Repository navigation
purge: erase a claim's text from every index, by handle - #72
Conversation
Memory is append-only, so a leaked key or a badly wrong lesson stayed in the claim row, FTS, pointers and recall queries forever. kypp purge (local MemoryStore.purge, hosted operator op) blanks the claim's text, anchors, embedding and verify, drops its index rows and usage queries, and keeps a rejected [purged] tombstone. Only the reason is logged.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 98992d411a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
vu1n
left a comment
vu1n
left a comment
There was a problem hiding this comment.
VPS review of 98992d4: 3 finding(s), 4 blocking.
The change adds claim purging with rejected tombstones in local and hosted stores. It is not safe to merge yet: purge leaves sensitive text in copied usage queries and earlier audit reasons, and an in-flight local verifier can revive a tombstone.
… reasons A recall query is stored on each claim it returned, so purging one claim left the key in its siblings' usage rows. Purge now clears every copy, blanks the claim's earlier defrag_log reasons, and local mark_verified skips claims without a verify command so an in-flight run can't revive a tombstone.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 502d2c1c15
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
vu1n
left a comment
vu1n
left a comment
There was a problem hiding this comment.
VPS review of 502d2c1: 1 finding(s), 1 blocking.
The change adds claim purging locally and in the hosted Worker. It is not safe to merge yet: an in-flight recall can restore sensitive query text after purge completes.
…-2el781-purge # Conflicts: # tests/test_store_contract.py
vu1n
left a comment
vu1n
left a comment
There was a problem hiding this comment.
VPS review of 103d1ef: 1 finding(s), 1 blocking.
The change adds claim purging across local and hosted stores. It is not safe to merge yet: an in-flight recall can write an erased query back into usage records after purge completes.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 103d1efec4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Requested by Vu · project thread
Memory is append-only, so a leaked key or a badly wrong lesson had no way out:
rejecthides a claim, but its text stays in the row, FTS, pointers and the recall queries that found it.kypp purge HANDLE... --reason …(localMemoryStore.purge; overKYPP_URL, operator oppurge) blanks subject/content to[purged]and clears code_refs, source_ids, metadata, verify and embedding. It deletes the claim's FTS andcode_pointersrows, nullsclaim_usages.query, and setsrejected. The row stays as a tombstone so the handle still resolves. Only the reason is logged (defrag_logoperator:purge). The hosted op reaches any claim by handle (anyClaim: every scope and lane), because a key can leak into a room or user scope. It is operator-only, never an MCP tool.This changes the rule "memory is append-only": purge is now the one erase (store.md gotcha updated). Not covered: local observations a claim was distilled from, and the unactivated
claim_command_*tables.Merging deploys to kypp.vu1n.dev: waiting for Vu's ok.
Verification: a contract test on all three local adapters (no trace of the key in any table, search and pointer lookups empty, a reason is required). A Worker operator test (another user's claim, FTS/pointer rows present before and gone after, usage queries nulled, verify cleared, logged). CLI tests for remote purge.
unittest discoverOK, workernpm test330 pass, typecheck clean,featuremap.py check0 broken.Generated by Claude Code