ScopeThread

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for ScopeThread

Inspiration

Website projects rarely lose requirements because nobody took notes. They lose the reasoning that connected those notes.

A client may say that online booking is unnecessary during an early meeting, then ask for a booking button weeks later. A transcript can show both messages, but it does not explain which decision is current, why it changed, or what the creator should ask next. Independent web creators and small production teams need durable project memory, not another chat window.

ScopeThread was inspired by that gap. It treats client conversations as evidence and turns them into structured, traceable memory that can guide the next action.

What it does

ScopeThread is an agentic-memory application for website requirements and decision history.

It can:

• ingest fictional client conversations;
• extract requirements, decisions, rationales, and open questions;
• store source quotes alongside every important memory;
• retrieve related memories with CockroachDB vector search;
• detect conflicts between new requests and active decisions;
• ask for confirmation instead of silently overwriting history;
• preserve superseded decisions and the reason for each revision;
• dismiss a false-positive conflict without changing the active decision;
• restore persisted memory after a browser reload;
• switch between an English-first interface and natural Japanese analysis;
• expose an auditable agent-run record without logging client text or credentials.

The core demo begins with an active decision that online booking is not needed. A later conversation requests a booking button on every page. ScopeThread retrieves the earlier decision, identifies the conflict, and asks whether the direction changed. When the creator confirms the revision, the old decision becomes superseded, the replacement becomes active, and CockroachDB retains the explicit supersedes link and its reason.

The interface presents this choice as two direct actions: adopt the new direction or keep the current decision. The underlying conflict and dismissal records remain available for audit, while the user-facing language stays focused on the project decision being made.

Why this is agentic memory

ScopeThread is not a chatbot with a long transcript. Its stored memory changes what the agent does next.

Structured memory remains authoritative for current project state. Vector retrieval reconnects new evidence with semantically related historical decisions. The agent uses both forms of memory to determine whether it should extract a new requirement, flag a conflict, preserve the existing decision, or recommend a follow-up question.

How we built it

The application is a TypeScript monorepo with four main layers:

1. A React and Vite browser interface for entering evidence and inspecting memory.
2. An AWS Lambda API behind API Gateway for session control and agent workflows.
3. Amazon Bedrock adapters for Cohere Embed Multilingual v3 and Amazon Nova 2 Lite.
4. CockroachDB Cloud for relational memory, conversation evidence, vector embeddings, revision links, and durable agent-run records.

The interface keeps English as the default for hackathon review and offers a persistent Japanese switch. The locale is sent to the analysis layer, where both the Nova prompt and deterministic fallback produce natural localized output while retaining source quotes exactly as evidence. The translation layer is intentionally extensible, but the MVP validates English and Japanese deeply before adding more languages.

CockroachDB stores VECTOR(1024) embeddings with a project-prefixed cosine vector index. Every retrieval query is scoped to one project before similarity ranking. The application stores conversations, extracted memories, conflict links, and successful run status in controlled transactions so a model or database failure cannot create a partially successful memory update.

The public-demo design uses short-lived bearer tokens. Only SHA-256 token hashes are stored, and CockroachDB atomically enforces each session's expiry, project ownership, and analysis allowance before Bedrock is called.

The AWS infrastructure is defined with SAM. It includes Lambda, an HTTP API, a private S3 origin, CloudFront, scoped Bedrock and Parameter Store access, API throttling, a 16 KiB request-body guard, 14-day log retention, and browser security headers. Secret-bearing operations and paid live tests use explicit --apply gates and refuse root credentials.

The CockroachDB Cloud Managed MCP Server provides a separate read-only operator path. The verified workflow uses OAuth, one-cluster scoping, read-only authorization, and allowlisted audit queries to inspect the same decision history created by the AWS application.

Challenges we faced

Preserving history without losing the current truth

The application could not simply update a decision in place. We modeled revisions as an atomic state transition plus an explicit graph edge: the prior decision becomes superseded, the replacement becomes active, and the reason is retained on the supersedes link.

Treating model output as untrusted input

The agent returns structured JSON, but generated output is not accepted directly. ScopeThread validates it with Zod before persistence. A malformed model response fails the run without creating conversation or memory records.

