[kvnloo]

Read-only memory MCP — bounded preview integration (#22)

Only search and fetch over private stdio. Memory is untrusted evidence, never instructions, write access or execution authority. AgentsView exact native message reads are the sole qualified source; ctx/QMD/TencentDB remain explicitly unavailable. operator and chatgpt grants are separate, and the checked-in ChatGPT grant is empty. Fetch re-authorizes and re-reads the original; native session/stable message ID/ordinal, complete content SHA-256, expiry, revocation, byte caps, redaction and fail-closed private audits remain enforced.

No hidden master promotion

The original branch descended from master, which is 63 commits/577 files ahead of old preview. Under explicit owner direction, the six PR-owned commits (162ce59, 4b9acc5, 494b473, 05142f1, bf0050a, 395101d) were cherry-picked onto preview after #198 and #197 merged, base 91167606af9e0ca18388ad1e72ec8c7f6c2c94a7. The README conflict retained preview's foundation text and added only the MCP section. The dependency conflict added only mcp==1.26.0 and the Python<3.11 tomli fallback, not master-only FFF/typesafe/AODL dependencies. No master commits are pulled into preview. Independent source review passed this bounded integration.

The phone worker acknowledged STOP at final original head 395101d. No other open PR used or depended on its branch. The merge owner performed the explicitly authorized head rebuild with an exact --force-with-lease bound to that old head; final merge remains normal, not squash or force. No tags were pushed.

Real RED and exact-head GREEN

• Actual merged-preview base RED: MBP job 20261023-170324-3682, base 91167606af9e0ca18388ad1e72ec8c7f6c2c94a7, with only the two new MCP test files overlaid. The tests actually ran and failed collection with two errors for missing z0int.memory_mcp/memory_mcp_backends; exit 2. Earlier untouched-preview RED 20261023-165933-3292 independently found the same missing feature.
• Integration RED at rebuilt 8bdc0b5: MBP 20261023-170434-8b60, 1 failed / 290 passed, exit 1. The phone's new stale+expiry test replaced original text but retained the old digest; the next fresh search correctly rejected that invalid record. The fixture was corrected to replace text and its source digest together via record(text="version-two"), retaining all stale/expiry assertions and leaving production code unchanged. Existing README draft language was updated.
• Exact final head d7a1a9770efda36b8fc0fc7894dfec0b20b6cb2c: MBP 20261023-170655-06c8, 291 passed in 33.20s, exit 0, CPython 3.13.13 / pytest 8.4.2 / MCP 1.26.0. This includes all freshness, capture and MCP suites, not only a narrowed new test. Retained logs are under the merge owner's fleet run receipts.

PYTHONPATH=src /tmp/z0-memory-core313-venv/bin/python -m pytest -q tests/test_memory_contract.py tests/test_context_resolve_freshness.py tests/test_reuse_packet_freshness.py tests/test_memory_event_log.py tests/test_memory_event_identity.py tests/test_memory_claims.py tests/test_memory_surface_capture.py tests/test_hermes_native_capture.py tests/test_memory_mcp.py tests/test_memory_mcp_backends.py

Cross-repository outcome decision

The real producer→consumer RED reported in z0evals#115 comment 6375415836 is a consumer replay defect, not a reason to weaken this producer. Public fetch may correctly return byte_limit; the documented retrieval audit maps fixed/unknown error codes to outcome=error while preserving decision=byte_limit. The replay incorrectly required decision=error. Repair belongs to z0evals#115 with an actual producer regression. This PR records retrieval dispositions only; hit_used, hit_ignored, user_restated and native-use joins are explicitly a separate later PR, not acceptance for this merge.

Deployment boundary

Deploy from merged preview, not master: master contains unrelated and overlapping integration not qualified here. Host IaC, explicit operator corpus grants, four client registrations and real provenance-bearing client queries are separate deployment receipts. This merge does not activate native capture, grant ChatGPT access, claim provider-side continuity or infer fetch=use.

issue: https://github.com/kvnloo/z0intelligence/issues/22
base_revision: 91167606af9e0ca18388ad1e72ec8c7f6c2c94a7
head_revision: d7a1a9770efda36b8fc0fc7894dfec0b20b6cb2c
tests:
  red: Real merged-preview baseline MBP 20261023-170324-3682 failed the new MCP tests with 2 absent-feature collection errors, exit 2; integrated 8bdc0b5 MBP 20261023-170434-8b60 found the incorrect revision fixture, 1 failed and 290 passed, exit 1
  green: Exact head d7a1a9770efda36b8fc0fc7894dfec0b20b6cb2c MBP 20261023-170655-06c8 passed all 291 freshness, capture and MCP tests, CPython 3.13.13, MCP 1.26.0, pytest 8.4.2, exit 0

[kvnloo]

