design: the Conversation Graph — distributed content-addressed causal transcript (chain-store is its authority projection)

[hartsock]

Direction (Shawn, 2026-07-16)

Conversation history is not a linear ledger — it is a Merkle DAG: a distributed, content-addressed causal transcript of messages, artifacts, decisions, and witnessed checkpoints. Branches (parallel agents) and merges (accepted synthesis) are first-class. The term is causal transcript / Conversation Graph — deliberately NOT "blockchain/ledger" (no mining, tokens, leader election, or global total order — "a circus tent when you need a raincoat").

The unification

The bridle chain-store (pins/grants/audits/revocations) and the Conversation Graph (messages/patches/decisions) are the same structure at different scopes: MerkleNode<T> over different payload T. The chain-store is the authority projection of the Conversation Graph. This is the [[content_addressable]] thesis (data carrying its own proof of integrity — the Kyln thesis) applied to agent conversations, and it makes floating-identity law 4 ("conversations outlive locations") concrete.

ConversationRecord (sketch)

struct ConversationRecord {
    cid: ContentId, parents: Vec<ContentId>,      // DAG, not chain
    conversation_id: ConversationId, actor: Fingerprint, sequence: u64,
    kind: RecordKind, payload: CanonicalPayload,
    referenced_artifacts: Vec<ContentId>,          // exact immutable CIDs
    signature: Option<Signature>,
}
enum RecordKind { UserMessage, AgentMessage, ToolInvocation, ToolResult,
  CodeSnapshot, Patch, ReviewComment, DecisionRequest, Decision,
  Attestation, Checkpoint, Branch, Merge, Retraction, Supersession }

Effect: "you can see the code in our conversation history" stops meaning scrollback and starts meaning CodeSnapshot X → Patch Y → Review Q → Decision R, all signed/attributable, causally linked, independently retrievable. Every consequential statement identifies the exact immutable objects it is about (generalizing the ceremony contract's decision→request CID binding).

Why distributed

Local-only history lets a harness rewrite it and recompute a consistent tail. Independent replicas + remembered witnessed heads give the memory needed to detect rollback / deletion / equivocation / divergent forks / forged merges / omitted reviews. Local, identity-scoped consistency — not global consensus: partial replicas, remembered heads, exchanged signed checkpoints, new history must prove extension from known checkpoints, concurrent branches permitted, merges name all parents, equivocation detectable.

The rule underneath

No authorization or claim should float free of the exact history and artifacts that gave it meaning.

Relations

• bridle ceremony contract §3.6/§5.7 (chain-store, anti-rollback anchor, AttestationRecord forward-only ratchet) — the authority projection of this graph
• session-streams ADR (agent-mesh ADR: session streams — long-lived conversations over the bus #58) — conversations as mesh primitives
• docs/decisions/floating_identity.md law 4
• content-addressable crate (MerkleNode<T>) — the shared substrate