memory: canonical continuity plan, State Packet, and implementation status

Start here — memory reconciliation, 2026-10-04

This is the single coordination issue for shared contextual memory. It retains the State Packet implementation responsibility. The narrower issues below implement or evaluate parts of this plan; they are not competing architectures.

Product goal: tell one connected assistant a decision/correction once, then continue the same work in another without preparing a recap. Shared continuity does not require every client to become a worker inside a new master chat.

This revision supersedes conflicting implementation directions in the older issue descriptions, not their historical evidence. It does not activate a runtime, migrate history, merge implementation branches, or certify an endpoint.

One ownership model

Responsibility	Owner / existing mechanism
Original conversation, repository and tool evidence	Native source archives and repository revisions remain authoritative for what they recorded. A record of an assertion is not proof that the assertion is true.
Admitted z0 events, notes and source references	Existing `EventLog` (#63). Canonical for admitted z0 records, not a mandatory replacement archive for every provider transcript.
Temporal compression / exact expansion	Existing `OptMemTree` (#63); semantic compression and fresh-turn OptChat are the separate experiment #120.
Evidence retrieval	Existing AgentsView/FTS5 and QMD paths as controls where present; `ctx` read-only integration #116; TencentDB gateway as configured. No new memory database.
Scoped current understanding	Existing State Packet / context resolution here, using #66 identity, claim lifecycle, provenance and snapshots.
Capture, model-visible injection and outcome linkage	Thin harness adapters; reuse #62 identities/receipts. Capture, retrieval, injection and verified use are separate stages.
Execution permission	Existing harness policy / AODL. Memory, summaries, confidence and old approvals cannot grant new authority.
Evaluation / improvement	`kvnloo/z0evals#56`, existing outcome receipts and Evolution Lab. No separate memory judge or skill compiler.

TencentDB is a backend, not a guarantee that semantic extraction, embeddings or useful tenant data are active. ctx is an evidence capability, not the entire contextual plane. StatePacket is a bounded derived representation, not a new database or scheduler.

Audited implementation status

Repository inspection is pinned to master at 0159808f64a8e8d7f7ae36a5a9a238b1cd2d03d6. These are repository facts, not current process/host health checks.

Piece	Evidence	Status / limit
`EventLog`, memory contract, structural `OptMemTree`, State Packet	#109; tree implementation	Integrated on audited `master`. Tree summaries are counts/types/checksums, not semantic summaries. `cover()` uses estimated tokens and can raise `CoverBudgetExceeded`; exact `zoom()` is not proof of semantic discoverability.
Shared memory surface, capture and harness injection	`integrate/wiring-20261003`, compared 96 commits ahead of audited `master`	Branch-only integration. Do not tell a clean `master` installation that these files/hooks are already there.
Current `ctx` + DSH pull integration	Draft #121, head `158931b1a6429bfc70fd1c87d80d6e8ee8ebb966`, base `integrate/wiring-20261003` at `05e50151ec04ea40892be46645fb208aff2a1f70`	Not merged. Supersedes the isolated #117 integration direction; #117 remains historical bakeoff evidence. `ctx` stays outside automatic latency-sensitive push.
Host wiring / TencentDB client fixes	`feat/salvage-stack-metrics` is published at `d9a3615487ec54a2ca613ac6819809725328fa17`	Branch-only. The original #122 body saying “not pushed” is stale. No wholesale merge is authorized by this reconciliation.
Host setup acceptance	#122 closing receipt	Dated operator report: restarted OMP, completed ctx import, gateway/tunnel and seeded-cache checks. Also explicitly reports zero default-tenant hits, missing AgentsView and an unscored unified-memory study. Keep #122 closed for that bounded setup task, not as proof of universal continuity.
Semantic OptChat harness	#120; remote `feat/optchat-harness-v0` compared identical to audited `master`	Proposed, not implemented merely because the branch exists.

The #116 historical 26-question bakeoff reported control 6/26, ctx lexical 0/26, exact hydration 3/26, hybrid not run. This does not select a universal winner or justify a default cutover. See the measured report.

What must travel with a workstream

These are views over existing evidence, not four new stores:

relevant durable preferences and approval/budget boundaries;
project decisions, rationale, rejected approaches and explicit corrections;
active task/intent revision, unresolved references, exact artifacts, blockers and next permitted step;
bounded historical overview with recoverable source references.

Keep an active-work pointer per workstream/session, not one global “latest task.” Preserve the immediate exchange when exact wording matters. Persist meaningful deltas through an admitted, idempotent capture path; do not require the user to author handoff notes.

Corrections supersede claims only within the relevant scope and evidential context. A newer model assertion must not overwrite verified evidence merely because it is newer. Keep contradictions, observation/validity times and uncertainty explicit (#66).

One near-term sequence

Reconcile the existing implementation branches by content and tests. Pin the memory surface, ctx changes and host fixes; avoid reimplementing them from old issue pseudocode. Do not merge unrelated loop/Bend/metrics changes just to obtain memory.
Prove one two-client handoff. Capture a real decision plus a later correction in client A. Start a fresh supported client B on the same workstream. It must receive the corrected context at its actual model-input boundary, recover the cited evidence, and continue without asking for the known explanation.
Prove failure behavior before expansion. Test stale revisions, duplicate delivery, missing required evidence, unrelated workstream, excluded private scope, source outage and an obsolete cached claim. A last-known cache is labeled stale and cannot justify a freshness-dependent action.
Add the next endpoint through the same contract. Record capture, pull, push/model-visible injection, correction propagation and verification independently for each client. ChatGPT/here, mbp, 0, grok-bot, muse and dots are desired surfaces, not verified adapter identities or completed integrations. Resolve device versus harness identity during endpoint qualification.
Optimize only after the handoff works. Compare existing controls, ctx, temporal compression and optional semantic retrieval on the same frozen history. Shadow-route candidate retrieval recipes; promote only after measured benefit including maintenance and fallback cost.

The standalone OptChat experiment is not a prerequisite for steps 1–4.

Acceptance for this coordination issue

Exact implementation and client/host revisions recorded; merged, branch-only, host-reported and verified-use states remain separate.
One real two-client decision/correction handoff succeeds with no manual recap.
Evidence survives capture -> retrieve -> inject -> model use -> independent check; a search result or transport success alone is insufficient.
Every material included claim descends to an authorized source; missing required evidence causes OBSERVE/abstention.
Scope/trust filtering precedes ranking and applies to summaries, hydration and caches; no cross-project leakage.
Relevant source/policy/workstream revisions invalidate the packet; concurrent sessions cannot overwrite one another's active intent.
Duplicate/restart replay is idempotent; unsupported/offline adapters report an explicit limitation.
Sanitized receipts join the existing kvnloo/z0evals#56 study; no private transcripts are published.
Report re-explanations/corrections per handoff, stale or irrelevant injections, source reads, cold/warm latency, context tokens and cache behavior. Token estimates remain labeled estimates.

Issue ownership / disposition

Issue	Remaining role
#22	Canonical continuity plan, current-work State Packet and end-to-end acceptance
#23	Broader capability selection; alternative memory backends are optional experiments, not required migration work
#63	Existing admitted event ledger and temporal projection; no mandatory new master topology
#66	Enforce the existing identity/scope/claim/snapshot contract in runtime paths
#116	`ctx` pull adapter, query/hydration bakeoff and provider coverage; current implementation #121
#120	Optional semantic compression / fresh-turn OptChat experiment, not the shared-memory prerequisite
#122	Closed, dated host setup receipt; remaining cross-client continuity belongs here
#53 / #54 / #62	Reuse broader decision/state/credit and harness identity contracts; do not invent parallel memory receipts
#28 / #106	Optional context-selection research; preserve negative evidence and existing promotion gates
#100 / #112 / #113 / #114 / #118	Bounded provenance, external capability, instrumentation or host integrations; none selects a second canonical memory architecture

Directions retired by this reconciliation

A mandatory new tool-less master chat, or making every surface its worker, before shared context can work.
Reimporting all original history into another canonical raw database.
A compulsory Sibyl/Mem0/Graphiti bakeoff or universal backend switch before the current stack works.
Rebuilding StatePacket, MemorySnapshot, capture or receipt APIs from illustrative older names.
Treating structural tree tests, configured gateways, captured telemetry, a branch name or a closed setup issue as proof that the answering model remembered correctly.
Treating tree-cache rebuild as user-data erasure. Any actual erasure must cover source retention, replicas and derived caches under a separate explicit policy.

