0024 — Evidence stays in workspace; intelligence stores pointers

Decided. The intelligence service never keeps a copy of the text it reasons about. When it records that a piece of text exists, it stores a pointer: which service the text is in, which record, which line, and a hash of the content. To read the words, it makes an HTTP call to the service that owns them.

Searching the raw text stays in workspace, which owns the conversations. Intelligence searches its own claims and merges the two sets of results.

There is one exception. Each search-index chunk keeps about 300 characters of preview text, so a results page can render without one HTTP call per result. It is there for display and its size is capped.

Alternatives

Copy the turns into intelligence. One database to search, no cross-service call while somebody is waiting, and much simpler queries.

Rejected because it is a second copy of every conversation at the company. That copy needs its own permission rules, its own deletion handling, and its own answer for what happens when it falls behind. It is also exactly the pattern 0002 exists to refuse: asynchronously copying another service's state.

Put the extraction work inside workspace. Nothing gets copied and there is no seam between two services.

Rejected because it puts model calls and embedding backlogs inside the service the UI depends on. Intelligence also reads from accounting, documents, and devops, so folding it into workspace would make workspace a dependency of all of them.

One shared database. Rejected by 0012.

Why

• Deletion only has to happen in one place. When text is destroyed in workspace, there is no second copy to chase. Intelligence withdraws the claims that cited it, which it can do from pointers alone.
• The permission check stays next to the data. Searching raw text is filtered by project membership inside workspace's SQL, by the service that owns the membership table. Intelligence never has to reimplement that check, so it cannot get it wrong.
• 0008 already settles this. Fetching another service's data over HTTP is the default. Keeping a local copy needs a specific reason, and "the query would be easier" is not one.

Consequences

• Extraction makes one HTTP call per source, to the same cursor-paged feed agent-desktop uses. These jobs are already in the background, so the extra latency costs nothing and a failure means a retry rather than an error somebody sees.
• Search is two calls whose results are merged, not one query. The claims half needs no membership check and can be cached across users. The raw-text half is filtered by workspace.
• Intelligence needs its own service identity for calling workspace and documents, separate from any person's.
• The content hash on each pointer is what lets us notice that one document reaching us through three different conversations is one piece of evidence, without ever holding its bytes.

Source: docs/decisions/0024-evidence-stays-in-workspace.md↗.