unique-user-memory 2026.38.0.dev0__tar.gz → 2026.38.0.dev2__tar.gz

unique_user_memory-2026.38.0.dev0/README.md → unique_user_memory-2026.38.0.dev2/PKG-INFO

@@ -1,3 +1,17 @@
+Metadata-Version: 2.3
+Name: unique-user-memory
+Version: 2026.38.0.dev2
+Summary: 
+Author: Fabian Schläpfer
+Author-email: Fabian Schläpfer <fabian@unique.ch>
+License: Proprietary
+Requires-Dist: jinja2>=3.1.6
+Requires-Dist: pydantic>=2.8.2
+Requires-Dist: unique-sdk>=2026.38.0.dev4,<2026.38.0rc0
+Requires-Dist: unique-toolkit>=2026.38.0.dev14,<2026.38.0rc0
+Requires-Python: >=3.12, <4
+Description-Content-Type: text/markdown
+
 # Unique User Memory
 
 Persistent per-user memory for Unique AI agents.
@@ -25,7 +39,38 @@ The memory file is intentionally small and structured. It is rewritten as a full
 5. `UserMemoryPostprocessor` runs after the assistant response.
 6. The package asks the configured language model to either return `NOOP` or a complete rewritten profile.
 7. If a rewrite runs, an **Updating your memory** Step is shown while consolidating (no settings entry yet).
-8. If the profile changed and `memory.md` uploads successfully (ingestion skipped, content hidden from chat), that Step is completed with a **Review your context memory** detail entry (same settings badge). On NOOP or failed upload the Step completes without the entry.
+8. Every rewrite passes through a mandatory CID/PII scrub call (see Content Policy below) before it is assembled for upload. When the scrub cannot vouch for the rewrite, the existing memory is kept unchanged.
+9. If the profile changed and `memory.md` uploads successfully (ingestion skipped, content hidden from chat), that Step is completed with a **Review your context memory** detail entry (same settings badge). On NOOP or failed upload the Step completes without the entry.
+
+## Content Policy — the current user's CID/PII only (UN-24886)
+
+The profile belongs to exactly one person: the signed-in user. It may contain
+personal data (PII) of that user only. It must never contain
+client-identifying data (CID) or PII of any other person or private entity —
+not other users, not clients, not prospects, not counterparties. Facts about
+the user's own work that involve a client are stored only in a fully
+de-identified form ("runs quarterly portfolio reviews", never "reviews the
+portfolio of J. Muster"). Credentials, payment data, health records, and
+government IDs are never stored for anyone, including the user.
+
+The policy text lives once, in `_CID_POLICY` in `user_memory_prompts.py`, and
+is embedded in every write-path stage so the rules cannot drift:
+
+| Stage | Role of the policy |
+| --- | --- |
+| Gate (`memory_gate_system_prompt`) | Turns whose only new facts are third-party CID/PII lean `NOOP` and never reach the rewrite. |
+| Consolidation (`consolidation_system_prompt`) | The rewrite itself must not extract forbidden content. |
+| Condensation (`condensation_system_prompt`) | Oversized (including legacy) profiles must drop violating bullets on every shrink, progressively cleaning old data. |
+| Scrub (`scrub_system_prompt` / `scrub_user_memory`) | Mandatory final gate on every consolidation rewrite. Answers `CLEAN`, returns a cleaned body, or vetoes the write. Fails closed: on any error the existing memory is kept and the unvalidated candidate is discarded. |
+
+Storage-level isolation (per-user home folder with exclusive owner ACL, see
+Storage Model) already prevents cross-user *access*; this policy governs
+cross-user and cross-client *content*.
+
+Note for follow-up client-memory work: this package is user memory only. A
+future client memory is a separate artefact with its own scoping and must not
+be built by loosening this policy — client-related durable knowledge is
+intentionally rejected here rather than stored under the user's profile.
 
