@unson/brainbase-mcp 0.15.1 → 0.15.3

package/dist/canonical-task-service.d.ts

@@ -9,6 +9,8 @@ export interface CanonicalTaskContext extends JsonRecord {
     auditPrincipal?: CanonicalTaskPrincipal | null;
     auditAuthSource?: string | null;
     idempotencyKey?: string | null;
+    /** Opaque host-policy scope, not authority or task input. */
+    storageScope?: string;
 }
 export interface CanonicalTaskRecord extends JsonRecord {
     id: string;
@@ -102,13 +104,13 @@ export interface CanonicalTaskAuditEntry extends JsonRecord {
     source_refs: unknown[];
 }
 export interface CanonicalTaskRepository {
-    list(filters: CanonicalTaskListFilters): Promise<CanonicalTaskPage>;
-    search(filters: CanonicalTaskSearchFilters): Promise<CanonicalTaskPage>;
-    get(taskId: string): Promise<CanonicalTaskRecord | null>;
-    findByIdempotencyKey(key: string): Promise<CanonicalTaskRecord | null>;
-    create(input: JsonRecord): Promise<CanonicalTaskRecord>;
-    update(taskId: string, patch: JsonRecord): Promise<CanonicalTaskRecord>;
-    delete(taskId: string, expectedVersion: number): Promise<void>;
+    list(filters: CanonicalTaskListFilters, storageScope?: string): Promise<CanonicalTaskPage>;
+    search(filters: CanonicalTaskSearchFilters, storageScope?: string): Promise<CanonicalTaskPage>;
+    get(taskId: string, storageScope?: string): Promise<CanonicalTaskRecord | null>;
+    findByIdempotencyKey(key: string, storageScope?: string): Promise<CanonicalTaskRecord | null>;
+    create(input: JsonRecord, storageScope?: string): Promise<CanonicalTaskRecord>;
+    update(taskId: string, patch: JsonRecord, storageScope?: string): Promise<CanonicalTaskRecord>;
+    delete(taskId: string, expectedVersion: number, storageScope?: string): Promise<void>;
 }
 export interface CanonicalTaskAuditRepository {
     upsertAuditLog(entry: CanonicalTaskAuditEntry): Promise<void>;
@@ -159,6 +161,7 @@ export interface CanonicalTaskPreparedDeleteRequest<T> {
     versionFingerprint: string;
     versionClaimKey: string;
     principalNamespace: string;
+    storageScope?: string;
     prepare: () => Promise<{
         result: T;
         task?: CanonicalTaskRecord | null;
@@ -237,6 +240,7 @@ export declare class CanonicalTaskService {
     private normalizeUpdateInput;
     private normalizeListFilters;
     private normalizeSearchFilters;
+    private scopeArgs;
     private normalizeContext;
     private authorize;
     private scopeFilters;

