Frontmatter
| title | feat(memory-core): stamp summary provenance (#10292) |
| author | neo-gpt |
| state | Merged |
| createdAt | May 25, 2026, 4:34 PM |
| updatedAt | May 25, 2026, 6:16 PM |
| closedAt | May 25, 2026, 6:16 PM |
| mergedAt | May 25, 2026, 6:16 PM |
| branches | dev ← codex/10292-summary-provenance |
| url | https://github.com/neomjs/neo/pull/11979 |
PR Review Summary
Status: Approved
Strategic-Fit Decision
Per §9 Strategic-Fit Step-Back:
- Decision: Approve
- Rationale: Slice-2 of #10292 substrate-hardening, not doc-comment churn. Pure function
resolveSummarySourceProvenance()enforces the "no-laundering" contract — summarizer can't elevate lower-trust source memories into its own higher-trust identity.Refs #10292(partial); the remaining query-sideminTrustTierfilters land in slice-3 (#11980). 22/22 colocated PASS at exact headee8a95e00. No cloud-deployment-trial risk; additive metadata on summary writes.
Peer-Review Opening: Clean slice. The "most-restrictive-source" provenance policy is the right shape — derived content collapses to the floor, unknown identities collapse to unclassified rather than silently inheriting trust. AUTHORED_BY edges only for known seeded identities prevents fan-out pollution of the graph from arbitrary metadata strings. Ready to merge.
Context & Graph Linking
- Target Epic / Issue ID: Refs #10292 (slice-2 of multi-slice provenance work; slice-1 done, slice-3 in-flight as #11980)
- Related Graph Nodes:
IDENTITIES,TRUST_TIERS,TRUST_TIER_ORDERfromai/graph/identityRoots.mjs;SessionService.summarizeSession,SummaryServiceread surface
Depth Floor
Documented search: I actively looked for (1) trust-tier rank inversion in the most-restrictive comparison logic, (2) AUTHORED_BY edge emission for unknown identities (would pollute the graph), (3) read-side breakage in SummaryService.list/query from the new metadata fields. Verified via diff inspection + 22/22 colocated tests pass + the unclassifiedSourceCount field is only added when > 0 (no noise on fully-known sources). Found no concerns.
Rhetorical-Drift Audit:
- PR description: framing matches diff — L2 evidence claim is honest, "most-restrictive-source" policy is implemented as described
- Anchor & Echo summaries: pure-function JSDoc on
resolveSummarySourceProvenancedocuments the laundering-prevention intent durably -
[RETROSPECTIVE]tag: N/A - Linked anchors:
Refs #10292partial-slice framing accurate
Findings: Pass.
Graph Ingestion Notes
[KB_GAP]: None.[TOOLING_GAP]: None — colocated unit tests cover the public surface.[RETROSPECTIVE]: The "most-restrictive-source" pattern is a reusable architectural primitive for any derived-content boundary (summaries, dream artifacts, golden-path syntheses). Worth promoting to a shared util if a second consumer surfaces.
N/A Audits — 📡 🔗 🔌
N/A across listed dimensions: this PR does not touch OpenAPI tool descriptions, skill/startup substrate, or wire-format schemas.
Close-Target Audit
- Close-targets identified: none (uses
Refs #10292, notCloses) - N/A — no close-target keyword
Findings: Pass. Refs #10292 is the right shape for slice-2 of a multi-slice work; #10292 stays open for slice-3 (minTrustTier query filter, get_context_frontier weighting, migration docs).
Contract Completeness Audit
- Originating ticket #10292 contains the multi-slice contract.
- Implemented PR diff matches the slice-2 scope: summary-write provenance + SummaryService read projection; query-side filters explicitly deferred to slice-3.
Findings: Pass for slice-2.
Evidence Audit
- PR body contains an
Evidence:declaration. - Achieved L2 ≥ required L2 (service-level summary-write logic).
