Keep mailbox tools available when summarization degrades

Context

During the 2026-06-08 cost-safety follow-up, the operator surfaced a peer-session failure while the Gemini key was removed:

Cannot execute list_messages: Memory Core is not fully operational:
  - GEMINI_API_KEY not set - summarization features unavailable

That is a release-blocking shape for Agent OS coordination. list_messages is the per-turn mailbox primitive, and it should remain available when only optional/cheap synthesis is degraded.

Live latest-open sweep: checked the latest 25 open issues on 2026-06-08T10:06Z. Adjacent issues exist (#12741 KB ask provider routing, #12742 default summarization to local provider, #12746 backfill pacing, #12748 local chat priority lane), but none scopes the Memory Core MCP health gate so mailbox tools survive summarization degradation.

Semantic duplicate sweep: used non-synthesis query_documents(type='ticket') because ask_knowledge_base is itself a sibling incident surface. Results were older mailbox/healthcheck tickets (#10149, #10180, #10147, etc.) and no current cost-safety health-gate leaf. Exact local sweep over resources/content/** surfaced the old mailbox identity/binding lineage and Discussion #12669's fail-soft summarization criteria, but no ticket for this health-gate bug.

The Problem

Memory Core currently has one broad MCP health gate for nearly every non-exempt tool. When the healthcheck status is degraded because the configured summarization provider needs GEMINI_API_KEY, HealthService.ensureHealthy() throws and BaseServer refuses the tool call before service dispatch.

That turns an optional synthesis/provider degradation into a hard block for A2A read paths. The result is backwards for incident recovery: when remote summarization is disabled or broken, agents most need list_messages, get_message, mark_read, and related mailbox primitives to coordinate the fix.

This is distinct from #12742. #12742 should make summary and mini-summary default local/remote-opt-in; this ticket ensures that even when summarization is unavailable, non-synthesis mailbox/read-path tools are not held hostage by that feature state.

The Architectural Reality

Verified source anchors:

• ai/mcp/server/BaseServer.mjs:326 calls healthService.ensureHealthy() for every non-exempt tool before dispatch.
• ai/mcp/server/memory-core/Server.mjs:85 only exempts healthcheck, start_database, and stop_database.
• ai/services/memory-core/HealthService.mjs:1541 rejects every status other than healthy.
• ai/services/memory-core/HealthService.mjs:1377-1383 marks missing Gemini credentials as degraded with GEMINI_API_KEY not set - summarization features unavailable when the active provider needs Gemini.
• ai/services/memory-core/MailboxService.mjs:599 implements listMessages() against RequestContextService, GraphService, and SQLite graph edges; it does not call the chat/summarization provider.

Current live Codex health projection also showed providers.summary.active = gemini / model = gemini-3.5-flash while the mailbox path remained available in this process because a stale key was still configured. The peer failure covers the complementary missing-key case.

The Fix

Make the Memory Core health gate capability-aware instead of all-or-nothing:

• Keep strict health gating for tools that require vector embeddings, Chroma writes, or synthesis.
• Allow mailbox/permission/read-path tools that only require graph/SQLite identity substrate to run when the only degradation is summarization/provider unavailability.
• Preserve hard failure when graph/SQLite identity substrate is unhealthy or unavailable.
• Add focused tests that reproduce list_messages being blocked by summarization-only degradation before the fix.

Implementation shape can be either a per-tool required-capability map in the Memory Core server, or a narrower HealthService method such as ensureHealthyForTool(name) that distinguishes mandatory dependencies from optional features. The important contract is that optional summary-provider degradation must not block mailbox coordination.

Contract Ledger Matrix

Decision Record impact

aligned-with ADR 0019. This ticket should not add a parallel provider config. It scopes tool health requirements around existing resolved config/provider state and service ownership.

Acceptance Criteria

• A Memory Core MCP dispatch test proves list_messages is allowed when health is degraded only because summarization/Gemini credentials are unavailable.
• Mailbox tools still fail when their real required substrate is unavailable: missing identity context, graph/SQLite unavailable, or permission denial.
• Tools requiring embeddings, vector search, memory writes, or summarization remain blocked when their required dependency is unavailable.
• healthcheck continues to report summarization/provider degradation visibly; this ticket changes dispatch policy, not observability.
• No runtime mutation of the shared AiConfig singleton in tests or implementation.

Out of Scope

• Changing the summarization default to local/remote-opt-in (#12742).
• KB ask provider routing (#12741).
• Backfill pacing / retry backoff (#12746).
• Billing reconciliation (#12743).
• Removing Gemini as an explicit remote provider.

Avoided Traps

• Treating key deletion as enough. It stops spend but can also break coordination if health gating remains too broad.
• Blanket-exempting all tools from healthcheck. That would hide real Chroma/graph failures and make errors less local.
• Folding this into #12742 without an explicit AC. Provider-default fixes reduce the chance of degraded summarization, but tool availability must be correct even when a provider is intentionally unavailable.

Related

Parent: #12740 Related: #12742 Related: #12741 Related: #12746 Related: #12748 Related: #10139

Origin Session ID: e8f07ef9-ef7e-4815-8ff4-7abe13720621 Retrieval Hint: "Memory Core health gate list_messages summarization degraded GEMINI_API_KEY not set mailbox coordination"