Enforce governed FAVA recall visibility and atomic supersession

[timeleft--]

Parent

• https://github.com/MachineWisdomAI/WisdomLoop/issues/38

Canonical boundary

FAVA Trails is canonical for governed decisions, observations, validation, and lineage. It is not the primary operational working-context store; that role belongs to OpenViking.

What to build

Make ordinary shared FAVA recall return governed current truth: approved records that have not been replaced by an approved successor. Keep draft/proposed authoring retrieval explicit and narrow, and keep human/operator archaeology explicit for historical statuses and superseded records. Do not describe either mode as a general working-memory system.

Correct replacement semantics at the same public boundary. Proposing a replacement must not hide an approved original. The original becomes historical only when the replacement is durably approved. Approval provenance must distinguish explicit human approval from LLM advisory review.

Apply the contract consistently to single-scope recall, multi-scope recall, MCP schemas, and operator-facing consumers such as Rich Views.

Acceptance criteria

• Default shared recall returns only approved, current governed records.
• Default shared recall excludes draft, proposed, rejected, tombstoned, and superseded records.
• Draft/proposed retrieval is explicit, scoped to authoring/review, and never presented as primary operational memory.
• One agent cannot claim another agent's identity or retrieve private authoring records.
• Explicit operator/history mode can retrieve selected lifecycle statuses and superseded records for archaeology.
• Single-scope and multi-scope recall enforce the same visibility semantics.
• Proposing a replacement leaves the approved original visible as current.
• Approving a replacement atomically makes the replacement current and original historical.
• Failed approval/persistence leaves the original current without half-applied supersession.
• Approval provenance distinguishes explicit human approval from advisory LLM review.
• MCP schemas and guidance explain governed, authoring, and history modes without calling FAVA the operational working-context store.
• Tests cover identities, lifecycle statuses, both recall scopes, proposal, approval, and interrupted persistence.

Blocked by

None. This is independent FAVA governance work and does not block the laptop pilot.