[cyberlife-coder]

Description

Three atomic fixes to velesdb-memory, each addressing a distinct code-quality issue found during a review of open PRs (PR #1278 — rmcp upgrade) and the code landed in develop.

---

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• 🔧 Refactoring (no functional changes)

---

Changes

1. fix(memory): prevent panic in truncate() when UTF-8 straddles byte 120

File: crates/velesdb-memory/src/extract.rs

The previous implementation added words until out.len() >= 120, then called out.truncate(120). If the last word pushed a multi-byte UTF-8 character (e.g. a 3-byte kanji at bytes 118–120), String::truncate() would panic — it requires a valid char boundary, and continuation bytes (0x80–0xBF) are never one.

Fix: Check before pushing a word whether adding it would push the output past 120 bytes. If it would, break without touching out. This preserves the <= 120-byte invariant at all times, making out.truncate() unnecessary and the panic impossible.

The function is an internal error-message preview (used in the extract feature). Stopping at a word boundary is the correct semantic here.

2. refactor(memory): remove redundant is_ascii() guard in validate_relation

File: crates/velesdb-memory/src/service.rs

// Before
if label.chars().any(|c| c.is_ascii() && c.is_ascii_control()) {

// After
if label.chars().any(|c| c.is_ascii_control()) {

char::is_ascii_control() returns false for all non-ASCII codepoints (U+0080+), so the c.is_ascii() guard is always redundant — it adds no filter and no protection. DRY simplification; semantics are identical.

3. chore(deps): upgrade rmcp 1.8.0 → 2.0.0 (security fixes)

Files: crates/velesdb-memory/Cargo.toml, Cargo.lock

rmcp 2.0.0 ships three security patches:

• Prevent OAuth resource spoofing (rust-sdk#937)
• Block OAuth metadata SSRF (rust-sdk#935)
• Prevent streamable HTTP session leak (rust-sdk#934)

The breaking API changes in 2.0.0 (new Audio variant in PromptMessageContent, MCP 2025-11-25 spec alignment) do not affect velesdb-memory: the server only uses the tool-call surface (tool_router / tool macros / transport-io), not the prompt-message types that changed.

This supersedes dependabot PR #1278, which was blocked by the freshness check because develop had advanced after the bot opened it.

---

How Has This Been Tested?

• Unit tests — cargo test -p velesdb-memory — all 56 tests pass (service BDD, TTL BDD, why BDD, schema tests, MCP server integration tests)
• Compile check — cargo check -p velesdb-memory — no warnings

Test Configuration:

• OS: Linux (Ubuntu 24.04)
• Rust version: stable (1.89)

---

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• My changes generate no new warnings
• New and existing unit tests pass locally with my changes

Additional Notes

The truncate panic (fix #1) could only be triggered in production when:

1. The extract feature is compiled in
2. Ollama returns output containing non-ASCII characters (CJK, emoji, etc.)
3. The content happens to have a multi-byte character straddling byte position 120

Low probability but deterministic once conditions align — classified as a correctness bug.

Date: 2026-06-30

[github-actions]

Thank you for your contribution to VelesDB!

Before this PR can be merged, please sign the Contributor License Agreement by posting the following comment:

I have read the CLA Document and I hereby sign the CLA

This grants the project a license to use your contribution under the VelesDB Core License 1.0 and future licensing terms.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}