feat(extended-memory): P0-P2 implementation with security hardening and 80.5% coverage

- Add opt-in Extended Memory atom store, vector recall, and retention-decay eviction
- Wire dedicated/fallback memory LLM and forward MemoryConfig in run/continue
- Fix loop dedup for extended context injection
- Implement quarantine store with TTL and scan tainted atoms before persistence
- Add promote/pin/list_quarantine tool actions and CLI commands
- Harden size cap accounting, vector file permissions, and anti-injection framing
- Update MEMORY.md, EXTENDED_MEMORY.md, and CONFIG.md docs

Delete docs/EXTENDED_MEMORY_IMPLEMENTATION_PLAN.md

Author: jkyberneees

cmd/odek/main.go

@@ -1032,6 +1032,8 @@ func run(args []string) error {
 		Skills:          skillsCfg,
 		SkillManager:    sm,
 		PromptCaching:   resolved.PromptCaching,
+		MemoryDir:       expandHome("~/.odek/memory"),
+		MemoryConfig:    resolved.Memory,
 	})
 	if err != nil {
 		return err
@@ -1049,6 +1051,39 @@ func run(args []string) error {
 	var allMessages []llm.Message
 	var runErr error
 	var result string
+	var sessionID string
+
+	cwd, _ = os.Getwd()
+	if mm := agent.Memory(); mm != nil {
+		if f.Session != nil && *f.Session {
+			// Pre-create the session so extracted atoms can be tagged with the
+			// session ID before the agent run starts.
+			store, err := session.NewStore()
+			if err != nil {
+				return fmt.Errorf("session store: %w", err)
+			}
+			messages := []llm.Message{
+				{Role: "user", Content: f.Task},
+			}
+			if systemMessage != "" {
+				messages = append([]llm.Message{{Role: "system", Content: systemMessage}}, messages...)
+			}
+			sess, err := store.Create(messages, resolved.Model, f.Task)
+			if err != nil {
+				return fmt.Errorf("save session: %w", err)
+			}
+			sess.Sandbox = resolved.Sandbox
+			store.Save(sess)
+			sessionID = sess.ID
+			mm.SetSessionContext(sessionID, cwd)
+			fmt.Fprintf(os.Stderr, "odek: session %s created\n", sessionID)
+		} else {
+			// Non-session mode still needs a transient ID so extracted atoms can
+			// be traced back to this run for review.
+			sessionID = session.GenerateID()
+			mm.SetSessionContext(sessionID, cwd)
+		}
+	}
 
 	if f.Session != nil && *f.Session {
 		// Multi-turn session mode: save conversation history
@@ -1083,22 +1118,27 @@ func run(args []string) error {
 			if err != nil {
 				return fmt.Errorf("session store: %w", err)
 			}
-			sess, err := store.Create(allMessages, resolved.Model, f.Task)
+			// Re-load the pre-created session and append the messages produced
+			// by the run. The pre-created session contains the system + user task;
+			// append only the assistant/tool turns that follow.
+			latest, err := store.Load(sessionID)
 			if err != nil {
+				return fmt.Errorf("load session: %w", err)
+			}
+			newMsgs := allMessages[len(latest.GetMessages()):]
+			if err := store.Append(sessionID, newMsgs); err != nil {
 				return fmt.Errorf("save session: %w", err)
 			}
-			sess.Sandbox = resolved.Sandbox
-			// Persist buffer to session
-			if mm := agent.Memory(); mm != nil {
-				sess.Buffer = mm.GetBuffer()
+			updated, err := store.Load(sessionID)
+			if err != nil {
+				return fmt.Errorf("reload session: %w", err)
 			}
-			store.Save(sess)
-			fmt.Fprintf(os.Stderr, "odek: session %s saved — continue with: odek continue \"...\"\n", sess.ID)
-			// Tag any atoms extracted during this run with the session ID so
-			// future review can trace their origin.
+			updated.Sandbox = resolved.Sandbox
 			if mm := agent.Memory(); mm != nil {
-				mm.SetSessionContext(sess.ID, "")
+				updated.Buffer = mm.GetBuffer()
 			}
+			store.Save(updated)
+			fmt.Fprintf(os.Stderr, "odek: session %s saved — continue with: odek continue \"...\"\n", updated.ID)
 		}
 	} else {
 		// Single-shot mode (default)
@@ -1128,11 +1168,11 @@ func run(args []string) error {
 
