legion-apollo 0.5.3 → 0.5.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a45052ee6c52f3642d1247538a691ace760e67bb5ec35f59fab03f42f95e8768
-  data.tar.gz: 7adc4eba3d571ef523c0588be61179e27b519b4f0f5ec620e06b9253004468a5
+  metadata.gz: da837d4b00044d6028f0d62cfcf972c1da2a15121c182c7e6306e188e6b8c5b8
+  data.tar.gz: 7eabbcc8623e98f023f9c1d39c824719336ea83826047ec7afe59d97fafa595f
 SHA512:
-  metadata.gz: 37c9de5b076d469c36f43a3cb55e608a053c146e97e9da63b5b4009772943adecff5f56ce6e416d105c52664c2616346a25cf6f2857c42b561ef84b5a95a007c
-  data.tar.gz: d4e73cf548045b9fce1b6713aaeb0e0abaca29757534feaf484f62300ec2c80eed16a2a514d9388fa80fde9ada1d5321f97dad8904d4fc9864f81c6d0efe2a31
+  metadata.gz: 2d5167b38adf9a921a97e72e0304a6b7c2d3b1706c105ffaf48dcbaa8e66af42b21c42e36d6b1f78d2b765fc1796ebffcb3aeed2a224a6343c43bb077aefd9ba
+  data.tar.gz: 6219138ff5582bcf5433b37ee3cadc59946df54c4d9cf64bba71e878e8062ed31fe9703bb66ae92f7849ed87eb0d8dba0f9a38c41d109e1f35ee5d127c97c55d

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.5.5] - 2026-05-15
+
+### Added
+- `Legion::Apollo.ingest` and `Legion::Apollo::Local.ingest`/`upsert` now auto-inject `access_scope` (default `'global'`), `identity_canonical_name`, `identity_principal_id`, and `identity_id` from `Legion::Identity::Process` — zero call-site changes required; guarded by `defined?` so nodes without Identity loaded are unaffected
+- Migration 006 adds the four identity/scope columns to `local_knowledge` with `access_scope` defaulting to `'global'` to match the Phase 1 Postgres schema
+
+### Fixed
+- `query_merged` now forwards `requesting_principal_id` to `Apollo::Local.query` so the access-scope filter is honoured in merged results
+- `Apollo::Local.query` accepts `requesting_principal_id:` and suppresses `private` entries whose `identity_principal_id` does not match the requesting principal (`nil` principal = system/background caller, all entries visible)
+
+## [0.5.4] - 2026-05-07
+
+### Fixed
+- Preserve distinct merged query results when local or global Apollo entries arrive without a `content_hash`.
+- Detect co-located Apollo reader and writer runners by module presence so in-process routing is not skipped.
+
 ## [0.5.3] - 2026-04-27
 
 ### Fixed

data/lib/legion/apollo/local/migrations/006_add_identity_and_access_scope.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+Sequel.migration do
+  up do
+    alter_table(:local_knowledge) do
+      add_column :access_scope,            String, null: false, default: 'global'
+      add_column :identity_canonical_name, String, null: true
+      add_column :identity_principal_id,   Integer, null: true
+      add_column :identity_id,             Integer, null: true
+
+      add_index :access_scope,            name: :idx_local_knowledge_access_scope
+      add_index :identity_principal_id,   name: :idx_local_knowledge_identity_principal_id
+      add_index :identity_id,             name: :idx_local_knowledge_identity_id
+    end
+  end
+
+  down do
+    alter_table(:local_knowledge) do
+      drop_column :access_scope
+      drop_column :identity_canonical_name
+      drop_column :identity_principal_id
+      drop_column :identity_id
+    end
+  end
+end

data/lib/legion/apollo/local.rb

@@ -46,12 +46,13 @@ module Legion
           @started == true
         end
 
-        def ingest(content:, tags: [], **opts) # rubocop:disable Metrics/MethodLength
+        def ingest(content:, tags: [], access_scope: 'global', **opts) # rubocop:disable Metrics/MethodLength
           return not_started_error unless started?
 
