Provenance: FM-week operator wishlist item 3, epic #14560. Body v2 (2026-08-03): re-premised after the terminal Drop+Supersede on PR #16400 (falsification · review · acceptance) and the co-planned producer-fork settlement with @neo-gpt-emmy. This ticket now delivers Leaf A of that settlement; Leaf B (recency-scope parity) and B′ (auth-doc repair) are separate successors.
Context
Lane A gave the cockpit identity-verified plane reads (PRs #16329/#16368/#16386). PR #16400 attempted a per-turn memories view and was correctly dropped: query_recent_turns is caller-userId-bound by fail-closed multi-tenant design (MemoryService.mjs AC4, per #12671), serves no peer rows, and consults neither memorySharing nor the reserved CAN_READ_MEMORIES_OF scope. The salvage map from that PR (wire verb, source seam, model/store/pane trio, dock placement, paging discipline, witnesses) is reusable on branch agent/16398-fleet-memories-view.
The Problem (unchanged in spirit, corrected in producer)
The operator managing the team through FM cannot see what any seat has been doing across sessions. The truthful, already-authorized cross-viewer read for this is the session-summary corpus: memorySharing=team is settled deployment-wide cross-author read authority per closed #12527, and summaries are its carrier.
The Architectural Reality (exact-claim V-B-A, 2026-08-03)
get_all_summaries is a registered plane op with per-agent filtering — live receipt from the authoring seat: get_all_summaries({agentIdentity: '@neo-gpt-emmy', limit: 2}) returned 2 rows of total: 253 cross-viewer, each carrying sessionId, timestamp, title, narrative summary, category, memoryCount, quality/productivity/impact/complexity metrics, technologies[], sourceAgentIdentities[] (sessions can be multi-agent — attribution is explicit), sourceTrustTier, provenancePolicy. Offset paging with honest total.- Both consumption modes ride the shipped boundary: plane mode via
planeClient.callTool('get_all_summaries', args); in-process via toolService.mjs:229 (get_all_summaries: SummaryService.listSummaries). Zero new Memory Core surface — this time with the exact-claim receipt, not the adjacent one.
- The product gets RICHER than the falsified per-turn shape: titles + narratives + metrics answer "what did this agent do lately" better than raw turn rows. Per-turn recall returns as Leaf B when scope parity lands.
The Fix (Leaf A, on the salvage branch)
fleetMemoriesSource.mjs — producer swap: injected getAllSummaries op; params {agentIdentity?, offset?, limit?}; viewer/target derivation and @me refusal unchanged; projection derivation removed (summaries carry no private axis; the source stays authority-free). Envelope: {capability: wired|unavailable, viewer, target, page: {offset, limit}, total, sessions, count} — fail-honest, no cache, offset echo for append-proofing.wireFleetMemoriesSource + devFleetServer — op injection renamed to get_all_summaries through the existing callHistoryOperation boundary.- App trio renamed to truth:
model/SessionSummary.mjs (convert-guarded title/summary strings, sourceAgentIdentities array), store/AgentSessionSummaries.mjs, MemoriesPane renders summary cards (title, stamp, category, memoryCount, compact metrics, attribution badge when a session lists co-authors beyond the target) with offset load-more while store.count < total.
- Witnesses: unit spec rewritten to the new contract;
FleetMemoriesNL e2e fixture updated to summary rows (including one multi-agent attribution row and one non-string title/summary guard row).
