LearnNewsExamplesServices
Frontmatter
id15151
titleAdmit idempotent community batches into durable history
stateOpen
labels
enhancementaiarchitectureperformancesecurity
assignees[]
createdAt7:30 AM
updatedAt8:29 AM
githubUrlhttps://github.com/neomjs/neo/issues/15151
authorneo-gpt
commentsCount0
parentIssue15145
subIssues[]
subIssuesCompleted0
subIssuesTotal0
contentTrust
projected
quarantined0
signals[]
blockedBy[ ] 15150 Add tenant-scoped community source registration
blocking[ ] 15158 Bind community events to canonical A2A Tasks, [ ] 15157 Expose a temporal community Bird View and seen state, [ ] 15156 Push hosted GitHub community batches securely, [ ] 15155 Coordinate local GitHub community reconciliation, [ ] 15152 Reconcile GitHub issue activity exhaustively
milestonev13.2

Admit idempotent community batches into durable history

Open Backlog/active-chunk-6 enhancementaiarchitectureperformancesecurity
neo-gpt
neo-gpt commented on 7:30 AM

Context

Option I makes tenant-scoped Memory Core admission the neutral durable owner. Provider connectors acquire and normalize; Memory Core validates and atomically admits reproducible batches. K remains conditional only for acquisition that cannot be reconstructed.

This is one fully closeable PR leaf under Epic #15145. The live parent-child and blocked-by graph is authoritative; this body owns only this leaf's contract.

The Problem

Current snapshots and compacted GraphLog cannot represent immutable occurrence/revision history, batch retry receipts, monotonic admitted sequence, checkpoint CAS, or honest coverage gaps. Advancing a source cursor before durable receipt loses events; treating same batch id with different digest as retry hides corruption.

The Architectural Reality

The owning service lives under ai/services/memory-core/; MCP/SDK entrypoints stay thin. Operational tables share the current SQLite/WAL instance under ADR 0015. Tenant id is request/server authority, never caller authority. Automatic durable rows are metadata-only.

The Agent OS structure map was run on 2026-07-14. New service/script/test placement must use the named sibling-file-lift fast paths; no service logic moves into MCP server entrypoint directories.

The Fix

Implement community-activity-batch.v1, canonical digest, scoped batch receipts, immutable provider entity/occurrence/revision rows, monotonic admitted sequence, per-partition checkpoint/inventory CAS, explicit coverage/loss/tombstone semantics, and one service method usable by local direct calls and authenticated remote ingress.

Contract Ledger Matrix

Target Surface Source of Authority Proposed Behavior Fallback / Edge Case Docs Evidence
Batch admission Discussion #15139 I/OQ3 Atomic validate-admit-receipt transaction scoped by tenant/source/family Same id+digest idempotent; same id+different digest conflict OpenAPI/SDK contract Replay, collision, crash tests
Occurrence ledger OQ2-OQ4 Metadata-only immutable occurrence/revision facts with admitted sequence Unsupported history remains explicit gap Schema JSDoc Revision/tombstone/absence fixtures
Checkpoint CAS OQ3/OQ5 Advance only with accepted receipt and expected basis Conflict returns current server state without destructive advance Service docs Concurrent stale-basis tests
Ingress parity L/M neutral contract Local and remote facades call the same service method Auth/transport failure cannot partially admit Tool contract Byte-equivalent local/remote fixture

Decision Record impact

Depends on ADR 0036 and the neutral registration contract; aligned with ADR 0015; GraphLog remains CDC only.

Decision Record

Required: ADR 0036. This leaf is not code-ready until the ADR-0036 child of #15145 is accepted at the human merge gate.

Discussion Criteria Mapping

Upstream graduated criterion This leaf's executable contract
OQ2 Stores honest coverage gaps, explicit tombstones, and unknown absence semantics.
OQ3 Separates source, entity, occurrence, revision, batch, receipt, sequence, and checkpoint identities.
OQ4 Makes Memory Core the neutral durable owner; K is not activated.
OQ8/OQ9 Uses server tenant/source authority and one local/hosted admission contract.

Source authority: Discussion #15139 body at the version-bound graduation anchor plus Grace's STEP_BACK and GRADUATION_APPROVED.

Operator Scope Clarification — 2026-07-14

The community substrate is not a mirror of every GitHub repository notification. It separates:

  1. source occurrences needed to reconstruct supported issue, pull-request/review, and Discussion conversation state; and
  2. attention-eligible community items: externally authored, response-bearing occurrences that may need maintainer attention.

Stars/un-stars, forks, watches, and equivalent popularity telemetry are outside the community-event source families and cannot enter Bird View, counts, wake, or Task claim. Internal/rostered actions may update or resolve the state of an existing external item without minting new community attention. First-time versus trusted-repeat external status affects trust/projection, not basic eligibility. Bot eligibility must be an explicit ADR disposition and cannot be inferred from provider actor kind or trust tier.

Attention eligibility remains zero-authority: it does not assign work, enter LifecycleFrontier, or create a Task. Only the explicit canonical claim transition owns that promotion.

Acceptance Criteria

  • AC1 — A versioned canonical batch schema validates provider-neutral metadata and coverage.

  • AC2 — Same scoped batchId plus same digest is idempotent; a different digest is an integrity conflict.

  • AC3 — Occurrence/revision identity is distinct from provider entity, delivery, batch, and admitted sequence.

  • AC4 — Checkpoint/inventory state advances atomically only after durable acceptance.

  • AC5 — Stale registration epochs, cross-tenant sources, regressed checkpoints, and invalid gaps fail closed.

  • AC6 — Automatic rows contain no title/body/excerpt prose.

  • AC7 — Deletion requires explicit provider evidence; absence remains deleted/inaccessible/unknown.

  • AC8 — Crash, lost-response, retry, out-of-order, and CAS-race tests prove no loss or duplicate authority.

  • AC9 — Local direct and remote facades produce the same receipt contract.

  • AC10 — The canonical row carries an evidence-backed attention-eligibility disposition/reason separate from occurrence kind, provider actor kind, and trust projection.

  • AC11 — Out-of-scope popularity telemetry cannot be admitted as a community item; internal/rostered context can update or resolve an eligible external item without creating a new attention item.

Out of Scope

Provider polling/webhooks, source-owned durable outbox K, queue receiver O, Bird View, Task creation, retention compaction, or HA/multi-writer storage.

Avoided Traps

Do not use GraphLog as history, treat cursors as causal order, trust caller tenant ids, persist prose, or advance checkpoints before receipt.

Related

Origin Session ID: 837ad74b-c2d2-413d-9aab-b7165a93a82a

Handoff Retrieval Hints

  • community activity batch receipt CAS occurrence revision admitted sequence
  • Discussion 15139 option I K discriminator

Creation Freshness

Creation duplicate sweep: immediately before filing at 2026-07-14T05:30:29.035Z, checked the latest 20 open issues and last 30 all-state A2A messages. The independent broader audit at 2026-07-14T05:13:00Z covered open and closed issues, pull requests, A2A, ADRs, and code; no equivalent owner or foreign claim existed.