Remove the destructive delete_all_summaries MCP tool

Context

Noticed while diagnosing the session-summary backlog (2026-06-09): the Memory Core MCP server exposes a delete_all_summaries tool that wipes session summaries. A mass-destructive operation on the agent-callable MCP surface is a footgun — especially as the summarization pipeline (turn mini-summaries + session summaries) becomes load-bearing for v13.

The Problem

• Any agent with Memory Core MCP access can call delete_all_summaries and destroy the SESSION_SUMMARY corpus the pipeline spends gemma4 cycles building.
• The {confirmation} string arg is weak protection on a tool that is agent-callable by construction; it does not gate against an agent that simply supplies the confirmation.
• There is no legitimate agent-facing reason to bulk-delete summaries at runtime. The destructive surface belongs off the MCP tool list.

The Architectural Reality

• ai/mcp/server/memory-core/toolService.mjs:19 — the MCP tool binding: delete_all_summaries: SummaryService.deleteAllSummaries.bind(SummaryService).
• ai/mcp/server/memory-core/openapi.yaml:487 — operationId: delete_all_summaries (schema loaded into every agent's context at tool-enumeration — per-agent context-tax).
• ai/services/memory-core/SummaryService.mjs:145 — async deleteAllSummaries({confirmation}) impl.
• The method is NOT orphaned (corrected via @neo-opus-ada /peer-role; V-B-A'd repo-wide). It is exercised by test/playwright/unit/ai/services/memory-core/SummaryService.TenantIsolation.spec.mjs (L133/164/178/300) — the #10000/#10128 multi-tenant safety guard: in cloud mode the delete scopes to the active tenant (collection.delete({where:{userId}}), NOT collection.drop()), and does NOT remove SHARED_USER_ID-tagged rows (asymmetric scope). Also referenced by learn/agentos/MemoryCore.md, learn/agentos/tooling/MemoryCoreMcpApi.md, and ROADMAP.md:24. The original AC#3 ai/-scoped grep was the blind spot that mis-classified it as orphaned.

The Fix (shape A — un-expose, do not delete)

• Remove the delete_all_summaries binding from toolService.mjs:19.
• Remove the delete_all_summaries operation from openapi.yaml:487 (also trims per-agent context-tax).
• KEEP SummaryService.deleteAllSummaries + its TenantIsolation.spec coverage — it is a tested, tenant-safe scoped-delete primitive, and is exactly the safe-delete primitive the #12830 gated corrupted-memory cleanup will reuse. It is simply no longer reachable via the agent MCP surface.
• Update docs that advertise the MCP tool: remove the tool entry from learn/agentos/MemoryCore.md + learn/agentos/tooling/MemoryCoreMcpApi.md; keep the ROADMAP.md:24 mention of the tenant-safe method.

Contract Ledger

Acceptance Criteria

• delete_all_summaries binding removed from toolService.mjs and operation removed from openapi.yaml.
• SummaryService.deleteAllSummaries method retained; SummaryService.TenantIsolation.spec.mjs retained and green (the #10000/#10128 tenant-safety guard is preserved).
• Repo-wide reference check (NOT ai/-scoped): grep -rn "delete_all_summaries" --include="*.mjs" --include="*.yaml" . → no MCP binding/operation references remain; the deleteAllSummaries method + its test still present.
• Docs updated: the delete_all_summaries MCP-tool entry removed from learn/agentos/MemoryCore.md + learn/agentos/tooling/MemoryCoreMcpApi.md; ROADMAP.md:24 tenant-safe-method mention retained.
• MC MCP tool list no longer advertises delete_all_summaries; tool-count specs updated + green.

Out of Scope

• Removing the underlying deleteAllSummaries method (it is a tested tenant-safety primitive; only the MCP surface is un-exposed).
• Auditing OTHER Memory Core MCP tools for destructive surface (worth a follow-up sweep; not this ticket).

Avoided Traps

• Gating behind a stronger confirmation instead of removing — rejected: any confirmation an agent can pass is not a guard; the operation should not be on the agent MCP surface.
• Deleting the method as "orphaned" — falsified by @neo-opus-ada /peer-role (V-B-A'd repo-wide): the method backs the #10000/#10128 multi-tenant safety regression test + docs + ROADMAP. An ai/-scoped grep missed them. Un-expose the MCP tool; keep the tested method.

Decision Record impact

none directly; preserves the #10000/#10128 multi-tenant tenant-safe-delete behavior (must not regress it).

Related

• #10000 / #10128 — multi-tenant identity + the tenant-safe deleteAllSummaries scoping this ticket must preserve.
• #12830 — corrupted-memory cleanup; its gated delete will reuse the tenant-safe scoped-delete primitive this ticket keeps.
• #12820 — the session-summary corpus this protects (builds-adjacent).
• #12778 — same runtime-safety theme.

Origin Session ID: 0f94aade-f9b1-4214-b17e-be0bdf33e2be Reshaped per @neo-opus-ada /peer-role (shape A) — Session 2feb15b9-1948-4553-9679-1419ed7eecf1. Retrieval Hint: "delete_all_summaries un-expose MCP tool keep tenant-safe deleteAllSummaries method TenantIsolation spec"