chorus/CHORUS-PLAN.md

# CHORUS — Group-Based Memory: Conversion Plan

**Fork of:** `jason/echo` (ECHO v1.5.1, schema 4) → `jason/chorus`
**Goal:** convert the single-operator ECHO memory plugin into CHORUS — one shared
Obsidian vault serving a **group of members**, with per-member identity,
attribution, and isolation of the churn-prone per-person state, while keeping the
shared knowledge graph (projects, areas, resources, decisions) communal.

**Naming metaphor:** ECHO is one voice reflected back; CHORUS is many voices in
one performance.

---

## 1. What the review found

ECHO is ~4,800 LOC of pure-stdlib Python (18 scripts) + a large doc surface
(SKILL.md ~456 lines, 6 references, 8 commands, 15 scaffold seeds). The
architecture is already favorable for this conversion:

- **Identity is barely wired in.** `echo.py` loads `OWNER` from config but never
  actually consumes it — attribution today is purely doc-driven ("write in third
  person about Jason"). Adding a `member` identity breaks nothing.
- **Routing is data-driven.** `routing.json` is the single source of truth for
  "what may be written where"; `vault_lint.py` and `check_routing.py` enforce it.
  Per-member paths are new route rows, not new code paths.
- **The vault is self-describing.** Bootstrap/migrate/sweep + `schema_version`
  in the marker give us a clean upgrade lever (schema 4 → 5).

The hard part is **not** identity plumbing — it's the five shared single-writer
artifacts that make no sense (or clobber) with multiple concurrent users:

| Artifact | Today | Problem in a group |
|---|---|---|
| `_agent/memory/semantic/operator-preferences.md` | One profile | Whose preferences? |
| `_agent/context/current-context.md` | One active scope for the vault | Members work on different things simultaneously |
| `_agent/heartbeat/last-session.md` | One "last session" pointer (PUT overwrite) | Race: lost updates; meaningless shared |
| `inbox/captures/inbox.md` | One shared inbox (POST append) | Append races; triage can't tell whose capture |
| `journal/daily/YYYY-MM-DD.md` `## Agent Log` | One shared heading | Duplicate-heading races; unattributed lines |

Also single-user by design: session filenames carry no author
(`YYYY-MM-DD-HHMM-<slug>.md` — two members can collide on the same minute),
frontmatter has no `author:` field anywhere, the offline queue is per-machine
with no member attribution, and the advisory lock owner is a session id, not a
person. Concurrency is advisory-only — `vault_lock()` warns and **proceeds** if
it can't acquire (echo_concurrency.py:78–81), which is acceptable for one person
on two machines but not for N people.

---

## 2. Target design

### 2.1 Identity model

- Config gains a `member` field:
  `{ "group": "...", "member": "jason", "endpoint": "https://chorusapi.mpm.to", "key": "..." }`.
  **Deployment endpoint: `https://chorusapi.mpm.to`** — the CHORUS vault gets
  its own Obsidian + Local REST API instance exposed there (separate from
  ECHO's `echoapi.alwisp.com`; the personal ECHO vault is untouched). The
  endpoint stays machine-local/baked config, never in source, same as ECHO.
  `owner` → `group`. Resolution order
  unchanged: baked > env (`CHORUS_MEMBER` etc.) > config file. Baked per-user
  builds (`build.py --bake-key --label alice`) already exist and become the
  primary **onboarding** mechanism: one artifact per member, member id baked in.
- Every agent-written note gets `author: <member>` stamped in frontmatter
  (`echo_ops._build_note`), added to the canonical frontmatter block, to
  `KIND_REQUIRED_FM` for agent-written kinds, linted by `vault_lint`, and
  backfilled by `sweep --apply` (existing notes → the migrating member).
- Lock owner and offline-queue entries carry the member id
  (`auto_owner()` → `f"{member}-{client}-{pid}"`), so contention and replay are
  attributable.

**Auth reality check:** the Obsidian Local REST API has **one bearer key per
vault**. Phase 1–4 ship with a shared key and honor-system attribution (fine for
a trusted team). Real per-member credentials/revocation would need a thin auth
proxy in front of `chorusapi.mpm.to` that maps per-member tokens → the vault
key and can inject/verify the member id. That's deliberately **out of scope**
here but the config shape (`member` + per-member baked artifacts) is designed so
the proxy slots in later without another migration.

