.hippoRoot);
+    try {
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            const row = loadPendingQuarantineRow(db, ctx.tenantId, id);
+            const quarantineScope = quarantineScopeFor(row.originalScope);
+            const updated = db
+                .prepare(`UPDATE memories SET scope = ? WHERE id = ? AND tenant_id = ? AND scope = ?`)
+                .run(row.originalScope, id, ctx.tenantId, quarantineScope);
+            if (Number(updated.changes ?? 0) !== 1) {
+                throw new Error(`memory ${id} scope changed since quarantine; refusing to approve`);
+            }
+            approveQuarantineRow(db, ctx.tenantId, id, ctx.actor.subject);
+            appendAuditEvent(db, {
+                tenantId: ctx.tenantId,
+                actor: ctx.actor.subject,
+                op: 'quarantine_approve',
+                targetId: id,
+                metadata: { originalScope: row.originalScope },
+            });
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            try {
+                db.exec('ROLLBACK');
+            }
+            catch { /* already rolled back */ }
+            throw err;
+        }
+    }
+    finally {
+        closeHippoDb(db);
+    }
+    // Post-commit, best-effort: a failed rewrite leaves the mirror showing the quarantine scope (fail-closed).
+    try {
+        const restored = readEntry(ctx.hippoRoot, id, ctx.tenantId);
+        if (restored)
+            writeEntryMirrors(ctx.hippoRoot, restored);
+    }
+    catch (err) {
+        console.error(`quarantine: mirror rewrite failed for ${id}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/** Keep a quarantined memory hidden for good. Admin only; the raw row is untouched (append-only). */
+export function quarantineReject(ctx, id) {
+    if (ctx.actor.role !== 'admin') {
+        throw new ForbiddenError('Only an admin key can reject a quarantined memory');
+    }
+    const db = openHippoDb(ctx.hippoRoot);
+    try {
+        db.exec('BEGIN IMMEDIATE');
+        try {
+            loadPendingQuarantineRow(db, ctx.tenantId, id);
+            rejectQuarantineRow(db, ctx.tenantId, id, ctx.actor.subject);
+            appendAuditEvent(db, {
+                tenantId: ctx.tenantId,
+                actor: ctx.actor.subject,
+                op: 'quarantine_reject',
+                targetId: id,
+                metadata: {},
+            });
+            db.exec('COMMIT');
+        }
+        catch (err) {
+            try {
+                db.exec('ROLLBACK');
+            }
+            catch { /* already rolled back */ }
+            throw err;
+        }
+    }
+    finally {
+        closeHippoDb(db);
+    }
+}
 const DEFAULT_SLEEP_PHASES = {
     consolidate,
     deduplicateStore,