Existing authority, privacy and free-only policies remain unchanged. Bend stays in #48 as a verifier experiment, not the memory protocol or a condition for useful recall.

Cross-harness proof wave is now tracked in z0evals#56: kvnloo/z0evals#56

Execution split:

DSH: prove real AgentsView retrieval + next-turn model-visible injection through the existing pre-step/inject seam; keep PR chore(deps): bump actions/checkout from 4 to 7 #2's stdio path.
Hermes: reuse the existing z0 pre_llm_call adapter and MemoryPacketCache; prove packet provenance/cache invalidation rather than adding another cache.
OMO: keep automatic z0 routing OFF; finish native historical session enumeration/search and rely on AgentsView#2009 for canonical omo: source identity.
OMP: use feat: frozen Agent Orchestrator promotion evidence report #79's context-extension seam for shadow cognitive-state virtualization; compare native context vs minimal State Packet without changing canonical transcript.
z0evals#56: one frozen question set + common retrieval→injection→use→verification receipt across all four.

Important implementation gap on current master: z0int.context_resolve.v1 already preserves EvidenceRef provenance, gaps, source epochs, AODL projection, and observation receipts, but memory recall is intentionally off by default and the current capability surface is still narrow. Do not broaden it speculatively; add only what the four live proofs require.

Promotion gate: no harness counts as integrated merely because indexing/configuration exists. Require one real supported answer from injected evidence, one abstention/failure-injection case, one idempotent replay, and one supersession case.

Hermes RLM/State Packet consumer is now kvnloo/hermes-agent#320, reusing z0evals#56 rather than creating a private Hermes memory benchmark. First gate is shadow packet/provenance/cache invalidation; active context replacement comes later.

This is now an implementation/research child of the DecisionOpportunity + evidence-derived state RFC: #53.

Key addition from the frontier-gap work: the State Packet should be evaluated as an evidence-derived belief/state representation, not an authority object. It should preserve explicit unknowns, contradictions/supersession, provenance/freshness, intent revision, legal-action context, and outcome identity. The natural-unit research issue #57 should be allowed to falsify whether State Packet alone is the right control unit.

Consolidation receipt: the bodies of #22 #23 #63 #66 #116 #120 #122 are updated, and #28 #53 #54 #62 #100 #106 #112 #113 #114 #118 plus PRs #117/#121 now point to the same memory direction. Existing issue states and historical evidence were preserved; #122 remains closed for its bounded setup checks.

Docs are in #125: docs/memory-status.md, with entry points from AGENTS.md and docs/ONBOARDING.md. The inspected diff is 3 Markdown files, 127 additions, no deletions. It targets preview and is not merged; no runtime implementation, defaults, stored memory or benchmarks were changed. No new local/private host tests were run.

Use this issue's current body for sequencing, and the pinned docs for evidence. Older comments/prospective API names are historical, not alternate implementation instructions. The next product gate is one real two-client decision/correction handoff, not another memory framework.

Research follow-up — one correction-to-reuse behavioral proof (2026-10-07)

#137 remains the reuse child; this issue retains continuity and end-to-end acceptance. The existing implementations to continue are kvnloo/z0archy#35 (normalization) and draft #140 (reuse-packet contract). Neither PR establishes deployed enforcement. #66 now tracks bytes-to-packet freshness; #136 tracks evidence sufficiency; #47 tracks the actual harness write-boundary qualification.

Use the existing kvnloo/z0evals#56 study and #62 identities, not a new benchmark or transcript store.

Frozen fixture

The selected repo/ref already contains a tested HardenedResolver (fixture name), but the task does not mention its name. Client A records an initial decision and a scoped correction directing reuse of the existing owner/subsystem. A fresh supported client B continues the same workstream without a manual recap.

B retrieves the corrected source-backed decision and exact-ref implementation/callers/tests through existing capabilities.
The actual model-input boundary records the supplied evidence identity. Retrieval success alone does not satisfy this check.
feat: add revision-bound architecture reuse packet #140 receives sufficient required needs and independently validated revisions; the relevant control-plane: enforce dispatch leases and expose live z0 network snapshot #47 governed write path checks them before mutation.
The resulting choice and diff reuse/extend the existing primitive. Establish behavioral RED and GREEN, run the post-diff duplicate check, and join the independent outcome through RFC: Experience → outcome → counterfactual credit contract #54/integration: emit DecisionOpportunity + episode/credit records across OMP, Hermes, and DeepSeek #62.
Exact raw/source evidence remains recoverable after compression; superseded decisions, authorship and uncertainty survive.

Negative controls: stale same-metadata source replacement; wrong workstream; excluded private scope; missing required source; retrieval without injection; injection without reuse; a direct write bypass; duplicate delivery/restart; and a genuinely novel task with bounded coverage evidence. Unknown coverage must not become a claim that no reusable implementation exists.

Qualify one OMP consuming lane first, then Hermes and DSH independently through the same contract. This ordering does not replace the broader cross-client acceptance or force a new master/worker topology. Do not infer adoption from branch/CI state or expand providers/defaults before the behavioral baseline works.

This is the next acceptance fixture, not a test run or deployment report. The research's dates, effort estimates and ranking formula are proposals, not measured completion evidence.

Hermes native correction checkpoint — workstream z0-multiharness-20261009

Published bounded downstream adapter: c71b4e27883ae957fa64ed75364a7e7872a05672 on feat/hermes-multiharness-20261009, from the requested published integration 4c41fd5b148fb04e63b1f721ccf3ef564aa78330. Four Hermes-owned files only; no shared-core, OMP, Claude, launcher or active-profile changes. Kevin Rajan supplied the requirements/invariants; the adapter reuses existing EventLog/claim admission and native Hermes persistence; Hermes Agent implemented the downstream adapter and tests. Parent rerun: 200 focused tests passed.

A controller submitted fresh, explicitly synthetic D1/D2 as real Hermes user inputs in a dedicated home. Production admission preserves native identity, source digest, controller attribution, scope and explicit correction. Canonical claim events are 536/538; coordination readiness event is 539. Private evidence key: multiharness-20261009/hermes/ (D1-capture.json, D2-capture.json, ready-event.json). No fixture correction text is copied into another lane's task prompt.

A separate fresh Hermes consumer received only the workstream ID and receipt location. Its actual serialized provider request contained the corrected canonical packet, and its real response selected the corrected strategy. This establishes correction injection and response-level use, NOT an implemented or independently verified artifact. Native producer request-body witnessing was unavailable on the installed host; producer persistence and actual responses are retained separately.

Deterministic controls on the same captured events passed scope isolation, primed-D1 cache refresh, two-process replay/idempotency and canonical-source outage. Passive approval-authority and failed-verifier outcome-join checks passed with narrower coverage; live tool-dispatch approval and exact-artifact failure controls are still pending.

Earliest remaining gate: fresh Claude Code consumption through z0, then lane-owned unsteered OMP implementation, independent Codex verification and final Hermes outcome resumption. The full loop is NOT qualified. No new upstream Hermes PR or replacement memory backend.