           tags = normalize_tags_input(tags)
           WRITE_MUTEX.synchronize do
-            ingest_without_lock(content: content, tags: tags, **opts)
+            ingest_without_lock(content: content, tags: tags,
+                                **inject_identity_context(opts).merge(access_scope: access_scope))
           end
         rescue StandardError => e
           handle_exception(
@@ -64,18 +65,19 @@ module Legion
           { success: false, error: e.message }
         end
 
-        def upsert(content:, tags: [], **opts) # rubocop:disable Metrics/MethodLength,Metrics/AbcSize
+        def upsert(content:, tags: [], access_scope: 'global', **opts) # rubocop:disable Metrics/MethodLength,Metrics/AbcSize
           return not_started_error unless started?
 
           sorted_tags = normalize_tags_input(tags).sort
           tag_json = Legion::JSON.dump(sorted_tags)
+          merged_opts = inject_identity_context(opts).merge(access_scope: access_scope)
           WRITE_MUTEX.synchronize do
             existing = db[:local_knowledge].where(tags: tag_json).first
 
             if existing
-              update_upsert_entry(existing, content, tag_json, opts)
+              update_upsert_entry(existing, content, tag_json, merged_opts)
             else
-              result = ingest_without_lock(content: content, tags: sorted_tags, **opts)
+              result = ingest_without_lock(content: content, tags: sorted_tags, **merged_opts)
               result[:mode] = :inserted if result[:success] && result[:mode] != :deduplicated
               result
             end
@@ -91,7 +93,7 @@ module Legion
           { success: false, error: e.message }
         end
 
-        def query(text:, limit: nil, min_confidence: nil, tags: nil, **opts) # rubocop:disable Metrics/MethodLength,Metrics/AbcSize,Metrics/CyclomaticComplexity
+        def query(text:, limit: nil, min_confidence: nil, tags: nil, requesting_principal_id: nil, **opts) # rubocop:disable Metrics/MethodLength,Metrics/AbcSize,Metrics/CyclomaticComplexity,Metrics/ParameterLists
           return not_started_error unless started?
 
           text = normalize_text_input(text)
@@ -111,7 +113,8 @@ module Legion
           include_history = opts.fetch(:include_history, false)
           candidates = filter_candidates(candidates, min_confidence: min_confidence, tags: tags,
                                                      options: { include_inferences: include_inferences,
-                                                                include_history: include_history, as_of: as_of })
+                                                                include_history: include_history, as_of: as_of,
+                                                                requesting_principal_id: requesting_principal_id })
           candidates = cosine_rerank(text, candidates) if can_rerank?
           results = candidates.first(limit)
 
@@ -496,8 +499,13 @@ module Legion
         end
 
         def ingest_source_columns(opts)
-          { source_channel: opts[:source_channel], source_agent: opts[:source_agent],
-            submitted_by: opts[:submitted_by] }
+          { source_channel:          opts[:source_channel],
+            source_agent:            opts[:source_agent],
+            submitted_by:            opts[:submitted_by],
+            access_scope:            opts[:access_scope] || 'global',
+            identity_canonical_name: opts[:identity_canonical_name],
+            identity_principal_id:   opts[:identity_principal_id],
+            identity_id:             opts[:identity_id] }
         end
 
         def ingest_lineage_columns(opts)
@@ -653,6 +661,13 @@ module Legion
               tag_set.intersect?(entry_tags)
             end
           end
+          pid = options[:requesting_principal_id]
+          if pid
+            candidates = candidates.select do |c|
+              scope = c[:access_scope] || 'global'
+              scope != 'private' || c[:identity_principal_id] == pid
+            end
+          end
           candidates
         end
 
