feat(life_capture): Composio → life_capture bridge for Gmail + Calendar (A2) - #820

src/openhuman/agent/agents/integrations_agent/prompt.rs (1)

171-171: LGTM — required compile-fix for the updated PromptContext shape.

Side note: with seven agent prompt-test files now manually spelling out every PromptContext field, the duplication is approaching the point where a PromptContext::test_default() builder (or a test-only Default impl behind #[cfg(test)]) would make future field additions a one-line change instead of seven. Not blocking — flagging for a future cleanup pass.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/agent/agents/integrations_agent/prompt.rs` at line 171, The
compile error is due to the updated PromptContext shape missing the
curated_snapshot field; update the construction of PromptContext in
agents/integrations_agent/prompt.rs to include curated_snapshot: None (matching
the new struct field) so the struct literal compiles, and consider adding a
PromptContext::test_default() or a test-only Default impl for PromptContext to
reduce duplication across the seven agent prompt-test files in a future cleanup.

src/openhuman/tools/ops.rs (1)

122-126: Add a regression-guard test for life_capture_search registration.

The new tool is unconditionally registered (matching the comment that surfaces a structured error at call time if life_capture::runtime isn't initialised yet), but there's no test pinning that contract. Every other always-on tool added to this list (spawn_subagent, complete_onboarding, current_time, curl, …) ships with a matching assert!(names.contains(&"…")) regression guard; without one here, a future refactor that gates registration behind a feature/flag could silently strip the tool from the agent's tool list and slip through CI.

♻️ Proposed test (drop next to the other regression guards)

#[test]
fn all_tools_always_registers_life_capture_search() {
    // Regression guard: `life_capture_search` is always registered.
    // Surfacing a structured error from runtime::get_index/get_embedder
    // is the intended behavior when life-capture core hasn't initialised
    // — the tool itself must still appear in the registry.
    let tmp = TempDir::new().unwrap();
    let security = Arc::new(SecurityPolicy::default());
    let mem_cfg = MemoryConfig {
        backend: "markdown".into(),
        ..MemoryConfig::default()
    };
    let mem: Arc<dyn Memory> =
        Arc::from(crate::openhuman::memory::create_memory(&mem_cfg, tmp.path()).unwrap());
    let browser = BrowserConfig::default();
    let http = crate::openhuman::config::HttpRequestConfig::default();
    let cfg = test_config(&tmp);

    let tools = all_tools(
        Arc::new(Config::default()),
        &security,
        mem,
        &browser,
        &http,
        tmp.path(),
        &HashMap::new(),
        &cfg,
    );
    let names: Vec<&str> = tools.iter().map(|t| t.name()).collect();
    assert!(
        names.contains(&"life_capture_search"),
        "life_capture_search must always be registered; got: {names:?}"
    );
}

As per coding guidelines: "Rust code must be unit-tested for new/changed behavior before stacking features".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/tools/ops.rs` around lines 122 - 126, Add a regression-guard
unit test that ensures life_capture_search is always registered by calling
all_tools and asserting the returned tool names contain "life_capture_search";
mirror the existing pattern used for other always-on tools (create a TempDir,
SecurityPolicy, Memory via create_memory, BrowserConfig, HttpRequestConfig,
test_config, call all_tools, collect names with .iter().map(|t| t.name()), and
assert!(names.contains(&"life_capture_search"))). Place this test alongside the
other registration guards (next to tests that assert presence of
spawn_subagent/complete_onboarding/current_time/etc.) so future refactors that
accidentally gate or remove LifeCaptureSearchTool::new() will fail CI.

src/openhuman/life_capture/redact.rs (1)

8-17: Optional: anchor PHONE with word boundaries to reduce over-matching in opaque IDs.

