# Capture capability — implementation report (as-built) **Status:** Shipped 2026-06-23, tagged `v0.11.0`. Epic hyperguild #49 (sub-issues #50–#55) closed. **Superseded 2026-07-27:** the `summary` → `ai-sessions` write path documented below was removed. It wrote a frontmatter shape (`title`/`harness`/`fidelity`/`captured_at`/`repos_touched`) that `ai-sessions`' own extract/audit pipeline couldn't parse — invisible to that repo's own audit tooling and bypassing its redaction/completeness gates (`ai-sessions#13`). `capture` now persists insights → brain and action items → Gitea tickets only. This document is kept as the historical as-built record of what shipped in #49; treat every `summary`/ai-sessions reference below as retired, not current behaviour. **Spec:** `specs/capture-bdd-spec.md` (the design contract this implements). **Governed by:** `infra/docs/architecture/01-invariants.md` (I1–I5) + the I2 acceptance ledger entry in `infra/docs/security-baseline.md`. This document records what was actually built, where it lives, how it maps to the spec, and what was deferred — for onboarding and future audit. It does not restate the design rationale (see the spec and the linked brain entries). --- ## 1. Outcome One uniform capture capability — insights → brain, action items → Gitea tickets, optional summary → ai-sessions — reachable identically from every harness: - **In-process / direct-REST harnesses** (Claude Code CLI, Agentsquad, claude.ai Code, headless): `POST /capture` on the brain server. - **MCP-native harnesses** (claude.ai Chat/Cowork/Design, Crush, Pi, LLM Council): the `capture` MCP tool, reached over the existing `/mcp` OAuth connector. Both doors call the **same** `CaptureService`; only the transport and credential assembly differ. The persistence behaviour (validation, classification, I1 gate, orchestration, I5 audit, partial receipt) is written once. --- ## 2. Architecture (as-built) ``` POST /capture (REST) capture MCP tool capturehttp.Handler mcp.Server.brainCapture \ / \ (auth → principal → / \ origin; decode) / v v capture.CaptureService (use-case, pure) ┌───────────────┬───────────────┬──────────────┬───────────────┐ BrainStore IssueTracker SummaryWriter ClassificationPolicy AuditSink brainstore. gitea.Client (nil today) classification.Config audit.Degrading Store (REST) Sink / SlogSink │ │ api.WriteNote/UpdateNote/ReadNote (#45) LokiCentral + FileBuffer + wing index + auto-tunnel + graph re-index + NtfyNotifier + Reconcile ``` - **`internal/capture/`** — the use-case + ports + entities. Pure; no I/O. Owns validation (fail-closed), effective-classification resolution (stricter wins), the **I1 sovereignty gate**, best-effort orchestration, the **two-phase I5 audit** (Reserve before writes / Record after), and the partial-aware receipt. - **`internal/brainstore/`** — concrete `BrainStore` wrapping the #45 `api` primitives + wiki upkeep (wing `_index`, auto-tunnel, graph re-index). The MCP `brain_write`/`brain_update`/`brain_get` handlers were re-pointed at it: one implementation, not two. - **`internal/classification/`** — `public < internal < confidential` taxonomy + per-wing/repo tags from an optional `classification.yaml`; fail-safe to confidential. - **`internal/gitea/`** — `IssueTracker` over the Gitea REST API; owner forced to `mathias`; token only in the Authorization header. - **`internal/capturehttp/`** — the REST adapter + the shared `Authenticate` / `DecodeRequest` / `OriginResolver` (also used by the MCP tool). - **`internal/audit/`** — `SlogSink` (default) and the `DegradingSink` (loki + durable `FileBuffer` + `NtfyNotifier` + `Reconcile`). - **`internal/mcp/`** — the `capture` relay tool + principal threading (re-derives the caller's principal from the Bearer header the chassis middleware discards). --- ## 3. Sub-issue → PR map | Sub | Issue | PR(s) | Delivered | |-----|-------|-------|-----------| | 49a | #50 | #56 | classification taxonomy + per-wing/repo tags (fail-safe to confidential) | | 49b | #51 | #57 | `CaptureService` use-case + ports + entities; `BrainStore` extraction (MCP re-pointed) | | 