package/dist/canonical-task-service.js

@@ -147,8 +147,12 @@ function validHttpUrl(value) {
         return null;
     }
 }
-function operationKey(principal, clientKey, prefix) {
-    return `${prefix}${principalNamespace(principal)}:${clientKey}`;
+function scopedNamespace(context) {
+    return context.storageScope === undefined ? principalNamespace(context.principal)
+        : `v2.${Buffer.from(JSON.stringify({ actor: context.principal, storageScope: context.storageScope })).toString('base64url')}`;
+}
+function operationKey(context, clientKey, prefix) {
+    return `${prefix}${scopedNamespace(context)}:${clientKey}`;
 }
 function extractPersistedFingerprint(task) {
     const value = task.payload_fingerprint ?? task._payload_fingerprint;
@@ -224,7 +228,7 @@ export class CanonicalTaskService {
         const normalizedFilters = this.normalizeListFilters(filters);
         await this.authorize('list', normalizedContext, undefined, normalizedFilters);
         const scoped = await this.scopeFilters('list', normalizedContext, normalizedFilters);
-        const page = await this.read(() => this.repository.list(scoped));
+        const page = await this.read(() => this.repository.list(scoped, ...this.scopeArgs(normalizedContext)));
         return {
             ...normalizePage(page, (task) => this.normalizeResponse(task)),
             as_of: this.clock().toISOString(),
@@ -238,7 +242,7 @@ export class CanonicalTaskService {
         if (typeof this.repository.search !== 'function') {
             throw new CanonicalTaskError('task_search_unavailable', 'Canonical Task search is unavailable', 503);
         }
-        const page = await this.read(() => this.repository.search(scoped));
+        const page = await this.read(() => this.repository.search(scoped, ...this.scopeArgs(normalizedContext)));
         const normalizedPage = normalizePage(page, (task) => this.normalizeResponse(task));
         return {
             ...normalizedPage,
@@ -250,7 +254,7 @@ export class CanonicalTaskService {
     async getTask(taskId, context) {
         const normalizedId = normalizeString(taskId, 'task_id', { required: true, max: 200 });
         const normalizedContext = await this.normalizeContext(context);
-        const task = await this.read(() => this.repository.get(normalizedId));
+        const task = await this.read(() => this.repository.get(normalizedId, ...this.scopeArgs(normalizedContext)));
         if (!task)
             throw new CanonicalTaskError('task_not_found', 'Task was not found', 404, { task_id: normalizedId });
         await this.authorize('read', normalizedContext, task);
@@ -261,10 +265,10 @@ export class CanonicalTaskService {
         const clientKey = this.requireIdempotencyKey(normalizedContext);
         const payload = this.normalizeCreateInput(input);
         await this.authorize('create', normalizedContext, undefined, payload);
-        const operation = operationKey(normalizedContext.principal, clientKey, 'api:');
+        const operation = operationKey(normalizedContext, clientKey, 'api:');
         const inputFingerprint = fingerprint(payload);
         const recover = async () => {
-            const existing = await this.read(() => this.repository.findByIdempotencyKey(operation));
+            const existing = await this.read(() => this.repository.findByIdempotencyKey(operation, ...this.scopeArgs(normalizedContext)));
             if (!existing)
                 return { recovered: false };
             const existingFingerprint = extractPersistedFingerprint(existing);
@@ -288,7 +292,7 @@ export class CanonicalTaskService {
                 version: 1,
                 idempotency_key: operation,
                 payload_fingerprint: inputFingerprint,
-            }));
+            }, ...this.scopeArgs(normalizedContext)));
             return this.normalizeResponse(created);
         };
         const result = await this.executeOperation({
@@ -299,6 +303,8 @@ export class CanonicalTaskService {
             recover,
             run,
         });
+        if (normalizedContext.storageScope !== undefined)
+            await this.authorize('read', normalizedContext, result);
         const normalized = this.normalizeResponse(result);
         // Audit each invocation, including a replay/recovery. The deterministic
         // entry id lets an upsert sink collapse retries without losing evidence
@@ -367,9 +373,11 @@ export class CanonicalTaskService {
         // operation may legitimately recover after the delete removed the row.
         // The fallback path still performs the ordinary read and authorization
         // checks before invoking the local operation runner.
+        if (normalizedContext.storageScope !== undefined)
+            await this.authorize('delete', normalizedContext);
         let task = null;
         if (!this.operationRepository?.executePreparedDelete) {
-            task = await this.read(() => this.repository.get(normalizedId));
+            task = await this.read(() => this.repository.get(normalizedId, ...this.scopeArgs(normalizedContext)));
             if (!task)