 ## Storage Model
 

unique_user_memory-2026.38.0.dev0/PKG-INFO → unique_user_memory-2026.38.0.dev2/README.md

@@ -1,17 +1,3 @@
-Metadata-Version: 2.3
-Name: unique-user-memory
-Version: 2026.38.0.dev0
-Summary: 
-Author: Fabian Schläpfer
-Author-email: Fabian Schläpfer <fabian@unique.ch>
-License: Proprietary
-Requires-Dist: jinja2>=3.1.6
-Requires-Dist: pydantic>=2.8.2
-Requires-Dist: unique-sdk>=2026.38.0.dev0,<2026.38.0rc0
-Requires-Dist: unique-toolkit>=2026.38.0.dev0,<2026.38.0rc0
-Requires-Python: >=3.12, <4
-Description-Content-Type: text/markdown
-
 # Unique User Memory
 
 Persistent per-user memory for Unique AI agents.
@@ -39,7 +25,38 @@ The memory file is intentionally small and structured. It is rewritten as a full
 5. `UserMemoryPostprocessor` runs after the assistant response.
 6. The package asks the configured language model to either return `NOOP` or a complete rewritten profile.
 7. If a rewrite runs, an **Updating your memory** Step is shown while consolidating (no settings entry yet).
-8. If the profile changed and `memory.md` uploads successfully (ingestion skipped, content hidden from chat), that Step is completed with a **Review your context memory** detail entry (same settings badge). On NOOP or failed upload the Step completes without the entry.
+8. Every rewrite passes through a mandatory CID/PII scrub call (see Content Policy below) before it is assembled for upload. When the scrub cannot vouch for the rewrite, the existing memory is kept unchanged.
+9. If the profile changed and `memory.md` uploads successfully (ingestion skipped, content hidden from chat), that Step is completed with a **Review your context memory** detail entry (same settings badge). On NOOP or failed upload the Step completes without the entry.
+
+## Content Policy — the current user's CID/PII only (UN-24886)
+
+The profile belongs to exactly one person: the signed-in user. It may contain
+personal data (PII) of that user only. It must never contain
+client-identifying data (CID) or PII of any other person or private entity —
+not other users, not clients, not prospects, not counterparties. Facts about
+the user's own work that involve a client are stored only in a fully
+de-identified form ("runs quarterly portfolio reviews", never "reviews the
+portfolio of J. Muster"). Credentials, payment data, health records, and
+government IDs are never stored for anyone, including the user.
+
+The policy text lives once, in `_CID_POLICY` in `user_memory_prompts.py`, and
+is embedded in every write-path stage so the rules cannot drift:
+
+| Stage | Role of the policy |
+| --- | --- |
+| Gate (`memory_gate_system_prompt`) | Turns whose only new facts are third-party CID/PII lean `NOOP` and never reach the rewrite. |
+| Consolidation (`consolidation_system_prompt`) | The rewrite itself must not extract forbidden content. |
+| Condensation (`condensation_system_prompt`) | Oversized (including legacy) profiles must drop violating bullets on every shrink, progressively cleaning old data. |
+| Scrub (`scrub_system_prompt` / `scrub_user_memory`) | Mandatory final gate on every consolidation rewrite. Answers `CLEAN`, returns a cleaned body, or vetoes the write. Fails closed: on any error the existing memory is kept and the unvalidated candidate is discarded. |
+
+Storage-level isolation (per-user home folder with exclusive owner ACL, see
+Storage Model) already prevents cross-user *access*; this policy governs
+cross-user and cross-client *content*.
+
+Note for follow-up client-memory work: this package is user memory only. A
+future client memory is a separate artefact with its own scoping and must not
+be built by loosening this policy — client-related durable knowledge is
+intentionally rejected here rather than stored under the user's profile.
 
 ## Storage Model
 

{unique_user_memory-2026.38.0.dev0 → unique_user_memory-2026.38.0.dev2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "unique_user_memory"
-version = "2026.38.0.dev0"
+version = "2026.38.0.dev2"
 description = ""
 authors = [
     { name = "Fabian Schläpfer", email = "fabian@unique.ch" },
@@ -11,8 +11,8 @@ requires-python = ">=3.12,<4"
 dependencies = [
     "jinja2>=3.1.6",
     "pydantic>=2.8.2",
-    "unique-sdk>=2026.38.0.dev0,<2026.38.0rc0",
-    "unique-toolkit>=2026.38.0.dev0,<2026.38.0rc0",
+    "unique-sdk>=2026.38.0.dev4,<2026.38.0rc0",
+    "unique-toolkit>=2026.38.0.dev14,<2026.38.0rc0",
 ]
 
