feat(memory-ingest): honor the per-remote deny/read-only trust policy (#2392)

Transcript ingest now respects the same trust store as code import — the gate existed only in gstack-gbrain-sync's runCodeImport, so memory-ingest happily ingested transcripts from deny-listed repos. preparePages filters prepared transcript pages through ONE batch policy lookup (new 'get --batch' verb on bin/gstack-gbrain-repo-policy — the script owns URL normalization; the client adds repoPolicyTierBatch, one spawn for all distinct remotes, so large corpora never pay a 10s-timeout subprocess per remote). Outcomes match code-import semantics: read-only → clean skip (skipped_policy_readonly), deny → counted refusal (skipped_policy_deny), corrupted/unreadable store → HARD ERROR before any write (state, staging, egress receipt, and import all untouched) with the recovery command named — policy corruption must never read as successful ingestion. Artifacts are never policy-filtered (their git_remote is a project slug, not a remote). Fixes #2392. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-09-09 14:38:59 +02:00 · 2026-08-17 10:39:24 -07:00
parent 40e4a53f74
commit 2494276742
6 changed files with 632 additions and 2 deletions
@@ -7,6 +7,13 @@
 #     if no URL is passed. Exits 0 with one of: read-write, read-only,
 #     deny, unset.
 #
+#   gstack-gbrain-repo-policy get --batch
+#     Read remote URLs from stdin (one per line); print one tier per line
+#     in input order: read-write, read-only, deny, or none (no entry / no
+#     store). A corrupt store is a hard error (exit 2), NEVER quarantined:
+#     batch callers are unattended ingest gates that must fail closed
+#     rather than bypass a set policy.
+#
 #   gstack-gbrain-repo-policy set <remote-url> <read-write|read-only|deny>
 #     Persist a tier for the given remote. Exits 0 on success.
 #
@@ -161,8 +168,50 @@ ensure_file() {
  fi
 }

+# get --batch — bulk lookup for ingest gates. One URL per stdin line, one
+# tier per stdout line, input order preserved. Reuses normalize() (the same
+# code path single `get` uses) per line. Prints `none` where single `get`
+# prints `unset` — batch consumers (lib/gbrain-repo-policy-client.ts) speak
+# the RepoPolicyTierValue vocabulary directly.
+#
+# Corruption polarity differs from single `get` ON PURPOSE: interactive
+# `get` quarantines a corrupt store and starts fresh because /setup-gbrain
+# re-asks the user; a batch caller is an unattended ingest gate with nobody
+# to re-ask, so silently quarantining would BYPASS a set deny policy. Batch
+# fails hard (exit 2) instead and names the recovery path.
+cmd_get_batch() {
+  require_jq
+  if [ ! -f "$POLICY_FILE" ]; then
+    # No store = no policy was ever set. Every URL is `none`; don't create
+    # the file just for a read (matches cmd_list).
+    while IFS= read -r url || [ -n "$url" ]; do
+      printf 'none\n'
+    done
+    return 0
+  fi
+  if ! jq empty "$POLICY_FILE" 2>/dev/null; then
+    die "policy store $POLICY_FILE is corrupt (invalid JSON) — refusing batch read. Inspect with: gstack-gbrain-repo-policy list; re-run /setup-gbrain to rebuild the store."
+  fi
+  # Valid JSON from here, so ensure_file only performs the legacy
+  # allow → read-write migration (never the quarantine branch).
+  ensure_file
+  local url key
+  while IFS= read -r url || [ -n "$url" ]; do
+    key=$(normalize "$url")
+    if [ -z "$key" ]; then
+      printf 'none\n'
+      continue
+    fi
+    jq -r --arg key "$key" '.[$key] // "none"' "$POLICY_FILE"
+  done
+}
+
 cmd_get() {
  local url="${1:-}"
+  if [ "$url" = "--batch" ]; then
+    cmd_get_batch
+    return 0
+  fi
  if [ -z "$url" ]; then
    url=$(git remote get-url origin 2>/dev/null || true)
    if [ -z "$url" ]; then
@@ -221,7 +270,7 @@ case "${1:-}" in
  set) shift; cmd_set "$@" ;;
  list) shift; cmd_list "$@" ;;
  normalize) shift; cmd_normalize "$@" ;;
-  --help|-h|help) sed -n '2,47p' "$0" | sed 's/^# \{0,1\}//' ;;
+  --help|-h|help) sed -n '2,54p' "$0" | sed 's/^# \{0,1\}//' ;;
  "") die "usage: gstack-gbrain-repo-policy {get|set|list|normalize|--help}" ;;
  *) die "unknown subcommand: $1" ;;
 esac
@@ -68,6 +68,7 @@ import {
 import { execGbrainText, spawnGbrainAsync } from "../lib/gbrain-exec";
 import { writeReceipt } from "../lib/egress-receipt";
 import { checkOwnedStagingDir, STAGING_MARKER } from "../lib/staging-guard";
+import { hasRepoPolicyStore, repoPolicyTierBatch } from "../lib/gbrain-repo-policy-client";

 // ── Types ──────────────────────────────────────────────────────────────────

@@ -150,6 +151,14 @@ interface BulkResult {
  skipped_secret: number;
  skipped_dedup: number;
  skipped_unattributed: number;
+  /**
+   * #2392: transcripts skipped because their git remote's trust tier in
+   * ~/.gstack/gbrain-repo-policy.json is `read-only` (search allowed, page
+   * writes never — and transcript ingest writes pages).
