dsh-loci 2.4.1 → 2.5.0

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html) from 1.0.0.
 
+## [2.5.0] — 2026-11-15
+
+The rest of the boundary audit: one real hole in the trust gate, one check that could
+never fail, and a number that was being read as more than it is.
+
+### Fixed
+
+- **A real quote could certify an unrelated claim.** The gate asked only "did the user
+  say this"; it never asked "is the claim about what they said". Quoting any real
+  sentence — "好的，继续吧" — was enough to launder a fabricated fact into the prompt.
+  `evidenceSupports` was written for exactly this and had no caller. It is now part of
+  the gate, and its threshold is **measured** rather than inherited: on Chinese text a
+  legitimate paraphrase scores 0.083–0.364 and a laundered claim scores 0.000, so the
+  bar is 0.05. The old 0.15 would have rejected "用户偏好中文" from "以后都用中文回复我".
+
+- **`loci doctor`'s host row could never warn.** It printed `[ok]` for any recorded
+  version, including one outside `engines.dsh`. It now compares against the declared
+  range and warns when outside, degrading to `ok` (not a failure) when the range cannot
+  be parsed.
+
+### Changed
+
+- **The acceptance numbers are qualified, not deleted.** Every measurement in
+  `docs/ACCEPTANCE.md` was taken on **v1.0.0**; the tree is 2.5.0. Worse, the
+  acceptance question contains the entry title verbatim (`acceptance-e2e.mjs:94`), the
+  corpus fixture is readable from the agent's workspace, and there is no no-memory arm —
+  so "49/50" measures lookup, not memory effect. The page now says so at the top and on
+  the row itself. A re-acceptance on 2.5.x with held-out facts and a control arm is an
+  open item, not something a doc edit can settle.
+
 ## [2.4.1] — 2026-11-15
 
 Three fixes from an independent boundary audit. All three were verified by running the

package/docs/ACCEPTANCE.md

@@ -1,5 +1,11 @@
 # ACCEPTANCE — measured results (v1.0.0)
 
+> **Version warning.** Everything below was measured on **v1.0.0**. The current tree is
+> 2.4.x: schema v3, auto-verified capture, the pending-review notice, lesson fields, the
+> review-kind filter and the two-part quote gate all landed after these runs. Treat this
+> page as a record of what was true then, not as a property of what ships now. A
+> re-acceptance is an open item.
+
 Environment: Windows 11 · DSH 0.2.2-rc.1 · Node 24.13.0 · model `local-test/deepseek-flash`
 (reasoning off, 100k context) · every run in a throwaway `DSH_HOME` under `%TEMP%`.
 The plugin under test is the packed tarball, installed with
@@ -9,7 +15,7 @@ Verdict summary:
 
 | # | Row | Result |
 |---|---|---|
-| 1 | Recall accuracy | **PASS** - single 49/50 = 98% (`acceptance-single.json`), multi 10/10, broad 50/50 |
+| 1 | Seeded-corpus keyword recall (**not** an evaluation of whether memory helps) | **PASS on its own terms** — single 49/50, multi 10/10, broad 50/50. Caveats that limit what this number means: the question contains the entry title verbatim (scripts/acceptance-e2e.mjs:94), the corpus fixture is readable from the agent's workspace, and there is no no-memory control arm. It shows the tools can find an entry when the question names it; it does not show that injection improved an answer |
 | 2 | Injection cost | **PASS** — 0 B empty; 3,450–3,507 B steady; ~1.2k tokens measured |
 | 3 | Concurrency and crash | **PASS** — 200/200 rows, 0 lock errors, kill -9 recoverable |
 | 4 | Migration and rollback | **PASS** — rehearsal upgrade + snapshot restore, row-identical |

package/docs/SECURITY.md

@@ -26,8 +26,11 @@ A memory is injected only when `status = 'verified'`. Status is derived, not
 declared:
 
