feat(reborn): optional native memory seeding on the composition build path

[BenKurrek]

Summary

Stacked on #5163 (reborn/memory-placement-m2-lift). Merge #5163 first.

Expands the native memory provider so it can optionally be initialized with a set of starting documents, exposed on the public composition build path. This is a general capability (tests / demos / migrations), not benchmark-specific.

The benchmark (and any caller) uses ironclaw's real native memory — real write/read/tree/search/scope/safety — not a swapped-in custom provider. An earlier with_memory_service provider-swap was dropped (it would have allowed a custom-search provider, the opposite of what we want).

Public API

// RebornBuildInput
pub fn with_seed_memory(
    self,
    documents: impl IntoIterator<Item = ironclaw_memory_native::SeedMemoryDocument>,
) -> Self

SeedMemoryDocument shape (each seed carries its own scope):

pub struct SeedMemoryDocument {
    pub tenant_id: String,
    pub user_id: String,
    pub agent_id: Option<String>,
    pub project_id: Option<String>,
    pub path: String,                       // relative memory doc path, validated like an agent write
    pub content: String,
    pub metadata: Option<DocumentMetadata>,
}
// builder: SeedMemoryDocument::new(tenant, user, path, content)
//   .with_agent_id(..).with_project_id(..).with_metadata(..)

Seeds go through the REAL native write path

NativeMemoryService::seed_documents(docs) ingests each seed by calling MemoryService::write — the exact entrypoint an agent write uses (crates/ironclaw_memory_native/src/service.rs, in seed_documents, calling self.write(invocation, request)). So each document is stored, versioned, prompt-safety-scanned, and chunked/indexed identically to an agent write. Per-doc scope is honored via a MemoryInvocation built from the seed's tenant/user/agent/project; the native path derives the MemoryContext exactly as it does for an agent write. Nothing is special-cased or bypassed.

Where seeds get written before the runtime is returned:

• local-dev / hosted-single-tenant: crates/ironclaw_reborn_composition/src/factory.rs — build_local_runtime calls seed_native_memory(filesystem, seed_memory_documents) just before constructing the host runtime, over the same composed /memory filesystem the runtime's memory capability reads.
• production (libsql / postgres): threaded through build_production_shaped → RebornProductionBuildContext { seed_memory_documents } → build_backend_production, which calls seed_native_memory(stores.filesystem, ..) before returning.

seed_native_memory builds a NativeMemoryService::from_filesystem(fs, None) over the runtime filesystem and calls seed_documents. The None prompt-write-safety event sink means seeds emit no audit events (they are setup, not agent actions) — but the native pipeline still runs the same prompt-safety policy scan, versioning, and indexing.

Search / capabilities UNTOUCHED

search.rs, backend.rs, indexer.rs, the MemoryBackendCapabilities, and the entire ironclaw_memory crate have zero changes (verified by diff). No FTS added, no bench-specific anything. An in-memory backend still has no full-text search, so search behavior is unchanged. Default (no seed supplied) is byte-identical to today on every path — proven by a test asserting an empty memory tree when no seeds are given.

Verification

• Builds clean under default, libsql, and postgres features.
• cargo clippy clean (the one secret_store "never used" warning pre-exists on the base branch under --tests, unrelated to this change).
• Tests:
  • native crate: seeds write through the native path and are readable + listed in the tree; seeds honor per-document scope (different tenant/user round-trip).
  • composition: with_seed_memory records docs / defaults empty; end-to-end — building a runtime with with_seed_memory and reading the doc back through the real native memory dispatch (memory_read / memory_tree); and a no-seed build yields an empty memory tree.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• staging
• reborn-integration

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7f5dd935-a50b-44e5-9971-28e520177c9b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request introduces a public composition seam to override the default native memory provider with a caller-supplied MemoryService (e.g., for testing or benchmarking) on the local-dev build path. The reviewer suggests failing loudly by returning a specific configuration error variant if memory_service_override is provided in build_production_shaped, rather than silently ignoring it.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Silently ignoring memory_service_override in build_production_shaped can lead to unexpected behavior (e.g., tests or benchmark harnesses silently falling back to the default native provider and hitting the real filesystem instead of using the injected override). To prevent this, we should explicitly check if memory_service_override is Some and return a specific error variant (such as MalformedConfig or a dedicated configuration error variant) to fail loud, rather than reusing generic or misleading error variants.

References

1. When adding preflight configuration checks, introduce specific error variants (e.g., MalformedConfig) for configuration errors rather than reusing existing, potentially misleading variants.