 [dependency-groups]

{unique_user_memory-2026.38.0.dev0 → unique_user_memory-2026.38.0.dev2}/unique_user_memory/tests/test_user_memory.py

@@ -36,6 +36,7 @@ from unique_user_memory.user_memory import (
     ensure_user_memory_folder,
     fit_user_memory,
     profile_body,
+    scrub_user_memory,
     should_consolidate_memory,
     upload_user_memory,
 )
@@ -46,6 +47,7 @@ from unique_user_memory.user_memory_prompts import (
     consolidation_system_prompt,
     empty_profile,
     memory_gate_system_prompt,
+    scrub_system_prompt,
 )
 
 _TEST_LANGUAGE_MODEL = LanguageModelInfo.from_name(DEFAULT_LANGUAGE_MODEL)
@@ -375,6 +377,7 @@ async def test_user_memory_llm_paths_forward_event_attribution(
         side_effect=[
             _completion_response("UPDATE"),
             _completion_response(rewritten),
+            _completion_response("CLEAN"),
             _completion_response(condensed),
         ]
     )
@@ -415,7 +418,7 @@ async def test_user_memory_llm_paths_forward_event_attribution(
     assert gate_result is True
     assert rewritten in rewrite_result
     assert condense_result == condensed
-    assert complete_async.await_count == 3
+    assert complete_async.await_count == 4
     assert all(
         call.kwargs["chat_id"] == "chat_1"
         and call.kwargs["assistant_id"] == "assistant_1"
@@ -564,7 +567,8 @@ async def test_consolidate_user_memory_runs_full_rewrite_when_gate_update(
     assert "user_id: user_1" in result
     assert "schema_version: 1" in result
     assert "turn_count: 1" in result
-    llm_service.complete_async.assert_awaited_once()
+    # One rewrite call plus the mandatory CID/PII scrub call (UN-24886).
+    assert llm_service.complete_async.await_count == 2
 
 
 @pytest.mark.asyncio
@@ -676,7 +680,8 @@ async def test_consolidate_user_memory_skips_gate_when_disabled(
     assert "user_id: user_1" in result
     assert "turn_count: 1" in result
     gate.assert_not_awaited()
-    llm_service.complete_async.assert_awaited_once()
+    # One rewrite call plus the mandatory CID/PII scrub call (UN-24886).
+    assert llm_service.complete_async.await_count == 2
 
 
 @pytest.mark.asyncio
@@ -799,6 +804,257 @@ async def test_should_consolidate_memory_falls_back_to_true_on_error(
     assert result is True
 
