系统记忆

.gitignore

@@ -27,7 +27,6 @@ mise.toml
 apps/android/.gradle/
 apps/android/app/build/
 apps/android/.cxx/
-
 # Bun build artifacts
 *.bun-build
 apps/macos/.build/
@@ -49,6 +48,8 @@ apps/ios/.swiftpm/
 apps/ios/.derivedData/
 apps/ios/.local-signing.xcconfig
 vendor/
+!src/auto-reply/reply/export-html/vendor/
+!src/auto-reply/reply/export-html/vendor/**
 apps/ios/Clawdbot.xcodeproj/
 apps/ios/Clawdbot.xcodeproj/**
 apps/macos/.build/**
@@ -79,6 +80,7 @@ apps/ios/*.mobileprovision
 
 # Local untracked files
 .local/
+.cursor/
 docs/.local/
 IDENTITY.md
 USER.md
@@ -88,15 +90,15 @@ USER.md
 # local tooling
 .serena/
 
+# Rust build artifacts (RustFS)
+packages/rustfs/target/
 # Agent credentials and memory (NEVER COMMIT)
 /memory/
 .agent/*.json
 !.agent/workflows/
 /local/
 package-lock.json
 .claude/settings.local.json
-.agents/
-.agents
 .agent/
 skills-lock.json
 

.oxfmtrc.jsonc

@@ -18,6 +18,7 @@
     "node_modules/",
     "patches/",
     "pnpm-lock.yaml/",
+    "packages/rustfs/target/",
     "src/gateway/server-methods/CLAUDE.md",
     "src/auto-reply/reply/export-html/",
     "Swabble/",

deploy/k8s/deep-memory/deep-memory-server.yaml

@@ -0,0 +1,135 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: deep-memory-server
+  labels:
+    app.kubernetes.io/name: deep-memory-server
+spec:
+  selector:
+    app.kubernetes.io/name: deep-memory-server
+  ports:
+    - name: http
+      port: 8088
+      targetPort: 8088
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: deep-memory-server-secrets
+type: Opaque
+stringData:
+  # REQUIRED in production: configure API keys and limit namespaces.
+  # Example:
+  # [
+  #   { "key": "<read-key>", "role": "read", "namespaces": ["teamA"] },
+  #   { "key": "<write-key>", "role": "write", "namespaces": ["teamA"] },
+  #   { "key": "<admin-key>", "role": "admin", "namespaces": ["teamA"] }
+  # ]
+  API_KEYS_JSON: "[]"
+  # Optional: set if Qdrant is secured.
+  QDRANT_API_KEY: ""
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: deep-memory-server-config
+data:
+  PORT: "8088"
+  HOST: "0.0.0.0"
+  REQUIRE_API_KEY: "true"
+  # In Kubernetes, prefer keeping /metrics behind NetworkPolicy; leave this false by default.
+  ALLOW_UNAUTHENTICATED_METRICS: "false"
+  RATE_LIMIT_ENABLED: "true"
+  RATE_LIMIT_WINDOW_MS: "60000"
+  RATE_LIMIT_RETRIEVE_PER_WINDOW: "300"
+  RATE_LIMIT_UPDATE_PER_WINDOW: "60"
+  RATE_LIMIT_FORGET_PER_WINDOW: "10"
+  RATE_LIMIT_QUEUE_ADMIN_PER_WINDOW: "60"
+  UPDATE_BACKLOG_REJECT_PENDING: "2000"
+  UPDATE_BACKLOG_RETRY_AFTER_SECONDS: "30"
+
+  QDRANT_URL: "http://qdrant:6333"
+  QDRANT_COLLECTION: "openclaw_memories"
+  VECTOR_DIMS: "384"
+
+  NEO4J_URI: "bolt://neo4j:7687"
+  NEO4J_USER: "neo4j"
+
+  LOG_LEVEL: "info"
+  UPDATE_CONCURRENCY: "1"
+  QUEUE_DIR: "/data/queue"
+  AUDIT_LOG_PATH: "/data/audit/audit.jsonl"
+  EMBEDDING_MODEL: "Xenova/bge-small-en-v1.5"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deep-memory-server
+  labels:
+    app.kubernetes.io/name: deep-memory-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: deep-memory-server
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: deep-memory-server
+    spec:
+      containers:
+        - name: deep-memory-server
+          # Build and push your own image from packages/deep-memory-server/Dockerfile
+          # then set this to your registry.
+          image: "openclaw/deep-memory-server:local"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8088
+          envFrom:
+            - configMapRef:
+                name: deep-memory-server-config
+            - secretRef:
+                name: deep-memory-server-secrets
+          env:
+            - name: NEO4J_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: neo4j-auth
+                  key: password
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: 200m
+              memory: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8088
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8088
+            initialDelaySeconds: 10
+            periodSeconds: 20
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: deep-memory-server-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: deep-memory-server-data
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 5Gi

deploy/k8s/deep-memory/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: openclaw
+
+resources:
+  - namespace.yaml
+  - qdrant.yaml
+  - neo4j.yaml
+  - deep-memory-server.yaml
+  - networkpolicy.yaml

deploy/k8s/deep-memory/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openclaw

deploy/k8s/deep-memory/neo4j.yaml

@@ -0,0 +1,95 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: neo4j
+  labels:
+    app.kubernetes.io/name: neo4j
+spec:
+  selector:
+    app.kubernetes.io/name: neo4j
+  ports:
+    - name: http
+      port: 7474
+      targetPort: 7474
+    - name: bolt
+      port: 7687
+      targetPort: 7687
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: neo4j-auth
+type: Opaque
+stringData:
+  # Set this to a strong password before applying.
+  password: "openclaw"
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: neo4j
+  labels:
+    app.kubernetes.io/name: neo4j
+spec:
+  serviceName: neo4j
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: neo4j
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: neo4j
+    spec:
+      containers:
+        - name: neo4j
+          image: neo4j:5.26
+          ports:
+            - name: http
+              containerPort: 7474
+            - name: bolt
+              containerPort: 7687
+          env:
+            - name: NEO4J_AUTH
+              value: "neo4j/$(NEO4J_PASSWORD)"
+            - name: NEO4J_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: neo4j-auth
+                  key: password
+            - name: NEO4J_server_memory_pagecache_size
+              value: "512M"
+            - name: NEO4J_server_memory_heap_initial__size
+              value: "512M"
+            - name: NEO4J_server_memory_heap_max__size
+              value: "512M"
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: 200m
+              memory: 1Gi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 7474
+            initialDelaySeconds: 15
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 7474
+            initialDelaySeconds: 30
+            periodSeconds: 20
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 20Gi

deploy/k8s/deep-memory/networkpolicy.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: deep-memory-server-ingress
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: deep-memory-server
+  policyTypes:
+    - Ingress
+  ingress:
+    # Allow in-namespace callers by default. Tighten this to specific pods/namespaces
+    # in production (e.g. OpenClaw gateway pods + Prometheus).
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: openclaw

deploy/k8s/deep-memory/qdrant.yaml

@@ -0,0 +1,67 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: qdrant
+  labels:
+    app.kubernetes.io/name: qdrant
+spec:
+  selector:
+    app.kubernetes.io/name: qdrant
+  ports:
+    - name: http
+      port: 6333
+      targetPort: 6333
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: qdrant
+  labels:
+    app.kubernetes.io/name: qdrant
+spec:
+  serviceName: qdrant
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: qdrant
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: qdrant
+    spec:
+      containers:
+        - name: qdrant
+          image: qdrant/qdrant:v1.13.4
+          ports:
+            - name: http
+              containerPort: 6333
+          volumeMounts:
+            - name: data
+              mountPath: /qdrant/storage
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 6333
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 6333
+            initialDelaySeconds: 10
+            periodSeconds: 20
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 10Gi