Repository navigation
feat: controlled Bot memory projections and Cortex integration contract - #17
Merged
Merged
Conversation
The local store is plaintext SQLite holding every memory, Private included, but it was created under the process umask: memory.db, -wal and -shm were 0644 and ~/.cortex 0755. Any other local account that can traverse the home directory (macOS staff group with a 0750 home, Linux 0755 homes, custom DB paths) could read every memory. - SqliteStorage creates a new DB file as 0600 before SQLite opens it; SQLite gives -wal/-shm the main file's mode. - Existing DB/-wal/-shm/-journal files with group/other bits are tightened on open (warn, not fail, if chmod is refused). - cortex-mcp-server and cortex-http create the DB directory as 0700. Fixes self-evolution iteration 47. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ivacy) delete_memory is documented as permanent, but on the plaintext database the deleted text stayed recoverable: SQLite's default fast secure_delete left the row in freed pages, FTS5 kept the lowercased terms in index segments, and the WAL kept the original frames until a later checkpoint. Any backup/copy of memory.db recovered it. - write connection sets PRAGMA secure_delete=ON - FTS5 'secure-delete' enabled where supported (SQLite 3.42+); otherwise the FTS index is optimized after a delete so deleted terms are dropped - after every delete path (single, batch, sync-merge) the WAL is checkpointed and truncated, best effort - test greps the raw .db and -wal bytes for the deleted marker; each of the three steps is individually required for it to pass Fixes self-evolution iteration 50. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
alvinttang
marked this pull request as ready for review
October 22, 2026 18:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Bot workbench needs authoritative, externally versioned memory projections. Cortex's personal ingest path performs inference and merging and cannot serve that contract directly. This adds an owner/bot/replica-isolated
ControlledStorewith durable sequential replay, revision/tombstone fences, readiness reconciliation and scoped bounded retrieval. PG remains the authority; hosts must revalidate every candidate before exposure or use.The Python 2.5.0 binding and architecture plan / API contract describe installation, replay, rebuild, authority revalidation and fallback. Existing personal APIs remain available. Storage hardening adds atomic mode admission, private-file checks, historical erasure migration and retryable cleanup fenced against concurrent deletions. Sync regressions cover macOS coalesced directory notifications and crash/partial-write oplog recovery.
Scope: Cortex W0–W2/P0. Host PG adapter, Bot/Studio wiring, real-PG C14–C18 and rollout remain host-owned W3–W4. P1 inference/tidy stays disabled. Python 2.5.0 is not published to PyPI; no deployment or real-host business acceptance is claimed.
Evidence is bound to:
81e195a44021795c8099ef57ceb449ff45f80f8b00f0e38da36bdafc8b40cf235aaac9e53bdf8548edc9cf083ac78d59b363b8b39b4b3fec198db69egpt-6.1-solCLEAN,gpt-6-astraCLEAN. Both first formed independent conclusions, then both returned CROSS-CHECK CLEAN. All prior valid findings were fixed and reverified closed; none remain unresolved.The existing ignored live-Google-Drive write test is outside required offline CI and was not run. Tests include real child-process SIGKILL windows, external SQLite reader/writer contention, directory/symlink races, historical plaintext fixtures, maintenance-trigger failures, concurrent mode admission and real
RLIMIT_FSIZEpartial-write recovery. These do not establish power-loss durability or real-PG delivery acceptance.All required CI runs directly locally; GitHub Actions CI is disabled and no GitHub success status is fabricated. The final Linux execution plan disables dev/test debug information and incremental artifacts to fit local VM storage, explicitly preserves debug assertions and overflow checks, and leaves release/bench settings and the entire check scope unchanged. Both actual review models separately returned PLAN_ENV_CLEAN. Failed/superseded attempts remain retained and do not count as passing.
Python release artifacts (CPython3.12):
cortex_ai_memory-2.5.0-cp312-cp312-macosx_11_0_arm64.whl— SHA2568fd2acad9cb749fefe9cd265f05e995550ba7b2f979639fd5527e04b102eea02cortex_ai_memory-2.5.0-cp312-cp312-manylinux_2_34_x86_64.whl— SHA2568dd857c8103beed70bcee775825daab9cb87768a74d5ae24e1927c950dd393deTrusted operator evidence is retained in
/Users/alvinclaw/work/cortex-bot-plan-review-20261022/:final-validation-evidence.json,implementation-final-review-evidence.json, both complete local receipts/logs,local-ci-linux-v5-environment-review-evidence.json, independent acceptance and all before/after fault evidence. The reviewed generic recorder formally verified every required command, exit code, log digest and exact identity.macos receipt SHA256
2d74cd48d4be88e0acc9bc0d49c57fe6adac46efd9a1520bd43d0f9836dd57d7; reviewed plan SHA25617185f338950be3d94f1afa7cb121f3162cb599247362248ba71f83525627434linux receipt SHA256
85e3e7a8710d041d4358eea0ad6093ed3032cd608db5bfe1d89a103df16e2e5c; reviewed plan SHA2560634a79a0f22bf842dbe834ce01a402d221d3bcd0b6f042969d51cf458437d3bFinal CI status is recorded in
final-validation-evidence.json; pending-CI wording in earlier static-review records describes the review-time state and is superseded by the final formally verified passing receipts.