 
+@pytest.mark.ai
+def test_cid_policy_is_embedded_in_every_write_path_prompt() -> None:
+    """Purpose: Verify the shared CID/PII policy reaches all write-path prompts.
+    Why this matters: UN-24886 forbids other people's CID/PII in User Memory;
+    a prompt missing the policy silently reopens the leak.
+    Setup summary: Render all four system prompts and assert the policy marker.
+    """
+    policy_marker = "CID / PII policy - the current user only - STRICT"
+    prompts = (
+        consolidation_system_prompt(2000),
+        condensation_system_prompt(
+            max_tokens=2000,
+            current_tokens=2200,
+            target_tokens=1800,
+        ),
+        memory_gate_system_prompt(),
+        scrub_system_prompt(),
+    )
+
+    assert all(policy_marker in prompt for prompt in prompts)
+    assert all("Bank-client relationship signals" in prompt for prompt in prompts)
+    # The policy must not swallow the user's own facts: employer changes and
+    # other affiliations are identity data, not CID (regression guard for the
+    # gate answering NOOP on "I work at X now, not at Y anymore").
+    assert all(
+        "Facts about the user themselves are ALWAYS allowed" in prompt
+        for prompt in prompts
+    )
+    # Same for the user's own personal life facts (regression guard for the
+    # gate answering NOOP on the user stating their own family status).
+    assert all(
+        "The user's own life facts stated about themselves are also allowed" in prompt
+        for prompt in prompts
+    )
+
+
+@pytest.mark.ai
+@pytest.mark.asyncio
+async def test_scrub_user_memory_returns_body_unchanged_on_clean(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Purpose: Verify a compliant profile passes the scrub untouched.
+    Why this matters: The scrub must not mutate profiles that already comply.
+    Setup summary: Mock the LLM to answer CLEAN and compare input to output.
+    """
+    body = _complete_profile_body("- Prefers concise answers")
+    response = MagicMock()
+    response.choices[0].message.content = "CLEAN"
+    llm_service = MagicMock()
+    llm_service.complete_async = AsyncMock(return_value=response)
+    monkeypatch.setattr(
+        "unique_user_memory.user_memory.LanguageModelService",
+        MagicMock(return_value=llm_service),
+    )
+
+    result = await scrub_user_memory(
+        body=body,
+        config=UserMemoryConfig(),
+        language_model=_TEST_LANGUAGE_MODEL,
+        event=MagicMock(),
+        logger=MagicMock(),
+    )
+
+    assert result == body
+
+
+@pytest.mark.ai
+@pytest.mark.asyncio
+async def test_scrub_user_memory_returns_cleaned_profile(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Purpose: Verify the scrub replaces a violating body with the cleaned one.
+    Why this matters: Third-party CID caught only at this last gate must be
+    stripped before the profile is persisted.
+    Setup summary: Mock the LLM to return a de-identified rewrite and assert it wins.
+    """
+    body_with_cid = _complete_profile_body(
+        "- Reviews the portfolio of J. Muster (client, IBAN CH93 0076 2011 6238 5295 7)"
+    )
+    cleaned = _complete_profile_body("- Runs quarterly portfolio reviews")
+    response = MagicMock()
+    response.choices[0].message.content = cleaned
+    llm_service = MagicMock()
+    llm_service.complete_async = AsyncMock(return_value=response)
+    monkeypatch.setattr(
+        "unique_user_memory.user_memory.LanguageModelService",
+        MagicMock(return_value=llm_service),
+    )
+
+    result = await scrub_user_memory(
+        body=body_with_cid,
+        config=UserMemoryConfig(),
+        language_model=_TEST_LANGUAGE_MODEL,
+        event=MagicMock(),
+        logger=MagicMock(),
+    )
+
+    assert result == cleaned
+    assert "J. Muster" not in result
+
+
+@pytest.mark.ai
+@pytest.mark.asyncio
+async def test_scrub_user_memory_fails_closed_on_llm_error(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Purpose: Verify a failing scrub call vetoes the write instead of passing it.
+    Why this matters: An unvalidated candidate must never reach storage; the
+    gate falls back to UPDATE on error, so the scrub must fall back to reject.
+    Setup summary: Mock the LLM to raise and assert the scrub returns None.
+    """
+    llm_service = MagicMock()
+    llm_service.complete_async = AsyncMock(side_effect=RuntimeError("boom"))
+    monkeypatch.setattr(
+        "unique_user_memory.user_memory.LanguageModelService",
+        MagicMock(return_value=llm_service),
+    )
+
+    result = await scrub_user_memory(
+        body=_complete_profile_body(),
+        config=UserMemoryConfig(),
+        language_model=_TEST_LANGUAGE_MODEL,
+        event=MagicMock(),