 - `trust_source = 'user'` (a human asserted it in the panel) → `verified`;
-- a tool write with an `evidenceQuote` of ≥8 characters that is still findable in
-  **the user's own messages of the live session** → `verified`;
+- a tool write with an `evidenceQuote` of ≥8 characters that is findable in **the
+  user's own messages of the live session** *and* shares substance with the claim
+  (≥5% character-bigram overlap) → `verified`; a quote that is real but unrelated to
+  the claim stays a candidate, because quoting a real sentence is the cheapest way to
+  launder a fabricated fact;
 - anything else → `candidate`;
 - instruction-shaped text → `disputed`;
 - imported or summarized text → `candidate`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-loci",
-  "version": "2.4.1",
+  "version": "2.5.0",
   "description": "Layered long-term memory for DeepSeek Harness: the prompt sees only a stable index, full text is one lookup away. Bi-temporal facts, strict scope isolation, verified-only injection.",
   "type": "module",
   "license": "MIT",

package/src/host/doctor.js

@@ -10,8 +10,37 @@ import { accessSync, constants, existsSync, readdirSync, statSync } from 'node:f
 import { join } from 'node:path';
 import { findDuplicateGroups } from './store/duplicates.js';
 import { detectInstructionLike, renderSafe } from './inject/sanitize.js';
+import { compareVersions } from './update.js';
 
 /** One check result. */
+/**
+ * Decide whether a host version falls inside a declared range.
+ *
+ * Only the comparisons `engines.dsh` actually uses are supported — `>=X <Y` and
+ * `>=X <Y-0` — because a full semver implementation is a dependency this plugin does
+ * not otherwise need. Anything else returns `unknown` and the caller assumes fine: a
+ * doctor row must never fail on a range it cannot read.
+ *
+ * @param version - the host version string.
+ * @param range - `engines.dsh`, e.g. `>=0.2.2-rc.1 <0.3.0-0`.
+ * @returns `'inside' | 'outside' | 'unknown'`.
+ */
+function checkAgainstRange(version, range) {
+  if (typeof range !== 'string' || typeof version !== 'string') return 'unknown';
+  const lower = /(?:^|\s)(>=)\s*([0-9][^\s]*)/.exec(range);
+  const upperLt = /(?:^|\s)<\s*([0-9][^\s]*)/.exec(range);
+  const upperLe = /(?:^|\s)<=\s*([0-9][^\s]*)/.exec(range);
+  if (lower === null && upperLt === null && upperLe === null) return 'unknown';
+  const compare = (a, b) => compareVersions(a, b);
+  // `compareVersions(a, b) > 0` means b is newer than a.
+  // lower bound: outside when the version is below it.
+  if (lower !== null && compare(lower[2], version) < 0) return 'outside';
+  // upper `<`: outside when the version is at or above it.
+  if (upperLt !== null && compare(version, upperLt[1]) <= 0) return 'outside';
+  // upper `<=`: outside only when strictly above it.
+  if (upperLe !== null && compare(version, upperLe[1]) < 0) return 'outside';
+  return 'inside';
+}
 function check(name, status, detail) {
   return { name, status, detail };
 }
@@ -64,15 +93,28 @@ export function runDoctor(options) {
   const lastMaintenance = Number(health.migration?.to === undefined ? 0 : 0);
   checks.push(check('rows', 'ok', `${health.counts.memory} revisions · ${health.counts.memory_head} entries · ${health.counts.entity} entities`));
 
