Merge origin/main into fix/tunnel-traversal (conflict-only)

Conflict in ingestion/internal/brainfs/brainfs_test.go only: both sides
appended a test after TestReadRegularNeverReturnsAnInBrainFileSwappedInBehindASymlink
(this branch: TestWriteRegularRefusesFinalSymlinksFIFOsEscapesAndMissingFilesAndRewritesRegularFiles;
main: TestReadDirDirsListsOnlyRealSubdirsAndRefusesSymlinkedComponents).
Kept both, unchanged. No production code touched by the resolution.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/cmd/server/jwt_validator.go

@@ -2,25 +2,24 @@ package main
 
 import (
 	"context"
-	"fmt"
 	"log/slog"
 
 	chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
+
+	"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
 )
 
-// buildJWTValidator builds the JWT validator for issuer (nil when issuer is
+// buildJWTValidator runs OIDC discovery under policy, so a 502 from an auth
-// empty: JWT auth disabled). Since mcp-chassis v0.7 construction no longer
+// upstream that is not serving yet on a cold boot is retried instead of
-// fails when OIDC discovery does (mcp-chassis#4): the issuer resolves lazily,
+// exiting (#83). It honours ctx between attempts.
-// and until it does a JWT is answered 503-and-retry, not 401. That replaces
+func buildJWTValidator(
-// #83's boot-time retry loop (hyperguild#155). An issuer still unresolved at
+	ctx context.Context, logger *slog.Logger, issuer, audience string, policy startupretry.Policy,
-// boot is logged, so a misconfigured issuer is visible rather than silent.
+) (*chassisauth.JWTValidator, error) {
-func buildJWTValidator(ctx context.Context, logger *slog.Logger, issuer, audience string) (*chassisauth.JWTValidator, error) {
+	return startupretry.Do(ctx, policy, func(ctx context.Context) (*chassisauth.JWTValidator, error) {
 		v, err := chassisauth.NewJWTValidator(ctx, issuer, audience)
 		if err != nil {
-		return nil, fmt.Errorf("build jwt validator: %w", err)
+			logger.Warn("oidc discovery not ready, retrying", "err", err)
 		}
-	if ok, rerr := v.Ready(ctx); !ok {
+		return v, err
-		logger.Warn("jwt issuer not resolved at boot; JWTs answer 503 until it is", "issuer", issuer, "err", rerr)
+	})
-	}
-	return v, nil
 }

ingestion/cmd/server/jwt_validator_test.go

@@ -1,7 +1,6 @@
 package main
 
 import (
-	"bytes"
 	"context"
 	"io"
 	"log/slog"
@@ -9,11 +8,12 @@ import (
 	"net/http/httptest"
 	"sync/atomic"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mathiasbq/hyperguild/ingestion/internal/metrics"
+	"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
 )
 
 // fakeIssuer answers OIDC discovery with 502 for the first fail requests, as
@@ -41,71 +41,46 @@ func fakeIssuer(t *testing.T, fail int32) (*httptest.Server, *atomic.Int32) {
 	return srv, &discoveries
 }
 
-// #83 retried discovery at boot because chassis v0.2.0 failed construction on
+var fastPolicy = startupretry.Policy{Attempts: 8, Base: time.Millisecond, Max: 5 * time.Millisecond}
-// a 502. Since chassis v0.7 (mcp-chassis#4) the validator is built anyway and
+
-// resolves the issuer lazily, so boot no longer waits or exits on it
+func TestBuildJWTValidatorRetriesDiscovery502sThenSucceeds(t *testing.T) {
-// (hyperguild#155). An unresolved issuer is logged at boot.
+	srv, discoveries := fakeIssuer(t, 3)
-func TestBuildJWTValidatorReturnsAValidatorWhileDiscovery502s(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
-	srv, _ := fakeIssuer(t, 1000)
+	defer cancel()
-	var buf bytes.Buffer
+
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.NewTextHandler(&buf, nil)), srv.URL, "brain")
+	v, err := buildJWTValidator(ctx, slog.New(slog.DiscardHandler), srv.URL, "brain", fastPolicy)
 	require.NoError(t, err)
 	assert.NotNil(t, v)
-	assert.Contains(t, buf.String(), "jwt issuer not resolved at boot")
+	assert.Equal(t, int32(4), discoveries.Load(), "three 502s, then the successful discovery")
 }
 
-func TestBuildJWTValidatorLogsNothingAgainstAHealthyIssuer(t *testing.T) {
+func TestBuildJWTValidatorGivesUpAfterTheBudgetWithTheLastError(t *testing.T) {
-	srv, _ := fakeIssuer(t, 0)
+	srv, discoveries := fakeIssuer(t, 1000)
-	var buf bytes.Buffer
+	ctx, cancel := context.WithCancel(context.Background())
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.NewTextHandler(&buf, nil)), srv.URL, "brain")
+	defer cancel()
-	require.NoError(t, err)
+
-	assert.NotNil(t, v)
+	_, err := buildJWTValidator(ctx, slog.New(slog.DiscardHandler), srv.URL, "brain", fastPolicy)
-	assert.NotContains(t, buf.String(), "not resolved")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "status 502")
+	assert.Equal(t, int32(8), discoveries.Load(), "bounded: exactly the attempt budget")
 }
 
-func TestBuildJWTValidatorIsNilWithoutAnIssuer(t *testing.T) {
+func TestBuildJWTValidatorStopsRetryingWhenTheContextIsCancelled(t *testing.T) {
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.DiscardHandler), "", "brain")
-	require.NoError(t, err)
-	assert.Nil(t, v)
-}
-
-// With the issuer unresolved, a JWT on a REST route answers 503 (retry), not
-// 401: the token may be fine, the server just cannot check it yet.
-func TestBuildMuxAnswers503ToAJWTWhileTheIssuerIsUnresolved(t *testing.T) {
 	srv, _ := fakeIssuer(t, 1000)
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.DiscardHandler), srv.URL, "brain")
+	ctx, cancel := context.WithCancel(context.Background())
-	require.NoError(t, err)
+	slow := startupretry.Policy{Attempts: 8, Base: time.Hour, Max: time.Hour}
-	mux, err := buildMux(restAuth{token: routesTok, validator: v, realm: "brain"}, testHandler(t),
-		okHandler("mcp"), metrics.New(), nil)
-	require.NoError(t, err)
-	code, _ := do(t, mux, "GET", "/pending", "Bearer aaa.bbb.ccc")
-	assert.Equal(t, http.StatusServiceUnavailable, code)
-}
 
-// PR #183 review: /mcp shares REST's bearer, but only the static token was
+	done := make(chan error, 1)
-// asserted on it. With the issuer unresolved, a JWT on /mcp answers 503 too,
+	go func() {
-// so /mcp's middleware was built with the JWT validator.
+		_, err := buildJWTValidator(ctx, slog.New(slog.DiscardHandler), srv.URL, "brain", slow)
-func TestBuildMuxAnswers503ToAJWTOnMCPWhileTheIssuerIsUnresolved(t *testing.T) {
+		done <- err
-	srv, _ := fakeIssuer(t, 1000)
+	}()
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.DiscardHandler), srv.URL, "brain")
+	time.Sleep(50 * time.Millisecond)
-	require.NoError(t, err)
+	cancel()
-	mux, err := buildMux(restAuth{token: routesTok, validator: v, realm: "brain"}, testHandler(t),
+	select {
-		okHandler("mcp"), metrics.New(), nil)
+	case err := <-done:
-	require.NoError(t, err)
+		assert.ErrorIs(t, err, context.Canceled)
-	code, _ := do(t, mux, "POST", "/mcp", "Bearer aaa.bbb.ccc")
+	case <-time.After(3 * time.Second):
-	assert.Equal(t, http.StatusServiceUnavailable, code)
+		t.Fatal("did not return after the context was cancelled")
 	}
-
-// PR #183 review: a 401 on /mcp names the protected-resource metadata in
-// WWW-Authenticate (what the claude.ai OAuth connector discovers from), so
-// /mcp's middleware was built with resourceMetadataURL.
-func TestBuildMuxMCP401CarriesResourceMetadataInWWWAuthenticate(t *testing.T) {
-	const rm = "https://brain.example/.well-known/oauth-protected-resource"
-	mux, err := buildMux(restAuth{token: routesTok, realm: "brain", resourceMetadataURL: rm}, testHandler(t),
-		okHandler("mcp"), metrics.New(), nil)
-	require.NoError(t, err)
-	rec := httptest.NewRecorder()
-	mux.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, "/mcp", nil))
-	require.Equal(t, http.StatusUnauthorized, rec.Code)
-	assert.Contains(t, rec.Header().Get("WWW-Authenticate"), `resource_metadata="`+rm+`"`)
 }

ingestion/cmd/server/main.go

@@ -32,6 +32,7 @@ import (
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/reranker"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/search"
+	"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/symlinkguard"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/vectorstore"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/watcher"
@@ -368,15 +369,21 @@ func main() {
 	// hyperguild#157: report a symlink that appears in the brain while running.
 	go symlinkguard.Watch(ctx, brainDir, symlinkScanInterval(os.Getenv), buildNotifier())
 