+        logger=MagicMock(),
+    )
+
+    assert result is None
+
+
+@pytest.mark.ai
+@pytest.mark.asyncio
+async def test_scrub_user_memory_fails_closed_on_malformed_output(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Purpose: Verify non-profile scrub output rejects the candidate.
+    Why this matters: A scrub reply that is neither CLEAN nor a well-formed
+    profile gives no guarantee about the candidate, so it must not be stored.
+    Setup summary: Mock the LLM to return prose and assert the scrub returns None.
+    """
+    response = MagicMock()
+    response.choices[0].message.content = "I removed some sensitive data for you."
+    llm_service = MagicMock()
+    llm_service.complete_async = AsyncMock(return_value=response)
+    monkeypatch.setattr(
+        "unique_user_memory.user_memory.LanguageModelService",
+        MagicMock(return_value=llm_service),
+    )
+
+    result = await scrub_user_memory(
+        body=_complete_profile_body(),
+        config=UserMemoryConfig(),
+        language_model=_TEST_LANGUAGE_MODEL,
+        event=MagicMock(),
+        logger=MagicMock(),
+    )
+
+    assert result is None
+
+
+@pytest.mark.ai
+@pytest.mark.asyncio
+async def test_consolidate_user_memory_persists_scrubbed_body(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Purpose: Verify the consolidation write path stores the scrubbed rewrite.
+    Why this matters: The scrub is the enforcement layer for UN-24886; the
+    profile assembled for upload must be the cleaned body, not the raw rewrite.
+    Setup summary: Rewrite emits third-party CID, scrub emits a de-identified
+    version; assert the result contains only the latter.
+    """
+    rewritten_with_cid = _complete_profile_body(
+        "- Reviews the portfolio of J. Muster (client)"
+    )
+    cleaned = _complete_profile_body("- Runs quarterly portfolio reviews")
+    responses = iter([rewritten_with_cid, cleaned])
+
+    def _next_response(*args: object, **kwargs: object) -> MagicMock:
+        response = MagicMock()
+        response.choices[0].message.content = next(responses)
+        return response
+
+    llm_service = MagicMock()
+    llm_service.complete_async = AsyncMock(side_effect=_next_response)
+    monkeypatch.setattr(
+        "unique_user_memory.user_memory.LanguageModelService",
+        MagicMock(return_value=llm_service),
+    )
+    monkeypatch.setattr(
+        "unique_user_memory.user_memory.should_consolidate_memory",
+        AsyncMock(return_value=True),
+    )
+
+    result = await consolidate_user_memory(
+        current_memory=empty_profile("user_1"),
+        user_id="user_1",
+        user_message="I just reviewed the portfolio of J. Muster",
+        assistant_message="noted",
+        config=UserMemoryConfig(),
+        language_model=_TEST_LANGUAGE_MODEL,
+        event=MagicMock(),
+        logger=MagicMock(),
+    )
+
+    assert "Runs quarterly portfolio reviews" in result
+    assert "J. Muster" not in result
+    assert llm_service.complete_async.await_count == 2
+
+
+@pytest.mark.ai
+@pytest.mark.asyncio
+async def test_consolidate_user_memory_keeps_existing_when_scrub_fails(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Purpose: Verify a failed scrub keeps the existing memory (fail closed).
+    Why this matters: When the enforcement layer cannot vouch for a rewrite,
+    the unvalidated candidate must be discarded, not uploaded.
+    Setup summary: Let the rewrite succeed, force the scrub to return None,
+    and assert the pre-turn memory survives unchanged.
+    """
+    current = empty_profile("user_1")
+    response = MagicMock()
+    response.choices[0].message.content = _complete_profile_body()
+    llm_service = MagicMock()
+    llm_service.complete_async = AsyncMock(return_value=response)
+    monkeypatch.setattr(
+        "unique_user_memory.user_memory.LanguageModelService",
+        MagicMock(return_value=llm_service),
+    )
+    monkeypatch.setattr(
+        "unique_user_memory.user_memory.should_consolidate_memory",
+        AsyncMock(return_value=True),
+    )
+    monkeypatch.setattr(
+        "unique_user_memory.user_memory.scrub_user_memory",
+        AsyncMock(return_value=None),
+    )
+
+    result = await consolidate_user_memory(
+        current_memory=current,
+        user_id="user_1",
+        user_message="remember I like concise answers",
+        assistant_message="noted",
+        config=UserMemoryConfig(),
+        language_model=_TEST_LANGUAGE_MODEL,
+        event=MagicMock(),
+        logger=MagicMock(),
+    )
+
+    assert result == current
+
+
 @pytest.mark.asyncio
 async def test_consolidate_user_memory_invokes_update_callbacks_on_rewrite(
     monkeypatch: pytest.MonkeyPatch,

