Grilling: Resources component placement and Resource ownership

[antejavor]

Part of #454

Question

Where does the Resources component live and who owns Resource nodes? A new resources-graph package alongside actions/skills/sessions-graph, or an extension of sessions-graph or unstructured2graph? A public resource is shared across users and sessions rather than user-owned (unlike a Memory) — what owns it, how is it joined to (:Session)/(:Action), and does that shared ownership fit the existing "every Memory is user-owned" invariant?

[antejavor]

Resolution — new resources-graph package; Resources shared, Touches private

Built on Resource capture model — passive, active, or hybrid.

1. New package context-graph/resources-graph — fifth sibling of actions/skills/sessions-graph, standard shape: connector consumes tool-call + prompt events and writes Touches (owns address extraction); core owns the Resource/Touch model; cli is the Sweep; a Tool is the read side (what a Resource cache hit means designs it). Not sessions-graph (would import a GitHub client, token, rate limits, per-platform models into the memory/reconciliation context), not actions-graph (observability, collection-tier, explicitly not memory), not unstructured2graph (generic text→Chunk pipeline with no Session/Touch notion — Resources may use it for chunking, still fog). resources-graph is free on PyPI (resource-graph is taken).
2. Name: Resource. Generalises to webpages/PDFs/pasted text — address→resource is URI semantics; platforms supply kinds (GitHub: Repository/Issue/PullRequest; later Page, PDF). An MCP resource is just one access channel to a Resource. unstructured2graph's Source stays the ingestion input address; a Resource is the persisted, identified thing. Rejected: Source (3 existing meanings), Document (a repo/listing isn't one), Reference (clashes with GitHub cross-references; implies pointer-only), Web/Page (excludes PDFs/text).
3. Ownership. A Resource belongs to no user — shared public canonical content, written only by resources-graph; user B gets cache hits on user A's sweep with nothing leaked (public by construction). A Touch is private exploration, scoped to its user via (:User)-[:HAD_SESSION]->(:Session): others see the Resource and its freshness, never who explored it, when, or which listing. A Resource is not a Memory — "every Memory is user-owned" is unaffected. Team visibility of exploration, if ever wanted, is a later access-control feature, not the default.
4. Soft joins, no import dependency. resources-graph MERGEs (:Session), never (:User); without sessions-graph Touches exist unscoped and the read side fails closed (no HAD_SESSION path → not shown cross-user). The Touch stores the event's tool_use_id (or prompt-event identity); the Sweep draws Touch→Action / Touch→Agent edges after both exist, avoiding connector-ordering races. Requires actions-graph to expose tool_use_id as a matchable Action property. Depends on agent-context-graph only as an extra, like its siblings.