 	// ── Session end — extract episode if enough turns ──
 	// Run asynchronously so episode extraction does not delay process exit.
-	if mm := agent.Memory(); mm != nil && f.Session != nil && *f.Session {
+	if mm := agent.Memory(); mm != nil && f.Session != nil && *f.Session && sessionID != "" {
 		go func() {
-			sess, err := session.NewStore()
+			store, err := session.NewStore()
 			if err == nil {
-				latest, err := sess.Latest()
+				latest, err := store.Load(sessionID)
 				if err == nil {
 					msgStrs := makeSessionMessageStrings(latest)
 					prov := memory.DeriveProvenance(latest.Messages)
@@ -1954,25 +1994,27 @@ func continueCmd(args []string) error {
 		skillsCfg = &resolved.Skills
 	}
 
-	agent, err := odek.New(odek.Config{
-		Model:            resolved.Model,
-		BaseURL:          resolved.BaseURL,
-		APIKey:           resolved.APIKey,
-		MaxIterations:    resolved.MaxIter,
-		MaxToolParallel:  resolved.MaxToolParallel,
-		SystemMessage:    systemMessage,
-		UntrustedWrapper: func(source, content string) string { return wrapUntrusted(context.Background(), source, content) },
-		NoProjectFile:    resolved.NoAgents,
-		Thinking:        resolved.Thinking,
-		Temperature:     0, // deterministic by default; override with --temperature
-		Tools:           tools,
-		ToolFilter:      odek.ToolFilterConfig{Enabled: resolved.Tools.Enabled, Disabled: resolved.Tools.Disabled},
-		SandboxCleanup:  sandboxCleanup,
-		Renderer:        rend,
-		Skills:          skillsCfg,
-		SkillManager:    sm,
-		PromptCaching:   resolved.PromptCaching,
-	})
+		agent, err := odek.New(odek.Config{
+			Model:            resolved.Model,
+			BaseURL:          resolved.BaseURL,
+			APIKey:           resolved.APIKey,
+			MaxIterations:    resolved.MaxIter,
+			MaxToolParallel:  resolved.MaxToolParallel,
+			SystemMessage:    systemMessage,
+			UntrustedWrapper: func(source, content string) string { return wrapUntrusted(context.Background(), source, content) },
+			NoProjectFile:   resolved.NoAgents,
+			Thinking:        resolved.Thinking,
+			Temperature:     0, // deterministic by default; override with --temperature
+			Tools:           tools,
+			ToolFilter:      odek.ToolFilterConfig{Enabled: resolved.Tools.Enabled, Disabled: resolved.Tools.Disabled},
+			SandboxCleanup:  sandboxCleanup,
+			Renderer:        rend,
+			Skills:          skillsCfg,
+			SkillManager:    sm,
+			PromptCaching:   resolved.PromptCaching,
+			MemoryDir:       expandHome("~/.odek/memory"),
+			MemoryConfig:    resolved.Memory,
+		})
 	if err != nil {
 		return err
 	}
@@ -1985,8 +2027,9 @@ func continueCmd(args []string) error {
 
 	// Propagate session context to Extended Memory so extracted atoms are
 	// tagged with the session they came from.
+	cwd, _ = os.Getwd()
 	if mm := agent.Memory(); mm != nil {
-		mm.SetSessionContext(sess.ID, "")
+		mm.SetSessionContext(sess.ID, cwd)
 	}
 
 	// Build message history: session messages + new user message

cmd/odek/memory_cmd.go

@@ -73,7 +73,7 @@ func memoryCmd(args []string) error {
 // extendedMemoryCmd handles `odek memory extended forget|quarantine|compact`.
 func extendedMemoryCmd(dir string, args []string) error {
 	if len(args) == 0 {
-		fmt.Fprintf(os.Stderr, "Usage: odek memory extended <forget|quarantine|compact> [args]\n")
+		fmt.Fprintf(os.Stderr, "Usage: odek memory extended <forget|promote|pin|quarantine|compact> [args]\n")
 		return nil
 	}
 
@@ -96,6 +96,28 @@ func extendedMemoryCmd(dir string, args []string) error {
 		fmt.Printf("odek: forgot atom %q\n", id)
 		return nil
 
