hippo-memory 1.48.0 → 1.50.0

package/dist/consolidate.js

@@ -25,6 +25,8 @@ import { rescueSet, rankNonPinnedByTenant, validateWeights } from './memory-valu
 import { MEMORY_VALUE_WEIGHTS, SOURCE_ARTIFACT_SHA256 } from './memory-value-weights.js';
 import { appendAuditEvent } from './audit.js';
 import { migrateDefaultHalfLife } from './half-life-migration.js';
+import { derivationScope, commonDerivationScope, derivationPartitionKey } from './recall-scope.js';
+import { isQuarantineScope } from './quarantine.js';
 const DECAY_THRESHOLD = 0.05;
 const MERGE_OVERLAP_THRESHOLD = 0.35; // Jaccard similarity for "related"
 const MERGE_MIN_CLUSTER = 2; // minimum cluster size to merge
@@ -108,6 +110,7 @@ export async function consolidate(hippoRoot, options = {}) {
         semanticCreated: 0,
         replayed: 0,
         promotedTraces: 0,
+        tracesSkippedMixedScope: 0,
         extractionCandidates: 0,
         extracted: 0,
         dagCandidateClusters: 0,
@@ -368,6 +371,13 @@ export async function consolidate(hippoRoot, options = {}) {
                     session_id: session.session_id,
                     limit: 1000,
                 });
+                // T7: a mixed-scope session would otherwise leak into one trace.
+                const sessionScope = commonDerivationScope(events.map((e) => e.scope));
+                if (!sessionScope.ok) {
+                    result.tracesSkippedMixedScope++;
+                    result.details.push(`  ⏭  skipped session ${session.session_id}: events span mixed scopes`);
+                    continue;
+                }
                 const completeEvent = events.find((e) => e.event_type === 'session_complete');
                 if (!completeEvent)
                     continue; // defence-in-depth; findPromotableSessions filters already.
@@ -391,6 +401,7 @@ export async function consolidate(hippoRoot, options = {}) {
                     source_session_id: session.session_id,
                     tags: ['auto-promoted'],
                     source: 'auto-promote',
+                    scope: sessionScope.scope,
                     // T1 fix (2026-08-15 hardening pass): stamp the trace into the SAME
                     // tenant the traceExistsForSession idempotency check (above) runs
                     // under. Before
@@ -671,11 +682,12 @@ export async function consolidate(hippoRoot, options = {}) {
         // before this fix — byte-identical behavior there.
         const mergeCandidatesByTenant = new Map();
         for (const entry of mergeCandidates) {
-            const bucket = mergeCandidatesByTenant.get(entry.tenantId);
+            const key = derivationPartitionKey(entry.tenantId, entry.scope);
+            const bucket = mergeCandidatesByTenant.get(key);
             if (bucket)
                 bucket.push(entry);
             else
-                mergeCandidatesByTenant.set(entry.tenantId, [entry]);
+                mergeCandidatesByTenant.set(key, [entry]);
         }
         // AT1 consolidation-loop fix (docs/plans/2026-08-15-at1-rejected-value-tombstone.md):
         // reuses the single consolidateDb handle opened once above (before the
@@ -686,7 +698,9 @@ export async function consolidate(hippoRoot, options = {}) {
         // declared up at the try's opening above 1.4, not here — it has to
         // survive the try/finally that now wraps this whole section; see the
         // handle-leak restructure comment there.)
-        for (const [mergeTenant, tenantCandidates] of mergeCandidatesByTenant) {
+        for (const [, tenantCandidates] of mergeCandidatesByTenant) {
+            const mergeTenant = tenantCandidates[0].tenantId;
+            const mergeScope = derivationScope(tenantCandidates[0].scope);
             for (let i = 0; i < tenantCandidates.length; i++) {
                 if (used.has(tenantCandidates[i].id))
                     continue;
@@ -722,6 +736,7 @@ export async function consolidate(hippoRoot, options = {}) {
                         source: 'consolidation',
                         confidence: 'inferred',
                         tenantId: mergeTenant,
+                        scope: mergeScope,
                     });
                 }
                 // mergeContents is DETERMINISTIC CONCATENATION (not an LLM paraphrase)
@@ -931,6 +946,8 @@ function detectConflicts(entries, now, decayOpts = {},
 // Default empty set: flag-off behavior is unchanged.
 rescuedIds = new Set()) {
     const survivors = entries.filter((entry) => entry.layer !== Layer.Semantic
+        // CD5: an unreviewed quarantined row must not taint a visible memory as conflicted.
+        && !isQuarantineScope(entry.scope ?? null)
         && (rescuedIds.has(entry.id) || calculateStrength(entry, now, decayOpts) >= DECAY_THRESHOLD));
     const detected = [];
     for (let i = 0; i < survivors.length; i++) {