Hermes native handoff checkpoint — z0-multiharness-20261009

A fresh, real Claude Code session consumed the Hermes-captured correction using the Claude-owned adapter at 0b58f42105bb970815af392abf6d453b22bf323c. Its only native task input was the workstream ID plus the existing receipt location. Native CLI UserPromptSubmit hook evidence contains the exact current claim/fresh fixture identity and marks the earlier value replaced. The real Claude response selected the corrected production-reuse strategy and recognized the superseded approach. Native input persistence and behavioral use are checked separately.

Immutable references: claims 536/538, initial ready 539, native Claude consumer ready event 547; consumer receipt SHA-256 3632fe9034329be302d1fee471d10c3cd42dfca6ae9db5700880b5dde297f905; native stream SHA-256 ecdd5c090351062556496d92ed68dc1c39b7a98ff9053179218e07461b2f7889. Private evidence key: multiharness-20261009/hermes/claude-correction-use.json. These two tracker copies describe ONE measured native session, not independent repetitions.

No OMP artifact was written by this Claude session. Full qualification remains false: next is Claude-supervised unsteered OMP through the owner's ordinary per-run approval path, fresh native Codex independent exact-artifact verification, then Hermes verified-outcome resumption. Codex's archival artifact replay and deliberately incorrect artifact failure control are explicitly not a fresh corrected-state execution. Four Hermes same-fixture memory controls passed; live approval-dispatch and same-new-artifact verifier-failure gates remain unqualified.

The earlier local Claude authentication blocker was resolved using the user's existing claude-home configuration. Only its valid access token was borrowed read-only into an isolated native proof home; no refresh grant or existing configuration/history was copied or changed. The existing public capture remains c71b4e27883ae957fa64ed75364a7e7872a05672 (200 focused tests previously executed); this checkpoint introduces no further source change and takes over no peer-owned adapter/launcher work.

Fresh-launch blocker audit (canonical owner delivery event 565): parent independently executed only the frozen runtime_env functions and existing production request normalizer, without launcher preparation/live execution or inference. The launcher strips an exported scoped-memory environment and assigns a random omp-live-* task; adding scope alone is rejected by the correct production stable-workstream guard. Matching-task control is accepted. This is a missing launcher-host binding, not an established shared-core defect.

Registered wrapper digest is 801975c522296a1eb8bc2dbd7c8bb28384b0aec3c8603d99e1ed5d5abfd51b88. It still selects historical source 1f8ec56dc6189d8735f1939792049f10fe00067d and a registry different from the frozen integration manifest at 4ac01fc18f80be6a741be6fd583906e68160be28. Owner checkout has since advanced; its pin checks must not be weakened. Recent peer preparations 548/562 use unrelated local/random-run scopes and contain neither current D2 claim identity nor its fresh nonce, so they are not evidence of this correction handoff.

Private reproduction key: multiharness-20261009/hermes/orchestration-readonly/parent-verification.json; script SHA-256 d027717deb2e3386084bf1044dfd1bb3f5a829a42cc07fc5ca9e3cc0d5f03851. Codex owns the fresh integration/workstream launcher binding; Claude owns OMP supervision. After owner publication, retain the ordinary native per-run approval with full-content/digest review. No historical approval transfers. No peer files, provider defaults, live sessions or gate policies were changed. The native Codex account/model restriction remains a separate owner-recorded gate.

Hermes read-only effectiveness and identifier-only continuity evaluation — z0-multiharness-20261009

Published exact tested commit: 285d74f18c68aec233b0be1bce472d9085bd5817, parent c71b4e27883ae957fa64ed75364a7e7872a05672. Four Hermes-owned reporting/recovery/test additions only. Local focused owning/adjacent suite: 211 passed; clean tree and diff check. Exact-head Core unit CI is successful, including offline-suite Python 3.11/3.13 and core-unit jobs. No new upstream Hermes PR, peer integration/OMP edits, production profile change, memory backend or routing activation. Kevin Rajan supplied the boundaries; Hermes Agent implemented this bounded evaluation and adapter.

Effectiveness report freezes EventLog 0–661: 662 events, nine verified blobs, 258 workstream events. DecisionReceipt has 6,166 rows/2,665 traces/3,501 revisions—not 6,166 calls. 904 latest traces name a compiler/planner. Six bounded native OMP traces establish 84 distinct completed response IDs, 145 tool proposals/results, 13 failed/denied results and six successful writes—not six independently qualified tasks. Provider-reported cost is zero with 84/84 coverage; invoice cost is unavailable. Reasoning-token coverage is 34/84. Tokenomics, preparation and shadow receipts are separately accounted; 51,539 of 51,622 backend-shaped shadow attempts are errors, and shadow executed-action count is zero. Estimates/claimed token savings are not measured paired savings.

Historical 536/538/649/659 were preserved, not recaptured or repeated. 649's exact artifact is functionally verified; strict_launcher_qualified and full_fresh_shared_acceptance remain false. The prior failed artifact and incorrect-identity control remain failures. 659 is historical consumption, not another independent artifact verification; its recorded r16 'oracle false negative' interpretation is not adopted.

A new empty-home, identifier-only Hermes session used ordinary lazy tool discovery/call of an opt-in read-only canonical z0 recovery adapter. The first serialized request contained neither the artifact answer nor the source receipt-directory hint; the actual later request contained the returned z0 evidence. The real response cites 649 and exact artifact digest, retains 616 as NOT superseded, and identifies ACT/proceed as read-only inspection under existing grants=['read'], with execution_permission=false. This qualifies an opt-in adapter smoke, not stock default installation or production adoption. The initial failed trial and the later generic citation/lineage-policy change are retained; this is not a controlled causal comparison attributing improvement solely to the adapter.

Scope isolation and byte-preserved historical stale-D1 recipe-cache/supersession controls pass. Actual unrelated-scope consumer receives no outcome. Source outage correctly yields unavailable/no outcome/no permission, but its response suggests a recap and overclaims corruption from the exception class. Strict outage-response/no-recap control is NOT PASS. Raw request witnesses, native SQLite rows, completions and that failure are private. Four new conversations used 12 observed logical API requests gated to the exact primary zero-priced free model, with paid fallback/rotation excluded; invoice/response-ID usage for this smoke is not collected.

Offline opportunity screening used unchanged opportunity/compiler/escalation code on 95 deduplicated parent completions. Four bounded observations are eligible: three read-back singletons (46.136 s historical model time, better handled deterministically), and one two-definition-span menu (7.021 s, the useful future learned-selection candidate). Total 53.157 s is addressable historical model time, not measured savings. Twenty opportunity negatives have zero false ACT; twelve compiler capability/budget/authority controls reject all actions. No inference/dispatch/routing from this screen. Zero observations are paired-benchmark/promotion-ready without a frozen independent selection oracle and matched prospective parent/SLM evidence.

Private evidence key: multiharness-20261009/hermes/effectiveness-continuity-20261009/. Entry points: REPORT.txt, effectiveness.json, native-continuity-verification.json, offline-controls/verification.json, future-paired-opportunities.json, FUTURE-PAIRED-PROTOCOL.txt, source/artifact manifests and final test/CI receipts. All 33 reporting-source prefixes were verified; six supplementary raw inputs/gates are retained for opportunity reproduction. Raw source/request proof stays outside Git.

Report SHA-256: ed87698dfb3af17630f9b26fe27053a2abc93af79798ed40358e24788d92de31.
Private core-proof archive SHA-256: ecd6e6c865618eaea234b52b1a99b0273a5e0226eca699557aba7de81b8cfa7f (134 archive members, readback verified). Later publication receipts and supplementary inputs are indexed separately. No unconditional system PASS, deployed enforcement, cache-regression diagnosis or measured SLM-versus-parent savings is claimed.