+	case "promote":
+		if len(subArgs) == 0 {
+			return fmt.Errorf("usage: odek memory extended promote <atom_id>")
+		}
+		id := subArgs[0]
+		if err := em.PromoteAtom(id); err != nil {
+			return err
+		}
+		fmt.Printf("odek: promoted atom %q — it can now be recalled into future sessions\n", id)
+		return nil
+
+	case "pin":
+		if len(subArgs) == 0 {
+			return fmt.Errorf("usage: odek memory extended pin <atom_id>")
+		}
+		id := subArgs[0]
+		if err := em.PinAtom(id); err != nil {
+			return err
+		}
+		fmt.Printf("odek: pinned atom %q\n", id)
+		return nil
+
 	case "quarantine":
 		atoms, err := em.ListQuarantine()
 		if err != nil {
@@ -117,6 +139,6 @@ func extendedMemoryCmd(dir string, args []string) error {
 		return nil
 
 	default:
-		return fmt.Errorf("unknown extended memory subcommand %q (expected: forget, quarantine, compact)", sub)
+		return fmt.Errorf("unknown extended memory subcommand %q (expected: forget, promote, pin, quarantine, compact)", sub)
 	}
 }

cmd/odek/repl.go

@@ -150,6 +150,7 @@ func replCmd(args []string) error {
 		Skills:         skillsCfg,
 		SkillManager:   sm,
 		MemoryConfig:   resolved.Memory,
+		MemoryDir:      expandHome("~/.odek/memory"),
 		PromptCaching:  resolved.PromptCaching,
 	})
 	if err != nil {
@@ -177,6 +178,10 @@ func replCmd(args []string) error {
 		sess.Sandbox = resolved.Sandbox
 		store.Save(sess)
 	}
+	cwd, _ := os.Getwd()
+	if mm := agent.Memory(); mm != nil {
+		mm.SetSessionContext(sess.ID, cwd)
+	}
 
 	fmt.Fprintf(os.Stderr, "\nodek ⚡ %s · session %s\n\n", modelLabel, sess.ID)
 	fmt.Fprintf(os.Stderr, "  Type /help for commands, /exit to quit.\n\n")

cmd/odek/serve.go

@@ -534,6 +534,7 @@ func newServeAgent(resolved config.ResolvedConfig, system string, sendFn func(v
 		Skills:       &resolved.Skills,
 		SkillManager: sm,
 		MemoryConfig: resolved.Memory,
+		MemoryDir:    expandHome("~/.odek/memory"),
 		ToolEventHandler: func(event, name, data string) {
 			sendFn(map[string]any{
 				"type": event,
@@ -967,6 +968,11 @@ func handlePrompt(
 		}
 	}
 
+	cwd, _ := os.Getwd()
+	if agent.Memory() != nil && sess != nil {
+		agent.Memory().SetSessionContext(sess.ID, cwd)
+	}
+
 	// Send session info
 	sid := ""
 	authToken := ""

docs/CONFIG.md

@@ -122,6 +122,10 @@ Every config knob has a `ODEK_*` counterpart:
 | `ODEK_SANDBOX_CPUS` | `--sandbox-cpus` | string |
 | `ODEK_SANDBOX_USER` | `--sandbox-user` | string |
 | `ODEK_MAX_TOOL_PARALLEL` | `max_tool_parallel` | int |
+| `ODEK_MEMORY_EXTENDED_ENABLED` | `--memory-extended-enabled` | bool |
+| `ODEK_MEMORY_EXTENDED_MAX_SIZE_MB` | `--memory-extended-max-size-mb` | int |
+| `ODEK_MEMORY_EXTENDED_ATOM_MAX_CHARS` | `--memory-extended-atom-max-chars` | int |
+| `ODEK_MEMORY_EXTENDED_MEMORY_BUDGET_CHARS` | `--memory-extended-memory-budget-chars` | int |
 
 ## API key fallback order
 
@@ -252,6 +256,67 @@ The `memory` section controls the persistent memory system (see [docs/MEMORY.md]
 | `episode_ttl_days` | 0 | Evict episodes older than this many days. `0` (default) disables TTL-based eviction. |
 | `embedding` | *(inherits top-level `embedding`)* | Optional override of the embedding backend for episode recall, dedup, the non-LLM episode ranker, and fact merge-on-write. When unset, memory inherits the shared top-level [`embedding`](#shared-embedding-backend-embedding--memory-sessions--skills) default; if neither is set, local RandomProjections (lexical bag-of-words — fast, zero-cost, but no real semantics). See below. |
 