PHONE has no \b at start/end, so digit substrings inside identifiers (tracking numbers, hex-adjacent IDs, etc.) can be partially rewritten as <PHONE>. The other three regexes use \b and don't have this property. Since this redaction runs upstream of embedding + FTS indexing, an over-match merely costs you recall on those tokens — not a correctness issue — but tightening it is cheap:

♻️ Suggested boundary tightening

 static PHONE: Lazy<Regex> = Lazy::new(|| {
     Regex::new(
         r"(?x)
+        \b
         (?:\+?\d{1,3}[\s\-.])?       # optional country code, e.g. '+1-' or '1.'
         (?:\(\d{2,4}\)|\d{2,4})[\s\-.]?
         \d{3}[\s\-.]?\d{3,4}
+        \b
     ",
     )
     .unwrap()
 });

Worth adding a regression test that a long opaque ID like "order-1234567890123" is left untouched (currently the CC regex would also catch this — same caveat applies but it's a separate, well-known best-effort tradeoff).

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/life_capture/redact.rs` around lines 8 - 17, The PHONE regex
(static PHONE: Lazy<Regex>) lacks word boundaries and can over-match digit
substrings inside opaque IDs; update the regex to add \b anchors at the start
and end of the pattern (i.e., wrap the whole pattern with \b ... \b or
equivalent) so it only matches standalone phone-like tokens, and add a unit test
asserting strings like "order-1234567890123" are not redacted (and other
positive tests to ensure real phone numbers still redact).

src/openhuman/life_capture/migrations/0001_init.sql (1)

9-9: Clarify or wire up text_keyword.

The column is declared with a comment promising a "raw values projection for FTS5/BM25 (Onyx pattern)", but items_fts indexes subject, text and all three triggers ignore text_keyword. Future readers will reasonably assume it's indexed. Either:

1. Index it in items_fts (and update the AI/AD/AU triggers accordingly) so keyword search actually uses the unprocessed projection, or
2. Drop the column from this migration and re-introduce it in the migration that first uses it, or
3. Rephrase the comment to make clear it's a placeholder reserved for a follow-up migration.

Option 3 is the lowest-risk if you want to keep the column shape stable for future readers/writers without touching trigger logic in this PR.

Also applies to: 30-36

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/life_capture/migrations/0001_init.sql` at line 9, The column
text_keyword is declared but not used by items_fts or the AI/AD/AU triggers,
which is misleading; update this migration to either wire it up or make its
intent explicit—prefer the low-risk option: keep the column but change its
inline comment to state it's a reserved placeholder for a future migration
(e.g., "reserved for raw values projection for FTS5/BM25; indexed and wired up
in a follow-up migration"), and leave items_fts and the triggers (AI/AD/AU)
unchanged so behavior stays stable.

src/openhuman/agent/harness/session/types.rs (1)

135-136: Use the in-scope Arc for consistency.

Arc is already imported at line 19 and used unqualified throughout this file (e.g., line 27 Arc<dyn Provider>, line 142 Arc<dyn ... PayloadSummarizer>). The new field could drop the std::sync:: prefix to match.

♻️ Proposed tweak

-    pub(super) curated_snapshot:
-        Option<std::sync::Arc<crate::openhuman::curated_memory::MemorySnapshot>>,
+    pub(super) curated_snapshot: Option<Arc<crate::openhuman::curated_memory::MemorySnapshot>>,

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/agent/harness/session/types.rs` around lines 135 - 136, The
field curated_snapshot is using the fully qualified std::sync::Arc type; change
it to use the in-scope Arc to match the rest of the file (e.g., other usages
like Arc<dyn Provider> and Arc<dyn PayloadSummarizer>). Locate the declaration
of curated_snapshot (type
Option<std::sync::Arc<crate::openhuman::curated_memory::MemorySnapshot>>) and
replace std::sync::Arc with the unqualified Arc so the field reads
Option<Arc<crate::openhuman::curated_memory::MemorySnapshot>>>, keeping the same
crate path for MemorySnapshot.

src/openhuman/life_capture/quote_strip.rs (1)

4-7: Edge case: wrapped On … wrote: headers won't match.