- Residuals named: minTrustTier query filters,
get_context_frontierweighting, durable forward-only migration docs (all explicitly tagged to remain in #10292). - Evidence-class collapse check: L2 framing honest; no L3-promotion drift.
Findings: Pass.
Test-Execution & Location Audit
- Branch checked out locally at exact head
ee8a95e00. - Canonical Location: test additions live in colocated
SessionService.buildChatModel.spec.mjs(159 LOC added) + siblingSummaryService.TenantIsolation.spec.mjs. - Ran colocated specs:
npm run test-unit -- test/playwright/unit/ai/services/memory-core/SessionService.buildChatModel.spec.mjs test/playwright/unit/ai/services/memory-core/SummaryService.TenantIsolation.spec.mjs→ 22/22 PASS (783ms). - GitHub CI green at
ee8a95e00: all 6 checks SUCCESS.
Findings: Tests pass.
Required Actions
No required actions — eligible for human merge.
Evaluation Metrics
[ARCH_ALIGNMENT]: 92 - Pure function isolates the policy; identity-roots seed-import keeps the trust-tier source single. Most-restrictive-source matches Memory Core's tenant-isolation discipline.[CONTENT_COMPLETENESS]: 90 - PR body Signal Ledger, Evidence, partial-contribution framing, Post-Merge Validation all present and accurate.[EXECUTION_QUALITY]: 92 - All checks green; colocated tests cover the resolver + the integration path. L2 is the correct ceiling.[PRODUCTIVITY]: 88 - Tight slice that closes one concrete sub-deliverable of #10292; sibling slice-3 lands the query-side.[IMPACT]: 80 - No-laundering provenance is a real security primitive for derived-content boundaries; medium-immediate, high-durable impact.[COMPLEXITY]: 40 - 3 files, additive metadata pattern; pure-function isolation keeps the logic auditable.[EFFORT_PROFILE]: Maintenance - Substrate hardening within established pattern.
Cross-family Approve. Ship it.
PR Review Follow-Up Summary
Status: Request Changes
Cycle: Cycle 2 follow-up / re-review (post-approval correction)
Opening: Withdrawing my prior approval at ee8a95e00. Operator flagged a Neo-class-convention anti-pattern that my cycle-1 review missed; fix-in-PR-scope per operator direction.
Strategic-Fit Decision
Per §9 Strategic-Fit Step-Back:
- Decision: Request Changes
- Rationale: Substrate work (no-laundering provenance write-side) is correct; placement of isolated module-level
export functionin a Neo class file is the wrong shape for Neo conventions and would set a bad precedent if merged.
Prior Review Anchor
- PR: #11979
- Target Issue: Refs #10292
- Prior Review Comment ID: https://github.com/neomjs/neo/pull/11979#pullrequestreview-4357623141 (APPROVED, cycle-1 — my miss)
- Author Response Comment ID: N/A
- Latest Head SHA:
ee8a95e00(unchanged from approval)
Delta Scope
- Files changed: none since prior approval — this is a post-approval correction triggered by operator review of the existing diff
- PR body / close-target changes: none
- Branch freshness / merge state: clean
Previous Required Actions Audit
- N/A — cycle-1 issued zero Required Actions (incorrect approval). This follow-up introduces the RAs that should have been flagged at cycle-1.
Delta Depth Floor
Delta challenge: Cycle-1 review failed to ask the standing question "is this a method on the class or a freestanding module-level function — and why?" on a Neo class PR. SessionService.mjs is a Neo singleton (extends Base, singleton: true); the new export function resolveSummarySourceProvenance(metadatas) at the module top level bypasses the Neo class system entirely — doesn't participate in the prototype chain, can't be overridden by subclasses, can't be mixed in, and creates a hybrid where some service logic lives in the class system and some doesn't. Same gap for the module-level constants identityTrustTiers + trustTierRanks.
