Merge pull request #81 from lazypower/fix/relational-extraction-decouple

fix: run relational extraction when auto-extraction is off

Author: lazypower

docs/reference/configuration.md

@@ -79,12 +79,21 @@ inherit your login `PATH`. Re-running `continuity install-service` bakes a usabl
 | Key | Type | Default | Notes |
 |---|---|---|---|
 | `auto` | boolean | `false` | Automatic session-end extraction: the Stop/SessionEnd hooks asking an LLM to infer memories from the whole transcript. |
+| `relational_auto` | boolean | `true` | Automatic relational profiling at session end: analyzing how you work and merging the result into the single profile node. Independent of `auto`. |
 
-Off by default on purpose. When you turn it on, `serve` prints a warning at
-startup saying so. Explicit `remember` calls, the signal-phrase path, and
-`continuity extract --force` are unaffected either way. Booleans are read
+`auto` is off by default on purpose. When you turn it on, `serve` prints a
+warning at startup saying so. Explicit `remember` calls, the signal-phrase path,
+and `continuity extract --force` are unaffected either way. Booleans are read
 loosely — `true`, `1`, and `yes` all mean on; anything else means off.
 
+`relational_auto` is on by default: unlike transcript extraction it never
+creates arbitrary memories — it only merges into the system-owned
+`mem://user/profile/communication` node, and its provenance is unambiguous
+(analysis of the session, not facts transiting it). Turning it off freezes the
+relational profile — including relational jobs already sitting in the durable
+queue, which are dropped rather than replayed — and `serve` prints a warning at
+startup saying so.
+
 ### `[embedder]`
 
 | Key | Type | Default | Accepted values |
@@ -115,6 +124,7 @@ is the command that changes the key *and* re-embeds.
 | `CONTINUITY_URL` | — | *(built from bind + port)* | Full base URL, e.g. `http://127.0.0.1:37777`. **Client-side only** — the CLI, hooks, and MCP server use it to find the server. It does not change what `serve` binds to. |
 | `CONTINUITY_EMBEDDER` | `[embedder].backend` | *(no override)* | `auto`, `model2vec`, `ollama`, `tfidf`, `hashtf`, `none`, or empty. Unrecognized values warn and fall back to `auto`. |
 | `CONTINUITY_EXTRACTION_AUTO` | `[extraction].auto` | `false` | Any Go boolean: `true`, `false`, `1`, `0`, `t`, `f`. `serve` **refuses to start** on anything else. |
+| `CONTINUITY_RELATIONAL_AUTO` | `[extraction].relational_auto` | `true` | Any Go boolean. `serve` **refuses to start** on anything else. `false` freezes the relational profile. |
 | `CONTINUITY_OBSERVATION_RETENTION_DAYS` | — | `14` days | A positive integer number of days, or `off` / `false` to disable pruning. See [below](#observation-retention). |
 | `ANTHROPIC_API_KEY` | `[llm].provider` **and** `[llm].anthropic_key` | *(unset)* | An API key. Setting it forces `provider = "anthropic"`, overriding whatever `config.toml` says. |
 | `CONTINUITY_GC` | — | `off` | `off`, `shadow`, `on`. Memory garbage collection. Anything unrecognized is treated as `off`. **Advanced.** |
@@ -266,6 +276,7 @@ anthropic_key = ""
 
 [extraction]
 auto = false
+relational_auto = true
 
 [embedder]
 backend = "auto"

internal/cli/extract.go

@@ -99,10 +99,21 @@ func runExtract(cmd *cobra.Command, args []string) error {
 	// than falsely reporting the job as queued. The status string is the server's
 	// stable extraction_disabled contract (server.StatusExtractionDisabled).
 	var resp struct {
-		Status string `json:"status"`
+		Status     string `json:"status"`
+		Relational string `json:"relational"`
 	}
 	if jsonErr := json.Unmarshal(data, &resp); jsonErr == nil && resp.Status == "extraction_disabled" {
 		fmt.Printf("automatic session extraction is off for %s — re-run with --force to extract it anyway\n", sessionID)
+		// Relational profiling is decoupled from that gate (#78); report it when
+		// the server queued a relational-only job for this request.
+		if resp.Relational == "extracting" {
+			fmt.Println("relational profiling queued — the profile still updates from this session")
+		}
+		// The server failed to queue the relational job — say so instead of
+		// letting the silent-skip message imply the profile update happened.
+		if resp.Relational == "error" {
+			fmt.Fprintf(os.Stderr, "relational profiling could NOT be queued for %s — the profile may miss this session; check serve.log\n", sessionID)
+		}
 		return nil
 	}
 

