fix(extended-memory): align SourceInferred trust boundary and wrap ReturnAfterBreak

- Remove SourceInferred from TrustBoost (treated as tainted/quarantined
  until promotion), matching IsTaintedSourceClass.
- Wrap the return-after-break summary with wrapUntrusted before injecting
  it as a system message in odek continue; attach the audit recorder early
  so the ingestion is recorded.
- Update docs to mark inferred as tainted/quarantined and document the
  first-pronoun, score-gated anaphora behavior.

Author: jkyberneees

cmd/odek/main.go

@@ -2121,10 +2121,26 @@ func continueCmd(args []string) error {
 	// The system message is already in the session
 	messages := sess.GetMessages()
 
+	// Create the run context early so that the return-after-break summary can
+	// be recorded in the audit log before the turn starts.
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer cancel()
+
+	// Audit: record every untrusted-content ingestion that fires during
+	// this turn. The recorder is scoped to the run context so a later turn
+	// (or background goroutine) cannot accidentally write to the wrong
+	// session's audit log.
+	auditStore := session.NewAuditStore(store.Dir())
+	currentTurn := sess.Turns + 1
+	sessIDCapture := sess.ID
+	ctx = loop.WithIngestRecorder(ctx, func(source, content string) {
+		_ = auditStore.RecordIngest(sessIDCapture, currentTurn, source, content)
+	})
+
 	// Return-after-break: on session resume, load a concise summary of where
 	// the user left off and the next likely step.
 	if mm := agent.Memory(); mm != nil {
-		rbCtx, rbCancel := context.WithTimeout(context.Background(), 5*time.Second)
+		rbCtx, rbCancel := context.WithTimeout(ctx, 5*time.Second)
 		if rb := mm.FormatReturnAfterBreak(rbCtx); rb != "" {
 			insertIdx := -1
 			for i := len(messages) - 1; i >= 0; i-- {
@@ -2133,7 +2149,8 @@ func continueCmd(args []string) error {
 					break
 				}
 			}
-			rbMsg := llm.Message{Role: "system", Content: rb}
+			wrapped := wrapUntrusted(rbCtx, "return_after_break", rb)
+			rbMsg := llm.Message{Role: "system", Content: wrapped}
 			if insertIdx >= 0 {
 				messages = append(messages[:insertIdx+1], append([]llm.Message{rbMsg}, messages[insertIdx+1:]...)...)
 			} else {
@@ -2150,20 +2167,6 @@ func continueCmd(args []string) error {
 		mm.AppendBuffer("user", task)
 	}
 
-	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
-	defer cancel()
-
-	// Audit: record every untrusted-content ingestion that fires during
-	// this turn. The recorder is scoped to the run context so a later turn
-	// (or background goroutine) cannot accidentally write to the wrong
-	// session's audit log.
-	auditStore := session.NewAuditStore(store.Dir())
-	currentTurn := sess.Turns + 1
-	sessIDCapture := sess.ID
-	ctx = loop.WithIngestRecorder(ctx, func(source, content string) {
-		_ = auditStore.RecordIngest(sessIDCapture, currentTurn, source, content)
-	})
-
 	rend.Start(task)
 	result, allMessages, err := agent.RunWithMessages(ctx, messages)
 	if err != nil {

docs/EXTENDED_MEMORY.md

@@ -29,15 +29,15 @@ The single most important design decision is the trust boundary.
 |---|---|---|
 | `user_said` | Trusted | Yes |
 | `user_approved` | Trusted | Yes |
-| `inferred` | Trusted, but flagged `inferred` | Yes, with lower trust boost |
+| `inferred` | Tainted / quarantined | No |
 | `tool_output` | Tainted | No |
 | `file_read` | Tainted | No |
 | `web` | Tainted | No |
 | `mcp` | Tainted | No |
 | `subagent` | Tainted | No |
 | `agent_generated` | Tainted | No |
 
-User inputs are trusted because they come from the operator. Indirect content may be prompt-injected, malicious, or simply noisy, so it is never auto-recalled. Planned promotion paths include inline commands such as:
+User inputs and explicitly user-approved atoms are trusted because they come from the operator. Indirect content may be prompt-injected, malicious, or simply noisy, so it is never auto-recalled. `inferred` atoms are treated as tainted: they are quarantined until a user explicitly promotes them, matching the code's `IsTaintedSourceClass` classification. Planned promotion paths include inline commands such as:
 
 - `odek, remember that`
 - `odek, remember the browser output`
@@ -183,8 +183,7 @@ retention_score = confidence
 
 decay_factor = 0.5 ^ (age_days / decay_half_life_days)
 trust_boost  = 1.0 for user_said and user_approved
-             = 0.8 for inferred
-             = 0.0 for tainted
+             = 0.0 for inferred and all tainted source classes
 
 composite_score = 0.6 * cosine_similarity(query_vector, atom_vector)
                   + 0.4 * retention_score
@@ -291,8 +290,7 @@ pin_boost = infinity for pinned atoms, 1.0 otherwise
 decay_factor = 0.5 ^ (age_days / decay_half_life_days)
 
 trust_boost  = 1.0 for user_said and user_approved
-             = 0.8 for inferred
-             = 0.0 for tainted
+             = 0.0 for inferred and all tainted source classes
 ```
 
 Eviction order:
@@ -422,7 +420,7 @@ The `promote` and `pin` actions for quarantined atoms are reserved for phase P4
 Once Extended Memory is enabled, the following proactive behaviors are planned:
 
 - **Return after break**: on session resume, summarize where the user left off and what the next likely step is.
-- **Anaphora resolution**: pronouns like "that" or "it" are resolved against recent atoms, not just the last buffer line.
+- **Anaphora resolution**: the first pronoun in a user message (e.g. "that" or "it") is resolved against recent trusted atoms only when the top atom's semantic similarity is above `semantic_search_min_score`; otherwise the message is passed through unchanged. Only the first pronoun occurrence is replaced.
 - **Follow-up anticipation**: the agent pre-loads related conventions, test patterns, and file references based on predicted intent.
 - **Style mirroring**: tone, verbosity, and explanation depth adapt automatically to the user model.
 

internal/memory/extended/atom.go

@@ -64,13 +64,12 @@ const (
 
 // TrustBoost returns a multiplicative boost for high-trust source classes.
 // External / generated sources receive a zero boost so they cannot be
-// recalled without promotion.
+// recalled without promotion. Inferred atoms are also untrusted because
+// they are not directly user-sourced and are quarantined until promotion.
 func TrustBoost(sourceClass string) float32 {
 	switch sourceClass {
 	case SourceUserSaid, SourceUserApproved:
 		return 1.0
-	case SourceInferred:
-		return 0.8
 	default:
 		return 0.0
 	}