feat: authorized one-hop graph expansion with server-bounded examination (#151) - #202
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (46)
📝 WalkthroughWalkthroughThis PR activates ADR-0093: rich Markdown v3 compilation moves to a leased, isolated Supply-worker subprocess; file-scan preflight drops compilation and refusal classification; an immutable, content-free revision link graph is extracted, persisted, and secured with a graph-definer role; and the runtime gains bounded, authorized one-hop expansion with dedicated ranking. ChangesLeased Markdown v3 and one-hop graph expansion
Estimated code review effort: 5 (Critical) | ~150 minutes Sequence Diagram(s)sequenceDiagram
participant Worker as Supply Worker
participant Runner as leased_compiler_runner (subprocess)
participant Compiler as compile_rich_markdown
participant LinkGraph as extract_revision_links
participant DB as revision_link_edge table
Worker->>Runner: launch subprocess (source, config, timeout)
Runner->>Compiler: compile_rich_markdown(stdin)
Compiler-->>Runner: parsed document or failure
Runner-->>Worker: JSON envelope (base64 doc or failure code)
Worker->>LinkGraph: extract_revision_links(document, source_path)
LinkGraph-->>Worker: RevisionLink tuples
Worker->>DB: persist revision snapshot + revision_link_edge rows
sequenceDiagram
participant Runtime
participant Kernel as AuthorizationKernel
participant Membership as membership_context.discover_one_hop
participant Graph as context_runtime_resolve_one_hop_graph (DB)
participant Ranker as rank_authorized_one_hop
Runtime->>Runtime: resolve authorized main-path results
Runtime->>Membership: discover_one_hop(anchors, limit, offset)
Membership->>Graph: query bounded one-hop edges
Graph-->>Membership: candidate rows
Membership-->>Runtime: MaterializedOneHopCandidate list
Runtime->>Kernel: authorize_one_hop(candidates)
Kernel-->>Runtime: AuthorizationDecision (expanded_candidate_refs)
Runtime->>Ranker: rank_authorized_one_hop(query, projections)
Ranker-->>Runtime: ranked CandidateRankEvidence
Runtime-->>Runtime: select delivery excluding unranked expansions
Possibly related issues
Possibly related PRs
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a76d0377ca
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| expanded.organization_id = expanded.anchor_organization_id | ||
| AND expanded.source_ref = expanded.anchor_source_ref | ||
| AND expanded.resource_ref = expanded.anchor_resource_ref | ||
| AND expanded.revision_id = expanded.anchor_revision_id | ||
| AND expanded.fragment_ref = expanded.anchor_fragment_ref |
There was a problem hiding this comment.
When two authorized main-path results are linked—for example, A links to B and both fragments were returned by initial retrieval—this predicate excludes a row only when it matches its own originating anchor, so B can still be returned as a candidate rooted at A. _discover_materialized_one_hop then rejects any candidate equal to any anchor and raises ValueError, failing the entire Acquire request; exclude candidates matching the complete requested anchor set before returning the page.
Useful? React with 👍 / 👎.
| source_text = "\n".join( | ||
| section.text | ||
| for section in document.sections | ||
| if section.kind is not SectionKind.FENCED_CODE |
There was a problem hiding this comment.
When a long paragraph is split at the rich compiler's token ceiling, joining document.sections with a newline changes the original source at each split. If that boundary falls inside a whitespace-containing construct such as [[Target Note]] or an angle-bracketed reference target, the regexes—which reject newlines inside targets—silently omit a valid graph edge; adapters/parsers/ragflow_markdown.py:685-693 shows these splits can occur between any two non-whitespace tokens, so extraction should preserve the original inter-section source span or derive links before splitting.
Useful? React with 👍 / 👎.
1 participant
What
Authorized one-hop graph expansion + evaluation slices (ADR-0093; migration 0052):
engine/supply/link_graph.py): deterministic edges from validated v3 section source intorevision_link_edge(six columns — refs/ordinals/kind only, no content, no per-edge ACL; path traversal blocked at construction; the staleLINK_OR_IMAGErefusal claim was re-verified and retired post-[M1] Tier-1 compiler-runner: vendor RAGFlow markdown parser #124).main_projectionssnapshot; a Kernel-side guard refusing any anchor already inexpanded_candidate_refs(no self-blinding — verified); and discovery's anchor-set check. The round-1 evaluation's surviving mutation (seeding expansion from the growing projection set) is now killed by a named test.row_security = oninside the SECURITY DEFINER body.Verification (independent evaluator, both rounds, fresh)
Independent evaluation
Round 1: PASS with two MAJORs (unpinned one-hop bound — demonstrated by a surviving mutation; missing examination ceiling — the ADR-0083 resource class on a new path). Round 2: CONFIRM MERGE — both closed with mutation-kill evidence re-run by the evaluator. Follow-up filed: the co-resident UI's v1-pinned preview cannot ingest link-bearing notes (boundary decision documented in ADR-0093; leased preview replacement tracked separately).
Closes #151
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Improvements
Documentation
Tests