internal/cli/serve.go

@@ -35,6 +35,12 @@ const (
 	// envServeExtractionAuto re-enables the deprecated automatic session-end
 	// extraction (default off). Accepts any strconv.ParseBool value.
 	envServeExtractionAuto = "CONTINUITY_EXTRACTION_AUTO"
+
+	// envServeRelationalAuto is the kill switch for automatic relational
+	// profiling at session end (default on; #78). Accepts any strconv.ParseBool
+	// value. Setting it false restores the pre-#78 behavior: non-force /extract
+	// requests are skipped entirely while autoExtract is off.
+	envServeRelationalAuto = "CONTINUITY_RELATIONAL_AUTO"
 )
 
 // tfidfLexicalNotice is surfaced once at startup whenever the hashed lexical
@@ -165,6 +171,13 @@ func runServe(cmd *cobra.Command, args []string) error {
 
 	srv := server.New(db, eng, VersionString())
 	srv.SetAutoExtraction(cfg.Extraction.Auto)
+	srv.SetRelationalAuto(cfg.Extraction.RelationalAuto)
+	if !cfg.Extraction.RelationalAuto {
+		fmt.Fprintf(os.Stderr,
+			"  ! extraction.relational_auto DISABLED — the relational profile will not "+
+				"update from session ends. Unset %s to return to the default.\n",
+			envServeRelationalAuto)
+	}
 	if cfg.Extraction.Auto {
 		fmt.Fprintf(os.Stderr,
 			"  ! extraction.auto ENABLED — automatic session extraction is on; it is off by "+
@@ -304,5 +317,12 @@ func applyServeEnvOverrides(cfg *config.Config) error {
 		}
 		cfg.Extraction.Auto = enabled
 	}
+	if v := strings.TrimSpace(os.Getenv(envServeRelationalAuto)); v != "" {
+		enabled, err := strconv.ParseBool(v)
+		if err != nil {
+			return fmt.Errorf("%s=%q: must be a boolean (true/false/1/0)", envServeRelationalAuto, v)
+		}
+		cfg.Extraction.RelationalAuto = enabled
+	}
 	return nil
 }

internal/cli/serve_env_test.go

@@ -9,7 +9,7 @@ import (
 
 func clearServeEnv(t *testing.T) {
 	t.Helper()
-	for _, k := range []string{envServeDB, envServePort, envServeBind, envServeEmbedder} {
+	for _, k := range []string{envServeDB, envServePort, envServeBind, envServeEmbedder, envServeExtractionAuto, envServeRelationalAuto} {
 		t.Setenv(k, "")
 	}
 }
@@ -86,6 +86,29 @@ func TestApplyServeEnvOverrides_WhitespaceIgnored(t *testing.T) {
 	}
 }
 
+// TestApplyServeEnvOverrides_RelationalAuto (#78): the kill switch flips the
+// on-by-default relational profiling off; an invalid value fails fast.
+func TestApplyServeEnvOverrides_RelationalAuto(t *testing.T) {
+	clearServeEnv(t)
+	cfg := config.Default()
+	if !cfg.Extraction.RelationalAuto {
+		t.Fatal("relational auto must default ON")
+	}
+
+	t.Setenv(envServeRelationalAuto, "false")
+	if err := applyServeEnvOverrides(&cfg); err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Extraction.RelationalAuto {
+		t.Error("CONTINUITY_RELATIONAL_AUTO=false must disable relational auto")
+	}
+
+	t.Setenv(envServeRelationalAuto, "not-a-bool")
+	if err := applyServeEnvOverrides(&cfg); err == nil {
+		t.Error("expected error for non-boolean CONTINUITY_RELATIONAL_AUTO")
+	}
+}
+
 func TestNormalizeBackend(t *testing.T) {
 	cases := []struct {
 		in, want string
@@ -116,10 +139,12 @@ func TestNormalizeBackend_UnknownPassesThrough(t *testing.T) {
 // The env constants form a contract used by external automation; pin them.
 func TestServeEnvConstants(t *testing.T) {
 	cases := map[string]string{
-		"CONTINUITY_DB":       envServeDB,
-		"CONTINUITY_PORT":     envServePort,
-		"CONTINUITY_BIND":     envServeBind,
-		"CONTINUITY_EMBEDDER": envServeEmbedder,
+		"CONTINUITY_DB":              envServeDB,
+		"CONTINUITY_PORT":            envServePort,
+		"CONTINUITY_BIND":            envServeBind,
+		"CONTINUITY_EMBEDDER":        envServeEmbedder,
+		"CONTINUITY_EXTRACTION_AUTO": envServeExtractionAuto,
+		"CONTINUITY_RELATIONAL_AUTO": envServeRelationalAuto,
 	}
 	for want, got := range cases {
 		if got != want {