Gmail/Apple Mail occasionally wrap the citation header across two lines when the sender name + email is long (On Mon, Apr 21, 2026 at 9:14 AM, Some Long Name\n<long.address@example.com> wrote:). Since . doesn't match newlines, the cut won't fire and the wrapped header + quoted block will leak through (the >-line filter catches the quotes, but the wrapped header stays). Not a release blocker — typical clients keep it on one line — but worth a (?s) variant or a permissive [\s\S]{1,400} if you see this in real Gmail payloads during A2 e2e.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/life_capture/quote_strip.rs` around lines 4 - 7, The
ON_DATE_WROTE regex currently uses .{1,200} which won't match when the "On …
wrote:" header is wrapped across lines; update the pattern in the Lazy::new
closure (where Regex::new is called for ON_DATE_WROTE) to allow newlines in that
span (either add the DOTALL flag via (?s) or replace .{1,200} with a permissive
[\s\S]{1,400} or similar) so wrapped headers like "On ...\n<email> wrote:" are
matched; keep the word boundary and trailing wrote:\s*$ anchors intact and
adjust the max length as needed.

app/src-tauri/src/imessage_scanner/mod.rs (1)

413-452: Note: ts is UTC midnight of a local-tz day.

seconds_to_ymd (line 276) renders the day in local timezone, but parse_day_to_unix parses it back as UTC midnight. For non-UTC users this puts ts up to ~24h off "actual local midnight" — fine for dedupe (the stable key is external_id, not ts), but the comment on line 413 reads as if ts is the precise start-of-day in UTC. Either tighten the comment to "stable anchor derived from the local-tz day" or compute the local-tz midnight here so semantic ranking by ts matches the user's calendar.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@app/src-tauri/src/imessage_scanner/mod.rs` around lines 413 - 452, The
comment claims ts is "UTC midnight of a local-tz day" but seconds_to_ymd renders
day in the local timezone while parse_day_to_unix currently produces UTC
midnight, causing up-to ~24h mismatch; either update the comment to say ts is a
stable anchor derived from the local-tz day, or change parse_day_to_unix to
compute the local-tz midnight for the provided YYYY-MM-DD string and return its
UTC unix-seconds instead (use chrono::Local or convert
NaiveDate.and_hms_opt(0,0,0) with Local::from_local_datetime and then to_utc
timestamp). Update the code in parse_day_to_unix (and keep seconds_to_ymd
behavior) so ts semantics match the comment, or leave parse_day_to_unix as-is
and tighten the comment to refer to a "stable anchor derived from the local-tz
day" mentioning parse_day_to_unix, seconds_to_ymd, and the ts variable.

tests/composio_ingest_e2e.rs (1)

67-72: Silent error-swallowing on init_index/init_embedder makes this test fragile if it ever stops being #[ignore].

Both calls are wrapped in let _ = …, so if the runtime singletons are already populated by an earlier test in the same binary the bridge is wired to the local idx while the JSON-RPC path (openhuman.life_capture_search / _get_stats) reads from the previously-installed runtime — the assertions then fail with no obvious diagnostic. Today this is masked by #[ignore], but if anyone removes that gate later this becomes a confusing flake.

Either log/assert on the init result, or document the single-test invariant inline:

📝 Surface init mismatches loudly

-    let _ = runtime::init_index(Arc::clone(&idx)).await;
+    if let Err(e) = runtime::init_index(Arc::clone(&idx)).await {
+        eprintln!("[composio_e2e] runtime::init_index already set ({e}) — this test must run alone");
+    }
     let embedder: Arc<dyn Embedder> = Arc::new(DeterministicEmbedder { dim: 1536 });
-    let _ = runtime::init_embedder(Arc::clone(&embedder)).await;
+    if let Err(e) = runtime::init_embedder(Arc::clone(&embedder)).await {
+        eprintln!("[composio_e2e] runtime::init_embedder already set ({e})");
+    }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/composio_ingest_e2e.rs` around lines 67 - 72, The test currently
silences errors from runtime::init_index and runtime::init_embedder which can
hide mismatched singleton state; change the calls to check and propagate
failures instead of using `let _ = ...` — call
runtime::init_index(Arc::clone(&idx)).await and
runtime::init_embedder(Arc::clone(&embedder)).await and assert or unwrap their
Results (or log and panic) so any attempt to reinitialize with a different
PersonalIndex (opened via PersonalIndex::open) or Embedder
(DeterministicEmbedder) fails loudly before calling
register_life_capture_composio_bridge; alternatively add an explicit inline
comment documenting the single-test invariant if you must keep the silent
behavior.

src/openhuman/life_capture/runtime.rs (1)

26-38: init_index / init_embedder are async fn but never .await — drop the async.