OMPB1-09 — revive #22: parked PR audit and the smallest clean Hermes continuity gate (analysis only; no implementation)

What was parked, and why

feat(memory): wire ctx into unified DSH memory pull #121 (PR, parking receipt): moved the read-only CtxHistoryCapability from the isolated feat(memory): add read-only ctx history capability #117 work onto integrate/wiring-20261003. It added ctx as a fourth explicit pull source in the shared memory surface/DSH z0-memory MCP, caller-neutral and keyword-shaped search, cwd-derived project scope (unknown fails closed), Core generation_id snapshots, exact ctx:event:<id> inspection, and DSH overlay/acceptance cases. It did not put ctx in automatic pre-step push or change authority/defaults. Closed unmerged; head 158931b1 retained. Immediate parking blocker: the underlying integrate/wiring-20261003 branch had not passed salvage unit H6. Even after H6, memory(ctx): read-only pull integration and evidence bakeoff (child of #22) #116's matched real-history, provider/Blame coverage, model-visible use and latency gates remain open (historical 26-question control 6/26, ctx lexical 0/26, hydrated 3/26; not a default-cutover verdict). Do not merge the aggregate branch just to obtain continuity.
docs(memory): consolidate continuity ownership and audited implementation status #125 (PR, parking receipt): reconciled ownership under memory: canonical continuity plan, State Packet, and implementation status #22/capabilities: replaceable evidence backends; memory direction lives in #22 #23/memory: admitted EventLog and OptMem temporal projection (child of #22) #63/memory: enforce scoped identity, claim lifecycle, and snapshots (child of #22) #66/memory(ctx): read-only pull integration and evidence bakeoff (child of #22) #116 and added a pinned docs/memory-status.md evidence index with AGENTS/ONBOARDING pointers; documentation only, no runtime behavior or new tests. Closed unmerged; docs head d76bff97 retained. Parking reason: not on the landing path of a runnable salvage unit; reopen if an actual consumer needs these docs. It is not a dependency of the first handoff.

Smallest qualified path: a Hermes profile with no memory provider

Pin and isolate rather than re-architect. Use one fresh, profile-scoped Hermes clean home; record Hermes/z0/plugin/claim-source hashes, workstream and model/policy revisions. Confirm no external memory.provider and disable the native memory control for a true no-recall baseline (memory.memory_enabled: false, memory.user_profile_enabled: false). In Hermes, memory.provider: "none" is a built-in-provider sentinel, not proof memory is disabled; unset/empty provider plus disabled native memory is the meaningful control. Do not share profile state or background context between profiles.
Reuse the existing narrow hook, not a MemoryProvider. The branch-only Hermes z0 adapter at 285d74f already has an opt-in pre_llm_call path: explicit context_memory_scope (contiguous user/project/repo/task), optional subject/predicate, a required memory InformationNeed, resolve_context(allow_memory=True, use_cache=False) over admitted source-backed EventLog claims, packet/source/snapshot validation, and bounded ephemeral {"context": "..."} injection. It does not require a Hermes memory-provider plugin, mutate the native transcript, or activate the separate ctx/DSH stack. This adapter and src/z0int/memory/claims.py are branch-only; the small master Hermes adapter lacks this scoped path. Qualify the exact pinned adapter in the isolated profile first; only reconcile the minimum supporting source if needed. Keep memory: admitted EventLog and OptMem temporal projection (child of #22) #63's ledger, memory: enforce scoped identity, claim lifecycle, and snapshots (child of #22) #66's scope/identity/claim lifecycle/snapshot contract, integration: emit DecisionOpportunity + episode/credit records across OMP, Hermes, and DeepSeek #62 receipts and native authority/AODL. No new database, router, cache, transcript migration, semantic download, paid backend or default activation.
Treat absent evidence as absent. Bad/unknown scope, mismatched source/policy/workstream revision, missing required evidence, contradiction, provider outage or invalid packet must not silently become a current claim or permission. Preserve sources and superseded claims; use OBSERVE/abstain for dependent decisions, while normal read-only Hermes behavior continues. The memory: enforce scoped identity, claim lifecycle, and snapshots (child of #22) #66 same-size/same-second freshness collision remains a specific qualification risk: bind the version to bytes actually consumed rather than trusting mtime+size. No cached historical approval authorizes a new action.

One acceptance test (reuse `kvnloo/z0evals#56`, not a new study)

Freeze a new, source-backed workstream: client A captures decision D1 and a later explicit, scoped correction D2 through the existing native admission path. Start a truly fresh clean Hermes B with only the workstream ID and a neutral continuation question—no answer, recap or receipt-directory hint. At the actual serialized model request, witness the corrected D2 packet, exact source event UIDs/revisions, scope and MemorySnapshot/packet hash. B must choose D2, mark D1 superseded (but recoverable), cite the original authorized evidence and select the next permitted step. Independently verify the response or resulting artifact; retrieval or transport alone is not success. Compare the same clean profile with the z0 hook disabled so a coincidental answer cannot be credited to the seam.

Required fail/negative controls: wrong workstream/private scope/cross-profile bleed; duplicate delivery and restart; stale source after equal-length, equal-second edit; missing source/outage; contradiction and obsolete cached claim; retrieval without injection; injection without correct use; forged remembered approval; and a failing independent verifier. Expect no cross-scope data, no double injection, bounded context, explicit absence/abstention rather than fabricated recall, no unauthorized write, and no verified_success without an independent check. Join existing #62 identity and DecisionReceipt.extra.memory to #56 with sanitized capture → retrieve → inject → use → verify evidence, exact pins, source reads, cold/warm latency, bytes/tokens and cache behavior. No private transcripts in Git.

Existing evidence is a starting point, not this PASS: #22's latest effectiveness receipt reports 211 focused tests, exact-head CI and a separate opt-in, identifier-only Hermes consumer smoke at 285d74f, but not stock clean-profile activation or full two-client product qualification; its strict outage-response/no-recap control failed. Previous Hermes/Claude correction consumers are useful historical controls, not a new independently verified artifact. The immediate goal is to close this one clean-profile model-input-and-behavior gap without un-parking #121 or #125.

Z01-MEM-CAPTURE

Draft PR: #197
Branch: feat/memory-workstream-capture-22
Base: preview@11e1454b4d5af60a4edccfc65bc53715568131e7
Exact head SHA: 705b1407bc50314e19ead74ceca79972bf538ed9
Status: Draft, NOT tested or activated; final connector comparison shows 13 changed files, no peer-owned shared files, no accidental placeholder in the final diff.

Existing code reused by content (no aggregate merge)

Identity-aware EventLog lineage and scoped references: integrate/wiring-20261003@05e50151ec04ea40892be46645fb208aff2a1f70.
Hardened EventLog, NativeUserClaimAttestation / scoped correction projection, Hermes native persisted-input adapter and original synthetic regression suites: feat/hermes-multiharness-20261009@285d74f18c68aec233b0be1bce472d9085bd5817.
Native capture choice: Hermes adapters/hermes_z0int/native_capture.py, not a new harness service. Hermes Agent retains original messages in native state.db; ledger retains only references and bounded admitted facts. Preserve source authorship, native UID/row/session, source SHA-256, full scope, role/speaker, locator and observed time.

