Option I makes tenant-scoped Memory Core admission the neutral durable owner. Provider connectors acquire and normalize; Memory Core validates and atomically admits reproducible batches. K remains conditional only for acquisition that cannot be reconstructed.
This is one fully closeable PR leaf under Epic #15145. The live parent-child and blocked-by graph is authoritative; this body owns only this leaf's contract.
The Problem
Current snapshots and compacted GraphLog cannot represent immutable occurrence/revision history, batch retry receipts, monotonic admitted sequence, checkpoint CAS, or honest coverage gaps. Advancing a source cursor before durable receipt loses events; treating same batch id with different digest as retry hides corruption.
The Architectural Reality
The owning service lives under ai/services/memory-core/; MCP/SDK entrypoints stay thin. Operational tables share the current SQLite/WAL instance under ADR 0015. Tenant id is request/server authority, never caller authority. Automatic durable rows are metadata-only.
The Agent OS structure map was run on 2026-07-14. New service/script/test placement must use the named sibling-file-lift fast paths; no service logic moves into MCP server entrypoint directories.
The Fix
Implement community-activity-batch.v1, canonical digest, scoped batch receipts, immutable provider entity/occurrence/revision rows, monotonic admitted sequence, per-partition checkpoint/inventory CAS, explicit coverage/loss/tombstone semantics, and one service method usable by local direct calls and authenticated remote ingress.
The community substrate is not a mirror of every GitHub repository notification. It separates:
source occurrences needed to reconstruct supported issue, pull-request/review, and Discussion conversation state; and
attention-eligible community items: externally authored, response-bearing occurrences that may need maintainer attention.
Stars/un-stars, forks, watches, and equivalent popularity telemetry are outside the community-event source families and cannot enter Bird View, counts, wake, or Task claim. Internal/rostered actions may update or resolve the state of an existing external item without minting new community attention. First-time versus trusted-repeat external status affects trust/projection, not basic eligibility. Bot eligibility must be an explicit ADR disposition and cannot be inferred from provider actor kind or trust tier.
Attention eligibility remains zero-authority: it does not assign work, enter LifecycleFrontier, or create a Task. Only the explicit canonical claim transition owns that promotion.
Acceptance Criteria
AC1 — A versioned canonical batch schema validates provider-neutral metadata and coverage.
AC2 — Same scoped batchId plus same digest is idempotent; a different digest is an integrity conflict.
AC3 — Occurrence/revision identity is distinct from provider entity, delivery, batch, and admitted sequence.
AC4 — Checkpoint/inventory state advances atomically only after durable acceptance.
AC5 — Stale registration epochs, cross-tenant sources, regressed checkpoints, and invalid gaps fail closed.
AC6 — Automatic rows contain no title/body/excerpt prose.
AC8 — Crash, lost-response, retry, out-of-order, and CAS-race tests prove no loss or duplicate authority.
AC9 — Local direct and remote facades produce the same receipt contract.
AC10 — The canonical row carries an evidence-backed attention-eligibility disposition/reason separate from occurrence kind, provider actor kind, and trust projection.
AC11 — Out-of-scope popularity telemetry cannot be admitted as a community item; internal/rostered context can update or resolve an eligible external item without creating a new attention item.
Out of Scope
Provider polling/webhooks, source-owned durable outbox K, queue receiver O, Bird View, Task creation, retention compaction, or HA/multi-writer storage.
Avoided Traps
Do not use GraphLog as history, treat cursors as causal order, trust caller tenant ids, persist prose, or advance checkpoints before receipt.
community activity batch receipt CAS occurrence revision admitted sequence
Discussion 15139 option I K discriminator
Creation Freshness
Creation duplicate sweep: immediately before filing at 2026-07-14T05:30:29.035Z, checked the latest 20 open issues and last 30 all-state A2A messages. The independent broader audit at 2026-07-14T05:13:00Z covered open and closed issues, pull requests, A2A, ADRs, and code; no equivalent owner or foreign claim existed.
Context
Option I makes tenant-scoped Memory Core admission the neutral durable owner. Provider connectors acquire and normalize; Memory Core validates and atomically admits reproducible batches. K remains conditional only for acquisition that cannot be reconstructed.
This is one fully closeable PR leaf under Epic #15145. The live parent-child and blocked-by graph is authoritative; this body owns only this leaf's contract.
