Skip to content

fix: input validation guards and pack hardening#2

Merged
ohdearquant merged 3 commits into
mainfrom
fix/input-validation-guards
Jun 7, 2026
Merged

fix: input validation guards and pack hardening#2
ohdearquant merged 3 commits into
mainfrom
fix/input-validation-guards

Conversation

@ohdearquant

Copy link
Copy Markdown
Owner

Summary

  • Reject empty/whitespace entity names on create
  • Reject self-loop edges where source_id == target_id on link
  • Add include_deleted flag to get for soft-deleted entity inspection
  • Expand brain.feedback help text from 3 → 8 signal values
  • Validate scheduled action verbs exist in registry at creation time
  • Fix comm.inbox(limit=0) returning 1 message instead of 0
  • Add raw_score regression test for tag-filtered memory.recall
  • Add get_entity_including_deleted to EntityStore trait + runtime

Test plan

  • create(kind="concept", name="")"name must not be empty"
  • link(source_id=X, target_id=X)"self-loop edges are not allowed"
  • get(id=X) after delete → "not found"; get(id=X, include_deleted=true) → returns entity with deleted_at
  • brain.feedback(help=true) → lists all 8 signals
  • schedule.schedule(action="fake_verb()") → rejected
  • comm.inbox(limit=0){messages: [], count: 0}
  • cargo check + clippy clean

🤖 Generated with Claude Code

ohdearquant and others added 3 commits June 7, 2026 00:43
- Reject empty/whitespace entity names on create (kg)
- Reject self-loop edges where source_id == target_id (kg)
- Add include_deleted flag to get verb for soft-deleted entities (kg)
- Expand brain.feedback help to list all 8 signal values (brain)
- Validate action verb exists in registry at schedule creation time (schedule)
- Return empty list for comm.inbox(limit=0) instead of 1 message (comm)
- Add raw_score regression test for tag-filtered recall (memory)
- Add get_entity_including_deleted to EntityStore trait (storage/runtime)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Finding 1 (High): schedule verb validation now accepts bare shorthand
"remind(...)" in addition to "schedule.remind(...)" by falling back to
the prefixed form in describe_verb; error hint updated to show the
fully-qualified form.

Finding 2 (High): self-loop rejection moved from the single-link handler
path into validate_edge_relation_endpoints in the runtime, so atomic
bulk and non-atomic bulk link paths are also covered. Existing phantom-
self-loop test updated to expect InvalidInput (the runtime fires before
NotFound because the UUID check is skipped).

Finding 3 (Medium): no code change — include_deleted param description in
handler_defs.rs now documents that a full UUID is required when using
include_deleted=true (short prefix resolution filters deleted records;
the delete response always returns the full UUID).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@ohdearquant ohdearquant merged commit aab5df8 into main Jun 7, 2026
3 checks passed
@ohdearquant ohdearquant deleted the fix/input-validation-guards branch June 7, 2026 15:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant