Continue in chat from a search-page answer

Spec 013, Story 2. The search page's AI answer can now be continued in a
chat tab, the way analysis summaries can since #294.

**Each answer gets its own ID, emitted in `done`.** It cannot be keyed by
question: two readers of one search get different answers (~0.33
similarity run to run), and a question-keyed cache would let one continue
the other's. `/api/answer` keeps each answered stream under a fresh
`answer_id`, present in `done` only when `state` is `answered`, for an hour.
What is kept is exactly what the page was sent -- the text after anchor and
sources stripping, and the citations -- not the raw model output.

`POST /api/handoff` now takes a discriminated request:
`{"kind": "analysis", "token", "disclosure"}` or
`{"kind": "search", "answer_id"}`. A search request carrying analysis fields
is rejected rather than read as one.

**No human-presence claim for a search handoff.** `/api/answer`, which
produced the answer, deliberately does not require it -- public pathway
text -- so the search page may have none to send. The analysis handoff
still requires it, because it releases a reader's own analysis. Pinned in
both directions: requiring presence for search fails one test, dropping it
for analysis fails two.

The handoff record is two types, `AnalysisHandoff` and `SearchHandoff`,
rather than one with optional fields, so a search handoff cannot carry a
disclosure tier that means nothing for it. mypy then found every place that
had assumed a handoff was an analysis.

The chat opens on the reader's own question as the human turn and the
answer, with its cited sources, as the model's.

Verified end to end through the real Turnstile gate as a first-time
visitor, over HTTPS: a real answer from the real endpoint carried an
answer_id; a handoff was minted with no human claim; the tab opened on the
question and the same answer; "which protein kinase were we just
discussing?" was answered "CDK5". The control -- the same question with no
handoff -- could not say.

Sabotage: storing anything other than the streamed text fails
`test_what_is_kept_is_exactly_what_the_page_was_sent`. Two of the presence
sabotages first came back void -- ruff had reformatted the conditional, so
the anchor matched nothing -- and one printed "applied" over an unchanged
file; both were redone with the change asserted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: adamjohnwright

bin/chat-chainlit.py

@@ -24,7 +24,7 @@
     run_analysis,
 )
 from handoff import seed
-from handoff.store import handoffs
+from handoff.store import AnalysisHandoff, handoffs
 from handoff.window import acknowledgement, claimed_id
 from util.chainlit_helpers import (
     PrefixedS3StorageClient,
@@ -229,8 +229,10 @@ async def continue_from_handoff(handoff_id: str) -> None:
     # `on_chat_start` sets `thread_id` from the session id. A claim arriving
     # before it has run would otherwise seed a thread called "None".
     thread_id: str = cl.user_session.get("thread_id") or cl.user_session.get("id")
+    data = None
     try:
-        data = await seed.analysis_data(handoff)
+        if isinstance(handoff, AnalysisHandoff):
+            data = await seed.analysis_data(handoff)
         seeded = await get_graph().seed_history(
             profile, thread_id=thread_id, messages=seed.seeded_turn(handoff, data)
         )
@@ -246,7 +248,11 @@ async def continue_from_handoff(handoff_id: str) -> None:
 
     logger.info(
         "handoff claimed",
-        extra={"tier": handoff.tier, "with_data": data is not None},
+        extra={
+            "kind": handoff.kind,
+            "tier": getattr(handoff, "tier", None),
+            "with_data": data is not None,
+        },
     )
     await cl.Message(content=seed.shown_to_reader(handoff)).send()
 

specs/010-search-page-answers/contracts/answer_endpoint.md

@@ -59,11 +59,21 @@ event: citation
 data: {"st_id": "R-HSA-8862803", "display_name": "Deregulated CDK5 triggers..."}
 