package/dist/dag.js

@@ -2,6 +2,7 @@ import { createMemory, Layer } from './memory.js';
 import { writeEntry, loadAllDirtySummaries, loadChildrenOfSummary, applyRebuildResult, clearSummaryDirtyAfterBuild, } from './store.js';
 import { RejectedValueError } from './rejection.js';
 import { redactSecrets } from './secret-detect.js';
+import { derivationScope, derivationPartitionKey } from './recall-scope.js';
 export function clusterFacts(facts) {
     if (facts.length === 0)
         return [];
@@ -93,13 +94,16 @@ export async function buildDag(hippoRoot, facts, opts) {
     // behavior there.
     const unparentedByTenant = new Map();
     for (const fact of unparented) {
-        const bucket = unparentedByTenant.get(fact.tenantId);
+        const key = derivationPartitionKey(fact.tenantId, fact.scope);
+        const bucket = unparentedByTenant.get(key);
         if (bucket)
             bucket.push(fact);
         else
-            unparentedByTenant.set(fact.tenantId, [fact]);
+            unparentedByTenant.set(key, [fact]);
     }
-    for (const [factTenant, tenantFacts] of unparentedByTenant) {
+    for (const [, tenantFacts] of unparentedByTenant) {
+        const factTenant = tenantFacts[0].tenantId;
+        const factScope = derivationScope(tenantFacts[0].scope);
         const clusters = clusterFacts(tenantFacts);
         const eligibleClusters = clusters.filter((c) => c.members.length >= 3);
         result.candidateClusters += eligibleClusters.length;
@@ -118,6 +122,7 @@ export async function buildDag(hippoRoot, facts, opts) {
                 confidence: 'inferred',
                 dag_level: 2,
                 tenantId: factTenant,
+                scope: factScope,
             });
             // Schema v25: cache descendant_count + earliest/latest_at on the summary
             // row so DAG-aware recall (docs/plans/2026-05-05-dag-recall.md Task 2)
@@ -299,11 +304,14 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
     const byTenant = new Map();
     for (const l2 of unparented) {
         const tid = l2.tenantId ?? 'default';
-        const list = byTenant.get(tid) ?? [];
+        const key = derivationPartitionKey(tid, l2.scope);
+        const list = byTenant.get(key) ?? [];
         list.push(l2);
-        byTenant.set(tid, list);
+        byTenant.set(key, list);
     }
-    for (const [tenantId, tenantL2s] of byTenant) {
+    for (const [, tenantL2s] of byTenant) {
+        const tenantId = tenantL2s[0].tenantId ?? 'default';
+        const scope = derivationScope(tenantL2s[0].scope);
         const clusters = clusterFacts(tenantL2s);
         const eligible = clusters.filter((c) => c.members.length >= 2);
         result.candidateClusters += eligible.length;
@@ -321,6 +329,7 @@ export async function buildEntityProfiles(hippoRoot, l2Summaries, opts) {
                 confidence: 'inferred',
                 dag_level: 3,
                 tenantId, // HIGH #1 fold: thread tenant explicitly
+                scope,
             });
             profileEntry.descendant_count = cluster.members.length;
             profileEntry.earliest_at = memberCreatedAts[0];

