feat(runtime+admin): A2 LLM异步提取接线 + A4 Tracing接线 + A6通知后端聚合

A2 异步记忆提取:
- loop/memory.go: asyncExtractor接口(ExtractAsync)+extractMemoryAsync(60s超时,WithOutCancel,dispatch即返回,后台落库,失败仅Warn)+persistMemories共用
- run.go 三个回合落定点改异步提取; 删除run.go逐步提取(design/03'每轮后', 避免多轮工具N次LLM调用/重复写)
- cmd/cyrene/extractor.go buildMemoryExtractor: llmGroupUsable为真→LLMExtractor, 否则回落ManualExtractor(日志说明); keylessEndpoint放行loopback/私网

A4 可观测性 Tracing:
- cmd/cyrene/observability.go: newAppTraceWriter+traceFanout(多sink)+gatewaySpanSink(走gw.ObserveSpan,喂环形缓冲+LLM/subagent指标)
- wire.go 注入; 未改trace/gateway数据结构

A6 通知后端:
- internal/services/gateway/notifications.go(311行): GET /admin/notifications?type=&before=&limit= (adminAuth)
- 聚合已有源(obs.audit SQLite + s.backthink), createdAt倒序, id=source:id; 类型派生(channel/system/audit/backthink); 无新建表/无新Deps/wire零改动
- 诚实: backthink仅shouldPush计, 未注入源为空, 报错500, 未读游标后置
- 契约与前端Y一致: {id,type,title,body,source,createdAt}, before含游标(<=), type未知400
- Docs/api-client v0.33

全仓 build/vet/test绿(56包)+win/darwin/linux-arm64交叉编译绿; 新增测试(memory_async/extractor/observability/notifications)

internal/runtime/loop/memory.go

@@ -3,11 +3,26 @@ package loop
 import (
 	"context"
 	"strings"
+	"time"
 
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/memory"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
 )
 
+// memoryExtractTimeout bounds one background extraction. It only governs the
+// detached extraction context, so a hung model call cannot leak a goroutine for
+// the process lifetime.
+const memoryExtractTimeout = 60 * time.Second
+
+// asyncExtractor is the extractor capability the loop detaches to a background
+// goroutine: memory.LLMExtractor implements it through ExtractAsync (design/03 §1
+// LLM 异步自动提取), returning a channel that delivers exactly one result.
+// Deterministic extractors (memory.ManualExtractor) do not implement it and stay
+// on the synchronous path.
+type asyncExtractor interface {
+	ExtractAsync(ctx context.Context, conversation []model.Message) (<-chan memory.AsyncResult, error)
+}
+
 // injectMemory retrieves the persona's relevant long-term memories and prepends
 // them as a leading system message, so the model can ground its answer in recalled
 // context (design §6 / §2). It is re-run every round via assembleContext so the
@@ -157,6 +172,66 @@ func (l *Loop) extractMemory(ctx context.Context, messages []model.Message, step
 		l.log.Warn("memory extract", "step", step, "error", err)
 		return
 	}
+	l.persistMemories(ctx, items, step)
+}
+
+// extractMemoryAsync triggers the extraction hook at the turn boundary without
+// blocking the reply (design/03 §1: 每轮对话后后台异步抽取). When the configured
+// extractor can extract asynchronously (the LLM extractor) the conversation is
+// handed to a background goroutine and this call returns immediately, so a slow
+// extraction model never delays the response. A deterministic extractor
+// (ManualExtractor) does not implement asyncExtractor and is run inline, which
+// keeps its cheap "记住 X" path observable and unchanged.
+//
+// The same gates as extractMemory apply: a restricted conversation is never
+// extracted (read-only isolation, design/02 §3 / design/11 §2), and a missing
+// extractor or store is a no-op. Extraction failures and store failures are
+// logged with the loop's source and never propagated.
+func (l *Loop) extractMemoryAsync(ctx context.Context, messages []model.Message, step int) {
+	env := sessionEnvFrom(ctx)
+	if env.Restricted() {
+		l.log.Debug("memory extract skipped: read-only context", "step", step, "env", env.ActorEnv)
+		return
+	}
+	if l.extractor == nil || l.memory == nil {
+		return
+	}
+	async, ok := l.extractor.(asyncExtractor)
+	if !ok {
+		l.extractMemory(ctx, messages, step)
+		return
+	}
+	// The turn's context dies with the request while the extraction deliberately
+	// outlives it, so the goroutine gets a detached copy of the context (values —
+	// the session env among them — are kept) under its own timeout.
+	dctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), memoryExtractTimeout)
+	// The caller keeps appending to messages as the turn continues, so the
+	// goroutine reads a private snapshot instead of racing on the shared slice.
+	snapshot := append([]model.Message(nil), messages...)
+	results, err := async.ExtractAsync(dctx, snapshot)
+	if err != nil {
+		cancel()
+		l.log.Warn("memory extract dispatch", "step", step, "error", err)
+		return
+	}
+	go func() {
+		defer cancel()
+		res, ok := <-results
+		if !ok {
+			return
+		}
+		if res.Err != nil {
+			l.log.Warn("memory extract", "step", step, "error", res.Err)
+			return
+		}
+		l.persistMemories(dctx, res.Items, step)
+	}()
+}
+
+// persistMemories writes extracted items to the memory store, scoping any item
+// the extractor left unscoped to the loop's persona. Store failures are logged
+// and never fatal, so one rejected item cannot abort a turn.
+func (l *Loop) persistMemories(ctx context.Context, items []memory.MemoryItem, step int) {
 	for _, it := range items {
 		if it.PersonaID == "" && l.personaID != "" {
 			it.PersonaID = l.personaID