+### Extended Memory (`memory.extended`)
+
+`memory.extended` is an **opt-in** atomic memory layer. It extracts small, typed memory atoms from user messages and recalls them via semantic search over the atom corpus. It does not replace facts, the buffer, or episodes; it adds a fourth source of context that is injected after episodes on each turn. See [docs/EXTENDED_MEMORY.md](EXTENDED_MEMORY.md) for the full design.
+
+> **Security note:** Project-level `./odek.json` cannot set the `memory` or `embedding` sections. Configure `memory.extended` in `~/.odek/config.json`, via the `ODEK_MEMORY_EXTENDED_*` environment variables, or with the CLI flags listed below.
+
+```json
+{
+  "memory": {
+    "extended": {
+      "enabled": true,
+      "max_size_mb": 100,
+      "semantic_search_top_k": 10,
+      "semantic_search_overfetch": 4,
+      "semantic_search_min_score": 0.55,
+      "semantic_search_rerank": true,
+      "atom_max_chars": 300,
+      "memory_budget_chars": 2000,
+      "decay_half_life_days": 30,
+      "quarantine_ttl_days": 7,
+      "eviction_policy": "retention_decay",
+      "predictive_intents": 3,
+      "auto_extract_per_turn": true,
+      "infer_user_state": true,
+      "llm": {
+        "base_url": "http://localhost:11434/v1",
+        "api_key": "",
+        "model": "qwen2.5:7b",
+        "max_tokens": 1024,
+        "temperature": 0.2,
+        "timeout_seconds": 30
+      },
+      "embedding": {
+        "provider": "http",
+        "base_url": "http://localhost:11434/v1",
+        "model": "nomic-embed-text"
+      }
+    }
+  }
+}
+```
+
+| Field | Default | Env var | CLI flag | Description |
+|-------|---------|---------|----------|-------------|
+| `enabled` | `false` | `ODEK_MEMORY_EXTENDED_ENABLED` | `--memory-extended-enabled` | Master switch for Extended Memory. |
+| `max_size_mb` | `100` | `ODEK_MEMORY_EXTENDED_MAX_SIZE_MB` | `--memory-extended-max-size-mb` | Hard disk budget for the `extended/` directory. |
+| `semantic_search_top_k` | `10` | — | — | Number of atoms returned to the system prompt. |
+| `semantic_search_overfetch` | `4` | — | — | Candidate multiplier before filtering and reranking. |
+| `semantic_search_min_score` | `0.55` | — | — | Minimum cosine similarity for a candidate to be considered. |
+| `semantic_search_rerank` | `true` | — | — | Use the memory LLM to rerank candidates. |
+| `atom_max_chars` | `300` | `ODEK_MEMORY_EXTENDED_ATOM_MAX_CHARS` | `--memory-extended-atom-max-chars` | Maximum stored text length per atom. |
+| `memory_budget_chars` | `2000` | `ODEK_MEMORY_EXTENDED_MEMORY_BUDGET_CHARS` | `--memory-extended-memory-budget-chars` | Maximum injected Extended Memory context per turn. |
+| `decay_half_life_days` | `30` | — | — | Days until an atom's recall/eviction weight halves. |
+| `quarantine_ttl_days` | `7` | — | — | Days before a tainted atom is auto-deleted from quarantine. |
+| `eviction_policy` | `"retention_decay"` | — | — | Eviction algorithm. `"retention_decay"` is the only supported value. |
+| `predictive_intents` | `3` | — | — | Reserved for future predictive-intent recall (P5). Currently accepted but ignored. |
+| `auto_extract_per_turn` | `true` | — | — | Extract atoms after every user message. |
+| `infer_user_state` | `true` | — | — | Reserved for future user-state model inference (P3). Currently accepted but ignored. |
+| `llm` | omitted | — | — | Dedicated memory LLM. If omitted, the main agent LLM is reused. A warning is emitted if that model has thinking enabled. |
+| `embedding` | omitted | — | — | Dedicated embedding backend for atoms. If omitted, inherits `memory.embedding` or the shared top-level `embedding`. |
+
 ### `embedding` — real semantic embeddings (optional)
 
 By default every similarity computation in memory uses go-vector
@@ -681,6 +746,12 @@ ODEK_SANDBOX=true odek run "run untrusted script"
 # Enable skill learning via env var
 ODEK_SKILLS_LEARN=true odek run "set up CI"
 
+# Enable Extended Memory via CLI flag
+odek run --memory-extended-enabled "remember that I prefer Go over Python"
+
+# Or configure it globally in ~/.odek/config.json (memory cannot be set in ./odek.json)
+# { "memory": { "extended": { "enabled": true } } }
+
 # Sub-agent config (project-level)
 echo '{"subagent": {"max_concurrency": 5, "timeout_seconds": 300}}' > ./odek.json