Fix all 19 audit issues from AUDIT.md - #9
Merged
Merged
Conversation
1. Sanitize SQL filter in expire_item (db.rs) 2. Fix UTF-8 safety in truncate (tools.rs), archive_preview (consolidation.rs), content preview (main.rs) 3. Update CLAUDE.md schema to match actual graph_edges table definition 4. Fix tool count to 5 and add connections tool in generated instructions 5. Remove duplicate boost_similarity from db.rs, use crate::boost_similarity 6. Cap trust-weighted similarity at 1.0 7. Replace all `let _ =` with logged `if let Err(e)` in tools.rs and consolidation.rs 8. Replace timestamp_opt().unwrap() with safe .single().unwrap_or_else fallback 9. Add WAL pragma to access.rs and consolidation.rs opens 10. Add tracing instrumentation spans to tokio::spawn tasks 11. Add rate limiter (60 calls/min) to MCP server 12. Fix TOCTOU race: move conflict detection after store 13. Pin model revision hash in embedder.rs 14. Support Unicode sentence terminators in chunker.rs 15. Remove unused jsonrpc-core dependency 16. Fix "4 tools" to "5 tools" in lib.rs doc comment 17. Add cleanup_expired() and invoke periodically during recall 18. Restrict config file permissions to 0o600 on Unix 19. Add depth counter (max 100) to find_project_root https://claude.ai/code/session_0128QmSWkx3tfw5Zh1JL4opS
…_root - Remove the 0o600 permission restriction on .sediment/config (issue 18 revert) - Add early return when parent == current (root reached) in find_project_root https://claude.ai/code/session_0128QmSWkx3tfw5Zh1JL4opS
…tall.sh - Add SHA256 TOFU (trust-on-first-use) hash checking for HuggingFace model downloads: stores hash on first load, verifies on subsequent loads - Narrow tokio features from "full" to rt, rt-multi-thread, sync, time, macros - Add SHA256 checksum verification in install.sh when checksums.txt is available - Add sha2 dependency for hash computation https://claude.ai/code/session_0128QmSWkx3tfw5Zh1JL4opS
After all platform builds complete, collects per-artifact .sha256 files into a single checksums.txt and uploads it to the release. This enables the SHA256 verification in install.sh. https://claude.ai/code/session_0128QmSWkx3tfw5Zh1JL4opS
rendro
pushed a commit
that referenced
this pull request
Jan 31, 2026
…orrectness Critical fixes: - #1: Replace lock-free CAS rate limiter with Mutex to eliminate race condition - #2: Add retry loop to expire_item re-insert to prevent data loss after delete - #3: Escape backslashes in SQL sanitization alongside single quotes High severity fixes: - #4: Clean stale pending consolidation entries after 30 days (was unbounded) - #5: Record validation on NEW item instead of deleted old item on replace - #6: Transfer graph edges before removing old node on replace (was losing all relationships) Medium severity fixes: - #7: Filter input IDs from get_neighbors results to prevent self-references - #8: Normalize co-access edge direction (smaller ID first) to prevent duplicates - #9: Recompute similarity from embeddings during consolidation instead of using stale scores - #10: Cap search limit inside search_items to prevent overflow before min(100) - #11: Stricter YAML detection requiring identifier-like keys (prevents false positives on prose) - #12: Log PRAGMA failures instead of silently ignoring them Low severity fixes: - #13: Remove unused sha2 dependency - #14: Delete chunks belonging to expired items during cleanup - #15: Use i32::try_from for chunk_index instead of silent truncation - #16: Wrap background tasks with spawn_logged to catch and log panics - #17: Change ListScope default from All to Project to match tool schema - #18: Use atomic temp-file-then-rename for project config to prevent TOCTOU race Added 15 new tests covering all major fixes. All 50 tests pass, clippy clean, fmt clean. https://claude.ai/code/session_01SHu7vSzBbG33DzYec2DFqe
rendro
pushed a commit
that referenced
this pull request
Jan 31, 2026
Chunker (issues #4, #5): - Use chars().count() instead of .len() for chunk threshold check - Ensure all byte offsets in split_by_chars land on UTF-8 char boundaries - Added tests: multibyte threshold, CJK splitting, mixed content Retry (issue #10): - Use checked_shl/saturating_mul to prevent overflow panic on large attempts - Added test: delay_for_attempt with attempt=64 and attempt=99 Recall (issue #6): - Added 100KB query size limit to prevent OOM during tokenization Unwrap elimination (issues #13, #14): - Replace all serde_json::to_string_pretty().unwrap() with unwrap_or_else - Replace Arrow StringArray downcast unwrap with graceful fallback Atomic ordering (issue #12): - Change recall_count from Relaxed to AcqRel ordering Path leakage (issue #9): - Provenance now stores only directory name, not full filesystem path Dangling edges (issue #11): - Validate related IDs exist in LanceDB before creating graph edges - Ensure target nodes exist in graph before creating edges Score transparency (issue #8): - Track raw_similarity alongside boosted similarity in recall results - Include raw_similarity in JSON output when it differs from boosted score Data loss prevention (issue #2): - expire_item: emergency recovery re-inserts original item if update fails Graceful shutdown (issue #7): - Wait up to 10s for consolidation semaphore before shutdown - Increased runtime shutdown timeout from 2s to 5s Cross-database atomicity (issues #1, #3): - Replace workflow now aborts with compensation on transfer_edges failure - Deletes new item and graph node if edge transfer fails - Preserves original item instead of leaving inconsistent state https://claude.ai/code/session_01WLA4gnq7gQrAgquAVB4p8r
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
let _ =with loggedif let Err(e)in tools.rs and consolidation.rshttps://claude.ai/code/session_0128QmSWkx3tfw5Zh1JL4opS