Add Feed Research Memory [cfi-dkgv10-r1]

[dcftradingcrypt]

What this PR does

Adds Feed Research Memory, an agent-invoked RSS 2.0/Atom 1.0 research inbox for DKG v10 Working Memory. It imports local feed snapshots, tracks exact source revisions and causal observation history, records research status/notes, and recalls question/answer packets with citations to the precise evidence used.

Bounty round: cfi-dkgv10-r1. Please apply the cfi-dkgv10-r1 label for round routing. This is a registry entry for a standalone contributor-owned integration, using the node's public HTTP API.

Integration links

• Repo: https://github.com/dcftradingcrypt/feed-research-memory
• Commit pinned: 91c24feea6752d544d877831176addc54f69944b
• OCI package/version: ghcr.io/dcftradingcrypt/feed-research-memory:0.1.0
• Immutable artifact: ghcr.io/dcftradingcrypt/feed-research-memory@sha256:b7f805ce43d0c45b21591ea170902eb30221f6f88cae3523c30d228258014903
• OCI build attestation: https://github.com/dcftradingcrypt/feed-research-memory/attestations/56953284
• Pinned manual-install instructions: https://github.com/dcftradingcrypt/feed-research-memory/blob/91c24feea6752d544d877831176addc54f69944b/CONTAINER.md
• Design brief: https://github.com/dcftradingcrypt/feed-research-memory/blob/91c24feea6752d544d877831176addc54f69944b/DESIGN.md
• Recorded walkthrough: https://dcftradingcrypt.github.io/feed-research-memory/demo/replay.html
• Verification report: https://github.com/dcftradingcrypt/feed-research-memory/blob/91c24feea6752d544d877831176addc54f69944b/VERIFICATION.md
• Security declaration: https://github.com/dcftradingcrypt/feed-research-memory/blob/91c24feea6752d544d877831176addc54f69944b/SECURITY.md
• Public artifact/provenance evidence: https://github.com/dcftradingcrypt/feed-research-memory/attestations/56953284
• Public package version: https://github.com/dcftradingcrypt/feed-research-memory/pkgs/container/feed-research-memory/1401721496?tag=0.1.0
• Successful release CI: https://github.com/dcftradingcrypt/feed-research-memory/actions/runs/39036443482
• Release: https://github.com/dcftradingcrypt/feed-research-memory/releases/tag/v0.1.0

Distribution and the equivalent-registry option

The official bounty §8a.1 allows a package on “npm (or an equivalent verifiable registry) with build provenance.” This submission proposes a public GHCR OCI package, pinned to an immutable digest with GitHub build-provenance attestation tied to its exact source commit. No npm release or npm provenance is claimed. The equivalence rationale is offered for committee review; it is not a prior approval or waiver of the publication/provenance requirement.

install.kind is manual because the distributed program is a one-shot containerized CLI. CONTAINER.md provides pinned installation, file-input, bearer-token, node-connectivity and attestation-verification instructions. dkg integration install hands the user those docs; it does not automatically install or verify this OCI image. The registry's security CI skips npm lookup for manual entries and does not verify OCI availability, digest, visibility or attestation. A passing registry check therefore does not establish provenance, accepted equivalence or bounty acceptance.

Working research capability

The agent supplies a canonical feed URL and a local XML file, then uses inbox, history, annotate, packet and recall. This integration does not call a paid model, fetch feeds/articles or schedule background work. Source-provided claims and agent interpretations are separate records; actor labels are self-described labels, not authenticated identities.

Normalized source digests exclude ingestion time. Reimporting unchanged content reuses its source KA. A changed version creates another KA; an observation chain selects the locally current imported revision, including A → B → A reversion. Exact-version annotations and packets continue to cite the original revision. Conflicting observation heads or missing/digest-inconsistent pinned evidence fail explicitly rather than silently choosing evidence.

The CLI creates local Context Graph metadata with register:false and KAs with finalize:false. Source/observation/annotation/packet URNs and WM assertionUri values are not presented as finalized or published DKG UALs. A future Curator-controlled promotion/oracle path is documented in the design brief; finalize, SHARE and PUBLISH are not implemented.

The supported input bounds are 5 MiB and 1,000 feed entries per import, with separate 10,000-record reader capacities for source revisions, observations, annotations and packets in a Context Graph. Imports into one Context Graph must be serialized. These are explicit small-project bounds, not a server-enforced storage quota or a claim of broad hostile-input hardening.

Scope & faithfulness

• Consumes only the supported public node HTTP API; no internal DKG package imports, node patches or direct SPARQL updates in the integration.
• memoryLayers: ["WM"] reflects the implemented surface.
• v10PrimitivesUsed reflects Context Graph, Knowledge Asset and Assertion usage; no finalized UAL or Curator operation is claimed.
• Uses the established DKG terminology and documents its own research vocabulary.
• Connects the memory capability to agent-driven source triage, research notes, exact-citation answers and later-session evidence recall.

Security declarations (§8a)

• networkEgress declares the operator-configured DKG API origin, including an explicitly selected remote node; loopback is the default. Feed/article/source/vocabulary URLs are not fetched.
• writeAuthority declares local Context Graph creation and open-WM KA creation. No finalize, SHARE, PUBLISH, graph registration, endorsement or voting operation is performed.
• credentialsHandled is empty under the registry convention for third-party credential prompts. Operator-provided DKG_AUTH_TOKEN bearer handling is explicitly disclosed in security.notes: it is sent only to the configured node origin and is not logged.
• Read operations are disclosed: GET /api/knowledge-assets/{name} checks the descriptor, GET /api/knowledge-assets/{name}/wm/quads reads content, and POST /api/query runs the integration's WM-scoped SELECT queries.
• No preinstall, install or postinstall hook; no remote code loading or runtime telemetry.
• Production dependency audit dated 2026-10-17 exited 0 with zero advisories for the checked lock (saxes@6.0.0, xmlchars@2.2.0). The released source contains that same dependency lock.
• OCI version 0.1.0 is publicly retrievable and pinned to the actual immutable digest above; anonymous artifact retrieval and digest checks succeeded.
• The published build-attestation subject digest and source commit match the artifact digest and source pin above; the artifact digest and source/subject consistency were checked.

The successful release CI ran gh attestation verify on this OCI digest, constrained to this repository/workflow, exact source and signer SHA, v0.1.0 source ref and GitHub-hosted runners. Separate anonymous registry checks verified the manifest/config and bundle hashes, tag-to-digest mapping, public access to all nine image layers, and matching attestation subject/source. The anonymous check is not a second full cryptographic verification or a separate Docker pull/run. The release container smoke exercised the installed CLI under a nonroot user with networking disabled and a read-only filesystem; the real DKG workflow tests below were run separately.

The public Pages walkthrough was checked in a browser: playback, pause, the final 13.53-second seek and captured JSON output worked. Pages build run 39036605256 succeeded from the pinned source. The immutable v0.1.0 source docs retain some pre-publication pending language; the actual package, CI, attestation, release and demo links above record the subsequent publication state.

Local verification

• 20 unit tests passed for feed parsing/attribution, normalized revisions, observations, annotations/packets, capacity errors and public HTTP behavior.
• One real local-node integration workflow passed, covering unchanged replay, revisions, Unicode/quote/newline readback, cited packet creation, later changes, old-evidence recall and A → B → A current-revision tracking.
• Independent real-feed acceptance passed: twenty transparently selected entries from an actual official Node.js blog RSS snapshot; the agent compared feed-labelled LTS/Current release metadata, stored an interpretation and recalled exact source citations. The original feed had 1,062 entries; the selected twenty preserve original item fields and channel metadata within the documented limit. No article-body or later-live-update claim is made.
• Recorded terminal walkthrough captured: thirteen real CLI commands and local-node responses over approximately 13.5 seconds, supplied as an asciicast and self-contained HTML replay. The benchmark feed is an explicit fictional fixture; the execution/store are real.

The exercised runtime was published @origintrail-official/dkg@10.0.24, build commit fffef7dd9993f8016c595f525397da440e72a15b, with its real HTTP routes and Oxigraph-worker WM store. An outside-package transport-only test harness bound P2P to loopback, disabled discovery/relay behavior and denied peer connections. The chain was mock; publishing, telemetry and updates were disabled. The harness did not replace HTTP routes, agent memory logic or storage, and is not imported by or required for this integration.

This evidence covers local public-HTTP/WM behavior. It does not establish stock P2P behavior, cross-node/SWM replication, live-chain anchoring, financial operations, sealing or finalized UALs. No user wallet, funded chain or paid model service was used. The inspected current docs/source head 7210ccda86ab845ec3161957ed42d2b5c5e02489 is distinct from the published runtime build above.

Contributor attestation and maintenance

• This integration is the contributor's work or properly licensed; it is released under Apache-2.0, with imported source content retaining its own rights.
• It contains no intentional backdoors, malicious logic or undeclared data-egress paths.
• The submitting maintainer understands that material misrepresentation can result in delisting.
• @dcftradingcrypt commits to maintain and support this integration for at least six months after this registry PR merges.

AI assistance disclosure: OpenAI Codex assisted with implementation, documentation, tests, local verification and preparation of this submission. @dcftradingcrypt is the submitting owner and named maintainer and takes responsibility for the submission and its support commitment.

Notes for the committee

Open registry PR #6 covers arXiv paper search/select ingestion into WM with provenance and status tags. This submission instead provides a general local RSS/Atom snapshot workflow with source reversion/observation history, exact-version research annotations and cited question/answer continuity. That distinction is offered for review; no priority, exclusivity or committee acceptance is assumed.

The promotion path is documented, not represented as a shipped SHARE/VM capability. The contribution is submitted for the committee's fit/quality/tier review. No reward amount, acceptance, remaining-pool balance or payment is guaranteed or counted as received income.