mathiasandClaude Sonnet 5 e2cb315b31 fix(api): validate the merged envelope on supersede, not the caller's fragment ...

Review caught a real bypass in the #111 fix before merge: the previous
commit validated only the frontmatter fence the caller supplied, not the
merged result that actually reaches disk. A caller could blank
claim_provenance alone (absent per claim.present's "empty is unset" rule)
while half_life/applies survived untouched from the prior note — each side
individually looked fine, the merged envelope on disk was the
unprovenanced one the whole check exists to catch. That's the exact
laundering #111 named as the worse of its two gaps.

Fixed by computing the envelope from fm (post-merge, pre-write) instead of
contentFM (the caller's raw fragment). Flip-tested: reverting to
fragment-only validation turns the new adversarial test red; the merged
validation turns it green.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-09-22 23:24:50 +02:00

..

cmd

feat(claudewatcher): exclude whole project directories from ingestion

2026-09-15 08:09:58 +02:00

internal

fix(api): validate the merged envelope on supersede, not the caller's fragment

2026-09-22 23:24:50 +02:00

Dockerfile

fix(ci): allow ingestion Dockerfile to fetch internal gitea modules

2026-05-22 12:12:09 +02:00

go.mod

feat(webhook): trigger brain-sync on Gitea push instead of 15-min poll

2026-07-07 22:00:56 +02:00

go.sum

feat(webhook): trigger brain-sync on Gitea push instead of 15-min poll

2026-07-07 22:00:56 +02:00