                 throw new CanonicalTaskError('task_not_found', 'Task was not found', 404, { task_id: normalizedId });
             await this.authorize('delete', normalizedContext, task);
@@ -378,16 +386,19 @@ export class CanonicalTaskService {
         // The client key identifies the delete command. The task/version claim is
         // carried separately so an operation coordinator can atomically claim the
         // exact row version without allowing another actor to replay the command.
-        const operation = operationKey(normalizedContext.principal, clientKey, 'delete:');
-        const versionClaimKey = `task-version:${normalizedId}:${version}`;
+        const operation = operationKey(normalizedContext, clientKey, 'delete:');
+        const scopePrefix = normalizedContext.storageScope === undefined ? '' : `${Buffer.from(normalizedContext.storageScope).toString('base64url')}:`;
+        const versionClaimKey = `task-version:${scopePrefix}${normalizedId}:${version}`;
         const versionFingerprint = fingerprint({
             kind: 'delete',
+            ...(normalizedContext.storageScope === undefined ? {} : { storageScope: normalizedContext.storageScope }),
             taskId: normalizedId,
             expectedVersion: version,
         });
-        const actorNamespace = principalNamespace(normalizedContext.principal);
+        const actorNamespace = scopedNamespace(normalizedContext);
         const operationFingerprint = fingerprint({
             kind: 'delete',
+            ...(normalizedContext.storageScope === undefined ? {} : { storageScope: normalizedContext.storageScope }),
             taskId: normalizedId,
             expectedVersion: version,
             principalNamespace: actorNamespace,
@@ -398,7 +409,7 @@ export class CanonicalTaskService {
             version: version + 1,
         };
         const prepare = async () => {
-            const current = await this.read(() => this.repository.get(normalizedId));
+            const current = await this.read(() => this.repository.get(normalizedId, ...this.scopeArgs(normalizedContext)));
             if (!current)
                 throw new CanonicalTaskError('task_not_found', 'Task was not found', 404, { task_id: normalizedId });
             await this.authorize('delete', normalizedContext, current);
@@ -408,23 +419,25 @@ export class CanonicalTaskService {
                 result: {
                     ...result,
                     _audit_source_refs: Array.isArray(current.source_refs) ? current.source_refs : [],
+                    ...(normalizedContext.storageScope === undefined ? {} : { _storage_scope: normalizedContext.storageScope }),
                 },
                 task: current,
                 authorizationSnapshot: {
                     task_id: normalizedId,
                     task_version: current.version,
+                    ...(normalizedContext.storageScope === undefined ? {} : { storage_scope: normalizedContext.storageScope }),
                     actor: normalizedContext.principal,
                     auth_source: normalizedContext.authSource ?? null,
                 },
             };
         };
-        const findTask = async () => this.read(() => this.repository.get(normalizedId)).then((current) => {
+        const findTask = async () => this.read(() => this.repository.get(normalizedId, ...this.scopeArgs(normalizedContext))).then((current) => {
             if (current)
                 task = current;
             return current;
         });
         const removeTask = async (current) => {
-            const taskToRemove = current ?? await this.read(() => this.repository.get(normalizedId));
+            const taskToRemove = current ?? await this.read(() => this.repository.get(normalizedId, ...this.scopeArgs(normalizedContext)));
             if (!taskToRemove)
                 throw new CanonicalTaskError('task_not_found', 'Task was not found', 404, { task_id: normalizedId });
             task = taskToRemove;
@@ -433,7 +446,7 @@ export class CanonicalTaskService {
             // actor cannot delete a task using a previously prepared authorization.
             await this.authorize('delete', normalizedContext, taskToRemove);
             this.assertVersion(taskToRemove, version);
-            await this.read(() => this.repository.delete(normalizedId, version));
+            await this.read(() => this.repository.delete(normalizedId, version, ...this.scopeArgs(normalizedContext)));
         };
         let deleted;
         if (this.operationRepository?.executePreparedDelete) {
@@ -444,6 +457,7 @@ export class CanonicalTaskService {
                 versionFingerprint,
                 versionClaimKey,
                 principalNamespace: actorNamespace,
+                ...(normalizedContext.storageScope === undefined ? {} : { storageScope: normalizedContext.storageScope }),
                 prepare,
                 findTask,
                 removeTask,
@@ -463,6 +477,9 @@ export class CanonicalTaskService {
                 },
             });
         }
+        if (normalizedContext.storageScope !== undefined && deleted._storage_scope !== normalizedContext.storageScope) {