internal/config/config.go

@@ -45,6 +45,14 @@ type ExtractionConfig struct {
 	// way. Explicit `continuity remember`, the signal ("remember this") path, and
 	// `continuity extract --force` (the manual override) are all unaffected.
 	Auto bool `toml:"auto"`
+
+	// RelationalAuto enables automatic relational profiling at session end. It
+	// defaults to ON, deliberately decoupled from Auto (#78): unlike transcript
+	// memory extraction, relational profiling merges into a single system-owned
+	// node (mem://user/profile/communication), never creates arbitrary memories,
+	// and its provenance is unambiguous — analysis of the session, not facts
+	// transiting it. CONTINUITY_RELATIONAL_AUTO=false is the kill switch.
+	RelationalAuto bool `toml:"relational_auto"`
 }
 
 // EmbedderConfig governs which embedding backend `serve` constructs.
@@ -84,6 +92,8 @@ func Default() Config {
 		Extraction: ExtractionConfig{
 			// Auto session extraction is off by default (deprecated, high-noise).
 			Auto: false,
+			// Relational profiling stays on by default (#78).
+			RelationalAuto: true,
 		},
 		Embedder: EmbedderConfig{
 			Backend: "auto",

internal/config/file.go

@@ -125,8 +125,11 @@ func applyKV(cfg *Config, section, key, val string) {
 			cfg.LLM.AnthropicKey = val
 		}
 	case "extraction":
-		if key == "auto" {
+		switch key {
+		case "auto":
 			cfg.Extraction.Auto = parseBoolLoose(val)
+		case "relational_auto":
+			cfg.Extraction.RelationalAuto = parseBoolLoose(val)
 		}
 	case "embedder":
 		if key == "backend" {

internal/config/file_test.go

@@ -50,6 +50,30 @@ func TestLoadFile_DefaultBackendIsAuto(t *testing.T) {
 	}
 }
 
+// TestLoadFile_RelationalAuto (#78): relational profiling defaults on and is
+// disableable via [extraction] relational_auto = false.
+func TestLoadFile_RelationalAuto(t *testing.T) {
+	if !Default().Extraction.RelationalAuto {
+		t.Fatal("Default().Extraction.RelationalAuto = false, want true")
+	}
+
+	path := filepath.Join(t.TempDir(), "config.toml")
+	content := "[extraction]\nrelational_auto = false\n"
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	cfg, err := LoadFile(path)
+	if err != nil {
+		t.Fatalf("LoadFile: %v", err)
+	}
+	if cfg.Extraction.RelationalAuto {
+		t.Error("Extraction.RelationalAuto = true, want false from config file")
+	}
+	if cfg.Extraction.Auto {
+		t.Error("Extraction.Auto must stay off by default")
+	}
+}
+
 func TestLoadFile_OtherFieldsRoundtrip(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "config.toml")
 	content := `[server]

internal/engine/engine.go

@@ -710,6 +710,21 @@ func (e *Engine) ExtractSessionForce(sessionID, transcriptPath string) error {
 	return e.extractSession(sessionID, transcriptPath, true)
 }
 
+// ExtractRelational runs only the relational profiling pipeline (#78) — the
+// "relational" queue jobs enqueued while autoExtract is off. It writes zero
+// memory nodes and does NOT mark the session extracted, so a later
+// `continuity extract --force` still runs the full pipeline; extractRelational's
+// source-session guard then prevents double-applying the same profile update.
+// The vector-identity lock is irrelevant here by construction: relational only
+// merges into the fixed system-owned URI and never passes the resurrection gate
+// (see the comment above extractRelational's UpsertNode call).
+func (e *Engine) ExtractRelational(sessionID, transcriptPath string) error {
+	if transcriptPath == "" {
+		return fmt.Errorf("no transcript path provided")
+	}
+	return extractRelational(e.DB, e.LLM, sessionID, transcriptPath)
+}
+
 func (e *Engine) extractSession(sessionID, transcriptPath string, force bool) error {
 	if transcriptPath == "" {
 		return fmt.Errorf("no transcript path provided")

internal/engine/engine_test.go

@@ -180,6 +180,61 @@ User trusts agent with code generation and architectural decisions.`
 	}
 }
 
