mathias

mathias pushed to fix/search-root-157 at mathias/hyperguild

2026-10-03 16:32:41 +00:00

fd33e04467 test(search): hold a writer on swapped-in FIFOs; await the swapper

mathias pushed to fix/brainwide-root-157 at mathias/hyperguild

2026-10-03 16:30:48 +00:00

4ba9d20b4e fix(ingestion): tripwire alerts survive outages; drop only permanent rejections

mathias commented on issue mathias/hyperguild#157

2026-10-03 16:28:26 +00:00

SECURITY: symlinks anywhere in the Syncthing-shared brain dir are followed by search, vectorstore, context and graph readers

Gatekeeper round 2 on PR #161 (head ffe46c7): BLOCK. Details are on the PR.

The unit tests now pin readOpened, Rel and WalkRegular. Remaining: nothing checks that ReadRegular goes through…

mathias commented on pull request mathias/hyperguild#161

2026-10-03 16:28:26 +00:00

fix(search): walk and read the brain through an os.Root (#157, slice 1)

Gatekeeper verdict, round 2: BLOCK (head ffe46c7)

Close. One gap is left, with the same shape as #156 round 2: the check has a unit test, but nothing checks that its caller uses it.

###…

mathias commented on pull request mathias/hyperguild#160

2026-10-03 16:28:12 +00:00

feat(ingestion): runtime symlink tripwire removes what it finds, 30s scans (#157)

pr-gatekeeper verdict, round 2: BLOCK (PR #160 @ 01de163). Not merged.

Round-1 findings 1, 3 and 4 are closed, and I verified each by execution. CI run 8916 is green. The fix for finding 2…

mathias commented on issue mathias/hyperguild#157

2026-10-03 16:28:12 +00:00

SECURITY: symlinks anywhere in the Syncthing-shared brain dir are followed by search, vectorstore, context and graph readers

pr-gatekeeper verdict, round 2: BLOCK (PR #160 @ 01de163). Not merged.

Round-1 findings 1, 3 and 4 are closed, and I verified each by execution. CI run 8916 is green. The fix for finding 2…

mathias pushed to fix/search-root-157 at mathias/hyperguild

2026-10-03 16:26:28 +00:00

ffe46c7077 test(brainfs): pin the handle check with a FIFO held open by a writer

mathias commented on issue mathias/hyperguild#157

2026-10-03 16:25:09 +00:00

SECURITY: symlinks anywhere in the Syncthing-shared brain dir are followed by search, vectorstore, context and graph readers

Gatekeeper review of PR #161 (slice 1, search, head 9c9ba31): BLOCK. Details are on the PR.

Symlinks at every depth, symlinked wing and hall filters, and symlinked wiki/ and knowledge/ roots…

mathias commented on pull request mathias/hyperguild#161

2026-10-03 16:25:08 +00:00

fix(search): walk and read the brain through an os.Root (#157, slice 1)

Gatekeeper verdict: BLOCK (head 9c9ba31)

The control held under every probe. One load-bearing check has no test.

What survived (run in a scratch clone, sentinel counted, contents never…

mathias opened issue mathias/hyperguild#163

2026-10-03 16:24:32 +00:00

ntfy notifier hard-codes the title "brain-capture audit degraded" for every alert

mathias pushed to fix/brainwide-root-157 at mathias/hyperguild

2026-10-03 16:24:15 +00:00

01de163452 fix(ingestion): bound the tripwire's alerts; test removal guards; deflake race tests

mathias commented on issue mathias/hyperguild#157

2026-10-03 16:21:34 +00:00

SECURITY: symlinks anywhere in the Syncthing-shared brain dir are followed by search, vectorstore, context and graph readers

One consequence of the auto-remove decision that the record above didn't spell out (from the PR #160 review): the brain dir is a Syncthing sendreceive folder, so a symlink the tripwire removes…

mathias commented on issue mathias/hyperguild#157

2026-10-03 16:21:02 +00:00

SECURITY: symlinks anywhere in the Syncthing-shared brain dir are followed by search, vectorstore, context and graph readers

pr-gatekeeper verdict: BLOCK (PR #160 @ 504feb3). Not merged.

The removal itself is correct, and I verified that by execution (table below). Two things block. CI is red, and the alert path…

mathias commented on pull request mathias/hyperguild#160

2026-10-03 16:21:02 +00:00

feat(ingestion): runtime symlink tripwire removes what it finds, 30s scans (#157)

pr-gatekeeper verdict: BLOCK (PR #160 @ 504feb3). Not merged.

The removal itself is correct, and I verified that by execution (table below). Two things block. CI is red, and the alert path…

mathias opened issue mathias/hyperguild#162

2026-10-03 16:20:37 +00:00

test(ingestion): raw swap-race tests do not join the swapper goroutine; TempDir cleanup flakes CI

mathias created pull request mathias/hyperguild#161

2026-10-03 16:19:10 +00:00

fix(search): walk and read the brain through an os.Root (#157, slice 1)

mathias pushed to fix/search-root-157 at mathias/hyperguild

2026-10-03 16:18:55 +00:00

9c9ba31770 fix(search): walk and read the brain through an os.Root (#157, slice 1)

mathias created branch fix/search-root-157 in mathias/hyperguild

2026-10-03 16:18:55 +00:00

mathias created pull request mathias/hyperguild#160

2026-10-03 16:16:58 +00:00

feat(ingestion): runtime symlink tripwire removes what it finds, 30s scans (#157)

mathias created branch fix/brainwide-root-157 in mathias/hyperguild

2026-10-03 16:16:45 +00:00