package/dist/audit.d.ts

@@ -16,7 +16,7 @@ export interface AuditResult {
 export declare function auditMemory(entry: MemoryEntry): AuditIssue | null;
 export declare function auditMemories(entries: MemoryEntry[]): AuditResult;
 export declare function isContentWorthStoring(content: string): boolean;
-export type AuditOp = 'remember' | 'recall' | 'promote' | 'supersede' | 'forget' | 'archive_raw' | 'auth_revoke' | 'auth_create' | 'outcome' | 'consolidate' | 'audit_prune' | 'summary_marked_dirty' | 'summary_marked_clean' | 'summary_rebuilt' | 'predict_create' | 'predict_close' | 'predict_baserate' | 'recall_autodebias_hint' | 'recall_autodebias_hint_no_class_match' | 'recall_autodebias_hint_tiebreak' | 'recall_anchor_detected_query_repeat' | 'recall_anchor_detected_memory_dominance' | 'recall_anchor_skipped_no_session' | 'recall_availability_detected' | 'decision_create' | 'decision_supersede' | 'decision_close' | 'incident_open' | 'incident_resolve' | 'incident_close' | 'process_create' | 'process_supersede' | 'process_close' | 'policy_create' | 'policy_supersede' | 'policy_close' | 'skill_create' | 'skill_supersede' | 'skill_close' | 'project_brief_create' | 'project_brief_supersede' | 'project_brief_close' | 'customer_note_create' | 'customer_note_supersede' | 'customer_note_close' | 'mv_rescue' | 'reject_value' | 'reject_refusal' | 'unreject_value' | 'half_life_migrate' | 'dormant_restore' | 'conflict_resolve';
+export type AuditOp = 'remember' | 'recall' | 'promote' | 'supersede' | 'forget' | 'archive_raw' | 'auth_revoke' | 'auth_create' | 'outcome' | 'consolidate' | 'audit_prune' | 'summary_marked_dirty' | 'summary_marked_clean' | 'summary_rebuilt' | 'predict_create' | 'predict_close' | 'predict_baserate' | 'recall_autodebias_hint' | 'recall_autodebias_hint_no_class_match' | 'recall_autodebias_hint_tiebreak' | 'recall_anchor_detected_query_repeat' | 'recall_anchor_detected_memory_dominance' | 'recall_anchor_skipped_no_session' | 'recall_availability_detected' | 'decision_create' | 'decision_supersede' | 'decision_close' | 'incident_open' | 'incident_resolve' | 'incident_close' | 'process_create' | 'process_supersede' | 'process_close' | 'policy_create' | 'policy_supersede' | 'policy_close' | 'skill_create' | 'skill_supersede' | 'skill_close' | 'project_brief_create' | 'project_brief_supersede' | 'project_brief_close' | 'customer_note_create' | 'customer_note_supersede' | 'customer_note_close' | 'mv_rescue' | 'reject_value' | 'reject_refusal' | 'unreject_value' | 'half_life_migrate' | 'dormant_restore' | 'conflict_resolve' | 'auth_grant' | 'auth_ungrant' | 'quarantine' | 'quarantine_approve' | 'quarantine_reject';
 export interface AppendAuditOpts {
     tenantId: string;
     actor: string;

package/dist/auth.d.ts

@@ -16,9 +16,17 @@ export interface ValidateResult {
     keyId?: string;
     /** v1.12.0 A5 v2 sub-1: 'admin' | 'member'. Present only when valid=true. */
     role?: 'admin' | 'member';
+    /** EI2: scope grants for this key. Present only when valid=true. */
+    scopes?: string[];
 }
 export declare function validateApiKey(db: DatabaseSyncLike, plaintext: string): ValidateResult;
 export declare function revokeApiKey(db: DatabaseSyncLike, keyId: string): void;
+/** EI2: grant `keyId` read access to one restricted `scope`. Idempotent. */
+export declare function grantScope(db: DatabaseSyncLike, keyId: string, scope: string): void;
+/** EI2: revoke `keyId`'s grant on `scope`. Not an error when no such grant exists. */
+export declare function ungrantScope(db: DatabaseSyncLike, keyId: string, scope: string): void;
+/** EI2: every restricted scope `keyId` may read. */
+export declare function listScopeGrants(db: DatabaseSyncLike, keyId: string): string[];
 export interface ApiKeyListItem {
     keyId: string;
     tenantId: string;
@@ -31,6 +39,8 @@ export interface ApiKeyListItem {
      * Fail-safe-to-member cast: any non-'admin' value reads as 'member'.
      */
     role: 'admin' | 'member';
+    /** EI2: restricted scopes this key may read. */
+    scopes: string[];
 }
 export declare function listApiKeys(db: DatabaseSyncLike, opts: {
     active: boolean;