 event: done
-data: {"state": "answered", "seconds": 8.4}
+data: {"state": "answered", "seconds": 8.4, "answer_id": "Ev3z3JDmIIUF4gkKTfrn9VF83H"}
 ```
 
 `state` is one of `answered`, `nothing_found`, `refused`, `failed`.
 
+**`answer_id` is present only when `state` is `answered`** (added 2026-09-25,
+spec 013). It names the answer exactly as this stream sent it -- the text after
+anchors and the sources list were stripped, and the citations -- kept for an
+hour so "Continue in chat" can open the chat on *that* answer rather than a
+regenerated one (the same question scores ~0.33 similarity run to run). Pass it
+to `POST /api/handoff` as `{"kind": "search", "answer_id": ...}`. It is keyed per
+answer, not per question, so two readers of the same search never share one.
+Every other `done` has exactly `state` and `seconds`; a caller that ignores
+unknown keys parses them all the same way.
+
 > **This endpoint does not require a human-presence claim and
 > `/api/analysis-summary` does.** A caller token without one gets a full
 > answer here and `no_human` there. Deliberate: this returns public pathway

specs/013-continue-chat-hand/spec.md

@@ -4,7 +4,7 @@
 
 **Created**: 2026-09-25
 
-**Status**: Story 1 built and verified end to end; Stories 2 and 3 not started
+**Status**: Stories 1 and 2 built and verified end to end; Story 3 needs a shared store
 
 **Input**: Adam, 2026-09-25: "with the chat on both the search page and the analysis results we want there to be a button to go to the [chat] interface … two options … either the logged in version or the guest version of the chat app and have the context already be set with either the search results or the analysis summary with the summary data." And: "the chat should open in a new tab."
 
@@ -165,3 +165,22 @@ on "couldn't load the summary". Two ways to do Story 3, to decide later:
 - the website calls the logged-in deployment's own summary and handoff
   endpoints -- simpler, but the summary would be generated a second time in
   that process, and would not be the one the reader saw (FR-002).
+
+## Story 2, 2026-09-25
+
+**Search-page answers can be continued.** `/api/answer` now keeps each answered
+stream under an `answer_id`, emitted in `done` only when `state` is
+`answered`, and `POST /api/handoff` accepts `{"kind": "search", "answer_id"}`.
+Keyed per answer, never per question: two readers of one search get different
+answers, and neither may continue the other's. What is kept is what the page
+was sent -- after anchor and sources stripping -- not the raw model output.
+
+**No human-presence claim for a search handoff**, unlike an analysis one.
+`/api/answer` does not require it either (public pathway text), so the search
+page may have none to send. Pinned in both directions: requiring it for search
+fails one test, dropping it for analysis fails two.
+
+Verified end to end through the real Turnstile gate as a first-time visitor:
+a real answer, a handoff minted with no human claim, the tab opens on the
+question and the same answer, and "which protein kinase were we just
+discussing?" is answered "CDK5". The control, with no handoff, cannot say.

src/api/answer.py

@@ -29,6 +29,7 @@
 from pydantic import BaseModel, Field
 
 from agent.registry import get_graph
+from api.answer_store import StoredAnswer, answers
 from util.anchor_strip import AnchorStripper
 from util.caller_token import TokenRejectedError, verify
 from util.logging import logging
@@ -129,6 +130,11 @@ async def stream() -> AsyncIterator[str]:
         # worse one, since `AnchorStripper` has just taken its links off.
         sources = SourcesSectionStripper()
         tokens_sent = 0
+        # What the reader is shown, kept so "Continue in chat" can open the
+        # chat on this answer rather than a regenerated one (spec 013). The
+        # text after stripping, because that is what the page renders.
+        shown: list[str] = []
+        cited: list[tuple[str, str]] = []
         try:
             async with asyncio.timeout(ANSWER_TIMEOUT_SECONDS):
                 async for event in graph.astream_answer(
@@ -147,6 +153,7 @@ async def stream() -> AsyncIterator[str]:
                         text = sources.feed(stripper.feed(event.text))
                         if text:
                             tokens_sent += 1
+                            shown.append(text)
                             yield _sse("token", {"text": text})
                     elif event.kind == "citation":
                         # Exactly one identifier, never both and never an empty
@@ -159,6 +166,9 @@ async def stream() -> AsyncIterator[str]:
                             if event.st_id
                             else {"url": event.url}
                         )
+                        cited.append(
+                            (event.st_id or event.url or "", event.display_name or "")
+                        )
                         yield _sse(
