feat(sources): design versioned host-owned current-turn evidence projections #2119

Background

Follow-up to #2069.

The capture-ownership evaluation reproduced cases where historical user turns, previously injected PreparedContext, host instructions, or summary content became new Atomic Memory candidates.

Six synthetic cases reproduced contamination in both repetitions while the paired current-turn experimental outputs retained all required current facts:

• history-before-current
• prepared-context-fact
• host-preference
• repeated-history
• forged-query-in-summary
• summary-and-notification

Twelve deterministic source/output literal witnesses supplement the candidate support annotations.

The evaluation decision is projection_follow_up_required. This issue tracks the resulting production design work. The evaluation itself does not change production capture, extraction, or public APIs.

Evaluation evidence

The evaluation artifacts are available in the contributor fork pending upstream review:

• Experiment and limitations
• Aggregate report
• Deterministic support audit

The experiment used pinned qwen-flash-2025-07-28. These are synthetic-corpus results for the configured model, not production incidence estimates.

Across the entire corpus, the experimental current-turn view still produced two critical candidates and missed two required facts. It must not be promoted directly to production.

Proposed implementation scope

Start by reviewing the shared projection contract and the WorkBuddy implementation scope against the findings from #2069.

Other hosts must document and verify their actual payload contracts independently before adopting this projection. This issue does not assume that WorkBuddy's parser can be reused across hosts.

The implementation may be split into focused PRs after maintainers agree on the design, compatibility requirements, and host rollout scope.

Proposed design requirements

1. Preserve the exact raw host submission as the auditable Source materialization.

2. Store or deterministically rebuild a separate, versioned text-evidence projection bound to:

   • Exact Source identity.
   • Materialization digest.
   • Host event identity.
   • Owning parser version.
   • Projection key and version.
   • Explicit ownership/eligibility status and offset convention.

3. Let the owning host parser produce the projection. Do not introduce a generic Server regex scrubber for arbitrary prompts.

4. Keep forged, nested, ambiguous, or missing boundaries in a neutral unknown/not-eligible state for automatic extraction. Preserve the raw Source regardless of eligibility.

5. Handle quoted content within a valid current turn without promoting quoted examples into independent user assertions. A syntactically valid textual envelope alone must not authenticate the actor or assertion source.

6. Keep payload ownership separate from Source declaration authority, verification, lifecycle semantics, and permission to publish memory.

7. Make duplicate delivery idempotent. Retrying the same event/materialization/version must not bind a different projection; conflicting views must produce an explicit conflict.

8. Define compatibility and deterministic rebuild behavior for old captures, existing projections, and parser version changes. Historical payloads must not silently acquire today's trusted interpretation.

9. Preserve existing Artifact bodies/revisions, citation identity, search ranking, and PreparedContext behavior.

10. Define each host's actual payload contract independently, including WorkBuddy, Codex, Claude Code, and other supported integrations.

11. If public Source/capture contracts change, start with the design and openapi/powercontext.yaml, regenerate clients, and document compatibility.

The extraction view must cover all payload-bearing carriers, including Source metadata. Replacing only content leaves another copy of the raw joined text available to extraction.

Alternatives considered

• Capture only the latest user turn: this would lose the complete raw submission needed for Source auditability.
• Scrub joined prompts with generic Server regex rules: host payload formats differ, and quoted or forged markup makes ownership ambiguous.
• Change extraction instructions alone: this does not separate evidence ownership or remove duplicate raw-text carriers from Source metadata.

Acceptance criteria

• Specify and review the ownership, versioning, materialization binding, and eligibility contract before implementation.
• Preserve exact raw Source content, identity, readback, and citation identity.
• Verify that content and payload-bearing metadata follow the same extraction eligibility/view contract.
• Re-run the six reproduced cases and the full malformed/quoted fixture matrix.
• Preserve required current facts and exact command/path/config literals.
• Address the experimental view's quoted-example contamination and current-fact omissions.
• Test duplicate delivery, conflicting projections, old captures, parser changes, and deterministic rebuild.
• Document the actual contract and support status for each host.
• Complete design-first OpenAPI/client updates if a public contract change is required.

Related work

Align Source declaration authority and historical rebuild semantics with #1975 and its implementation #2004.

Coordinate the bounded extraction-evidence boundary with #2074.

Keep this production design separate from #2069's evaluation-only scope.