[OSPP] Implement Full Context Management for the Dubbo Admin Agent

[robocanic]

为Dubbo Admin Agent 实现完整的上下文管理功能：

1. Prompt Template的占位和渲染。System Prompt, AI Message, User Message 的组合。
2. 长对话的上下文压缩。
3. 跨对话的记忆机制。

更多细节请参考：https://summer.ospp.ac.cn/org/prodetail/26cf40055?list=org&navpage=org

English version

Implement comprehensive context management for the Dubbo Admin Agent:

1. Prompt template placeholders and rendering, including the composition of system prompts, AI messages, and user messages.
2. Context compression for long conversations.
3. A cross-conversation memory mechanism.
   For more details, please refer to: https://summer.ospp.ac.cn/org/prodetail/26cf40055?list=org&navpage=org

[Geaus]

Hi! I’ve submitted my proposal and résumé through the OSPP system and would love to work on this issue. I’m happy to discuss the implementation details and refine the proposal based on the community’s feedback. Thanks!

[larry-zy]

Pure prompt and prompt-assembly issues include: the final-answer phase reuses a system prompt that instructs the model to call tools when needed, while tools are no longer bound and the model is simultaneously required to produce a final answer. This creates an instruction conflict that may lead to fabricated verification or invalid tool calls. The prompt should therefore be split into separate act and final-answer policies, with the final-answer policy explicitly stating that no tools are available and that the answer must rely only on already provided evidence. Other issues include absolute history instructions that can induce hallucination; no clear distinction between confirmed facts, inferences, and unknowns; undefined user-facing behavior for tool failures, timeouts, empty results, and unavailable data; no rule that user input, retrieved documents, tool outputs, and future Memory content must be treated as untrusted data rather than executable instructions; redundant injection of tool names; and overly specific, easily outdated infrastructure rules. The prompt should be simplified into reusable policy fragments and retain stable decision principles rather than hardcoded tool names or metric details. Diagnostic answers should also follow a minimum structure covering conclusion, evidence, uncertainty, and recommended next steps. These changes are limited to ai/prompts/agentReasonAct.txt and ai/component/agent/react/prompt.go and do not depend on storage, compression, hooks, middleware, or changes in other modules.

[larry-zy]

@yuqi Qiao

[Qiao-yq]

The current context-window problem is that, although the Agent already injects messages before each model call through ai.WithMessages, WindowMemoryForTurn returns only the current active turn. Previously completed turns are therefore excluded from the model context, effectively reducing multi-turn conversations to single-turn interactions and incorrectly relying on the Memory Tool to recover history. The fix should build one stable context snapshot at the beginning of each interaction, containing the most recent N completed turns in chronological order followed by the selected active turn, while excluding all other concurrent active turns. Subsequent tool results should be persisted to the Store and appended to the in-memory snapshot for the next ReAct model call. MemoryStore and GormStore must implement identical window semantics, with tests covering message ordering, window limits, concurrent-turn isolation, snapshot stability, and cleanup on failure. This change is limited to restoring short-term context within one Session and does not include prompt templates, context summarization, cross-session long-term memory, or generic hooks and middleware.

[larry-zy]

The next phase of context engineering should provide an extensible, secure, and measurable pipeline for assembling
model inputs. Each context source should have explicit permissions, provenance, freshness, lifecycle, and token
limits. The implementation should use project-owned interfaces without integrating PowerContext. Reviewing the
design document also highlights requirements that need explicit coverage: shared security controls, storage limits,
evidence precedence, memory deduplication, and deletion of derived data.

1. Unified Context Compiler
   Define extensible context-source interfaces and assemble authorized sources into model inputs. Record included
   and omitted items with reasons, support bounded historical queries, and prioritize fresh tool evidence over
   historical summaries or memory.

2. Versioned Prompt Templates
   Support template variables, message roles, versioning, and backward compatibility. Restrict available variables
   and functions, validate required inputs, and prevent user-controlled values from changing message roles or tool
   permissions.

3. Server-Side Page Context Validation
   Validate snapshot structure, size, allowed fields, and resource permissions. Redact sensitive data, limit
   snapshots to the current interaction, and verify current resource state through live tools.

4. Session Ownership and Access Isolation
   Derive tenant and user identity from server-side authentication. Enforce ownership and resource permissions
   across session APIs, chat requests, history retrieval, and deletion.

5. Shared Context Security and Sensitive-Data Controls
   Apply consistent trust boundaries and redaction across page context, tool results, summaries, memory, and RAG.
   Treat external content as untrusted data and prevent secrets from entering persistent memory, indexes, or logs.

6. Request Idempotency and Session Lifecycle
   Prevent duplicate interactions on retries, define concurrent-write behavior, and support configurable retention
   and cleanup. Bound in-memory session counts, event counts, and total storage size; propagate deletion to derived
   data and pending background work.

7. Token Budgets and Tool-Result Compression
   Reserve output capacity and a safety margin, allocate budgets by source, and trim deterministically without
   breaking tool-call/result pairs. Compress large results into structured evidence with authorized references, and
   return explicit errors when mandatory content alone exceeds the budget.

8. Token Usage Attribution and Cost Accounting
   Distinguish pre-call estimates from provider-reported usage and track estimated consumption by context source.
   Aggregate usage across agent iterations, retries, and auxiliary model calls such as summarization; calculate
   auditable costs using versioned pricing and explicitly mark unknown costs.

9. Conversation Summarization
   Generate structured summaries containing goals, confirmed facts, evidence, completed actions, unresolved work,
   and superseded conclusions. Track source ranges and versions, protect concurrent updates, and support continued
   conversations beyond fixed turn limits with bounded fallback when summarization fails.

10. Long-Term Memory Creation and Management
    Support confirmed memory facts, candidate extraction, deduplication, and replacement of outdated facts. Provide
    controls to view, confirm, edit, delete, clear, expire, and disable memory, with traceable provenance and
    cleanup of derived copies.

11. Long-Term Memory Retrieval and Injection
    Begin with structured-key and keyword retrieval. Apply permission and scope filters before ranking, then enforce
    confirmation status, validity, relevance, and token limits; historical memory must not override current
    authoritative evidence.

12. Evaluation, Observability, and Controlled Rollout
    Evaluate multi-turn reasoning, long conversations, memory corrections, access isolation, prompt injection,
    deletion, and failure recovery. Record privacy-preserving metrics and version identifiers, provide independent
    feature flags and rollback, and retire legacy paths after validation.

13. Vector Retrieval Extension
    Introduce pluggable vector indexing when evaluations demonstrate a benefit. Enforce authorization during
    retrieval, synchronize updates and deletion, and keep the index rebuildable from canonical memory records.

14. Authorized RAG Evidence and Genuine Reranking
    Integrate RAG as a context source with collection permissions, provenance, document versions, and retrieval
    scores. Implement actual reranking, enforce evidence budgets, and allow basic conversation to continue when
    retrieval fails.

15. Declarative Skills and Task-Specific Assembly
    Implement versioned Skill manifests, registration, and deterministic selection. Load task instructions,
    examples, and permitted tools or knowledge sources within the caller’s permissions and token budget; Skills must
    not override core security policy.

[larry-zy]

@Qiao-yq