Exact changed files

adapters/__init__.py
adapters/hermes_z0int/__init__.py
adapters/hermes_z0int/native_capture.py
docs/ONBOARDING.md
src/z0int/memory/__init__.py
src/z0int/memory/claims.py
src/z0int/memory/event_log.py
src/z0int/memory/surface.py
tests/test_hermes_native_capture.py
tests/test_memory_claims.py
tests/test_memory_event_identity.py
tests/test_memory_event_log.py
tests/test_memory_surface_capture.py

Completed code / coverage (synthetic only)

Existing stable EventIdentity event UID with payload-hash conflict; EventLog append/restart replay returns the admitted source identity instead of appending another source event.
Hermes adapter requires a trusted bound session, complete user/project/repo/task scope, persisted unmarked role=user row, native UID and row number, submitted-content SHA-256 match, source locator and typed attestation; rejects child sessions, tool/assistant rows, injected-form prose and ambiguous/mutated originals. Synthetic controller attribution remains distinguished from actual user evidence.
D1 then explicit same-scoped correction_of D2: prior claim/history retained, correction selected for that exact scope; sibling task excluded before reducer/snapshot; later model assertions cannot promote themselves to user decisions.
Disabled claim capture now rejects before writable EventLog construction (including no directory creation). Capture-only surface enforces explicit host-bound scope before touching identity/payload, offers read-only worker view and non-attesting reference ingestion; intentionally does not port unsafe legacy broad search/automatic brief behavior.
Reused ledger, identity, scoped-correction and Hermes native test suites, plus new disabled-capture and sibling/unknown-scope no-write controls. Static connector read-back verified key entry points, guards and 13-file diff. No tests executed; no test pass claim.

Precise blockers / ordered next slices (ownership)

Shared scope/freshness owner: pinned preview is missing BOTH src/z0int/memory_contract.py and src/z0int/context_resolve.py. Reconcile their canonical source content and same-bytes freshness contract in the separate peer slice. Both are strictly read-only in this PR. Until then this branch cannot import/run capture tests on unmodified preview. Do not clone contracts into memory/ or silently merge the aggregate branch.
OMP MBP verifier / capture owner: after (1), execute all focused commands below, review native persistence and event UID/hash/restart/scope/incomplete-ledger behavior, and resolve any failures in this PR's exclusive capture files. No code was executed by this worker.
Host wiring owner, kvnloo/.files: qualify the missing actual authorized Hermes host/session/task binding and explicit opt-in. Do not claim capture active or flip local profiles; this PR neither imports historical data nor activates hooks.
Read/freshness consumer owner, memory: enforce scoped identity, claim lifecycle, and snapshots (child of #22) #66/feat(memory): scoped read-only stdio MCP server #194: retain src/z0int/memory_mcp*.py ownership and read-only provider paths; separately qualify exact native source revision, scope before retrieval, outage/stale evidence and actual model-input injection. Those files are untouched.
z0evals#56 + native harness owners: freeze ONE real user D1 and later real explicit D2, then test fresh second-client consumption, original evidence hydration, denied sibling/unknown scope, duplicate/restart, wrong hash, injected brief negative control, model-input witness and independent verification. Current synthetic fixtures do not satisfy that experiment.

Exact OMP MBP commands (after shared dependencies land)

PYTHONPATH=src python -m pytest -q tests/test_memory_event_log.py tests/test_memory_event_identity.py
PYTHONPATH=src python -m pytest -q tests/test_memory_claims.py tests/test_memory_surface_capture.py
PYTHONPATH=src python -m pytest -q tests/test_hermes_native_capture.py

No live profile edits, host activation, semantic inference, imports of private records, second memory store/registry/bridge, secret exposure, default-branch push, merge or upstream writes. Continue only within this Draft PR and the explicit peer-owned slices.

OMP Z0Memory — final SYNTHESIS steps1–3 + frozen first-experiment case

All changes remain Draft, unmerged and inactive. Exact-head MBP checks used one job at a time,512MiB/1CPU,cooperative locks, and isolated Python3.13.13 for z0intelligence.

Gate	Draft / exact head	Exercised evidence
Step1 freshness/scope	#198,8aac6cf208d6be183332fffec68d64220d497fee	MBP20261023-005911-7e69:41 passed; GitHub rollup SUCCESS
Step2 one exact-source facade	#194 SAME branch,05142f1f998f83805c9b70223790f6e7e585981b	MBP20261023-004811-f20a:81 passed; GitHub rollup SUCCESS
Step3 scoped native capture	#197,3cd637c6ce6cbe21372c166b48899ab2a0336439	MBP20261023-010539-3ea8:159 passed,retained log exit0; GitHub rollup SUCCESS; stacked on verified#198
Frozen variant	kvnloo/z0evals#115,322b0e9c5154f0e89476202731619ad2d3c95e0d	MBP20261022-232007-3e38:8 fixture tests passed and3 study manifests validated; hosted validate successful; exact-head receipt corrected

Step1 recovers canonical contracts and #140 consumer, binds hashes to the same accepted bytes, independently rejects stale/missing required evidence, preserves policy/workstream/compiler/Git revisions and filters scope before metadata. Review additionally closed leaf/parent symlink TOCTOU and rename-path parsing.

Step2 qualifies only AgentsView full normalized message-content recovery, with native session+stable message ID+ordinal, principal-specific grants, reauthorization, content revisions, expiry,outage/stale/denied distinctions,redaction and bounded read-only transports. Other sources explicitly unavailable,not cached-snippet hydration. MBP/hosted RED exposed mutable signed identity aliasing; fixed the cache snapshot,not the assertion. Real native AgentsView HTTP recovery was separately exercised by the health lane; facade tests do not claim live ChatGPT recall.

Step3 reuses EventLog/claim/Hermes native persistence rather than rebuilding admission. Synthetic tests cover replay/restart,UID/hash conflict,scoped correction,non-user/injected rejection and disabled-capture zero writes. Actual one-workstream host capture remains BLOCKED: no authorized Hermes host/session/workstream binding and hook is qualified. Durable wiring belongs .files; no live clean profile was touched. The explicit native JSON grammar is not an OMP prose-capture adapter.

First experiment: parent-authorized AGENT-CODIFIED POLICY D1 -> USER CORRECTION D2 variant frozen for .files/fleet/mbp. Pure USER -> USER variant remains BLOCKED: no qualifying earlier user D1 found; bounded search is not proof absent. D1 source79b6c84 inherited95C,not user-authored; D2 native user message95d71187,source-bound539-byte digest frozen. The110C value is later codification,not user wording; CPU/memory/disk/battery gates are not superseded. Private native bytes remain local. All actual capture/retrieve/source-verify/model-input/use/independent-answer stages and matched enabled/disabled experiment execution remain NOT_RUN/NOT_QUALIFIED.

No private raw transcript,source import,inference,host activation,new store,default merge,tag push or upstream mutation. z0intelligence and z0evals were audited non-forks with no parent repository; same-branch repairs affect only the authorized kvnloo Drafts. Native governed write interception and model-visible continuity remain separate #47/#22/#62/#56 gates.

FEED6-CAPTURE197-IDEMPOTENCE

Read-only integrated-preview provenance audit — 2026-10-23

Disposition: source contract substantially reconciled; bounded static AUDIT ONLY, not native PASS or activation. No new branch, PR, commits, source/archive edits, history downloads, permissions, hooks, upstream posts, default-branch writes or live actions. HermesArchive retains native archive/host wiring. This return follows the read-only TASK rather than the generic write/PR template.

Existing PR: #197 (merged into preview; no new PR).
Existing branch / exact final head: feat/memory-workstream-capture-22 @ 3cd637c6ce6cbe21372c166b48899ab2a0336439.
Capture merge: 91167606af9e0ca18388ad1e72ec8c7f6c2c94a7. Current audited preview: bbcb4681bd2ad4251da6f58358330f05d7dc4d2b (8 commits ahead, 0 behind capture merge; comparison changes only PR #194's 7 read-only MCP/README/dependency/test files, none of the 13 capture files). Prerequisite: PR #198 head 8aac6cf208d6be183332fffec68d64220d497fee, preview merge bf1bacaf88bb5981db2436b6bd5cec105506f16e. Immutable reused sources: integrate/wiring-20261003@05e50151ec04ea40892be46645fb208aff2a1f70 (identity ledger); feat/hermes-multiharness-20261009@285d74f18c68aec233b0be1bce472d9085bd5817 (native Hermes source/claims). #195's verified OPT1-SYNTHESIS roadmap, #22 and its owner receipts, #63/#66, #197/#198 and #194 inspected. master was neither targeted nor changed.