+   */
+  skipped_policy_readonly: number;
+  /** #2392: transcripts skipped because their remote's trust tier is `deny`. */
+  skipped_policy_deny: number;
  failed: number;
  duration_ms: number;
  partial_pages: number;
@@ -914,6 +923,14 @@ interface PreparedPage {
  /** Carry-through fields for state recording on success. */
  page_slug: string;
  partial: boolean;
+  /** Memory type — the per-remote policy filter (#2392) applies to transcripts only. */
+  type: MemoryType;
+  /**
+   * Canonical git remote ("host/org/repo") for transcript pages; undefined
+   * for artifacts (whose PageRecord.git_remote is a project slug, not a
+   * remote — artifacts are never policy-filtered).
+   */
+  git_remote?: string;
 }

 interface StagingResult {
@@ -1210,8 +1227,16 @@ function preparePages(
  skippedSecret: number;
  skippedDedup: number;
  skippedUnattributed: number;
+  skippedPolicyReadonly: number;
+  skippedPolicyDeny: number;
  parseFailed: number;
  partialPages: number;
+  /**
+   * #2392: set when the per-remote policy store EXISTS but could not be
+   * read (corrupt file, spawn failure). The caller must abort before any
+   * writes — proceeding would bypass a possibly-set deny policy.
+   */
+  policyError?: string;
 } {
  const prepared: PreparedPage[] = [];
  let skippedSecret = 0;
@@ -1280,16 +1305,78 @@ function preparePages(
      rendered_body: renderPageBody(page),
      page_slug: page.slug,
      partial: page.partial ?? false,
+      type,
+      // Only transcripts carry a real remote; buildArtifactPage's git_remote
+      // is a project slug, and artifacts are never policy-filtered (#2392).
+      git_remote: type === "transcript" ? page.git_remote : undefined,
    });
  }

+  // #2392: per-remote trust policy for transcript pages — the same store the
+  // code-import gate honors (bin/gstack-gbrain-sync.ts). One batch spawn for
+  // all distinct remotes in the run; no store on disk → zero policy work.
+  // Runs AFTER the loop because preparePages accumulates fully in memory (no
+  // writes happen until the caller stages), so filtering here is still
+  // strictly before any write.
+  let finalPrepared = prepared;
+  let skippedPolicyReadonly = 0;
+  let skippedPolicyDeny = 0;
+  let policyError: string | undefined;
+  if (hasRepoPolicyStore()) {
+    const remotes = [
+      ...new Set(
+        prepared
+          .filter((p) => p.type === "transcript" && p.git_remote)
+          .map((p) => p.git_remote as string),
+      ),
+    ];
+    if (remotes.length > 0) {
+      const verdicts = repoPolicyTierBatch(remotes);
+      // The store EXISTS (checked above), so an unreadable/spawn-failed
+      // result is a HARD ERROR — match the fail-closed polarity of
+      // gstack-gbrain-sync's code-import gate: never bypass a set policy.
+      const broken = remotes.find((r) => {
+        const v = verdicts.get(r);
+        return !v || v.error !== undefined;
+      });
+      if (broken) {
+        const kind = verdicts.get(broken)?.error === "spawn-failed"
+          ? "the policy helper could not be spawned (bash missing from PATH?)"
+          : "the policy store could not be read (corrupt file?)";
+        policyError =
+          `repo policy store exists but ${kind} — refusing transcript ingest rather than ` +
+          `bypassing a possibly-set deny policy. Inspect with: gstack-gbrain-repo-policy list; ` +
+          `re-run /setup-gbrain if the store is corrupt.`;
+      } else {
+        finalPrepared = prepared.filter((p) => {
+          if (p.type !== "transcript" || !p.git_remote) return true;
+          const tier = verdicts.get(p.git_remote)?.tier ?? "none";
+          if (tier === "read-only") {
+            // Honoring an explicit user setting (search allowed, page writes
+            // never) — transcript ingest writes pages, so skip.