Contract Ledger Matrix (Leaf A)
| Target Surface |
Source of Authority |
Proposed Behavior |
Fallback |
Docs |
Evidence |
fleetMemories wire verb (request) |
FLEET_WIRE_METHODS SSOT + dispatchFleetRequest allowlist |
request carries {agentIdentity?, offset?, limit?} ONLY — canonical @identity target (viewer default, @me refused), non-negative integer offset, limit 1..50; caller-supplied viewer/projection fields are discarded before the operation call |
non-allowlisted method ⇒ {ok:false} at dispatch; invalid params ⇒ sanitized {ok:false} (source throws TypeError server-side) |
fleetWireMethods.mjs + source JSDoc |
unit wire-shape negative (op keys exactly [agentIdentity, limit(, offset)]) |
fleetMemories response envelope |
this ticket (v2) + fleetMemoriesSource.mjs |
{capability: wired|unavailable, viewer, target, page: {offset, limit}, total, sessions, count}; wired + empty claimed ONLY when the operation answered an empty page (total: 0 distinguishable from failure); failure/unrecognized ⇒ unavailable with reason, zero rows, total: null |
unwired source ⇒ bridge's honest unavailable envelope |
bridge verb JSDoc |
unit distinguishability + fallback specs; e2e renders |
get_all_summaries downstream call (consumed) |
MC MCP registration (toolService.mjs:229 ⇒ SummaryService.listSummaries); sharing authority #12527 |
consumed as-is with {agentIdentity, limit(, offset)}; zero MC-side change; summaries = team-visible corpus, no projection axis |
op absence/failure ⇒ unavailable envelope |
— |
live plane receipts (own total 14 / peer total 255) + in-process smoke |
| Target-state coherence (pane contract) |
Emmy's PR #16415 review (target = part of the rendered snapshot KEY) |
selection switch invalidates cards + continuation immediately; foreign-target envelopes not adopted; offset continuation fires only after the selected target's accepted page zero; rematerialization derives/receives the selection with the snapshot |
pending window renders honest "Reading X…" state |
pane JSDoc |
5 pane unit witnesses + e2e switch-pending scenario |
SessionSummary / AgentSessionSummaries / MemoriesPane (cockpit-internal) |
apps/agentos sibling trio conventions |
pane-local data.Store of data.Model records; non-string title/summary guarded to null at the model boundary; multi-agent sourceAgentIdentities rendered explicitly |
honest empty/degraded states |
JSDoc |
unit + e2e |
Acceptance Criteria (v2 — supersede v1 wholesale)
Out of Scope
Leaf B (recency-scope parity: queryRecentTurns resolving memorySharing with typed unscoped/denied/degraded/empty — own ticket, authority trail = Emmy's mining: #12527, #12671 AC4, reserved-scope status) · Leaf B′ (auth-doc repair of the misleading strict-scope prose) · semantic search UI (query_summaries) · write surfaces · D#16176 / D#16304 lanes · design-system work (the #14560 Lane-D offer to @neo-opus-vega stands).
Avoided Traps
No caller-chosen identity on the wire · no shadow authorization · no second truth (pane-local projection only) · data.Store of data.Model records · no adjacent-claim V-B-A: every producer assertion in this body carries a live receipt from the authoring seat · no reserved-scope wiring (per settled #12527; the reserved marker stays authoritative until explicitly reversed).
Related
Epic #14560 · PR #16400 (dropped, salvage carrier) · settled fork: comment · authorities #12527, #12671 · D#16408 (the no-blame/team-planning Discussion this arc seeded) · Lane-A spine PRs #16329/#16368/#16386.
Origin Session ID: 3ed7c4ca-19ff-451c-bce7-a3d8de2cbbeb
Retrieval Hint: "fleet memories view session summaries get_all_summaries scope parity" · branch agent/16398-fleet-memories-view.
Amendment history: v1 (2026-08-02) premised a per-turn view on query_recent_turns — falsified by @neo-gpt-emmy's live-plane review (see Provenance links). v2 (2026-08-03) delivers the co-planned Leaf A on the summaries producer with exact-claim receipts. The v1 text is preserved in the edit history; its salvage inventory remains accurate.
Context
Lane A gave the cockpit identity-verified plane reads (PRs #16329/#16368/#16386). PR #16400 attempted a per-turn memories view and was correctly dropped:
query_recent_turnsis caller-userId-bound by fail-closed multi-tenant design (MemoryService.mjsAC4, per #12671), serves no peer rows, and consults neithermemorySharingnor the reservedCAN_READ_MEMORIES_OFscope. The salvage map from that PR (wire verb, source seam, model/store/pane trio, dock placement, paging discipline, witnesses) is reusable on branchagent/16398-fleet-memories-view.The Problem (unchanged in spirit, corrected in producer)
The operator managing the team through FM cannot see what any seat has been doing across sessions. The truthful, already-authorized cross-viewer read for this is the session-summary corpus:
memorySharing=teamis settled deployment-wide cross-author read authority per closed #12527, and summaries are its carrier.The Architectural Reality (exact-claim V-B-A, 2026-08-03)
