Decision (Mathias, 2026-10-03): both, auto-remove first.
- Now: the runtime tripwire unlinks any symlink it finds (the link only, never the target), scans every 30s by default instead of…
Shipped and verified live. PR #156 squash-merged as 687afa0 after 5 adversarial review rounds (Mathias pre-approved merging on PASS). CD rolled out ingestion:687afa0; /pending with the…
687afa0145
fix(ingestion): brain/raw/ readers go through an os.Root; symlinks are inert (#153) (#156)
Gatekeeper round 5 on PR #156 (head 8e88dde): PASS. Evidence is on the PR.
Every flip in the table goes red (the race tests caught 10/10 or 5/5 of the flips). No flakiness under -count=20,…
Gatekeeper verdict, round 5: PASS (head 8e88dde)
Production code is identical to 87c80e4 (git diff 87c80e4..8e88dde, excluding tests, is empty). All round-1 probes were last run against…
Tripwire half (option 2) shipped and verified live. PR #159 squash-merged as cad389f after 3 adversarial review rounds; Mathias approved the merge. CD rolled out ingestion:cad389f, the pod…
Gatekeeper round 4 on PR #156 (head d5b2be0): BLOCK, one item left. Details are on the PR.
The race tests caught 10/10 of my flips, still caught them under CPU starvation, and showed no…
Gatekeeper verdict, round 4: BLOCK (head d5b2be0). One item left.
Verified by running it
- The race tests detect reliably. Each flip was run 10 times; every run went red: -…
pr-gatekeeper verdict, round 3: PASS (PR #159 @ cda18e6). Not merged.
This is a verdict only. The PR is risk/high, so the merge is Mathias's call (CD deploys on merge).
Blocking…
pr-gatekeeper verdict, round 3: PASS (PR #159 @ cda18e6). Not merged.
This is a verdict only. The PR is risk/high, so the merge is Mathias's call (CD deploys on merge).
Blocking…
Same class, added from the PR #159 review: the symlink tripwire's wiring in ingestion/cmd/server/main.go (startupSymlinkCheck(brainDir) before any reader starts, and `go symlinkguard.Watch(...)…