feat(memory): spoke-memory optional capability family — wire, operations, engine, Connect, conformance

.mstar/specs/spoke-connect.md

@@ -374,7 +374,7 @@ Open string (documented, not JSON Schema enum). Schema `description` on `Connect
 
 `extract` is a **whole-operation** core op: `payload` carries the existing extraction request envelope itself and the success `payload` carries the existing extraction response envelope (`{ candidates, run, extensions? }`) — no `{ request }` / `{ result }` wrapper. The serving host performs the extraction orchestration, including source loading through its own in-process loader port, so the loaded input value is host-local and is never a request or response field. Its requester-side surface is the `extract` method on the remote adapter ([`spoke-remote-adapter.md`](spoke-remote-adapter.md) D4).
 
-Reserved product prefixes are open strings documented in specs only — the connect schema `description` on `ConnectInvokeRequest.op` lists the eight core values and stays closed to product prefixes. `port.*` is the reserved product prefix for proxied `BaselinePorts` method calls — the baseline six families plus the optional `project` / `compute` / `listForkTimelineEvents` methods ([`spoke-remote-adapter.md`](spoke-remote-adapter.md)); `tools.<ns>.<tool_id>` is the reserved product prefix for self-describing tool invokes declared in `HostCapabilityManifest.tools[]` (see [`spoke-data-model.md`](spoke-data-model.md) §HostCapabilityManifest and §[Op dispatch gate](#op-dispatch-gate)).
+Reserved product prefixes are open strings documented in specs only — the connect schema `description` on `ConnectInvokeRequest.op` lists the eight core values and stays closed to product prefixes. `port.*` is the reserved product prefix for proxied `BaselinePorts` method calls — the baseline six families plus the optional `project` / `compute` / `listForkTimelineEvents` methods ([`spoke-remote-adapter.md`](spoke-remote-adapter.md)); `tools.<ns>.<tool_id>` is the reserved product prefix for self-describing tool invokes declared in `HostCapabilityManifest.tools[]` (see [`spoke-data-model.md`](spoke-data-model.md) §HostCapabilityManifest and §[Op dispatch gate](#op-dispatch-gate)). `memory.*` is the reserved product prefix for the optional `spoke-memory` family — one op per typed `MemoryPort` method, 33 ops across three capability flags ([`spoke-memory.md`](spoke-memory.md) §7).
 
 Unknown `op` values are valid on the wire; receivers return `ErrorEnvelope` with an appropriate `code` (e.g. `op_unsupported`) when they cannot handle them. Connect does not close the vocabulary. The core vocabulary above MUST stay in sync with the schema `description` fields under `schemas/connect/` and the corresponding ops schema text under `schemas/ops/`.
 
@@ -389,10 +389,13 @@ Required capabilities (core table):
 | `upsert`, `promote`, `relate`, `check`, `assemble` | `spoke-baseline` (or a deployment-documented synonym that both peers list and intersect into `negotiated_capabilities`) |
 | `project`, `compute` | `l2-computable` |
 | `extract` | `ke-extraction` |
+| `memory.*` (reserved product prefix; 33 ops) | `spoke-memory` for the 25 core ops; `spoke-memory-reflection` for `memory.reflections.state` / `.list` / `.generate`; `spoke-memory-transfer` for `memory.exports.*` / `memory.imports.*` |
 | `tools.<ns>.<tool_id>` (reserved product prefix) | the op string itself |
 
 `tools.*` is a **core gate rule**: `tools.<ns>.<tool_id>` ops are self-describing, so the required capability is the op string itself — no registry, no umbrella flag. This is the core-table counterpart of `port.*` being product-map territory: a `tools.*` op never consults a product capability map. A tool id enters `negotiated_capabilities` only when both hellos list that exact string (the agreed-subset rule of §[Session-core state machine](#session-core-state-machine)); the gate then evaluates that exact string as for every op.
 
+**`memory.*` family rule (`MEM-R019`, `MEM-R020`).** The 33 memory ops carry core-table rows, split by the family's three flags (§4.1 and §7 of [`spoke-memory.md`](spoke-memory.md)): 25 core ops require `spoke-memory`, the 3 `memory.reflections.*` ops require `spoke-memory-reflection`, and the 5 `memory.exports.*` / `memory.imports.*` ops require `spoke-memory-transfer`. A host declaring a sub-flag MUST also declare `spoke-memory`; a host declaring only `spoke-memory` denies the sub-flag ops with `capability_missing` before any handler runs, with zero side effects. **No fallback exists:** when `spoke-memory` is not negotiated, memory semantics have no substitute on the wire — a peer MUST NOT emulate them through `KnowledgeEntry`, `modules.*`, `Scope.viewpoint`, or `port.*` ops (`MEM-R019`), and the memory grant model never consults `ke-ownership` / `Scope.viewpoint` semantics (`MEM-R020`): memory ops carry no `Scope` and the `ke-ownership` conjunct below never applies to them.
+
 **Conditional capability requirement — declared Scope viewpoint (`ke-ownership`).** The Scope-bearing remote ops — `port.scope.list_knowledge_entries`, `port.scope.list_timeline_events`, `port.fork.list_timeline_events` — carry one payload-dependent conjunct on top of their row capability: when the request payload declares `scope.viewpoint` as a non-empty string, `negotiated_capabilities` MUST also contain `ke-ownership`. The predicate reads that declared location only — no trimming, normalization, holder lookup, owner comparison, or recursive scan of arbitrary JSON — so `owner` / `disclosure` in a knowledge entry, a top-level `viewpoint`, `extensions.*`, tool `arguments.scope`, source anchors, and opaque metadata never trigger it. Identifiers are opaque: a whitespace-only viewpoint is non-empty and triggers the conjunct. `extract` and the `tools.*` family carry no Scope and never require `ke-ownership`.
 
