Module memory_history 

Existing-history disclosure preview and consent gate (task D1).

The host owns metadata discovery, disclosure policy, and authority. Both /memory index-history and the memory_context(action=index_history) tool enter through this engine; D2 will consume the typed ImportPlan.

This module deliberately contains no importer. A successful confirmation returns a plan and performs no session-content reads or Axel writes.

Structs

CanonicalHistoryMetadataIo

Production metadata provider over the canonical session storage API. It intentionally does not implement content reads or Axel writes in D1.

ConfirmedUserIntent

Confirmation authority is represented by the same unforgeable A4 proof type used by memory leases. There is intentionally no string constructor.

HistoryImportCancellation

HistoryImportEvent

Content-free event envelope for frontends and diagnostics. The payload type intentionally has no content, session id, project id, or filesystem path.

HistoryImportHostState

Trusted, host-computed scope and destination. No field comes from model parameters or a provider response.

HistoryImportPreview

Complete disclosure presented before consent is requested.

HistoryImportReport

HistorySessionMetadata

Metadata that may be inspected before the user decides whether to import. It must not contain message, prompt, or tool-result bodies.

ImportPlan

D2 input: an already disclosed preview bound to explicit user intent.

IncludedDateRange

Enums

HistoryImportConsent

HistoryImportError

HistoryImportOutcome

RequestAuthority

Identifies the caller, independently of any claimed consent payload.

Constants

CHECKPOINT_FILE_MAX_BYTES

Maximum durable host state for one project import. One digest is 64 bytes; this supports thousands of committed source ranges without unbounded growth.

IMPORT_BATCH_MAX_RECORDS

Hard ceiling on records accumulated before dispatch. The C3 worker queue is independently fixed-capacity and nonblocking; imports can therefore bound both their producer batch and consumer queue.

Traits

HistoryImportIo

Narrow I/O boundary for history import. D1 calls only scan_metadata; content reads and provider writes are reserved for D2 consuming a plan.

Functions

authorize_history_import

Apply the user’s decision without beginning import.

import_history_resumable_from_dir

Incremental D3 import. A source range is checkpointed only after the C3 worker receives a provider acknowledgement (or idempotency reconciliation). Therefore a process killed between provider commit and checkpoint rename may replay at most one stable capture id, which the provider store deduplicates.

index_history

Single shared engine operation used by every frontend.

preview_history_import

Compute the disclosure using only trusted host state and a metadata scan.

propose_history_import

Request authority is fixed by the entry point, not accepted as an argument.