mirror of
https://github.com/samvallad33/vestige.git
synced 2026-07-02 22:01:01 +02:00
8f7bed0463
A full multi-agent review found 7 real issues (4 blockers). All fixed + tested.
B1 (blocker): Promoting a Memory PR did not release the quarantined memory —
the UI said "promoted" while the memory stayed suppressed/out of retrieval.
act_on_memory_pr now calls reverse_suppression(subject_id) on accept actions;
MemoryPrAction::releases_memory() encodes the rule (promote/merge/supersede
release; forget/quarantine keep it held). Proven live: PR response
subjectReleased:true, SQLite suppression_count 0.
B2 (blocker): memory promote/demote (returns `action`, not `decision`) and
codebase remember_* writes bypassed the write-trace + PR gate. extract_writes
now reads `action` too, filtered by is_write_decision (reads like get/state
excluded); is_write_tool includes `codebase`.
B3 (blocker): receipt ids collided within a run (r_<date>_<runId> +
INSERT OR REPLACE overwrote earlier receipts). IDs are now
r_<date>_<runId8>_<unique6>; build() mints the suffix, build_with_unique()
keeps tests deterministic.
B4 (blocker): proof bundle was assembled from two runs (trace.json=run_proof,
websocket-events.jsonl=run_proof2). Re-captured the whole bundle from a single
run — trace, websocket, receipt, and memory_pr all carry run_proof now.
B5: Black Box receipts panel showed global latest, not the selected run.
Added list_receipts_for_run + /api/receipts?run= ; the page uses listForRun.
B6: SENSITIVE_TOPICS substring matching false-fired (tokenizer->token,
author->auth, secretary->secret). Switched to word-boundary matching; real
phrasings (auth token, security vulnerability, api key) still gate.
B7: set_review_mode now writes atomically (temp+rename via write_atomic);
export_trace sanitizes run_id in the Content-Disposition filename; memory-prs
static routes declared before the dynamic /{id} route.
Withdrawn: the /mode-vs-/{id} route order is NOT a functional bug (axum 0.8 /
matchit prioritizes static segments) — reordered for clarity only.
Gates: 999 lib tests pass (+9 new regressions), clippy -D warnings clean,
dashboard check + build clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
29 lines
849 B
JSON
29 lines
849 B
JSON
{
|
|
"created_at": "2026-06-22T23:39:30.596744+00:00",
|
|
"decided_at": "2026-06-22T23:39:44.258862+00:00",
|
|
"decision": "promote",
|
|
"diff": {
|
|
"decision": "create",
|
|
"node": {
|
|
"content": "Store the production auth token and security credential for deploys.",
|
|
"id": "e22e83f3-2c18-4e33-93f4-558d91009505",
|
|
"nodeType": "fact",
|
|
"tags": [
|
|
"security",
|
|
"auth"
|
|
]
|
|
}
|
|
},
|
|
"id": "pr_3c5b4b2852e74f1ab7c325a7e9cb6e1f",
|
|
"kind": "new_fact",
|
|
"run_id": "run_proof",
|
|
"signals": [
|
|
{
|
|
"code": "sensitive_topic",
|
|
"detail": "Touches a sensitive topic: authentication / authorization."
|
|
}
|
|
],
|
|
"status": "promoted",
|
|
"subject_id": "e22e83f3-2c18-4e33-93f4-558d91009505",
|
|
"title": "New fact pending review: \"Store the production auth token and security credential for deploys.\""
|
|
}
|