Saved context for the operator
The operator uses durable working notes and cross-session memory through the same storage seams as execution. Context is advisory; stored text supplies no authority.
- Code:
src/core/dispatch/unitSeedProof.ts,src/core/dispatch/workFreshness.ts,src/core/confirmations.ts,src/core/dispatch/confirm.ts,src/core/dispatch/route.ts,src/core/coordinator/unitStatus.ts,src/core/references/unitStatusReference.ts,src/core/dispatch/contextSeed.ts,src/core/dispatch/mainAudience.ts,src/core/dispatch/operatorNotes.ts,src/core/dispatch/operatorMemory.ts,src/core/dispatch/operatorContext.ts,src/core/dispatch/operatorTail.ts,src/core/dispatch/contextAccess.ts. - Tests:
src/core/dispatch/unitSeedProof.test.ts,src/core/dispatch/workFreshness.test.ts,src/core/confirmations.test.ts,src/core/dispatch/confirm.test.ts,src/core/dispatch/route.test.ts,src/core/coordinator/unitStatus.test.ts,src/core/dispatch/contextSeed.test.ts,src/core/dispatch/mainAudience.test.ts,src/core/dispatch/operatorNotes.test.ts,src/core/dispatch/operatorMemory.test.ts,src/core/dispatch/operatorContext.test.ts,src/core/dispatch/operatorTail.test.ts,src/core/dispatch/contextAccess.test.ts.
Behavior
Notes reads start from run identities already admitted by the caller's run-read capability. Each run must match the current thread and destination. Another requester's notes require the canonical producer origin and a current source visibility check; public origin access uses the current reader without rewriting the original producer. Its persisted session key is canonical, including a unit lane; an absent identity does not invent an agent session. Each distinct session is read once.
The notepad is read independently of transcript compaction. The full typed dependency envelope is checked after reading the note snapshot, so a concurrent source dependency cannot be omitted from its checks. Unknown, revoked or unsupported full source provenance omits that note with an explicit unavailable reason. The independent legacy Slack tracker does not veto a known full envelope. A known typed dependency envelope passes the current source revalidator before the operator receives text; legacy metadata alone cannot establish source-free notes. A private destination also passes the existing private-audience check. No transcript prose or tool name establishes source authority.
Memory retrieval admits only the request's allowed scopes and records whose exact frozen content revision and bounded context dependencies pass a current source-owner read capability. Its immutable content digest must match before that capability is called; source run identity alone cannot establish that inherited inputs remain readable. Both keyword retrieval and repository-window listing filter before context rendering. Missing legacy dependencies, modified content, denied or unavailable source checks, scope mismatches and failed store reads omit the affected records while preserving independently authorized context. Every admitted memory scope is also retained as an access dependency, so transformation or a public producer cannot widen a private user memory's audience. The read returns the admitted dependency union beside the rendered block, so downstream producers preserve the same envelope. Empty reads may return known-empty dependencies because no source bytes were consumed. Memory remains disabled when its existing config is off.
Notes, memory and conversation tails return the dependency closure of every admitted byte beside their content. The operator records the union before asking the model. Shared conversation rows carry explicit individual envelopes; a missing or denied row is omitted without discarding other proved rows. Legacy working logs require a known complete envelope checked after the byte snapshot. Thread history uses the shared session first, with canonical authorized run sessions supplying bounded migration context when the new log is empty or contains only this admitted request.
The message-bound context reader checks original run identities and current requester grants. Completed runs use their retained dependency and source-action archives, never a later shared session. Stored actions are freshly inspected with their original owner, session and query; consuming saved context does not execute them again. Memory must preserve its canonical producer's dependencies. Repository metadata and README content preserve the original exposed repository names as one bounded catalog-access leaf. Reuse checks each original name is still in the current public requester-authorized catalog; README edits do not invalidate an earlier content snapshot. Catalog overflow is named and never silently drops dependencies. Artifact recovery pages through the greatest frozen source cursor and excludes later events.