get_all_summariesis a registered plane op with per-agent filtering — live receipt from the authoring seat:get_all_summaries({agentIdentity: '@neo-gpt-emmy', limit: 2})returned 2 rows oftotal: 253cross-viewer, each carryingsessionId,timestamp,title, narrativesummary,category,memoryCount, quality/productivity/impact/complexity metrics,technologies[],sourceAgentIdentities[](sessions can be multi-agent — attribution is explicit),sourceTrustTier,provenancePolicy. Offset paging with honesttotal.planeClient.callTool('get_all_summaries', args); in-process viatoolService.mjs:229(get_all_summaries: SummaryService.listSummaries). Zero new Memory Core surface — this time with the exact-claim receipt, not the adjacent one.The Fix (Leaf A, on the salvage branch)
fleetMemoriesSource.mjs— producer swap: injectedgetAllSummariesop; params{agentIdentity?, offset?, limit?}; viewer/target derivation and@merefusal unchanged; projection derivation removed (summaries carry no private axis; the source stays authority-free). Envelope:{capability: wired|unavailable, viewer, target, page: {offset, limit}, total, sessions, count}— fail-honest, no cache, offset echo for append-proofing.wireFleetMemoriesSource+devFleetServer— op injection renamed toget_all_summariesthrough the existingcallHistoryOperationboundary.model/SessionSummary.mjs(convert-guardedtitle/summarystrings,sourceAgentIdentitiesarray),store/AgentSessionSummaries.mjs,MemoriesPanerenders summary cards (title, stamp, category, memoryCount, compact metrics, attribution badge when a session lists co-authors beyond the target) with offset load-more whilestore.count < total.FleetMemoriesNLe2e fixture updated to summary rows (including one multi-agent attribution row and one non-string title/summary guard row).Contract Ledger Matrix (Leaf A)
fleetMemorieswire verb (request)FLEET_WIRE_METHODSSSOT +dispatchFleetRequestallowlist{agentIdentity?, offset?, limit?}ONLY — canonical@identitytarget (viewer default,@merefused), non-negative integer offset, limit 1..50; caller-supplied viewer/projection fields are discarded before the operation call{ok:false}at dispatch; invalid params ⇒ sanitized{ok:false}(source throws TypeError server-side)fleetWireMethods.mjs+ source JSDoc[agentIdentity, limit(, offset)])fleetMemoriesresponse envelopefleetMemoriesSource.mjs{capability: wired|unavailable, viewer, target, page: {offset, limit}, total, sessions, count};wired+ empty claimed ONLY when the operation answered an empty page (total: 0distinguishable from failure); failure/unrecognized ⇒unavailablewith reason, zero rows,total: nullunavailableenvelopeget_all_summariesdownstream call (consumed)toolService.mjs:229⇒SummaryService.listSummaries); sharing authority #12527{agentIdentity, limit(, offset)}; zero MC-side change; summaries = team-visible corpus, no projection axisunavailableenvelopeSessionSummary/AgentSessionSummaries/MemoriesPane(cockpit-internal)apps/agentossibling trio conventionsdata.Storeofdata.Modelrecords; non-string title/summary guarded to null at the model boundary; multi-agentsourceAgentIdentitiesrendered explicitlyAcceptance Criteria (v2 — supersede v1 wholesale)
@merefusal, offset/limit validation, no projection or identity field ever sent on the op call beyondagentIdentitytarget (unit-witnessed).unavailableenvelope with zero rows — never fabricated empty history; wired+empty renders "no sessions" ONLY when the op genuinely returned an empty page withtotal: 0(unit-witnessed).fleet.planeBase) answers throughtoolService(smoke receipt).sourceAgentIdentities; offset append only on same-targetpage.offset > 0echo; load-more honest againsttotal; non-string title/summary guarded at the model boundary.ai/services/memory-core/+ai/mcp/server/memory-core/.unit/ai/services/fleet/ANDunit/apps/agentos/) + e2e green; JSDoc Anchor & Echo.Out of Scope
Leaf B (recency-scope parity:
queryRecentTurnsresolvingmemorySharingwith typedunscoped/denied/degraded/empty— own ticket, authority trail = Emmy's mining: #12527, #12671 AC4, reserved-scope status) · Leaf B′ (auth-doc repair of the misleading strict-scope prose) · semantic search UI (query_summaries) · write surfaces · D#16176 / D#16304 lanes · design-system work (the #14560 Lane-D offer to @neo-opus-vega stands).Avoided Traps
No caller-chosen identity on the wire · no shadow authorization · no second truth (pane-local projection only) ·
data.Storeofdata.Modelrecords · no adjacent-claim V-B-A: every producer assertion in this body carries a live receipt from the authoring seat · no reserved-scope wiring (per settled #12527; the reserved marker stays authoritative until explicitly reversed).Related
Epic #14560 · PR #16400 (dropped, salvage carrier) · settled fork: comment · authorities #12527, #12671 · D#16408 (the no-blame/team-planning Discussion this arc seeded) · Lane-A spine PRs #16329/#16368/#16386.
Origin Session ID: 3ed7c4ca-19ff-451c-bce7-a3d8de2cbbeb
Retrieval Hint: "fleet memories view session summaries get_all_summaries scope parity" · branch
agent/16398-fleet-memories-view.