49c | #52 | #58 | Gitea `IssueTracker` (owner forced mathias; token never logged) | | 49d | #53 | #59 | `POST /capture` REST + OAuth2 + I1 sovereignty gate (server-derived origin) | | 49e | #54 | #60 | I5 audit path + classification-aware degradation (loki + buffer + reconcile) | | 49f | #55 | #61, infra #151 (ledger), #152 (deploy) | MCP `capture` relay tool + I2 ledger + I3 deploy | Predecessor: #45 (`brain_update`/`brain_get` verbs, PR #46) — the read-after-write contract capture reuses. --- ## 4. Invariant compliance | Inv | How satisfied | |-----|---------------| | **I1** sovereign containment | Effective classification = stricter(caller-declared, target-derived #50). Origin is **server-derived from the authenticated principal**, never `context.harness`. Confidential + us-nexus origin → refused before any write; refusal audited. Asserted-vs-derived mismatch → security event. | | **I2** deliberate acceptance | The relay's cross-harness reach is recorded in `infra/docs/security-baseline.md` with six containment properties + Revisit-if, **merged before relay code shipped** (infra #151). | | **I3** GitOps reconcilability | Env + `gitea-api-token` ExternalSecret under `infra/k3s/apps/supervisor/`, Flux-reconciled; image bumped by CD. No untracked runtime. | | **I5** auditability | Every capture emits a request-level audit record. Classification-aware degradation: confidential + sink-down → hard-refuse; internal/public + sink-down → durable local buffer + ntfy + reconcile-on-recovery; floor → refuse if nothing can record. | --- ## 5. Operational reference (env) Set on the `ingestion` deployment (`infra/k3s/apps/supervisor/ingestion-deployment.yaml`): | Env | Purpose | Notes | |-----|---------|-------| | `BRAIN_GITEA_URL` / `BRAIN_GITEA_TOKEN` | enables the `IssueTracker` → gates `/capture` + the MCP tool | token from 1P `DMABE_GITEA_API_TOKEN` via ESO; unset ⇒ capture disabled | | `BRAIN_LOKI_URL` | activates the `DegradingSink` | unset ⇒ `SlogSink` (audit to stdout → alloy → loki; no refuse/buffer semantics) | | `BRAIN_NTFY_URL` / `BRAIN_NTFY_TOKEN` | degraded-state alerts | optional | | `BRAIN_CAPTURE_SOVEREIGN_PRINCIPALS` | JWT subjects treated as sovereign-soil | comma-separated; static-token caller is always sovereign; unknown JWT ⇒ us-nexus (fail safe) | | `BRAIN_AUDIT_RECONCILE_INTERVAL` | buffer→loki replay tick | default 60s | The audit buffer lives at `/.audit-buffer/capture.jsonl` on the brain hostPath (nodeSelector-pinned to koala) — durable across restart without a separate PV. --- ## 6. Tests 67 test functions across the six packages. Coverage maps to the spec's Gherkin: happy path, supersede-not-duplicate, fail-closed validation, partial-failure receipt, dry-run, stricter-classification-wins, I1 confidential-via-us-nexus-refused / via-sovereign-allowed / asserted-label-ignored / caller-cannot-forge-origin, I5 confidential-refuse / internal-buffer / floor-refuse / reconcile / buffer-survives-restart, and the MCP relay tool (forwards, preserves principal, unauth rejected). `task check` green. --- ## 7. Deferred (not in this epic) Tracked here so they aren't lost; file as issues when picked up: - **SKILL veneer** — the `close-session` SKILL becomes the claude.ai trigger/harvest layer that calls capture. - **Per-harness token provisioning** for Crush / Pi / LLM Council (claude.ai is done via the existing `/mcp` connector). - **Harvest adapters** — transcript-parse vs chat-memory-reconstruct vs agent-runlog, each assembling capture args at its own fidelity. - **`SummaryWriter` impl** — ai-sessions summary persistence (the port + path logic exist; the concrete writer is nil today, so a request with a summary fails that one item). --- ## 8. Brain learnings - `wiki/hyperguild/decisions/capture-classification-taxonomy` - `wiki/hyperguild/decisions/gate-on-server-derived-signals-fail-safe` - `wiki/hyperguild/decisions/two-phase-reserve-record-audit-gate` - `wiki/hyperguild/failures/mcp-bearer-middleware-discards-principal` - `wiki/hyperguild/facts/brain-mcp-embeddings-out-of-band-sync` (from #45, the predecessor)