Publication revalidates the actual admitted input envelope (the seed plus new context admissions) alongside existing live source checks. It validates a frozen snapshot and retries once if admission changed during the asynchronous check; continued change, unknown or missing proof, denied access and unavailable validation withhold publication. Cumulative retained/export context remains separate: omitted legacy rows or fresh opaque results can leave it unknown and unavailable for reuse without blocking a fresh answer whose admitted inputs and live source checks pass. No omission clears retained dependencies.
A committed coordinator delivery can add a separate typed status observation to the shared conversation. It includes the work identity, allowlisted result, attempt, canonical delivery or recovery label, and a PR pointer only when bound to a terminal outcome. It excludes report, title, reason and error prose. Its dependency points to the exact immutable stored observation; a newer unit status cannot replace it. Reuse requires the current canonical unit owner, repository and audience, including a private worker's original main-task link. Missing legacy proof skips this optional observation without blocking the existing raw delivery. Raw reports keep unknown provenance. The main agent can use an admitted work identity to request current details.
A committed ordinary-session checkpoint can replace equivalent run-origin identities before a long history or note closure reaches its bound. The reader verifies the exact retained seed, canonical membership and current origin audience. It preserves each admitted item's external dependencies; later unrelated sources are not imported into an earlier row. Prepared, missing or changed checkpoints confer no access. Notes normalize individual canonical origins before union; shared history checks individual rows before normalization.
The operator revalidates its exact admitted inputs before publishing or persisting model text and before applying a decision. A revoked or unavailable source withholds the decision without persisting its text or starting its effects. Pending questions and proposals retain that same input envelope on their canonical record; a later answer reads and validates that record before joining its text or binding a bare assent. Missing legacy proof makes the pending decision unavailable.
Validation criteria
| Criterion | Proof |
|---|---|
| Notes use canonical authorized run identities, survive compaction with typed provenance, revalidate sources and destinations, reject legacy/unknown/revoked dependencies without failing other notes, and never derive authority from transcript text. | [unit] src/core/dispatch/operatorNotes.test.ts::operator working notes::* |
| Memory filters both retrieval paths by admitted scope and current exact source identity; missing or denied source provenance never enters the model block, failures preserve safe records, and disabled memory performs no reads. | [unit] src/core/dispatch/operatorMemory.test.ts::operator memory source reads::* |
| Current context access checks canonical original identities and retained source actions, rejects revoked or missing proof, binds memory to its producer and paginates artifact recovery through the frozen cursor; live artifact sources with missing or invalid cursors fail closed before events are read. | [unit] src/core/dispatch/contextAccess.test.ts::message-bound context access::pages live artifact events through the greatest frozen cursor and excludes later events; [unit] src/core/dispatch/contextAccess.test.ts::message-bound context access::* |
| Tail snapshots are checked after reading bytes and omit unavailable sources while preserving admitted dependency closures. | [unit] src/core/dispatch/operatorTail.test.ts::operator source-aware tail::* |
| Recent ordinary row identities normalize through canonical checkpoint membership before access checks; expired identities outside the bounded window are omitted while recent summaries remain usable. Explicit mismatched checkpoint hashes and external source dependencies cannot be erased. | [unit] src/core/dispatch/operatorTail.test.ts::operator source-aware tail::normalizes canonical recent row identities before access checks and merging a long shared history, ::omits a row outside the proved identity window without tainting its recent neighbor; [unit] src/core/dispatch/contextAccess.test.ts::message-bound context access::normalizes retained identity aliases before access without erasing mismatched checkpoint hashes or external leaves |
| A saved pending decision comes only from a finished canonical door event in the same channel and thread. Its original producer identity and complete known dependencies pass current access checks after the bytes are read; missing, live, legacy or revoked proof is unavailable. | [unit] src/core/dispatch/contextAccess.test.ts::canonical saved operator decisions::* |