@@ -841,17 +856,21 @@ module Legion
 
           db.transaction do
             db[:local_knowledge].where(id: existing[:id]).update(
-              content:        content,
-              content_hash:   new_hash,
-              tags:           tags_json,
-              embedding:      embedding ? Legion::JSON.dump(embedding) : nil,
-              embedded_at:    embedded_at,
-              confidence:     opts.fetch(:confidence, existing[:confidence]),
-              expires_at:     expires_at,
-              source_channel: opts.fetch(:source_channel, existing[:source_channel]),
-              source_agent:   opts.fetch(:source_agent, existing[:source_agent]),
-              submitted_by:   opts.fetch(:submitted_by, existing[:submitted_by]),
-              updated_at:     now
+              content:                 content,
+              content_hash:            new_hash,
+              tags:                    tags_json,
+              embedding:               embedding ? Legion::JSON.dump(embedding) : nil,
+              embedded_at:             embedded_at,
+              confidence:              opts.fetch(:confidence, existing[:confidence]),
+              expires_at:              expires_at,
+              source_channel:          opts.fetch(:source_channel, existing[:source_channel]),
+              source_agent:            opts.fetch(:source_agent, existing[:source_agent]),
+              submitted_by:            opts.fetch(:submitted_by, existing[:submitted_by]),
+              access_scope:            opts.fetch(:access_scope, existing[:access_scope]) || 'global',
+              identity_canonical_name: opts.fetch(:identity_canonical_name, existing[:identity_canonical_name]),
+              identity_principal_id:   opts.fetch(:identity_principal_id, existing[:identity_principal_id]),
+              identity_id:             opts.fetch(:identity_id, existing[:identity_id]),
+              updated_at:              now
             )
             rebuild_fts_entry!(existing[:id], content, tags_json)
           end
@@ -880,6 +899,20 @@ module Legion
           end
         end
 
+        def inject_identity_context(opts)
+          return opts unless defined?(Legion::Identity::Process)
+
+          id = Legion::Identity::Process.identity_hash
+          {
+            identity_canonical_name: id[:canonical_name],
+            identity_principal_id:   id[:db_principal_id],
+            identity_id:             id[:db_identity_id]
+          }.compact.merge(opts)
+        rescue StandardError => e
+          handle_exception(e, level: :warn, operation: 'apollo.local.inject_identity_context')
+          opts
+        end
+
         def not_started_error
           { success: false, error: :not_started }
         end

data/lib/legion/apollo/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Apollo
-    VERSION = '0.5.3'
+    VERSION = '0.5.5'
   end
 end

data/lib/legion/apollo.rb

@@ -1,7 +1,9 @@
 # frozen_string_literal: true
 
 require 'digest'
+require 'legion/json'
 require 'legion/logging'
+require 'legion/settings'
 require_relative 'apollo/version'
 require_relative 'apollo/settings'
 require_relative 'apollo/helpers/tag_normalizer'
@@ -93,13 +95,14 @@ module Legion
         end
       end
 
-      def ingest(content:, tags: [], scope: :global, **opts) # rubocop:disable Metrics/MethodLength,Metrics/AbcSize
+      def ingest(content:, tags: [], scope: :global, access_scope: 'global', **opts) # rubocop:disable Metrics/MethodLength,Metrics/AbcSize
         return not_started_error unless started?
 
         normalized_tags = normalize_tags_input(tags)
         normalized_content = normalize_text_input(content)
         normalized_raw_content = normalize_raw_content_input(opts[:raw_content], fallback: normalized_content)
-        payload = { **opts, content: normalized_content, raw_content: normalized_raw_content, tags: normalized_tags }
+        payload = { **inject_identity_context(opts), content: normalized_content,
+                    raw_content: normalized_raw_content, tags: normalized_tags, access_scope: access_scope }
         log.info do
           "Apollo ingest requested scope=#{scope} content_length=#{payload[:content].to_s.length} " \
             "tags=#{payload[:tags].size} source_channel=#{payload[:source_channel]}"
@@ -224,8 +227,7 @@ module Legion
       def co_located_reader?
         return false unless data_available?
 