{unique_user_memory-2026.38.0.dev0 → unique_user_memory-2026.38.0.dev2}/unique_user_memory/user_memory.py

@@ -38,6 +38,8 @@ from unique_user_memory.user_memory_prompts import (
     empty_profile,
     memory_gate_system_prompt,
     memory_gate_user_prompt,
+    scrub_system_prompt,
+    scrub_user_prompt,
 )
 
 MEMORY_FILENAME = "memory.md"
@@ -846,6 +848,101 @@ async def consolidate_user_memory(
         await on_update_end()
 
 
+async def scrub_user_memory(
+    *,
+    body: str,
+    config: UserMemoryConfig,
+    language_model: LanguageModelInfo,
+    event: ChatEvent,
+    logger: Logger,
+    invocation_stats: list[LanguageModelInvocationStats] | None = None,
+) -> str | None:
+    """Enforce the CID/PII policy on a candidate profile body (UN-24886).
+
+    Runs after every consolidation rewrite and before the profile is
+    assembled for upload. Returns the body unchanged when the model
+    answers ``CLEAN``, the cleaned body when bullets were removed or
+    de-identified, and ``None`` when the scrub cannot vouch for the
+    candidate (LLM error, malformed output). The caller MUST treat
+    ``None`` as fail-closed and keep the existing memory.
+    """
+    try:
+        llm_service = LanguageModelService(event)
+    except Exception as exc:
+        logger.warning(
+            "[user-memory] cannot construct LanguageModelService for scrub: [%s] %s",
+            type(exc).__name__,
+            exc,
+        )
+        return None
+
+    messages = LanguageModelMessages(
+        [
+            LanguageModelSystemMessage(content=scrub_system_prompt()),
+            LanguageModelUserMessage(
+                content=scrub_user_prompt(_sanitize_for_xml_context(body))
+            ),
+        ]
+    )
+
+    try:
+        response = await llm_service.complete_async(
+            messages=messages,
+            model_name=language_model.name,
+            other_options={
+                "max_tokens": config.max_tokens + _LLM_OUTPUT_HEADROOM_TOKENS
+            },
+        )
+    except Exception as exc:
+        logger.warning(
+            "[user-memory] scrub LLM call failed (model=%s): [%s] %s",
+            language_model.name,
+            type(exc).__name__,
+            exc,
+        )
+        return None
+
+    if invocation_stats is not None and response.usage is not None:
+        invocation_stats.append(
+            LanguageModelInvocationStats.from_usage(
+                language_model.name,
+                response.usage,
+                source="user_memory_scrub",
+            )
+        )
+
+    try:
+        raw = response.choices[0].message.content or ""
+    except Exception as exc:
+        logger.warning(
+            "[user-memory] could not extract content from scrub response: [%s] %s",
+            type(exc).__name__,
+            exc,
+        )
+        return None
+
+    if not isinstance(raw, str):
+        logger.warning(
+            "[user-memory] scrub returned non-string content (%s)",
+            type(raw).__name__,
+        )
+        return None
+
+    if raw.strip().upper() == "CLEAN":
+        return body
+
+    cleaned = _without_legacy_profile_title(profile_body(_strip_code_fences(raw)))
+    if not _is_well_formed_profile(cleaned):
+        logger.warning(
+            "[user-memory] scrub output did not look like a profile (%d chars)",
+            len(cleaned),
+        )
+        return None
+
+    logger.info("[user-memory] scrub removed or de-identified profile content")
+    return cleaned
+
+
 async def _rewrite_user_memory(
     *,
     safe_current: str,
@@ -945,6 +1042,22 @@ async def _rewrite_user_memory(
         )
         return safe_current
 
+    scrubbed_body = await scrub_user_memory(
+        body=candidate_body,
+        config=config,
+        language_model=language_model,
+        event=event,
+        logger=logger,
+        invocation_stats=invocation_stats,
+    )
+    if scrubbed_body is None:
+        logger.warning(
+            "[user-memory] scrub could not validate the rewritten profile - "
+            "keeping existing memory"
+        )
+        return safe_current
+    candidate_body = scrubbed_body
+
     if safe_current and candidate_body == profile_body(safe_current):
         logger.debug("[user-memory] memory body unchanged - skipping update")
         return safe_current