package/dist/db.js

@@ -11,7 +11,7 @@ const require = createRequire(import.meta.url);
 // runtime (Node's built-in synchronous SQLite module); there are no bundled
 // types for it here, so this require + cast is the module's documented boundary.
 const { DatabaseSync } = require('node:sqlite');
-const CURRENT_SCHEMA_VERSION = 46;
+const CURRENT_SCHEMA_VERSION = 48;
 const MIGRATIONS = [
     {
         version: 1,
@@ -2447,6 +2447,30 @@ const MIGRATIONS = [
       `);
         },
     },
+    {
+        version: 47,
+        up: (db) => {
+            // Scope grants (src/auth.ts, ROADMAP EI2): a member key reads a
+            // restricted scope only by an explicit row here. Additive only: no
+            // min_compatible_binary bump.
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS api_key_scope_grants (
+          key_id     TEXT NOT NULL,
+          scope      TEXT NOT NULL,
+          granted_at TEXT NOT NULL,
+          PRIMARY KEY(key_id, scope)
+        );
+      `);
+        },
+    },
+    {
+        version: 48,
+        up: (db) => {
+            // Quarantine (src/quarantine.ts, CD5): a poisoned or suspect memory sits here pending
+            // admin review instead of being hidden with no record. Additive only: no min_compatible_binary bump.
+            db.exec(MEMORY_QUARANTINE_DDL);
+        },
+    },
 ];
 function tableHasColumn(db, tableName, columnName) {
     if (!/^[a-z_]+$/i.test(tableName))
@@ -2612,6 +2636,22 @@ function setSchemaVersion(db, version) {
     db.prepare(`INSERT INTO meta(key, value) VALUES('schema_version', ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value`).run(String(version));
     db.exec(`PRAGMA user_version = ${Math.max(0, Math.trunc(version))}`);
 }
+// Shared by migration v48 and the stamped-store self-heal below.
+const MEMORY_QUARANTINE_DDL = `
+    CREATE TABLE IF NOT EXISTS memory_quarantine (
+      tenant_id      TEXT NOT NULL DEFAULT 'default',
+      memory_id      TEXT NOT NULL,
+      original_scope TEXT,
+      reason         TEXT NOT NULL,
+      status         TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','approved','rejected')),
+      quarantined_at TEXT NOT NULL,
+      decided_at     TEXT,
+      decided_by     TEXT,
+      PRIMARY KEY (tenant_id, memory_id)
+    ) WITHOUT ROWID;
+    CREATE INDEX IF NOT EXISTS idx_memory_quarantine_status
+      ON memory_quarantine(tenant_id, status, quarantined_at DESC);
+`;
 // Before the loop on stamped stores: a table lost after its migration stamped (2026-08-15
 // incident) is never re-migrated, and v4/v16/v22 ALTER or read it. Fresh stores use the chain.
 function ensureContinuityTables(db) {
@@ -2713,6 +2753,7 @@ function ensureContinuityTables(db) {
       tenant_id TEXT NOT NULL DEFAULT 'default'
     )
   `);
+    db.exec(MEMORY_QUARANTINE_DDL);
 }
 // After the loop: tenant_id (v16) and scope (v23) do not exist yet on a genuine old store.
 function ensureContinuityIndexes(db) {

package/dist/dedupe.js

@@ -24,6 +24,7 @@ import { textOverlap } from './search.js';
 import { loadAllEntries, deleteEntry } from './store.js';
 import { compareEntryIdentity } from './compare.js';
 import { canAutoDelete } from './memory.js';
+import { derivationPartitionKey } from './recall-scope.js';
 /** Quantization step for strength-tie comparisons. The historical 0.01
  *  epsilon (see `strengthBucket` below) applied via rounding instead of a
  *  raw abs-diff threshold, so the tiebreak is transitive. */
@@ -76,11 +77,13 @@ export function deduplicateStore(hippoRoot, options = {}) {
     // pre-fix global pass.
     const entriesByTenant = new Map();
     for (const entry of entries) {
-        const bucket = entriesByTenant.get(entry.tenantId);
+        // EI2: also split by restricted scope, else a private copy can delete the readable one.
+        const key = derivationPartitionKey(entry.tenantId, entry.scope);
+        const bucket = entriesByTenant.get(key);
         if (bucket)
             bucket.push(entry);
         else
-            entriesByTenant.set(entry.tenantId, [entry]);
+            entriesByTenant.set(key, [entry]);
     }
     // finiteCount mirrors strengthBucket's non-finite hardening on the
     // retrieval leg: a NaN retrieval_count would make the comparator return

package/dist/extract.js

@@ -92,6 +92,7 @@ export function storeExtractedFacts(hippoRoot, source, facts) {
             confidence: 'inferred',
             source: source.source,
             extracted_from: source.id,
+            scope: source.scope,
             // T1 executor check (2026-08-15 hardening pass): same defect as the
             // consolidate.ts merge/trace passes — createMemory with no tenantId
             // option stamps 'default' (memory.ts:535) regardless of the source

package/dist/instruction-detect.d.ts

@@ -0,0 +1,7 @@
+/** Prompt-injection detection for untrusted memory content (CD5). Same shape as secret-detect.ts; leaf module, no store/api/shared imports. */
+export interface InstructionDetection {
+    flagged: boolean;
+    reason: string | null;
+}
+export declare function detectInstruction(content: string): InstructionDetection;
+//# sourceMappingURL=instruction-detect.d.ts.map