-	// Never fatal on an unreachable issuer (#83): on a cold cluster boot this
+	// Built before the watcher, the graph backfill and session ingestion, and
-	// pod can beat dex to serving and get a 502 from ingress, and exiting meant
+	// retried rather than fatal (#83). Two separate reasons:
-	// CrashLoopBackOff redoing the backfill. Since mcp-chassis v0.7 the
+	//
-	// validator resolves the issuer lazily and answers JWTs 503-and-retry until
+	//   - On a cold cluster boot this pod can beat dex to serving and gets a
-	// it does (hyperguild#155), so no boot retry is needed. A misconfigured
+	//     502 from ingress. Nothing is misconfigured; it simply started first.
-	// issuer no longer exits the process: it is logged at boot and every JWT
+	//     Exiting there meant CrashLoopBackOff redoing the backfill on every
-	// gets 503; the static bearer keeps working.
+	//     attempt, with exponential backoff stretching the brain outage.
+	//   - Constructing it first means a genuine config error (wrong issuer,
+	//     bad audience) fails in seconds instead of after all that work.
+	//
+	// The budget stays bounded: retrying forever would turn a misconfiguration
+	// into a process that looks alive and never serves.
 	jwtValidator, err := buildJWTValidator(ctx, logger,
-		os.Getenv("DEX_ISSUER_URL"), os.Getenv("MCP_AUDIENCE"))
+		os.Getenv("DEX_ISSUER_URL"), os.Getenv("MCP_AUDIENCE"),
+		startupretry.Policy{Attempts: 8, Base: time.Second, Max: 30 * time.Second})
 	if err != nil {
 		logger.Error("build jwt validator", "err", err)
 		os.Exit(1)
@@ -516,6 +523,8 @@ func main() {
 		}
 	}
 
+	public["/mcp"] = chassisauth.BearerMiddleware(mcpToken, jwtValidator, "brain", resourceMetadataURL, mcpSrv)
+
 	// POST /capture (#53/#54): the uniform capture REST door. Needs a ticket
 	// tracker to file action items, so it only mounts when Gitea is
 	// configured. It reuses the MCP server's graph-wired brain store (one
@@ -539,7 +548,7 @@ func main() {
 		public["POST /capture"] = captureH
 		// Same use-case behind the MCP `capture` tool (#55 relay) so MCP-native
 		// harnesses (claude.ai, Crush, Pi, LLM Council) reach capture through
-		// the existing /mcp OAuth connector. buildMux wraps this same mcpSrv;
+		// the existing /mcp OAuth connector. mcpSrv is already wrapped above;
 		// WithCapture mutates the same instance, so the tool appears live.
 		mcpSrv.WithCapture(captureSvc, jwtValidator, mcpToken, "local-cli", resolver)
 		// hyperguild#97: a governance-file rewrite gets the same trail a
@@ -581,18 +590,19 @@ func main() {
 		os.Exit(1)
 	}
 
-	// /metrics — unauthenticated Prometheus endpoint, scraped via the
+	// /metrics — unauthenticated Prometheus endpoint. kube-prometheus-stack
-	// ServiceMonitor in k3s/apps/supervisor/. buildMux registers it and wraps
+	// scrapes it via the ServiceMonitor in k3s/apps/supervisor/. The metrics
-	// the whole router in the registry's middleware.
+	// middleware below wraps every other registered handler so it observes
-	//
+	// real request latency. /metrics itself is excluded from its own
-	// The whole router, /mcp's bearer included, is built in buildMux so its
+	// observation by registering it on the outer mux (post-wrap).
-	// tests are tests of production wiring (PR #152 review, hyperguild#154).
+	reg := metrics.New()
-	// The REST API's credential is the same as /mcp's. Untested here: the
+	public["GET /metrics"] = http.HandlerFunc(reg.Handler())
-	// restAuth fields and the public map this call passes in (e.g. a nil
+
-	// validator would drop JWT auth on /mcp and REST and the suite stays
+	// The whole router, built in one place so the test of buildMux is a test
-	// green), and ListenAndServe serving the result unchanged (hyperguild#182).
+	// of production wiring (PR #152 review). The REST API's credential is the
-	handler, err := buildMux(restAuth{token: mcpToken, validator: jwtValidator, realm: "brain",
+	// same as /mcp's.
-		resourceMetadataURL: resourceMetadataURL}, h, mcpSrv, metrics.New(), public)
+	mux, err := buildMux(restAuth{token: mcpToken, validator: jwtValidator, realm: "brain",
+		resourceMetadataURL: resourceMetadataURL}, h, public)
 	if err != nil {
 		logger.Error("build router", "err", err)
 		os.Exit(1)
@@ -613,7 +623,7 @@ func main() {
 		"watch_interval", watchIntervalLog,
 		"mcp_enabled", true,
 	)
-	if err := http.ListenAndServe(addr, handler); err != nil {
+	if err := http.ListenAndServe(addr, reg.Middleware(mux)); err != nil {
 		logger.Error("server stopped", "err", err)
 		os.Exit(1)
 	}

ingestion/cmd/server/routes.go

@@ -8,22 +8,22 @@ import (
 	chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
 
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/metrics"
 )
 
-// publicRoutes is the complete set of patterns a caller may register on the
+// publicRoutes is the complete set of patterns allowed on the outer mux,
-// outer mux, outside the REST API's auth (hyperguild#149). Each authenticates
+// outside the REST API's auth (hyperguild#149). Each authenticates itself or is
-// itself or is meant to be open: /capture (bearer/JWT), the webhook (HMAC),
+// meant to be open: /mcp (bearer/JWT), /capture (bearer/JWT), the webhook
-// /oauth/token (client secret) and OAuth metadata (open). /mcp and /metrics
+// (HMAC), /oauth/token (client secret), OAuth metadata and /metrics (open).
-// are not here: buildMux builds them itself (hyperguild#154). A REST pattern
+// A REST pattern added here would beat the authenticated catch-all by
-// added here would beat the authenticated catch-all by specificity and ship
+// specificity and ship open, which is why buildMux refuses anything else.
-// open, which is why buildMux refuses anything else.
 var publicRoutes = map[string]bool{
+	"/mcp":                      true,
 	"POST /capture":             true,
 	"POST /webhooks/brain-sync": true,
 	"GET /.well-known/oauth-protected-resource":   true,
 	"GET /.well-known/oauth-authorization-server": true,
 	"POST /oauth/token":                           true,
+	"GET /metrics":                                true,
 }
 
 // restAuth is the credential the REST API checks: the same as /mcp's.
@@ -34,25 +34,16 @@ type restAuth struct {
 	resourceMetadataURL string
 }
 
-// buildMux builds the handler main passes to ListenAndServe unchanged. The
+// buildMux is the server's whole router. The REST API is mounted at "/"
-// REST API is mounted at "/" and /mcp is registered, both behind bearer auth
+// behind bearer auth that buildMux constructs itself, so a caller cannot pass
-// that buildMux constructs itself from auth (one credential), so a caller
+// a no-op; public handlers are registered as given, and only for patterns on
-// cannot pass a no-op. GET /metrics serves reg, and the whole router is
+// the publicRoutes allowlist. It returns an http.Handler, not the
-// wrapped in reg's middleware. Other public handlers are registered as given,
+// *ServeMux, so nothing can register a route on the result afterwards and
-// and only for patterns on the publicRoutes allowlist. It returns an
+// bypass the allowlist.
-// http.Handler, not the *ServeMux, so nothing can register a route on the
+func buildMux(auth restAuth, h *api.Handler, public map[string]http.Handler) (http.Handler, error) {
-// result. What stays untested is main's call site: the restAuth fields and
-// the public map main passes in, and ListenAndServe serving this handler
-// unchanged (hyperguild#182). The tests build their own arguments.
-func buildMux(
-	auth restAuth, h *api.Handler, mcpHandler http.Handler, reg *metrics.Registry, public map[string]http.Handler,
-) (http.Handler, error) {
 	if auth.token == "" {
 		return nil, errors.New("buildMux: REST auth needs a token")
 	}
-	if mcpHandler == nil || reg == nil {
-		return nil, errors.New("buildMux: needs the MCP handler and the metrics registry")
-	}
 	mux := http.NewServeMux()
 	for pattern, handler := range public {
 		if !publicRoutes[pattern] {
@@ -60,15 +51,10 @@ func buildMux(
 		}
 		mux.Handle(pattern, handler)
 	}
-	bearer := func(next http.Handler) http.Handler {
+	mountREST(mux, h, func(next http.Handler) http.Handler {
 		return chassisauth.BearerMiddleware(auth.token, auth.validator, auth.realm, auth.resourceMetadataURL, next)
-	}
+	})
-	mux.Handle("/mcp", bearer(mcpHandler))
+	return mux, nil
-	// /metrics is registered on the mux and so observed by its own
-	// middleware, like any route.
-	mux.Handle("GET /metrics", reg.Handler())
-	mountREST(mux, h, bearer)
-	return reg.Middleware(mux), nil
 }
 