The Problem
Current snapshots and compacted GraphLog cannot represent immutable occurrence/revision history, batch retry receipts, monotonic admitted sequence, checkpoint CAS, or honest coverage gaps. Advancing a source cursor before durable receipt loses events; treating same batch id with different digest as retry hides corruption.
The Architectural Reality
The owning service lives under
ai/services/memory-core/; MCP/SDK entrypoints stay thin. Operational tables share the current SQLite/WAL instance under ADR 0015. Tenant id is request/server authority, never caller authority. Automatic durable rows are metadata-only.The Agent OS structure map was run on 2026-07-14. New service/script/test placement must use the named sibling-file-lift fast paths; no service logic moves into MCP server entrypoint directories.
The Fix
Implement
community-activity-batch.v1, canonical digest, scoped batch receipts, immutable provider entity/occurrence/revision rows, monotonic admitted sequence, per-partition checkpoint/inventory CAS, explicit coverage/loss/tombstone semantics, and one service method usable by local direct calls and authenticated remote ingress.Contract Ledger Matrix
Decision Record impact
Depends on ADR 0036 and the neutral registration contract; aligned with ADR 0015; GraphLog remains CDC only.
Decision Record
Required: ADR 0036. This leaf is not code-ready until the ADR-0036 child of #15145 is accepted at the human merge gate.
Discussion Criteria Mapping
Source authority: Discussion #15139 body at the version-bound graduation anchor plus Grace's STEP_BACK and GRADUATION_APPROVED.
Operator Scope Clarification — 2026-07-14
The community substrate is not a mirror of every GitHub repository notification. It separates:
Stars/un-stars, forks, watches, and equivalent popularity telemetry are outside the community-event source families and cannot enter Bird View, counts, wake, or Task claim. Internal/rostered actions may update or resolve the state of an existing external item without minting new community attention. First-time versus trusted-repeat external status affects trust/projection, not basic eligibility. Bot eligibility must be an explicit ADR disposition and cannot be inferred from provider actor kind or trust tier.
Attention eligibility remains zero-authority: it does not assign work, enter LifecycleFrontier, or create a Task. Only the explicit canonical claim transition owns that promotion.
Acceptance Criteria
AC1 — A versioned canonical batch schema validates provider-neutral metadata and coverage.
AC2 — Same scoped batchId plus same digest is idempotent; a different digest is an integrity conflict.
AC3 — Occurrence/revision identity is distinct from provider entity, delivery, batch, and admitted sequence.
AC4 — Checkpoint/inventory state advances atomically only after durable acceptance.
AC5 — Stale registration epochs, cross-tenant sources, regressed checkpoints, and invalid gaps fail closed.
AC6 — Automatic rows contain no title/body/excerpt prose.
AC7 — Deletion requires explicit provider evidence; absence remains deleted/inaccessible/unknown.
AC8 — Crash, lost-response, retry, out-of-order, and CAS-race tests prove no loss or duplicate authority.
AC9 — Local direct and remote facades produce the same receipt contract.
AC10 — The canonical row carries an evidence-backed attention-eligibility disposition/reason separate from occurrence kind, provider actor kind, and trust projection.
AC11 — Out-of-scope popularity telemetry cannot be admitted as a community item; internal/rostered context can update or resolve an eligible external item without creating a new attention item.
Out of Scope
Provider polling/webhooks, source-owned durable outbox K, queue receiver O, Bird View, Task creation, retention compaction, or HA/multi-writer storage.
Avoided Traps
Do not use GraphLog as history, treat cursors as causal order, trust caller tenant ids, persist prose, or advance checkpoints before receipt.
Related
ai/graph/storage/SQLite.mjs, #15114, PR #15121Origin Session ID: 837ad74b-c2d2-413d-9aab-b7165a93a82a
Handoff Retrieval Hints
community activity batch receipt CAS occurrence revision admitted sequenceDiscussion 15139 option I K discriminatorCreation Freshness
Creation duplicate sweep: immediately before filing at 2026-07-14T05:30:29.035Z, checked the latest 20 open issues and last 30 all-state A2A messages. The independent broader audit at 2026-07-14T05:13:00Z covered open and closed issues, pull requests, A2A, ADRs, and code; no equivalent owner or foreign claim existed.