In-app Recall / AI Assistant + live Context/Recall (Slice C) — deferred from the trust landing

[silverstein]

Context

The conversation-trust privacy landing (Slice A + B) ships sealed audio, restricted-meeting policy, egress controls, audit, and PARA. The in-app Recall / AI Assistant — the native chat panel and the developer/terminal "Discuss with AI" Recall — is deferred (Slice C's live Context/Recall orchestration) and ships fail-closed / temporarily unavailable in this landing.

What still works (not deferred)

The MCP path stays fully functional and policy-enforced: Claude Desktop / Cowork / external agents read your meetings with restricted meetings excluded/filtered. Plus search, CLI, summarize, audit, and PARA. So "the AI remembers your meetings" still works via MCP — only the in-app assistant surface defers.

Why deferred

The in-app Recall paths are live-egress surfaces (Slice C territory), and under adversarial review they were incompatible with the restricted-meeting promise in ways that generated attack round after attack round (the live-Recall analog of the graph #513 / durability #510 defers):

• Terminal/"Discuss with AI" Recall creates a symlink to the raw corpus and instructs the agent it has complete meeting history and may raw-grep it — a total restricted-bypass; meeting mode directly materializes the selected transcript.
• Native chat egress had provider identity that was name/env-based (spoofable), unbounded history/response bytes, raw Claude stream metadata reaching the UI bus, and Ollama cancel that didn't abort transport.

Hardening all of this is C-scope live-fence engineering; deferring it keeps it off the trust-landing critical path while cleanly preserving the restricted-meeting guarantee (with all in-app Recall entry points unavailable, no live assistant path remains to bypass policy).

Until then (this landing's behavior)

• In-app native Recall chat, terminal/"Discuss with AI" Recall, and any assistant spawn are fail-closed "temporarily unavailable until Slice C."
• Legacy assistant-workspace capabilities/instructions/raw-corpus symlinks are scrubbed on startup.

Slice C rebuild requirements (the follow-up)

• Descriptor-authorized exact snapshots; transitive history reauthorization; no raw-corpus symlink or "raw-grep everything" instruction.
• Authentic provider identity (not name/env), loopback-only no-proxy for local providers, tool-less launch for cloud providers.
• Bounded history/response bytes; no raw stream metadata to the UI bus; cancellation that aborts transport; ordered egress under one deadline/budget.

[shin4141]

Your #514 shows a difficult operating boundary: keeping live Context/Recall fail-closed while preserving a usable and restartable path for later agent-assisted operation.

I publicly offer a bounded AI Agent Handoff Audit for repositories with multiple context, instruction, handoff, completion, and restart surfaces.

The standard rate is US$200. I’m offering the first three paid audits at a US$100 pilot rate while I establish paid delivery evidence and refine the bounded delivery format.

The audit would cover one specifically agreed workflow—not redesign the whole Slice C—and deliver one friction map, one restartability diagnosis, one priority fix, one copy-paste operational asset, and one before/after restart check.

The public scope, evidence, boundaries, and pricing are here:
https://github.com/shin4141/decision-os-v13-loopkit/blob/main/services/ai_agent_handoff_audit_offer.md

Would a fit check be useful for one bounded Minutes agent workflow?

The fit check only confirms scope and material availability. Bespoke diagnosis starts after scope confirmation and payment.

[silverstein]

Thanks for the interest in the Slice C work. We are not looking for paid audit or consulting services on this project, so I will pass on the offer. If you use Minutes and run into friction with the agent workflows firsthand, bug reports and PRs are always welcome through the normal channels.