package/dist/auth.js

@@ -74,12 +74,30 @@ export function validateApiKey(db, plaintext) {
     // 'superuser', or a NULL slipped past the NOT NULL constraint) downgrades to
     // 'member'. The migration constrains to 'admin' DEFAULT, but defense-in-depth.
     const role = row.role === 'admin' ? 'admin' : 'member';
-    return { valid: true, tenantId: row.tenant_id, keyId, role };
+    const scopes = listScopeGrants(db, keyId);
+    return { valid: true, tenantId: row.tenant_id, keyId, role, scopes };
 }
 export function revokeApiKey(db, keyId) {
     db.prepare(`UPDATE api_keys SET revoked_at = ? WHERE key_id = ? AND revoked_at IS NULL`)
         .run(new Date().toISOString(), keyId);
 }
+/** EI2: grant `keyId` read access to one restricted `scope`. Idempotent. */
+export function grantScope(db, keyId, scope) {
+    db.prepare(`INSERT INTO api_key_scope_grants (key_id, scope, granted_at) VALUES (?, ?, ?)
+     ON CONFLICT(key_id, scope) DO NOTHING`).run(keyId, scope, new Date().toISOString());
+}
+/** EI2: revoke `keyId`'s grant on `scope`. Not an error when no such grant exists. */
+export function ungrantScope(db, keyId, scope) {
+    db.prepare(`DELETE FROM api_key_scope_grants WHERE key_id = ? AND scope = ?`).run(keyId, scope);
+}
+/** EI2: every restricted scope `keyId` may read. */
+export function listScopeGrants(db, keyId) {
+    // SAFETY: rows' shape matches the single `scope` column named in the SELECT above.
+    const rows = db
+        .prepare(`SELECT scope FROM api_key_scope_grants WHERE key_id = ? ORDER BY scope`)
+        .all(keyId);
+    return rows.map((r) => r.scope);
+}
 export function listApiKeys(db, opts) {
     const sql = opts.active
         ? `SELECT key_id, tenant_id, label, created_at, revoked_at, role FROM api_keys WHERE revoked_at IS NULL ORDER BY id DESC`
@@ -92,6 +110,7 @@ export function listApiKeys(db, opts) {
         keyId: r.key_id, tenantId: r.tenant_id, label: r.label,
         createdAt: r.created_at, revokedAt: r.revoked_at,
         role: r.role === 'admin' ? 'admin' : 'member',
+        scopes: listScopeGrants(db, r.key_id),
     }));
 }
 //# sourceMappingURL=auth.js.map

