Repository navigation
Round 8: provider isolation and document lifecycle fixes - #131
Merged
Merged
Conversation
…e and FTS tokens After purge and cleanup, the marker was still readable in the raw mesa.db file (12 hits): old row bytes in page free space (raw_logs, artifact registry/sources, page-split leftovers) and live FTS5 segment tokens (FTS5 deletes only add tombstones). The SQL-level scan could not see them. - sqlite_engine: PRAGMA secure_delete=ON on every connection - purge: enable FTS5 secure-delete on v4_assertions_fts / v4_entities_fts before erasing, and TRUNCATE-checkpoint the WAL after the purge - test: raw byte scan of the storage root (mesa.db, WAL, LanceDB, JSONL) while running and after shutdown, with and without extraction Kuzu keeps deleted strings in kuzu_db; that needs an owner decision. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ource With opt-in validation (modes 1/2) the Tier-3 receipt stores model justifications (up to 280 chars of free text) in the mutation metadata and in pipeline_run_events. Purge kept the receipt, and copied it into the raw log, so quoted source text survived. Purge now blanks the justifications in both places for this document's mutations and runs; decisions, models and the other receipt fields stay. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… checks SQLite before 3.46.1 reports false index corruption after FTS5 secure-delete. Rebuild legacy indexes during purge and cleanup, retaining physical erasure and strict integrity checks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Round 8 fixes provider key isolation, rebuild admission after purge/rollback, duplicate revision conflicts, writes to purged documents, historical supersession filtering, and session context filtering. Document purge also erases source/extracted text from SQLite and vectors, including SQLite free space, FTS tokens, WAL content and validator justifications. Shared artifacts remain while another active document owns them.
The initial PR CI exposed SQLite's pre-3.46.1 FTS5 secure-delete integrity-check bug in both Python coverage jobs. The fix retains secure-delete on supported SQLite versions and rebuilds FTS indexes after purge/cleanup on older versions. Purge tests now explicitly check SQLite integrity. The two failing tests were reproduced on SQLite 3.46.0, and all 15 focused privacy/rebuild tests pass with the fix. Older SQLite versions incur full FTS index work during erasure.
Validation at f3be019: full R8-github-merge gate PASS (lane, lock, sync, ruff, mypy, layer imports; 1643 local tests and 7 MCP tests passed). All 23 applicable GitHub CI checks passed; the scheduled/manual legacy baseline was skipped. Focused privacy/rebuild tests: 15 passed on SQLite 3.46.0 and 15 passed on SQLite 3.50.4. SQLite upstream fix: https://www.sqlite.org/releaselog/3_46_1.html (item 5).
Known deferred issue: deleted assertion text remains recoverable in Kuzu's physical database file after logical deletion. The owner explicitly elected to handle this separately and authorized merging this round with that limitation. Physical graph erasure is not claimed by this PR.