Add grounded conversation, memory, research, and host awareness

[RobVanProd]

Summary

• add bridge-only Conversation v2 with bounded session history, playback-committed typed tool state, episodic memory, initiative, room context, natural SearXNG research, resident Whisper STT, in-process Gemma, DirectML voice, and a loopback dashboard
• make terse repairs such as No, West Berlin selectively replace the active weather location and rerun a self-contained request instead of being classified as a greeting or new topic
• keep Spark sharp and varied while preventing repeat introductions, repeated three-word punchline families, teasing recognition mistakes, unsafe actuator requests, and unsupported memory writes
• expose value-free model/research/voice/playback/knowledge stage and health diagnostics without transcripts, queries, places, prompts, excerpts, or full URLs
• keep accepted main firmware unchanged

Root cause and harness design

The observed correction failure was not loss of the session ring. The original weather turn and correction were in one session, but the one-turn router classified the terse correction independently and therefore never carried the active tool arguments forward.

ConversationSession now owns a deterministic ConversationHarness. It tracks only a small typed, session-scoped task, stages state beside the generated turn, and commits it only after the matching robot playback acknowledgement. High-confidence repairs overwrite one slot; ambiguous repairs ask for one detail; cancellation, sensitive detours, barge-in, TTS failure, stale playback acknowledgements, bridge loss, and close discard pending state.

The design and alternatives are documented in docs/CONVERSATION_HARNESS.md, with published grounding from Diable, SOM-DST, TripPy, CANARD, conversational query rewriting, correction grammar, and human-machine repair research. Four independent design agents and four separate adversarial judges converged on typed host state plus bounded natural history; extra rewrite-model, full-DST, ReAct, and database-heavy paths were rejected for this latency-sensitive bridge.

Memory and research policy

• incidental places remain inside the current conversation only
• only explicit coarse defaults such as Always use West Berlin as my default weather place persist across sessions
• addresses, coordinates, inferred here/IP/Wi-Fi locations, private data, and reserved host-owned keys are rejected
• wrong-place weather evidence is treated as a typed research failure, not successful grounding
• failed searches retain a retryable canonical request; source verification can refetch the top result
• research-tainted, private, precise-location, third-party, and URL-bearing turns cannot enter generative episode distillation
• an epoch/revision guard prevents late background distillation from resurrecting superseded memory

Scope and authority

This is host bridge and bridge-packaging work. There are no changes to src/, PlatformIO configuration, boards, partitions, generated firmware data, or the installed robot image. The model and research broker have no actuator, power, pairing, camera-authentication, filesystem, shell, or OTA authority. Production turn logs redact text; raw microphone audio and camera frames are not persisted.

Exact candidate

• source head: ec3dc42d
• bridge implementation: e4627cc1
• final head delta: desktop resource manifest only, packaging conversation_harness.py
• branch: agent/natural-research-voice
• PR: Add grounded conversation, memory, research, and host awareness #199 into main

Validation

• bridge reference suite: 524/524 pass
• generated topic-switch adversarial matrix: 200/200 no false weather routes
• real Gemma character red team: 26/26 pass
• real Gemma conversation benchmark: 9/9 pass, median model step 1123.87 ms
• trusted-facts smoke: ready, modelInvocations=0, audioPlayed=false, no issues
• companion full check: pass after adding the new bridge module to desktop resources
• dashboard browser check: live pipeline state rendered, no horizontal overflow, no console errors
• exact-head GitHub Actions: 11/11 pass

Live host state

The bridge implementation at e4627cc1 is deployed through the production DirectML launcher. The final ec3dc42d commit changes packaging only and does not require a host restart.

Production startup evidence reports:

• bridge and robot connected at 192.168.1.238
• SearXNG ready; supervised Vulkan Whisper healthy and warmed
• DirectML voice synthesis ready; Gemma runner resident
• room/face vision advancing without capture or authentication failures
• motion disabled and verified
• servo rail disabled
• servo torque disabled
• bridge uplink errors: zero

Remaining promotion boundary

The PR remains draft until exact-head CI is green and an ordinary physical conversation confirms the new repair path in real acoustics. The bridge implementation and automated gates are complete; no firmware flash, reboot, or motion enable is part of this update.

[RobVanProd]

Bridge transport follow-up after syncing current main:

• Root cause: bridge_uplink_errors=80 corresponds exactly to two failed dedicated-capture chunks retried 40 times each (mww_uplink_submit_failed=2), with zero binary queue failures.
• Fixed cross-type queue ordering so a final PCM frame cannot be overtaken by a later utterance_end text frame.
• Remote response_start/response_end events no longer close an active local microphone turn; local SpeechEnded, errors, and bounded gate timeouts retain ownership of capture completion.
• response_end now retains its sequence for diagnostics.

