Skip to content

Clarify namespace and cached-observation contracts #764

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seathatflowsinourveins wants to merge 4 commits into from
Closed

Clarify namespace and cached-observation contracts #764

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5255e34
docs: clarify namespace and cached-observation contracts
seathatflowsinourveins Oct 6, 2026
cc6b814
evidence: register secret-storage lessons last
seathatflowsinourveins Oct 6, 2026
9418130
docs: correct cached timestamps and keyed source citations
seathatflowsinourveins Oct 6, 2026
5fc2e8d
chore: register corrected secret-storage sources last
seathatflowsinourveins Oct 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions catalogs/foundation/upstream-surface-dispositions.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,7 +203,7 @@
"key": "claude:env:CLAUDE_CODE_ENABLE_TELEMETRY",
"disposition": "enabled",
"reason": "set in the user settings of both hosts (read 2026-10-04); the cited record names it",
"source": "docs/secret-storage.md:1685",
"source": "docs/secret-storage.md:1714",
"carrier": "host user settings",
"value": null,
"scope": "both",
Expand Down Expand Up @@ -731,7 +731,7 @@
"key": "claude:env:OTEL_LOG_ASSISTANT_RESPONSES",
"disposition": "enabled",
"reason": "set in the user settings of both hosts (read 2026-10-04); the cited record names it",
"source": "docs/secret-storage.md:1672",
"source": "docs/secret-storage.md:1701",
"carrier": "host user settings",
"value": null,
"scope": "both",
Expand All @@ -755,7 +755,7 @@
"key": "claude:env:OTEL_LOG_RAW_API_BODIES",
"disposition": "enabled",
"reason": "set in the user settings of both hosts (read 2026-10-04); the cited record names it",
"source": "docs/secret-storage.md:1674",
"source": "docs/secret-storage.md:1703",
"carrier": "host user settings",
"value": null,
"scope": "both",
Expand All @@ -767,7 +767,7 @@
"key": "claude:env:OTEL_LOG_TOOL_CONTENT",
"disposition": "enabled",
"reason": "set in the user settings of both hosts (read 2026-10-04); the cited record names it",
"source": "docs/secret-storage.md:1674",
"source": "docs/secret-storage.md:1703",
"carrier": "host user settings",
"value": null,
"scope": "both",
Expand All @@ -791,7 +791,7 @@
"key": "claude:env:OTEL_LOG_USER_PROMPTS",
"disposition": "enabled",
"reason": "set in the user settings of both hosts (read 2026-10-04); the cited record names it",
"source": "docs/secret-storage.md:1672",
"source": "docs/secret-storage.md:1701",
"carrier": "host user settings",
"value": null,
"scope": "both",
Expand Down
29 changes: 29 additions & 0 deletions docs/secret-storage.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -261,6 +261,13 @@ not a boundary.
hosts (`adoption/manifest.json` `authentication_transfer:
native_login_on_target_only`).

If a credential store is supplied through a mount, check its visibility in the
consuming process's mount namespace. The process's `/proc/<pid>/mountinfo` view
is the relevant observation; a mount seen by another process or a general claim
about Administrator or WSL state does not establish that view. Treat restart
visibility as unverified until it is observed from the consumer after that restart.
See [Linux mount_namespaces(7), DESCRIPTION](https://man7.org/linux/man-pages/man7/mount_namespaces.7.html#DESCRIPTION).

## Adding or rotating a key without pasting it anywhere

Never paste a key into a chat, an issue, a prompt or a command line. Run:
Expand Down Expand Up @@ -1346,6 +1353,28 @@ synchronization; it is deliberately authorized with no body on 20128 and 21128.
is 20129-only. Body absence is explicit: even an empty string, object or body-file
option is body-present; no file is opened to decide this.

At the cited OmniRoute pin, `GET /api/usage/provider-limits` reads cached data
through `getSanitizedCachedProviderLimitsMap()`, while `POST` calls
`syncAllProviderLimits({ source: "manual" })`. The cached reader rewrites only
Antigravity/agy quota keys; its sanitization name does not certify that every
returned field is safe to publish. Review the exact route and helper before
publishing value-free observations
([diegosouzapw/OmniRoute@c1e30b76, route.ts:13–38](https://github.com/diegosouzapw/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/usage/provider-limits/route.ts#L13-L38),
[cached reader, providerLimits.ts:686–724](https://github.com/diegosouzapw/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/lib/usage/providerLimits.ts#L686-L724),
[quota sanitizer, providerLimits.ts:160–169](https://github.com/diegosouzapw/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/lib/usage/providerLimits.ts#L160-L169)).

`lastAutoSyncAt` records only the last scheduled bulk sync. Retain it and
`intervalMinutes` as scheduler metadata. A manual POST, per-connection refresh
or post-usage refresh can update the cache without advancing that bulk-sync
stamp. Date each cached entry by its own `fetchedAt` and retain its recorded
`source`; an error-only refresh can preserve a prior entry and its metadata
([timestamp getter, providerLimits.ts:668–676](https://github.com/diegosouzapw/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/lib/usage/providerLimits.ts#L668-L676),
[bulk-sync writer, providerLimits.ts:1028–1034](https://github.com/diegosouzapw/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/lib/usage/providerLimits.ts#L1028-L1034),
[post-usage refresh, providerLimits.ts:117–133](https://github.com/diegosouzapw/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/lib/usage/providerLimits.ts#L117-L133),
[per-connection refresh, route.ts:14–23](https://github.com/diegosouzapw/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/usage/%5BconnectionId%5D/route.ts#L14-L23),
[entry fields, providerLimitsCache.ts:22–38](https://github.com/diegosouzapw/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/lib/usage/providerLimitsCache.ts#L22-L38),
[prior-entry preservation, providerLimitsCache.ts:40–49](https://github.com/diegosouzapw/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/lib/usage/providerLimitsCache.ts#L40-L49)).

Method and query evidence are associated with each request. Curl's last explicit
`-X` controls its wire method; otherwise data/form means POST, upload PUT and
`-I` HEAD. `-G` moves computable literal data into the query and changes the
Expand Down
6 changes: 3 additions & 3 deletions manifests/evidence.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16028,7 +16028,7 @@
},
{
"path": "catalogs/foundation/upstream-surface-dispositions.json",
"sha256": "7a11c341ad0c194ae42e4bcd8fc0fc61c3765bb871e97fec31bef03f3c933594",
"sha256": "4255ca9f74fa9472707006de37e1337e0601eba126a430494e764d41cc75be59",
"bytes": 155287
},
{
Expand Down Expand Up @@ -17398,8 +17398,8 @@
},
{
"path": "docs/secret-storage.md",
"sha256": "61039915b9fe31c5931f3cffbd60bdc686fa3433a495ce91dd56501bb67b0ef7",
"bytes": 184073
"sha256": "296be9b2b1c66ce6f4305826dc0f1bc70837eb0e625616d2a32fb8ea7361d5d1",
"bytes": 187056
},
{
"path": "docs/stack.md",
Expand Down
Loading