+            throw new CanonicalTaskError('task_not_found', 'Task was not found', 404);
+        }
         // A completed replay may return without prepare/findTask, because the
         // durable operation result is sufficient. Keep the audit target stable in
         // that case while avoiding a second task-store read that would turn a
@@ -494,11 +511,11 @@ export class CanonicalTaskService {
     async versionedMutation(input) {
         const taskId = normalizeString(input.taskId, 'task_id', { required: true, max: 200 });
         const expectedVersion = this.requireExpectedVersion(input.expectedVersion);
-        const current = await this.read(() => this.repository.get(taskId));
+        const current = await this.read(() => this.repository.get(taskId, ...this.scopeArgs(input.context)));
         if (!current)
             throw new CanonicalTaskError('task_not_found', 'Task was not found', 404, { task_id: taskId });
         await this.authorize(input.action, input.context, current, input.patch);
-        const operation = operationKey(input.context.principal, `${taskId}:${expectedVersion}`, `${input.action}:`);
+        const operation = operationKey(input.context, `${taskId}:${expectedVersion}`, `${input.action}:`);
         const mutationTimestamp = this.clock().toISOString();
         const patch = {
             ...input.patch,
@@ -518,6 +535,7 @@ export class CanonicalTaskService {
             patch: input.patch,
             transitionStatus: input.transitionStatus ?? null,
             principal: input.context.principal,
+            ...(input.context.storageScope === undefined ? {} : { storageScope: input.context.storageScope }),
         });
         const wasApplied = (candidate) => candidate.version === expectedVersion + 1
             && candidate._last_operation_key === operation
@@ -532,7 +550,7 @@ export class CanonicalTaskService {
             }
         }
         const recover = async () => {
-            const latest = await this.read(() => this.repository.get(taskId));
+            const latest = await this.read(() => this.repository.get(taskId, ...this.scopeArgs(input.context)));
             if (!latest)
                 throw new CanonicalTaskError('task_not_found', 'Task was not found', 404, { task_id: taskId });
             await this.authorize(input.action, input.context, latest, input.patch);
@@ -548,7 +566,7 @@ export class CanonicalTaskService {
             return { recovered: false };
         };
         const run = async () => {
-            const latest = await this.read(() => this.repository.get(taskId));
+            const latest = await this.read(() => this.repository.get(taskId, ...this.scopeArgs(input.context)));
             if (!latest)
                 throw new CanonicalTaskError('task_not_found', 'Task was not found', 404, { task_id: taskId });
             if (wasApplied(latest))
@@ -564,7 +582,7 @@ export class CanonicalTaskService {
                 ...patch,
                 _last_operation_key: operation,
                 _last_operation_fingerprint: operationFingerprint,
-            }));
+            }, ...this.scopeArgs(input.context)));
             return this.normalizeResponse(updated);
         };
         const result = await this.executeOperation({
@@ -575,6 +593,8 @@ export class CanonicalTaskService {
             recover,
             run,
         });
+        if (input.context.storageScope !== undefined)
+            await this.authorize(input.action, input.context, result, input.patch);
         const normalized = this.normalizeResponse(result);
         const auditAction = input.action === 'update'
             ? 'canonical_task.updated'
@@ -684,6 +704,9 @@ export class CanonicalTaskService {
         const limit = normalizeLimit(filters.limit, 20);
         return { ...normalized, q, query: q, tokens, limit };
     }
+    scopeArgs(context) {
+        return context.storageScope === undefined ? [] : [context.storageScope];
+    }
     async normalizeContext(context) {
         if (!context || typeof context !== 'object') {
             throw new CanonicalTaskError('unauthenticated_context', 'A task context is required', 401);
@@ -702,6 +725,10 @@ export class CanonicalTaskService {
             ? await this.policy.normalizeContext(normalized)
             : normalized;
         try {
+            if (fromPolicy.storageScope !== undefined && (typeof fromPolicy.storageScope !== 'string'
+                || !fromPolicy.storageScope.trim() || /\p{Cc}/u.test(fromPolicy.storageScope))) {
+                throw new Error('Storage scope is invalid');
+            }
             return { ...fromPolicy, principal: normalizeCanonicalTaskPrincipal(fromPolicy.principal) };
         }
         catch (error) {
@@ -759,6 +786,7 @@ export class CanonicalTaskService {
             actor_type: actor.type,
             actor_principal: actor,
             actor_namespace: principalNamespace(actor),
+            ...(context.storageScope === undefined ? {} : { storage_scope: context.storageScope }),
             auth_source: context.auditAuthSource ?? context.authSource ?? null,
             action,
             target_type: 'canonical_task',

