fix(engram): allow SessionSummary node_type in validation allowlist

handle_api_consolidate writes a "SessionSummary" node, but engram_valid_node_type
omitted it — so once this validation ships, every consolidate() would be silently
REJECTED at the engram boundary. Add SessionSummary to the allowlist.

Found in Will's PR review of neuron #1 / el #52.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci-dev.yaml

@@ -174,6 +174,28 @@ jobs:
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_fs
           /tmp/el_native_fs
 
+      # Build epm binary using elb (epm lives at repo root, not inside lang/)
+      - name: Build epm
+        run: |
+          ABS_ELB="$(pwd)/dist/bin/elb"
+          ABS_ELC="$(pwd)/dist/platform/elc"
+          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
+          ABS_OUT="$(pwd)/dist/bin"
+          (cd ../epm && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
+          chmod +x dist/bin/epm
+          echo "epm built"
+
+      # Build el-install binary using elb
+      - name: Build el-install
+        run: |
+          ABS_ELB="$(pwd)/dist/bin/elb"
+          ABS_ELC="$(pwd)/dist/platform/elc"
+          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
+          ABS_OUT="$(pwd)/dist/bin"
+          (cd tools/install && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
+          chmod +x dist/bin/el-install
+          echo "el-install built"
+
       # Publish only after merge (push event), not on PR validation runs
       - name: Publish El SDK to Artifact Registry (dev)
         if: github.event_name == 'push'

.gitea/workflows/ci-stage.yaml

@@ -170,6 +170,42 @@ jobs:
             -lcurl -lssl -lcrypto -lpthread -lm -o /tmp/el_native_fs
           /tmp/el_native_fs
 
+      # Build elb (needed for epm and el-install builds below)
+      - name: Build elb
+        run: |
+          mkdir -p dist/bin
+          dist/platform/elc elb.el > dist/elb.c
+          gcc -O2 \
+            -I el-compiler/runtime \
+            dist/elb.c \
+            el-compiler/runtime/el_runtime.c \
+            -lcurl -lssl -lcrypto -lpthread -lm \
+            -o dist/bin/elb
+          chmod +x dist/bin/elb
+          echo "elb built"
+
+      # Build epm binary using elb (epm lives at repo root, not inside lang/)
+      - name: Build epm
+        run: |
+          ABS_ELB="$(pwd)/dist/bin/elb"
+          ABS_ELC="$(pwd)/dist/platform/elc"
+          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
+          ABS_OUT="$(pwd)/dist/bin"
+          (cd ../epm && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
+          chmod +x dist/bin/epm
+          echo "epm built"
+
+      # Build el-install binary using elb
+      - name: Build el-install
+        run: |
+          ABS_ELB="$(pwd)/dist/bin/elb"
+          ABS_ELC="$(pwd)/dist/platform/elc"
+          ABS_RUNTIME="$(pwd)/el-compiler/runtime"
+          ABS_OUT="$(pwd)/dist/bin"
+          (cd tools/install && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
+          chmod +x dist/bin/el-install
+          echo "el-install built"
+
       # Publish only after merge (push event), not on PR validation runs
       - name: Publish El SDK to Artifact Registry (stage)
         if: github.event_name == 'push'

.gitea/workflows/sdk-release.yaml

@@ -77,7 +77,7 @@ jobs:
           ABS_ELC="$(pwd)/dist/platform/elc"
           ABS_RUNTIME="$(pwd)/el-compiler/runtime"
           ABS_OUT="$(pwd)/dist/bin"
-          (cd ../epm && "$ABS_ELB" --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
+          (cd ../epm && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/epm
           echo "epm built"
 
@@ -88,7 +88,7 @@ jobs:
           ABS_ELC="$(pwd)/dist/platform/elc"
           ABS_RUNTIME="$(pwd)/el-compiler/runtime"
           ABS_OUT="$(pwd)/dist/bin"
-          (cd tools/install && "$ABS_ELB" --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
+          (cd tools/install && "$ABS_ELB" --clean --elc="$ABS_ELC" --runtime="$ABS_RUNTIME" --out="$ABS_OUT")
           chmod +x dist/bin/el-install
           echo "el-install built"
 