 // mountREST registers the REST API on its own mux and mounts it at "/" behind
@@ -87,23 +73,5 @@ func mountREST(mux *http.ServeMux, h *api.Handler, auth func(http.Handler) http.
 	rest.HandleFunc("POST /promote", h.Promote)
 	rest.HandleFunc("POST /backfill-embeddings", h.BackfillEmbeddings)
 	rest.HandleFunc("GET /pass-rate", h.PassRate)
-	mux.Handle("/", labelRESTPattern(rest, auth(rest)))
+	mux.Handle("/", auth(rest))
-}
-
-// labelRESTPattern sets the request's Pattern to the REST route it addresses
-// before auth runs, so the metrics middleware (which reads Pattern from the
-// same *http.Request) labels a refused request by its route rather than by
-// the "/" mount (hyperguild#155). A refused request to a path no route
-// matches keeps "/", so for refused requests the label set stays bounded by
-// the registered routes. That bound does not hold for authenticated
-// requests: an unregistered path reaches the REST mux, which 404s with an
-// empty Pattern, and the metrics middleware falls back to the raw URL path
-// (hyperguild#185).
-func labelRESTPattern(rest *http.ServeMux, next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if _, pattern := rest.Handler(r); pattern != "" {
-			r.Pattern = pattern
-		}
-		next.ServeHTTP(w, r)
-	})
 }

ingestion/cmd/server/routes_observability_test.go

@@ -1,88 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// wrongTokSentinel is a presented credential distinctive enough that any
-// occurrence in a log line is the raw token, not a coincidence.
-const wrongTokSentinel = "wrong-tok-sentinel-q7zx"
-
-// hyperguild#155: since #149 every REST route sits behind BearerMiddleware,
-// and chassis v0.2.0 refused without logging, so an unknown caller got
-// silent 401s. The chassis now writes an `mcp auth rejected` line, and the
-// presented token appears nowhere in the log as a bare value (PR #181
-// review: asserting on the "Bearer " header form could never fail, since
-// the chassis logs fields, not headers).
-func TestBuildMuxRejectionLogLineOmitsTheBarePresentedToken(t *testing.T) {
-	var buf bytes.Buffer
-	prev := slog.Default()
-	slog.SetDefault(slog.New(slog.NewTextHandler(&buf, nil)))
-	t.Cleanup(func() { slog.SetDefault(prev) })
-
-	code, _ := do(t, testMux(t), "POST", "/query", "Bearer "+wrongTokSentinel)
-	require.Equal(t, http.StatusUnauthorized, code)
-	assert.Contains(t, buf.String(), "mcp auth rejected")
-	assert.Contains(t, buf.String(), "path=/query")
-	assert.NotContains(t, buf.String(), wrongTokSentinel, "the rejected token is logged as a bare value")
-	assert.NotContains(t, buf.String(), routesTok, "the valid static token is logged")
-}
-
-// The `mcp auth accepted` line leaves out the valid static token.
-func TestBuildMuxAcceptedLogLineOmitsTheBareStaticToken(t *testing.T) {
-	var buf bytes.Buffer
-	prev := slog.Default()
-	slog.SetDefault(slog.New(slog.NewTextHandler(&buf, nil)))
-	t.Cleanup(func() { slog.SetDefault(prev) })
-
-	code, _ := do(t, testMux(t), "GET", "/pending", "Bearer "+routesTok)
-	require.Equal(t, http.StatusOK, code)
-	assert.Contains(t, buf.String(), "mcp auth accepted")
-	assert.NotContains(t, buf.String(), routesTok, "the accepted static token is logged as a bare value")
-}
-
-// An authenticated REST request is labelled with the REST mux's pattern:
-// the inner mux sets it on the same *http.Request the outer middleware reads.
-func TestMetricsLabelAnAuthenticatedRESTRequestWithItsRoutePattern(t *testing.T) {
-	mux, reg := testMuxAndRegistry(t)
-	code, _ := do(t, mux, "GET", "/pending", "Bearer "+routesTok)
-	require.Equal(t, http.StatusOK, code)
-
-	rec := httptest.NewRecorder()
-	reg.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/metrics", nil))
-	assert.Contains(t, rec.Body.String(), `path="GET /pending"`)
-	assert.NotContains(t, rec.Body.String(), `path="/"`)
-}
-
-// hyperguild#155: a request refused by REST auth never reaches the REST mux,
-// so it was labelled path="/" and a 4xx on /query could not be told from one
-// on /write. It is now labelled with the REST pattern it was addressed to.
-func TestMetricsLabelARejectedRESTRequestWithItsRoutePattern(t *testing.T) {
-	mux, reg := testMuxAndRegistry(t)
-	code, _ := do(t, mux, "POST", "/query", "")
-	require.Equal(t, http.StatusUnauthorized, code)
-
-	rec := httptest.NewRecorder()
-	reg.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/metrics", nil))
-	assert.Contains(t, rec.Body.String(), `path="POST /query",status="4xx"`)
-}
-
-// A path no REST route matches keeps the catch-all label, so an attacker
-// probing random URLs cannot grow the series set.
-func TestMetricsLabelARejectedUnknownPathWithTheCatchAll(t *testing.T) {
-	mux, reg := testMuxAndRegistry(t)
-	code, _ := do(t, mux, "POST", "/no-such-route-zq", "")
-	require.Equal(t, http.StatusUnauthorized, code)
-
-	rec := httptest.NewRecorder()
-	reg.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/metrics", nil))
-	assert.Contains(t, rec.Body.String(), `path="/",status="4xx"`)
-	assert.NotContains(t, rec.Body.String(), "no-such-route-zq")
-}

ingestion/cmd/server/routes_test.go

@@ -12,7 +12,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/metrics"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
 )
 
@@ -22,34 +21,20 @@ func okHandler(body string) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { _, _ = w.Write([]byte(body)) })
 }
 
-// testMux builds the router through buildMux, the function main calls, with
+// testMux builds the router exactly as main does: buildMux with the full
-// every allowlisted public pattern (stub handlers), a stub MCP server and a
+// public set main registers (stub handlers) and real bearer config.
-// static token only: no JWT validator and no resourceMetadataURL (the tests
+// hyperguild#149: the REST API is authenticated as a whole; the PR #152
-// in jwt_validator_test.go pass those). It does not use main's own restAuth
+// review showed a test of a COPY of the router let main.go regress unseen.
-// or public map (hyperguild#182). hyperguild#149: the REST API is
-// authenticated as a whole; the PR #152 review showed a test of a COPY of
-// the router let main.go regress unseen.
 func testMux(t *testing.T) http.Handler {
 	t.Helper()
-	mux, _ := testMuxAndRegistry(t)
+	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
-	return mux
-}
-
-func testMuxAndRegistry(t *testing.T) (http.Handler, *metrics.Registry) {
-	t.Helper()
 	public := map[string]http.Handler{}
 	for p := range publicRoutes {
 		public[p] = okHandler("public " + p)
 	}
-	reg := metrics.New()
+	mux, err := buildMux(restAuth{token: routesTok, realm: "brain"}, h, public)
-	mux, err := buildMux(restAuth{token: routesTok, realm: "brain"}, testHandler(t), okHandler("mcp"), reg, public)
 	require.NoError(t, err)
-	return mux, reg
+	return mux
-}
-
-func testHandler(t *testing.T) *api.Handler {
-	t.Helper()
-	return api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
 }
 
 func do(t *testing.T, h http.Handler, method, path, authz string) (int, string) {
@@ -89,9 +74,8 @@ func TestBuildMuxAuthenticatesAnUnregisteredPath(t *testing.T) {
 }
 