package/dist/cli.js

@@ -4,7 +4,7 @@ import { createOrganizationGraphConfig, createOrganizationGraphClient } from './
 import { listLocalMemories, memoryListJson, registerSelectedMemories, registrationPreviewJson, renderMemoryList, renderRegistrationPreview, renderRegistrationResult, selectLocalMemories } from './personal-memory-handover.js';
 import { constants, realpathSync } from 'node:fs';
 import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
-import { delimiter, dirname, isAbsolute, join } from 'node:path';
+import { delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { initializePersonalOs, loadPersonalOs, migrateCanonicalGraph, mutatePersonalOs } from './ssot.js';
 import { diagnoseGraph } from './graph-diagnosis.js';
@@ -21,6 +21,8 @@ import { renderGuidedFirstRun } from './guided-onboarding.js';
 import { blockedJudgmentOutput, processJudgmentHook } from './judgment-host.js';
 import { applyCanonicalWrites, buildCanonicalEdge } from './canonical-edge-builder.js';
 import { defaultJudgmentJournalRoot } from './judgment-value-proof-review.js';
+import { createWorldExtension, readWorldVocabulary } from './world-extension.js';
+import { createOrganizationGraphSource } from './organization-graph-web.js';
 import { createLocalWebHost, LOCAL_WEB_DEFAULT_PORT } from './local-web-host.js';
 export async function runCli(argv = process.argv.slice(2), io = process) {
     const parsed = parseArgs(argv);
@@ -1043,7 +1045,38 @@ async function webServe(parsed, io, command) {
     if (!Number.isInteger(port) || port < 0 || port > 65535) {
         throw new Error(`${command} requires --port to be an integer between 0 and 65535`);
     }
-    const { server } = createLocalWebHost({ dataDir, journalRoot });
+    // World view (ledger P17): the businesses as a city above the home. Off unless the flag is given.
+    const world = parsed.flags.has('world');
+    // The owner's words for project kinds and statuses (labels, buildings, lifecycle phases).
+    const worldVocabularyPath = first(parsed, 'world-vocabulary');
+    if (worldVocabularyPath !== undefined && !world)
+        throw new Error(`${command} --world-vocabulary requires --world`);
+    const worldVocabulary = worldVocabularyPath === undefined ? undefined : await readWorldVocabulary(resolve(worldVocabularyPath));
+    // Ledger C1: the Graph screens read the owner's organization Graph read only.
+    let organizationGraph = null;
+    if (parsed.flags.has('organization-graph')) {
+        const source = await createOrganizationGraphSource();
+        if ('reason' in source) {
+            throw new Error(`${command} --organization-graph cannot read the organization Graph (${source.reason}); sign in with brainbase auth first`);
+        }
+        organizationGraph = source;
+    }
+    // Where the organization's records are corrected; the read-only screens link to it.
+    const organizationWeb = first(parsed, 'organization-web');
+    if (organizationWeb !== undefined) {
+        if (!organizationGraph)
+            throw new Error(`${command} --organization-web requires --organization-graph`);
+        if (!/^https:\/\/[^/?#@\s]+$/u.test(organizationWeb)) {
+            throw new Error(`${command} --organization-web must be an https origin such as https://org.example.com`);
+        }
+        organizationGraph = { ...organizationGraph, webUrl: organizationWeb };
+    }
+    const { server } = createLocalWebHost({
+        dataDir,
+        journalRoot,
+        extensions: world ? [createWorldExtension(worldVocabulary ? { vocabulary: worldVocabulary } : {})] : [],
+        ...(organizationGraph ? { organizationGraph } : {})
+    });
     await new Promise((resolveListen, rejectListen) => {
         server.once('error', rejectListen);
         server.listen(port, '127.0.0.1', () => resolveListen());
@@ -1057,6 +1090,9 @@ async function webServe(parsed, io, command) {
         `- 目的と現状: ${origin}/#objectives`,
         `- プロジェクトと関係者: ${origin}/#projects`,
         `- 情報と関係: ${origin}/#graph`,
+        ...(world ? [`- 世界: ${origin}/#world`] : []),
+        ...(organizationGraph ? [`組織のGraph（読み取りのみ）: ${organizationGraph.server}`] : []),
+        ...(organizationGraph?.webUrl ? [`組織版（訂正の入口）: ${organizationGraph.webUrl}`] : []),
         `データ: ${dataDir}`,
         `判断journal: ${journalRoot}`,
         '終了: Ctrl+C',
@@ -1213,7 +1249,7 @@ function usage() {
   brainbase judgment:install --target codex [--autonomy-mode off|canary|on] [--autonomy-project code] [--dry-run] [--output path]
   brainbase judgment:hook [--autonomy-mode off|canary|on] [--autonomy-project code]
   brainbase doctor [--dir path] [--judgment-hooks path]
-  brainbase web:serve [--dir path] [--journal path] [--port n]
+  brainbase web:serve [--dir path] [--journal path] [--port n] [--world [--world-vocabulary file]] [--organization-graph [--organization-web https-origin]]
   brainbase review:serve [--dir path] [--journal path] [--port n]  （web:serveの別名）
 `;
 }

