Bound native memory worst-case hardening costs

[NGO-A]

Summary

This PR applies the uploaded 2026-07-02 boundary/performance hardening audit patch for @ngo-a/native-memory-citations.

It fixes three availability/algorithmic-complexity defects without changing the public API, config schema, or manifest intent:

• Finding B: rewrites orphan private-key END-marker redaction from backward-scan-per-marker O(n^2) to an equivalent O(n) forward scan.
• Finding C: bounds pathological query cost with MAX_QUERY_CHARS = 4096 and MAX_QUERY_TERMS = 64.
• Finding D: bounds graph extraction per-line cost with MAX_GRAPH_LINE_CHARS = 4096.

The new src/hardening.test.ts keeps the frozen reference oracle for the redaction rewrite and adds guards for query and graph caps. Do not delete that oracle; it is the behavior-preservation proof for the O(n) rewrite.

Validation

Run locally on Ninja:

• npm run build passed
• npm test passed: 105/105 tests across 5 files
• npm run plugin:build:check passed
• npm run plugin:validate passed
• git diff --check passed

Notes from plugin commands: OpenClaw doctor still reports existing plugin-install-index and duplicate explicit-plugin config warnings for this workspace; those were present before this PR and did not block build/validation.

Release Boundary

No irreversible release action was performed:

• no GHSA draft/publication
• no tag push
• no npm/OIDC publish
• no ClawHub release workflow
• no deprecation
• no Notion edit

Recommended disposition from the audit: treat this as a dedicated low-severity availability hardening release, owner-gated by Mo.

Docs Handoffs

Local handoff artifacts were also prepared outside this repo:

• /home/ad/.openclaw/workspace/artifacts/handoffs/HANDOFF-native-memory-citations-project-page.md
• /home/ad/.openclaw/workspace/artifacts/handoffs/HANDOFF-sovereign-memory-availability-threat-model.md

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 05cfa95e19

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve tail terms when capping long queries

For queries longer than 4096 characters where the discriminating term appears after the prefix (for example, a pasted log/stack trace followed by the actual memory term to search), this slices the term off before tokenization. searchMemory and answerFromMemory then build no matcher for that term and return no hit even when memory contains it; the new regression test only covers the marker-before-junk ordering. Keep the DoS bound, but sample/select capped terms from the whole query or at least include the tail as well as the head.

Useful? React with 👍 / 👎.

[NGO-A]

REPORT — Full merge sequence (all phases), @ngo-a/native-memory-citations

Date: 2026-08-02
Authorization: artifacts/handoffs/authorization-2026-08-01-nmc-merge-sequence-all-phases.md
Status: Completed through Phase 4; hard stop active. This was not a release.

Merge record

All three PRs are merged with true merge commits:

PR	Merge commit	First parent	Second parent / merged head
#2	de224446b392a426a3e88802ab238d2c12692d0d	becb6fa1e0ca6d0a8238c566de1383aac6afc74b	4855a15b201e2172b6c4534ea3b72c8f04c68a97
#3	a206aaa7ea069110a29fb0e441f5626e7c1c9ebc	de224446b392a426a3e88802ab238d2c12692d0d	ae61e7eca717bc50b9f6da1ac644ee09adaa72d3
#4	a9a99438c310f3d1b880e5318cabdb24e9b4fcff	a206aaa7ea069110a29fb0e441f5626e7c1c9ebc	fccea364625f9b20d6b2da475b4521961f1b3fb5

PR #3 recomputed to exactly the 12 authorized round-2 commits before fixes. PR #4 recomputed to exactly the three authorized round-3 commits (c2dd1eb, 13462e2, e4423da) before its test-only successor. Both merge trees were conflict-free; no rebase, force-push, squash, or history rewrite occurred.

Matrix evidence

Each run used the 12 named tuples: Ubuntu/macOS/Windows × Node 22.19.0/24.x × OpenClaw 2026.6.8/2026.6.9.