-  // Which Harness opened this store. A range in engines.dsh is a promise; this row
-  // is what actually happened, and it is the first thing to ask for in a bug report.
+  // Which Harness opened this store, and whether that version is inside the range this
+  // build declares. The row used to print `[ok]` for any version at all, which made it
+  // a warning surface that could never warn — the exact shape of check that survives
+  // review because it looks like engineering.
   try {
     const hostVersion = store.hostVersion ?? null;
-    checks.push(
-      hostVersion === null
-        ? check('host', 'warn', `not recorded yet; this build declares engines.dsh ${engines?.dsh ?? 'unknown'}`)
-        : check('host', 'ok', `last opened by DeepSeek Harness ${hostVersion}`),
-    );
+    if (hostVersion === null) {
+      checks.push(check('host', 'warn', `not recorded yet; this build declares engines.dsh ${engines?.dsh ?? 'unknown'}`));
+    } else {
+      const verdict = checkAgainstRange(hostVersion, engines?.dsh);
+      checks.push(
+        verdict === 'inside'
+          ? check('host', 'ok', `last opened by DeepSeek Harness ${hostVersion} (inside ${engines?.dsh})`)
+          : verdict === 'outside'
+            ? check(
+                'host',
+                'warn',
+                `last opened by DeepSeek Harness ${hostVersion}, outside the declared ${engines?.dsh}; memory may misbehave`,
+              )
+            : check('host', 'ok', `last opened by DeepSeek Harness ${hostVersion} (range not parsed; assumed fine)`),
+      );
+    }
   } catch (error) {
     checks.push(check('host', 'warn', `could not read: ${String(error?.message ?? error)}`));
   }

package/src/host/index.js

@@ -23,7 +23,7 @@ import { registerCommands } from './commands.js';
 import { runDoctor } from './doctor.js';
 
 /** Version stamped into the database and diagnostics. */
-export const VERSION = '2.4.1';
+export const VERSION = '2.5.0';
 
 /** Optional collaborators; without them the plugin still serves tools. */
 export const inject = ['systemPrompt', 'tools'];

package/src/host/store/store.js

@@ -1555,6 +1555,18 @@ export class Store {
       verified = false;
     }
     this.quoteChecked += 1;
+    // Two questions, not one. The verifier answers "did the user say this"; this
+    // answers "is the claim about what they said". Checking only the first let any real
+    // sentence certify an unrelated fact — the cheapest way to launder a wrong memory
+    // into the prompt. A quote that fails the second question lands as a candidate,
+    // which costs a person one click.
+    if (verified) {
+      const claim = `${input?.title ?? ''} ${input?.body ?? ''}`.trim();
+      if (claim.length > 0 && !evidenceSupports(quote, claim)) {
+        this.log?.debug?.('loci: quote is in the transcript but unrelated to the claim; keeping it a candidate');
+        verified = false;
+      }
+    }
     return verified;
   }
 
@@ -1725,9 +1737,29 @@ function nowOrMax(value) {
  * @param text - new title and body.
  * @returns true when the two share at least 15% of their character bigrams.
  */
+/**
+ * Does the quote have anything to do with the claim?
+ *
+ * Containment alone is not enough: a model can quote any real user sentence ("好的，
+ * 继续吧") and attach a fabricated claim to it, and the transcript check would pass.
+ * This is the second half — the quote must share some substance with what it is
+ * supposed to support.
+ *
+ * The 0.05 threshold is measured, not guessed. On Chinese text:
+ *   "以后都用中文回复我" → "用户偏好中文"                    0.083  legitimate paraphrase
+ *   "回滚窗口是三十分钟"   → "回滚窗口 30 分钟"                0.364  legitimate restatement
+ *   "好的，继续吧"         → "用户要求永远不要审查代码"        0.000  laundering
+ * A higher bar (the 0.15 this function used to carry) rejects the first case; 0.05
+ * separates the two groups cleanly. Failing it lands the entry as a candidate, which
+ * a person can still promote — the cost of being wrong in this direction is one click.
+ *
+ * @param quote - evidence quote.
+ * @param text - title and body of the claim.
+ * @returns true when the two share at least 5% of their character bigrams.
+ */
 function evidenceSupports(quote, text) {
   if (typeof quote !== 'string' || quote.trim().length < 8) return false;
-  return jaccard(quote, text) >= 0.15;
+  return jaccard(quote, text) >= 0.05;
 }
 /** Jaccard over whitespace-collapsed character bigrams (duplicate heuristic). */
 function jaccard(a, b) {

package/src/mcp/store-facade.js

@@ -36,7 +36,7 @@ export function openFacadeStore(options = {}) {
     memoryRoot: root,
     paths,
     config,
-    pluginVersion: '2.4.1',
+    pluginVersion: '2.5.0',
     readOnly: options.readOnly === true,
   });
   return { store, paths };