| Operator confirmation offers persist their exact input dependencies with an explicit discriminator. A click reads the stored bytes before rechecking current source access, repeats the check before command effects and output, and carries a final publication check to the reply boundary. Invalid proof cannot become a legacy offer; typed source-free offers keep their existing behavior. | [unit] src/core/confirmations.test.ts::the offer's words and the stored message::preserves exact operator dependencies and refuses a present malformed derivation without legacy fallback; [unit] src/core/dispatch/route.test.ts::mintConfirmationOffer — risk projection::stores the operator's exact dependencies and cannot mint an operator row with missing proof; [unit] src/core/dispatch/confirm.test.ts::consumeAndRun — the stored input runs once, as the requester, through the typed path (record 0044)::revalidates operator context after consuming the saved bytes before any effect or decision event, ::runs an unchanged operator offer and carries a fresh publication check to the reply boundary, ::withholds an operator offer with …, ::withholds command output and answer events when source access changes during execution |
| Ordinary conversation continuations use a committed canonical checkpoint to keep their source envelope bounded across process restarts; original membership remains in the retention index and each new turn stays known beyond 64 runs. Fixture point reads synchronize only the exact canonical target without unrelated archive rewrites or cached authority; full-list, private projection and later-update semantics remain intact. | [unit] src/core/dispatcher.test.ts::dispatch::keeps ordinary conversation context known across 256 runs and fresh process facades; src/core/dispatcher.test.ts::dispatch::bounds canonical fixture point reads while retaining current context, updates and full list semantics |
| Composition preserves admitted note and memory dependencies and excludes unproved component text. | [unit] src/core/dispatch/operatorContext.test.ts::loadOperatorContext::* |
| Initial metadata, eager source text and lazy repository brief responses enter the model only after their repository access dependency is included in the operator callback. | [unit] src/core/dispatch/operator.test.ts::the operator's repository briefs::loads authorized notes, memory and connected repository README facts before binding a product-name request |
| New source captures retain original action and call identities, freeze exposed response hashes, and keep legacy referenced text or an exposed unfinished action unknown. | [unit] src/core/dispatch/contextSeed.test.ts::context dependency capture::* |
| Checked complete context admits compacted notes, summaries and typed handoffs; it cannot bypass a current private-destination refusal, and an absent or denied check does not establish authority. | [unit] src/core/dispatch/mainAudience.test.ts::main conversation source audience::uses the checked full context for compacted notes and handoffs while keeping the private audience gate |
| Publication checks a stable snapshot of the admitted inputs, retries a concurrent admission once and withholds when proof is unknown, unavailable or keeps changing. | [unit] src/core/dispatch/contextAccess.test.ts::publication of admitted context::* |
| Operator questions, preset routing and command effects are withheld when an admitted source is revoked during completion, while unchanged sources remain usable. | [unit] src/core/dispatcher.test.ts::durable operator conversation without an agent run::revalidates admitted operator memory before publishing or acting… |
| Pending questions and proposals cannot reintroduce revoked saved context through free-text answers or bare assent. | [unit] src/core/dispatcher.test.ts::durable operator conversation without an agent run::revalidates a pending decision before joining an answer or binding assent… |
| Every private preset rechecks admitted context before publication. A revocation during a checkpoint, parent lookup or report append withholds the next report or answer event; content already handed to storage remains subject to its retained read checks. | [unit] src/core/dispatcher.test.ts::dispatch::withholds inherited-memory answers and reports after source revocation during generation…, src/core/dispatch/runLoop.test.ts::runLoop — the model turn and everything that rides on it::withholds the next report and answer event after a late untrusted follow-up…, src/core/runLedger/threadSession.test.ts::thread session — durable turns and legacy context::rechecks publication after a blocked parent lookup before handing over parent bytes |