OnceCell::set is synchronous. Marking these functions async adds spurious async-coloring to startup with zero benefit. All six call sites (in src/core/jsonrpc.rs and test files) use .await and would need it removed:

♻️ Proposed change

-pub async fn init_index(idx: Arc<PersonalIndex>) -> Result<(), &'static str> {
+pub fn init_index(idx: Arc<PersonalIndex>) -> Result<(), &'static str> {
     INDEX
         .set(idx)
         .map_err(|_| "life_capture index already initialised")
 }

-pub async fn init_embedder(embedder: Arc<dyn Embedder>) -> Result<(), &'static str> {
+pub fn init_embedder(embedder: Arc<dyn Embedder>) -> Result<(), &'static str> {
     EMBEDDER
         .set(embedder)
         .map_err(|_| "life_capture embedder already initialised")
 }

Update call sites to remove .await:

• src/core/jsonrpc.rs (lines 940, 973)
• tests/imessage_ingest_e2e.rs (lines 73, 75)
• tests/composio_ingest_e2e.rs (lines 68, 70)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/life_capture/runtime.rs` around lines 26 - 38, The functions
init_index and init_embedder are declared async but only call synchronous
OnceCell::set (INDEX.set and EMBEDDER.set); remove the async from both
signatures so they are regular synchronous functions returning Result<(),
&'static str>, and update all call sites that currently do `.await` on
init_index/init_embedder to call them without awaiting (i.e., remove the
`.await`), leaving their return type and error handling unchanged.

src/openhuman/life_capture/embedder.rs (2)

97-99: Hard-coded dim() = 1536 couples this struct to a single model family.

text-embedding-3-small is 1536-dim, but text-embedding-3-large is 3072 and other providers vary. Since model is already a configurable field, a future config swap will fail the dim-check at lines 87‑92 with a confusing error. Consider taking the dimension via HostedEmbedder::new(...) or auto-detecting from the first response.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/life_capture/embedder.rs` around lines 97 - 99, The dim()
method currently returns a hard-coded 1536 which ties the embedder to one model;
change HostedEmbedder so dimension is configurable (e.g., add a dim field set
via HostedEmbedder::new(...)) or implement auto-detection by calling the
embedding API once and storing the returned vector length, then have dim()
return that stored value; update any construction sites that create
HostedEmbedder to supply/derive the correct dimension and remove the fixed 1536
constant so model swaps won’t break the runtime check in the embedding
validation logic.

---

54-95: Add logging around the external embeddings call.

This is a remote HTTP dependency on the request-serving path. Consider adding tracing::debug! with [life_capture:embedder] prefix at entry (input count, model, base_url host only — never api_key), and tracing::warn! on error_for_status/JSON parse failures with the response status. As per coding guidelines: "Add substantial development-oriented logging at entry/exit points, branch decisions, external calls, retries/timeouts" and "Never log secrets, raw JWTs, API keys".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/life_capture/embedder.rs` around lines 54 - 95, The embed_batch
function makes an external HTTP call without development logging; add a
tracing::debug! at the start of embed_batch that logs the input count,
self.model, and only the host portion of self.base_url (do NOT log self.api_key
or any secrets) with a prefix like "[life_capture:embedder]"; then wrap the HTTP
response handling to emit tracing::warn! (also prefixed) when error_for_status()
or the subsequent JSON deserialization fails, including the HTTP status code and
any non-sensitive response context (but not body or api_key), and include a
final tracing::debug! on success (e.g., returned embeddings count and dim)
before returning.

src/openhuman/curated_memory/store.rs (2)

58-60: Drop a more informative error like add does.

add reports "char limit {} exceeded" (line 42) but replace just says "char limit". Trivial consistency win for callers reading the error.