 // buildMux registers public handlers as given, without adding auth: each
-// public route owns its own (bearer/JWT on /capture, HMAC on the webhook,
+// public route owns its own (bearer on /mcp, HMAC on the webhook, client
-// client secret on /oauth/token) or is meant to be open (OAuth metadata).
+// secret on /oauth/token) or is meant to be open (/metrics, OAuth metadata).
-// /mcp and /metrics are not public routes: buildMux builds them itself.
 func TestBuildMuxDoesNotWrapPublicRoutes(t *testing.T) {
 	r := testMux(t)
 	for p := range publicRoutes {
@@ -109,53 +93,14 @@ func TestBuildMuxDoesNotWrapPublicRoutes(t *testing.T) {
 // over the authenticated catch-all (more specific pattern), so it is refused.
 func TestBuildMuxRefusesAPublicPatternOffTheAllowlist(t *testing.T) {
 	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
-	// "/mcp" and "GET /metrics" are built by buildMux itself (hyperguild#154):
+	for _, p := range []string{"POST /query", "GET /pending", "/", "POST /metrics"} {
-	// passing either as public would register them unauthenticated or twice.
+		_, err := buildMux(restAuth{token: routesTok, realm: "brain"}, h, map[string]http.Handler{p: okHandler("x")})
-	for _, p := range []string{"POST /query", "GET /pending", "/", "POST /metrics", "/mcp", "GET /metrics"} {
-		_, err := buildMux(restAuth{token: routesTok, realm: "brain"}, h, okHandler("mcp"), metrics.New(),
-			map[string]http.Handler{p: okHandler("x")})
 		assert.Error(t, err, "public pattern %q must be refused", p)
 	}
 }
 
 func TestBuildMuxRefusesAnEmptyToken(t *testing.T) {
 	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
-	_, err := buildMux(restAuth{token: "", realm: "brain"}, h, okHandler("mcp"), metrics.New(), nil)
+	_, err := buildMux(restAuth{token: "", realm: "brain"}, h, nil)
 	assert.Error(t, err)
 }
-
-// hyperguild#154: /mcp's bearer was built in main.go, untested; the buildMux
-// tests used stubs. buildMux now wraps the MCP handler itself, with the same
-// credential as the REST API.
-func TestBuildMuxRefusesMCPWithoutAValidToken(t *testing.T) {
-	r := testMux(t)
-	for _, authz := range []string{"", "Bearer wrong"} {
-		code, body := do(t, r, "POST", "/mcp", authz)
-		assert.Equal(t, http.StatusUnauthorized, code, "authz %q", authz)
-		assert.NotEqual(t, "mcp", body)
-	}
-	code, body := do(t, r, "POST", "/mcp", "Bearer "+routesTok)
-	assert.Equal(t, http.StatusOK, code)
-	assert.Equal(t, "mcp", body)
-}
-
-func TestBuildMuxRefusesANilMCPHandlerOrRegistry(t *testing.T) {
-	auth := restAuth{token: routesTok, realm: "brain"}
-	_, err := buildMux(auth, testHandler(t), nil, metrics.New(), nil)
-	assert.Error(t, err)
-	_, err = buildMux(auth, testHandler(t), okHandler("mcp"), nil, nil)
-	assert.Error(t, err)
-}
-
-// hyperguild#154: main wrapped buildMux's result in the metrics middleware
-// before ListenAndServe, untested. buildMux now returns the handler main
-// serves as-is, metrics included: a request through it is observed and
-// exposed on its own GET /metrics.
-func TestBuildMuxObservesRequestsAndServesMetrics(t *testing.T) {
-	r := testMux(t)
-	code, _ := do(t, r, "GET", "/pending", "Bearer "+routesTok)
-	require.Equal(t, http.StatusOK, code)
-	code, body := do(t, r, "GET", "/metrics", "")
-	require.Equal(t, http.StatusOK, code)
-	assert.Contains(t, body, `path="GET /pending"`)
-}

ingestion/go.mod

@@ -51,7 +51,7 @@ require (
 )
 
 require (
-	git.d-ma.be/mathias/mcp-chassis v0.7.1
+	git.d-ma.be/mathias/mcp-chassis v0.2.0
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
 	github.com/goccy/go-json v0.10.3 // indirect

ingestion/go.sum

@@ -1,5 +1,5 @@
-git.d-ma.be/mathias/mcp-chassis v0.7.1 h1:4h8TOBHTA0L/no4IPcr4tLcQtmKUlhE2/cXyPdNFGmM=
+git.d-ma.be/mathias/mcp-chassis v0.2.0 h1:6fLmb7xqRa2nNVWsHaUbbfbArgDXJw/gDhb09clBIjo=
-git.d-ma.be/mathias/mcp-chassis v0.7.1/go.mod h1:Ks7EK2UnGAN0H3rJjKUxUagX8/ZBdtLrOlcUbv0RwH8=
+git.d-ma.be/mathias/mcp-chassis v0.2.0/go.mod h1:Ks7EK2UnGAN0H3rJjKUxUagX8/ZBdtLrOlcUbv0RwH8=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

ingestion/internal/api/update.go

@@ -3,15 +3,18 @@ package api
 import (
 	"crypto/sha256"
 	"encoding/hex"
+	"errors"
 	"fmt"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
 	"time"
 
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
+	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/claim"
+	"github.com/mathiasbq/hyperguild/ingestion/internal/notes"
 )
 
 // ContentHash returns the lowercase hex sha256 of b. It is the note's
@@ -91,14 +94,23 @@ func UpdateNote(brainDir string, opts UpdateNoteOptions) (relPath, contentHash,
 		rel = filepath.ToSlash(rel)
 	}
 
-	rel, abs, err := resolveWithin(brainDir, rel)
+	// The path is caller-supplied (brain_update): resolve it as brain_edit
+	// does, knowledge/ and wiki/ notes only, and read and rewrite it through
+	// the brain root, never through a symlink (hyperguild#169).
+	t, err := notes.Resolve(brainDir, rel, notes.ScopeNotes)
 	if err != nil {
 		return "", "", "", err
 	}
-
+	rel = t.Rel
-	prior, err := os.ReadFile(abs)
+	bfs, err := brainfs.Open(brainDir)
 	if err != nil {
-		if os.IsNotExist(err) {
+		return "", "", "", fmt.Errorf("open brain: %w", err)
+	}
+	defer func() { _ = bfs.Close() }()
+
+	prior, err := bfs.ReadRegular(rel)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
 			return "", "", "", fmt.Errorf("note %q does not exist: use brain_write to create", rel)
 		}
 		return "", "", "", fmt.Errorf("read target: %w", err)
@@ -164,7 +176,7 @@ func UpdateNote(brainDir string, opts UpdateNoteOptions) (relPath, contentHash,
 		return "", "", "", err
 	}
 	out := []byte(stamped)
-	if err := os.WriteFile(abs, out, 0o644); err != nil {
+	if err := bfs.WriteRegular(rel, out); err != nil {
 		return "", "", "", fmt.Errorf("write: %w", err)
 	}
 	return rel, ContentHash(out), priorHash, nil

