feat(topic-memory): add end-to-end topic memory

[frf12]

Which issue or RFC does this PR close?

Implements the Topic Memory RFC introduced in #1417.

Rationale for this change

PowerContext captures detailed Sources, but long-running agents also need durable, scoped knowledge that can be evolved, searched, and reused across sessions. Topic Memory turns accepted Sources into long-lived Topic Artifacts while preserving evidence lineage, Scope isolation, publication consistency, and bounded model/resource use.

This change implements that lifecycle end to end rather than exposing an isolated storage or UI layer: Source capture raises durable processing intent, background workers generate and atomically publish Topic revisions, retrieval makes the active projection available to agents, and operators can inspect the same published state from the Dashboard.

What changes are included in this PR?

• Add the topic-memory Artifact family, Markdown chunking, immutable revisions, evidence lineage, current-head projections, and SQLite/OceanBase lexical plus optional vector/hybrid indexes.
• Persist processing Pending state, Cursors, frozen automatic waves, Leases, fencing generations, retries, and per-binding scheduling. Source capture and Pending updates share one transaction; publication validates Lease, Cursor generation, and Topic head compare-and-swap guards in one short transaction.
• Add the bounded generation pipeline for Probe, planning, CREATE/UPDATE/NOOP evolution, related-topic coordination, and conflict-safe retries. Model calls run outside database transactions, provider input/output is budgeted, and server-owned identities and evidence are never delegated to model output.
• Expose scoped flush, search, and exact-get operations through OpenAPI, generated clients, HTTP, MCP capabilities, and the Codex project-context skill. Prepared context can include retrieved Topic Memory without weakening existing Scope or authorization boundaries.
• Add the read-only /topics Dashboard with Scope selection, search, sorting, pagination, list/detail views, source and publication explanations, localized navigation, responsive layouts, and stale-response protection. The page does not create, edit, or delete Topic Memory.
• Add configuration, readiness, deployment-role, troubleshooting, and bilingual RFC/documentation updates. Optional retrieval channels activate only when their complete configuration and indexes are ready.
• Add repository, runtime, API, browser, and product-chain coverage for persistence semantics, generation, atomic publication, retrieval bounds, credential isolation, and a real local Codex-to-Dashboard workflow.

Are there any user-facing changes?

• Agents can call search_topic_memory and get_topic_memory to reuse current Topic knowledge for the active Scope. Operators can request a flush through POST /v1/topic-memory/flush.
• The Dashboard now includes a read-only Topics page. Results remain Scope-isolated and expose current publication metadata and evidence without providing mutation controls.
• Topic processing can run with the API process or the supported background deployment role. Invalid model budgets, incomplete vector configuration, or unsupported scheduler combinations fail readiness instead of silently degrading processing.
• Database initialization adds the Topic Memory processing, publication, projection, and index structures. Existing Artifact families and unfiltered prepared-context behavior remain supported.

How was this change tested?

Local validation covered the complete feature branch at 4189638ba6851b2686c0bb94ce5138fb5e70663e. These are local results, not a claim that remote CI has passed.

• make test: 1263 passed, 11 skipped.
• make check: passed, including manifest, lock, formatting, lint, and type checks.
• make contract-test: 30 passed.
• make build: passed.
• Focused Topic Memory product-chain suite: 15 passed.
• Real local acceptance passed from Codex Source capture through background generation, search/exact retrieval, prepared context, and the /topics Dashboard.
• Python 3.11 and 3.13 credential-isolation acceptance passed; browser requests were verified not to receive the generation or embedding provider credentials.
• Cumulative git diff --check passed.

Known validation limitations:

• Remote CI is pending.
• Live OceanBase/SeekDB and a real external embedding provider were not available for the final acceptance run; their dialect, configuration, fail-closed, and adapter contracts are covered by local tests.

AI usage statement

OpenAI Codex assisted with implementation, review-driven fixes, regression tests, documentation, and local product acceptance. The results above come from executed tests and real local PowerContext/Codex/browser processes; AI assistance is not a substitute for maintainer review or CI.

[CLAassistant]

All committers have signed the CLA.

[Teingi]

resolve conflicts

[Teingi]

resolve conflicts

[Teingi]

LGTM