Triage & Organizational Memory — Canonical Specification
1. Purpose
Triage is the cognitive intake and classification boundary between incoming evidence/AI output and the governed organizational-memory promotion path.
Triage is not the owner of canonical truth. Triage is not a canonical writer. Triage is not an authority grantor.
Its job is to:
- classify incoming evidence;
- link it to known entities and work where possible;
- identify duplicates, conflicts, ambiguity and materiality;
- classify the proposed memory scope;
- stage a candidate for governed review;
- route the candidate to human approval, rejection, deferral or repair;
- emit a durable audit trail.
2. Canonical Doctrine
Triage classifies. Governance decides. The Pipeline promotes. Spine owns organizational memory. Twin consumes the governed result.
This is the single most important sentence in the triage subsystem. Every code path, every endpoint, every workflow must conform to it.
3. Memory Boundary
SOURCE / USER / AI / AGENT EVENT
|
v
Triage Intake
|
classify + link
|
v
TRIAGE CANDIDATE / EVIDENCE
|
+-------+--------+
| |
reject/defer review
|
HUMAN DECISION
/ \
reject approve
| |
v v
terminal GOVERNED PROMOTION
|
v
ORGANIZATIONAL MEMORY
|
v
SPINE CONTEXT / SEARCH
Non-negotiable Rule
AI may propose organizational memory; only the governed promotion path can publish it.
High confidence does not itself authorize promotion.
4. What Triage May Write
Triage may write only to bounded operational/staging state:
- triage item
- extracted candidate
- classification
- entity links
- provenance
- confidence dimensions
- conflict findings
- proposed memory scope
- governance recommendation
- review state
- correlation/causation identifiers
These writes are operational records, not canonical organizational truth.
5. What Triage May Never Write
Triage must never directly write:
- canonical entity state
- approved organizational memory
- authoritative policy
- permissions
- authority grants
- canonical relationships
- promoted outcomes
Those changes must pass through governed promotion / canonical writers.
6. Memory Scopes
| Scope | Meaning | Promotion |
|---|---|---|
| Personal | Private user memory | Never widens automatically |
| Conversational | Session/thread working memory | Evidence only |
| Agent | Agent/Twin working memory | Evidence only |
| Organizational staging | Candidate organizational memory | Human/governed review required |
| Organizational published | Approved tenant-wide memory | Canonical governed state |
Only the governed promotion path can move material into Organizational Published.
7. Triage Decision Model
Triage evaluates:
- source and provenance
- entity/link confidence
- semantic category
- duplication
- conflict with canonical truth
- sensitivity
- materiality
- freshness
- completeness
- proposed memory scope
- policy eligibility
Recommended output:
{
"classification": {},
"linking": {},
"canonical_review": {},
"memory": {
"scope": "personal|conversational|agent|organizational",
"candidate": true
},
"governance": {
"decision": "stage|reject|defer|repair|review",
"reason": ""
},
"provenance": {},
"confidence": {}
}
There is deliberately no AUTO_APPROVE outcome for organizational memory.
8. Promotion State Machine
candidate
|
+--> repair
|
+--> rejected
|
+--> deferred
|
+--> pending_approval
|
+----+----+
| |
reject approve
| |
v v
terminal promote
|
v
published
9. Canonical Write Path
Triage
-> candidate staging
-> governance review
-> approval record
-> canonical writer / Pipeline promotion
-> provenance + lineage + outbox
-> search/index projections
-> refreshed user/Twin context
There is no direct Triage → Neon/R2/Vectorize/D1 canonical promotion path.
The canonical promotion engine is services/pipeline/src/memory-promoter.ts.
10. AI Operational Boundary
AI works on governed operational context derived from Spine.
Canonical Spine
|
Context Assembly
|
permission + purpose + freshness + relevance
|
v
Operational Sandbox
|
+--> Twin
+--> Coworker
+--> Domain Agents
+--> External Agents
AI-generated conclusions remain Flow C evidence/candidates until promoted.
11. Organizational Memory Semantics
Organizational memory is not a transcript dump. It is curated, provenance-bearing, semantically classified knowledge that has survived the promotion gate.
Examples:
- durable business facts
- approved decisions
- explicit organizational preferences
- stable relationships
- validated insights
- policy/knowledge candidates that have passed governance
12. Activation Contract
Triage is considered active only when all of the following are true:
- the Triage runtime is deployed;
- its intake trigger is wired to the intended Flow C ingress;
- staging writes are tenant-scoped;
- the approval endpoint updates review state;
- approval triggers canonical promotion through the governed writer;
- direct canonical writes from Triage are impossible by credentials/bindings;
- rejection/defer/repair are terminal or resumable states with audit;
- a test proves approved memory appears in canonical retrieval and rejected memory does not;
- observability exposes triage throughput, pending queue, approval latency, promotion success and failure;
- the end-to-end path is proven in Customer Zero before external tenants.
13. Memory Contract
Every published memory item carries:
- tenant identity
- memory ID
- category
- source evidence
- entity references
- provenance/lineage
- author/approver where applicable
- creation/update timestamps
- lifecycle state
- freshness
- confidence dimensions
- conflict status
14. Canonical Data Flow
Source / User / Twin / Agent
↓
Operational Sandbox / Flow C Intake
↓
Triage
↓
Candidate + Evidence + Classification + Provenance
↓
Staging
↓
Governance / Human Review
┌────┼───────────┐
reject defer approve
│ │ │
▼ ▼ ▼
terminal pending Pipeline Promotion
↓
Organizational Memory
↓
Index / Projection
↓
Twin / User
15. Code Mapping
| Responsibility | Service | File | Status |
|---|---|---|---|
| Cognitive triage (classify, link, stage) | intelligence | src/agents/specialized/triage.ts | VERIFIED — patched: STAGE_FOR_REVIEW / REJECT only |
| Durable triage workflow | intelligence | src/workflows/triage-workflow.ts | VERIFIED — patched: no direct canonical writes |
| Runtime intake classifier | iw-agent-runtime | src/agents/triage-agent.ts | VERIFIED — operational state only |
| AI extraction + Slack review | knowledge | src/triage-bot.ts | VERIFIED — all outputs pending |
| Human decision endpoint | knowledge | src/index.ts PATCH /v1/knowledge/triage/:id | VERIFIED — auth + tenant + audit |
| Session triage endpoint | knowledge | src/index.ts POST /v1/triage/session | VERIFIED — patched: no auto-approve |
| Canonical promotion engine | pipeline | src/memory-promoter.ts | VERIFIED — sole canonical writer |
| Domain governance config | knowledge | src/synthesis/knowledge-model.ts | VERIFIED — patched: all domains require governance |
| SQL approval state | sql-migrations | 058_triage_approval_status.sql | VERIFIED — `pending |
16. Acceptance Tests
- AI-generated candidate is visible in staging.
- Candidate is not visible to governed Organizational Memory queries while pending.
- Reject leaves no published memory.
- Defer leaves no published memory and can return to review.
- Approve records approver identity/time and triggers exactly one promotion.
- Promotion creates provenance/lineage and an outbox event.
- Search/index receives only published memory.
- Twin reads published memory through bounded context projection, not raw canonical storage.
- Canonical direct writes from Triage are impossible through runtime credentials/bindings.
- Reconciliation confirms the published record is retrievable after promotion.
17. Architectural Law
Triage classifies. Governance decides. The Pipeline promotes. Spine owns organizational memory. Twin consumes the governed result.