internal/runtime/loop/memory_async_test.go

@@ -0,0 +1,228 @@
+package loop
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/capability/restrict"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/memory"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
+)
+
+// The LLM extractor is the async-capable implementation behind design/03 §1: the
+// loop type-asserts this capability to detach extraction to a background
+// goroutine, so the contract is locked here rather than discovered at runtime.
+var (
+	_ memory.Extractor = (*memory.LLMExtractor)(nil)
+	_ asyncExtractor   = (*memory.LLMExtractor)(nil)
+	_ memory.Extractor = (*memory.ManualExtractor)(nil)
+)
+
+// gatedExtractor is a memory.Extractor that also implements asyncExtractor. Its
+// extraction blocks until release is closed (or ctx is canceled), so a test can
+// prove the loop's turn finishes while extraction is still in flight, and that
+// the extraction survives the caller's own cancellation.
+type gatedExtractor struct {
+	release  chan struct{}
+	started  chan struct{}
+	items    []memory.MemoryItem
+	dispatch int
+}
+
+func newGatedExtractor() *gatedExtractor {
+	return &gatedExtractor{
+		release: make(chan struct{}),
+		started: make(chan struct{}, 1),
+		items: []memory.MemoryItem{{
+			Scope:       memory.ScopeUser,
+			Kind:        memory.KindRelationship,
+			Content:     "用户习惯：爱喝冰美式",
+			Confidence:  0.9,
+			DecayWeight: 1,
+		}},
+	}
+}
+
+func (g *gatedExtractor) Extract(ctx context.Context, _ []model.Message) ([]memory.MemoryItem, error) {
+	select {
+	case g.started <- struct{}{}:
+	default:
+	}
+	select {
+	case <-g.release:
+		return g.items, nil
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
+func (g *gatedExtractor) ExtractAsync(ctx context.Context, conv []model.Message) (<-chan memory.AsyncResult, error) {
+	g.dispatch++
+	out := make(chan memory.AsyncResult, 1)
+	go func() {
+		defer close(out)
+		items, err := g.Extract(ctx, conv)
+		out <- memory.AsyncResult{Items: items, Err: err}
+	}()
+	return out, nil
+}
+
+// TestExtractMemoryAsync_LLMExtractorThroughLoop wires the real LLM extractor
+// (not a fake) into the loop: after the turn settles, the extractor's own model
+// call runs in the background and its parsed items land in the store, so the
+// production path (design/03 §1 LLM 异步自动提取) is exercised end to end.
+func TestExtractMemoryAsync_LLMExtractorThroughLoop(t *testing.T) {
+	t.Parallel()
+	store := newTestMemoryStore(t)
+	ad := &mockAdapter{chat: []mgResp{
+		{resp: model.Response{Content: "记住了"}},
+		{resp: model.Response{Content: `[{"content":"用户爱喝冰美式","scope":"user","kind":"relationship","confidence":0.92}]`}},
+	}}
+	a := newTestAgent(t, ad, nil)
+	l := New(Options{
+		Agent: a, Memory: store, PersonaID: "persona-a", MaxRounds: 8,
+		Extractor: memory.NewLLMExtractor(ad, "persona-a", "owner"),
+	})
+
+	if _, err := l.Run(context.Background(), "sess", []model.Message{model.TextMessage(model.RoleUser, "我喜欢冰美式")}); err != nil {
+		t.Fatalf("Run: %v", err)
+	}
+	waitForMemoryCount(t, store, "persona-a", 1)
+
+	items, err := store.ListByPersona(context.Background(), "persona-a")
+	if err != nil {
+		t.Fatalf("ListByPersona: %v", err)
+	}
+	if items[0].Content != "用户爱喝冰美式" || items[0].Scope != memory.ScopeUser {
+		t.Fatalf("stored item = %+v, want the extracted user-scope memory", items[0])
+	}
+	if items[0].PersonaID != "persona-a" {
+		t.Fatalf("item persona = %q, want persona-a", items[0].PersonaID)
+	}
+
+	extractCalls := 0
+	for _, req := range ad.reqs {
+		if req.Purpose == "memory_extract" {
+			extractCalls++
+		}
+	}
+	if extractCalls != 1 {
+		t.Fatalf("memory_extract model calls = %d, want 1 (the LLM extractor drove the background call)", extractCalls)
+	}
+}
+
+// waitForMemoryCount polls the persona's stored memories until want is reached,
+// failing the test when the extraction never lands.
+func waitForMemoryCount(t *testing.T, store *memory.Store, personaID string, want int) {
+	t.Helper()
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		items, err := store.ListByPersona(context.Background(), personaID)
