feat(memory): learn from durable evidence and recover private sessions

[jacoblee-io]

Summary

Shared volumes tie private sessions to a Runtime, while unbounded recall can retain obsolete or forgotten instructions. Persist private session checkpoints in host-authorized object storage and replace legacy personal-memory indexes with bounded evidence learning in AgentBox. Users can reuse their own memory across Runtimes and resume completed sessions after Pod replacement.

Solution and upgrade

• Keep ownership, writer leases, generation fencing, immutable object versions and idempotent commit receipts on the host. Restore the exact Pi entry tree and selected branch; unfinished execution requires explicit recovery and is never replayed automatically.
• Learn from host-selected committed sources in a durable first stage, then organize evidence through an independent second-stage lease, revision and receipt. Preserve task goals, uncertainty, failed attempts and scoped corrections. Explicit remember/correct/forget operations retain source provenance and tombstones.
• Supply small relevant briefs with a 1.5-second deadline, bounded body reads and context budgets; read longer evidence on demand. Recheck source authorization, expiry and supersession on return. Search exposure, explicit reads and final citations remain distinct usage signals.
• Remove personal-memory embeddings, vector/FTS/BM25 indexes and old flush/watch/profile paths. Local and remote execution share retrieval contracts and ranking fixtures. Local memory uses per-user SQLite transactions; remote memory uses the host service without a local memory database. Memory cannot install Skills or grant tool permissions.

Deploy a compatible host API before Runtime/AgentBox. Export and verify historical state before enabling remote workspace mode. Object versions remain retained; forgetting learned memory does not erase source checkpoints. Existing spaces keep their storage placement; cross-bucket migration is not implemented. See the memory design and workspace operations guide.

Test Plan

• Rebased on main at 479eb6b5; 85 targeted TypeScript test files / 1,540 tests and the TypeScript build passed.
• Compatible host: 10 Go packages passed race tests; Web typecheck and four complete Linux amd64 image builds passed.
• Deployed by image digest. Five real-model turns verified learning, owner-specific recall across two logical Runtimes, rejection of another user's checkpoint read (HTTP 403), and completed-session Pod replacement without PVCs or tool replay. All seven original Pi entries survived unchanged.
• Earlier feature validation, before this rebase: 376 test files / 7,488 passed with one existing skip; 288 same-model synthetic evaluation trajectories passed. Those full suites were not rerun for this publication.

Both latest recall turns used one memory_search; the restored-session follow-up used no tools. This is not an official Codex/Claude product comparison or a geographical latency measurement. In-flight hard-kill recovery and earlier Helm coverage were not repeated in this deployment pass.

Architecture Checklist

• Local and remote memory contracts have targeted coverage; live Pod recovery uses the remote workspace path.
• No new shell execution authority or automatic Skill writer; source ownership and visibility remain host-enforced.
• Personal-memory storage stays separate from Portal/Gateway configuration persistence.

General Checklist

• One branch for private state persistence and evidence-backed memory.
• No unrelated workspace changes or private deployment details included.