                             "citation",
                             {**identifier, "display_name": event.display_name},
@@ -209,9 +219,26 @@ async def stream() -> AsyncIterator[str]:
             state = "failed"
         held = sources.feed(stripper.flush()) + sources.flush()
         if held:
+            shown.append(held)
             yield _sse("token", {"text": held})
-        yield _sse(
-            "done", {"state": state, "seconds": round(time.monotonic() - started, 1)}
-        )
+        done: dict[str, Any] = {
+            "state": state,
+            "seconds": round(time.monotonic() - started, 1),
+        }
+        if state == "answered":
+            # Only an answer can be continued. The ID, not the question, is
+            # the key: two readers asking the same thing get different text.
+            answer_id = answers.put(
+                StoredAnswer(
+                    question=body.question,
+                    text="".join(shown),
+                    citations=tuple(cited),
+                    release=release,
+                    created_at=time.time(),
+                )
+            )
+            if answer_id:
+                done["answer_id"] = answer_id
+        yield _sse("done", done)
 
     return StreamingResponse(stream(), media_type="text/event-stream")

src/api/answer_store.py

@@ -0,0 +1,72 @@
+"""Answers the search page was shown, kept briefly so they can be continued.
+
+Spec 013, Story 2. "Continue in chat" beside a search-page answer must open
+the chat on *that* answer. It cannot be regenerated: the same question
+through the same endpoint scores ~0.33 similarity run to run, so the reader
+would be greeted with different text from the one they clicked from.
+
+**Keyed by a per-answer ID, not by the question.** Two readers asking the
+same question get different answers; a cache keyed by question would let
+one reader continue another's. The endpoint issues an ID in its `done`
+event, and that is what the website hands back.
+
+**What is kept is exactly what the reader saw** -- the text after anchors and
+the trailing sources list were stripped, and the citations as sent -- not
+the raw model output.
+
+Bounded and process-local, like the analysis summary cache. An answer is
+public pathway text, so keeping it briefly carries no disclosure; the window
+only has to outlast a reader deciding to click.
+"""
+
+import secrets
+import time
+from collections import OrderedDict
+from dataclasses import dataclass, field
+
+DEFAULT_TTL_SECONDS = 60 * 60
+DEFAULT_MAX_ENTRIES = 2048
+
+
+@dataclass(frozen=True)
+class StoredAnswer:
+    question: str
+    text: str
+    #: `(identifier, display_name)`, where identifier is an st_id or a URL.
+    citations: tuple[tuple[str, str], ...]
+    release: int | None
+    created_at: float
+
+
+@dataclass
+class AnswerStore:
+    ttl_seconds: float = DEFAULT_TTL_SECONDS
+    max_entries: int = DEFAULT_MAX_ENTRIES
+    _entries: OrderedDict[str, StoredAnswer] = field(default_factory=OrderedDict)
+
+    def put(self, answer: StoredAnswer) -> str | None:
+        """Keep an answer; returns its ID, or None if there was nothing to keep.
+
+        An empty answer is never stored: continuing it would open a chat on
+        nothing, and say it was the reader's answer.
+        """
+        if not answer.text.strip():
+            return None
+        answer_id = secrets.token_urlsafe(18)
+        self._entries[answer_id] = answer
+        while len(self._entries) > self.max_entries:
+            self._entries.popitem(last=False)
+        return answer_id
+
+    def get(self, answer_id: str, *, now: float | None = None) -> StoredAnswer | None:
+        found = self._entries.get(answer_id)
+        if found is None:
+            return None
+        if (time.time() if now is None else now) - found.created_at > self.ttl_seconds:
+            del self._entries[answer_id]
+            return None
+        return found
+
+
+#: Written by `/api/answer`, read by `/api/handoff`.
+answers = AnswerStore()

src/api/handoff.py

@@ -25,7 +25,7 @@
 
 import os
 import time
-from typing import Any
+from typing import Annotated, Any, Literal
 
 from fastapi import APIRouter, Request
 from fastapi.responses import JSONResponse
@@ -34,7 +34,14 @@
 from analysis.client import current_release
 from analysis.disclosure import Tier
 from api.analysis_summary import stored_summary
-from handoff.store import DEFAULT_TTL_SECONDS, Handoff, handoffs
+from api.answer_store import StoredAnswer, answers
+from handoff.store import (
+    DEFAULT_TTL_SECONDS,
+    AnalysisHandoff,
+    Handoff,
+    SearchHandoff,
+    handoffs,
+)
 from util.caller_token import (
     TokenRejectedError,
     human_presence_detail,
@@ -51,19 +58,36 @@
 _limiter = limiter_from_env()
 
 
-class HandoffRequest(BaseModel):
-    kind: str = Field(pattern="^analysis$")
+class AnalysisHandoffRequest(BaseModel):
+    kind: Literal["analysis"]