 The conjunct is **additional, never a replacement**: a viewpoint-bearing Scope op still requires its own row capability (`spoke-baseline`, or `l5-fork` for the fork timeline op) plus `ke-ownership`. Because the requirement is payload-dependent it is evaluated at the remote/product dispatch boundary rather than in the core table: `required_capability(op)` keeps its op-only signature and no `ke-ownership` op exists. A host that cannot satisfy the conjunct answers the existing dispatch-deny branch (`op_unsupported`) before any host side effect — the same wire code as a missing row capability, with no new wire code introduced. A peer-selection layer that filters on cached advertised manifests applies the same predicate as a **hard capability filter**, never a soft preference; advertisement is not authorization, so the selected peer's responder still evaluates the conjunct against its negotiated set.
@@ -445,6 +448,8 @@ A new or modified ops family that is intended to be remotely invokable over conn
 
 **`ke-ownership` (conditional conjunct, not an op):** the ownership capability is advertised in `HostCapabilityManifest.capabilities` like any other capability, but it maps to **no** `op` row. It is the payload-dependent conjunct of §[Op dispatch gate](#op-dispatch-gate) over the Scope-bearing ops: a request that declares a non-empty `scope.viewpoint` requires it **in addition to** the row capability. Registration therefore declares the capability name only — the predicate over the declared Scope stays at the dispatch boundary, not in the core table.
 
+**`spoke-memory` family (reserved product prefix):** registers through items 1–4 — 33 stable `memory.*` strings (§7 of [`spoke-memory.md`](spoke-memory.md)) kept in sync with this spec and the `description` fields under `schemas/ops/`; the three capability names `spoke-memory`, `spoke-memory-reflection`, `spoke-memory-transfer` advertised in `HostCapabilityManifest.capabilities` (both peers list the exact string for it to enter `negotiated_capabilities`); and opaque `payload` wrapping of the existing `memory-*` request/response envelopes. No connect envelope field changes. The serving host exposes the connect-owned `RemoteMemoryService` seam, which `MemoryPortService` implements over a provider `MemoryPort` (typed per-op delegation plus a peer→`Principal` admission context) — see [`spoke-remote-adapter.md`](spoke-remote-adapter.md) D4/D14.
+
 Connect schemas and the six envelope shapes stay closed; extensibility is vocabulary + capabilities + opaque payload, not new connect fields.
 
 ## Tools over connect
@@ -763,6 +768,7 @@ The Rust reference maps these envelopes onto rust-libp2p: **noise** for authenti
 | [`spoke-data-model.md`](spoke-data-model.md) | `HostCapabilityManifest` field tables (embedded by hello) |
 | [`spoke-ops.md`](spoke-ops.md) | Ops wire + error envelope (wrapped as opaque invoke payloads) |
 | [`spoke-operations.md`](spoke-operations.md) | Lifecycle helpers; adapter ports; `HostManifestPort` |
+| [`spoke-memory.md`](spoke-memory.md) | `spoke-memory` family — 33 `memory.*` ops riding these envelopes, capability split, `MEM-R019`/`MEM-R020` fallback prohibition |
 | [`schemas/README.md`](../../schemas/README.md) | Connect schema files under `schemas/connect/` |
 | [`crates/spoke-connect/README.md`](../../crates/spoke-connect/README.md) | Rust reference (libp2p transport + Path B uniffi binding surface) |
 | [`CONCEPTS.md`](../../CONCEPTS.md) | Connect envelope family / Session (connect) / peer_id vocabulary |

.mstar/specs/spoke-data-model.md

@@ -932,7 +932,7 @@ Normative mirror of the Spoke Protocol Research canvas `TYPE_MAP`. Integrators c
 - **ComputableFieldMap** — open object for `body.state` and `body.computable` under `l2-computable`
 - **BodyAttribute** — scalar trait item in `body.attributes[]` (`trait_type` + `value`; optional `display_type`, `max_value`)
 - **ComputableLogEntry** — Moment-scale presentation on `TimelineEvent.computable_logs` (not Finding)
-- **World KB / Author Memory** — product-local stores; mapped via adapters in a later iteration, not redefined here
+- **World KB / Author Memory** — World KB stays a product-local store mapped via adapters. Author Memory is standardized as the optional `spoke-memory` capability family: thirteen models in `schemas/data/` (reusing `SourceAnchor` and the common primitives) and 33 `memory.*` ops, documented in [`spoke-memory.md`](spoke-memory.md) rather than duplicated here. A product that does not implement the family keeps memory product-local and MUST NOT emulate memory semantics through KnowledgeEntry, `modules.*`, `Scope.viewpoint`, or `port.*` ops (`MEM-R019`); memory grants are self-contained and never consult `ke-ownership` (`MEM-R020`)
 - **Finding** — checker output, not a KnowledgeEntry body
 - **HostCapabilityManifest** — in-process adapter self-description (`host_id`, `roles`, `capabilities`, `namespaces`); distinct from KnowledgeEntry
 - **Host role** — open string in `HostCapabilityManifest.roles[]`; core vocabulary: `data-store`, `input-source`, `checker`, `assembler`, `computable-engine`