This implementation is not enabled for customer use. Access is restricted
to a signed-in platform operator acting in a seller account without user
impersonation. Ordinary seller accounts do not receive the Session tools
or search kind, and direct calls are denied. tools/list for the active
account remains authoritative.
Scope and access
search({"kind":"session"}), get({"kind":"session","id":"..."}),
and save_session({"action":"record_note", ...}) use the operator’s
active seller account and apply only to native Murph conversations. Operator
access does not bypass room permissions. A member can read their own room.
A shared room is readable only while the server’s current room-sharing policy
permits that member.
The server checks that policy again for every page and for every note retry.
Changing a participant or advertiser link does not grant access.
Generic intake, historical RFP exchanges, buyer message delivery, lifecycle
updates, approvals, chat execution, and evaluations are not available through
this admitted slice.
Find and read retained history
Only conversations with a complete-history publication admission appear in
Session search. A retained root alone is not admission. Search and get never
create a Murph room, import history, allocate an event position, or repair
source data.
This source supports text query and lifecycle filters. Requests for purpose,
live status, attention, operator domain, advertiser, transport or updated-time
filters are rejected; they are not treated as successful unfiltered searches.
Session search captures a committed publication-sequence ceiling on the first
page and binds it to an opaque cursor generation. Pages use that fixed retained
membership snapshot, with a conversation-ID tiebreaker, rather than mutable
native message activity. A conversation first retained after that ceiling is
excluded until a fresh search. An old cursor or one with a mismatched generation
must restart the search.
The cursor also binds the complete matching retained set at that ceiling. If
matching text, lifecycle, or current room access changes that set between
pages, the next page requires a fresh search rather than silently skipping or
adding a room. Native activity that does not change the set, and publications
after the ceiling, do not invalidate the traversal.
Search cursors are separate from the event cursors returned by get. In both
cases, current account and room access are checked again on every page.
get returns an immutable page of retained events and three cursor values:
snapshotThrough fixes the committed prefix being read.pageNextAfter is present only when that prefix has another page.resumeAfter remains at that prefix’s boundary, including an empty or final
page, so a later poll can receive publications that arrived while pages were
being read.
Continue an existing snapshot with pageNextAfter as after and the original
snapshotThrough as through. Once it is consumed, poll with resumeAfter
as after and no through. Cursors identify positions, not permission:
current account and room access are rechecked on every read.
Complete result boundary
On a successful retained Session get, both the text-only MCP channel and
structuredContent carry the complete declared Session page: event bodies,
evidence and locators, participant/link-decision context, approvals,
capabilities, and cursor values. Text is fenced as untrusted data; it is not a
separate excerpt or a lossy summary.
The complete returned MCP result, including both channels, is limited to
128,000 characters. If that complete result does not fit, get returns a
VALIDATION_ERROR and attaches no Session page. For a multi-event page, retry
the same Session ID and after/through boundary with limit: 1 or a smaller
valid limit. If a one-event minimum page still exceeds the boundary, repeating
the same request cannot recover it: this read has no text-offset continuation.
Historical Murph import is an explicit server-side, bounded operation. It
imports at most 100 native messages and commits publication admission in the
same transaction. A fresh room may admit only with its first native message.
An older room can continue native conversation work while unadmitted; if its
history exceeds the bound or its retained root is partial, Session search, get,
and notes remain unavailable and the stored timeline is not rewritten. Later
native publications and private notes use the same retained sequence. A
message or note never changes an already returned event.
Add a private coaching note
Use save_session with an exact Session ID, private note, and
clientRequestId:
The note is an authored private event; it does not send a buyer message, amend
the conversation, alter a response in progress, update Playbook, approve an
action, or create an evaluation. The same scoped request ID and same content
reuses the retained note without appending a duplicate. Its delivery receipt
remains null. Reusing that key with different content fails.
If current room or seller access has been revoked, both a new write and its
retry fail.
Delivery status
This is retained-history and private-note infrastructure only. It does not
claim deployment, customer enablement, message delivery, response approval,
or completed evaluation work. The native source remains responsible for
conversation execution and room permissions.
