feat(ingestion): runtime symlink tripwire removes what it finds, 30s scans (#157) #160

Merged

mathias merged 3 commits from fix/brainwide-root-157 into main 2026-10-03 19:34:19 +00:00

Conversation 3 Commits 3 Files Changed 6

+519 -48

3 Commits

Author	SHA1	Message	Date
mathiasandClaude Opus 5.5	4ba9d20b4e	fix(ingestion): tripwire alerts survive outages; drop only permanent rejections ... PR #160 round 2: dropping a message after 5 failures could not tell a poison message from an ntfy outage. A 15-minute outage dropped the only incident with nothing reported, and drops were not counted (74 of 300 removals were neither delivered nor counted). - audit.NtfyNotifier returns *RejectedError for non-2xx; Permanent() is true for 4xx other than 429. - The tripwire queue drops a message only on a permanent rejection and counts it; every other failure is an outage and is retried, however long. Each flush tries every queued message, so an undeliverable one cannot block the rest. - Overflow and drops go into one counter, sent as a summary retried every tick and never dropped. Every removal is delivered or counted. Tests (red first): an outage of ~100 ticks still delivers the only incident; delivered + counted equals the number of removals; a permanently rejected message is dropped and counted. The short-outage test is renamed to say it is short. The Watch doc no longer claims 'loses none' unconditionally. Refs #157 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 18:30:46 +02:00
mathiasandClaude Opus 5.5	01de163452	fix(ingestion): bound the tripwire's alerts; test removal guards; deflake race tests ... PR #160 review: - The planter chooses the paths, and one alert listed them all, while the queue retried oldest-first forever: a message ntfy refuses (too large) blocked every later alert (2000 links: 0 alerts delivered), and an outage queued one message per removal, unbounded. Alerts now name at most 10 paths and count the rest; the queue holds at most 5, further alerts become one suppression summary; a message failing 5 times is dropped so it cannot block the rest. - removeSymlinks' Lstat re-check had no test: a direct test passes a regular file, a path through an in-brain dir link, a ../ escape and a missing path, and asserts all fail with nothing deleted. A Watch test covers dir and in-brain targets. root.Remove (not RemoveAll) is commented: it refuses a dir swapped in after the Lstat. - Every queued alert is delivered after an outage (truncating the queue after the first send is now red). - hyperguild#162: race tests did not wait for their swapper goroutines before t.TempDir cleanup ("directory not empty" in CI run 8912). Each swapper is now stopped and awaited in a t.Cleanup. Fixes #162 Refs #157 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 18:24:13 +02:00
mathiasandClaude Opus 5.5	504feb372f	feat(ingestion): the runtime symlink tripwire removes what it finds ... Decision (#157): the tripwire only alerted, so a symlink planted in the Syncthing-shared brain dir stayed readable until a human removed it. Watch now unlinks every symlink it finds through an os.Root on the brain dir (re-checking it is still a symlink; the target is never touched), and the default scan interval drops from 5 min to 30 s, so a planted link is readable for at most one interval. Each removal is an alert naming what was removed; a persistent finding (a link it could not remove, an unreadable dir, a scan error) alerts once per distinct state. Alerts queue until Notify succeeds, so an ntfy outage delays them without losing them, even though the next scan of the cleaned brain is clean. The startup check still refuses to start on any symlink. Refs #157 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 18:16:43 +02:00