{unique_user_memory-2026.38.0.dev0 → unique_user_memory-2026.38.0.dev2}/unique_user_memory/user_memory_prompts.py

@@ -37,6 +37,63 @@ def empty_profile(user_id: str) -> str:
     )
 
 
+# Shared across the consolidation, condensation, gate, and scrub prompts so
+# the CID/PII rules cannot drift between the write-path stages (UN-24886).
+_CID_POLICY = """\
+# CID / PII policy - the current user only - STRICT
+
+The profile belongs to exactly one person: the signed-in user. It may
+contain personal data (PII) of that user only. It must NEVER contain
+client-identifying data (CID) or PII of any other person or private
+entity - not other users, not clients, not prospects, not counterparties.
+
+NEVER store, about any person or private entity other than the user:
+
+- Direct identifiers: full or partial names with identifying context,
+  addresses, email addresses, phone numbers, dates of birth,
+  passport / national ID / tax ID numbers, employee IDs, client IDs,
+  customer numbers, CRM or ticket IDs.
+- Financial identifiers: account numbers, IBANs, card numbers,
+  portfolio / custody / mandate numbers, transaction or payment
+  references, loan, mortgage, or insurance policy numbers.
+- Bank-client relationship signals: any statement that a person or
+  private entity is a client, customer, prospect, account holder,
+  beneficial owner, borrower, investor, or KYC/onboarding subject.
+- Financial or personal context tied to an identifiable person or
+  private entity other than the user: holdings, balances, transactions,
+  source of wealth, income, creditworthiness, risk rating, KYC/AML
+  status, or that person's or entity's health, family, legal disputes,
+  or tax situation.
+- Indirect identification: combinations of attributes that could single
+  out a non-public person or private entity even without a name.
+
+These rules apply even when the identifying data is abbreviated,
+misspelled, obfuscated, or split across words.
+
+Facts about the user themselves are ALWAYS allowed, even when they name
+an organization: the user's own employer (current and past), team, role,
+job title, location, and the organizations, products, and tools they say
+they work at or with. "Works at COMPANY X", "moved from COMPANY X to
+COMPANY Y" are the user's own identity facts, not CID. The prohibitions
+above target OTHER people, and entities in a client, prospect, or
+counterparty relationship - never the user's own employment or
+affiliations.
+
+The user's own life facts stated about themselves are also allowed -
+family status, languages, hobbies, general location - as long as they
+do not name or otherwise identify another specific individual.
+
+When a durable fact about the user's own work involves a client or
+counterparty, keep only a fully de-identified version: "runs quarterly
+portfolio reviews" is fine; "reviews the portfolio of J. Muster" is not.
+
+Also NEVER store, for anyone including the user: credentials, API keys,
+passwords, OTPs, payment card data, health-record details, or government
+ID numbers. If any of these appear in a conversation, ignore the value
+entirely.\
+"""
+
+
 _CONSOLIDATION_SYSTEM_PROMPT_TEMPLATE = """\
 You are a memory-consolidation engine for the Unique AI platform.
 
@@ -160,15 +217,13 @@ ADD/UPDATE for facts that are:
 
 NEVER extract:
 
-- Sensitive credentials, API keys, passwords, OTPs, payment info,
-  health-record details, government IDs. If the user pastes any of
-  these, ignore the value entirely.
-- Information about other named individuals beyond the immediate
-  professional context.
+- Anything forbidden by the CID / PII policy below.
 - Transient turn-level state: one-off factual answers, code snippets,
   error messages, file contents, search results.
 - Anything stated as third-party information or retrieved context.
 
+{{ cid_policy }}
+
 # Word budget - STRICT
 
 The complete body MUST be <= {{ max_words }} words (corresponding to {{ max_tokens }} tokens).
@@ -202,6 +257,7 @@ def consolidation_system_prompt(max_tokens: int) -> str:
         max_tokens=max_tokens,
         section_list=section_list,
         now_datetime=now.strftime("%Y-%m-%d %H:%M UTC"),
+        cid_policy=_CID_POLICY,
     )
 
 
@@ -243,6 +299,12 @@ fact about the user. This is lossy compression, not deletion of meaning.
 # Hard rules
 