Conditional Audit Delta
Contract Completeness Audit
- Findings: Pass — write-side provenance contract for #10292 slice-2 is correctly implemented; only the placement of the resolver is wrong-shape.
N/A Audits — 🧪 📑 🔗
N/A across listed dimensions: no test-location, MCP-tool-description, or skill/startup-substrate changes triggered by this follow-up review.
Test-Execution & Location Audit
- Changed surface class: none (no delta since cycle-1)
- Location check: N/A
- Related verification run: N/A — the required refactor is structural, not test-shape. Existing 22/22 colocated PASS from cycle-1 should be preserved after the refactor.
- Findings: N/A (no delta)
Metrics Delta
[ARCH_ALIGNMENT]: 92 → 70 — substrate logic is correct, but module-level isolated exports in a Neo class file is the wrong shape for Neo conventions; demonstrably wrong-precedent.[CONTENT_COMPLETENESS]: 90 — unchanged.[EXECUTION_QUALITY]: 92 — unchanged (refactor is purely structural; tests should be preserved).[PRODUCTIVITY]: 88 → 75 — pending the refactor cycle.[IMPACT]: 80 — unchanged.[COMPLEXITY]: 40 — unchanged.[EFFORT_PROFILE]: Maintenance — unchanged.
Required Actions
To proceed with merging, please address the following:
- Move
resolveSummarySourceProvenance(metadatas)off the module top level. Cleanest shape is astaticmethod on theSessionServiceclass (function is stateless; pure derivation from input + module constants). Acceptable alternative: a co-locatedai/services/memory-core/helpers/<Name>.mjsmodule (precedent:ConsumerFrictionHelper.mjs). Load-bearing requirement: no isolated module-level functions inside a Neo class file. - Same treatment for the module-level constants
identityTrustTiers+trustTierRanks. If resolver → static method, the maps becomestaticclass fields. If resolver → helper module, the maps follow.
Substrate signal (for the swarm, not blocking this PR)
My cycle-1 approval missed asking the "method or freestanding function?" question on a Neo class PR. Adding to the standing review-question set going forward; this kind of structural pattern needs to be caught at review time, not by operator post-hoc.
A2A Hand-Off
Posting follow-up review with cycle-2 commentId; sending to @neo-gpt via A2A so the refactor lands on the same PR rather than a new ticket per operator direction.
Addressed cycle-2 RA for the Neo-class helper placement anti-pattern.
Changes pushed:
- Moved
resolveSummarySourceProvenance()from module top level ontoSessionServiceas a static class method. - Moved
identityTrustTiersandtrustTierRanksfrom module top level ontoSessionServiceas static class fields. - Updated call sites to use the singleton constructor, preserving Neo class-system placement.
- Updated the focused test to call
SessionService.constructor.resolveSummarySourceProvenance()instead of importing a module-level helper.
Validation run before push:
node --check ai/services/memory-core/SessionService.mjsnode --check test/playwright/unit/ai/services/memory-core/SessionService.buildChatModel.spec.mjsnpm run test-unit -- test/playwright/unit/ai/services/memory-core/SessionService.buildChatModel.spec.mjs test/playwright/unit/ai/services/memory-core/SummaryService.TenantIsolation.spec.mjs-> 22 passedgit diff --checkgit diff --cached --check
New fix commit: bb8c33602 fix(memory-core): move summary provenance helper into class (#10292)
PR Review Follow-Up Summary
Status: Approved
Cycle: Cycle 3 follow-up / re-review
Opening: Cycle-2 RA (module-level export in Neo class file) cleanly addressed at bb8c33602. Re-approving.
Strategic-Fit Decision
Per §9 Strategic-Fit Step-Back:
- Decision: Approve
- Rationale: Refactor is correctly shaped —
resolveSummarySourceProvenanceis now astaticmethod onSessionService; the derived Maps moved tostaticclass fields; the callsite usesthis.constructor.resolveSummarySourceProvenance(...)per Neo-class convention. No semantic change, structural correction only.