Files already owned by merged #197 (13; no edits this wave):

adapters/__init__.py
adapters/hermes_z0int/__init__.py
adapters/hermes_z0int/native_capture.py
docs/ONBOARDING.md
src/z0int/memory/__init__.py
src/z0int/memory/claims.py
src/z0int/memory/event_log.py
src/z0int/memory/surface.py
tests/test_hermes_native_capture.py
tests/test_memory_claims.py
tests/test_memory_event_identity.py
tests/test_memory_event_log.py
tests/test_memory_surface_capture.py

OBSERVED from immutable GitHub source (not execution)

Native user correction, not an agent summary: [adapters/hermes_z0int/native_capture.py:43-79](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/adapters/hermes_z0int/native_capture.py#L43-L79) accepts only one complete, duplicate-key-free, bounded z0int.hermes.native_decision.v1 JSON object with schema/subject/predicate/value and optional explicit correction_of claim ID. Ordinary prose, quoted JSON, inferred intent and unstructured agent summaries are not capture declarations. [adapters/hermes_z0int/native_capture.py:86-160](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/adapters/hermes_z0int/native_capture.py#L86-L160) requires trusted absolute home/session and full typed user/project/repo/task scope; caller scope/session must exactly match before native content access. [adapters/hermes_z0int/native_capture.py:163-245](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/adapters/hermes_z0int/native_capture.py#L163-L245) reads one persisted native SQLite snapshot read-only, requires matching top-level CLI session, unique message UID, active/uncompacted/unmarked role=user row, supplied row/UID/SHA-256 equality, original timestamp, and synthetic-controller attribution where applicable. Original content remains native; only locator, source identity/hash and bounded normalized claim enter EventLog. Source-native original at 285d74f18c68aec233b0be1bce472d9085bd5817 has the same blob fe2666c32a19e8eaf77c6a52210780957959a285 as preview.
Trust and correction semantics: [src/z0int/memory/claims.py:98-171](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory/claims.py#L98-L171) re-hydrates/checks the same identity, scope, payload hash and typed normalized attestation. [src/z0int/memory/claims.py:365-455](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory/claims.py#L365-L455) checks source-ingest opt-in before writable EventLog construction, then permits correction_of only for an existing, provenance-validated explicit-user claim of identical scope, subject and predicate. [src/z0int/memory/claims.py:469-513](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory/claims.py#L469-L513) writes source reference plus separately bounded claim; generic record_claim forces model_assertion. [src/z0int/memory/claims.py:234-276](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory/claims.py#L234-L276) revalidates attested source ancestry instead of trusting a caller-declared origin_trust; [src/z0int/memory/claims.py:318-362](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory/claims.py#L318-L362) ranks validated user evidence above later model assertions and retains contradictions. [src/z0int/memory/claims.py:516-729](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory/claims.py#L516-L729) filters sibling scope before reduction, requires a complete EventLog snapshot and emits bounded claim history, source refs and MemorySnapshot/existing MemoryUseReceipt. This is evidence, not action authority; [src/z0int/memory_contract.py:264-271](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory_contract.py#L264-L271).
Identity and replay: [src/z0int/memory_contract.py:55-94](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory_contract.py#L55-L94) derives event_uid from durable source system/session/native UID (row sequence only fallback), not ledger position or mutable payload hash. [src/z0int/memory/event_log.py:528-603](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory/event_log.py#L528-L603) holds a file lock for source-identity admission, returns the prior identical source event on replay and raises EventIdentityConflict for same UID with changed hash or event payload. Original source and current preview event_log.py have identical Git blob fc735c4caf6ec550b68f40dd62c80a8bec839fd3. Preview claims.py differs from source 285d74f only by the two-line early opt-in guard plus its import. [src/z0int/memory/surface.py:18-61](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory/surface.py#L18-L61) keeps generic references non-attesting and scoped; [src/z0int/memory/surface.py:28-30](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory/surface.py#L28-L30) offers read-only worker view. No duplicate store/registry/bridge.
What the synthetic tests actually exercise (reviewed; not rerun): [tests/test_hermes_native_capture.py:95-168](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/tests/test_hermes_native_capture.py#L95-L168) verifies D1→explicit D2, a sequential fresh-process replay with unchanged ledger bytes, and retained D1 history. [tests/test_hermes_native_capture.py:203-246](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/tests/test_hermes_native_capture.py#L203-L246) rejects assistant/system/tool/compressed/marked rows, internal sessions and prose. [tests/test_hermes_native_capture.py:399-490](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/tests/test_hermes_native_capture.py#L399-L490) covers scope/key mismatch, re-hydration mutation, changed source hash, disabled capture creating no ledger directory, and sibling rejection before source read. [tests/test_memory_event_identity.py:28-91](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/tests/test_memory_event_identity.py#L28-L91) covers reopened exact UID replay and divergent hash/payload. PR feat(memory): capture scoped native workstream decisions and corrections #197 reports 159 passed on exact 3cd637c6ce6cbe21372c166b48899ab2a0336439, MBP fleet 20261023-010539-3ea8, Python 3.13.13, exit 0; that is a prior operator receipt, not a test performed here.

Static audit gaps / no product-PASS inference

Concurrent claim-level idempotence remains unproven: source references are lock-deduped, but [src/z0int/memory/claims.py:438-467](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory/claims.py#L438-L467) snapshots prior claims before [src/z0int/memory/claims.py:476-503](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory/claims.py#L476-L503) appends the identity-less memory.claim. Two truly simultaneous producers could both miss that claim and append twice. This is a code-path race hypothesis, NOT_RUN/not a reproduced failure; the existing subprocess test replays after capture.
Conflict versus explicit correction: [src/z0int/memory/claims.py:588-607](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/src/z0int/memory/claims.py#L588-L607) labels a losing history row superseded_by the group winner even when no correction_of linked it; [tests/test_memory_claims.py:414-420](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/tests/test_memory_claims.py#L414-L420) asserts an unlinked-user conflict is reported, but not that history avoids implying explicit supersession. Keep unlinked disagreement distinct from attested correction in any consumer. Static semantic discrepancy; NOT_RUN as a new regression.
A persisted role=user row plus typed JSON is source-role attestation, not proof of a live authenticated human, a policy grant, or that an LLM-generated summary forwarded as user was independently authored. The trusted native host/caller binding remains an external qualification gate. experiment: GStack context value shadow adapter #115's frozen first variant is agent-codified policy D1 → real user correction D2; do not relabel it user D1 → user D2. The Hermes JSON adapter has not been shown to ingest that native OMP prose case.
[docs/ONBOARDING.md:115-145](https://github.com/kvnloo/z0intelligence/blob/bbcb4681bd2ad4251da6f58358330f05d7dc4d2b/docs/ONBOARDING.md#L115-L145) still calls feat(memory): capture scoped native workstream decisions and corrections #197/fix(memory): source-byte freshness and fail-closed scoped reuse (#66) #198 “Draft” despite their later preview merges; “inactive/no live hook” remains true. Status text needs a separate docs-owner fix, not source activation.

NOT_RUN / NOT_QUALIFIED this wave: any pytest, independent concurrent-race reproduction, real Hermes host/session/workstream binding, history import or original-body download, authorized native D1/D2 capture, real second-client retrieval/injection/model-input witness, enabled-versus-disabled controlled continuation, independent answer/artifact check, failure injection, permissions/tool dispatch or live activation. In particular, prior synthetic 159/159 does not certify #22's capture→retrieve→inject→use→verify acceptance. No native PASS claimed.

