4 Commits

Include renames

Author	SHA1	Message	Date
mathiasandClaude Sonnet 5	e2cb315b31	fix(api): validate the merged envelope on supersede, not the caller's fragment ... Review caught a real bypass in the #111 fix before merge: the previous commit validated only the frontmatter fence the caller supplied, not the merged result that actually reaches disk. A caller could blank claim_provenance alone (absent per claim.present's "empty is unset" rule) while half_life/applies survived untouched from the prior note — each side individually looked fine, the merged envelope on disk was the unprovenanced one the whole check exists to catch. That's the exact laundering #111 named as the worse of its two gaps. Fixed by computing the envelope from fm (post-merge, pre-write) instead of contentFM (the caller's raw fragment). Flip-tested: reverting to fragment-only validation turns the new adversarial test red; the merged validation turns it green. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-22 23:24:50 +02:00
mathiasandClaude Sonnet 5	c50c64f93b	fix(api): validate the claim envelope on supersede, same as on create ... hyperguild#111: writeHallNote validates half_life/applies/claim_provenance before a note is born; UpdateNote's supersede path didn't, so the fields that need provenance most (a whole-note regenerate is more likely to carry model-authored frontmatter than a fresh create) went unchecked. Fixed by extracting any frontmatter fence the caller leads Content with, validating it with the same claim.ValidateEnvelope, and merging its fields into the restamped frontmatter instead of leaving it as a second, inert `---`-fenced block in the body — that merge was a real gap independent of validation: a caller's supersede-time frontmatter was previously silently dropped, never taking effect at all. Reject leaves the note byte-identical (fail-closed, nothing written). Fence-less content (the common case today) is unchanged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-22 23:20:12 +02:00
mathiasandClaude Opus 5	eb2acfeeb8	fix(brain): move the wikilink strip into WriteNote/UpdateNote ... The BrainStore is not the only door. POST /write — the HTTP path CLAUDE.md hands to curl and scripts — calls api.WriteNote directly, so the strip shipped one commit ago covered brain_write and capture while leaving the raw door ungated. A gate one door wide is not a gate. The BrainStore keeps its own call so it can still report Ref.Unlinked to the MCP caller; running the strip twice is a no-op on content the primitive has already cleaned. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-16 23:59:44 +02:00
mathiasandClaude Opus 4.8	95a69fc2c1	feat(brain): add UpdateNote/ReadNote supersede primitives + frontmatter editor ... Implements the api-layer half of #45. UpdateNote supersedes a note in place (whole-note body replace, frontmatter re-stamp: updated_at, supersedes=prior content hash, supersede_reason), preserving created_at, wing, hall, and any custom fields. Never creates — a missing target is an error so callers fall back to brain_write. ReadNote is the read-after- write primitive (frontmatter + body + content_hash). ContentHash is the sha256 handle that round-trips write/update → get. Frontmatter is edited via a line-preserving ordered editor rather than a yaml.v3 round-trip, which would reorder keys and strip comments — the brain writes flat key:value frontmatter by hand. Embeddings are not refreshed here: the rewritten file's mtime advances, which the out-of-band vectorstore.Sync ticker uses to re-embed it — the same mechanism brain_write relies on. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-22 08:25:00 +02:00