♻️ Tweak

         if next.chars().count() > self.char_limit {
-            return Err(std::io::Error::new(std::io::ErrorKind::Other, "char limit"));
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::Other,
+                format!("char limit {} exceeded", self.char_limit),
+            ));
         }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/curated_memory/store.rs` around lines 58 - 60, The replace
branch returns a non-descriptive error string "char limit" when
next.chars().count() > self.char_limit; make it consistent with add by returning
an error that includes the limit value and context (e.g., "char limit {}
exceeded") so callers see the threshold—update the error created in replace to
format the message with self.char_limit, matching the add implementation.

---

98-102: with_extension("md.tmp") is fragile if MemoryFile::filename() ever stops being .md.

Path::with_extension replaces the existing extension. Today MemoryFile::filename() always ends in .md so memory.md → memory.md.tmp, but if a future variant returns notes.json, this would write to notes.md.tmp and silently lose the .json. Appending instead of replacing is more robust, e.g. path.with_file_name(format!("{}.tmp", path.file_name().unwrap().to_string_lossy())). Minor — current callers are fine.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/curated_memory/store.rs` around lines 98 - 102, The
atomic_write function uses path.with_extension("md.tmp") which replaces the
existing extension and will break if MemoryFile::filename() stops using .md;
change it to append a .tmp suffix to the entire filename instead (use
path.file_name() + ".tmp" and call path.with_file_name(...)) so e.g.
atomic_write builds tmp via something like path.with_file_name(format!("{}.tmp",
path.file_name().unwrap().to_string_lossy())); ensure you handle the None case
for file_name (return an io::Error) and keep the rest of atomic_write
(tokio::fs::write then tokio::fs::rename) unchanged.

src/openhuman/life_capture/rpc.rs (2)

76-82: Constant duplicated with index.rs — extract to types.rs to keep dim authoritative.

INDEX_VECTOR_DIM = 1536 here mirrors dim() = 1536 in embedder.rs and the vec0 schema width in index.rs. If a future migration changes the column width, three places have to move in lockstep. Promoting this to a pub const VECTOR_DIM: usize = 1536; in types.rs (or index.rs) and importing it into both call sites would keep things honest.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/life_capture/rpc.rs` around lines 76 - 82, The duplicate
hard-coded vector dimension (INDEX_VECTOR_DIM = 1536) used in rpc.rs should be
centralized: create a public constant pub const VECTOR_DIM: usize = 1536 in
types.rs (or an existing index-related module), remove the local
INDEX_VECTOR_DIM, and import VECTOR_DIM into rpc.rs to use in the embedder.dim()
check (replace INDEX_VECTOR_DIM with VECTOR_DIM). Update any other modules
(e.g., where vec0 schema width or embedder.rs currently assume 1536) to
reference the same VECTOR_DIM to keep the dimension authoritative across
INDEX_VECTOR_DIM, embedder.dim(), and index schema usages.

---

142-170: Item is committed before the embedding succeeds — retry semantics are okay, but document/log the partial state.

If embed_batch or upsert_vector fails after upsert returns, the row exists in items/items_fts with no vector. Keyword search will still surface it; vector search won't. The next re-ingest by the same (source, external_id) will re-embed and patch it, so this is self-healing — but only if the caller retries.

Two suggestions:

1. Log a tracing::warn! (with item_id/source/external_id) on the embed/upsert_vector error paths so partial states are observable.
2. Consider noting this contract in the rustdoc on handle_ingest so callers of the RPC know to retry on error to backfill the vector.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/life_capture/rpc.rs` around lines 142 - 170, The upsert of the
Item (requested_id -> canonical_id) happens before embedding, so failures in
embed_batch or upsert_vector leave a row without a vector; update the
embed/upsert_vector error paths to emit a tracing::warn! that includes the item
id (canonical_id or requested_id), source and external_id so partial states are
observable, and ensure the warn is logged just before returning the error from
both the embed_batch .map_err and the upsert_vector .map_err locations;
additionally add a short rustdoc on the handle_ingest RPC function explaining
that callers should retry on error to allow a subsequent ingest to backfill the
missing vector.

src/openhuman/life_capture/ingest/composio.rs (2)

364-378: log::debug!/log::warn! here while the rest of the file uses tracing — pick one.