     token: str = Field(min_length=1, max_length=256)
     #: The tier of the summary the reader was shown. Required, no default.
     disclosure: Tier
     caller_token: str = ""
 
 
+class SearchHandoffRequest(BaseModel):
+    kind: Literal["search"]
+    #: From the `done` event of the `/api/answer` stream the page rendered.
+    answer_id: str = Field(min_length=1, max_length=128)
+    caller_token: str = ""
+
+
+HandoffRequest = Annotated[
+    AnalysisHandoffRequest | SearchHandoffRequest, Field(discriminator="kind")
+]
+
+
 def _refuse(status: int, reason: str, log: str) -> JSONResponse:
     logger.info("handoff refused", extra={"reason": reason, "detail": log})
     return JSONResponse(status_code=status, content={"reason": reason})
 
 
+def stored_answer(answer_id: str) -> StoredAnswer | None:
+    """An answer `/api/answer` showed a reader, if it is still kept."""
+    return answers.get(answer_id)
+
+
 def own_chat_path() -> str:
     """Where this process's chat is mounted, e.g. `/chat/guest`."""
     return (os.getenv("CHAINLIT_URI") or "/chat").rstrip("/")
@@ -79,7 +103,13 @@ async def create_handoff(body: HandoffRequest, request: Request) -> JSONResponse
     except TokenRejectedError as rejected:
         return _refuse(403, "no_caller", rejected.reason)
 
-    presence = human_presence_reason(claims, time.time())
+    # Human presence for an analysis only. It releases a reader's own
+    # analysis summary; a search answer is public pathway text, and
+    # `/api/answer` -- which produced it -- deliberately does not require
+    # presence either, so the search page may not have the claim to send.
+    presence = (
+        human_presence_reason(claims, time.time()) if body.kind == "analysis" else None
+    )
     if presence:
         detail = (
             human_presence_detail(claims, time.time())
@@ -93,25 +123,37 @@ async def create_handoff(body: HandoffRequest, request: Request) -> JSONResponse
     if not _limiter.allow(key or identity_of(claims, body.caller_token)):
         return _refuse(429, "rate_limited", "rate limited")
 
-    release = await current_release()
-    if not release:
-        # Summaries are cached per release, so without knowing the release
-        # there is no way to find the one the reader saw. Refusing is the
-        # honest answer; guessing a release could hand off a summary of a
-        # result the Analysis Service has since deleted.
-        return _refuse(503, "no_release", "current release unknown")
-    stored = stored_summary(body.token, release, body.disclosure)
-    if stored is None:
-        # Not generated, evicted, from a previous release, or requested at a
-        # tier the reader never chose. In every case there is nothing the
-        # reader has seen to continue, and generating one here would break
-        # both FR-002 and FR-003.
-        return _refuse(
-            404, "no_summary", f"no stored summary at tier {body.disclosure}"
+    handoff: Handoff
+    if isinstance(body, SearchHandoffRequest):
+        answer = stored_answer(body.answer_id)
+        if answer is None:
+            # Unknown, expired, or never answered: nothing the reader saw.
+            return _refuse(404, "no_answer", "no stored answer for that id")
+        handoff = SearchHandoff(
+            kind="search",
+            question=answer.question,
+            summary=answer.text,
+            citations=answer.citations,
+            created_at=time.time(),
         )
-
-    handoff_id = handoffs.put(
-        Handoff(
+    else:
+        release = await current_release()
+        if not release:
+            # Summaries are cached per release, so without knowing the release
+            # there is no way to find the one the reader saw. Refusing is the
+            # honest answer; guessing a release could hand off a summary of a
+            # result the Analysis Service has since deleted.
+            return _refuse(503, "no_release", "current release unknown")
+        stored = stored_summary(body.token, release, body.disclosure)
+        if stored is None:
+            # Not generated, evicted, from a previous release, or requested at
+            # a tier the reader never chose. In every case there is nothing the
+            # reader has seen to continue, and generating one here would break
+            # both FR-002 and FR-003.
+            return _refuse(
+                404, "no_summary", f"no stored summary at tier {body.disclosure}"
+            )
+        handoff = AnalysisHandoff(
             kind="analysis",
             token=body.token,
             release=release,
@@ -120,7 +162,8 @@ async def create_handoff(body: HandoffRequest, request: Request) -> JSONResponse
             citations=stored.citations,
             created_at=time.time(),
         )
-    )
+
+    handoff_id = handoffs.put(handoff)
     payload: dict[str, Any] = {
         "id": handoff_id,
         "expires_in": int(DEFAULT_TTL_SECONDS),