Context Inbox MVP: prove MCP agent capture with citations and freshness

[DanielJD1216]

Goal

Prove the first synthetic Context Inbox tracer for the Source Wire product direction: an MCP-capable AI agent may submit one explicit, bounded source snapshot through Source Wire API policy, receive a source citation and synchronization cutoff, and later retrieve that source-only context without creating trusted memory.

This is a public-safe state-transition proof. It is not a live connector, database-backed inbox, deployed MCP server, or real-data pilot.

User problem

Context is scattered across Slack, email, meeting assistants, documents, local files, Codex, Claude Code, GitHub, and operational tools. The originals should remain in those systems, but any authorized AI should be able to access previously synchronized context through one governed MCP boundary with source ownership, links, citations, and freshness preserved.

First tracer

synthetic MCP capture request
→ Source Wire API policy
→ validated source envelope
→ append-only caller-supplied inbox state
→ capture receipt with citation and sync cutoff
→ source-only search result

Required source envelope

The explicit caller-supplied envelope must carry bounded synthetic values for:

• envelope and source-record identity;
• source kind: Slack, email, meeting, document, code, operations, or custom;
• source revision;
• title;
• source-native locator;
• source occurrence time;
• capture time;
• sensitivity;
• exact source snapshot content;
• fixtureSafety: synthetic;
• instructionAuthority: none.

Owner and namespace authority come from the authenticated policy request, not from source content or model claims. Content digest is derived by Source Wire.

Required behavior

1. A caller with the exact namespace and import_or_maintain_sources capability may append one valid synthetic envelope.
2. MCP capture maps through the API policy boundary and cannot bypass it.
3. Capture returns bounded metadata, exact citation, content digest, and synchronizedThrough without returning snapshot content.
4. Replaying the same source record, revision, and digest is idempotent.
5. Reusing the same source record and revision with different content fails closed as a source-revision conflict.
6. Wrong namespace or missing capability fails before state mutation.
7. Missing provenance, malformed dates, invalid locator, non-synthetic fixture, oversized content, or instruction authority fails closed.
8. Search returns only source evidence with citation and freshness cutoff.
9. Capture and search create no pending candidate and no trusted memory.
10. Existing Alpha MCP profiles remain unchanged.

Mandatory TDD order

For each behavior:

1. Add one focused failing fixture or smoke assertion.
2. Run the narrow smoke and preserve the expected RED result.
3. Implement the minimum behavior.
4. Run the narrow smoke GREEN.
5. Run affected package gates before the next behavior.

Initial allowed paths

• src/runtime-skeleton/
• src/index.ts
• examples/runtime-skeleton/
• examples/fixtures/runtime-skeleton/
• focused docs describing the synthetic Context Inbox proof
• package scripts only if a dedicated smoke command is required

Any expansion into apps/alpha1-runtime/, migrations, deployment, connectors, or published package metadata requires a separate reviewed slice.

Acceptance

• Valid MCP-originated synthetic capture passes through API policy.
• State transition is append-only and immutable.
• Exact replay is idempotent.
• Conflicting source revision fails closed.
• Namespace and capability denial mutate nothing.
• Citation, source revision, digest, and freshness cutoff are preserved.
• Search distinguishes source-only evidence from trusted memory.
• Snapshot content is absent from receipts, audit, and denial output.
• trustedMemoryCreated and pendingCandidateCreated remain false.
• Existing runtime-skeleton behavior remains compatible.
• Typecheck, focused smoke, tests, docs, safety, and claims checks pass.
• Independent exact-diff review passes before commit.

Stop conditions

Stop immediately if the slice would:

• ingest real Slack, email, meeting, document, code, or client data;
• crawl a local folder or broad export;
• add a live connector or platform credential;
• add a production or reachable MCP/API listener;
• change the Alpha MCP tool profiles;
• add a database migration or non-disposable storage;
• let source content grant namespace, capability, sensitivity, or approval authority;
• let MCP approve, correct, revoke, or auto-promote trusted memory;
• expose snapshot content, private locators, credentials, or identifiers in logs;
• publish a package, tag, release, deployment, or production-readiness claim.

Relationship to Gate B operations

This product-validation tracer does not close or weaken #296. Gate B operations, backup, restore, monitoring, rollback, target-host testing, real-data approval, and production activation remain separate blocked gates.