Context & Investigations
Context Bridge
An edge-local signal store + manifest so /chat reads fresh personal context with zero dependency on the home VM during a turn.
Situation
Mallory could hold context and reason well, but had no live view of Alex's own world — agenda, tasks, activity, status all lived on the home VM, out of reach on the hot path. This is step 1 of a broader materialised-context + async-handoff architecture: it builds the inbound bridge and the router foundation, while Live lookups, Device signals, Investigate and the outbound notifications loop are *designed here* (§7 reserved slots) but built in later steps.
The core move is a uniform signal: {key, value, ts, ttl_seconds, source}, written to KV by any producer and read the same way regardless of origin. Step 1 has exactly one producer — a runtime cron job pushing vault digests — but Live (edge fetch) and Device (phone push) can join later as producers writing the identical envelope, with no new consumption code.
Key decisions
Signal store + manifest
Uniform KV envelope per signal plus one signal:manifest index; TTL is load-bearing — a reader treats an expired signal as stale and omits or flags it, preventing confident answers from expired data.
Runtime-only write auth
POST /context requires the JWT's common_name to equal CONTEXT_RUNTIME_CN, a dedicated service token — SSO and watch tokens are rejected outright.
Router goes composable
The Haiku classifier emits {type, tier, signals[], live[], investigate} instead of one label, so a single turn can combine Memory + Context + Live + Device.
Escalation fallback
If Context is chosen but the injected signals don't answer, the capable model emits insufficient_context and Mallory offers to dig in — step 1 surfaces this as a graceful offer since Investigate itself lands in step 2.
Deep tier registered, not wired
A deep provider tier (Opus) and a providerFor(taskClass) policy map are added now; /chat keeps using fast/capable until Investigate needs it.
Action-distillation contract
Every response must resolve to a decision/next step with retrieved data as supporting evidence, not a data dump — Mallory's value is N facts → one action.
Architecture
A new edge module pairs with a runtime push job: POST /context writes signals, loadSignals reads them freshness-aware, and the classifier decides what to inject.
POST /context — verifies the runtime common_name, writes each signal:<key> + signal:manifest to KV, idempotent overwrite.loadSignals(env, keys[]) — assembles a freshness-headed context block, dropping anything past TTL; never throws.signals/live/investigate; /chat merges loadSignals output into systemContext.deep tier (MODEL_DEEP, default claude-opus-4-8) and a providerFor(taskClass) map._generated/*.md + state/sources/*.json, POSTs {signals, manifest} with runtime service-token headers every ~15 min.CONTEXT_KV binding for the signal store.Risks & guardrails
Stale data
Per-signal TTL enforced in both the reader and the manifest — staleness is never a matter of trusting the producer.
Hot-path degradation
KV miss/empty/stale degrades silently (answer without that signal); the Worker never depends on the Hub on the chat path.
Push job failure
record_status fail + ntfy alert, retried next cycle; the edge keeps serving last-good values in the meantime.
Auth boundary
A dedicated runtime service token (Client ID as common_name) keeps write access to /context separate from the user's own SSO/watch tokens.
Delivery
Test harness + bindings
Vitest scaffolding, CONTEXT_KV in wrangler.toml, CONTEXT_RUNTIME_CN / MODEL_DEEP vars.
Signal reader + auth plumbing
loadSignals in src/context.ts; expose common_name from the existing auth check.
POST /context handler + routing
Write path with per-key results, wired into index.ts.
Classifier + /chat injection
Emit signals[...], inject the block, enforce the action-distillation output contract.
Provider policy
Register the deep tier without wiring it into /chat yet.
Runtime push job
context-push.sh with --dry-run, cron every ~15 min; manual deploy steps recorded for execution time.
Out of scope
docs/superpowers/specs/2026-06-09-mallory-context-bridge-design.mdplan ·
docs/superpowers/plans/2026-06-09-mallory-context-bridge.md