The bridge's hot path uses tracing::{debug,warn}! (lines 57‑112), but registration uses log::{debug,warn}!. Both routes ultimately reach the configured subscriber, but mixing facades makes filtering by target less predictable and adds a small papercut for anyone grepping with a single prefix. Prefer tracing to stay consistent with the rest of the bridge and the codebase's [domain] prefix convention.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/life_capture/ingest/composio.rs` around lines 364 - 378,
Replace the mixed use of log macros with tracing in the bridge registration
path: where BRIDGE_HANDLE is checked and the bridge is created with
LifeCaptureComposioBridge::new and registered via subscribe_global, change the
log::debug! and log::warn! calls to tracing::debug! and tracing::warn! (or
import tracing::{debug, warn}) so the registration messages use the same tracing
facade/target as the rest of the file and maintain consistent filtering and
[domain] prefix behavior.

---

417-424: std::mem::forget(dir) leaks the temp dir for the process lifetime.

The intent is "keep the directory alive past the function return so the SQLite file at db remains valid". TempDir::into_path() expresses that explicitly (and lets the OS reclaim it on test-runner cleanup) without going through mem::forget. Lower priority since this is test-only.

♻️ Proposed tweak

-    async fn fresh_bridge() -> LifeCaptureComposioBridge {
-        let dir = tempdir().expect("tempdir");
-        let db = dir.path().join("lc.db");
-        std::mem::forget(dir);
-        let idx = Arc::new(PersonalIndex::open(&db).await.expect("open"));
+    async fn fresh_bridge() -> LifeCaptureComposioBridge {
+        let dir = tempdir().expect("tempdir").into_path();
+        let db = dir.join("lc.db");
+        let idx = Arc::new(PersonalIndex::open(&db).await.expect("open"));

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/life_capture/ingest/composio.rs` around lines 417 - 424, The
test helper fresh_bridge currently calls std::mem::forget(dir) which improperly
leaks the TempDir; replace that with TempDir::into_path() so the temp directory
is explicitly preserved for the lifetime of the test-runner cleanup. Concretely:
create the tempdir as before, call dir.into_path() (or assign its result to a
new PathBuf) to construct the db path used to open PersonalIndex, remove the
std::mem::forget call, and keep the rest (opening PersonalIndex, creating
Arc<TestEmbedder>, and calling LifeCaptureComposioBridge::new) unchanged.

src/openhuman/life_capture/schemas.rs (1)

226-272: Adapter logging — consider emitting trace/debug at entry/exit for each handler.

These adapters cross the JSON-RPC → domain boundary and currently log nothing on entry, exit, or failure paths. A tracing::debug! with a stable [life_capture:rpc] prefix and the controller name + key params (e.g. source, external_id for ingest; k and a redacted text.len() for search) would make request flows traceable without leaking PII (don't log text body or metadata). As per coding guidelines: "Add substantial development-oriented logging at entry/exit points, branch decisions, external calls".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/life_capture/schemas.rs` around lines 226 - 272, Add
development-oriented trace/debug logs to the RPC adapters: in handle_get_stats,
handle_search, and handle_ingest emit tracing::debug! logs with a stable
"[life_capture:rpc]" prefix at function entry (and at successful exit) and on
error branches; log only non-PII controller identifiers — for handle_ingest
include source and external_id, for handle_search include k and text.len()
(redacted), and for handle_get_stats a simple entry/exit marker — do not log
text bodies or metadata. Place entry logs before calling
runtime::get_index()/runtime::get_embedder() and downstream RPC calls, place
exit logs after the to_json(...) result is produced, and include error context
when mapping runtime errors or serde errors to strings so failures are traceable
without leaking sensitive content.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes