ADR 0020: Thread visibility, oversight reads, owner-only sharing and conversation retention
- Status
- Accepted
- Date
- Deciders
- Founder
Context
A chat console holds thinking aloud. If every thread is readable by every program member, scientists will not use it; if none are, quality reviewers lose the oversight the regulatory frame expects. Deletion must coexist with an append-only audit trail.
Decision
- Threads are private by default; owners read their own threads (
program.threads.read_own); quality reviewers and leads read every thread for oversight (program.threads.read) and the composer says so. - Visibility changes only by the owner’s explicit action with a confirmation naming what becomes visible;
program.threads.managecovers archive and export with a reason, never sharing. - The thread rule also governs the run rail’s routes: events, tool calls, interrupts, snapshots and artifacts of a run with a thread are returned only to a principal who may read the thread.
- Retention:
organizations.settings.thread_retention_months(default 24); on expiry or deletion message bodies and artifact content become tombstones while tool calls, interrupts, snapshots, signatures and audit rows persist (thread.redact).
Consequences
- Records created from a thread link to it and show the run snapshot, citations and decision without opening the thread (“From a private thread”).
- A viewer-principal test pins the rule in
route_matrix.py.
Alternatives considered
- All threads readable by every member: adoption risk; rejected.
- No oversight read: reviewers cannot review; rejected.
- Promote shares the thread: changes visibility as a side effect; rejected.
Follow-ups
- Message branching UI (R3).
Last updated on