stack/docs/scratchpads/tess-m4-003-operator-plugins.md

TESS-M4-003 — Operator Plugin Foundations

• Task: TESS-M4-003 / TESS-MEM-001
• Branch/base: feat/tess-operator-plugins rebased on origin/main 76325ca3
• Scope: first leaf-package memory/retrieval slice only; no durable inbox ownership, gateway integration, or Mosaic catalog implementation.

Handoff

Coder4's uncommitted implementation was preserved first in commit 5b99c821 before review. The completion pass corrected the contract so namespace is injected configuration rather than caller-selected scope data, storage keys include tenant/owner/session via collision-safe tuple encoding, and malformed runtime scope values fail closed.

Delivered boundary

• OperatorMemoryPlugin exposes capture, search, recent, stats, and startupContext through MemoryAdapter only.
• Scope is server-derived {tenantId, ownerId, sessionId}; adapter and namespace are configuration, not operation input.
• Capture redacts before persistence and records configured instance/namespace/source provenance.
• Wildcard retrieval is documented at the MemoryAdapter boundary and implemented by the keyword adapter.
• Startup context uses a bounded 64-result candidate window, then prioritizes project and flat-file provenance before slicing the configured output limit.
• No Tess identity is hardcoded in storage keys or defaults; tests use configured Nova.

Verification

• pnpm --filter @mosaicstack/memory test — PASS (32 tests)
• pnpm --filter @mosaicstack/memory typecheck — PASS
• pnpm --filter @mosaicstack/memory lint — PASS
• pnpm --filter @mosaicstack/memory build — PASS
• Codex code review — APPROVE after remediation
• Codex security review — no findings after runtime scope-validation remediation