feat(engine): secret redaction mode, superseded detail, delta recall, and enhanced auto routing - #187
Merged
Merged
Conversation
…all, and enhanced auto routing
- Secret redaction mode: opt-in redact_secrets flag in MemoryEngine.remember and MemoryService.remember masks detected credentials safely to <redacted> instead of failing agent writes.
- Superseded detail: invalidation write resolution returns superseded_detail (id, content_preview, prior stability_days, prior access_count).
- Delta recall: SearchFilter.modified_since enables streaming incremental recall (ingested_at >= ?) to minimize agent token usage.
- Enhanced auto routing: DeterministicRetrievalPolicy recognizes structural/relationship tokens ('connected', 'superseded') and definitions ('interface', 'struct').
- Full test coverage across all 4 capabilities, all 12 CI gates verified green.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
… parser to eliminate CodeQL polynomial ReDoS - Replaces _PEM_BLOCK regex in redact_secrets with an O(N) linear-time str.find scanner _redact_pem. - Eliminates the py/polynomial-redos CodeQL static analysis vulnerability caused by backtracking over repeated PEM headers. - Adds test coverage verifying linear execution time on repeated PEM headers in tests/test_secrets_edge_cases.py.
…nner in _PATTERNS - Replaces regex-based PEM header search in _PATTERNS with linear _contains_pem_header and _PEMHeaderPattern. - Ensures safe initialization in redact_secrets and provides ReDoS execution time test.
CodeQL's polynomial-ReDoS gate (py/polynomial-redos) flags the '-----BEGIN PRIVATE KEY' detection regex: the optional ' [A-Z0-9]+' group makes worst-case matching input-dependent. Replace it with a case-normalized anchor scan using monotone-cached str.find probes for both the canonical header and the '-----BEGIN <kind> ' variant (RSA/EC/DSA/OPENSSH/ENCRYPTED/PGP/PKCS8), verified O(N) on adversarial shapes (anchor-heavy 3MB: 0.92s; long-token 2MB: 0.24s; late-header 1.5MB: 0.09s) with identical accept/reject behavior across PEM variants and no change to reject_secrets/redact_secrets contracts.
…ag, and correct gravity physics
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
This PR delivers four high-impact, backward-compatible engine enhancements across the Engraphis v2 core and service facade:
Secret & Credential Redaction Mode (
edact_secrets):
edact_secrets: bool = False\ on \MemoryEngine.remember(),
emember_with_resolution(), and \MemoryService.remember().
Superseded Detail in Write Resolution (\superseded_detail):
Incremental Delta Recall (\modified_since):
Enhanced Dynamic Intent Routing in Auto Profile:
Validation
uff, \pyright, \pytest, \check_commercial_manifest.py, CSP drift, and all 7 eval gates).