+		if err != nil {
+			t.Fatalf("ListByPersona: %v", err)
+		}
+		if len(items) == want {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("stored memories = %d, want %d (extraction never landed)", len(items), want)
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+}
+
+// TestExtractMemoryAsync_DoesNotBlockTurn proves the turn returns while the LLM
+// extraction is still running, and that the extraction completes (and persists)
+// after the caller's context has already been canceled — the detached context
+// keeps a request-scoped cancellation from aborting the background extraction.
+func TestExtractMemoryAsync_DoesNotBlockTurn(t *testing.T) {
+	t.Parallel()
+	store := newTestMemoryStore(t)
+	ext := newGatedExtractor()
+	ad := &mockAdapter{chat: []mgResp{{resp: model.Response{Content: "记住了"}}}}
+	a := newTestAgent(t, ad, nil)
+	l := New(Options{Agent: a, Memory: store, Extractor: ext, PersonaID: "persona-a", MaxRounds: 8})
+
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() {
+		_, err := l.Run(ctx, "sess", []model.Message{model.TextMessage(model.RoleUser, "记住 我爱喝冰美式")})
+		done <- err
+	}()
+
+	select {
+	case err := <-done:
+		if err != nil {
+			t.Fatalf("Run: %v", err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("Run blocked on memory extraction: the async path must not gate the reply")
+	}
+
+	if ext.dispatch != 1 {
+		t.Fatalf("async dispatch count = %d, want 1 (one extraction per settled turn)", ext.dispatch)
+	}
+	items, err := store.ListByPersona(context.Background(), "persona-a")
+	if err != nil {
+		t.Fatalf("ListByPersona: %v", err)
+	}
+	if len(items) != 0 {
+		t.Fatalf("store already holds %d items after Run, want 0 (extraction still in flight)", len(items))
+	}
+
+	// The turn is over, so its context is canceled; the background extraction
+	// must still finish and persist.
+	cancel()
+	select {
+	case <-ext.started:
+	case <-time.After(2 * time.Second):
+		t.Fatal("extraction goroutine never started")
+	}
+	close(ext.release)
+	waitForMemoryCount(t, store, "persona-a", 1)
+}
+
+// TestExtractMemoryAsync_RestrictedEnvNeverDispatches proves the group-chat /
+// stranger isolation still gates the async path: nothing is dispatched, so no
+// owner-private memory can be written from a read-only conversation.
+func TestExtractMemoryAsync_RestrictedEnvNeverDispatches(t *testing.T) {
+	t.Parallel()
+	store := newTestMemoryStore(t)
+	ext := newGatedExtractor()
+	l := New(Options{Memory: store, Extractor: ext, PersonaID: "persona-a"})
+
+	ctx := WithSessionEnv(context.Background(), SessionEnv{ActorEnv: restrict.ActorGroupMember, MemWritable: false})
+	l.extractMemoryAsync(ctx, []model.Message{model.TextMessage(model.RoleUser, "记住 我爱喝冰美式")}, 1)
+
+	if ext.dispatch != 0 {
+		t.Fatalf("async dispatch count = %d, want 0 (restricted context is read-only)", ext.dispatch)
+	}
+	items, err := store.ListByPersona(context.Background(), "persona-a")
+	if err != nil {
+		t.Fatalf("ListByPersona: %v", err)
+	}
+	if len(items) != 0 {
+		t.Fatalf("restricted async extract wrote %d items, want 0 (read-only isolation)", len(items))
+	}
+}
+
+// TestExtractMemoryAsync_ManualExtractorStaysSync proves the deterministic path
+// is unchanged: an extractor without the async capability is still run inline, so
+// the explicit "记住 X" memory is stored by the time the call returns.
+func TestExtractMemoryAsync_ManualExtractorStaysSync(t *testing.T) {
+	t.Parallel()
+	store := newTestMemoryStore(t)
+	l := New(Options{Memory: store, Extractor: memory.NewManualExtractor("persona-a", "owner"), PersonaID: "persona-a"})
+
+	ctx := WithSessionEnv(context.Background(), OwnerEnv())
+	l.extractMemoryAsync(ctx, []model.Message{model.TextMessage(model.RoleUser, "记住 我爱喝冰美式")}, 1)
+
+	items, err := store.ListByPersona(context.Background(), "persona-a")
+	if err != nil {
+		t.Fatalf("ListByPersona: %v", err)
+	}
+	if len(items) != 1 {
+		t.Fatalf("stored memories = %d, want 1 (deterministic extractor runs inline)", len(items))
+	}
+}

