Repository navigation
worker: hide other sessions' unjudged candidates when S1 is wired - #71
Conversation
The write gate fails open, so during a model outage a claim is stored without a verdict and other sessions could read it until the hourly judgeLate pass. With an S1 model wired, recall, the briefing's recent sections and nearSubjects now show another session's candidate only once it has metadata.s1.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 47dbf09bb0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
vu1n
left a comment
vu1n
left a comment
There was a problem hiding this comment.
VPS review of 47dbf09: 1 finding(s), 0 blocking.
The change hides unjudged candidates from other sessions when S1 is configured, but sessionless callers retain the existing exposure. The finding identifies a pre-existing gap, so it does not block merging this change.
NULL IS NULL let one sessionless caller read another's unjudged candidates. The exemption now needs a non-null session.
vu1n
left a comment
vu1n
left a comment
There was a problem hiding this comment.
VPS review of 7760cda: 2 finding(s), 0 blocking.
The change hides unjudged candidates from recall, briefing recent sections, and nearby-subject suggestions when S1 is configured. Both reported gaps already exist at the merge base, so neither blocks this change from merging.
Requested by Vu · project thread
The S1 write gate fails open, so a claim written during a model outage has no
metadata.s1, and other sessions could read it (recall's candidate lane, the briefing's recent sections) until the hourlyjudgeLatepass. If it was control text aimed at agents, that window is the poisoning hole.With an S1 model wired,
D1Store({ screened: true })now shows another session's candidate only once it has a verdict (judgedOnly). This coversrecall,recentCandidates,recentUserCandidatesandnearSubjects. Accepted claims, the writer's own session and installs without S1 are unchanged. Existing unjudged candidates stay hidden from other sessions until defrag judges them.Merging deploys to kypp.vu1n.dev: waiting for Vu's ok.
Verification: new defrag test (another session can't see it while unjudged, through recall or the briefing; a no-S1 install still sees it; after
judgeLateit shows). It fails onmainat both assertions.npm test330 pass,npm run typecheckclean,featuremap.py check0 broken.Generated by Claude Code