Remaining ordered slices and owners (no writes authorized by this audit)

Capture correctness owner, kvnloo/z0intelligence: resolve/verify concurrent claim dedupe and unlinked-conflict supersession semantics within src/z0int/memory/claims.py, existing src/z0int/memory/event_log.py only if necessary, and adjacent tests/test_memory_claims.py, tests/test_hermes_native_capture.py, tests/test_memory_event_identity.py. Add simultaneous, not merely sequential, replay and conflict/history tests; reuse the existing EventLog.
HermesArchive + host-intent owner, kvnloo/.files / native Hermes seam: independently qualify authenticated input origin, frozen native source identity, actual host/session/workstream binding and disabled-by-default opt-in. No historical/private data export or clean-profile edit without separate approval. Not owned by this capture audit.
Read-path owner, kvnloo/z0intelligence: src/z0int/memory_mcp.py, src/z0int/memory_mcp_backends.py, src/z0int/context_resolve.py and adjacent tests; keep feat(memory): scoped read-only stdio MCP server #194's current exact native AgentsView read distinct from the capture writer. Verify scope, revocation/outage, source-byte freshness and independently witnessed model-input consumption; do not add archive wiring or expand providers from a search hit.
Native harness plugin + kvnloo/z0evals RFC: Compilation validity, drift, deoptimization, and mechanism-neutral promotion #56/experiment: GStack context value shadow adapter #115: one authorized real D1/D2 provenance variant, matched memory-off control, captured source UID/hash, emitted model input, corrected response and independent read-only check; wrong scope, stale source, injected agent summary, missing source and obsolete approvals are negative gates. control-plane: enforce dispatch leases and expose live z0 network snapshot #47/AODL retains all execution permission.
Documentation owner: update only docs/ONBOARDING.md merged-vs-Draft labels after the above ownership handoff; no claims of active integration.

Exact OMP commands (instructions only; not executed here):

PYTHONPATH=src python -m pytest -q tests/test_memory_event_log.py tests/test_memory_event_identity.py tests/test_memory_claims.py tests/test_memory_surface_capture.py tests/test_hermes_native_capture.py
PYTHONPATH=src python -m pytest -q tests/test_memory_contract.py tests/test_context_resolve_freshness.py tests/test_reuse_packet_freshness.py
PYTHONPATH=src python -m pytest -q tests/test_memory_mcp.py tests/test_memory_mcp_backends.py

Return: READ_ONLY / NO_NATIVE_PASS. Provenance-aware synthetic contract present on immutable preview@bbcb4681bd2ad4251da6f58358330f05d7dc4d2b; source-originals remain native and authority remains external. No new PR/branch or source edits.

FEED8-CAPTURE197-CONCURRENT-IDENTITY

goal_lock / disposition

Target: read-only exact-head audit of kvnloo/z0intelligence:preview@bbcb4681bd2ad4251da6f58358330f05d7dc4d2b, limited to concurrent append/retry identity collision across adapters/hermes_z0int/native_capture.py, src/z0int/memory/surface.py::ingest_reference, and the existing EventLog/claim admission primitives. Re-read preview before publishing: unchanged at this full SHA.
Required proof: immutable source anchors, distinction between exact replay and identity/payload conflict, crash boundaries, a minimal proposed synthetic multi-process regression, and one owner gate. No native/device/runtime proof requested or claimed.
Status: CHECK / LIMITED — SOURCE_ONLY, NOT_RUN. No edits, new branch, new PR, test/build/inference, native history/credential/archive reads, activation, permissions, default-branch mutation, upstream posts, or merge. CONTRIBUTING.md is absent at this ref (404); AGENTS.md and factory control/HITL/queue/access rules were consulted. Earlier capture audit already identified the claim race hypothesis; this return narrows it to concurrent identity collisions and recovery ordering, not a new reproduced defect.

Existing provenance / what changed

Existing PR #197 was merged, merge SHA 91167606af9e0ca18388ad1e72ec8c7f6c2c94a7; original branch feat/memory-workstream-capture-22 at 3cd637c6ce6cbe21372c166b48899ab2a0336439. Audited current preview is bbcb468, which includes later feat(memory): scoped read-only stdio MCP server #194 changes. This worker created no branch, commit, PR, or code change.
Original source owners preserved: feat(memory): capture scoped native workstream decisions and corrections #197 capture/claims/EventLog and tests; feat(memory): scoped read-only stdio MCP server #194 read-only MCP consumer separate; native Hermes archive/host/session binding stays with native harness and kvnloo/.files. Tern/TSP branches and files untouched.
Current Git blob witnesses: native_capture.py fe2666c32a19e8eaf77c6a52210780957959a285; event_log.py fc735c4caf6ec550b68f40dd62c80a8bec839fd3; claims.py e6f8596300c7cbb363f4d41b29761506ec7aeb4d; surface.py dbeee962a983088fb17e67cd38b835ab75a503e7. All observed by connector file read at the audited SHA.

OBSERVED at this immutable head (static source only)

Identity definition: memory_contract.py L46–119 derives event_uid from source system/session/native event ID (sequence only if no native ID), not payload bytes or local ledger position; payload_hash detects changed source bytes. Native Hermes derives hermes + persisted session_id + message_uid, retains row id as source_seq, and verifies exact submitted SHA-256 against read-only SQLite snapshot: native_capture.py L135–255.
Same UID, same hash, same event record = idempotent source reference: EventLog._append_event L528–605 acquires an exclusive fcntl.flock, refreshes the UID index from committed event bytes L241–259, and returns the existing MemoryEvent without another append if hash and event type, source, project, session, parents, and canonical payload agree. Independent processes writing the same ledger file are serialized for this single append. test_memory_event_identity.py L28–91 and test_memory_surface_capture.py L57–75 check sequential/reopened exact replay, not simultaneous producers.
Same UID, different hash OR same hash/different reference record = conflict, not silent update: EventLog raises EventIdentityConflict before writing a second identity-bearing event L575–605. Generic ingest_reference L33–62 writes only {locator,scope}, non-attesting. Native admit_user_claim L469–503 writes {locator,scope,role:user,native_source_validated:true}, then a separate memory.claim. If a generic reference and an attested native capture resolve to the same event_uid and hash, their record payloads differ: whichever source-reference append wins the file lock determines the first record; the other must conflict. In particular, generic-first can block that native admission; it must not be upgraded to trusted user evidence by retry or replay. If the source-system/native key differs, the UID differs and this cross-path uniqueness claim does not apply.
Concurrency gap is at claim level, not source-reference dedupe: claims.py L438–467 reads the event/claim snapshot, validates an optional correction and checks for pre-existing claim IDs before either append. L476–503 then calls the EventLog primitive twice, releasing its lock between source.reference and an identity-less memory.claim. Two simultaneous exact-native retries could each snapshot an absent claim, reuse the one reference, then each append a claim with the same deterministic claim_id but distinct ledger event IDs. This is a source-reachable TOCTOU race hypothesis, not an executed/reproduced failure. test_hermes_native_capture.py L126–168 exercises a later subprocess replay after the first capture completes, not a barrier-synchronized collision.
Crash boundaries: A complete event row is flushed/fsynced before index/state updates event_log.py L629–668; on next append, stale/missing derived state can be reconstructed from canonical complete rows L308–395 and L429–470. An incomplete trailing row blocks further append, not silently skipped L379–395; recovery readers may see only a prefix whereas require_complete=True rejects it L723–768. A crash after native reference commit but before claim commit can leave a valid, reference-only intermediate state; replay can attempt to finish the claim, but there is no atomic two-event admission transaction. No guarantee is asserted for bytes not durably fsynced.
Secondary identity limit, not a separately proved bug: with source_event_id present, source_seq is secondary metadata rather than part of event_uid; replay comparison checks UID/hash/event record, not equality of every identity-field byte contract L46–119, EventLog L575–605. Hermes' locator embeds row ID, so changed row ID normally becomes a reference-payload conflict in the native path. The existing source-key/sequence policy should be preserved or explicitly decided by its owner, not silently rewritten here.