ingestion/internal/api/update_scope_test.go

@@ -0,0 +1,112 @@
+package api_test
+
+import (
+	"os"
+	"path/filepath"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
+)
+
+// brain_update passed the caller's path through resolveWithin, a lexical
+// containment check only: any file in the brain could be superseded
+// (classification.yaml, raw/, sessions/), and a final symlink was written
+// through. It now resolves like brain_edit: knowledge/ and wiki/ notes only,
+// read and rewritten through the brain root.
+func TestUpdateNoteRefusesPathsOutsideKnowledgeAndWikiNotes(t *testing.T) {
+	brain := t.TempDir()
+	files := map[string]string{
+		"classification.yaml": "levels: {}\n",
+		"raw/r.md":            "raw\n",
+		"sessions/s.jsonl":    "{}\n",
+		"wiki/w/facts/ok.md":  "---\ntitle: ok\n---\nold\n",
+		"knowledge/k.md":      "---\ntitle: k\n---\nold\n",
+		"wiki/w/facts/x.txt":  "txt\n",
+	}
+	for rel, body := range files {
+		p := filepath.Join(brain, filepath.FromSlash(rel))
+		require.NoError(t, os.MkdirAll(filepath.Dir(p), 0o755))
+		require.NoError(t, os.WriteFile(p, []byte(body), 0o644))
+	}
+	for _, rel := range []string{"classification.yaml", "raw/r.md", "sessions/s.jsonl", "wiki/w/facts/x.txt", "wiki/w/../../raw/r.md"} {
+		_, _, _, err := api.UpdateNote(brain, api.UpdateNoteOptions{Path: rel, Content: "replaced"})
+		assert.Error(t, err, rel)
+	}
+	for rel, body := range files {
+		if rel == "wiki/w/facts/ok.md" || rel == "knowledge/k.md" {
+			continue
+		}
+		got, err := os.ReadFile(filepath.Join(brain, filepath.FromSlash(rel)))
+		require.NoError(t, err)
+		assert.Equal(t, body, string(got), rel)
+	}
+	for _, rel := range []string{"wiki/w/facts/ok.md", "knowledge/k.md"} {
+		_, _, _, err := api.UpdateNote(brain, api.UpdateNoteOptions{Path: rel, Content: "new body"})
+		require.NoError(t, err, "positive control: %s", rel)
+		got, _ := os.ReadFile(filepath.Join(brain, filepath.FromSlash(rel)))
+		assert.Contains(t, string(got), "new body")
+	}
+}
+
+func TestUpdateNoteDoesNotWriteThroughASymlinkedNote(t *testing.T) {
+	brain := t.TempDir()
+	facts := filepath.Join(brain, "wiki", "w", "facts")
+	require.NoError(t, os.MkdirAll(facts, 0o755))
+	victim := filepath.Join(brain, "raw", "victim.md")
+	require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
+	require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
+	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "victim.md"), filepath.Join(facts, "l.md")))
+	_, _, _, err := api.UpdateNote(brain, api.UpdateNoteOptions{Path: "wiki/w/facts/l.md", Content: "replaced"})
+	assert.Error(t, err)
+	got, _ := os.ReadFile(victim)
+	assert.Equal(t, "untouched\n", string(got))
+}
+
+// The note is swapped between a regular file and an in-brain symlink to a
+// raw/ file while UpdateNote runs: the read and the write each refuse a
+// symlink, so the raw/ file is never rewritten.
+func TestUpdateNoteNeverRewritesASymlinkSwappedInForTheNote(t *testing.T) {
+	brain := t.TempDir()
+	facts := filepath.Join(brain, "wiki", "w", "facts")
+	require.NoError(t, os.MkdirAll(facts, 0o755))
+	victim := filepath.Join(brain, "raw", "victim.md")
+	require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
+	require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
+	note := filepath.Join(facts, "n.md")
+	body := "---\ntitle: n\n---\nold\n"
+	require.NoError(t, os.WriteFile(note, []byte(body), 0o644))
+
+	var stop atomic.Bool
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		tmp := note + ".swap"
+		for i := 0; !stop.Load(); i++ {
+			_ = os.Remove(tmp)
+			if i%2 == 0 {
+				_ = os.WriteFile(tmp, []byte(body), 0o644)
+			} else {
+				_ = os.Symlink(filepath.Join("..", "..", "..", "raw", "victim.md"), tmp)
+			}
+			_ = os.Rename(tmp, note)
+		}
+	}()
+	ok := 0
+	for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
+		if _, _, _, err := api.UpdateNote(brain, api.UpdateNoteOptions{Path: "wiki/w/facts/n.md", Content: "new"}); err == nil {
+			ok++
+		}
+	}
+	stop.Store(true)
+	wg.Wait()
+	got, _ := os.ReadFile(victim)
+	assert.Equal(t, "untouched\n", string(got))
+	assert.Positive(t, ok, "positive control: some updates reach the regular note")
+}

ingestion/internal/brain/tunnel.go

@@ -4,9 +4,12 @@ import (
 	"bufio"
 	"fmt"
 	"os"
+	"path"
 	"path/filepath"
 	"strings"
 	"time"
+
+	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 )
 
 // seeAlsoHeader is the markdown heading used to group cross-wing links.
@@ -197,6 +200,12 @@ func fileExists(p string) bool {
 // section headers. Rejects same-wing pairs (a tunnel is by definition
 // cross-wing) and missing notes.
 func WriteTunnel(brainDir, sourcePath, targetPath string) error {
+	if err := checkNotePath(sourcePath); err != nil {
+		return fmt.Errorf("source: %w", err)
+	}
+	if err := checkNotePath(targetPath); err != nil {
+		return fmt.Errorf("target: %w", err)
+	}
 	srcWing, err := wingOf(sourcePath)
 	if err != nil {
 		return fmt.Errorf("source: %w", err)
@@ -209,20 +218,50 @@ func WriteTunnel(brainDir, sourcePath, targetPath string) error {
 		return fmt.Errorf("tunnel must cross wings; got both in %q", srcWing)
 	}
 
-	srcFull := filepath.Join(brainDir, filepath.FromSlash(sourcePath))
+	// Both notes are read and rewritten through the brain root, regular
-	tgtFull := filepath.Join(brainDir, filepath.FromSlash(targetPath))
+	// files only: brain_tunnel passes caller-supplied paths, and the brain is
-	if _, err := os.Stat(srcFull); err != nil {
+	// a Syncthing folder that can hold symlinks.
+	bfs, err := brainfs.Open(brainDir)
+	if err != nil {
+		return fmt.Errorf("open brain: %w", err)
+	}
+	defer func() { _ = bfs.Close() }()
+	srcContent, err := bfs.ReadRegular(sourcePath)
+	if err != nil {
 		return fmt.Errorf("source note: %w", err)
 	}
-	if _, err := os.Stat(tgtFull); err != nil {
+	tgtContent, err := bfs.ReadRegular(targetPath)
+	if err != nil {
 		return fmt.Errorf("target note: %w", err)
 	}
 
-	if err := appendSeeAlso(srcFull, wikilinkOf(targetPath)); err != nil {
+	if out, changed, err := withSeeAlso(srcContent, wikilinkOf(targetPath)); err != nil {
+		return fmt.Errorf("update source: %w", err)
+	} else if changed {
+		if err := bfs.WriteRegular(sourcePath, out); err != nil {
 			return fmt.Errorf("update source: %w", err)
 		}
-	if err := appendSeeAlso(tgtFull, wikilinkOf(sourcePath)); err != nil {
+	}
+	if out, changed, err := withSeeAlso(tgtContent, wikilinkOf(sourcePath)); err != nil {
 		return fmt.Errorf("update target: %w", err)
+	} else if changed {
+		if err := bfs.WriteRegular(targetPath, out); err != nil {
+			return fmt.Errorf("update target: %w", err)
+		}
+	}
+	return nil
+}
+
+// checkNotePath accepts only a clean, local wiki/<wing>/<hall>/.../<slug>.md
+// path: no "." or ".." segments, no empty segments, no leading slash.
+func checkNotePath(p string) error {
+	if p == "" || path.Clean(p) != p || !filepath.IsLocal(p) || !strings.HasSuffix(p, ".md") {
+		return fmt.Errorf("not a clean wiki note path: %q", p)
+	}
+	for _, part := range strings.Split(p, "/") {
+		if part == "" || part == "." || part == ".." {
+			return fmt.Errorf("not a clean wiki note path: %q", p)
+		}
 	}
 	return nil
 }
@@ -248,16 +287,13 @@ func wingOf(relPath string) (string, error) {
 	return parts[1], nil
 }
 
-// appendSeeAlso inserts `- [[link]]` under the file's See also section,
+// withSeeAlso returns content with `- [[link]]` under its See also section,
-// creating the section if absent. No-op when the link is already present.
+// creating the section if absent. changed is false when the link is already
-func appendSeeAlso(filePath, link string) error {
+// present.
-	content, err := os.ReadFile(filePath)
+func withSeeAlso(content []byte, link string) (out []byte, changed bool, err error) {
-	if err != nil {
-		return err
-	}
 	wikilink := "[[" + link + "]]"
 	if strings.Contains(string(content), wikilink) {
-		return nil
+		return content, false, nil
 	}
 
 	bullet := "- " + wikilink
@@ -266,8 +302,7 @@ func appendSeeAlso(filePath, link string) error {
 		// No section yet — append a fresh one. Always emit a trailing
 		// newline so subsequent appends don't merge into the previous line.
 		trimmed := strings.TrimRight(string(content), "\n")
-		out := trimmed + "\n\n" + seeAlsoHeader + "\n\n" + bullet + "\n"
+		return []byte(trimmed + "\n\n" + seeAlsoHeader + "\n\n" + bullet + "\n"), true, nil
-		return os.WriteFile(filePath, []byte(out), 0o644)
 	}
 
