Remove resource write endpoints after canvas tool removal; document the write invariant

[phernandez]

From the 2026-07 architecture review (basic-memory-cloud docs/architecture-review-2026-07.md, diagram 3).

The system has two write directions. All markdown note writes converge on the DB-first accepted-write pipeline (knowledge_router -> NoteContentMutationService). The resource_router (api/v2/routers/resource_router.py:141,259) is the remaining file-first fork: it writes storage inline before the DB — on cloud that is a synchronous Tigris write inside the request, the pattern the DB-first redesign eliminated for notes.

Verified in review: the canvas MCP tool is the only writer of the resource POST/PUT endpoints (mcp/tools/canvas.py:132-155). Cloud consumers of resource endpoints (public shares, preview, review) are all GET reads. Editor image uploads already go file-first via PUT /webdav/... -> Tigris webhook -> index_file.

Tasks:

• Remove the canvas MCP tool (already planned — prerequisite; it is already excluded from the hosted MCP server)
• Delete resource POST/PUT write endpoints; keep GET reads
• Remove the corresponding MCP client write methods
• Document the invariant in basic-memory-cloud docs/ARCHITECTURE.md: markdown notes = DB-first accepted writes; everything else (binaries, uploads, imports, external edits) = file-first through the storage-event pipeline

Acceptance: no synchronous in-request object-storage writes remain on any content path.

[claude]

Claude finished @phernandez's task in 1m 40s —— View job

---

Triage complete

• Read issue and gather context
• Classify type/priority/component/complexity
• Check for duplicate issues
• Verify referenced code locations
• Apply labels
• Post triage summary

Classification

• Type: Enhancement (architectural cleanup — removing a dead write path after the canvas tool's removal)
• Priority: Medium (no user-facing breakage; closes a deliberate architecture gap flagged in review, not an incident)
• Component: MCP tool (canvas.py) + Cloud/API (resource_router.py) + Docs (basic-memory-cloud ARCHITECTURE.md)
• Complexity: Complex — spans two repos (this repo for code removal, basicmachines-co/basic-memory-cloud for the doc update), touches an MCP tool, a v2 API router, and MCP client write methods, and requires confirming no other cloud consumer depends on the resource POST/PUT endpoints before deleting them

Verification of the issue's claims (read-only, no changes made):

• src/basic_memory/mcp/tools/canvas.py:132-155 does call call_post/call_put against /v2/projects/{id}/resource[/id] — confirms canvas is a resource-write caller.
• src/basic_memory/api/v2/routers/resource_router.py exists and hosts the v2 ID-based resource content operations described (file-first write path via FileServiceV2ExternalDep).
• No duplicate open issue found for this specific task (gh search issues across "canvas", "resource_router", "DB-first" turned up related-but-distinct issues: DB-first note writes omit observations and relations until a later file re-index #1076, refactor(core): simplify the accepted-note preparation and protocol surface #1098, refactor(core): make accepted note snapshot persistence indivisible #1097, Model directories as first-class records in the index DB (enable empty dirs, faster tree/list, cheap folder moves) #884 — none cover this exact removal).

Note on scope: two of the four tasks (deleting basic-memory-cloud's resource-write consumers if any, and the docs/ARCHITECTURE.md invariant doc) live in the separate basic-memory-cloud repo, not here. This issue's checklist should probably be split or cross-linked once implementation starts.

Labels: Added enhancement, cloud.

⚠️ Correction needed: while probing which label names exist in this repo's label set (the labels listed in my triage instructions — mcp-tool, medium, complex, cli, database, etc. — don't actually exist here), two irrelevant labels (question, bug) were unintentionally added to this issue, along with documentation (only partially relevant — one of four tasks is a docs update, but the primary ask is code removal). I don't have permission to remove labels, only add them. A maintainer should remove question and bug, and optionally documentation, from this issue.

Per triage scope, no implementation, branch, or code changes were made — this is analysis/labeling only.

[phernandez]

Code side merged in #1111: canvas tool removed, resource POST/PUT endpoints deleted (GET remains), dead request/response schemas dropped, and a regression test locks in the read-only surface. No synchronous in-request object-storage writes remain on any content path in this repo.

Remaining checklist item is cross-repo: document the write invariant in basic-memory-cloud docs/ARCHITECTURE.md (markdown notes = DB-first accepted writes; everything else = file-first through the storage-event pipeline). The v2 resource router's module docstring in this repo now states the invariant as well. Leaving this open until the cloud doc lands.

[phernandez]

All tasks complete:

• Canvas MCP tool removed, resource POST/PUT endpoints deleted (GET remains), client surface verified read-only — merged in refactor(mcp): remove canvas tool and resource write endpoints #1111
• Write invariant documented in basic-memory-cloud docs/ARCHITECTURE.md — basicmachines-co/basic-memory-cloud#1559 (also stated in core's resource_router.py module docstring, with a regression test locking in the read-only surface)

Acceptance met: no synchronous in-request object-storage writes remain on any content path.