+            skippedPolicyReadonly++;
+            return false;
+          }
+          if (tier === "deny") {
+            skippedPolicyDeny++;
+            return false;
+          }
+          return true; // read-write, or none (no policy set for this remote)
+        });
+      }
+    }
+  }
+
  return {
-    prepared,
+    prepared: finalPrepared,
    skippedSecret,
    skippedDedup,
    skippedUnattributed,
+    skippedPolicyReadonly,
+    skippedPolicyDeny,
    parseFailed,
    partialPages,
+    policyError,
  };
 }

@@ -1636,6 +1723,25 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
  let written = 0;
  let failed = 0;

+  // #2392 HARD ERROR: the policy store exists but could not be consulted.
+  // Abort before ANY write — state recording, staging, gbrain import — so a
+  // corrupt store can never silently bypass a set deny/read-only policy.
+  if (prep.policyError) {
+    console.error(`[memory-ingest] ERR: ${prep.policyError}`);
+    return {
+      written: 0,
+      skipped_secret: prep.skippedSecret,
+      skipped_dedup: prep.skippedDedup,
+      skipped_unattributed: prep.skippedUnattributed,
+      skipped_policy_readonly: prep.skippedPolicyReadonly,
+      skipped_policy_deny: prep.skippedPolicyDeny,
+      failed: prep.parseFailed + prep.prepared.length,
+      duration_ms: Date.now() - t0,
+      partial_pages: prep.partialPages,
+      system_error: prep.policyError,
+    };
+  }
+
  if (args.noWrite) {
    // --no-write: skip the gbrain import call but still record state for
    // prepared pages (treat them as ingested for dedup purposes). Matches
@@ -1664,6 +1770,8 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
      skipped_secret: prep.skippedSecret,
      skipped_dedup: prep.skippedDedup,
      skipped_unattributed: prep.skippedUnattributed,
+      skipped_policy_readonly: prep.skippedPolicyReadonly,
+      skipped_policy_deny: prep.skippedPolicyDeny,
      failed: prep.parseFailed,
      duration_ms: Date.now() - t0,
      partial_pages: prep.partialPages,
@@ -1680,6 +1788,8 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
      skipped_secret: prep.skippedSecret,
      skipped_dedup: prep.skippedDedup,
      skipped_unattributed: prep.skippedUnattributed,
+      skipped_policy_readonly: prep.skippedPolicyReadonly,
+      skipped_policy_deny: prep.skippedPolicyDeny,
      failed: prep.parseFailed,
      duration_ms: Date.now() - t0,
      partial_pages: prep.partialPages,
@@ -1695,6 +1805,8 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
      skipped_secret: prep.skippedSecret,
      skipped_dedup: prep.skippedDedup,
      skipped_unattributed: prep.skippedUnattributed,
+      skipped_policy_readonly: prep.skippedPolicyReadonly,
+      skipped_policy_deny: prep.skippedPolicyDeny,
      failed: prep.parseFailed + prep.prepared.length,
      duration_ms: Date.now() - t0,
      partial_pages: prep.partialPages,
@@ -1842,6 +1954,8 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
        skipped_secret: prep.skippedSecret,
        skipped_dedup: prep.skippedDedup,
        skipped_unattributed: prep.skippedUnattributed,
+        skipped_policy_readonly: prep.skippedPolicyReadonly,
+        skipped_policy_deny: prep.skippedPolicyDeny,
        failed,
        duration_ms: Date.now() - t0,
        partial_pages: prep.partialPages,
@@ -1881,6 +1995,8 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
        skipped_secret: prep.skippedSecret,
        skipped_dedup: prep.skippedDedup,
        skipped_unattributed: prep.skippedUnattributed,
+        skipped_policy_readonly: prep.skippedPolicyReadonly,
+        skipped_policy_deny: prep.skippedPolicyDeny,
        failed,
        duration_ms: Date.now() - t0,
        partial_pages: prep.partialPages,
@@ -1917,6 +2033,8 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
          skipped_secret: prep.skippedSecret,
          skipped_dedup: prep.skippedDedup,
          skipped_unattributed: prep.skippedUnattributed,
+          skipped_policy_readonly: prep.skippedPolicyReadonly,
+          skipped_policy_deny: prep.skippedPolicyDeny,
          failed,
          duration_ms: Date.now() - t0,
          partial_pages: prep.partialPages,
@@ -1935,6 +2053,8 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
        skipped_secret: prep.skippedSecret,
        skipped_dedup: prep.skippedDedup,
        skipped_unattributed: prep.skippedUnattributed,
+        skipped_policy_readonly: prep.skippedPolicyReadonly,
+        skipped_policy_deny: prep.skippedPolicyDeny,
        failed,
        duration_ms: Date.now() - t0,
        partial_pages: prep.partialPages,
@@ -1963,6 +2083,8 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
        skipped_secret: prep.skippedSecret,
        skipped_dedup: prep.skippedDedup,
        skipped_unattributed: prep.skippedUnattributed,
+        skipped_policy_readonly: prep.skippedPolicyReadonly,
+        skipped_policy_deny: prep.skippedPolicyDeny,
        failed,
        duration_ms: Date.now() - t0,
        partial_pages: prep.partialPages,
@@ -2015,6 +2137,8 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
        skipped_secret: prep.skippedSecret,
        skipped_dedup: prep.skippedDedup,
        skipped_unattributed: prep.skippedUnattributed,
+        skipped_policy_readonly: prep.skippedPolicyReadonly,
+        skipped_policy_deny: prep.skippedPolicyDeny,
        failed,
        duration_ms: Date.now() - t0,
        partial_pages: prep.partialPages,
@@ -2094,6 +2218,8 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
    skipped_secret: prep.skippedSecret,
    skipped_dedup: prep.skippedDedup,
    skipped_unattributed: prep.skippedUnattributed,
+    skipped_policy_readonly: prep.skippedPolicyReadonly,
+    skipped_policy_deny: prep.skippedPolicyDeny,
    failed: failed + prep.parseFailed,
    duration_ms: Date.now() - t0,
    partial_pages: prep.partialPages,
@@ -2140,6 +2266,12 @@ function printBulkResult(r: BulkResult, args: CliArgs): void {
  console.log(`  skipped (dedup):       ${r.skipped_dedup}`);
  console.log(`  skipped (secret-scan): ${r.skipped_secret}`);
  console.log(`  skipped (unattrib):    ${r.skipped_unattributed}`);
+  if (r.skipped_policy_readonly > 0) {
+    console.log(`  skipped (policy read-only): ${r.skipped_policy_readonly}  (remote tier is read-only; transcript ingest writes pages)`);
+  }
+  if (r.skipped_policy_deny > 0) {
+    console.log(`  skipped (policy deny):      ${r.skipped_policy_deny}  (change with: gstack-gbrain-repo-policy set <remote> read-write)`);
+  }
  console.log(`  failed:                ${r.failed}`);
  console.log(`  duration:              ${(r.duration_ms / 1000).toFixed(1)}s`);
  if (args.benchmark) {
@@ -82,3 +82,71 @@ export function repoPolicyTier(url: string | null, env: NodeJS.ProcessEnv = proc
  if (tier === "unset") return { tier: "none" };
  return { tier: "none", error: "unreadable" }; // unexpected output — a read failure, not a tier
 }
+
+/**
+ * Bulk trust-tier lookup via `gstack-gbrain-repo-policy get --batch` — ONE
+ * spawn total for the whole url list (memory-ingest checks every distinct
+ * transcript remote in a run; per-url spawns would fork N bash+jq processes).
+ *
+ * The deduped url list goes to the script's stdin, one per line; the script
+ * answers one tier per line in input order (`none` where single `get` says
+ * `unset`). Fast paths mirror repoPolicyTier: no store on disk → every url
+ * is `{ tier: "none" }` with no subprocess.
+ *
+ * Failure classification matches repoPolicyTier (spawn ENOENT →
+ * `spawn-failed`, everything else → `unreadable`), applied to EVERY url: a
+ * malformed, incomplete, or timed-out batch (wrong line count, unknown tier
+ * token, non-zero exit) maps every url to `{ tier: "none", error:
+ * "unreadable" }`. POLARITY IS STILL THE CALLER'S — this client only reads
+ * and classifies.
+ */
+export function repoPolicyTierBatch(
+  urls: string[],
+  env: NodeJS.ProcessEnv = process.env,
+): Map<string, RepoPolicyResult> {
+  const out = new Map<string, RepoPolicyResult>();
+  const distinct = [...new Set(urls)];
+  if (distinct.length === 0) return out;
+  if (!hasRepoPolicyStore(env)) {
+    for (const u of distinct) out.set(u, { tier: "none" });
+    return out;
+  }
+  const allWithError = (error: "unreadable" | "spawn-failed"): Map<string, RepoPolicyResult> => {
+    for (const u of distinct) out.set(u, { tier: "none", error });
+    return out;
+  };
+  // Same win32 bash-wrapping as repoPolicyTier: the script is
+  // `#!/usr/bin/env bash`, which win32 can't exec directly.