lang/elb.el

@@ -271,7 +271,10 @@ fn link_binary(c_files: [String], out_bin: String, runtime_path: String, out_dir
     let parts: [String] = native_list_empty()
     // Include both the runtime dir (for el_runtime.h) and the output dir
     // (for module.elh cross-module forward declarations).
-    let parts = native_list_append(parts, "cc -O2 -fbracket-depth=1024 -I " + dirname_of(runtime_path) + " -I " + out_dir)
+    // Detect clang vs gcc: -fbracket-depth is clang-only; silently ignored
+    // if unsupported but gcc rejects it with an error.
+    let bracket_flag: String = "$(cc --version 2>&1 | grep -q clang && printf -- '-fbracket-depth=1024' || true)"
+    let parts = native_list_append(parts, "cc -O2 " + bracket_flag + " -I " + dirname_of(runtime_path) + " -I " + out_dir)
     let i = 0
     while i < n {
         let f: String = native_list_get(c_files, i)
@@ -279,7 +282,7 @@ fn link_binary(c_files: [String], out_bin: String, runtime_path: String, out_dir
         let i = i + 1
     }
     let parts = native_list_append(parts, runtime_path)
-    let parts = native_list_append(parts, "-lcurl -lpthread -lm")
+    let parts = native_list_append(parts, "-lcurl -lssl -lcrypto -lpthread -lm")
     let parts = native_list_append(parts, "-o " + out_bin)
     let cmd: String = str_join(parts, " ")
     println("  link     " + out_bin)

lang/runtime/engram.el

@@ -6,15 +6,55 @@
 //
 // Dependencies: runtime/string.el, runtime/json.el
 
+// --- Validation (defense in depth) ---
+// el_val_t is an untyped machine word, so a wrong TYPE can't be caught here — but a
+// wrong VALUE can (a tier in the node_type slot, an empty/garbage string, an int, a
+// path, a model name, a cgi id). Reject loudly instead of silently writing junk.
+
+fn engram_valid_node_type(t: String) -> Bool {
+    return str_eq(t, "Memory") || str_eq(t, "Knowledge") || str_eq(t, "Belief")
+        || str_eq(t, "Project") || str_eq(t, "Tag") || str_eq(t, "BacklogItem")
+        || str_eq(t, "Artifact") || str_eq(t, "Conversation") || str_eq(t, "ExecutionContext")
+        || str_eq(t, "InternalStateEvent") || str_eq(t, "Self") || str_eq(t, "Entity")
+        || str_eq(t, "Process") || str_eq(t, "ConfigEntry") || str_eq(t, "Concept") || str_eq(t, "Imprint")
+        || str_eq(t, "SessionSummary")
+}
+
+fn engram_valid_tier(t: String) -> Bool {
+    return str_eq(t, "Semantic") || str_eq(t, "Episodic") || str_eq(t, "Working")
+        || str_eq(t, "Procedural") || str_eq(t, "Canonical") || str_eq(t, "Note") || str_eq(t, "Lesson")
+}
+
 // --- Node creation ---
 
 fn engram_node(content: String, node_type: String, salience: Float) -> String {
+    if !engram_valid_node_type(node_type) {
+        __println("[engram] REJECTED node write — invalid node_type '" + node_type + "'")
+        return ""
+    }
     return __engram_node(content, node_type, salience)
 }
 
-fn engram_node_full(content: String, nt: String, sal: Float, imp: Float,
-                    source: String, lang: String, ts: Int, tags: String) -> String {
-    return __engram_node_full(content, nt, sal, imp, source, lang, ts, tags)
+// Signature MUST match the C primitive __engram_node_full exactly (el_seed.h):
+//   (content, node_type, label, salience, importance, confidence, tier, tags)
+// The previous wrapper declared a stale 8-arg schema with wrong names AND types
+// (sal:Float at the label slot, ts:Int at the tier slot). Because el_val_t is an
+// untyped machine word, the EL compiler coerced caller args to those wrong param
+// types and then forwarded them BY POSITION into the C function — so tier received
+// an int, importance/confidence received strings, label received a float, etc.
+// That is the field-corruption bug. Match the contract 1:1 — no coercion, no reorder.
+fn engram_node_full(content: String, node_type: String, label: String,
+                    salience: Float, importance: Float, confidence: Float,
+                    tier: String, tags: String) -> String {
+    if !engram_valid_node_type(node_type) {
+        __println("[engram] REJECTED node write — invalid node_type '" + node_type + "' (label=" + label + ")")
+        return ""
+    }
+    if !engram_valid_tier(tier) {
+        __println("[engram] REJECTED node write — invalid tier '" + tier + "' (node_type=" + node_type + ", label=" + label + ")")
+        return ""
+    }
+    return __engram_node_full(content, node_type, label, salience, importance, confidence, tier, tags)
 }
 
 // --- Node retrieval ---

lang/tools/install/el-install.el

@@ -10,15 +10,6 @@
 //   export PATH="$HOME/.el/bin:$PATH"
 //   export EL_HOME="$HOME/.el"
 
-// ── Imports ───────────────────────────────────────────────────────────────────
-
-import "../../runtime/string.el"
-import "../../runtime/env.el"
-import "../../runtime/fs.el"
-import "../../runtime/exec.el"
-import "../../runtime/json.el"
-import "../../runtime/http.el"
-
 // ── Constants ─────────────────────────────────────────────────────────────────
 
 fn gitea_releases_url() -> String {