package/dist/instruction-detect.js

@@ -0,0 +1,27 @@
+/** Prompt-injection detection for untrusted memory content (CD5). Same shape as secret-detect.ts; leaf module, no store/api/shared imports. */
+const INSTRUCTION_PATTERNS = [
+    { name: 'override-instructions', re: /\b(?:ignore|disregard|forget)\b[^.\n]{0,40}\b(?:previous|prior|above)\b[^.\n]{0,40}\binstructions?\b/i },
+    { name: 'role-reassignment', re: /\b(?:you are now|act as|pretend to be)\b[^.\n]{0,40}\b(?:an?\s+)?(?:ai|assistant|agent|system)\b/i },
+    { name: 'chat-role-markup', re: /<\|im_start\|>|<\|system\|>|\[INST\]|<\/?system>|###\s*system\s*:/i },
+    { name: 'system-prompt-reference', re: /\b(?:(?:override|ignore|bypass|replace|reveal)\b[^.\n]{0,40}\b(?:system prompt|developer message)|(?:system prompt|developer message)\b[^.\n]{0,40}\b(?:override|ignore|bypass|replace|reveal))\b/i },
+    // "always"/"never" alone (ordinary PR prose) doesn't flag without an agent-facing target nearby too.
+    { name: 'standing-order', re: /\b(?:from now on|whenever you|always|never)\b[^.\n]{0,50}\b(?:you must|(?:the ai|the assistant|the agent|claude|copilot)\s+(?:must|should|will)\b)/i },
+    { name: 'concealment', re: /\b(?:do not|never|don't)\b[^.\n]{0,40}\b(?:tell|mention|reveal)\b[^.\n]{0,40}\bthe user\b/i },
+    { name: 'remote-script-exec', re: /\b(?:curl|wget)\b[^\n|]{0,80}\|\s*(?:sudo\s+)?(?:sh|bash|zsh)\b|\biex\s*\(\s*(?:iwr|invoke-webrequest|new-object\s+net\.webclient)/i },
+    { name: 'exfiltration', re: /\b(?:send|post|upload|exfiltrate)\b[^.\n]{0,40}\b(?:secrets?|tokens?|api[- ]?keys?|credentials?|env(?:ironment)? variables?)\b/i },
+    { name: 'unicode-tag-chars', re: /[\u{E0000}-\u{E007F}]/u },
+];
+// A stray zero-width char has legitimate uses (ZWJ); only a run of 3+ adjacent ones reads as smuggling.
+const ZERO_WIDTH_RUN_RE = /[\u200B-\u200F\u2060-\u2064]{3,}/;
+export function detectInstruction(content) {
+    for (const { name, re } of INSTRUCTION_PATTERNS) {
+        if (re.test(content)) {
+            return { flagged: true, reason: `pattern:${name}` };
+        }
+    }
+    if (ZERO_WIDTH_RUN_RE.test(content)) {
+        return { flagged: true, reason: 'pattern:zero-width-smuggling' };
+    }
+    return { flagged: false, reason: null };
+}
+//# sourceMappingURL=instruction-detect.js.map

package/dist/mcp/server.d.ts

@@ -48,6 +48,8 @@ export interface McpContext {
      * assuming admin, or a member key over HTTP-MCP would act as admin.
      */
     role?: 'admin' | 'member';
+    /** EI2: scope grants for the HTTP-MCP caller's key. Absent for stdio (admin, needs none). */
+    scopes?: readonly string[];
     /**
      * Per-client key for state isolation under HTTP-MCP. For stdio: 'stdio-${pid}'
      * (one process = one client). For HTTP-SSE / HTTP MCP: hash(bearer + remoteAddr)

