Guard private memory artifacts from delivery

[kelvmg]

Summary

• keep context compaction handoff summaries out of assistant-role transcript turns
• filter context compaction handoffs from session_search discovery/scroll output
• deny media delivery of profile MEMORY.md, USER.md, and memories/ artifacts
• add regression coverage for compression, session_search hygiene, and gateway media path validation

Test Plan

• python3 -m pytest tests/gateway/test_platform_base.py tests/tools/test_session_search.py tests/run_agent/test_compression_boundary.py -q
• python3 -m ruff check agent/context_compressor.py gateway/platforms/base.py tools/session_search_tool.py tests/gateway/test_platform_base.py tests/tools/test_session_search.py tests/run_agent/test_compression_boundary.py

[teknium1]

Thanks for the privacy-focused coverage. The memory-delivery and session-search directions still address gaps on current main, but the compaction hunk needs rework before salvage.

Problems

• agent/context_compressor.py PR line 1998 forces every standalone handoff to role="user". Current main deliberately selects against both neighbors and merges on double collisions (agent/context_compressor.py:3127-3144). In the reverse case—user head, assistant tail—the PR creates adjacent user turns; current regression coverage requires an assistant summary there (tests/agent/test_context_compressor.py:1942-1973, 2188-2228).
• Session-search filtering does not cover direct reads (tools/session_search_tool.py:227-250) or title-match discovery (tools/session_search_tool.py:462-489), both of which can return stored handoffs.

Suggested changes

• Preserve current main's role-selection, forced-leading-user, and merge logic; apply transcript hygiene at retrieval/rendering boundaries instead.
• Apply handoff filtering across every session_search shape and add direct-read/title-match coverage.
• Test the production memory locations under memories/MEMORY.md and memories/USER.md (tools/memory_tool.py:55-57).

This is an automated hermes-sweeper review.

[teknium1]

Forcing user here loses the protected-head check. If the head ends in user and the tail begins with assistant, this inserts adjacent user turns. Current main handles that reverse double collision by merging into the tail; please retain the two-neighbor role selection rather than making every summary a user turn.

[GottZ]

This was generated by AI during triage.

Summary

Three PRs are associated with this complex, but only #37003 addresses the reported privacy exposure by changing compaction handling, session-search rendering, and media-delivery denylisting. #46938 and #46940 make the same test-comment cleanup and do not address the privacy cause.

Related pull requests

• #37003 related — (+143/-23) — keep open for rework: The media denylist directly protects profile MEMORY.md, USER.md, and memories/ artifacts, and the session-search changes hide some compaction handoffs. As the contributor keep_open review notes, however, the compaction role change conflicts with current alternation/merge behavior, while direct reads and title-match discovery remain unfiltered, so the fix is not yet complete.
• #46938 [closed] related — (+1/-1) — superseded duplicate: This closed PR only removes stale “THE BUG” wording from a compression-boundary test and does not change behavior or address the privacy cause; it remains relevant as the earlier version superseded by refreshed #46940.
• #46940 related — (+1/-1) — mergeable cleanup: This accurately removes the same stale test-docstring wording from its current path, consistent with the contributor keep_open review, but it does not change runtime behavior or address #37003’s privacy gaps.

Duplicates

#46938 and #46940 are substantively identical one-line test-comment cleanups; #46940 is the refreshed current-path version, while #46938 is already closed.

Suggested consolidation

Merge #46940 as the current, accurate cleanup and retain #46938 as its closed superseded duplicate. Keep #37003 open but require rework before merge: preserve current compaction role-selection and merge invariants, move transcript hygiene to retrieval/rendering boundaries, and cover direct-read and title-match session_search paths; this follows rather than overrides the contributor keep_open review on #37003.

Cross-PR triage: Reviewed 3 pull requests and 0 issues in this complex. Each diff was read against this issue; Assessment working set: 14 kB of PR diffs, 1 kB of issue/PR text, 2 kB of discussion (3 comments), 1 verify verdict. verdicts reflect diff content, not PR titles. Part of an automated triage batch.