feat(life_capture, curated_memory): prompt injection + WAL read pool by jwalin-shah · Pull Request #1 · jwalin-shah/openhuman

jwalin-shah · 2026-04-23T01:22:35Z

Summary

Three contained follow-ups to the life_capture / curated_memory foundation (stacked on top of tinyhumansai#817).

curated_memory.snapshot_pair() → agent prompts. PromptContext gains curated_snapshot: Option<&MemorySnapshot>. Session takes one snapshot on the first turn (from curated_memory::runtime::get()), reuses it every turn, and forwards it through ParentExecutionContext so sub-agents render byte-identical MEMORY.md / USER.md blocks as their parent. Preserves the "frozen for the session" KV-cache prefix contract — runtime curated_memory.add/replace/remove writes land on the NEXT session. Workspace-file loader retained as a fallback for embeds without the curated-memory runtime (pure unit tests).
Retrieval eval fixture/runner. Cherry-picked from the retrieval-work branch so we have a scorecard on the RRF/pool changes. Loads tests/fixtures/life_capture/corpus.json, runs per-query keyword/vector/hybrid asserting must_contain / must_not_contain inside top-K. 4/4 green.
r2d2 read pool for PersonalIndex. Split into writer: Arc<Mutex<Connection>> (unchanged single-writer model) + reader_pool: Option<Arc<r2d2::Pool<SqliteConnectionManager>>> (4 read-only connections on file-backed indexes). IndexReader::with_read_conn helper routes reads through the pool when present, the writer lock otherwise — so concurrent RPC searches don't queue behind an in-flight ingest. In-memory handles keep the single-connection layout deliberately (shared-cache URI buys nothing at test-fixture scale).

Note: the RRF rerank commit (c3342d65 on the worktree) was dropped during rebase — patch contents landed upstream via the foundation branch's CodeRabbit review pass. This PR is the remaining three changes.

Test plan

cargo test --lib -p openhuman life_capture — 26 pass
cargo test --test life_capture_retrieval_eval — 4 pass
cargo test --lib -p openhuman curated_memory — 7 pass
cargo test --lib -p openhuman agent::prompts — 23 pass
cargo test --lib -p openhuman agent — 499 pass
CI full matrix

Rendered prompts now surface runtime curated-memory writes: - `PromptContext` gains `curated_snapshot: Option<&MemorySnapshot>`. - `UserFilesSection` prefers the snapshot over the workspace-file loader when one is attached, and injects `USER.md` alongside `MEMORY.md` using a byte-compatible `inject_snapshot_content` helper. - `Session` carries `Option<Arc<MemorySnapshot>>`, populated by `ensure_curated_snapshot` on the first turn from `curated_memory::runtime::get()`. Reused across turns so prompt bytes stay frozen (KV-cache prefix contract) while mid-session `curated_memory.add/replace/remove` writes land on the NEXT session. - `ParentExecutionContext` inherits the snapshot so sub-agents render identical `MEMORY.md`/`USER.md` blocks as the parent. - Legacy workspace-file fallback preserved for embeds that don't initialise the curated-memory runtime (pure unit tests).

Loads a 32-item corpus across gmail/calendar/imessage/slack into an in-memory PersonalIndex and runs 12 queries through keyword / vector / hybrid paths, asserting must_contain / must_not_contain within per-query top-K prefixes. The vector leg uses a deterministic FNV-1a feature-hashing embedder (1536 dims, L2-normalized) so the test is offline and reproducible; real embedder swaps behind one call. Fixture reserves `relevant` and `pending` fields so recall@k / MRR / nDCG bolt onto the same JSON later. q-src-01 is marked pending: hybrid_search currently ignores Query.sources/since/until. Flip to false once filtering lands.

Previously every read grabbed the same `Arc<Mutex<Connection>>` as the writer, so `IndexReader` calls serialised behind in-flight ingests even though WAL would allow parallel readers. Split `PersonalIndex` into: - `writer: Arc<Mutex<Connection>>` — unchanged single-writer model. - `reader_pool: Option<Arc<r2d2::Pool<SqliteConnectionManager>>>` — four-connection read pool on file-backed indexes, built alongside the writer after migrations run. Each pooled connection gets `query_only=ON` as a belt-and-suspenders guard; sqlite-vec is loaded automatically via the process-wide auto-extension. `IndexReader` routes `keyword_search` / `vector_search` through a new `with_read_conn` helper that picks the pool when present and falls back to the writer lock otherwise. In-memory handles keep the single-connection layout — shared-cache URIs buy nothing at test-fixture scale and would force every test to grow a unique name.

jwalin-shah · 2026-04-23T01:24:56Z

Folding into PR tinyhumansai#817 (upstream) instead of stacking.

Two implementation plans drafted from the life-capture spec: - Track 1 (ship pipeline): fix Ubuntu installer smoke, land in-flight PRs tinyhumansai#806/tinyhumansai#786/tinyhumansai#788/tinyhumansai#797, wire Tauri auto-updater + signed Mac/Windows builds. - Life-Capture #1 (foundation): SQLite + sqlite-vec personal_index.db, Embedder trait + HostedEmbedder (OpenAI), PII redaction, quoted-thread stripping, hybrid retrieval (vector + keyword + recency), controller schema + RPC. End-to-end test with synthetic items. No ingestion or UI yet — those are subsequent milestone plans.

…ection snapshot_pair(memory, user) returns a MemorySnapshot containing plain strings — no reference back to the stores — so taking a snapshot at session start and reusing it across turns gives a stable system-prompt prefix and lets the LLM prefix-cache hit on every subsequent turn. Plan #1 also calls for wiring this into chat.rs' OpenClaw context loader, but openhuman assembles agent prompts per-agent under src/openhuman/agent/agents/*/prompt.rs (not the plan's stale src-tauri/src/commands/chat.rs path); the prompt-builder integration is deferred to Plan #2 alongside the agent-context refactor.

…ings Findings from Codex + Gemini second-opinion review: 1. IndexWriter::upsert orphaned vectors on re-ingest (Codex). On (source, external_id) conflict the row's id was kept but the caller's fresh UUID was used for upsert_vector — the vector wrote under an id no row joined to. Fix: explicit SELECT-then-UPDATE-or-INSERT in the same transaction; mutates caller's Item.id to the canonical id (so the next upsert_vector lands on the right row) and orphan-deletes any vector already written under the wrong id. Signature change: upsert(&[Item]) -> upsert(&mut [Item]). 2. upsert_vector DELETE+INSERT was outside a transaction (Gemini) — a failed INSERT permanently lost the item's vector. Now wrapped in tx. 3. Runtime over-gated get_stats on the embedder (Codex). Split runtime into separate INDEX + EMBEDDER OnceCells: get_stats only requires index, search requires both. Index initialises whenever the workspace dir is reachable; embedder is env-gated as before. 4. Startup race (both reviewers): runtime init lived inside the post- serve tokio::spawn block, so axum::serve was already accepting before the OnceCells were set. Hoisted both bootstraps (curated_memory and life_capture) into helpers called inline before axum::serve. 5. runtime::get error message lied (Codex) — said 'set embeddings.api_key in config' but startup actually reads env vars. Fixed text. Bonus: rename controller namespace memory_curated -> curated_memory (Codex preference; nothing depends on it yet so renamed before clients do). Adds regression test for #1 (reingest_with_fresh_uuid_keeps_vector_findable). 4696 lib tests pass.