Verification:

• native logic: 272/272 pass
• bridge Python suite: 337/337 pass
• stackchan_release_full: build pass
• current live robot: exact downlink accounting, 0 playback errors, 0 playRaw failures; host log has not observed PCM after utterance_end

Physical gate remains intentionally pending: flash an exact private candidate only with the operator present, keep motion stopped, capture a pre-test /debug baseline, run at least ten wake/speech turns including one interruption near response completion, and require zero deltas in uplink errors/failed chunks plus clean heard audio and exact downlink/playRaw accounting. The existing live process and robot were not restarted or flashed for this software-only update.

[RobVanProd]

Final post-push verification for e9b7cba4:

• GitHub Actions bridge-tests: passed (1m33s)
• GitHub Actions native-tests: passed (41s)
• GitHub Actions Windows firmware build: passed (11m54s)
• path-filtered companion jobs: skipped as expected
• branch is 0 behind origin/main and 0 ahead/behind its remote head after push
• final local release ZIP: 189,300,476 bytes, SHA-256 7e41f8b64e4bff4ee4ab12703e468a0893bc90312df15e9894a2c9082e6f046a
• strengthened release verifier passed and archive contains zero Python cache/bytecode entries

The PR remains draft. No live bridge restart, robot flash, motion command, or merge was performed. The remaining gates are the exact-image supervised physical qualification and normal soak documented in docs/BRIDGE_AI_QUALIFICATION.md.

[RobVanProd]

Exact candidate update for 5767ec958e1ba528fe3e477d7df4eeec4add3dc7:

• branch clean, pushed, 0 behind origin/main; guarded firmware-input diff remains empty
• bridge suite 448/448 pass; Character Lock red team 26/26 pass; credential hygiene 11/11 pass
• all 11 GitHub Actions checks pass, including bridge/native tests, firmware build, Android emulator smoke, companion tests/release evidence, and Android/Linux/macOS/Windows artifacts
• exact package stackchan_alive_v0.2.0-124-g5767ec95.zip, 189400522 bytes, SHA-256 BF42EAB100A7D8E9EB9D09E1A111F5FB602623D4A8A80582F8C809747DE57C4A, independently reverified
• exact clean commit is live; robot/bridge ready; motion, servo rail, and torque off; uplink errors remain at the established baseline of 80 and playback errors remain 0
• live follow-up VAD now records successful speech and no-speech evidence together; a quiet 93-chunk capture was classified no-speech and closed silently without STT/model/TTS
• host-only face/room stack is enabled; authenticated frame/target/face counters advance with zero new frame/auth failures
• privacy control exercised: room observation produced grounded person-present and empty-room summaries with zero observation failures, then disable cleared state immediately and no image file was persisted; observation was re-enabled at the 120-second cadence

The PR remains draft. The exact supervised evidence session still requires the operator-present attestation, multi-turn/exit/barge-in checks, 100 echo-free reply windows, initiative timing/backoff/night checks, bridge-loss recovery, exact pre/post firmware SHA, and explicit owner approval. No firmware operation or merge was performed.

[RobVanProd]

PR #216 baseline is now included unchanged. Exact bridge candidate: 04064bf; package stackchan_alive_v0.2.0-135-g04064bf7.zip; SHA-256 A6ED79002713C288CAF70A5D812D8C60F8166A88B40D174DD36A5A2BB51E632B. Local validation: bridge 471/471, native 287/287, package verifier pass; warm local generation median 1126.33 ms, max 1872.31 ms. Firmware guarded diff against main remains empty. PR #216's 12-second capture improves long utterances, but live evidence found a same-threshold BridgeWakeGate/final-chunk race producing audio_uplink_not_active at the ceiling; this is documented as a firmware-owner handoff and must be closed before supervised promotion. PR remains draft and unmerged.

[RobVanProd]

Final pre-physical candidate update: head 5d6c6c9; package stackchan_alive_v0.2.0-136-g5d6c6c91.zip; 189,432,449 bytes; SHA-256 A3DDDD3A4FA4D2493FD2F747BAB8BA2D6056B8D9D94289FE559889F6F0741B30. Local bridge suite 477/477; independent package verifier pass; all 11 exact-head CI checks pass; guarded firmware diff remains empty. The supervised checker now requires PR #216-or-later accepted firmware provenance, complete required transport telemetry with zero deltas, redacted route proof for research/visual/grayscale/memory, and operator-confirmed natural conversation, recall isolation, grounded person noticing, initiative, privacy, and recovery. The live bridge remains stopped and no firmware, reboot, or motion action was performed.