package/dist/cli.js

@@ -852,6 +852,7 @@ function cmdSupersede(hippoRoot, oldId, newContent, flags) {
         source: old.source,
         confidence: 'verified',
         tenantId: old.tenantId,
+        scope: old.scope,
     });
     // AT1: write the SUCCESSOR first. The rejection guard fires on the new
     // content — if it refuses, nothing has been mutated yet (the old ordering
@@ -3896,6 +3897,56 @@ function cmdDormant(hippoRoot, args, flags) {
     }
     console.log('Bring one back: hippo dormant restore <id>   Delete for good: hippo dormant forget <id>');
 }
+/** `hippo quarantine [list] [--all] [--json] [--global]`, `quarantine approve <id>`, `quarantine reject <id>` (CD5 poisoning defence). */
+function cmdQuarantine(hippoRoot, args, flags) {
+    const root = resolveAuthRoot(hippoRoot, flags);
+    const ctx = {
+        hippoRoot: root,
+        tenantId: resolveTenantId({}),
+        actor: api.adminActor('cli'),
+    };
+    const sub = args[0];
+    if (sub === 'approve' || sub === 'reject') {
+        const id = (args[1] ?? '').trim();
+        if (!id) {
+            console.error(`Usage: hippo quarantine ${sub} <id>`);
+            process.exit(1);
+        }
+        try {
+            if (sub === 'approve') {
+                api.quarantineApprove(ctx, id);
+                console.log(`Approved ${id}: restored to its original scope.`);
+            }
+            else {
+                api.quarantineReject(ctx, id);
+                console.log(`Rejected ${id}: stays quarantined.`);
+            }
+        }
+        catch (err) {
+            console.error(`Could not ${sub} ${id}: ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(1);
+        }
+        return;
+    }
+    const status = flags['all'] ? 'all' : 'pending';
+    const rows = api.quarantineList(ctx, { status });
+    if (flags['json']) {
+        console.log(JSON.stringify({ quarantine: rows }, null, 2));
+        return;
+    }
+    if (rows.length === 0) {
+        console.log(status === 'all' ? 'No quarantined memories.' : 'No pending quarantined memories.');
+        return;
+    }
+    console.log(`${rows.length} quarantined memor${rows.length === 1 ? 'y' : 'ies'} (newest first):\n`);
+    for (const row of rows) {
+        console.log(`--- ${row.id} [${row.status}]`);
+        console.log(`    ${row.contentPreview}`);
+        console.log(`    ${row.reason}, original scope ${row.originalScope ?? '(none)'}, quarantined ${row.quarantinedAt.slice(0, 10)}`);
+        console.log('');
+    }
+    console.log('Approve: hippo quarantine approve <id>   Reject: hippo quarantine reject <id>');
+}
 /**
  * `hippo tokens [--days <n>] [--json] [--global]`: the token ledger
  * (ROADMAP TE0). Tokens of memory text handed to agents per surface, blocks
@@ -7885,6 +7936,41 @@ function cmdAuthRevoke(hippoRoot, keyId, flags) {
     }
     console.log(`Revoked ${keyId} at ${revokedAt}`);
 }
+/** EI2: `hippo auth grant|ungrant <key_id> <scope>`, routed through api so the tenant, restricted-scope and audit checks live in one place. */
+function cmdAuthScopeGrant(hippoRoot, keyId, scope, grant, flags) {
+    const root = resolveAuthRoot(hippoRoot, flags);
+    // The local CLI owns every tenant (as auth revoke does), so the grant runs in the key's own tenant.
+    const db = openHippoDb(root);
+    let keyTenant;
+    try {
+        // SAFETY: row's shape matches the single tenant_id column in the SELECT.
+        const row = db.prepare(`SELECT tenant_id FROM api_keys WHERE key_id = ?`).get(keyId);
+        keyTenant = row?.tenant_id;
+    }
+    finally {
+        closeHippoDb(db);
+    }
+    if (keyTenant === undefined) {
+        console.error(`Unknown key_id: ${keyId}`);
+        process.exit(1);
+    }
+    const ctx = { hippoRoot: root, tenantId: keyTenant, actor: api.adminActor('cli') };
+    try {
+        if (grant)
+            api.authGrant(ctx, keyId, scope);
+        else
+            api.authUngrant(ctx, keyId, scope);
+    }
+    catch (err) {
+        console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+    if (flags['json']) {
+        console.log(JSON.stringify({ keyId, scope, granted: grant }));
+        return;
+    }
+    console.log(grant ? `Granted ${keyId} read access to ${scope}` : `Removed ${keyId}'s grant on ${scope}`);
+}
 // ---------------------------------------------------------------------------
 // Audit log subcommands (A5 stub auth — `hippo audit list`)
 // ---------------------------------------------------------------------------
@@ -7941,6 +8027,11 @@ const VALID_AUDIT_OPS = new Set([
     'conflict_resolve', // AT1 — emitted by resolveConflict on every resolution path; lockstep
     'half_life_migrate', // Decay default change — emitted by migrateDefaultHalfLife; lockstep with AuditOp union
     'dormant_restore', // Dormant memories — emitted by api.restoreDormant; lockstep with AuditOp union + server.ts VALID_AUDIT_OPS
+    'auth_grant', // EI2: emitted by api.authGrant; lockstep with AuditOp union + server.ts VALID_AUDIT_OPS
+    'auth_ungrant', // EI2: emitted by api.authUngrant; lockstep with AuditOp union + server.ts VALID_AUDIT_OPS
+    'quarantine', // CD5: emitted by recordQuarantine; lockstep with AuditOp union + server.ts VALID_AUDIT_OPS
+    'quarantine_approve', // CD5: emitted by api.quarantineApprove; lockstep
+    'quarantine_reject', // CD5: emitted by api.quarantineReject; lockstep
 ]);
 function formatAuditRow(ev) {
     const target = ev.targetId ?? '-';
@@ -8264,7 +8355,7 @@ function cmdGoal(hippoRoot, args, flags) {
 function cmdAuth(hippoRoot, args, flags) {
     const sub = args[0];
     if (!sub) {
-        console.error('Usage: hippo auth <create|list|revoke> [options]');
+        console.error('Usage: hippo auth <create|list|revoke|grant|ungrant> [options]');
         process.exit(1);
     }
     const subArgs = args.slice(1);
@@ -8284,8 +8375,18 @@ function cmdAuth(hippoRoot, args, flags) {
             cmdAuthRevoke(hippoRoot, keyId, flags);
             return;
         }
+        case 'grant':
+        case 'ungrant': {
+            const [keyId, scope] = subArgs;
+            if (!keyId || !scope) {
+                console.error(`Usage: hippo auth ${sub} <key_id> <scope>`);
+                process.exit(1);
+            }
+            cmdAuthScopeGrant(hippoRoot, keyId, scope, sub === 'grant', flags);
+            return;
+        }
         default:
-            console.error(`Unknown auth subcommand: ${sub}. Expected: create | list | revoke.`);
+            console.error(`Unknown auth subcommand: ${sub}. Expected: create | list | revoke | grant | ungrant.`);
             process.exit(1);
     }
 }
@@ -8673,6 +8774,12 @@ Commands:
     --global               Operate on the global store
     dormant restore <id>   Bring a dormant memory back to active memory
     dormant forget <id>    Delete a dormant memory permanently
+  quarantine [list]        List memories a connector flagged as an instruction attempt, pending review
+    --all                  Include approved and rejected rows too (default: pending only)
+    --json                 Output as JSON
+    --global               Operate on the global store
+    quarantine approve <id> Restore a quarantined memory to its original scope
+    quarantine reject <id>  Keep a quarantined memory hidden for good
   capture-error            Store a failed tool call as an error memory (reads the Claude Code
                            PostToolUseFailure hook payload on stdin; skips routine failures)
   doctor                   Check the install: Node, store, schema, sleep, agent hooks
@@ -8966,6 +9073,12 @@ Commands:
     auth revoke <key_id>   Revoke an API key (subsequent validate fails)
       --json               Output as JSON
       --global             Operate on the global store
+    auth grant <key_id> <scope>    Let a member key read one restricted scope
+      --json               Output as JSON
+      --global             Operate on the global store
+    auth ungrant <key_id> <scope>  Remove a scope grant
+      --json               Output as JSON
+      --global             Operate on the global store
   audit <sub>              Query the append-only audit log (A5 stub auth)
     audit list             List audit events for the active tenant
       --op <op>            Filter by op (remember | recall | promote |
@@ -9424,6 +9537,9 @@ async function main(command, args, flags, hippoRoot) {
         case 'dormant':
             cmdDormant(hippoRoot, args, flags);
             break;
+        case 'quarantine':
+            cmdQuarantine(hippoRoot, args, flags);
+            break;
         case 'tokens':
             cmdTokens(hippoRoot, flags);
             break;