package/dist/graph-web-http.d.ts

@@ -1,4 +1,5 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type GraphWebAnySource, type InMemoryGraphReader } from './graph-web.js';
 export declare const GRAPH_WEB_HTTP_VERSION: "graph-web-http.v1";
 export interface GraphWebHttpOptions {
     /** Personal OS data directory chosen by the host. Never taken from the request. */
@@ -11,6 +12,12 @@ export interface GraphWebHttpOptions {
      */
     readonly assertWriteAllowed?: (request: IncomingMessage) => void | Promise<void>;
     readonly now?: () => Date;
+    /**
+     * Ledger C1: read every route from a Graph the host holds in memory (the
+     * owner's organization Graph) instead of the data directory. Corrections
+     * are refused as read only.
+     */
+    readonly readGraph?: () => Promise<InMemoryGraphReader<GraphWebAnySource>>;
 }
 export type GraphWebHttpHandler = (request: IncomingMessage, response: ServerResponse) => Promise<boolean>;
 /**

package/dist/graph-web-http.js

@@ -52,6 +52,9 @@ export function createGraphWebHttpHandler(options) {
             if (route.name === 'corrections') {
                 if (request.method !== 'POST')
                     throw methodNotAllowed('POST');
+                if (options.readGraph) {
+                    throw new HttpError(403, 'organization_graph_read_only', 'This host reads the organization Graph read only; correct it in the organization edition');
+                }
                 await assertWriteAllowed(options.assertWriteAllowed, request);
                 const body = await readJsonBody(request);
                 const result = await applyGraphCorrection(dataDir, body, { now: now() });
@@ -62,6 +65,17 @@ export function createGraphWebHttpHandler(options) {
                 throw methodNotAllowed('GET');
             const asOf = queryValue(url, 'as_of');
             const readOptions = { ...(asOf !== undefined ? { asOf } : {}), now: now() };
+            if (options.readGraph) {
+                const reader = await options.readGraph();
+                const body = route.name === 'status' ? reader.status(readOptions)
+                    : route.name === 'projects' ? reader.listProjects(readOptions)
+                        : route.name === 'project' ? reader.readProject(route.id, readOptions)
+                            : route.name === 'search' ? reader.search({ q: queryValue(url, 'q'), type: queryValue(url, 'type'), asOf, limit: parseLimit(queryValue(url, 'limit')), now: readOptions.now })
+                                : route.name === 'entity' ? reader.readEntity(route.id, readOptions)
+                                    : reader.ontology(readOptions);
+                writeJson(response, 200, body);
+                return true;
+            }
             switch (route.name) {
                 case 'status':
                     writeJson(response, 200, await readGraphWebStatus(dataDir, readOptions));