PR #3 first runs and finals

• Run 30746220794, head 310af48: Ubuntu 4/4 success; macOS 0/4; Windows 0/4. macOS/Windows were non-blocking on this first run. All eight failures were the same false workspace-escape finding caused by canonical path spelling for missing default roots.
• Run 30746321594, head 112f5be: Ubuntu 4/4 and macOS 4/4 success; Windows 3/4 success. Windows Node 22.19.0 + OpenClaw 2026.6.9 failed with EPERM during concurrent graph-sidecar replacement.
• Run 30746434982, head 413d9ea: all 12/12 success, including Windows 4/4.
• Blocking final run 30746542275, head ae61e7e: all 12/12 success after removing non-blocking semantics.
• Post-merge master run 30746645489, merge a206aaa: all 12/12 success.

PR #4 and final master

• PR run 30746766559, head fccea36: all 12/12 success, including the round-3 guard and per-agent override test on macOS/Windows.
• Post-merge master run 30746863178, merge a9a9943: all 12/12 success.

GitHub Actions may display the first two PR #3 workflow conclusions as success because macOS/Windows were still continue-on-error; the per-job outcomes above preserve the actual lane results verbatim.

Fix and closure commits

Commit	Purpose	Evidence
310af48e9a40547185c2b88f78048d20c01e0d79	Moved pull_request from invalid permissions placement into the workflow trigger so the hosted matrix could run.	All subsequent PR matrices instantiated 12 tuples.
112f5be71e42ce6efc6d430f7b0df2fa0970a7c3	Canonicalized missing default roots relative to the real workspace path across macOS/Windows.	macOS 4/4 green on the next run; named symlink/canonicalization test added.
413d9ea7d03223989df99139b353904453158439	Serialized concurrent atomic writes per sidecar path, preserving Windows backup/restore behavior.	Windows 4/4 green on the next and every final run; concurrent-replacement test added.
ae61e7eca717bc50b9f6da1ac644ee09adaa72d3	Removed the macOS/Windows non-blocking guard.	Blocking final PR #3 matrix 12/12 green.
fccea364625f9b20d6b2da475b4521961f1b3fb5	Test-only closure of the delegated per-agent override review item.	Test name: warns and reports health when a per-agent override re-enables host injection; asserts both warning and health finding; full matrix 12/12 green.

Branch protection

master branch protection is active. strict is false so the audited stacked heads did not require an extra base-merge commit. All 12 exact matrix contexts are required:

• build-validate-test (ubuntu-latest, 22.19.0, 2026.6.8)
• build-validate-test (ubuntu-latest, 22.19.0, 2026.6.9)
• build-validate-test (ubuntu-latest, 24.x, 2026.6.8)
• build-validate-test (ubuntu-latest, 24.x, 2026.6.9)
• build-validate-test (macos-latest, 22.19.0, 2026.6.8)
• build-validate-test (macos-latest, 22.19.0, 2026.6.9)
• build-validate-test (macos-latest, 24.x, 2026.6.8)
• build-validate-test (macos-latest, 24.x, 2026.6.9)
• build-validate-test (windows-latest, 22.19.0, 2026.6.8)
• build-validate-test (windows-latest, 22.19.0, 2026.6.9)
• build-validate-test (windows-latest, 24.x, 2026.6.8)
• build-validate-test (windows-latest, 24.x, 2026.6.9)

Release-boundary verification

• Remote tag baseline and final state both end at existing v2026.6.18; no tag was created or pushed by this sequence. Final complete tag-list SHA-256: f07586ea731925638022956eff34afc667620fa90396e5a34f7480e1969aa684.
• npm still serves @ngo-a/native-memory-citations@2026.6.18, the same version recorded before Phase 1; nothing was published.
• CHANGELOG.md on final master keeps all merged work under ## [Unreleased]; no new version was stamped.
• No ClawHub action, npm publish, deprecation, GHSA action, upstream filing, Notion edit, reporter attribution, or runtime dependency change was performed.

Hard stop / owner-only remainder

The merge sequence is complete and stopped. Remaining owner-only work is unchanged: any later release decision and release steps; the five staged 2026.6.17 steps in their standing order; filing both upstream issues; and the Notion threat-model mapping.