{"slug":"architecture/TRIAGE_AND_ORG_MEMORY","title":"Triage & Organizational Memory — Canonical Specification","section":"architecture","sectionLabel":"Architecture","status":"canon","type":"document","path":"architecture/TRIAGE_AND_ORG_MEMORY.mdx","bytes":9646,"description":null,"updated":"2026-08-24","source":"integratewise/Integratewise-docs-wiki","content":"\n\n## 1. Purpose\n\nTriage is the cognitive intake and classification boundary between incoming evidence/AI output and the governed organizational-memory promotion path.\n\nTriage is **not** the owner of canonical truth. Triage is **not** a canonical writer. Triage is **not** an authority grantor.\n\nIts job is to:\n\n1. classify incoming evidence;\n2. link it to known entities and work where possible;\n3. identify duplicates, conflicts, ambiguity and materiality;\n4. classify the proposed memory scope;\n5. stage a candidate for governed review;\n6. route the candidate to human approval, rejection, deferral or repair;\n7. emit a durable audit trail.\n\n## 2. Canonical Doctrine\n\n> **Triage classifies. Governance decides. The Pipeline promotes. Spine owns organizational memory. Twin consumes the governed result.**\n\nThis is the single most important sentence in the triage subsystem. Every code path, every endpoint, every workflow must conform to it.\n\n## 3. Memory Boundary\n\n```text\nSOURCE / USER / AI / AGENT EVENT\n              |\n              v\n        Triage Intake\n              |\n       classify + link\n              |\n              v\n     TRIAGE CANDIDATE / EVIDENCE\n              |\n      +-------+--------+\n      |                |\n   reject/defer     review\n                        |\n                   HUMAN DECISION\n                  /               \\\n             reject              approve\n               |                    |\n               v                    v\n            terminal          GOVERNED PROMOTION\n                                  |\n                                  v\n                           ORGANIZATIONAL MEMORY\n                                  |\n                                  v\n                         SPINE CONTEXT / SEARCH\n```\n\n### Non-negotiable Rule\n\n> **AI may propose organizational memory; only the governed promotion path can publish it.**\n\nHigh confidence does not itself authorize promotion.\n\n## 4. What Triage May Write\n\nTriage may write only to bounded operational/staging state:\n\n- triage item\n- extracted candidate\n- classification\n- entity links\n- provenance\n- confidence dimensions\n- conflict findings\n- proposed memory scope\n- governance recommendation\n- review state\n- correlation/causation identifiers\n\nThese writes are **operational records**, not canonical organizational truth.\n\n## 5. What Triage May Never Write\n\nTriage must never directly write:\n\n- canonical entity state\n- approved organizational memory\n- authoritative policy\n- permissions\n- authority grants\n- canonical relationships\n- promoted outcomes\n\nThose changes must pass through governed promotion / canonical writers.\n\n## 6. Memory Scopes\n\n| Scope | Meaning | Promotion |\n|---|---|---|\n| Personal | Private user memory | Never widens automatically |\n| Conversational | Session/thread working memory | Evidence only |\n| Agent | Agent/Twin working memory | Evidence only |\n| Organizational staging | Candidate organizational memory | Human/governed review required |\n| Organizational published | Approved tenant-wide memory | Canonical governed state |\n\nOnly the governed promotion path can move material into Organizational Published.\n\n## 7. Triage Decision Model\n\nTriage evaluates:\n\n- source and provenance\n- entity/link confidence\n- semantic category\n- duplication\n- conflict with canonical truth\n- sensitivity\n- materiality\n- freshness\n- completeness\n- proposed memory scope\n- policy eligibility\n\nRecommended output:\n\n```json\n{\n  \"classification\": {},\n  \"linking\": {},\n  \"canonical_review\": {},\n  \"memory\": {\n    \"scope\": \"personal|conversational|agent|organizational\",\n    \"candidate\": true\n  },\n  \"governance\": {\n    \"decision\": \"stage|reject|defer|repair|review\",\n    \"reason\": \"\"\n  },\n  \"provenance\": {},\n  \"confidence\": {}\n}\n```\n\nThere is deliberately **no `AUTO_APPROVE` outcome for organizational memory**.\n\n## 8. Promotion State Machine\n\n```text\ncandidate\n   |\n   +--> repair\n   |\n   +--> rejected\n   |\n   +--> deferred\n   |\n   +--> pending_approval\n             |\n        +----+----+\n        |         |\n      reject    approve\n        |         |\n        v         v\n     terminal   promote\n                  |\n                  v\n             published\n```\n\n## 9. Canonical Write Path\n\n```text\nTriage\n  -> candidate staging\n  -> governance review\n  -> approval record\n  -> canonical writer / Pipeline promotion\n  -> provenance + lineage + outbox\n  -> search/index projections\n  -> refreshed user/Twin context\n```\n\nThere is no direct Triage → Neon/R2/Vectorize/D1 canonical promotion path.