{"slug":"canonical/adr/ADR-2026-08-31-02-three-continuity-scopes","title":"ADR-2026-08-31-02 — Three continuity scopes","section":"canonical","sectionLabel":"Canon","status":"canon","type":"adr","path":"canonical/adr/ADR-2026-08-31-02-three-continuity-scopes.md","bytes":5831,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** Accepted\n**Date:** 2026-08-31\n**Gap:** [`G-01`](../17-IMPLEMENTATION-ALIGNMENT-AND-GAP-REGISTER.md)\n**Related:** [ADR-2026-08-31-01](ADR-2026-08-31-01-ai-workbench-supersedes-twin-workbench.md), [ADR-2026-08-31-03](ADR-2026-08-31-03-personal-contextual-spine.md)\n\n## Context\n\n`packages/hermes-spine-memory` models memory as two scopes:\n\n```ts\nexport type MemoryScope = \"personal\" | \"org\";   // types.ts:29\n```\n\nThe namespace header describes `personal:user:{id}` as holding *\"twin chat history, personal\nnotes\"* — one namespace holding two participants' continuity. `routeTwinMemory()` can only route\nTwin into `personal` or `org`, so **AI has no continuity of its own**: its working memory is\nstored inside the human's private namespace.\n\nThis violates the canon invariant directly. Personal Memory and AI Memory are supposed to be\nseparate from each other, and neither automatically becomes organizational truth. Today the first\nhalf of that is untrue.\n\nIt also blocks Spine Agents ([`G-05`](../17-IMPLEMENTATION-ALIGNMENT-AND-GAP-REGISTER.md)), which cannot have per-agent memory\nnamespaces while the scope enumeration has no slot for a non-human participant.\n\n## Decision\n\nMemory has **three** scopes, matching the three continuity domains:\n\n| Scope | Holds | Owner |\n|---|---|---|\n| `org` | Business Context / Organizational Memory — shared organizational reality and durable knowledge | Organization |\n| `personal` | Personal Contextual Memory — the human's private continuity | Human |\n| `ai` | AI Continuity Memory — AI's own continuing working memory | Twin, Spine Agents |\n\n**Twin's continuity moves out of the human's private namespace into its own.**\n\nThe `ai` scope is subject-addressed like the others, so a Twin and each Spine Agent get distinct\nnamespaces rather than sharing one AI pool.\n\n**Governed promotion is the only path between scopes.** Nothing crosses implicitly. This half is\nalready correct in code: `services/pipeline/src/memory-promoter.ts` never auto-promotes\nAI-sourced writes into organizational memory — they land in `staging` pending approval. That\nbehaviour is preserved unchanged.\n\n## Implementation status — landed 2026-08-31\n\nImplemented in `packages/hermes-spine-memory`:\n\n- `MemoryScope` widened to `\"personal\" | \"org\" | \"ai\"`, with `MemorySubjectType` naming the\n  subject each scope addresses (`user` / `tenant` / `agent`).\n- `resolveNamespace` and the new `subjectIdForScope` resolve the subject per scope and **throw**\n  when it is absent. A fallback would write one participant's continuity into another's database,\n  so absence is refused rather than defaulted.\n- `routeTwinMemory` now defaults Twin to its own `ai` continuity when an `agentId` is known,\n  instead of falling into `personal` or `org`.\n- The `ai` scope is subject-addressed, so a Twin and each Spine Agent get distinct namespaces.\n- 27 tests added (`namespaces.test.ts`) — the package previously had none.\n\n**Round-trip bug fixed in passing.** The path grammar was inconsistent: `resolveNamespace` produced\n`personal:user:{id}` but `parseNamespacePath` treated `user` as part of the subject id, so\n`dbNameFromPath(ns.path)` returned `iw_mem_personal_user_abc` while `ns.dbName` was\n`iw_mem_personal_abc` — **two different databases for one namespace**. The grammar is now uniformly\n`{scope}:{subjectType}:{subjectId}` and round-trips are asserted for all three scopes.\n\n## No migration is required — correcting an earlier assessment\n\nAn earlier draft of this ADR stated that a data migration was required, on the assumption that\nexisting `personal:user:{id}` namespaces held commingled human notes and Twin chat history. **That\nwas wrong.** Verified:\n\n- `packages/hermes-spine-memory` has **zero consumers** — only its own `package.json` and\n  `index.ts` reference it. Nothing has ever written through it.\n- `services/continuity` no longer uses CouchDB. Its `wrangler.toml` binds `env.DB` (D1)\n  exclusively, and `src/couchdb.ts` no longer exists. The `COUCHDB_*` secrets in its `README.md`\n  and in `SERVICE_ARCHITECTURE_REPORT.md` are **stale documentation**.\n- `apps/web/lib/core/twin-memory/store.ts` is an in-memory `Map` implementation, headed\n  *\"Production: Replace with Supabase or database backend.\"*\n\nSo no CouchDB memory databases are provisioned, and **AI continuity has no persistent home today\nat all**. This substrate is designed but unwired.\n\nThat makes now the cheapest possible moment to correct the scope model: the design is being fixed\nbefore anything depends on it, at zero migration risk. It also reframes the gap — the problem was\nnever \"AI memory sits in the wrong live namespace,\" it was \"the three-domain model was designed\ninto a substrate that was never wired, with only two domains in it.\"\n\n## Consequences\n\n- The privacy boundary is now structural: a human's personal namespace cannot accumulate AI\n  working state, because the `ai` scope refuses to resolve against a `userId`.\n- Unblocks [`G-05`](../17-IMPLEMENTATION-ALIGNMENT-AND-GAP-REGISTER.md) — Spine Agents can hold identity plus an addressable\n  memory namespace.\n- **A migration becomes required the moment this substrate is wired to a live store.** This ADR\n  records that it is not required *now*; that changes as soon as anything writes through it.\n- Stale CouchDB references in `services/continuity/README.md` and `SERVICE_ARCHITECTURE_REPORT.md`\n  should be corrected, so the next reader does not conclude a CouchDB deployment exists.\n\n## Not decided here\n\nPromotion *rules* between the three scopes — what qualifies AI continuity or personal context for\npromotion into organizational memory, and under whose authority. The existing seven promotion\nsignals cover Spine → Org Memory. Scope-to-scope promotion needs its own decision.\n"}