The KB Chroma client reaches the live canonical collection from unit specs

Context

Delivered-half leaf of #16617, filed so a PR that closes exactly this can say Resolves truthfully. #16617 retains the backup.spec.mjs live-plane coupling and the two-plane-state control; this leaf is only the KB Chroma isolation.

The Problem

ai/services/knowledge-base/ChromaManager.mjs created its client with no database:

this.client = new ChromaClient({host, port, ssl: false});   // -> Chroma's default database

So any unit/ spec touching KB Chroma reached the live canonical collection. Memory Core has isolated its Chroma writes all along (ensureChromaTestDatabase, assertCollectionNotProdBleed); KB had none — its only UNIT_TEST_MODE mention was unrelated JSDoc about a confirmation token.

The Fix

Consume the existing authority rather than adding a second one: the same ensureChromaTestDatabase from chromaTestIsolation.mjs, at the same point in connect(), for the same reason — the test database must exist before the first lazy getOrCreateCollection. Selection is declarative per ADR 0019: two leaves plus a formula mirroring the sibling memoryCoreDbPath, so the manager reads one resolved value and holds no env ternary. Test database is per-worker (pid-keyed) so fullyParallel workers cannot drop each other's collections.

Acceptance Criteria

• The KB client passes database explicitly, resolved from config.
• ensureChromaTestDatabase is called before the first collection resolve, and only when a declared toggle selected test mode.
• Selection is declarative — no process.env read in the manager.
• The test database is per-worker.
• A spec asserts the precondition first: if no declared leaf selected test mode, the isolation assertions are vacuous and must fail loudly.
• The new declared paths are recorded in the config-leaf parity snapshot, so a later silent removal is reviewable.
• The existing KB services suite is unchanged as a collateral control.

Out of Scope

• backup.spec.mjs live-plane coupling and its sibling-abort behaviour — stays on #16617.
• The two-plane-state negative control (populated and empty) — stays on #16617; only the populated arm is producible here.

Avoided Traps

• A second isolation mechanism beside the existing one. The ticket that motivated this asks for one authority, so this consumes chromaTestIsolation rather than reimplementing it.
• Trusting a green suite as proof of isolation. 487 tests passed before the change and would have passed after an inert one. The precondition test is what distinguishes working isolation from a no-op.
• Assuming the leaves suffice. They read undefined in a peer's process without a parity-snapshot entry, which would make the isolation inert exactly where the author cannot see it.

Related

#16617 (parent, retains the remaining ACs) · ADR 0019 (declarative leaf contract).

Live latest-open sweep: latest 20 open issues checked at 2026-08-08T09:22Z; no equivalent found — #16617 is the parent, not a duplicate.

Origin Session ID: 4141258c-36d3-4788-b0c2-ab3ebe0867be

Retrieval Hint: query_raw_memories("KB ChromaClient no database unit spec reaches canonical collection, ensureChromaTestDatabase")