+  const [cmd, args]: [string, string[]] =
+    process.platform === "win32"
+      ? ["bash", [POLICY_SCRIPT, "get", "--batch"]]
+      : [POLICY_SCRIPT, ["get", "--batch"]];
+  const res = spawnSync(cmd, args, {
+    encoding: "utf-8",
+    timeout: 10_000,
+    input: distinct.join("\n") + "\n",
+    env: { ...env } as NodeJS.ProcessEnv,
+  });
+  if (res.error) {
+    const code = (res.error as NodeJS.ErrnoException).code;
+    return allWithError(code === "ENOENT" ? "spawn-failed" : "unreadable");
+  }
+  if (res.status !== 0) return allWithError("unreadable");
+  const lines = (res.stdout || "").replace(/\n$/, "").split("\n");
+  if (lines.length !== distinct.length) return allWithError("unreadable");
+  const parsed: RepoPolicyResult[] = [];
+  for (const raw of lines) {
+    const tier = raw.trim();
+    if (tier === "deny" || tier === "read-only" || tier === "read-write") {
+      parsed.push({ tier });
+    } else if (tier === "none") {
+      parsed.push({ tier: "none" });
+    } else {
+      // Unknown token anywhere poisons the whole batch — a partially-garbled
+      // response can't be trusted line-by-line (the ordering itself may be off).
+      return allWithError("unreadable");
+    }
+  }
+  for (let i = 0; i < distinct.length; i++) out.set(distinct[i], parsed[i]);
+  return out;
+}
@@ -35,6 +35,25 @@ happens after you say yes.
 - **Repos under a `deny` trust policy** (set in `/setup-gbrain` Step 6)
  are skipped — neither code nor transcripts from those repos ingest.

+## Per-remote trust policy (deny / read-only)
+
+Transcript ingest respects the same per-remote trust store as code import
+(`~/.gstack/gbrain-repo-policy.json`, managed by
+`gstack-gbrain-repo-policy`). Each transcript's git remote is checked
+against the store before anything is written:
+
+- **deny** — the transcript is skipped (reported as `skipped (policy deny)`).
+- **read-only** — skipped too: read-only means "search allowed, page
+  writes never", and transcript ingest writes pages (reported as
+  `skipped (policy read-only)`).
+- **read-write, or no entry** — ingests normally.
+- **Corrupted or unreadable store** — ingestion aborts before any writes
+  rather than bypassing a set policy. Inspect the store with
+  `gstack-gbrain-repo-policy list`; re-run `/setup-gbrain` if it's corrupt.
+
+Artifacts (learnings, plans, retros, etc.) are never policy-filtered — the
+policy is keyed by git remote, which artifacts don't have.
+
 ## What gets scanned for secrets

 The cross-machine secret boundary is `gstack-brain-sync` (the git push
@@ -0,0 +1,152 @@
+/**
+ * lib/gbrain-repo-policy-client — batch trust-tier lookup (#2392).
+ *
+ * Covers the `get --batch` verb of bin/gstack-gbrain-repo-policy (bash level:
+ * multiple urls in, per-line verdicts out, input order preserved) and the
+ * TypeScript client `repoPolicyTierBatch` (ONE spawn, dedup, fast paths, and
+ * the whole-batch `unreadable` classification on a corrupt store).
+ *
+ * Each test uses a temp GSTACK_HOME so nothing leaks into the user's real
+ * ~/.gstack. The client is exercised against the REAL bash script — the
+ * script owns URL normalization, so stub stores are seeded through its own
+ * `set` verb.
+ */
+
+import { describe, test, expect, beforeEach, afterEach } from "bun:test";
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import { spawnSync } from "child_process";
+
+import { repoPolicyTierBatch } from "../lib/gbrain-repo-policy-client";
+
+const ROOT = path.resolve(import.meta.dir, "..");
+const BIN = path.join(ROOT, "bin", "gstack-gbrain-repo-policy");
+
+let tmpHome: string;
+
+function env(): NodeJS.ProcessEnv {
+  return { ...process.env, GSTACK_HOME: tmpHome };
+}
+
+function run(args: string[], input?: string) {
+  const res = spawnSync(BIN, args, { env: env(), encoding: "utf-8", input });
+  return {
+    stdout: res.stdout || "",
+    stderr: res.stderr || "",
+    status: res.status ?? -1,
+  };
+}
+
+function policyFile(): string {
+  return path.join(tmpHome, "gbrain-repo-policy.json");
+}
+
+beforeEach(() => {
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "gbrain-policy-client-"));
+});
+
+afterEach(() => {
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+describe("bin/gstack-gbrain-repo-policy get --batch (bash level)", () => {
+  test("multiple urls in, per-line verdicts out, input order preserved", () => {
+    expect(run(["set", "https://github.com/foo/bar.git", "deny"]).status).toBe(0);
+    expect(run(["set", "git@github.com:baz/qux.git", "read-only"]).status).toBe(0);
+    expect(run(["set", "https://github.com/rw/repo", "read-write"]).status).toBe(0);
+
+    const r = run(
+      ["get", "--batch"],
+      // Mixed URL forms — the script's normalize() collapses them to the
+      // stored keys. `nope/never` has no entry → none.