package/dist/mcp/server.js

@@ -12,7 +12,7 @@ import * as path from 'path';
 import { createMemory, Layer, calculateStrength, } from '../memory.js';
 import { hybridSearch, physicsSearch, estimateTokens } from '../search.js';
 import { evalNow } from '../ablation.js';
-import { loadAllEntries, writeEntry, strengthenRetrieved, readEntry, loadFreshActiveTaskSnapshot, listMemoryConflicts, resolveConflict, RECALL_DEFAULT_DENY_SCOPES, countCreatedSinceLastSleep } from '../store.js';
+import { loadAllEntries, writeEntry, strengthenRetrieved, readEntry, loadFreshActiveTaskSnapshot, listMemoryConflicts, resolveConflict, countCreatedSinceLastSleep } from '../store.js';
 import { shareMemory, listPeers, getGlobalRoot, initGlobal } from '../shared.js';
 import { consolidate } from '../consolidate.js';
 import { execSync } from 'child_process';
@@ -20,7 +20,7 @@ import { fetchGitLog, extractLessons, partitionLessons, deduplicateLesson, isGit
 import { loadConfig } from '../config.js';
 import { confidenceLabel } from '../memory.js';
 import { resolveTenantId } from '../tenant.js';
-import { recall as apiRecall, remember as apiRemember, outcome as apiOutcome, drillDown as apiDrillDown, assemble as apiAssemble, isPrivateScope, passesScopeFilterForRecall, buildSuppressionSummary, ambientSecretAdmit } from '../api.js';
+import { recall as apiRecall, remember as apiRemember, outcome as apiOutcome, drillDown as apiDrillDown, assemble as apiAssemble, passesScopeFilterForRecall, buildSuppressionSummary, ambientSecretAdmit } from '../api.js';
 import { assertScopeRequestAllowed } from '../recall-scope.js';
 import { resolveProjectIdentity, classifyOriginProject, findHippoStoreDir } from '../project-identity.js';
 import { computePredictionBaserate } from '../predictions.js';
@@ -57,7 +57,7 @@ export function findHippoRoot(cwd = process.cwd(), opts) {
  * a member key never acts as admin through MCP.
  */
 function mcpActor(ctx) {
-    return { subject: ctx?.actor ?? 'mcp', role: ctx?.role ?? 'admin' };
+    return { subject: ctx?.actor ?? 'mcp', role: ctx?.role ?? 'admin', scopes: ctx?.scopes };
 }
 // MCP stdio transport spec: messages are newline-delimited JSON-RPC, no embedded newlines.
 // https://modelcontextprotocol.io/specification/.../basic/transports#stdio
@@ -518,7 +518,7 @@ async function executeTool(name, args, ctx) {
             // ordering and the strength bump on retrieval. Apply the same scope
             // rule as api.recall: explicit scope = exact match; no scope =
             // default-deny on ANY `<source>:private:*` AND 'unknown:legacy'.
-            // v1.2.1: generic-private check via api.isPrivateScope.
+            // EI2: one shared predicate (passesScopeFilterForRecall) so MCP never admits what SQL hides.
             const allEntries = loadAllEntries(hippoRoot, tenantId);
             // v1.12.13 / C5 — WYSIATI counters for the MCP physics/hybrid pipeline.
             // Per the plan-eng-critic round 1 CRIT resolution: MCP's user-visible
@@ -530,18 +530,7 @@ async function executeTool(name, args, ctx) {
             const totalCandidatesCountMcp = allEntries.length;
             const entries = explicitScope
                 ? allEntries.filter((e) => e.scope === explicitScope)
-                : allEntries.filter((e) => {
-                    const s = e.scope ?? null;
-                    if (s === null)
-                        return true;
-                    if (isPrivateScope(s))
-                        return false;
-                    // v1.7.2: read from RECALL_DEFAULT_DENY_SCOPES (single source of truth
-                    // shared with SQL clause + passesScopeFilterForRecall).
-                    if (RECALL_DEFAULT_DENY_SCOPES.some((deny) => deny === s))
-                        return false;
-                    return true;
-                });
+                : allEntries.filter((e) => passesScopeFilterForRecall(e.scope ?? null, undefined));
             const droppedPreRankCountMcp = allEntries.length - entries.length;
             const usePhysics = config.physics?.enabled !== false;
             let results = usePhysics
@@ -1012,7 +1001,7 @@ async function executeTool(name, args, ctx) {
             // results and the snapshot. Pre-v1.2 this surface returned all memories
             // and the snapshot unfiltered, which would have leaked private-channel
             // content to no-scope MCP callers once scope writers shipped.
-            assertScopeRequestAllowed(mcpActor(ctx).role, explicitScope);
+            assertScopeRequestAllowed(mcpActor(ctx), explicitScope);
             const allEntries = loadAllEntries(hippoRoot, tenantId);
             // v39 memory scope isolation: this surface reads the LOCAL store only,
             // but synced-down or legacy rows can still carry another project's