Combining semantic recall with strict isolation

Vector similarity is useful only after the project boundary is enforced. The CockroachDB vector index begins with project_id, and retrieval queries filter by that project before ordering by cosine distance.

Designing a public demo without exposing costly or privileged operations

Anonymous model access needed multiple layers of control. ScopeThread combines short-lived sessions, hashed tokens, per-session analysis limits, API Gateway throttling, request-size limits, scoped IAM permissions, and guarded deployment scripts.

Keeping deployment access narrow

The first deployment bootstrap reached the IAM user's aggregate inline-policy size limit. Instead of broadening the user or switching to administrator access, we moved only the deployment permissions into a customer-managed policy. SAM deployment then exposed three resource-level details: the transform ARN, both stack and change-set ARNs during execution, and the API Gateway tag endpoint. We added only those exact paths. The final bootstrap separates the development user, CloudFormation service role, Lambda execution role, and artifact bucket, and the application deployer can pass only the fixed CloudFormation role for the fixed stack.

External model activation

The Cohere embedding path required accepting the third-party model agreement before live inference. Nova 2 Lite initially returned zero-quota throttling, so we kept account activation separate from code completion and requested review through AWS Support. AWS approved the global cross-region inference profile on 2026-08-07, and the direct agent-memory E2E then completed live conflict detection and transactional memory persistence. The first public E2E exposed a different issue: generated output could still fail strict schema or grounding validation. ScopeThread rejected that output without partial memory, and we added bounded, cause-specific repair guidance without sending raw model output back into the repair prompt. After that repair was deployed, a second public run still failed at the validation boundary. A third run with allowlisted telemetry identified an unlinked conflict, so the host now links the conflict deterministically when exactly one extracted memory has a source quote copied from the conversation while continuing to reject ambiguous cases. The final deployed fix completed the public analysis and revision workflow, and a read-only CockroachDB query verified the persisted decision chain.

Japanese output exposed one more reliability boundary: a fluent-looking model quote could still differ from the actual conversation. ScopeThread now gives Nova host-owned evidence IDs, resolves those IDs back to exact source text, performs one bounded review when a likely conflict is missing, and keeps every new decision proposed until explicit confirmation. Critical conflict explanation and confirmation copy is normalized by the host in English and Japanese, while the model still selects the grounded evidence and relationship.

What we learned

• Agentic memory needs explicit state transitions, not only better prompts.
• Semantic retrieval should locate evidence, while structured records decide what is currently true.
• A durable run ID connects user-visible behavior, model metadata, failures, and database changes without logging sensitive conversation content.
• Idempotency and transactional persistence matter because model calls and browser retries fail in different ways.
• Managed MCP access is most useful as a controlled audit path when the public application already has a narrow runtime API.
• Security gates are easier to trust when they are executable checks rather than prose-only warnings.

Accomplishments we are proud of

• A complete domain workflow with extraction, retrieval, conflict detection, revision, and dismissal behavior.
• CockroachDB-backed memory that survives a browser reload.
• A project-prefixed distributed vector index verified with live multilingual embeddings.
• Durable agent-run observability with allowlisted failure categories.
• Atomic public-session authorization and analysis allowances.
• A least-privilege runtime SQL role that excludes deletion, DDL, and privilege delegation.
• Reproducible local, SAM, browser, and guarded live-E2E verification paths.

What's next

• Add authenticated team workspaces while preserving the current project-isolation boundary.
• Expand requirement and decision templates for more web-production workflows, including WordPress delivery constraints.
• Evaluate additional languages with the same source-quote and terminology checks used for English and Japanese.
• Add configurable retention and export controls for production client projects.

Built With

• amazon-api-gateway
• amazon-bedrock
• amazon-cloudfront
• amazon-nova
• amazon-web-services
• aws-lambda
• aws-sam
• cockroachdb
• cockroachdb-cloud
• cohere-embed-multilingual-v3
• distributed-vector-indexing
• model-context-protocol
• node.js
• react
• typescript
• vite
• zod