### 2.2 Vault layout changes (schema 5)

Per-member state moves under a member namespace; shared knowledge stays where it
is.

```
_agent/
├── chorus-vault.md            ← renamed marker (schema_version: 5, managed_by: chorus-memory-plugin)
├── members/
│   └── <member>/
│       ├── preferences.md     ← was operator-preferences.md (one per member)
│       ├── current-context.md ← per-member scope + Scope History
│       ├── heartbeat.md       ← per-member last-session pointer
│       └── inbox.md           ← per-member quick-capture inbox
├── memory/
│   └── semantic/
│       └── group-profile.md   ← NEW: shared facts about the group itself
├── sessions/
│   └── <member>/YYYY-MM-DD-HHMM-<slug>.md   ← member-namespaced session logs
└── (context/, memory/, health/, index/, locks/, templates/, skills/ unchanged — shared)
```

- **Shared and unchanged:** `projects/`, `areas/`, `resources/`, `decisions/`,
  `journal/`, semantic/episodic/working memory (now with `author:`), the entity
  index, recall index, health notes.
- **Daily Agent Log stays one shared heading** (it's the group's timeline) but
  every line is member-prefixed: `- HH:MM [alice] did X`. `ensure_daily_log`
  keeps its GET→POST-heading→PATCH flow; idempotent whole-line append plus the
  member prefix makes interleaving safe and attributed. (Per-member daily notes
  were considered and rejected — the whole point of a group vault is one shared
  timeline.)
- **Inbox:** per-member capture files (`_agent/members/<id>/inbox.md`) kill the
  append race and make triage member-aware, **plus** one shared
  `inbox/captures/group.md` for unowned "someone should look at this" items
  (member-prefixed lines; routed by whoever triages first). Triage covers both:
  accepted items route to shared homes; preference-type items route to *that
  member's* `preferences.md`. Processing-log lines carry the member id.
- `resources/people/<member>.md` continues to exist for every member — the
  public "who is this person" note, distinct from their private-ish
  `preferences.md` (how the agent should behave *for them*).

### 2.3 Cold-start load (per member)

`chorus.py load` reads: marker → **group-profile** → **my** preferences → **my**
current-context → **my** heartbeat/last-session (fallback: my sessions dir) →
today's shared daily note → **my** inbox depth → **group inbox** depth. Optional `--all-members` flag
for a group-wide orientation (e.g., "what has the team been doing"). Reconcile
(inbox aging, scope drift) runs against the member's own state only.

### 2.4 Concurrency posture

Namespacing removes ~all of the contention (each member's churn-prone files are
theirs alone). What remains shared-write:

- **Entity + recall indexes** — keep `vault_lock` + `atomic_index_update`, but
  flip the lock to **required** (`required=True`) on index writes: block/retry
  briefly instead of warn-and-proceed. TTL reclaim unchanged.
- **Daily note / shared notes** — idempotent member-prefixed appends; PATCH to
  headings is last-writer-wins per line, which is acceptable for log lines.
- **Duplicate gate** — unchanged and global (dedup across the group is the
  *feature*: two members shouldn't create parallel notes for the same client).
  Gate messages name the `author` of the existing candidate.

### 2.5 Recall / reflection

- Corpus unchanged (shared graph is the point). `recall` gains an optional
  `--author <member>` filter and surfaces `author:` in hits.
- `reflect` proposals route preference items to the current member's
  `preferences.md`; everything else routes to shared homes with `author:`
  stamped. The Stop-hook nudge state stays per-machine (already is).

---

## 3. Renaming map (echo → chorus)

| Category | From | To |
|---|---|---|
| Plugin | `echo-memory` (plugin.json, skill dir, SKILL.md name) | `chorus-memory` |
| Commands | `/echo-{load,save,recall,reflect,triage,sweep,health,doctor}` | `/chorus-*` |
| Scripts | `echo*.py` (16 modules + imports everywhere) | `chorus*.py` |
| Exception | `EchoError` | `ChorusError` |
| Env vars | `ECHO_OWNER/BASE/KEY/CONFIG/TODAY/VERIFY/LOCK_TTL/TIMEOUT/WORKERS/STATE_DIR/CLIENT/DUP_GATE/REFLECT_MIN_TURNS/FRESH_HALF_LIFE` | `CHORUS_*` (+ new `CHORUS_MEMBER`) |
| Config file | `~/.claude/echo-memory/config.json` | `~/.claude/chorus-memory/config.json` |
| State dir | `~/.echo-memory/` | `~/.chorus-memory/` |
| Marker | `_agent/echo-vault.md` (hardcoded in 8 files + routing.json) | `_agent/chorus-vault.md` |
| Hooks | `hooks.json` paths ×2 incl. CoWork fallback glob | updated paths |
| Docs/branding | README, SKILL.md, references, scaffold seeds, icons | rewrite pass (cosmetic but large) |

`operator-preferences.md` is renamed as part of the **layout** change
(§2.2), not the branding pass.

---

## 4. Phased plan

### Phase 0 — Baseline (½ day)
Repo hygiene on the fork: strip stale versioned `.plugin` artifacts from the
tree (move to Gitea releases per ROADMAP-2.0), confirm `eval/` suites green
as-is, tag the fork point.