| Unit admission reads the exact persisted context under its canonical instance, unit, attempt and child step. Private workers resolve source visibility and the current destination through the original main-task link and fresh worker audience verification; retained MCP actions keep their original owner, action and session. | [unit] src/core/dispatch/contextAccess.test.ts::canonical unit context access::*, src/core/dispatch/contextAccess.test.ts::message-bound context access::freshly inspects retained original source actions without executing or rewriting them… |
| A committed coordinator delivery adds a separate allowlisted status row bound to its immutable snapshot and original unit. Raw reports remain unknown; current unit ownership, repository and private audience checks authorize later status reuse without interpreting report text. | [unit] src/core/coordinator/unitStatus.test.ts::committed coordinator status context::*, src/core/dispatch/contextAccess.test.ts::canonical unit context access::revalidates an immutable private work status independently of the adjacent raw report |
| Long histories and notes use only committed canonical checkpoint identities, preserve original source dependencies and continue checking current audience access. | [unit] src/core/dispatch/contextAccess.test.ts::message-bound context access::requires a committed canonical checkpoint with unchanged seed proof before accepting its marker, src/core/dispatch/operatorTail.test.ts::operator source-aware tail::normalizes canonical recent row identities before access checks and merging a long shared history, src/core/dispatch/operatorNotes.test.ts::operator working notes::normalizes canonical note origins before a long session reaches the dependency limit |
| An immutable raw report is created only after the canonical unit CAS admits that exact delivery and rendered proposal; a concurrent losing settlement cannot poison the winner's report. | [unit] src/channels/adminCoordinator.test.ts::the plan runner's steps — plan, unit-start, branch, round, unit-end, finish (item 9)::freezes only the winning proposal when same-delivery settlements race |
| Every current work observation is saved before exposure and keeps its own refresh obligation, including repeated reads of one unit. Before publication, a running-then-ended transition in either live or restored calls revises the answer once; further changes or unavailable proof yield an explicit unconfirmed answer without revoking the private audience. Restart checks bind each exact saved call/result and do not reset the refresh allowance. | [unit] src/core/dispatch/workFreshness.test.ts::current work answer freshness::revises an answer based on an earlier status even after a later status for the same unit; [unit] src/core/dispatch/workFreshness.test.ts::current work answer freshness::restores both statuses for the same unit and detects the earlier result's transition; [unit] src/core/dispatch/workFreshness.test.ts::current work answer freshness::* |
| A unit seed acknowledgment binds the canonical unit, attempt, brief, capsule and contract to the exact committed child messages and system prompt. An owner-fenced durable acknowledgment is required; restart validates the original seed. The canonical child role distinguishes admitted research, coding and review. Research requires its recorded phase selection and exact original research step; no seed acknowledgment implies provider execution began. | [unit] src/core/dispatch/unitSeedProof.test.ts::canonical unit seed acknowledgment::* |
| Actual status tool reads are recorded before exposure; a state change during generation triggers one tool-free follow-up on the same lease, updates the answer event, and preserves immutable archived proof. A second change emits an unconfirmed result without revoking the audience. | [unit] src/core/dispatch/runLoop.test.ts::runLoop — the model turn and everything that rides on it::refreshes current work before the final answer… |
| A work transition after the card closes replaces stale reply text and attached work details with the unconfirmed result, without creating an audience-refusal receipt. | [unit] src/core/dispatch/reply.test.ts::deliverAnswer — the answer reaches the thread::rechecks work state after the card closes without treating change as an audience refusal |
| Generic queued units, including coding units backed by the configured coordinator store, retain canonical handoff validation without requiring a main-work seed receipt when the brief is absent. A present invalid brief cannot bypass acknowledgment. A coding unit with a saved work brief acknowledges its exact seed before the first provider call; a failed ledger acknowledgment prevents that call. | [unit] src/core/dispatcher.test.ts::durable structured child context::persists the queued unit source before seeding and reconstructs tool evidence from canonical rows, src/core/dispatcher.test.ts::durable structured child context::requires the applicable coding seed acknowledgment before the first provider call… |