-        defined?(Legion::Extensions::Apollo::Runners::Knowledge) &&
-          Legion::Extensions::Apollo::Runners::Knowledge.respond_to?(:handle_query)
+        defined?(Legion::Extensions::Apollo::Runners::Knowledge) ? true : false
       rescue StandardError => e
         handle_exception(e, level: :debug, operation: 'apollo.co_located_reader')
         false
@@ -234,8 +236,7 @@ module Legion
       def co_located_writer?
         return false unless data_available?
 
-        defined?(Legion::Extensions::Apollo::Runners::Knowledge) &&
-          Legion::Extensions::Apollo::Runners::Knowledge.respond_to?(:handle_ingest)
+        defined?(Legion::Extensions::Apollo::Runners::Knowledge) ? true : false
       rescue StandardError => e
         handle_exception(e, level: :debug, operation: 'apollo.co_located_writer')
         false
@@ -292,7 +293,8 @@ module Legion
         end
         result = Legion::Apollo::Local.query(**payload.slice(:text, :limit, :min_confidence, :tags,
                                                              :tier, :include_inferences, :include_history,
-                                                             :as_of))
+                                                             :as_of),
+                                            requesting_principal_id: payload[:requesting_principal_id])
         return result unless result[:success]
 
         entries = normalize_local_entries(Array(result[:results]))
@@ -328,7 +330,8 @@ module Legion
           attempted = true
           local = Legion::Apollo::Local.query(**payload.slice(:text, :limit, :min_confidence, :tags,
                                                               :tier, :include_inferences, :include_history,
-                                                              :as_of))
+                                                              :as_of),
+                                             requesting_principal_id: payload[:requesting_principal_id])
           if local[:success]
             any_success = true
             entries.concat(normalize_local_entries(Array(local[:results]))) if local[:results]
@@ -407,7 +410,13 @@ module Legion
       end
 
       def dedup_and_rank(entries, limit:)
-        sorted = entries
+        entries_with_hashes = entries.map do |e|
+          next e if e[:content_hash]
+
+          e.merge(content_hash: Digest::MD5.hexdigest(e[:content].to_s.strip.downcase.gsub(/\s+/, ' ')))
+        end
+
+        sorted = entries_with_hashes
                  .sort_by { |e| -(e[:confidence] || 0) }
                  .uniq { |e| e[:content_hash] }
 
@@ -554,6 +563,20 @@ module Legion
         end
       end
 
+      def inject_identity_context(opts)
+        return opts unless defined?(Legion::Identity::Process)
+
+        id = Legion::Identity::Process.identity_hash
+        {
+          identity_canonical_name: id[:canonical_name],
+          identity_principal_id:   id[:db_principal_id],
+          identity_id:             id[:db_identity_id]
+        }.compact.merge(opts)
+      rescue StandardError => e
+        handle_exception(e, level: :warn, operation: 'apollo.inject_identity_context')
+        opts
+      end
+
       def not_started_error
         { success: false, error: :not_started }
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-apollo
 version: !ruby/object:Gem::Version
-  version: 0.5.3
+  version: 0.5.5
 platform: ruby
 authors:
 - Esity
@@ -88,6 +88,7 @@ files:
 - lib/legion/apollo/local/migrations/003_harden_graph_relationships.rb
 - lib/legion/apollo/local/migrations/004_add_versioning_tiers_inference.rb
 - lib/legion/apollo/local/migrations/005_add_raw_content_temporal_windows.rb
+- lib/legion/apollo/local/migrations/006_add_identity_and_access_scope.rb
 - lib/legion/apollo/messages/access_boost.rb
 - lib/legion/apollo/messages/ingest.rb
 - lib/legion/apollo/messages/query.rb