 	// Section exists — splice the bullet in just before the next `## `
@@ -293,12 +328,11 @@ func appendSeeAlso(filePath, link string) error {
 		b.WriteByte('\n')
 	}
 	if err := scanner.Err(); err != nil {
-		return err
+		return nil, false, err
 	}
 	if !inserted {
 		// section was the last thing in the file — just append bullet
-		out := strings.TrimRight(b.String(), "\n") + "\n" + bullet + "\n"
+		return []byte(strings.TrimRight(b.String(), "\n") + "\n" + bullet + "\n"), true, nil
-		return os.WriteFile(filePath, []byte(out), 0o644)
 	}
-	return os.WriteFile(filePath, []byte(b.String()), 0o644)
+	return []byte(b.String()), true, nil
 }

ingestion/internal/brain/tunnel_root_test.go

@@ -0,0 +1,141 @@
+package brain_test
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
+)
+
+// brain_tunnel passes caller-supplied source and target paths to WriteTunnel,
+// which checked only "wiki/<wing>/..." and then joined them onto the brain
+// dir: ".." segments resolved outside the brain and appendSeeAlso rewrote the
+// file there.
+func TestWriteTunnelRefusesATargetThatTraversesOutOfTheBrain(t *testing.T) {
+	brain0 := t.TempDir()
+	src := filepath.Join(brain0, "wiki", "a", "facts", "s.md")
+	require.NoError(t, os.MkdirAll(filepath.Dir(src), 0o755))
+	require.NoError(t, os.WriteFile(src, []byte("---\ntitle: S\n---\nbody\n"), 0o644))
+	victim := filepath.Join(t.TempDir(), "victim.md")
+	require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
+
+	up := strings.Repeat("../", strings.Count(filepath.Clean(brain0), "/")+3)
+	target := "wiki/b/x/" + up + strings.TrimPrefix(victim, "/")
+	err := brain.WriteTunnel(brain0, "wiki/a/facts/s.md", target)
+	assert.Error(t, err)
+	got, rerr := os.ReadFile(victim)
+	require.NoError(t, rerr)
+	assert.Equal(t, "untouched\n", string(got), "a file outside the brain was modified")
+}
+
+func TestWriteTunnelRefusesUncleanOrNonWikiPaths(t *testing.T) {
+	brain0 := t.TempDir()
+	for _, p := range []string{"wiki/a/facts/s.md", "wiki/b/facts/t.md", "wiki/b/facts/t.txt", "raw/r.md"} {
+		require.NoError(t, os.MkdirAll(filepath.Dir(filepath.Join(brain0, p)), 0o755))
+		require.NoError(t, os.WriteFile(filepath.Join(brain0, p), []byte("x\n"), 0o644))
+	}
+	for _, target := range []string{
+		"wiki/b/facts/../../../raw/r.md",
+		"wiki/b/./facts/t.md",
+		"wiki/b//facts/t.md",
+		"/wiki/b/facts/t.md",
+		"wiki/b/facts/t.txt",
+		"wiki/b/facts/",
+	} {
+		assert.Error(t, brain.WriteTunnel(brain0, "wiki/a/facts/s.md", target), target)
+	}
+	for _, p := range []string{"raw/r.md", "wiki/b/facts/t.txt"} {
+		got, err := os.ReadFile(filepath.Join(brain0, p))
+		require.NoError(t, err)
+		assert.Equal(t, "x\n", string(got), p)
+	}
+	require.NoError(t, brain.WriteTunnel(brain0, "wiki/a/facts/s.md", "wiki/b/facts/t.md"), "positive control")
+	got, err := os.ReadFile(filepath.Join(brain0, "wiki", "b", "facts", "t.md"))
+	require.NoError(t, err)
+	assert.Contains(t, string(got), "[[a/facts/s]]")
+}
+
+func TestWriteTunnelDoesNotWriteThroughASymlinkedNote(t *testing.T) {
+	brain0 := t.TempDir()
+	src := filepath.Join(brain0, "wiki", "a", "facts", "s.md")
+	require.NoError(t, os.MkdirAll(filepath.Dir(src), 0o755))
+	require.NoError(t, os.WriteFile(src, []byte("x\n"), 0o644))
+	tdir := filepath.Join(brain0, "wiki", "b", "facts")
+	require.NoError(t, os.MkdirAll(tdir, 0o755))
+	victim := filepath.Join(t.TempDir(), "victim.md")
+	require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
+	require.NoError(t, os.Symlink(victim, filepath.Join(tdir, "t.md")))
+	assert.Error(t, brain.WriteTunnel(brain0, "wiki/a/facts/s.md", "wiki/b/facts/t.md"))
+	got, err := os.ReadFile(victim)
+	require.NoError(t, err)
+	assert.Equal(t, "untouched\n", string(got))
+
+	// The same with a link to a file elsewhere in the brain, which os.Root
+	// would follow.
+	inVictim := filepath.Join(brain0, "raw", "v.md")
+	require.NoError(t, os.MkdirAll(filepath.Dir(inVictim), 0o755))
+	require.NoError(t, os.WriteFile(inVictim, []byte("untouched\n"), 0o644))
+	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "v.md"), filepath.Join(tdir, "u.md")))
+	assert.Error(t, brain.WriteTunnel(brain0, "wiki/a/facts/s.md", "wiki/b/facts/u.md"))
+	got, err = os.ReadFile(inVictim)
+	require.NoError(t, err)
+	assert.Equal(t, "untouched\n", string(got))
+	got, err = os.ReadFile(src)
+	require.NoError(t, err)
+	assert.Equal(t, "x\n", string(got), "the source is not touched when the target is refused")
+}
+
+// The target is swapped between a regular note and a symlink to an in-brain
+// file outside wiki/ while WriteTunnel runs: the read and the write each
+// refuse a symlink, so the other file is never rewritten.
+func TestWriteTunnelNeverRewritesASymlinkSwappedInForTheTarget(t *testing.T) {
+	brain0 := t.TempDir()
+	src := filepath.Join(brain0, "wiki", "a", "facts", "s.md")
+	require.NoError(t, os.MkdirAll(filepath.Dir(src), 0o755))
+	require.NoError(t, os.WriteFile(src, []byte("x\n"), 0o644))
+	tdir := filepath.Join(brain0, "wiki", "b", "facts")
+	require.NoError(t, os.MkdirAll(tdir, 0o755))
+	victim := filepath.Join(brain0, "raw", "victim.md")
+	require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
+	require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
+	tgt := filepath.Join(tdir, "t.md")
+	require.NoError(t, os.WriteFile(tgt, []byte("t\n"), 0o644))
+
+	var stop atomic.Bool
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		tmp := tgt + ".swap"
+		for i := 0; !stop.Load(); i++ {
+			_ = os.Remove(tmp)
+			if i%2 == 0 {
+				_ = os.WriteFile(tmp, []byte("t\n"), 0o644)
+			} else {
+				_ = os.Symlink(filepath.Join("..", "..", "..", "raw", "victim.md"), tmp)
+			}
+			_ = os.Rename(tmp, tgt)
+		}
+	}()
+	ok := 0
+	for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
+		if brain.WriteTunnel(brain0, "wiki/a/facts/s.md", "wiki/b/facts/t.md") == nil {
+			ok++
+		}
+		_ = os.WriteFile(src, []byte("x\n"), 0o644)
+	}
+	stop.Store(true)
+	wg.Wait()
+	got, err := os.ReadFile(victim)
+	require.NoError(t, err)
+	assert.Equal(t, "untouched\n", string(got), "the swapped-in symlink's target was rewritten")
+	assert.Positive(t, ok, "positive control: some tunnels were written to the regular target")
+}

ingestion/internal/brainfs/brainfs.go

@@ -249,3 +249,41 @@ func (b *Brain) WalkRegular(relDir string, fn func(rel string) error, onErr func
 		return fn(p)
 	})
 }
+
+// WriteRegular replaces the contents of an existing regular file at a
+// brain-relative path. It never creates a file and never writes through a
+// final symlink: os.Root.OpenFile follows an in-root final symlink even with
+// O_NOFOLLOW (verified on go1.27), so the path is Lstat-ed through the root
+// first and the opened handle must be that same file (os.SameFile), which
+// also catches a swap between the two. O_NONBLOCK keeps a FIFO from blocking
+// the open. Intermediate in-brain symlinks are still followed (os.Root keeps
+// the write inside the brain; hyperguild#167).
+func (b *Brain) WriteRegular(rel string, data []byte) error {
+	rel = filepath.ToSlash(rel)
+	lfi, err := b.root.Lstat(rel)
+	if err != nil {
+		return err
+	}
+	if !lfi.Mode().IsRegular() {
+		return fmt.Errorf("%s: %w", rel, ErrNotRegular)
+	}
+	f, err := b.root.OpenFile(rel, os.O_WRONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = f.Close() }()
+	fi, err := f.Stat()
+	if err != nil {
+		return err
+	}
+	if !fi.Mode().IsRegular() || !os.SameFile(lfi, fi) {
+		return fmt.Errorf("%s: changed while opening: %w", rel, ErrNotRegular)
+	}
+	if err := f.Truncate(0); err != nil {
+		return err
+	}
+	if _, err := f.Write(data); err != nil {
+		return err
+	}
+	return f.Close()
+}

ingestion/internal/brainfs/brainfs_test.go

@@ -263,6 +263,52 @@ func TestReadRegularNeverReturnsAnInBrainFileSwappedInBehindASymlink(t *testing.
 	assert.Positive(t, ok, "positive control: the regular file is read")
 }
 