\n\nThe canonical promotion engine is `services/pipeline/src/memory-promoter.ts`.\n\n## 10. AI Operational Boundary\n\nAI works on governed operational context derived from Spine.\n\n```text\nCanonical Spine\n      |\n Context Assembly\n      |\n permission + purpose + freshness + relevance\n      |\n      v\nOperational Sandbox\n      |\n      +--> Twin\n      +--> Coworker\n      +--> Domain Agents\n      +--> External Agents\n```\n\nAI-generated conclusions remain Flow C evidence/candidates until promoted.\n\n## 11. Organizational Memory Semantics\n\nOrganizational memory is not a transcript dump. It is curated, provenance-bearing, semantically classified knowledge that has survived the promotion gate.\n\nExamples:\n\n- durable business facts\n- approved decisions\n- explicit organizational preferences\n- stable relationships\n- validated insights\n- policy/knowledge candidates that have passed governance\n\n## 12. Activation Contract\n\nTriage is considered **active** only when all of the following are true:\n\n1. the Triage runtime is deployed;\n2. its intake trigger is wired to the intended Flow C ingress;\n3. staging writes are tenant-scoped;\n4. the approval endpoint updates review state;\n5. approval triggers canonical promotion through the governed writer;\n6. direct canonical writes from Triage are impossible by credentials/bindings;\n7. rejection/defer/repair are terminal or resumable states with audit;\n8. a test proves approved memory appears in canonical retrieval and rejected memory does not;\n9. observability exposes triage throughput, pending queue, approval latency, promotion success and failure;\n10. the end-to-end path is proven in Customer Zero before external tenants.\n\n## 13. Memory Contract\n\nEvery published memory item carries:\n\n- tenant identity\n- memory ID\n- category\n- source evidence\n- entity references\n- provenance/lineage\n- author/approver where applicable\n- creation/update timestamps\n- lifecycle state\n- freshness\n- confidence dimensions\n- conflict status\n\n## 14. Canonical Data Flow\n\n```text\nSource / User / Twin / Agent\n        ↓\nOperational Sandbox / Flow C Intake\n        ↓\nTriage\n        ↓\nCandidate + Evidence + Classification + Provenance\n        ↓\nStaging\n        ↓\nGovernance / Human Review\n   ┌────┼───────────┐\n reject defer      approve\n   │      │           │\n   ▼      ▼           ▼\nterminal pending    Pipeline Promotion\n                      ↓\n               Organizational Memory\n                      ↓\n              Index / Projection\n                      ↓\n                  Twin / User\n```\n\n## 15. Code Mapping\n\n| Responsibility | Service | File | Status |\n|---|---|---|---|\n| Cognitive triage (classify, link, stage) | intelligence | `src/agents/specialized/triage.ts` | VERIFIED — patched: `STAGE_FOR_REVIEW` / `REJECT` only |\n| Durable triage workflow | intelligence | `src/workflows/triage-workflow.ts` | VERIFIED — patched: no direct canonical writes |\n| Runtime intake classifier | iw-agent-runtime | `src/agents/triage-agent.ts` | VERIFIED — operational state only |\n| AI extraction + Slack review | knowledge | `src/triage-bot.ts` | VERIFIED — all outputs `pending` |\n| Human decision endpoint | knowledge | `src/index.ts` PATCH `/v1/knowledge/triage/:id` | VERIFIED — auth + tenant + audit |\n| Session triage endpoint | knowledge | `src/index.ts` POST `/v1/triage/session` | VERIFIED — patched: no auto-approve |\n| Canonical promotion engine | pipeline | `src/memory-promoter.ts` | VERIFIED — sole canonical writer |\n| Domain governance config | knowledge | `src/synthesis/knowledge-model.ts` | VERIFIED — patched: all domains require governance |\n| SQL approval state | sql-migrations | `058_triage_approval_status.sql` | VERIFIED — `pending|approved|discarded|deferred` |\n\n## 16. Acceptance Tests\n\n1. AI-generated candidate is visible in staging.\n2. Candidate is not visible to governed Organizational Memory queries while pending.\n3. Reject leaves no published memory.\n4. Defer leaves no published memory and can return to review.\n5. Approve records approver identity/time and triggers exactly one promotion.\n6. Promotion creates provenance/lineage and an outbox event.\n7. Search/index receives only published memory.\n8. Twin reads published memory through bounded context projection, not raw canonical storage.\n9. Canonical direct writes from Triage are impossible through runtime credentials/bindings.\n10. Reconciliation confirms the published record is retrievable after promotion.\n\n## 17. Architectural Law\n\n> **Triage classifies. Governance decides. The Pipeline promotes. Spine owns organizational memory. Twin consumes the governed result.**\n"}