[Swarm Board] Durable mission threads, subscribed inboxes and low-overhead agent notifications #83

Purpose

Deliver a small, mission-scoped, multi-agent message board on the Spark: agents write a coordination message once, subscribe to relevant threads, and read only new events after their durable cursor. Eliminate redundant file/message relays and avoid large context replays. This is an opt-in, finite engineering coordination experiment, not a new AIEN planner, authority, agent operating system, general-purpose chat server, or source-control format.

Request: owner wants naturally cooperative Claude/AIEN workers without a new model/tool turn merely to forward messages. Parent ALLEN swarm: aien-dev/aien-architecture-mv#231.

Grounded current implementation (inspected 2026-10-16)

• crates/synapse-coord/src/lib.rs: existing CoordStore::{claim,update,whisper,sniff,close}, stable session IDs, and STORE_ID semantics. whisper writes into directory JSON; sniff reads relevant whispers; WHISPER_RETENTION = 24h and live locks/presence expire. This is not a durable threaded inbox nor push delivery.
• crates/synapse-coord/README.md: same coordination store and fcntl lock shared with aien-architecture/tools/crumb/crumb.c across worktrees. Preserve these exact claim/lock/whisper semantics. The existing C tool does not enforce STORE_ID; separate Architecture compatibility ticket to fix that.
• crates/synapse-coord/src/record.rs: bounded safe record reads; do not regress them.
• docs/adr/0004-crumb-synapse-integration.md: Crumb directory context + ephemeral coordination, Synapse history, independent authority.
• NOT duplicate Synapse ADR 0003 F2: Footprint subscriptions and predictive conflicts, with footprint breadth charged to quota #37 (source-control footprint subscriptions) or ADR 0003 G3: Shared-memory ring for local agents #46 (future shared-memory ring): neither gives current model agents a mission discussion inbox. Do not make either a prerequisite.
• aien-sovereign-core/crates/spark-harness/src/scheduler/mod.rs: separate internal DAG scheduler journal; not a multi-producer communication board. aegis-runtime/src/events/bus.rs: in-process Tokio broadcast, not durable inter-process delivery.
• Omega src/runtime/rx_semcomm.{h,c}: experimental relevance projections for an in-process World. Consider as an optional future optimization, not this board's message transport or authority.

Design constraints / deliverables

1. One append per message. Introduce a bounded append-only journal for a mission (and partition/index by topic / task_id); allocate stable monotonically increasing event IDs under a multi-process-safe writer lock. Each event: protocol version, mission, thread, sender session, audience/topic, kind (finding, question, answer, blocked, ready, handoff, receipt-ref), causal parent, timestamp, bounded text and references to issue/commit/receipt rather than copied artifacts. Idempotency key rejects duplicate posts, and conflicting same key refuses.
2. Cross-repository scope. A mission spans aienos, omega, Synapse, core, AEGIS, etc. Therefore configure an explicit mission board root and unique board identity separate from each repository's Crumb coordination root. Do not point every repository's Crumb claims at a new shared repo-agnostic root: advisory file locks must stay scoped to repository identity + relative path. Board references include repository identity when relevant.
3. Durability. post ACK only after applicable fsync; restart retains posted messages and receiver cursors; replay validates checksums/format and never guesses past corruption; any torn tail follows a documented recovery rule. No duplicate delivery after durable acknowledgement under normal operation (at-least-once on crash boundaries with stable event IDs/dedup allowed). Handle concurrent writers and readers, bounded storage, compaction/cursor retention and explicit overflow/expired-cursor refusal without silent gaps.
4. Subscription/read. subscribe(topic/issue/task), read_since(cursor, limit), ack(cursor). Structured machine format and small human CLI view. Sequence is authoritative, not wall clock. A client can follow multiple threads and receive only subscribed changes without reading every other team's content. Sender writes one event, everyone follows same ID.
5. Notifications. Local Unix-domain socket / lightweight notifier (or equally small native mechanism) signals event availability to connected workers. Notification is best effort; cursor + journal remains truth. Do not put message bodies into a second persistence location or create a blocking network dependency. Provide safe batch wakeup / backpressure. Explicitly document that an LLM must still run to understand events; board notification itself consumes no model token.
6. Trust/security. Namespace mission/store/tenant, limit payloads/reader exposure and event fanout, refuse forged/cross-mission subscriptions and path traversal, never treat posts as approval, file ownership, executable instruction, verified evidence or code authority. OS-scoped filesystem permissions for v0; do not claim an agent-ID string alone is authentication. Treat messages as untrusted data.
7. Compatibility. Existing crumb claim|sniff|whisper|close and Synapse CoordStore produce byte-identical records and retain the same conflict behavior. Board may post a pointer-only compatibility whisper, only when specifically needed, not mirror every message into .crumb, Git issues or agent handoff files. Structural .crumb files remain compiler-owned and committed with source.
8. API/test. Minimal synapse-coord board post|read|subscribe|watch|ack API/CLI (names may change upon source audit); library usable from Rust and thin worker adapters. Unit + concurrency + crash/fault tests including 1/4/8/32 agents; independent subscriber replay and wrong-root/foreign-mission controls. Test measured seconds per post-to-availability and joules where actually metered, compare against current crumb whisper / sniff workflow at matching workload. Other metrics (tool/model calls, duplicate context tokens, loss) are supporting facts.

Acceptance / negative controls

• A posts one question; B and C (cross-repository agents on the same Spark) see that same message ID through subscribed threads, B answers with parent ID, A receives the answer without Git commit, Crumb compilation, GitHub comment or orchestrator repost.
• Kill a writer mid-append and restart: no acknowledged message is lost, no malformed committed entry is returned; any unacknowledged last entry has unambiguous reconciliation. Kill subscriber/restart: cursor resume gives every unread event and no silent gaps.
• Two agents attempting same idempotency key produce one durable event; conflicting payload is refused. A malicious oversized/truncated event, wrong mission, unauthorized audience, symlink/FIFO journal, bogus cursor and lost socket notification all have bounded named outcomes.
• Existing Crumb/Synapse claim collision tests remain PASS and existing crumb-sniff visibility does not regress.
• Publish a reproducible paired benchmark of sender-to-agent availability and coordination overhead vs the pre-board flow. Do not claim it saves LLM round trips until the live worker integration ticket demonstrates that.

Execution discipline

First audit recent HEAD, open PRs, outstanding related #37/#46, AGENTS.md and Crumbs. One owner for shared coordination files; split source-compatible PRs (journal, subscription/cursor, notifications, CLI/tests). Do not modify Synapse source history/canonical promotion paths or privileged capabilities. No operatorless production change. Link receipts and leaf PRs here.