### Phase 1 — Mechanical rename (1–2 days) — DONE
Everything in §3. All existing tests pass under the new names. No behavior
change. **Deliverable:** installable `chorus-memory` plugin that is
ECHO-with-a-new-name. *(Decided post-Phase-1: CHORUS is a **clean break** —
fresh vaults on fresh machines for new users, so no ECHO back-compat: legacy
`ECHO_*` env vars, echo-memory configs, `~/.echo-memory` state, and
`_agent/echo-vault.md` markers are all ignored. Shims briefly existed and were
removed.)*

### Phase 2 — Identity plumbing (1–2 days) — DONE
`member` in config (+ `CHORUS_MEMBER`, baked-tier support, `config set --member`
with slug validation; `owner` → `group`; member REQUIRED for is_configured),
`MEMBER` global in `chorus.py`, `author:` stamping in `_build_note` + bootstrap
`{{MEMBER}}` anchor stamping + templates, canonical frontmatter docs + a
`missing-author` lint check (agent_written notes must carry `author:`; sweep
does NOT backfill — attribution can't be guessed), member-aware lock owner
(`<member>-<client>-<pid>`) and queue records, `doctor` reports member/group.
Vault layout untouched. **Deliverable:** every new write is attributed;
single-user behavior otherwise identical.

### Phase 3 — Per-member namespacing (3–5 days — the core) — DONE
Schema 5. New `LEAVES` + seeds (`members/<id>/…`, `group-profile.md`),
member-parameterized bootstrap (bootstraps *your* member subtree on first load
if the vault exists but your namespace doesn't — new members self-onboard),
`cmd_load`/`cmd_scope`/heartbeat/inbox/triage/reflect retargeted to member
paths, session logs under `sessions/<member>/`, member-prefixed Agent Log
lines, `routing.json` route rows (with `<member>` pattern segment) + retired
old paths, lint updates, `migrate.py` 4→5 (for any alpha CHORUS vaults stood
up between phases — there is no ECHO-vault adoption path; CHORUS vaults start
fresh). Docs: vault-layout.md, routing-map.md, bootstrap.md rewritten.
**Deliverable:** a real multi-member vault, bootstrapped from empty.

### Phase 4 — Shared-write hardening (1–2 days)
Required lock on index writes with bounded retry/backoff, gate messages carry
author, `recall --author`, `load --all-members`, concurrency docs
(operating-contract.md) rewritten for N writers.

### Phase 5 — Docs, onboarding & eval (2–3 days)
SKILL.md full rewrite (operator → member voice; drop the "single owner"
safety rule, replace with group rules: don't edit another member's
`preferences.md` except via their session; shared notes are fair game),
8 command docs, README. Onboarding runbook: per-member baked builds. Extend
`eval/`: two-member mock scenarios (concurrent capture, interleaved daily-log
appends, index race, cross-member dedup gate, member-scoped load) + rerun the
retrieval/durability metrics. New icon.

**Total: roughly 9–15 working days**, shippable at every phase boundary
(1 = rename, 2 = attribution, 3 = groups).

---

## 5. Decisions (settled with Jason, 2026-07-21)

1. **Journal rollups — shared.** One group rollup per period
   (`journal/weekly/YYYY-Www.md` etc.) with member-attributed bullets inside.
   No per-member rollup trees.
2. **Preference privacy — group-visible, documented.** Member `preferences.md`
   files live in the shared vault and are readable by every member (one vault,
   one key — no read ACLs possible). SKILL.md documents this explicitly;
   anything a member considers private belongs in their own personal ECHO
   vault, not CHORUS.
3. **Auth proxy — out of scope; shared key first.** Phases 1–5 ship with the
   shared vault key and honor-system attribution. The per-member token proxy
   (namespace write ACL, server-side audit, per-member revocation) is a later
   standalone project; the config shape (`member` + per-member baked
   artifacts) already accommodates it with zero plugin changes.
4. **Commands — `/chorus-*`.** Full-prefix names
   (`/chorus-load`, `/chorus-save`, …), consistent with the ECHO pattern and
   collision-free if both plugins are installed.
5. **Inboxes — per-member + shared group inbox.** Each member gets
   `_agent/members/<id>/inbox.md`; a shared `inbox/captures/group.md` holds
   unowned items (member-prefixed lines, idempotent appends), routed by
   whoever triages first. Both are probed at load and covered by triage.
6. **Clean break from ECHO** *(added post-Phase-1)*. CHORUS vaults are fresh
   vaults on fresh machines for new users — no ECHO adoption path, no legacy
   `ECHO_*` env/config/state/marker compatibility. Jason's personal ECHO vault
   continues unchanged on its own plugin and endpoint. If ECHO history is ever
   wanted in CHORUS, it would be a one-off import exercise, out of scope.