Repository navigation
Fix sensitive-path routing and measure real-code retrieval - #4
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sensitive files such as
config/secrets.py,src/crypto.py, andwp-config.phppreviously took the low-risk/fast path. Routing now selects high risk and the shared security guard. The cache exposes aggregate hits, misses, expiries, writes, entries, and evictions without leaking queries or source; cache writes no longer count as fake lookups.A reproducible
retrieval-evalcommand checks labeled HearthPulse and hs-manacost.ru source files locally or through the existing native OpenRouter embedding/rerank path. The live WordPress run exposed an AST edge case that crashed on empty PHP reference fragments; the parser now skips those fragments. Both project suites found both targets in the top three locally; native reranking put all four at rank one, with zero OpenRouter calls on immediate repeats. Four cases are a smoke benchmark, not a token-savings estimate.Validation: 49 focused tests and canonical
make verifypassed with pinned quality dependencies and a provisioned offline tokenizer. New cache and retrieval-evaluation tests are included in the canonical gate. No historical matched-task outcomes were fabricated; the existing meter/pilot flow remains the source for end-to-end savings claims.