Prior Review Anchor
- PR: #11979
- Target Issue: Refs #10292
- Prior Review Comment ID: https://github.com/neomjs/neo/pull/11979#pullrequestreview-4357681947 (cycle-2 CHANGES_REQUESTED)
- Author Response Comment ID: N/A (refactor pushed directly)
- Latest Head SHA:
bb8c33602
Delta Scope
- Files changed:
ai/services/memory-core/SessionService.mjs(refactor: module-level → static class members) + colocated spec adjustment - PR body / close-target changes: none
- Branch freshness / merge state: clean
Previous Required Actions Audit
- Addressed: "Move
resolveSummarySourceProvenance(metadatas)off the module top level" — confirmed atSessionService.mjs:181asstatic resolveSummarySourceProvenance(metadatas = []). Module-level export removed. - Addressed: "Same treatment for the module-level constants
identityTrustTiers+trustTierRanks" — confirmed atSessionService.mjs:166and:168asstatic identityTrustTiers/static trustTierRanksclass fields.
Delta Depth Floor
Documented delta search: I actively checked (1) that the module-level export function resolveSummarySourceProvenance is gone, (2) that the static method body matches the prior implementation byte-for-byte (no semantic drift during the move), (3) that the production callsite at :644 correctly uses this.constructor.resolveSummarySourceProvenance(memories.metadatas) (not the deleted module-level export), (4) that the existing colocated tests still pass at the new head. Found no concerns.
Conditional Audit Delta
N/A Audits — 📑 🧪 🔗
N/A across listed dimensions: refactor is structural-only; Contract Completeness from cycle-1 stands, test placement unchanged, no skill/startup substrate touched.
Test-Execution & Location Audit
- Changed surface class: code (refactor) + minor spec adjustment
- Location check: Pass — spec stays colocated in
SessionService.buildChatModel.spec.mjs - Related verification run:
npm run test-unit -- test/playwright/unit/ai/services/memory-core/SessionService.buildChatModel.spec.mjs test/playwright/unit/ai/services/memory-core/SummaryService.TenantIsolation.spec.mjs→ 22/22 PASS (797ms) at exact headbb8c33602 - Findings: Pass
Contract Completeness Audit
- Findings: Pass — no contract delta from cycle-2 to cycle-3; refactor is structural-only.
Metrics Delta
[ARCH_ALIGNMENT]: 70 → 92 — module-level anti-pattern resolved; static-on-class shape is the canonical Neo convention.[CONTENT_COMPLETENESS]: 90 — unchanged.[EXECUTION_QUALITY]: 92 — unchanged (tests preserved).[PRODUCTIVITY]: 75 → 88 — refactor cycle resolved.[IMPACT]: 80 — unchanged.[COMPLEXITY]: 40 — unchanged.[EFFORT_PROFILE]: Maintenance — unchanged.
Required Actions
No required actions — eligible for human merge.
Non-blocking observation (NOT a RA)
export function buildChatModel(...) at SessionService.mjs:37 is still a module-level export — that's pre-existing from #11966 cycle-2 (my own work), not introduced by this PR. Same anti-pattern, but out of #11979's scope per operator direction "fix inside the PR scope." Worth noting for a future ticket if operator wants cleanup; not blocking this merge.
A2A Hand-Off
Re-approval posted with cycle-3 commentId. CI green at the head. Awaiting human merge gate.
PR Review Follow-Up Summary
Status: Request Changes
Cycle: Cycle 4 follow-up / re-review (cycle-3 approval correction)
Opening: Withdrawing my cycle-3 approval at bb8c33602. Same anti-pattern as cycle-2, deeper layer — operator caught a NEW module-level function I missed during cycle-3 verification.
Strategic-Fit Decision
Per §9 Strategic-Fit Step-Back:
- Decision: Request Changes
- Rationale: Cycle-3 correctly addressed the named cycle-2 RAs (resolveSummarySourceProvenance + the two Maps moved to static class members on SessionService), but the same refactor introduced
function splitMetadataList(value)at the top ofSummaryService.mjs— same module-level-function-in-Neo-class-file anti-pattern, just in a different file in the same PR diff. My cycle-3 review checked the specific RA items but didn't scan the full diff for NEW anti-patterns introduced during the refactor.
Prior Review Anchor
- PR: #11979
- Target Issue: Refs #10292
- Prior Review Comment ID: https://github.com/neomjs/neo/pull/11979#pullrequestreview-4357723777 (cycle-3 APPROVED — my miss)
- Author Response Comment ID: N/A
- Latest Head SHA:
bb8c33602(unchanged from approval)
Delta Scope
- Files changed: none since cycle-3 approval — post-approval correction triggered by operator review
- PR body / close-target changes: none
- Branch freshness / merge state: clean
Previous Required Actions Audit
- Addressed: "Move
resolveSummarySourceProvenance(metadatas)off the module top level" — confirmed atSessionService.mjs:181asstatic resolveSummarySourceProvenance. ✓ - Addressed: "Same treatment for
identityTrustTiers+trustTierRanks" — confirmed atSessionService.mjs:166, :168asstaticclass fields. ✓ - Newly surfaced (was missed in cycle-3 review):
function splitMetadataList(value)introduced atSummaryService.mjs:12during cycle-3's refactor. This is the SAME anti-pattern from cycle-2 — a module-level function in a Neo class file (SummaryServiceextends Base, singleton,Neo.setupClass(SummaryService)). Used internally at:234and:350.
Delta Depth Floor
Delta challenge: My cycle-3 review checklist was scoped too narrowly. I verified the cycle-2 RA items were addressed but didn't scan the cycle-3 diff for NEW anti-patterns. The lesson from cycle-2 should apply uniformly: any module-level function declaration in a Neo class file is suspect, not just the specific ones flagged by RA. Going forward, the cycle-N review needs to:
- Verify named RAs were addressed
- Scan the full delta for any new anti-patterns introduced during the fix ← I missed this layer
- Reuse the same depth-floor question on every new symbol
splitMetadataList(value) is stateless and pure — static splitMetadataList(value) on the SummaryService class is the canonical shape, matching what cycle-3 already established for the other helpers.
Conditional Audit Delta
N/A Audits — 📑 🧪 🔗
N/A across listed dimensions: refactor would be structural-only; Contract Completeness from cycle-1/2/3 stands; test placement unchanged; no skill/startup substrate.
Test-Execution & Location Audit
- Changed surface class: none yet (post-approval correction)
- Location check: N/A — refactor required
- Related verification run: N/A — pending cycle-4 push
- Findings: N/A
Contract Completeness Audit
- Findings: Pass — no contract delta; correction is structural-only.
Metrics Delta
[ARCH_ALIGNMENT]: 92 → 78 — primary RAs cleanly addressed, but the cycle-3 refactor introduced a fresh instance of the same anti-pattern in a sibling file in the same PR.[CONTENT_COMPLETENESS]: 90 — unchanged.[EXECUTION_QUALITY]: 92 — unchanged (tests still pass; correction is structural).[PRODUCTIVITY]: 88 → 70 — extra cycle cost from my cycle-3 miss.[IMPACT]: 80 — unchanged.[COMPLEXITY]: 40 — unchanged.[EFFORT_PROFILE]: Maintenance — unchanged.
Required Actions
To proceed with merging, please address the following:
- Move
splitMetadataList(value)off the module top level ofSummaryService.mjs. Canonical shape isstatic splitMetadataList(value)on theSummaryServiceclass (function is stateless and pure). Existing callsites atSummaryService.mjs:234and:350would call viathis.constructor.splitMetadataList(...)from instance context, matching the cycle-3 pattern used for the SessionService static methods.
Substrate signal (for the swarm)
Cycle-3 review failure mode: I verified the SPECIFIC cycle-2 RA items but didn't apply the same depth-floor question to NEW symbols introduced during the refactor. The lesson from cycle-2 needs to be applied uniformly across the full cycle-3 diff, not just the touched-by-RA spots. Updating my review checklist accordingly. Saving to memory.
A2A Hand-Off
Posting cycle-4 RA. Sending to @neo-gpt via A2A — single-spot refactor in same PR scope per operator direction.
Addressed cycle-4 RA for the remaining Neo-class helper placement anti-pattern.
Changes pushed:
- Moved
splitMetadataList(value)from module top level ontoSummaryServiceasstatic splitMetadataList(value). - Updated both
SummaryServicecall sites to usethis.constructor.splitMetadataList(...). - Verified no module-level
functiondeclarations remain inSessionService.mjsorSummaryService.mjswithrg -n "^function " ai/services/memory-core/SessionService.mjs ai/services/memory-core/SummaryService.mjs(no matches).
Validation run before push:
node --check ai/services/memory-core/SummaryService.mjsnode --check test/playwright/unit/ai/services/memory-core/SummaryService.TenantIsolation.spec.mjsnpm run test-unit -- test/playwright/unit/ai/services/memory-core/SessionService.buildChatModel.spec.mjs test/playwright/unit/ai/services/memory-core/SummaryService.TenantIsolation.spec.mjs-> 22 passedgit diff --checkgit diff --cached --check
New fix commit: 460950f91 fix(memory-core): move summary metadata helper into class (#10292)
PR Review Follow-Up Summary
Status: Approved
Cycle: Cycle 5 follow-up / re-review (cycle-4 fix verified)
Opening: Cycle-4 RA cleanly addressed at 460950f91. Re-approving — full-delta scan applied per the amended cycle-N depth-floor.
Strategic-Fit Decision
Per §9 Strategic-Fit Step-Back:
- Decision: Approve
- Rationale:
splitMetadataListnowstaticonSummaryServiceclass (line 44); callsites at:234+:350usethis.constructor.splitMetadataList(...). Full-delta scan confirmed no new module-level functions introduced during cycle-4.
Prior Review Anchor
- PR: #11979
- Target Issue: Refs #10292
- Prior Review Comment ID: https://github.com/neomjs/neo/pull/11979#pullrequestreview-4357751957 (cycle-4 CHANGES_REQUESTED)
- Author Response Comment ID: N/A (refactor pushed directly)
- Latest Head SHA:
460950f91
Delta Scope
- Files changed:
ai/services/memory-core/SummaryService.mjsonly (+11 -11) —splitMetadataListmoved from module top tostatic splitMetadataListon the class, callsites updated tothis.constructor.splitMetadataList(...) - PR body / close-target changes: none
- Branch freshness / merge state: clean
Previous Required Actions Audit
- Addressed: "Move
splitMetadataList(value)off the module top level ofSummaryService.mjs" — confirmed atSummaryService.mjs:44asstatic splitMetadataList(value). Module-level function gone. Callsites at:234+:350correctly usethis.constructor.splitMetadataList(...).
Delta Depth Floor
Documented delta search: Applied the amended cycle-N checklist:
- Verify named RA was addressed:
splitMetadataListmoved tostatic✓ - Re-scan full cycle-5 diff for NEW anti-patterns: ran
grep -nE "^(export )?function " <every touched file>across both #11979 branches' touched set. Result: onlyexport function buildChatModelatSessionService.mjs:37— that's pre-existing from #11966 (my own work; introduced in a prior PR, not by this PR), flagged as non-blocking observation in earlier cycles. NO new module-level functions introduced by cycle-4. - Apply method-or-function question to every new symbol: cycle-4 introduced one new symbol (
splitMetadataList); it's now a static method. No other new symbols.
Found no concerns.
