Add top-level session_id field to messages

[nanxingw]

Summary

Introduce an optional session_id column on the messages table so callers can group messages into logical conversation sessions independent of agent_id. Validated at three layers (Pydantic, REST request models, Postgres CHECK), propagated end-to-end through the agent's synthesized messages, and exposed through MessageManager.list_messages_for_*(session_id=...) for filtering.

Behavior

• Optional — existing callers untouched. Unset → NULL. Old rows stay NULL after migration.
• Strict format — when set, must match [A-Za-z0-9_-]{1,64}. Rejected at Pydantic construction, REST request validation, and Postgres CHECK constraint.
• Filterable — MessageManager.list_messages_for_agent(session_id="...") and list_messages_for_user(session_id="...") return only that session's messages.
• Auto-mirror to memory tags — add_memory mirrors the batch-level session_id into filter_tags["session_id"] so memories created from that batch inherit the tag, making them retrievable via the existing /memory/retrieve/conversation endpoint without API surface changes.
• Agent-internal propagation — every synthesized message in a step (LLM-generated assistant replies, tool returns, heartbeat, warning, meta-memory bootstrap, summary) inherits the triggering input's session_id via a _current_step_session_id stash on self, save/restored with try/finally so it cannot leak across calls.

Test plan

• 38 unit tests in tests/test_session_id.py (DB-free): schema, validator, helper, REST request schemas, queue proto serialization, ORM column shape and indexing, agent-source lint for propagation sites, dialect-gated CHECK, constants-in-sync.
• 1 Postgres integration test in tests/test_session_id_integration.py — auto-skips without MIRIX_PG_URI (mirrors tests/test_agent_trigger_state_integration.py pattern).
• Manual E2E with real OpenRouter LLM: Phase A direct MessageManager round-trip + Phase B validator rejection + Phase C real server.send_messages → _step with LLM-generated tool call. All three synthesized messages (user + assistant + tool result) inherited session_id correctly; negative control verified no cross-session leak.
• Codex review — first pass surfaced one shippable medium finding (step() stash leak); fixed with try/finally + regression test test_step_seeds_and_restores_stash. Second finding was a pre-existing unrelated bug — see [bug] Agent.step_user_message → inner_step missing required first_input_messge arg #127.

Reviewer hints

• Use git diff -w on mirix/agent/agent.py — the bulk of that file's diff is body re-indent to wrap step() in try/finally. The actual session_id additions are ~70 lines; the rest is the indent shift.
• The CHECK constraint in mirix/orm/message.py uses ddl_if(dialect="postgresql") because SQLite has no ~ regex operator. SQLite path verified to suppress the constraint (test_check_is_suppressed_for_sqlite).
• Shared length / charset constants in mirix/schemas/message.py are the single source of truth — the migration SQL and ORM CHECK both reference them, with test_migration_sql_uses_shared_pattern_and_length keeping them in sync.

Out of scope

• Pre-existing Agent.step_user_message → inner_step missing first_input_messge arg bug — see [bug] Agent.step_user_message → inner_step missing required first_input_messge arg #127. Surfaced during E2E validation but not introduced by this PR; production REST path is unaffected because it goes through server.send_messages → _step.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}