internal/runtime/loop/run.go

@@ -18,8 +18,10 @@ import (
 // timeout and fed back as RoleTool messages so the model can continue.
 // A checkpoint is persisted at every step, every step is traced as a
 // state_transition span (with an llm_call child and tool_call spans for each
-// invocation), and after each step the memory Extractor runs with errors logged
-// rather than fatal.
+// invocation), and when the turn settles the memory Extractor runs over the
+// turn's conversation (design/03 §1: the LLM extractor on a background
+// goroutine, so extraction never delays the reply) with errors logged rather
+// than fatal.
 //
 // When a turn settles with a Result, the OnTurnEnd hook is called once for that
 // turn (never per step) and its mood label is recorded on Result.Mood, so the
@@ -84,7 +86,7 @@ func (l *Loop) Run(ctx context.Context, sessionID string, messages []model.Messa
 			res.Text = outcome.text
 			res.StopReason = outcome.stopReason
 			l.saveCheckpoint(ctx, sessionID, step, msgs, outcome.stopReason)
-			l.extractMemory(ctx, msgs, step)
+			l.extractMemoryAsync(ctx, msgs, step)
 			l.settleTurn(ctx, sessionID, msgs, res)
 			return res, nil
 		}
@@ -96,7 +98,6 @@ func (l *Loop) Run(ctx context.Context, sessionID string, messages []model.Messa
 		msgs = batch.messages
 		res.ToolCallsExecuted += batch.executed
 		l.saveCheckpoint(ctx, sessionID, step, msgs, agent.StopReasonToolCalls)
-		l.extractMemory(ctx, msgs, step)
 
 		// The critical-tool-loop safety net (or a terminating hook) stops the
 		// round without waiting for a real final answer.
@@ -104,7 +105,7 @@ func (l *Loop) Run(ctx context.Context, sessionID string, messages []model.Messa
 			res.Text = criticalToolLoopTerminalReason
 			res.StopReason = StopReasonToolLoopTerminated
 			l.saveCheckpoint(ctx, sessionID, step, msgs, StopReasonToolLoopTerminated)
-			l.extractMemory(ctx, msgs, step)
+			l.extractMemoryAsync(ctx, msgs, step)
 			l.settleTurn(ctx, sessionID, msgs, res)
 			return res, nil
 		}
@@ -114,7 +115,7 @@ func (l *Loop) Run(ctx context.Context, sessionID string, messages []model.Messa
 	res.Steps = l.maxRounds
 	res.StopReason = StopReasonMaxRounds
 	l.saveCheckpoint(ctx, sessionID, l.maxRounds, msgs, StopReasonMaxRounds)
-	l.extractMemory(ctx, msgs, l.maxRounds)
+	l.extractMemoryAsync(ctx, msgs, l.maxRounds)
 	l.settleTurn(ctx, sessionID, msgs, res)
 	return res, nil
 }