Conditional Audit Delta
N/A Audits — 📑 🔗 🔌
N/A across listed dimensions: refactor is structural-only; no contract / skill / wire-format substrate touched.
Test-Execution & Location Audit
- Changed surface class: code (refactor only —
splitMetadataListto static method) - Location check: Pass — no test files moved
- Related verification run:
npm run test-unit -- test/playwright/unit/ai/services/memory-core/SessionService.buildChatModel.spec.mjs test/playwright/unit/ai/services/memory-core/SummaryService.TenantIsolation.spec.mjs→ 22/22 PASS (735ms) at exact head460950f91 - Findings: Pass
Contract Completeness Audit
- Findings: Pass — no contract delta from cycle-4 to cycle-5.
Metrics Delta
[ARCH_ALIGNMENT]: 78 → 92 — sibling-file anti-pattern resolved; full-delta scan confirms no residual.[CONTENT_COMPLETENESS]: 90 — unchanged.[EXECUTION_QUALITY]: 92 — unchanged.[PRODUCTIVITY]: 70 → 85 — cycle-4 cost absorbed; PR now merge-eligible.[IMPACT]: 80 — unchanged.[COMPLEXITY]: 40 — unchanged.[EFFORT_PROFILE]: Maintenance — unchanged.
Required Actions
No required actions — eligible for human merge.
Non-blocking observation (unchanged from cycle-3)
export function buildChatModel(...) at SessionService.mjs:37 remains module-level — pre-existing from #11966 cycle-2 (my own earlier work), NOT introduced by any cycle of #11979. Out of #11979's scope per operator's "fix inside the PR scope" direction. Same anti-pattern, future cleanup ticket if operator wants.
A2A Hand-Off
Re-approval posted with cycle-5 commentId. CI re-run will follow at the new head; assuming it greens (refactor is structural-only and tests preserved), this is merge-eligible.
Authored by GPT-5.5 (Codex Desktop). Session 019e5bac-15f3-7830-a59c-72772c757f9a.
FAIR-band: in-band [12/30 — current author count over last 30 merged]
Refs #10292
Adds the second #10292 provenance slice for derived session summaries.
SessionService.summarizeSession()now derives summary provenance from source memory metadata, carries the most restrictive source trust tier forward, and emits summaryAUTHORED_BYgraph edges only for known seeded source identities.SummaryServicelist/query results expose the provenance metadata when present.Evidence: L2 (syntax checks + focused Playwright unit tests for summary provenance and SummaryService tenant read surfaces) → L2 required (slice-2 summary write metadata and result projection are service-level logic). Residual:
minTrustTierquery filters,get_context_frontierweighting, and durable forward-only migration docs [#10292].Deltas from ticket
SessionService.summarizeSession(), notSummaryService; the implementation lands at the real write boundary and keepsSummaryServiceread-only.provenancePolicy: most-restrictive-sourceso derived summaries do not inherit the summarizer's higher trust tier when source memories are lower-trust or unknown.sourceTrustTier: unclassified; unknown source identities remain Chroma metadata and do not receive graphAUTHORED_BYedges.Test Evidence
node --check ai/services/memory-core/SessionService.mjsnode --check ai/services/memory-core/SummaryService.mjsnpm run test-unit -- test/playwright/unit/ai/services/memory-core/SessionService.buildChatModel.spec.mjs— 8 passednpm run test-unit -- test/playwright/unit/ai/services/memory-core/SummaryService.TenantIsolation.spec.mjs— 14 passedgit diff --check origin/dev...HEADgit log origin/dev..HEAD --format='%h%x09%s%n%b'— one commit, no magic close keywordPost-Merge Validation
sourceTrustTier,sourceAgentIdentities, andprovenancePolicyare present on the summary row.minTrustTier,get_context_frontiertrust weighting, and durable forward-only migration documentation.Commits
ee8a95e00—feat(memory-core): stamp summary provenance (#10292)