P1: Content Provenance Tracking — authoredBy edges + 8-tier trust taxonomy on Memory Core

Context

Sub-ticket of Epic #10291 — Organism Self-Defense substrate for cloud-phase #9999 deployment. First blocker primitive (P1 per Discussion #10289); foundation layer all other primitives depend on.

Ideation source: Discussion #10289 — §1 Content Provenance Tracking. Cloud-phase blocker sequencing per #10289 OQ 10: P1 ships before P6a/P6b and P2.

The Problem

Every piece of content an agent consumes currently carries no explicit provenance label. Memory Core queries return content without distinguishing AGENTS.md system mandate from peer-trusted-agent A2A from external-contributor ticket body. The agent treats all retrieved content with equal authority, which is incorrect once external agents enter the substrate (cloud-phase).

2026 Industry-Standard Alignment

Mitigates OWASP ASI06 Memory & Context Poisoning per the 2026 OWASP Top 10 for Agentic Applications. Implements the "Architecting for Memory Integrity" principle — authoritative author-provenance tracking at the ingestion boundary prevents retroactive memory-poisoning attacks where malicious content enters Memory Core without trust-tier attribution. Write-time provenance stamping is the defense; query-time tier filtering is the query-path consumer.

The Architectural Reality

• ai/mcp/server/memory-core/services/GraphService.mjs — node schema + edge creation
• ai/mcp/server/memory-core/services/MemoryService.mjs + SessionService.mjs — memory/summary ingestion write paths
• ai/mcp/server/memory-core/services/MailboxService.mjs — A2A message ingestion
• ai/mcp/server/memory-core/managers/StorageRouter.mjs — query-path enforcement for tier filtering
• ChromaDB metadata schema — vector embeddings need matching provenance metadata for semantic-search tier filtering

The Fix

1. 8-tier trust taxonomy (per Discussion #10289 §1):

• system (AGENTS.md / AGENTS_STARTUP.md)
• repo-trusted (skill files)
• owner (session owner input)
• self (current session prior thoughts)
• peer-trusted (other @neo-* agents via A2A)
• internal-authored (ticket/PR from swarm-internal agent)
• external (ticket/PR/comment from external contributor)
• unclassified (unknown authoring agent — defaults to external-tier)

2. authoredBy edges on every Memory Core node at write time:

• MEMORY nodes get AUTHORED_BY → AgentIdentity edge stamped from RequestContextService.getAgentIdentityNodeId()
• SESSION summary nodes carry the session owner's identity
• MESSAGE nodes already carry SENT_BY (per #10139 mailbox work) — reused as provenance signal

3. trustTier field on AgentIdentity nodes — enum value from the 8-tier taxonomy. System agents / repo-trusted sources get highest tier; unclassified-by-default on identity creation.

4. Query-path tier filtering:

• query_raw_memories, ask_knowledge_base, query_summaries gain optional minTrustTier parameter
• get_context_frontier weights results by trust tier (Retrospective daemon already uses edge weights)
• Default behavior: tier info available in results but not filtered — callers opt-in to filtering

Acceptance Criteria

• AgentIdentity nodes gain trustTier property (enum: the 8 tiers above).
• Memory Core write paths (memory, summary, mailbox, graph upsert) stamp AUTHORED_BY edges from current RequestContextService identity.
• Query tools accept optional minTrustTier parameter; when omitted, return all tiers with tier info in results.
• Playwright test coverage: write as each tier, query with minTrustTier filter, assert correct subset returned.
• Migration strategy documented for existing Memory Core content (Out-of-Scope below confirms forward-looking only, but document the decision).
• Downstream consumers (get_context_frontier, Retrospective daemon) updated to weight results by trust tier.

Out of Scope

• Retroactive provenance assignment to existing Memory Core content (per Epic #10291 Out of Scope) — forward-looking only.
• Cryptographic signing of provenance — this ticket establishes structural tier labels; cryptographic guarantees are a separate concern (OQ 1 in Discussion #10289).
• Cross-tenant provenance (multi-tenant-aware tier computation) — handled by the #10016 multi-tenant sub-epic; this ticket assumes single-tenant substrate per write.

Avoided Traps

• Inventing a new property name for provenance — rejected. authoredBy edge + trustTier on AgentIdentity reuses existing graph vocabulary from #10144. No new substrate.
• Filtering by default in query paths — rejected. Would break existing consumers that expect all content. Opt-in filter via minTrustTier.
• Storing tier on every node directly — rejected as denormalized. Tier lives on AgentIdentity; nodes carry AUTHORED_BY edge; queries traverse.

Related

• Parent Epic: #10291
• Discussion: #10289 §1 Content Provenance Tracking
• Identity substrate: #10144 (AgentIdentity node type), #10145 (OAuth2 MCP auth), #10146 (cross-tenant permission edges)
• Multi-tenant sub-epic: #10016

Origin Session ID: b02bd06c-a2cb-4aff-8af1-c4f2643c91be

Retrieval Hint: "content provenance tracking trust tier authoredBy edge memory core 8-tier taxonomy OWASP ASI06 memory integrity write-time ingestion"