+func TestWriteRegularRefusesFinalSymlinksFIFOsEscapesAndMissingFilesAndRewritesRegularFiles(t *testing.T) {
+	dir := t.TempDir()
+	outside := filepath.Join(t.TempDir(), "o.md")
+	require.NoError(t, os.WriteFile(outside, []byte("untouched"), 0o644))
+	require.NoError(t, os.Symlink(outside, filepath.Join(dir, "l.md")))
+	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "f.md"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "n.md"), []byte("old content"), 0o644))
+	b, err := Open(dir)
+	require.NoError(t, err)
+	defer func() { _ = b.Close() }()
+
+	assert.Error(t, b.WriteRegular("l.md", []byte("x")))
+	got, _ := os.ReadFile(outside)
+	assert.Equal(t, "untouched", string(got))
+
+	// A symlink to another file inside the brain: os.Root would allow it,
+	// only O_NOFOLLOW refuses it.
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "in.md"), []byte("inside"), 0o644))
+	require.NoError(t, os.Symlink("in.md", filepath.Join(dir, "il.md")))
+	assert.Error(t, b.WriteRegular("il.md", []byte("x")))
+	got, _ = os.ReadFile(filepath.Join(dir, "in.md"))
+	assert.Equal(t, "inside", string(got))
+
+	// A reader held open, so a non-blocking write open would succeed. The
+	// Lstat type check refuses the FIFO first; the handle check and
+	// O_NONBLOCK matter only if it is swapped in after the Lstat.
+	r, err := os.OpenFile(filepath.Join(dir, "f.md"), os.O_RDONLY|syscall.O_NONBLOCK, 0)
+	require.NoError(t, err)
+	defer func() { _ = r.Close() }()
+	done := make(chan error, 1)
+	go func() { done <- b.WriteRegular("f.md", []byte("x")) }()
+	select {
+	case err := <-done:
+		assert.Error(t, err)
+	case <-time.After(3 * time.Second):
+		t.Fatal("WriteRegular hung on a FIFO")
+	}
+
+	assert.Error(t, b.WriteRegular("../"+filepath.Base(filepath.Dir(outside))+"/o.md", []byte("x")))
+	assert.Error(t, b.WriteRegular("missing.md", []byte("x")), "does not create files")
+
+	require.NoError(t, b.WriteRegular("n.md", []byte("new")))
+	got, _ = os.ReadFile(filepath.Join(dir, "n.md"))
+	assert.Equal(t, "new", string(got), "truncated and rewritten")
+}
+
 func TestReadDirDirsListsOnlyRealSubdirsAndRefusesSymlinkedComponents(t *testing.T) {
 	dir := t.TempDir()
 	require.NoError(t, os.MkdirAll(filepath.Join(dir, "a", "real"), 0o755))

ingestion/internal/session/id_test.go

@@ -0,0 +1,92 @@
+package session
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// session_log passed the caller's session_id straight into
+// filepath.Join(sessionsDir, id+".jsonl") and opened it O_CREATE|O_APPEND:
+// path segments in the id created or appended files anywhere the pod could
+// write. The id is now a plain name, and the open does not follow a final
+// symlink.
+func TestAppendRefusesSessionIDsThatAreNotPlainNames(t *testing.T) {
+	root := t.TempDir()
+	dir := filepath.Join(root, "sessions")
+	for _, id := range []string{"../x", "a/b", "/abs", ".", "..", ".hidden", "", "a\\b", "a\x00b"} {
+		assert.Error(t, Append(dir, id, Entry{SessionID: id}), "%q", id)
+	}
+	ents, _ := os.ReadDir(root)
+	for _, e := range ents {
+		assert.Equal(t, "sessions", e.Name(), "nothing created beside the sessions dir")
+	}
+	for _, id := range []string{"1557b2e1-bf0d-5c4f-bbe3-0754d087e356", "_routing", "2026-05-05-infra.plan", "0"} {
+		require.NoError(t, Append(dir, id, Entry{SessionID: id}), "positive control: %q", id)
+	}
+}
+
+func TestAppendDoesNotWriteThroughASymlinkedLog(t *testing.T) {
+	root := t.TempDir()
+	dir := filepath.Join(root, "sessions")
+	require.NoError(t, os.MkdirAll(dir, 0o755))
+	victim := filepath.Join(root, "victim.md")
+	require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
+	require.NoError(t, os.Symlink(filepath.Join("..", "victim.md"), filepath.Join(dir, "s.jsonl")))
+	assert.Error(t, Append(dir, "s", Entry{SessionID: "s"}))
+	got, _ := os.ReadFile(victim)
+	assert.Equal(t, "untouched\n", string(got))
+}
+
+func TestReadRefusesSessionIDsThatAreNotPlainNames(t *testing.T) {
+	root := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(root, "x.jsonl"), []byte(`{"session_id":"x"}`+"\n"), 0o644))
+	_, err := Read(filepath.Join(root, "sessions"), "../x")
+	assert.Error(t, err)
+}
+
+// A name that starts plainly and then climbs out with ".." is exactly what the
+// ban on "/" in the id's tail stops: filepath.Join cleans "a/../../x" to a
+// path beside the sessions dir without needing sessions/a to exist. The
+// assertion is on the refusal itself (ErrInvalidID), not on any error.
+func TestAppendRefusesAnIDThatClimbsOutAfterAPlainPrefix(t *testing.T) {
+	root := t.TempDir()
+	dir := filepath.Join(root, "sessions")
+	require.NoError(t, os.MkdirAll(dir, 0o755))
+	for _, id := range []string{"a/../../escape", "a/../../../escape", "a/../b"} {
+		err := Append(dir, id, Entry{SessionID: id})
+		assert.ErrorIs(t, err, ErrInvalidID, "%q", id)
+	}
+	_, err := os.Lstat(filepath.Join(root, "escape.jsonl"))
+	assert.True(t, errors.Is(err, os.ErrNotExist), "nothing created beside the sessions dir")
+	_, err = os.Lstat(filepath.Join(dir, "b.jsonl"))
+	assert.True(t, errors.Is(err, os.ErrNotExist), "no in-dir alias created either")
+}
+
+// Append does no Lstat type check, so O_NONBLOCK is the only thing that keeps
+// a FIFO named <id>.jsonl with no reader from blocking session_log forever.
+func TestAppendReturnsPromptlyOnAFIFOLogWithNoReader(t *testing.T) {
+	dir := filepath.Join(t.TempDir(), "sessions")
+	require.NoError(t, os.MkdirAll(dir, 0o755))
+	fifo := filepath.Join(dir, "s.jsonl")
+	require.NoError(t, syscall.Mkfifo(fifo, 0o644))
+	done := make(chan error, 1)
+	go func() { done <- Append(dir, "s", Entry{SessionID: "s"}) }()
+	select {
+	case err := <-done:
+		assert.Error(t, err, "a FIFO with no reader is refused, not written")
+	case <-time.After(3 * time.Second):
+		// Unblock the stuck open so the goroutine and TempDir cleanup finish.
+		if r, err := os.OpenFile(fifo, os.O_RDONLY|syscall.O_NONBLOCK, 0); err == nil {
+			defer r.Close() //nolint:errcheck
+		}
+		<-done
+		t.Fatal("Append blocked on a FIFO log with no reader")
+	}
+}

ingestion/internal/session/session.go

@@ -9,6 +9,8 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
+	"regexp"
+	"syscall"
 	"time"
 )
 
@@ -42,13 +44,32 @@ type Attempt struct {
 	RunnerOutput  string `json:"runner_output,omitempty"`
 }
 