+      "git@github.com:foo/bar.git\nhttps://github.com/nope/never\nhttps://github.com/baz/qux\nhttps://github.com/rw/repo.git\n",
+    );
+    expect(r.status).toBe(0);
+    expect(r.stdout).toBe("deny\nnone\nread-only\nread-write\n");
+  });
+
+  test("no store on disk: every line is none, and no file is created", () => {
+    const r = run(["get", "--batch"], "https://github.com/a/a\nhttps://github.com/b/b\n");
+    expect(r.status).toBe(0);
+    expect(r.stdout).toBe("none\nnone\n");
+    expect(fs.existsSync(policyFile())).toBe(false);
+  });
+
+  test("corrupt store: hard error (exit 2), NOT quarantined, names recovery", () => {
+    fs.writeFileSync(policyFile(), "not valid json{", { mode: 0o600 });
+    const r = run(["get", "--batch"], "https://github.com/foo/bar\n");
+    expect(r.status).toBe(2);
+    expect(r.stderr).toContain("corrupt");
+    expect(r.stderr).toContain("gstack-gbrain-repo-policy list");
+    // Unlike interactive `get`, batch must never quarantine-and-proceed —
+    // that would bypass a set deny policy on an unattended ingest run.
+    expect(fs.readFileSync(policyFile(), "utf-8")).toBe("not valid json{");
+    expect(
+      fs.readdirSync(tmpHome).find((f) => f.includes(".corrupt-")),
+    ).toBeUndefined();
+  });
+
+  test("legacy allow entries migrate to read-write on batch read", () => {
+    fs.writeFileSync(
+      policyFile(),
+      JSON.stringify({ "github.com/foo/bar": "allow" }),
+      { mode: 0o600 },
+    );
+    const r = run(["get", "--batch"], "https://github.com/foo/bar\n");
+    expect(r.status).toBe(0);
+    expect(r.stdout).toBe("read-write\n");
+  });
+});
+
+describe("repoPolicyTierBatch (TypeScript client)", () => {
+  test("maps each input url to its verdict, dedup included", () => {
+    expect(run(["set", "https://github.com/foo/bar", "deny"]).status).toBe(0);
+    expect(run(["set", "https://github.com/baz/qux", "read-only"]).status).toBe(0);
+
+    const verdicts = repoPolicyTierBatch(
+      [
+        "github.com/foo/bar", // canonical form, as memory-ingest passes it
+        "github.com/baz/qux",
+        "github.com/nope/never",
+        "github.com/foo/bar", // duplicate — dedup keeps ONE map entry
+      ],
+      env(),
+    );
+    expect(verdicts.size).toBe(3);
+    expect(verdicts.get("github.com/foo/bar")).toEqual({ tier: "deny" });
+    expect(verdicts.get("github.com/baz/qux")).toEqual({ tier: "read-only" });
+    expect(verdicts.get("github.com/nope/never")).toEqual({ tier: "none" });
+  });
+
+  test("no store on disk: every url is tier none with no error (fast path)", () => {
+    const verdicts = repoPolicyTierBatch(["github.com/a/a", "github.com/b/b"], env());
+    expect(verdicts.get("github.com/a/a")).toEqual({ tier: "none" });
+    expect(verdicts.get("github.com/b/b")).toEqual({ tier: "none" });
+    expect(fs.existsSync(policyFile())).toBe(false);
+  });
+
+  test("empty url list returns an empty map without spawning", () => {
+    const verdicts = repoPolicyTierBatch([], env());
+    expect(verdicts.size).toBe(0);
+  });
+
+  test("corrupt store: EVERY url maps to { tier: none, error: unreadable }", () => {
+    fs.writeFileSync(policyFile(), "not valid json{", { mode: 0o600 });
+    const verdicts = repoPolicyTierBatch(["github.com/foo/bar", "github.com/baz/qux"], env());
+    expect(verdicts.get("github.com/foo/bar")).toEqual({ tier: "none", error: "unreadable" });
+    expect(verdicts.get("github.com/baz/qux")).toEqual({ tier: "none", error: "unreadable" });
+  });
+
+  test("store unreadable on disk (chmod 000): whole batch classified unreadable", () => {
+    if (process.platform === "win32" || process.getuid?.() === 0) return; // chmod semantics differ
+    expect(run(["set", "https://github.com/foo/bar", "deny"]).status).toBe(0);
+    fs.chmodSync(policyFile(), 0o000);
+    try {
+      const verdicts = repoPolicyTierBatch(["github.com/foo/bar"], env());
+      expect(verdicts.get("github.com/foo/bar")).toEqual({ tier: "none", error: "unreadable" });
+    } finally {
+      fs.chmodSync(policyFile(), 0o600);
+    }
+  });
+});
@@ -939,3 +939,213 @@ describe("#2394: probe applies the same attribution gate as prepare", () => {
    rmSync(home, { recursive: true, force: true });
  });
 });
+
+// ── #2392: transcript ingest honors the per-remote trust policy ─────────────
+//
+// The same store the code-import gate honors (bin/gstack-gbrain-sync.ts):
+// tier `deny` and `read-only` transcripts are skipped with their own counters;
+// a store that EXISTS but can't be read is a hard error before any writes
+// (never a silent bypass of a set policy); no store at all = zero policy work.
+// The policy store is seeded through the REAL bin/gstack-gbrain-repo-policy
+// script (its `set` verb owns the file schema + URL normalization).
+
+describe("#2392: transcript ingest honors per-remote trust policy", () => {
+  const POLICY_BIN = join(import.meta.dir, "..", "bin", "gstack-gbrain-repo-policy");
+
+  /** Attributable temp git repo whose origin points at `remoteUrl`. */
+  function makeRepoWithRemote(home: string, name: string, remoteUrl: string): string {
+    const repo = join(home, "work", name);
+    mkdirSync(repo, { recursive: true });
+    spawnSync("git", ["-C", repo, "init", "-q"], { encoding: "utf-8" });
+    spawnSync("git", ["-C", repo, "remote", "add", "origin", remoteUrl], { encoding: "utf-8" });
+    return repo;
+  }
+
+  function writeSessionForRepo(home: string, projectName: string, sessionId: string, cwd: string): void {
+    const record = JSON.stringify({
+      type: "user",
+      message: { role: "user", content: `hello from ${sessionId}` },
+      timestamp: new Date().toISOString(),
+      cwd,
+    });
+    writeClaudeCodeSession(home, projectName, sessionId, record + "\n");
+  }
+
+  function setPolicy(gstackHome: string, url: string, tier: string): void {
+    const r = spawnSync(POLICY_BIN, ["set", url, tier], {
+      encoding: "utf-8",
+      env: { ...process.env, GSTACK_HOME: gstackHome },
+    });
+    expect(r.status).toBe(0);
+  }
+
+  function stateSessions(gstackHome: string): string[] {
+    const statePath = join(gstackHome, ".transcript-ingest-state.json");
+    if (!existsSync(statePath)) return [];
+    return Object.keys(JSON.parse(readFileSync(statePath, "utf-8")).sessions || {});
+  }
+
+  it("(a) deny remote's transcript is skipped and counted as skipped_policy_deny", () => {
+    const home = makeTestHome();
+    const gstackHome = join(home, ".gstack");
+    mkdirSync(gstackHome, { recursive: true });
+    const { binDir, logFile } = installFakeGbrain(home);
+
+    const denyCwd = makeRepoWithRemote(home, "denied", "https://github.com/denyme/denied.git");
+    const okCwd = makeRepoWithRemote(home, "allowed", "https://github.com/okorg/okrepo.git");
+    writeSessionForRepo(home, "work-denied", "denysess1", denyCwd);
+    writeSessionForRepo(home, "work-allowed", "oksess1", okCwd);
+    setPolicy(gstackHome, "https://github.com/denyme/denied.git", "deny");
+
+    const r = runScript(["--bulk", "--quiet"], {
+      HOME: home,
+      GSTACK_HOME: gstackHome,
+      PATH: `${binDir}:${process.env.PATH || ""}`,
+    });
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toMatch(/written:\s+1/);
+    expect(r.stdout).toMatch(/skipped \(policy deny\):\s+1/);
+    expect(r.stdout).not.toMatch(/skipped \(policy read-only\)/);
+
+    // Only the allowed session was imported + state-recorded.
+    expect(existsSync(logFile)).toBe(true);
+    const sessions = stateSessions(gstackHome);
+    expect(sessions.length).toBe(1);
+    expect(sessions[0]).toContain("oksess1");
+
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  it("(b) read-only remote's transcript is skipped and counted as skipped_policy_readonly", () => {
+    const home = makeTestHome();
+    const gstackHome = join(home, ".gstack");
+    mkdirSync(gstackHome, { recursive: true });
+    const { binDir } = installFakeGbrain(home);
+
+    const roCwd = makeRepoWithRemote(home, "readonly", "https://github.com/roorg/rorepo.git");
+    const okCwd = makeRepoWithRemote(home, "allowed", "https://github.com/okorg/okrepo.git");
+    writeSessionForRepo(home, "work-readonly", "rosess1", roCwd);
+    writeSessionForRepo(home, "work-allowed", "oksess1", okCwd);
+    setPolicy(gstackHome, "https://github.com/roorg/rorepo.git", "read-only");
+
+    const r = runScript(["--bulk", "--quiet"], {
+      HOME: home,
+      GSTACK_HOME: gstackHome,
+      PATH: `${binDir}:${process.env.PATH || ""}`,
+    });
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toMatch(/written:\s+1/);
+    expect(r.stdout).toMatch(/skipped \(policy read-only\):\s+1/);
+    const sessions = stateSessions(gstackHome);
+    expect(sessions.length).toBe(1);
+    expect(sessions[0]).toContain("oksess1");
+
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  it("(c) read-write remote's transcript is ingested (reaches gbrain import)", () => {
+    const home = makeTestHome();
+    const gstackHome = join(home, ".gstack");
+    mkdirSync(gstackHome, { recursive: true });
+    const { binDir, logFile } = installFakeGbrain(home);
+
+    const rwCwd = makeRepoWithRemote(home, "readwrite", "https://github.com/rworg/rwrepo.git");
+    writeSessionForRepo(home, "work-readwrite", "rwsess1", rwCwd);
+    setPolicy(gstackHome, "https://github.com/rworg/rwrepo.git", "read-write");
+
+    const r = runScript(["--bulk", "--quiet"], {
+      HOME: home,
+      GSTACK_HOME: gstackHome,
+      PATH: `${binDir}:${process.env.PATH || ""}`,
+    });
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toMatch(/written:\s+1/);
+    expect(r.stdout).not.toMatch(/skipped \(policy/);
+    // gbrain import ran exactly once — the page reached the import stage.
+    const calls = readFileSync(logFile, "utf-8").trim().split("\n").filter(Boolean);
+    expect(calls.length).toBe(1);
+    expect(stateSessions(gstackHome).length).toBe(1);
+
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  it("(d) corrupted store: hard error before any writes, message names recovery", () => {
+    const home = makeTestHome();
+    const gstackHome = join(home, ".gstack");
+    mkdirSync(gstackHome, { recursive: true });
+    const { binDir, logFile } = installFakeGbrain(home);
+
+    const cwd = makeRepoWithRemote(home, "somerepo", "https://github.com/some/repo.git");
+    writeSessionForRepo(home, "work-somerepo", "somesess1", cwd);
+    // Corrupt store — the batch verb refuses (exit 2), the client classifies
+    // `unreadable`, and ingest must abort rather than bypass a set policy.
+    writeFileSync(join(gstackHome, "gbrain-repo-policy.json"), "not valid json{", "utf-8");
+
+    const r = runScript(["--bulk", "--quiet"], {
+      HOME: home,
+      GSTACK_HOME: gstackHome,
+      PATH: `${binDir}:${process.env.PATH || ""}`,
+    });
+
+    expect(r.exitCode).toBe(1);
+    expect(r.stderr).toMatch(/\[memory-ingest\] ERR:.*repo policy store exists/);
+    expect(r.stderr).toContain("gstack-gbrain-repo-policy list");
+    expect(r.stderr).toContain("/setup-gbrain");
+    // Nothing written: no gbrain import call, no state file, store untouched.
+    expect(existsSync(logFile)).toBe(false);
+    expect(stateSessions(gstackHome).length).toBe(0);
+    expect(readFileSync(join(gstackHome, "gbrain-repo-policy.json"), "utf-8")).toBe("not valid json{");
+
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  it("(e) no store at all: no policy filtering, transcript ingests normally", () => {
+    const home = makeTestHome();
+    const gstackHome = join(home, ".gstack");
+    mkdirSync(gstackHome, { recursive: true });
+    const { binDir } = installFakeGbrain(home);
+
+    const cwd = makeRepoWithRemote(home, "freerepo", "https://github.com/free/repo.git");
+    writeSessionForRepo(home, "work-freerepo", "freesess1", cwd);
+
+    const r = runScript(["--bulk", "--quiet"], {
+      HOME: home,
+      GSTACK_HOME: gstackHome,
+      PATH: `${binDir}:${process.env.PATH || ""}`,
+    });
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toMatch(/written:\s+1/);
+    expect(r.stdout).not.toMatch(/skipped \(policy/);
+    expect(stateSessions(gstackHome).length).toBe(1);
+
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  it("artifacts are never policy-filtered, even when their project's remote is denied", () => {
+    const home = makeTestHome();
+    const gstackHome = join(home, ".gstack");
+    mkdirSync(join(gstackHome, "projects", "denyme-denied"), { recursive: true });
+    const { binDir } = installFakeGbrain(home);
+
+    // A learning artifact under a project slug matching a denied remote —
+    // the policy is keyed by git remote, which artifacts don't have.
+    writeFileSync(join(gstackHome, "projects", "denyme-denied", "learnings.jsonl"), '{"key":"a","insight":"b"}\n');
+    setPolicy(gstackHome, "https://github.com/denyme/denied.git", "deny");
+
+    const r = runScript(["--bulk", "--quiet"], {
+      HOME: home,
+      GSTACK_HOME: gstackHome,
+      PATH: `${binDir}:${process.env.PATH || ""}`,
+    });
+
+    expect(r.exitCode).toBe(0);
+    expect(r.stdout).toMatch(/written:\s+1/);
+    expect(r.stdout).not.toMatch(/skipped \(policy/);
+
+    rmSync(home, { recursive: true, force: true });
+  });
+});