Module coordinator 

Recall coordinator (docs/design/agent-memory-architecture.md §9).

The deterministic shell that owns everything about getting memory into (and keeping forgeries out of) an agent’s context: scope composition, byte-budget ladders, per-session dedup, echo-safe assembly for the build-time surface, inbound envelope defanging, the per-session envelope nonce, and injection-ledger writes. Its topology is fixed — the bundled provider now, hub candidates later — and its only judgment stage is the LLM Selector (P1.3); nothing here scores content beyond the wire-compat lexical recall the providers already share.

AgentMemoryRuntimeInjector and AgentMemoryCustomizer (the wire-stable public surfaces in identity_first::agent_memory) are thin callers into this module.

Structs

RecallCoordinator

Deterministic recall coordinator (§9). Cheap to clone; per-session state is shared across clones on purpose (budgets are per session, not per clone).

ScopeBudget

A readable scope paired with its sub-budget slice of a global byte budget.

StaticMobBinding

Fixed single-mob binding: the resolver for hosts (like the stock gateway) where every identity in realm runs inside one known mob. Multi-mob hosts install a roster-backed resolver instead.

Traits

MobScopeResolver

§7.2 identity→mob binding seam, mirroring OperatorResolver. The hosting runtime knows which mob(s) an identity serves (the same source that pins MemoryRecorder::mob for propose_to_mob); this trait keeps the coordinator free of roster coupling. Without a resolver installed — or when it yields no mobs — composition is unchanged, so mob-scope reads activate exactly when a binding exists.

OperatorResolver

§7.2 / §16 Q1 — PROVISIONAL operator keying seam.

Functions

compose_identity_scope_set

The identity’s baseline readable scope set (§7.2): Identity ∪ Realm. Mob scopes join through compose_identity_scope_set_with_bindings (resolver-yielded identity→mob binding); Operator joins through compose_identity_scope_set_with_operator (P4) — callers treat the result as an opaque ordered set, so nothing changes structurally when scopes arrive.

compose_identity_scope_set_with_bindings

Full §7.2 read composition: Identity ∪ Mob(bound mobs) ∪ Operator ∪ Realm, in that order. Mob names are trimmed and deduplicated (“bound mobs” is plural — an identity may serve several); blank mob or operator entries compose nothing. Same-realm only by construction: every scope is keyed with the composing realm.

compose_identity_scope_set_with_operator

§7.2 composition with an active operator: Identity ∪ Operator ∪ Realm, operator between private and shared (render order follows scope weight). Same-realm only by construction — the operator scope is keyed with the composing realm, never a foreign one (realm confinement is also §7.2 validator law on the write side).

compose_scope_budgets

Deterministic per-scope sub-budgets inside a global byte budget: weight-proportional with largest-remainder rounding, order-preserving, summing exactly to total_budget.