package/dist/project-briefs.js

@@ -22,7 +22,7 @@
  * closed (retired).
  */
 import { openHippoDb, closeHippoDb } from './db.js';
-import { writeEntry, assertTenantId } from './store.js';
+import { writeEntry, assertTenantId, RECALL_DEFAULT_DENY_SCOPES } from './store.js';
 import { markGraphDirty, removeGraphEntitiesForObject } from './graph.js';
 import { createMemory, Layer, PROJECT_BRIEF_HALF_LIFE_DAYS } from './memory.js';
 import { appendAuditEvent } from './audit.js';
@@ -386,6 +386,7 @@ export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
     }
     const tag = `path:${normalizedRepo.toLowerCase()}`;
     const likeParam = `%"${escapeLike(tag)}"%`;
+    const denyPlaceholders = RECALL_DEFAULT_DENY_SCOPES.map(() => '?').join(', ');
     const db = openHippoDb(hippoRoot);
     let receipts;
     try {
@@ -396,9 +397,10 @@ export function assembleBriefFromReceipts(hippoRoot, tenantId, repo) {
       WHERE tenant_id = ?
         AND source != 'project_brief'
         AND LOWER(tags_json) LIKE ? ESCAPE '\\'
+        AND (scope IS NULL OR (scope NOT IN (${denyPlaceholders}) AND scope NOT LIKE '%:private:%'))
       ORDER BY created DESC, id DESC
       LIMIT ?
-    `).all(tenantId, likeParam, MAX_BRIEF_RECEIPTS);
+    `).all(tenantId, likeParam, ...RECALL_DEFAULT_DENY_SCOPES, MAX_BRIEF_RECEIPTS);
     }
     finally {
         closeHippoDb(db);

package/dist/quarantine.d.ts

@@ -0,0 +1,31 @@
+/** Quarantine tier (CD5, AT3): pending/approved/rejected record for a memory `remember` flagged as untrusted. */
+import type { DatabaseSyncLike } from './db.js';
+export declare const QUARANTINE_SCOPE_PREFIX = "quarantine:private:";
+/** Scope a quarantined memory is stored under; matches PRIVATE_SCOPE_RE so every default-deny site hides it. */
+export declare function quarantineScopeFor(original: string | null): string;
+export declare function isQuarantineScope(scope: string | null | undefined): boolean;
+export type QuarantineStatus = 'pending' | 'approved' | 'rejected';
+export interface QuarantineRow {
+    tenantId: string;
+    memoryId: string;
+    originalScope: string | null;
+    reason: string;
+    status: QuarantineStatus;
+    quarantinedAt: string;
+    decidedAt: string | null;
+    decidedBy: string | null;
+}
+export interface RecordQuarantineOpts {
+    tenantId: string;
+    memoryId: string;
+    originalScope: string | null;
+    reason: string;
+    actor: string;
+}
+/** Insert the quarantine row + its audit event; caller runs this inside the memory's own write transaction. */
+export declare function recordQuarantine(db: DatabaseSyncLike, opts: RecordQuarantineOpts): void;
+export declare function getQuarantineRow(db: DatabaseSyncLike, tenantId: string, memoryId: string): QuarantineRow | null;
+export declare function listQuarantineRows(db: DatabaseSyncLike, tenantId: string, status?: QuarantineStatus | 'all', limit?: number): QuarantineRow[];
+export declare function approveQuarantineRow(db: DatabaseSyncLike, tenantId: string, memoryId: string, decidedBy: string): void;
+export declare function rejectQuarantineRow(db: DatabaseSyncLike, tenantId: string, memoryId: string, decidedBy: string): void;
+//# sourceMappingURL=quarantine.d.ts.map