package/dist/connectors/github/ingest.js

@@ -108,6 +108,7 @@ export function ingestEvent(ctx, input) {
         // v1.12.0: drop the legacy `|| 'connector:github'` fallback (see slack/ingest.ts:73 for rationale).
         const result = remember(ctx, {
             ...opts,
+            untrusted: true,
             afterWrite: (innerDb, memoryId) => {
                 if (input.__testInjectBeforeLog) {
                     input.__testInjectBeforeLog(innerDb, idempotencyKey);

package/dist/connectors/slack/ingest.js

@@ -61,6 +61,7 @@ export function ingestMessage(ctx, input) {
         // ever missing); explicit reliance on the caller is safer.
         const result = remember(ctx, {
             ...opts,
+            untrusted: true,
             afterWrite: (innerDb, memoryId) => {
                 const inserted = innerDb
                     .prepare(`INSERT OR IGNORE INTO slack_event_log (event_id, ingested_at, memory_id) VALUES (?, ?, ?)`)

package/dist/consolidate.d.ts

@@ -19,6 +19,8 @@ export interface ConsolidationResult {
     semanticCreated: number;
     replayed: number;
     promotedTraces: number;
+    /** T7: sessions skipped because their events span two derivation scopes. */
+    tracesSkippedMixedScope: number;
     extractionCandidates: number;
     extracted: number;
     dagCandidateClusters: number;