+// TestExtractRelationalOnlyThenForceDoesNotDoubleApply (#78): a relational-only
+// job followed by `extract --force` on the same session must not re-apply the
+// profile update — extractRelational's source-session guard holds inside the
+// forced full pipeline too.
+func TestExtractRelationalOnlyThenForceDoesNotDoubleApply(t *testing.T) {
+	db := testDB(t)
+	transcriptPath := makeTranscript(t)
+	if _, err := db.InitSession("rel-idem", "proj"); err != nil {
+		t.Fatalf("InitSession: %v", err)
+	}
+
+	relationalResp := `## 1. FEEDBACK CALIBRATION
+Direct feedback style, specific and immediate.
+
+## 2. WORKING DYNAMIC
+Autonomous execution preferred, reviews results.`
+	relMock := &llm.MockClient{Response: &llm.Response{Content: relationalResp, Provider: "mock"}}
+	relEng := New(db, relMock)
+
+	// Relational-only job: profile written, session NOT marked extracted.
+	if err := relEng.ExtractRelational("rel-idem", transcriptPath); err != nil {
+		t.Fatalf("ExtractRelational: %v", err)
+	}
+	first, err := db.GetNodeByURI(relationalURI)
+	if err != nil || first == nil {
+		t.Fatalf("expected profile node, err=%v", err)
+	}
+	if sess, _ := db.GetSession("rel-idem"); sess.ExtractedAt != nil {
+		t.Fatal("relational-only run must not mark the session extracted")
+	}
+
+	// Forced full extraction on the same session: memory extraction runs, but the
+	// relational leg skips before its LLM call (source-session dedup).
+	// Three responses so callIdx distinguishes 2 calls from 3: a relational leg
+	// that failed to dedup would consume the third slot.
+	multiMock := &multiResponseMock{responses: []*llm.Response{
+		{Content: `[{"category":"preferences","uri_hint":"go-style","l0":"Uses Go with minimal deps","l1":"Prefers Go with minimal dependencies and clean architecture","l2":"Full"}]`, Provider: "mock"},
+		{Content: "concise, collaborative", Provider: "mock"}, // tone
+		{Content: "unreached", Provider: "mock"},
+	}}
+	forceEng := New(db, multiMock)
+	if err := forceEng.ExtractSessionForce("rel-idem", transcriptPath); err != nil {
+		t.Fatalf("ExtractSessionForce: %v", err)
+	}
+
+	// Two LLM calls only: memory extraction + tone. Zero for relational.
+	if multiMock.callIdx != 2 {
+		t.Errorf("LLM calls = %d, want 2 (relational must dedup)", multiMock.callIdx)
+	}
+	second, _ := db.GetNodeByURI(relationalURI)
+	if second.L1Overview != first.L1Overview || second.SourceSession != first.SourceSession {
+		t.Error("profile changed on forced re-extraction of the same session")
+	}
+}
+
 func TestExtractRelationalDedup(t *testing.T) {
 	db := testDB(t)
 

internal/server/extraction_worker.go

@@ -124,6 +124,20 @@ func (s *Server) runExtractionJob(job *store.ExtractionJob) error {
 		ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
 		defer cancel()
 		return s.engine.ExtractSignal(ctx, job.SessionID, job.Payload)
+	case "relational":
+		// Relational-only job (#78): enqueued by handleExtractSession while
+		// autoExtract is off, so the profile keeps learning without the memory
+		// pipeline. Runs no memory extraction and never marks the session extracted.
+		//
+		// Honor the kill switch at execution time too, not just at enqueue: a job
+		// queued before CONTINUITY_RELATIONAL_AUTO=false took effect must not
+		// replay after a restart and write to a profile the operator froze.
+		// Dropping (nil ⇒ deleted) is the freeze doing its job, not data loss.
+		if !s.relationalAuto {
+			log.Printf("extraction worker: dropping queued relational job for %s — relational auto is disabled", job.SessionID)
+			return nil
+		}
+		return s.engine.ExtractRelational(job.SessionID, job.Payload)
 	default:
 		// Unknown kind: drop it (nil error ⇒ deleted) rather than retry forever.
 		log.Printf("extraction worker: unknown job kind %q (job %d) — dropping", job.Kind, job.ID)