Z02-MEM-EXACTSOURCE

Draft PR: #194 (reused; no second PR)
Branch: feat/memory-mcp-readonly (continued from Z01 4b9acc5c1d438b6f0b99bde8add8a0e2de5727dd)
Exact final head: 494b473fd140e2a5ab11b1a170a7f9b3a69ac793
Compare: 4b9acc5...494b473 (one commit; five MCP-owned files)

Files changed

• src/z0int/memory_mcp_backends.py: verify the returned message's session_id equals the requested native session and its stable db.Message.id is a positive signed int64 before reading content/display metadata. Search aborts with explicit identity denial; fetch requires the original stable ID, not just a matching ordinal. Canonical lossless locator includes native session, stable message ID and ordinal; reject rather than truncate oversized identities. SHA-256 source_version still hashes the complete original normalized UTF-8 content bytes, unchanged.
• src/z0int/memory_mcp.py: facade independently checks native identity/locator consistency during search, before issuing a private HMAC handle, and again on fetch; invalid/replaced identities return only {"error":"denied"}, with no record/packet/source metadata. Source-owned native.id and full locator remain in the private identity and provenance locator.
• tests/test_memory_mcp_backends.py: native HTTP fixture now includes exact session_id and id; regressions for sibling/missing session at search and fetch, invalid/missing/boolean/overflow IDs, identical-text reused ordinal with different native ID, and direct fetch without full native locator.
• tests/test_memory_mcp.py: facade regressions for wrong/missing identity, same-text ID replacement, and full long native locator retained in the ContextPacket even when the content hash is identical. Synthetic hydration deliberately navigates by session + ordinal so an ID swap cannot accidentally be hidden by the test double.
• README.md (existing MCP documentation): clarifies that AgentsView's bearer token provides broad API access, not provider/project/session-scoped authorization. operator and chatgpt are distinct MCP facade-side allowlists selected at stdio startup; they do not attenuate the native bearer or authenticate the external tunnel.

Security boundary: memory is evidence, never execution permission. No new store, service, bridge, provider authorization, listening port, or extra MCP tool. Unknown or sibling scope does not become global. Native project label and per-principal facade grants are necessary checks, not a native AgentsView ACL. The default ChatGPT grant remains empty.

Verification status: connector reread confirmed all five committed blobs and the PR branch head; compare_commits shows exactly one commit ahead of the specified Z01 SHA. Tests NOT run in this worker. The prior PR description's 77-test result belongs to the older 162ce590 revision, not this new head.

Exact MBP commands for OMP (run from z0intelligence root at 494b473fd140e2a5ab11b1a170a7f9b3a69ac793, isolated environment with package/test dependencies):

git fetch origin feat/memory-mcp-readonly
git checkout --detach 494b473fd140e2a5ab11b1a170a7f9b3a69ac793
PYTHONPATH=src python -m pytest -q tests/test_memory_mcp.py -k 'facade or native or locator or source_replacement'
PYTHONPATH=src python -m pytest -q tests/test_memory_mcp_backends.py -k 'adapter or native or backend_direct'
PYTHONPATH=src python -m pytest -q tests/test_memory_mcp.py tests/test_memory_mcp_backends.py

Do not enable live ChatGPT/tunnel access from a synthetic pass. Independently verify actual AgentsView message JSON schema and read-only behavior in the operator-controlled environment before activation.

Remaining, in order (owners/files):

1. OMP/MBP acceptance: execute the exact pinned focused subsets/full focused suite above; report outcomes tied to 494b473fd140e2a5ab11b1a170a7f9b3a69ac793. No pass claimed here. Test ownership: tests/test_memory_mcp.py, tests/test_memory_mcp_backends.py.
2. z0intelligence native API qualification: confirm real AgentsView around=0 message fields (id, session_id, ordinal) and the broad-token trust boundary. Only if evidence demands changes, use src/z0int/memory_mcp_backends.py + tests/test_memory_mcp_backends.py; stay on PR194.
3. Operator-only grant/transport review: document any approved corpus/tunnel profile in README.md and reviewed private deployment policy derived from manifests/memory-mcp-readonly.json. Do not silently grant chatgpt or publish bearer credentials.
4. Subsequent exact-source expansion, not in this patch: qualify each unsupported ctx/QMD/TencentDB source independently in src/z0int/memory_mcp_backends.py with corresponding tests/test_memory_mcp_backends.py negative cases. None is presently approved as original hydration.
5. Separate memory: canonical continuity plan, State Packet, and implementation status #22/OptMem × unified memory: ChatGPT research wave (20 artifacts) #195 roadmap acceptance: prove one decision/correction handoff at the actual model-input boundary with negative scope/freshness controls, under the existing harness-plugin and z0evals ownership. MCP search success alone is not continuity.

No context_resolve, core admission, default branch, or other repository was changed. No tests or live archive reads were performed here.

[kvnloo]

Z04-CONTRACT-CORRECTION — supersedes conflicting initial Z04 task details.

