fix(vector): close native index authority boundaries - #588
Conversation
github-actions
Bot
added
type/test
ba71286 to
9f6b535
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9f6b5353ad
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
2213624 to
b856efd
Compare
Require exact captured-tree authorization before native parsing in compiler, agent, pipeline, script, and example call sites. Distinguish missing capabilities from malformed or mismatched capabilities so only absence can select a safe source rebuild. Keep local administrative minting at explicit source-bound boundaries and preserve cleanup failures without hiding the first exception.
Build vector files, cache state, and update markers through a descriptor-anchored private generation before one owned-directory switch. Reject generation-root replacement without writing through attacker-controlled paths. Disable live incremental mutation until it can satisfy the same boundary; validated requests take the complete-generation rebuild path and preserve the previous tree under BaseException faults.
Authenticate FAISS payload bytes and canonical metadata without importing native parsers or deserializing pickle. Treat trusted-local as descriptive only and require an exact out-of-band capability for any native normalization. Bind context staging minting to the verified checkout, persisted config fingerprint, and copied tree while preserving first-primary cleanup failures.
Keep the first entry or body BaseException authoritative when POSIX or Windows lock cleanup also fails. Complete descriptor and registry cleanup, retain secondary diagnostics, and propagate cleanup itself when no earlier fault exists.
Require a resolver for hybrid native views unless the caller explicitly chooses optional sparse fallback. Mint local capabilities outside the registry only under the compiler cache lock after exact manifest, source-fingerprint-v2, and captured-tree checks. Keep legacy route defaults out of the capability semantic contract and reject wrong-tree or wrong-config tokens before model construction.
Document parser-inert portable validation, descriptor-anchored whole-generation publication, source-bound Web authorization, and the temporary full-rebuild behavior for vector incremental requests.
Keep external native-index capabilities intact through cached loads. Isolate snapshot vector trees from profile and quality metadata, and resolve publication output ancestors before overlap checks. Preserve root-level manifest source coverage and cleanup failure ownership. Verified with 793 changed-surface unit tests, the full 5167-test unit tier, and pre-commit across the complete branch diff.
9f6b535 to
f0bfcef
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f0bfcefa09
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| source_binding = capture_repository_source( | ||
| repo_path, | ||
| exclude_roots=(manifest_path.parent,), |
There was a problem hiding this comment.
When manifest_path.parent == repo_path, this passes the repository root as an exclusion, so the captured fingerprint always represents zero files. A manifest produced with a root-level custom cache (cache_dir == repo_path) can therefore retain the same valid v2 fingerprint and file_count == 0 after arbitrary source changes, allowing prepare_local_wiki to accept stale sparse/BM25 indexes for the wrong checkout. Although native_authority now handles this case, this independent unconditional exclusion remains in prepare_local_wiki; exclude only the manifest file and lock when the parent is the repository root.
Useful? React with 👍 / 👎.
1 participant
Summary
Close native-vector authority and publication boundaries across compiler,
artifact, agent, MCP, Web, script, and cache consumers. The former stacked
dependencies through #587 are merged, and this branch is restacked directly
on current
main.Changes
entry points.
constructing embedding models, remote clients, pickle decoders, or FAISS
parsers, and pass that same external capability through every native load.
trusted-localvalue no longer grants native access.
one descriptor-anchored private generation with an atomic directory switch.
boundary; validated incremental requests use a safe complete-generation
rebuild.
faults.
the manifest is stored at the repository root.
repeated strict captures remain valid.
canonical paths for publication, preventing symlink redirects into source or
index state.
storage roadmaps.
Platforms without a descriptor-anchored path for native writers fail closed
before model construction instead of using a replaceable build pathname.
Type of Change
Testing
Tests pass locally
Added new tests for the changes
Full unit tier:
5167 passed, 71 skipped, 190 deselected.Changed-surface unit sweep:
793 passed, 11 deselected.Focused manifest, snapshot-layout, and publication-output regressions:
38 passed.Pre-commit passed across the complete 62-file branch diff, including Black,
isort, flake8, namespace checks, and
git diff --check.Checklist
The branch is based directly on
mainat1de7d18f7480491ca050d7a7a09f22a7a5723a58.