package/dist/quarantine.js

@@ -0,0 +1,63 @@
+/** Quarantine tier (CD5, AT3): pending/approved/rejected record for a memory `remember` flagged as untrusted. */
+import { appendAuditEvent } from './audit.js';
+export const QUARANTINE_SCOPE_PREFIX = 'quarantine:private:';
+/** Scope a quarantined memory is stored under; matches PRIVATE_SCOPE_RE so every default-deny site hides it. */
+export function quarantineScopeFor(original) {
+    return `${QUARANTINE_SCOPE_PREFIX}${original ?? 'unscoped'}`;
+}
+export function isQuarantineScope(scope) {
+    return scope != null && scope.startsWith(QUARANTINE_SCOPE_PREFIX);
+}
+const SELECT_COLUMNS = 'tenant_id, memory_id, original_scope, reason, status, quarantined_at, decided_at, decided_by';
+function fromDbRow(row) {
+    return {
+        tenantId: row.tenant_id,
+        memoryId: row.memory_id,
+        originalScope: row.original_scope,
+        reason: row.reason,
+        // SAFETY: this module's own INSERT/UPDATE statements are the only writers of status.
+        status: row.status,
+        quarantinedAt: row.quarantined_at,
+        decidedAt: row.decided_at,
+        decidedBy: row.decided_by,
+    };
+}
+/** Insert the quarantine row + its audit event; caller runs this inside the memory's own write transaction. */
+export function recordQuarantine(db, opts) {
+    db.prepare(`INSERT INTO memory_quarantine (tenant_id, memory_id, original_scope, reason, status, quarantined_at)
+     VALUES (?, ?, ?, ?, 'pending', ?)`).run(opts.tenantId, opts.memoryId, opts.originalScope, opts.reason, new Date().toISOString());
+    appendAuditEvent(db, {
+        tenantId: opts.tenantId,
+        actor: opts.actor,
+        op: 'quarantine',
+        targetId: opts.memoryId,
+        metadata: { reason: opts.reason, originalScope: opts.originalScope },
+    });
+}
+export function getQuarantineRow(db, tenantId, memoryId) {
+    const row = db.prepare(`SELECT ${SELECT_COLUMNS} FROM memory_quarantine WHERE tenant_id = ? AND memory_id = ?`)
+        .get(tenantId, memoryId);
+    return row ? fromDbRow(row) : null;
+}
+export function listQuarantineRows(db, tenantId, status = 'pending', limit = 100) {
+    // A pending row whose memory was deleted (e.g. Slack message_deleted) is dead; keep its history, drop it from the queue.
+    const live = status === 'pending'
+        ? ' AND EXISTS (SELECT 1 FROM memories m WHERE m.id = memory_quarantine.memory_id AND m.tenant_id = memory_quarantine.tenant_id)'
+        : '';
+    const rows = status === 'all'
+        ? db.prepare(`SELECT ${SELECT_COLUMNS} FROM memory_quarantine WHERE tenant_id = ? ORDER BY quarantined_at DESC LIMIT ?`)
+            .all(tenantId, limit)
+        : db.prepare(`SELECT ${SELECT_COLUMNS} FROM memory_quarantine WHERE tenant_id = ? AND status = ?${live} ORDER BY quarantined_at DESC LIMIT ?`)
+            .all(tenantId, status, limit);
+    // SAFETY: both branches select SELECT_COLUMNS, matching QuarantineDbRow's field set.
+    return rows.map(fromDbRow);
+}
+export function approveQuarantineRow(db, tenantId, memoryId, decidedBy) {
+    db.prepare(`UPDATE memory_quarantine SET status = 'approved', decided_at = ?, decided_by = ? WHERE tenant_id = ? AND memory_id = ?`)
+        .run(new Date().toISOString(), decidedBy, tenantId, memoryId);
+}
+export function rejectQuarantineRow(db, tenantId, memoryId, decidedBy) {
+    db.prepare(`UPDATE memory_quarantine SET status = 'rejected', decided_at = ?, decided_by = ? WHERE tenant_id = ? AND memory_id = ?`)
+        .run(new Date().toISOString(), decidedBy, tenantId, memoryId);
+}
+//# sourceMappingURL=quarantine.js.map

package/dist/recall-scope.d.ts

@@ -71,14 +71,26 @@ export declare class ScopeForbiddenError extends Error {
  * is the act that needs authorization.
  */
 export declare function isRestrictedScope(scope: string | null | undefined): boolean;
-/**
- * Authorize an explicitly requested scope before any read honours it.
- *
- * An admin (tenant owner, the local CLI, loopback without a key) may unlock
- * any scope in its tenant. A member key may not unlock a restricted scope by
- * naming it: before this check, any key in a tenant could read every private
- * channel or repo by passing its scope string. Per-scope grants for member
- * keys belong to ROADMAP Part VIII EI2 (permission-aware recall).
- */
-export declare function assertScopeRequestAllowed(role: 'admin' | 'member', requested: string | undefined): void;
+/** The identity a scope check runs against: a role plus any scope grants. */
+export interface ScopeActor {
+    role: 'admin' | 'member';
+    scopes?: readonly string[];
+}
+/** True when `actor` may read `scope`: admin always; member needs an exact grant on a restricted scope. */
+export declare function canReadScope(actor: ScopeActor, scope: string): boolean;
+/** Authorize an explicitly requested scope before any read honours it (ROADMAP Part VIII EI2: member scope grants). */
+export declare function assertScopeRequestAllowed(actor: ScopeActor, requested: string | undefined): void;
+/** Scope a derived row keeps from one source: the restricted scope itself, else null. */
+export declare function derivationScope(scope: string | null | undefined): string | null;
+/** The one derivation scope shared by every source, or `{ ok: false }` when
+ *  two disagree, so the caller skips the derived row instead of under-scoping it. */
+export declare function commonDerivationScope(scopes: readonly (string | null | undefined)[]): {
+    ok: true;
+    scope: string | null;
+} | {
+    ok: false;
+};
+/** Map-partition key for consolidate/dag producers: tenant + derivation scope,
+ *  so a derived row never blends two restricted scopes or a mixed pair. */
+export declare function derivationPartitionKey(tenantId: string, scope: string | null | undefined): string;
 //# sourceMappingURL=recall-scope.d.ts.map