 - NEVER invent, embellish, or add facts that are not already present.
+- DELETE any bullet that violates the CID / PII policy below - CID or
+  PII of any person or private entity other than the user. This deletion
+  is mandatory even when the bullet is otherwise high-signal and does
+  not count against the shrink priorities above. When such a bullet also
+  carries a durable fact about the user's own work, keep only a fully
+  de-identified rewrite.
 - Keep exactly these section headings, in this order, even if a section
   becomes empty (use the literal string `_(empty)_`):
 
@@ -252,6 +314,8 @@ fact about the user. This is lossy compression, not deletion of meaning.
   keep two conflicting bullets.
 - Use `-` markdown bullets, no nesting beyond two levels, no emojis.
 
+{{ cid_policy }}
+
 # Output
 
 Return the complete rewritten profile body, starting with
@@ -276,6 +340,7 @@ def condensation_system_prompt(
         target_words=int(target_tokens * 0.75),
         reduction_pct=max(reduction_pct, 1),
         max_tokens=max_tokens,
+        cid_policy=_CID_POLICY,
     )
 
 
@@ -358,17 +423,18 @@ only the single word `UPDATE` or `NOOP`.
 
 # What NEVER justifies UPDATE (lean NOOP)
 
-- Credentials, API keys, passwords, payment or health details, IDs.
-- Facts about other people beyond the immediate professional context.
+- Anything forbidden by the CID / PII policy below.
 - Transient turn state: one-off answers, code snippets, error messages,
   file contents, search results.
 - Anything stated as third-party or retrieved context.
 - Facts already captured in `<existing_memory>`.
+
+{{ cid_policy }}
 """
 
 
 def memory_gate_system_prompt() -> str:
-    return Template(_GATE_SYSTEM_PROMPT_TEMPLATE).render()
+    return Template(_GATE_SYSTEM_PROMPT_TEMPLATE).render(cid_policy=_CID_POLICY)
 
 
 _GATE_USER_PROMPT_TEMPLATE = """\
@@ -400,3 +466,60 @@ def memory_gate_user_prompt(
         user_message=(user_message or "").strip(),
         assistant_message=(assistant_message or "").strip(),
     )
+
+
+_SCRUB_SYSTEM_PROMPT_TEMPLATE = """\
+You are the final content gate for the user-memory system on the Unique
+AI platform. You receive a candidate Markdown memory profile just before
+it is persisted. Your ONLY job is to enforce the CID / PII policy below;
+you never improve, extend, or restyle the profile.
+
+{{ cid_policy }}
+
+# Your task
+
+Inspect every bullet of the candidate profile:
+
+- Remove each bullet that violates the policy. When a violating bullet
+  also carries a durable fact about the user's own work, replace it with
+  a fully de-identified rewrite instead of deleting it.
+- Leave every compliant bullet unchanged, word for word. Never add
+  facts, never merge or reorder bullets, never rename or reorder
+  sections.
+- A section left without bullets keeps its heading with the literal
+  placeholder `_(empty)_`.
+
+# Output
+
+- When every bullet complies, reply with EXACTLY the single uppercase
+  word `CLEAN` and nothing else.
+- Otherwise return the complete cleaned profile body, starting with
+  `## Identity` and containing exactly these section headings in this
+  order:
+
+{{ section_list }}
+
+Do NOT add a document-level `# User Memory` title. Do NOT emit a diff or
+commentary. Do NOT wrap the output in ``` fences.
+"""
+
+
+def scrub_system_prompt() -> str:
+    section_list = "\n".join(f"- ## {heading}" for heading in SECTION_HEADINGS)
+    return Template(_SCRUB_SYSTEM_PROMPT_TEMPLATE).render(
+        cid_policy=_CID_POLICY,
+        section_list=section_list,
+    )
+
+
+_SCRUB_USER_PROMPT_TEMPLATE = """\
+<candidate_profile>
+{{ profile }}
+</candidate_profile>
+
+Reply with CLEAN or the complete cleaned profile body now.
+"""
+
+
+def scrub_user_prompt(profile: str) -> str:
+    return Template(_SCRUB_USER_PROMPT_TEMPLATE).render(profile=profile)