Minimal proposed synthetic concurrent regression — NOT_CREATED / NOT_RUN

Use only synthetic, isolated tmp_path ledger + SQLite sessions/messages fixtures already defined in tests/test_hermes_native_capture.py; explicit local Z0INT_MEMORY_SOURCE_INGEST=references inside child test processes, never on a live profile. Use two independent spawned processes with a controlled barrier, not timing-based sleeps:

EventLog/generic: simultaneously call ingest_reference with identical bound workstream, EventIdentity, locator and ledger. Expect both return the same event ID; exactly one source.reference, zero memory.claim, complete ledger. Re-run with same UID but changed source hash; then with same UID/hash but changed locator or reference metadata: expect one accepted row and one EventIdentityConflict in each collision, with unchanged winning row/bytes. Assert no attestation marker in generic refs.
Native exact retry: persist one synthetic unmarked Hermes role=user decision; call capture_native_decision from two processes with identical binding/UID/row/bytes and ledger. Synchronize them after each has completed claims.py's prior-claims snapshot but before the first reference append (inject a test-only barrier at that seam). Contract target: exactly one validated reference and one memory.claim, identical claim_id and claim event ID returned to both processes. Current code may produce two claims; record RED if so, no fabricated result.
Cross-path same-UID race: one process issues generic ingest_reference, the other native capture for the same Hermes-native identity/hash/locator. Force each winner ordering; expect one immutable reference identity, one EventIdentityConflict, and never generic-to-native trust promotion. Generic-first may leave zero admitted claims; native-first may complete exactly one claim. Whether to permit explicit separate later native attestation without mutating the generic reference is a source-owner policy decision, not implied by an idempotent retry.
Crash/restart: test-only fault injection exits the first process (a) after reference fsync but before derived state update, and (b) after native source.reference fully returns but before memory.claim. Fresh-process retry must recover state, reuse the existing reference, and complete one claim without duplicate identity. Inject an incomplete final line separately: next append must fail closed rather than overwrite/skip the tail. Do not present these as completed tests.

Smallest remaining owner gate / commands for OMP

Capture/claim owner, existing feat(memory): capture scoped native workstream decisions and corrections #197 files only: first implement the barrier-synchronized two-process native same-UID regression in tests/test_hermes_native_capture.py (or focused tests/test_memory_claims.py) with reference + claim cardinality and return-ID assertions; run it RED/GREEN. If RED, enforce atomic claim-ID uniqueness/claim admission under the existing EventLog's serialization boundary in src/z0int/memory/claims.py with the minimum src/z0int/memory/event_log.py primitive if necessary; keep original source/event authorship, native identity, privacy, and generic non-attestation intact. Add mixed generic/native and crash cases next in tests/test_memory_surface_capture.py, tests/test_memory_event_identity.py, and native tests. No new store, queue, bridge, host hooks or Tern/TSP edits.
Native host owner (kvnloo/.files / Hermes native seam) alone owns real authenticated source/session/workstream binding and opt-in. This static work does not clear that gate or memory: canonical continuity plan, State Packet, and implementation status #22's capture → inject → use → independently verify proof.
OMP commands, exact pinned checkout first (instructions only; NOT executed by this worker):

git fetch origin preview
test "$(git rev-parse origin/preview)" = "bbcb4681bd2ad4251da6f58358330f05d7dc4d2b" || { echo "preview drift: re-audit exact source"; exit 1; }
git switch --detach bbcb4681bd2ad4251da6f58358330f05d7dc4d2b
python -m pip install -e '.[test]'
PYTHONPATH=src python -m pytest -q tests/test_memory_event_identity.py tests/test_memory_event_log.py tests/test_memory_surface_capture.py
PYTHONPATH=src python -m pytest -q tests/test_memory_claims.py tests/test_hermes_native_capture.py
# After owner adds the deterministic concurrent test, run its exact new test name separately with -vv.

Execution_proof: tested=[], runtime=NOT_RUN, result_status=NOT_RUN. This worker's evidence is independent connector source inspection at exact preview SHA only; no regression timing, crash, native SQLite, archive/history, actual user, host, GUI, CI, model, tool-dispatch, or real cross-client acceptance evidence. Existing prior test receipts are not fresh tests of these concurrency cases. No new PR/branch/head; no upstream write.

contrib(CW1): draft .z0/priorities.yaml, vocab, credits + priorities-…

Navigation Menu

Repository navigation

memory: canonical continuity plan, State Packet, and implementation status #22

Start here — memory reconciliation, 2026-10-04

One ownership model

Audited implementation status

What must travel with a workstream

One near-term sequence

Acceptance for this coordination issue

Issue ownership / disposition

Directions retired by this reconciliation

Research follow-up — one correction-to-reuse behavioral proof (2026-10-07)

Frozen fixture

What was parked, and why

Smallest qualified path: a Hermes profile with no memory provider

One acceptance test (reuse `kvnloo/z0evals#56`, not a new study)

Existing code reused by content (no aggregate merge)

Exact changed files

Completed code / coverage (synthetic only)

Precise blockers / ordered next slices (ownership)

Exact OMP MBP commands (after shared dependencies land)

Read-only integrated-preview provenance audit — 2026-10-23

OBSERVED from immutable GitHub source (not execution)

Static audit gaps / no product-PASS inference

Remaining ordered slices and owners (no writes authorized by this audit)

goal_lock / disposition

Existing provenance / what changed

OBSERVED at this immutable head (static source only)

Minimal proposed synthetic concurrent regression — NOT_CREATED / NOT_RUN

Smallest remaining owner gate / commands for OMP

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

memory: canonical continuity plan, State Packet, and implementation status #22

Description

Start here — memory reconciliation, 2026-10-04

One ownership model

Audited implementation status

What must travel with a workstream

One near-term sequence

Acceptance for this coordination issue

Issue ownership / disposition

Directions retired by this reconciliation

Activity

kvnloo commented on Sep 29, 2026

kvnloo commented on Sep 30, 2026

kvnloo commented on Sep 30, 2026

kvnloo commented on Oct 5, 2026

kvnloo commented on Oct 7, 2026

Research follow-up — one correction-to-reuse behavioral proof (2026-10-07)

Frozen fixture

kvnloo commented on Oct 9, 2026

kvnloo commented on Oct 9, 2026

kvnloo commented on Oct 10, 2026

kvnloo commented on Oct 22, 2026

What was parked, and why

Smallest qualified path: a Hermes profile with no memory provider

One acceptance test (reuse kvnloo/z0evals#56, not a new study)

kvnloo commented on Oct 23, 2026

Existing code reused by content (no aggregate merge)

Exact changed files

Completed code / coverage (synthetic only)

Precise blockers / ordered next slices (ownership)

Exact OMP MBP commands (after shared dependencies land)

kvnloo commented on Oct 23, 2026

kvnloo commented on Oct 24, 2026

Read-only integrated-preview provenance audit — 2026-10-23

OBSERVED from immutable GitHub source (not execution)

Static audit gaps / no product-PASS inference

Remaining ordered slices and owners (no writes authorized by this audit)

kvnloo commented on Oct 24, 2026

goal_lock / disposition

Existing provenance / what changed

OBSERVED at this immutable head (static source only)

Minimal proposed synthetic concurrent regression — NOT_CREATED / NOT_RUN

Smallest remaining owner gate / commands for OMP

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

One acceptance test (reuse `kvnloo/z0evals#56`, not a new study)