package/dist/recall-scope.js

@@ -50,18 +50,7 @@ export function passesScopeFilterForRecall(scope, requested) {
     if (requested !== undefined && requested !== '') {
         return scope === requested;
     }
-    if (scope === null)
-        return true;
-    if (isPrivateScope(scope))
-        return false;
-    // SAFETY: RECALL_DEFAULT_DENY_SCOPES (v1.7.2, single source of truth
-    // shared with the SQL clause in loadSearchRows) is a readonly tuple of
-    // string literals. Cast the array to readonly string[] so .includes()
-    // accepts arbitrary string scopes without a cast on the input (codex
-    // P0-2: casting `scope` would defeat the constant's safety).
-    if (RECALL_DEFAULT_DENY_SCOPES.includes(scope))
-        return false;
-    return true;
+    return !isRestrictedScope(scope);
 }
 /**
  * v1.25.0 — the CLI `--scope` variant of the recall filter (JS half of the
@@ -108,23 +97,49 @@ export function isRestrictedScope(scope) {
         return false;
     // SAFETY: RECALL_DEFAULT_DENY_SCOPES is a readonly tuple of string
     // literals; widening the array (not the input) lets .includes() take any scope.
-    return isPrivateScope(scope) || RECALL_DEFAULT_DENY_SCOPES.includes(scope);
+    // `:private:` anywhere, any case, matches the store's SQL default-deny (store.ts:894) so JS never admits what SQL hides.
+    return isPrivateScope(scope) || /:private:/i.test(scope) || RECALL_DEFAULT_DENY_SCOPES.includes(scope);
 }
-/**
- * Authorize an explicitly requested scope before any read honours it.
- *
- * An admin (tenant owner, the local CLI, loopback without a key) may unlock
- * any scope in its tenant. A member key may not unlock a restricted scope by
- * naming it: before this check, any key in a tenant could read every private
- * channel or repo by passing its scope string. Per-scope grants for member
- * keys belong to ROADMAP Part VIII EI2 (permission-aware recall).
- */
-export function assertScopeRequestAllowed(role, requested) {
+/** True when `actor` may read `scope`: admin always; member needs an exact grant on a restricted scope. */
+export function canReadScope(actor, scope) {
+    if (actor.role === 'admin')
+        return true;
+    if (!isRestrictedScope(scope))
+        return true;
+    return (actor.scopes ?? []).includes(scope);
+}
+/** Authorize an explicitly requested scope before any read honours it (ROADMAP Part VIII EI2: member scope grants). */
+export function assertScopeRequestAllowed(actor, requested) {
     if (requested === undefined || requested === '')
         return;
-    if (role === 'admin')
+    if (canReadScope(actor, requested))
         return;
-    if (isRestrictedScope(requested))
-        throw new ScopeForbiddenError(requested);
+    throw new ScopeForbiddenError(requested);
+}
+/** Scope a derived row keeps from one source: the restricted scope itself, else null. */
+export function derivationScope(scope) {
+    return isRestrictedScope(scope) ? (scope ?? null) : null;
+}
+/** The one derivation scope shared by every source, or `{ ok: false }` when
+ *  two disagree, so the caller skips the derived row instead of under-scoping it. */
+export function commonDerivationScope(scopes) {
+    let common = null;
+    let seen = false;
+    for (const raw of scopes) {
+        const scope = derivationScope(raw);
+        if (!seen) {
+            common = scope;
+            seen = true;
+        }
+        else if (scope !== common) {
+            return { ok: false };
+        }
+    }
+    return { ok: true, scope: common };
+}
+/** Map-partition key for consolidate/dag producers: tenant + derivation scope,
+ *  so a derived row never blends two restricted scopes or a mixed pair. */
+export function derivationPartitionKey(tenantId, scope) {
+    return `${tenantId}\u0000${derivationScope(scope) ?? ''}`;
 }
 //# sourceMappingURL=recall-scope.js.map

package/dist/secret-detect.js

@@ -50,7 +50,7 @@ const KEYISH_CONTEXT_RE = /key|token|secret|credential|bearer|auth|password/i;
 const CO_OCCURRENCE_GUARDED = new Set(['sk-style-key', 'sk-underscore-key']);
 // redactSecretsStrict-only: too noisy for whole-entry memory scanning, worth hiding once text leaves the machine.
 const STRICT_ONLY_PATTERNS = [
-    /\b[Bb]earer\s+[A-Za-z0-9._~+/-]{16,}=*/g,
+    /\bbearer\s+[A-Za-z0-9._~+/-]{16,}=*/gi,
     /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g,
 ];
 /**