package/dist/graph-web.d.ts

@@ -1,7 +1,7 @@
 import { GRAPH_CORRECTIONS_FILE, type GraphCorrectionRecord } from './graph-corrections.js';
 import { type PortableGraphOwner } from './portable-graph.js';
 import type { FoundationAdoptionState, FoundationOperator } from './ontology-foundation.js';
-import type { CanonicalEdge, CanonicalEntityKind, CoreRelation } from './types.js';
+import type { CanonicalEdge, CanonicalEntityKind, CoreRelation, GraphFileV2 } from './types.js';
 /**
  * Read views of the canonical local Graph for the local Web screens
  * "プロジェクトと関係者" and "情報と関係".
@@ -34,7 +34,20 @@ export interface GraphWebOwnerPrivateSource {
     graphFormat: 2;
     authority: 'owner_private';
 }
-export type GraphWebAnySource = GraphWebSource | GraphWebOwnerPrivateSource;
+/**
+ * The owner's organization Graph read through the host (ledger C1): read only,
+ * held in memory, never written to the data directory.
+ */
+export interface GraphWebOrganizationSource {
+    dataDir: null;
+    graphFormat: 2;
+    authority: 'organization_graph';
+    /** Organization server origin, without credentials. */
+    server: string;
+    /** When the host last read the organization Graph. */
+    readAt: string;
+}
+export type GraphWebAnySource = GraphWebSource | GraphWebOwnerPrivateSource | GraphWebOrganizationSource;
 export interface GraphMigrationRequired {
     status: 'migration_required';
     source: GraphWebSource;
@@ -132,10 +145,10 @@ export interface GraphEdgeView {
     };
     digest: string;
 }
-export interface GraphWebStatus {
+export interface GraphWebStatus<S extends GraphWebAnySource = GraphWebSource> {
     status: 'ok';
     version: typeof GRAPH_WEB_VERSION;
-    source: GraphWebSource;
+    source: S;
     asOf: string;
     ontology: {
         id: string;
@@ -289,9 +302,9 @@ export interface GraphObjectiveList<S extends GraphWebAnySource = GraphWebSource
     /** True when the foundation was read and holds no objective. */
     absenceConfirmed: boolean;
 }
-export interface GraphOntologySummary {
+export interface GraphOntologySummary<S extends GraphWebAnySource = GraphWebSource> {
     status: 'ok';
-    source: GraphWebSource;
+    source: S;
     asOf: string;
     ontology: {
         id: string;
@@ -361,4 +374,21 @@ export interface OwnerPrivateGraph {
  * machine, so a relation's source ID is shown unresolved.
  */
 export declare function openOwnerPrivateGraph(bundle: unknown, owner: PortableGraphOwner): OwnerPrivateGraph;
+/** Read views of one in-memory Graph v2 held by the host (no data directory, no corrections). */
+export interface InMemoryGraphReader<S extends GraphWebAnySource> {
+    readonly source: S;
+    status(options?: GraphWebReadOptions): GraphWebStatus<S>;
+    listProjects(options?: GraphWebReadOptions): GraphProjectList<S>;
+    readProject(projectId: string, options?: GraphWebReadOptions): GraphProjectDetail<S>;
+    search(input?: GraphEntitySearchInput): GraphEntitySearchResult<S>;
+    readEntity(entityId: string, options?: GraphWebReadOptions): GraphEntityDetail<S>;
+    ontology(options?: GraphWebReadOptions): GraphOntologySummary<S>;
+}
+/**
+ * The same read views as the local Graph routes over a Graph v2 the host
+ * holds in memory (the organization Graph read under C1).  The Graph is
+ * checked with the canonical validator first; nothing is written, and there
+ * are no correction records or relation sources to resolve.
+ */
+export declare function openInMemoryGraph<S extends GraphWebAnySource>(graph: GraphFileV2, source: S): InMemoryGraphReader<S>;
 export {};

package/dist/graph-web.js

@@ -1,6 +1,6 @@
 import { access, readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { isActiveAt } from './canonical-graph.js';
+import { isActiveAt, validateCanonicalGraph } from './canonical-graph.js';
 import { assertFoundationCatalog, findFoundationRecord } from './foundation-catalog.js';
 import { GRAPH_CORRECTION_EDGE_FIELDS, GRAPH_CORRECTION_ENTITY_FIELDS, GRAPH_CORRECTION_NEW_EDGE_RELATIONS, GRAPH_CORRECTION_PROJECT_FIELDS, GRAPH_CORRECTIONS_FILE, graphRecordDigest, readGraphCorrectionHistory } from './graph-corrections.js';
 import { ONTOLOGY_VERSION, portableOntology } from './ontology.js';
@@ -207,12 +207,13 @@ export async function readGraphOntology(dataDir, options = {}) {
     const loaded = await loadForRead(dataDir);
     if ('status' in loaded)
         return loaded;
-    const asOf = resolveAsOf(options);
-    const { graph } = loaded;
+    return ontologyOf(loaded.graph, loaded.source, resolveAsOf(options));
+}
+function ontologyOf(graph, source, asOf) {
     const concepts = new Map(portableOntology.domains.types.concepts.map((concept) => [concept.id, concept.meaning]));
     return {
         status: 'ok',
-        source: loaded.source,
+        source,
         asOf,
         ontology: { ...graph.ontology, currentVersion: ONTOLOGY_VERSION, upToDate: graph.ontology.version === ONTOLOGY_VERSION },
         entityTypes: ENTITY_KINDS.map((kind) => ({
@@ -304,6 +305,46 @@ export function openOwnerPrivateGraph(bundle, owner) {
         }
     });
 }
+/**
+ * The same read views as the local Graph routes over a Graph v2 the host
+ * holds in memory (the organization Graph read under C1).  The Graph is
+ * checked with the canonical validator first; nothing is written, and there
+ * are no correction records or relation sources to resolve.
+ */
+export function openInMemoryGraph(graph, source) {
+    try {
+        validateCanonicalGraph(graph);
+    }
+    catch (error) {
+        throw new GraphWebError('unavailable', 'graph_invalid', errorMessage(error));
+    }
+    return Object.freeze({
+        source,
+        status: (options = {}) => {
+            const asOf = resolveAsOf(options);
+            const entities = Object.fromEntries(ENTITY_KINDS.map((kind) => [kind, graph.entities.filter((entity) => entity.type === kind).length]));
+            return {
+                status: 'ok',
+                version: GRAPH_WEB_VERSION,
+                source,
+                asOf,
+                ontology: { ...graph.ontology, currentVersion: ONTOLOGY_VERSION },
+                counts: {
+                    entities: { ...entities, total: graph.entities.length },
+                    edges: { total: graph.edges.length, active: graph.edges.filter((edge) => isActiveAt(edge, asOf)).length },
+                    relationships: 0,
+                    corrections: 0
+                },
+                issues: []
+            };
+        },
+        listProjects: (options = {}) => projectListOf(graph, source, resolveAsOf(options)),
+        readProject: (projectId, options = {}) => projectDetailOf(graph, source, projectId, resolveAsOf(options), NO_REFERENCES),
+        search: (input = {}) => entitySearchOf(graph, source, parseSearchInput(input)),
+        readEntity: (entityId, options = {}) => entityDetailOf(graph, source, entityId, resolveAsOf(options), NO_REFERENCES),
+        ontology: (options = {}) => ontologyOf(graph, source, resolveAsOf(options))
+    });
+}
 function decisionRecordView(record) {
     return {
         title: record.title,