+// idPattern is a plain file name: session_log takes the id from the caller,
+// and a path segment in it created or appended files anywhere the pod could
+// write (hyperguild#169).
+var idPattern = regexp.MustCompile(`^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$`)
+
+// ErrInvalidID is returned when a session id is not a plain file name.
+var ErrInvalidID = errors.New("session id is not a plain name")
+
+func checkID(sessionID string) error {
+	if !idPattern.MatchString(sessionID) {
+		return fmt.Errorf("%w: %q", ErrInvalidID, sessionID)
+	}
+	return nil
+}
+
 // Append writes entry as a single JSON line to sessionsDir/{sessionID}.jsonl.
+// The open does not follow a final symlink.
 func Append(sessionsDir, sessionID string, entry Entry) error {
+	if err := checkID(sessionID); err != nil {
+		return err
+	}
 	if err := os.MkdirAll(sessionsDir, 0o755); err != nil {
 		return fmt.Errorf("create sessions dir: %w", err)
 	}
 	path := filepath.Join(sessionsDir, sessionID+".jsonl")
-	f, err := os.OpenFile(path, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o644)
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_APPEND|os.O_WRONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0o644)
 	if err != nil {
 		return fmt.Errorf("open session log: %w", err)
 	}
@@ -70,6 +91,9 @@ func Append(sessionsDir, sessionID string, entry Entry) error {
 
 // Read returns all entries for sessionID. Returns empty slice if no log exists.
 func Read(sessionsDir, sessionID string) ([]Entry, error) {
+	if err := checkID(sessionID); err != nil {
+		return nil, err
+	}
 	path := filepath.Join(sessionsDir, sessionID+".jsonl")
 	f, err := os.Open(path)
 	if errors.Is(err, fs.ErrNotExist) {

ingestion/internal/startupretry/startupretry.go

@@ -0,0 +1,75 @@
+// Package startupretry retries a startup dependency that may not be serving
+// yet, instead of exiting on its first failure.
+//
+// It exists for the cold-boot ordering race (#83): on a cluster restart the
+// ingestion pod can reach OIDC discovery before dex is answering, gets a 502
+// from ingress, and dies — after having already connected postgres, backfilled
+// the graph and ingested session batches, all of which the restart redoes.
+// Nothing is misconfigured in that scenario; the pod simply started first.
+//
+// The budget is bounded on purpose. Retrying forever would turn a genuine
+// misconfiguration (wrong issuer URL, bad audience) into a process that looks
+// healthy and never serves, which is harder to diagnose than a crash loop.
+package startupretry
+
+import (
+	"context"
+	"fmt"
+	"time"
+)
+
+// Policy bounds the retry: at most Attempts calls, with the delay doubling
+// from Base and capped at Max.
+type Policy struct {
+	Attempts int           // total calls, including the first; < 1 means 1
+	Base     time.Duration // delay before the second attempt
+	Max      time.Duration // ceiling for the doubling delay
+}
+
+// Do calls fn until it succeeds, the attempt budget is spent, or ctx ends.
+//
+// The returned error wraps the last failure, so callers keep the diagnosis
+// they would have had without the retry.
+func Do[T any](ctx context.Context, p Policy, fn func(context.Context) (T, error)) (T, error) {
+	var zero T
+
+	attempts := p.Attempts
+	if attempts < 1 {
+		attempts = 1
+	}
+
+	delay := p.Base
+	var lastErr error
+
+	for i := range attempts {
+		if err := ctx.Err(); err != nil {
+			return zero, fmt.Errorf("startupretry: %w", err)
+		}
+
+		v, err := fn(ctx)
+		if err == nil {
+			return v, nil
+		}
+		lastErr = err
+
+		if i == attempts-1 {
+			break
+		}
+
+		if delay <= 0 {
+			delay = time.Second
+		}
+		if p.Max > 0 && delay > p.Max {
+			delay = p.Max
+		}
+
+		select {
+		case <-ctx.Done():
+			return zero, fmt.Errorf("startupretry: %w", ctx.Err())
+		case <-time.After(delay):
+		}
+		delay *= 2
+	}
+
+	return zero, fmt.Errorf("startupretry: gave up after %d attempts: %w", attempts, lastErr)
+}

ingestion/internal/startupretry/startupretry_test.go

@@ -0,0 +1,142 @@
+// ingestion/internal/startupretry/startupretry_test.go
+package startupretry
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+)
+
+func fastPolicy(attempts int) Policy {
+	return Policy{Attempts: attempts, Base: time.Millisecond, Max: 2 * time.Millisecond}
+}
+
+func TestDo_ReturnsImmediatelyOnFirstSuccess(t *testing.T) {
+	calls := 0
+	got, err := Do(context.Background(), fastPolicy(5), func(context.Context) (string, error) {
+		calls++
+		return "ready", nil
+	})
+	if err != nil {
+		t.Fatalf("Do: %v", err)
+	}
+	if got != "ready" {
+		t.Errorf("got %q, want %q", got, "ready")
+	}
+	if calls != 1 {
+		t.Errorf("calls = %d, want 1", calls)
+	}
+}
+
+func TestDo_SurvivesTransientFailuresThenSucceeds(t *testing.T) {
+	// The observed cold-boot race: dex is not serving yet, ingress answers
+	// 502 for the first few attempts, then discovery works.
+	calls := 0
+	got, err := Do(context.Background(), fastPolicy(5), func(context.Context) (string, error) {
+		calls++
+		if calls < 4 {
+			return "", errors.New("oidc discovery: status 502")
+		}
+		return "ready", nil
+	})
+	if err != nil {
+		t.Fatalf("Do returned %v — a transient 502 must not be fatal", err)
+	}
+	if got != "ready" {
+		t.Errorf("got %q, want %q", got, "ready")
+	}
+	if calls != 4 {
+		t.Errorf("calls = %d, want 4", calls)
+	}
+}
+
+func TestDo_GivesUpAfterTheAttemptBudgetAndReportsTheLastError(t *testing.T) {
+	// A genuinely broken issuer must still fail — retrying forever would turn
+	// a config error into a silent hang, which is worse than crash-looping.
+	last := errors.New("oidc discovery: status 404")
+	calls := 0
+
+	_, err := Do(context.Background(), fastPolicy(3), func(context.Context) (string, error) {
+		calls++
+		return "", last
+	})
+
+	if !errors.Is(err, last) {
+		t.Fatalf("err = %v, want it to wrap the last failure", err)
+	}
+	if calls != 3 {
+		t.Errorf("calls = %d, want 3 (the attempt budget)", calls)
+	}
+}
+
+func TestDo_StopsPromptlyWhenTheContextIsCancelled(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	calls := 0
+
+	done := make(chan struct{})
+	var err error
+	go func() {
+		defer close(done)
+		_, err = Do(ctx, Policy{Attempts: 100, Base: 50 * time.Millisecond, Max: time.Second},
+			func(context.Context) (string, error) {
+				calls++
+				if calls == 1 {
+					cancel()
+				}
+				return "", errors.New("still down")
+			})
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Do did not return after context cancellation")
+	}
+	if !errors.Is(err, context.Canceled) {
+		t.Errorf("err = %v, want context.Canceled", err)
+	}
+}
+
+func TestDo_BacksOffAndIsCappedByMax(t *testing.T) {
+	var delays []time.Duration
+	p := Policy{Attempts: 5, Base: 10 * time.Millisecond, Max: 25 * time.Millisecond}
+
+	last := time.Now()
+	_, _ = Do(context.Background(), p, func(context.Context) (string, error) {
+		now := time.Now()
+		delays = append(delays, now.Sub(last))
+		last = now
+		return "", errors.New("down")
+	})
+
+	// delays[0] is the first call (no wait); the rest are the sleeps.
+	if len(delays) != 5 {
+		t.Fatalf("attempts = %d, want 5", len(delays))
+	}
+	if delays[1] >= delays[2] {
+		t.Errorf("backoff is not growing: %v then %v", delays[1], delays[2])
+	}
+	for i, d := range delays[1:] {
+		if d > 2*p.Max {
+			t.Errorf("delay %d = %v, exceeds the Max cap %v with slack", i+1, d, p.Max)
+		}
+	}
+}
+
+func TestPolicy_ZeroValueStillMakesOneAttempt(t *testing.T) {
+	// A caller that forgets to configure the policy must not silently get a
+	// no-op that returns a nil validator and a nil error.
+	calls := 0
+	_, err := Do(context.Background(), Policy{}, func(context.Context) (string, error) {
+		calls++
+		return "", errors.New("down")
+	})
+
+	if calls != 1 {
+		t.Errorf("calls = %d, want 1", calls)
+	}
+	if err == nil {
+		t.Error("err = nil, want the failure surfaced")
+	}
+}