feat: add shared workflow memory for cross-persona knowledge sharing

Introduces a pack-level shared memory pool that enables personas within a
PersonaPack to share knowledge across runs. Each persona retains its private
memory; the shared pool adds cross-persona context via three new agent tools
(workflow_memory_search, workflow_memory_store, workflow_memory_list) with
per-persona read-write/read-only access control.

- CRD: SharedMemorySpec on PersonaPackSpec with access rules
- Controller: provisions PVC, Deployment, Service per pack
- AgentRun: injects WORKFLOW_MEMORY_SERVER_URL and wait-for init container
- Agent runner: workflow memory tools with auto-context injection
- API: PATCH support + shared-memory list proxy endpoint
- Frontend: workflow tab card, canvas badges, TypeScript types
- Cypress: 7 test suites (30+ cases) for API, UI, and edge cases
- Docs: updated personapacks, persistent-memory, writing guide, architecture

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: AlexsJones

README.md

@@ -82,14 +82,16 @@ Sympozium serves **two powerful use cases** on one Kubernetes-native platform:
 
 | | |
 |---|---|
-| **PersonaPacks** | Helm-like bundles for AI agents — activate a pack and the controller stamps out a full agent team |
+| **PersonaPacks** | Helm-like bundles for AI agent teams — activate a pack and the controller stamps out instances, schedules, and memory |
+| **Agent Workflows** | Delegation, sequential pipelines, and supervision relationships between personas — visualised on an interactive canvas |
+| **Shared Workflow Memory** | Pack-level SQLite memory pool for cross-persona knowledge sharing with per-persona access control |
 | **Skill Sidecars** | Every skill runs in its own sidecar with ephemeral least-privilege RBAC, garbage-collected on completion |
 | **Multi-Channel** | Telegram, Slack, Discord, WhatsApp — each channel is a dedicated Deployment backed by NATS JetStream |
 | **Persistent Memory** | SQLite + FTS5 on a PersistentVolume — memories survive across ephemeral pod runs |
 | **Scheduled Heartbeats** | Cron-based recurring agent runs for health checks, alert triage, and resource right-sizing |
 | **Agent Sandbox** | Kernel-level isolation via [kubernetes-sigs/agent-sandbox](https://deploy.sympozium.ai/docs/concepts/agent-sandbox/) — gVisor or Kata with warm pools for instant starts |
 | **MCP Servers** | External tool providers via Model Context Protocol with auto-discovery and allow/deny filtering |
-| **TUI & Web UI** | Terminal and browser dashboards, or skip the UI entirely with Helm and kubectl |
+| **TUI & Web UI** | Terminal and browser dashboards with live workflow canvas, or skip the UI entirely with Helm and kubectl |
 | **Any AI Provider** | OpenAI, Anthropic, Azure, Ollama, or any compatible endpoint — no vendor lock-in |
 
 ---

api/v1alpha1/personapack_types.go

@@ -82,6 +82,12 @@ type PersonaPackSpec struct {
 	// +optional
 	AgentSandbox *AgentSandboxInstanceSpec `json:"agentSandbox,omitempty"`
 
+	// SharedMemory configures a shared memory pool accessible to all personas
+	// in this pack. Each persona retains its private memory; the shared pool
+	// provides cross-persona knowledge sharing within the workflow.
+	// +optional
+	SharedMemory *SharedMemorySpec `json:"sharedMemory,omitempty"`
+
 	// Relationships defines directed edges between personas in the pack,
 	// enabling coordination patterns like delegation, sequential pipelines,
 	// and supervision.
@@ -198,6 +204,35 @@ type PersonaMemory struct {
 	Seeds []string `json:"seeds,omitempty"`
 }
 
+// SharedMemorySpec configures a shared memory pool for all personas in a pack.
+type SharedMemorySpec struct {
+	// Enabled activates the shared memory server for this pack.
+	// +kubebuilder:default=false
+	Enabled bool `json:"enabled"`
+
+	// StorageSize is the PVC storage request for the shared memory database.
+	// Defaults to "1Gi".
+	// +kubebuilder:default="1Gi"
+	// +optional
+	StorageSize string `json:"storageSize,omitempty"`
+
+	// AccessRules defines per-persona access controls for the shared memory.
+	// If empty, all personas get read-write access.
+	// +optional
+	AccessRules []SharedMemoryAccessRule `json:"accessRules,omitempty"`
+}
+
+// SharedMemoryAccessRule defines access control for a specific persona.
+type SharedMemoryAccessRule struct {
+	// Persona is the persona name this rule applies to.
+	Persona string `json:"persona"`
+
+	// Access is the access level: "read-write" or "read-only".
+	// +kubebuilder:validation:Enum="read-write";"read-only"
+	// +kubebuilder:default="read-write"
+	Access string `json:"access"`
+}
+
 // PersonaRelationship defines a directed edge between two personas in a pack.
 type PersonaRelationship struct {
 	// Source is the persona name that initiates the interaction.
@@ -259,6 +294,10 @@ type PersonaPackStatus struct {
 	// +optional
 	InstalledPersonas []InstalledPersona `json:"installedPersonas,omitempty"`
 