package/dist/judgment-value-proof-review.d.ts

@@ -12,6 +12,11 @@ export declare const JUDGMENT_VALUE_PROOF_FEEDBACK_LAYERS: readonly JudgmentValu
 export interface JudgmentValueProofJournalEntry {
     readonly file: string;
     readonly proof: JudgmentValueProof;
+    /**
+     * For a judgment waiting for the owner: when another turn of the same conversation was first finalized
+     * after it, i.e. the conversation moved on (the owner answered there or changed the subject); null otherwise.
+     */
+    readonly conversation_moved_on_at?: string | null;
 }
 export interface JudgmentValueProofJournalRejection {
     readonly file: string;
@@ -88,6 +93,8 @@ export interface JudgmentValueProofReviewItem {
     readonly feedback_history: readonly JudgmentValueProofFeedbackRecord[];
     /** The owner's recorded answer to a judgment returned to them; null when there is none. */
     readonly answer?: JudgmentValueProofAnswerRecord | null;
+    /** See `JudgmentValueProofJournalEntry.conversation_moved_on_at`. Such a judgment is no longer answered here. */
+    readonly conversation_moved_on_at?: string | null;
 }
 export type JudgmentValueProofReviewHome = {
     readonly status: 'unavailable';
@@ -157,12 +164,29 @@ export interface JudgmentDelegationMap {
     readonly continued_after_ask: readonly JudgmentDelegationItemRef[];
 }
 export declare function defaultJudgmentJournalRoot(dataDir?: string): string;
+/**
+ * Remembers which value proofs each folder of a judgment journal held, so that a later read lists only
+ * the folders that changed. A folder is listed again when its inode, mtime or ctime differs from the
+ * listing, or when it was listed within a few seconds of its last change. The judgment Host creates
+ * value proofs and finals by linking a new file and never rewrites them, so every new or removed file
+ * changes the folder's mtime. It keeps no proof contents; every read still reads each proof.
+ * Use one cache per journal.
+ */
+export declare class JudgmentValueProofJournalCache {
+    #private;
+    /** The value proof files in `folder`, reusing the last listing while the folder is unchanged. */
+    valueProofFiles(folder: string): Promise<readonly string[]>;
+    /** Forgets folders that are no longer in the journal. */
+    retainOnly(folders: ReadonlySet<string>): void;
+}
 /**
  * Reads saved judgment value proofs from `<root>/*.value-proof.json` and
  * `<root>/<session>/*.value-proof.json`. The journal is read-only here.
+ * With `cache`, folders unchanged since an earlier read are not listed again; without it every folder is listed.
  */
 export declare function readJudgmentValueProofJournal(options?: {
     readonly root?: string;
+    readonly cache?: JudgmentValueProofJournalCache;
 }): Promise<JudgmentValueProofJournalRead>;
 export declare function classifyJudgmentValueProof(proof: JudgmentValueProof): JudgmentValueProofReviewSection;
 /** Reads all recorded feedback in append order. A missing file means no feedback has been recorded. */