Main/Kevin sequencing at private fleet-critical-path.md: prepare and fully test scoped194+198 service plus four native registration snippets, DO NOT start live service or register clients before Kevin approves running Drafts live or merge. No live apply/activation.

Outcome receipts must support the NORTH STAR context re-explanations per day, not only retrieval hit counts. Required explicit outcomes: hit_used, hit_ignored, miss, user_restated; retain separate transport states denied/unavailable/stale/rate_limited/invalid/error and never count those as misses. A search hit/fetch is NOT proof of model use. Record use/ignore only from an explicit client acknowledgement/witness, clearly labelled agent-reported vs independently witnessed. User-restated requires a real native user-source correction and prior source-bound decision, never invented assistant/tool text or merely a model assertion.

Extend the existing private audit/outcome seam, not a second store. Replay-relevant metadata must include session/workstream identity, bounded redacted query, returned opaque/native record IDs and source revisions, timestamps, and query correlation. This data stays local private0600/0700; never upload real queries/history to GitHub, and do not put bearer/credentials/private content in receipts. Missing/unknown scope never becomes global. Keep read-only memory source guarantees; any outcome acknowledgement changes only local audit telemetry, never source memory or permission. If this expands source scope beyond initial owned facade/tests, report exact needed files and do not collide with another worker.

Offline replay consumes this explicit typed receipt contract, begins with read-only query rewrite/re-rank on genuine misses only, and reports no efficacy/causal gain from fixtures. It must not manufacture hit_used/user_restated or equate retrieval with benefit. Exit75 gate receipts and a Kueue canary must precede scaling autoresearch. The frozen thermal study controls/provenance remain unchanged. Real D1→D2 five-arm case belongs to source-proven user_restated events, not a renamed synthetic case.

Current initial Z04-MEM-OUTCOMES-01/Z04-EVAL-MEMREPLAY-01 workers should incorporate this correction if observed before committing; otherwise the first returned result will be independently rejected as incomplete and a sequential repair brief will follow. No parallel same-file repair worker. This is a contract update, NOT readiness or permission to deploy live.

[kvnloo]

OMP merge owner: hold further pushes to this branch

[kvnloo]

Z04-MEM-OUTCOMES-01 — IMMEDIATE SOURCE FREEZE. Main assigned MemoryMergeDeploy sole ownership of exact-head receipts, normal merges and deployment for #194/#197/#198. Stop branch source commits/pushes now. Report any already-written head and any pending file changes in the tagged result; do not mutate the branch further. Outcome instrumentation resumes only as a sequential owner handoff after the merge gate. This freeze supersedes the initial Z04 source-write brief. No permission to bypass lease or current-head checks.

[kvnloo]

Z04-MEM-OUTCOMES-01

STOP acknowledged: OMP is now the merge owner for #194. No further commits or branch updates from this worker.

Existing Draft PR: #194
Branch: feat/memory-mcp-readonly
Original head: 05142f1f998f83805c9b70223790f6e7e585981b
Pushed commits (in order):

1. bf0050a4048922d426cb1d3addef9654128e3996 — add versioned per-query retrieval outcome classification to the existing private audit.jsonl; behavioral tests and README documentation.
2. 395101d82382b64bf4c7d085bdf91f0cfc3ca07e — add grant-revoked fetch denial test and formatting cleanup.

Last verified head: 395101d82382b64bf4c7d085bdf91f0cfc3ca07e. Connector readback confirmed Draft PR #194 remains open against preview; both commits are fast-forward, and comparison with the original head changes exactly src/z0int/memory_mcp.py, tests/test_memory_mcp.py, and the existing private-memory-MCP section of README.md. No merge, default-branch push, second PR, deployment, or live activation was performed.

Implementation: audit schema z0int.memory_query_outcome.v1; outcomes hit|miss|denied|unavailable|stale|rate_limited|invalid|error. Existing audit fields and privacy/fail-closed behavior retained. Tests inspect actual synthetic audit rows for hit, authorized miss, policy denial, outage, stale content/handles, rate limit, invalid calls, unknown error, and failed audit.

Validation: connector file and head readback complete. Native tests NOT_RUN in this worker. OMP should run at the exact head:

git fetch origin feat/memory-mcp-readonly
git checkout --detach 395101d82382b64bf4c7d085bdf91f0cfc3ca07e
PYTHONPATH=src python -m pytest -q tests/test_memory_mcp.py -k 'query_outcome or query_outcomes'
PYTHONPATH=src python -m pytest -q tests/test_memory_mcp.py tests/test_memory_mcp_backends.py

Remaining (OMP-owned, in order): (1) run the focused/full MCP suites and inspect actual audit behavior (tests/test_memory_mcp.py); (2) review the scoped audit implementation and README contract (src/z0int/memory_mcp.py, README.md); (3) independently review deployment/grants and handle PR integration under OMP authority. No changes to #198 freshness files, capture, registry, transport, or other repositories.

Status: handed off; no further mutations by Z04-MEM-OUTCOMES-01.