+	// SharedMemoryReady indicates the shared memory infrastructure is provisioned.
+	// +optional
+	SharedMemoryReady bool `json:"sharedMemoryReady,omitempty"`
+
 	// Conditions represent the latest available observations.
 	// +optional
 	Conditions []metav1.Condition `json:"conditions,omitempty"`

api/v1alpha1/zz_generated.deepcopy.go

@@ -531,6 +531,51 @@ spec:
                   - type
                   type: object
                 type: array
+              sharedMemory:
+                description: |-
+                  SharedMemory configures a shared memory pool accessible to all personas
+                  in this pack. Each persona retains its private memory; the shared pool
+                  provides cross-persona knowledge sharing within the workflow.
+                properties:
+                  accessRules:
+                    description: |-
+                      AccessRules defines per-persona access controls for the shared memory.
+                      If empty, all personas get read-write access.
+                    items:
+                      description: SharedMemoryAccessRule defines access control for
+                        a specific persona.
+                      properties:
+                        access:
+                          default: read-write
+                          description: 'Access is the access level: "read-write" or
+                            "read-only".'
+                          enum:
+                          - read-write
+                          - read-only
+                          type: string
+                        persona:
+                          description: Persona is the persona name this rule applies
+                            to.
+                          type: string
+                      required:
+                      - access
+                      - persona
+                      type: object
+                    type: array
+                  enabled:
+                    default: false
+                    description: Enabled activates the shared memory server for this
+                      pack.
+                    type: boolean
+                  storageSize:
+                    default: 1Gi
+                    description: |-
+                      StorageSize is the PVC storage request for the shared memory database.
+                      Defaults to "1Gi".
+                    type: string
+                required:
+                - enabled
+                type: object
               skillParams:
                 additionalProperties:
                   additionalProperties:
@@ -660,6 +705,10 @@ spec:
               phase:
                 description: Phase is the current phase (Pending, Ready, Error).
                 type: string
+              sharedMemoryReady:
+                description: SharedMemoryReady indicates the shared memory infrastructure
+                  is provisioned.
+                type: boolean
             type: object
         type: object
     served: true

charts/sympozium/crds/sympozium.ai_personapacks.yaml

@@ -255,6 +255,33 @@ func main() {
 		}
 	}
 
+	// Load shared workflow memory tools if configured (pack-level shared memory).
+	if wfMemTools := initWorkflowMemoryTools(); len(wfMemTools) > 0 {
+		tools = append(tools, wfMemTools...)
+
+		// Auto-inject shared team memory context alongside private memory.
+		if wfMemCtx := queryWorkflowMemoryContext(task, 3); wfMemCtx != "" {
+			systemPrompt += "\n\n## Team Knowledge (Shared Workflow Memory)\n\n" +
+				"The following shared memories were contributed by other personas in your team:\n\n" +
+				wfMemCtx + "\n\n" +
+				"Use `workflow_memory_search` for additional team knowledge lookups.\n"
+			log.Printf("auto-injected %d bytes of shared workflow memory context", len(wfMemCtx))
+		}
+
+		systemPrompt += "\n\n## Shared Workflow Memory\n\n" +
+			"You have access to shared team memory tools (`workflow_memory_search`, `workflow_memory_list`"
+		if workflowMemoryAccess != "read-only" {
+			systemPrompt += ", `workflow_memory_store`"
+		}
+		systemPrompt += ") that are shared across all personas in your team.\n"
+		if workflowMemoryAccess != "read-only" {
+			systemPrompt += "**After completing your task**, use `workflow_memory_store` to share key findings " +
+				"with other team members. Your persona name is automatically attached for attribution.\n"
+		}
+
+		log.Printf("workflow memory tools loaded: %d tool(s) (access: %s)", len(wfMemTools), workflowMemoryAccess)
+	}
+
 	apiKey := firstNonEmpty(
 		os.Getenv("API_KEY"),
 		os.Getenv("OPENAI_API_KEY"),