Chat memory bridge: archive chat turns to the SQLite memory store

[TimothyNguyen]

Stacked on #7 (rag-chatbot-manager → master). Base is rag-chatbot-manager, so the diff here is only the 14 commits of this branch.

Summary

Chat turns now persist to both FalkorDB (as before) and the SQLite memory store, so an answered turn becomes a searchable archive entry alongside the graph history.

• A separate chat_memories table. The existing memories table is a byte-level cross-language contract with Go's internal/memory/store.go and cannot gain a workspace column. chat_memories lives in the same memory.db with its own workspace-scoped schema and indexes; Go ignores tables it does not know. No new code reads or writes memories.
• A sink layer that is allowed to fail. ChatMemorySink has three implementations: NullChatMemorySink (what a server with no memory database injects, so call sites stay unconditional), SyncChatMemorySink (does the work, swallows store failures), and ThreadedChatMemorySink (runs the sync sink on one worker thread). An archive write never blocks a chat response and never turns a successful turn into a failure — failures become strings on the frozen errors list and are drained once. Only exc.__class__.__name__ reaches the wire; full detail goes to stderr.
• Off the request thread. Embedding a turn can be a 30s HTTP call when KB_CORE_UI_EMBED_URL is set, which must not sit on a request that already has its answer. Work is a single FIFO queue, so a delete queued after a write is applied after it — a pending write can never resurrect a deleted thread.
• Three workspace-scoped routes, on the existing single handle_rag_workspaces dispatcher rather than the mux: GET /api/rag/workspaces/{id}/memory, GET .../memory/search, DELETE .../memory. Every branch passes workspace_id to the store, which scopes its own SQL. An unknown workspace 404s rather than reading as an empty archive. The routes do not exist at all when GraphRAG is off.
• Deleting a workspace clears its archive. WorkspaceManager.delete_workspace cascades to the sink. This is an explicit correction to the spec, recorded in the handoff doc.
• Web surface to browse and search a workspace's archived turns, using snake_case payload keys (created_at, workspace_id, thread_id, turn_id, seq). The global memory surface's createdAt shape is untouched.

Recall is not implemented. Archived turns are stored and searchable through the UI, but the chat workflow does not retrieve from them.

The last three commits fix correctness bugs found in self-review after the feature was otherwise complete:

• A full queue used to discard the oldest pending item to make room, which could drop a delete or let a write outlive the delete meant to remove it. Writes stay expendable; deletes now wait for the sink timeout instead.
• drain_errors was global, so a store failure caused by one tenant's turn could be drained onto another tenant's response. It now takes a workspace id, in both the sink and ChatManager's own buffer, and the sink's buffer is lock-guarded.
• The HTTP DELETE talked to the store directly while writes were still queued, stepping over the FIFO. It now goes through the sink when the server has one.

Test plan

• pytest (python) — 289 passed
• pytest -k isolation with RAG_ENABLE=false — 9 passed, existing Graph/Bots/Memory/REST/MCP/SQLite/static graph.json paths unaffected
• pytest (harness) — 128 passed
• harness rag --backend fake — passed, 22/22 stages, new chat_memory_persistence stage green
• harness rag --backend falkordb against pinned falkordb/falkordb:v4.20.4 — passed, 22/22, same stage green
• pnpm test (web) — 62 passed
• pnpm lint (oxlint) — clean
• pnpm build — succeeded
• Live pass against a real kb-core-ui serve process with the built web/dist and pinned FalkorDB, driving the exact HTTP calls the UI makes. The DOM itself was not driven — there is no browser automation in this repo, and the handoff doc says so explicitly rather than claiming otherwise.

The chat_memory_persistence harness stage is the standing gate: it runs two tenants end to end over HTTP and asserts each one's archive holds only its own turns, that search never crosses the boundary, and that deleting a workspace empties its archive while the other tenant's is untouched.

🤖 Generated with Claude Code