hippo-memory 1.62.0 → 1.63.0

package/dist/config.js

@@ -5,10 +5,11 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { DEFAULT_PHYSICS_CONFIG, mergePhysicsConfig } from './physics-config.js';
 import { DEFAULT_HALF_LIFE_DAYS } from './memory.js';
+import { DEFAULT_LOCAL_BUMP, DEFAULT_RECALL_BUDGET } from './search/types.js';
 import { log } from './log.js';
 const DEFAULT_CONFIG = {
     defaultHalfLifeDays: DEFAULT_HALF_LIFE_DAYS,
-    defaultBudget: 4000,
+    defaultBudget: DEFAULT_RECALL_BUDGET,
     defaultContextBudget: 3000,
     decayBasis: 'adaptive',
     autoLearnOnSleep: true,
@@ -36,7 +37,7 @@ const DEFAULT_CONFIG = {
         lambda: 0.7,
     },
     search: {
-        localBump: 1.2,
+        localBump: DEFAULT_LOCAL_BUMP,
     },
     replay: {
         count: 5,
@@ -92,6 +93,9 @@ const DEFAULT_CONFIG = {
     pilot: {
         holdoutRateBp: 0,
     },
+    projectIdentity: {
+        remote: true,
+    },
 };
 function isMemoryValueConfig(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -132,6 +136,17 @@ function pilotHoldoutRate(value) {
         `(got ${JSON.stringify(value)}) - using 0 (pilot off).`);
     return 0;
 }
+// Only a real false turns the remote rule off; anything else malformed warns and keeps it on.
+function projectIdentityRemote(value) {
+    const remote = value?.remote;
+    if (remote === true || remote === false)
+        return remote;
+    if (value === undefined || (remote === undefined && value !== null && value.constructor === Object))
+        return true;
+    log.warn(`config.json's "projectIdentity" must be an object like {"remote": false} ` +
+        `(got ${JSON.stringify(value)}) - using true (projects named by their origin remote).`);
+    return true;
+}
 function agentMemoryTools(value) {
     if (value === undefined || value === null)
         return null;
@@ -141,6 +156,70 @@ function agentMemoryTools(value) {
         `(got ${JSON.stringify(value)}) - importing none.`);
     return [];
 }
+function memoryValueOverride(raw) {
+    // Spreading a non-object raw.memoryValue (e.g. {"memoryValue": true}) silently leaves `enabled` false;
+    // this feature must never be silently off, so warn loudly and fall back to defaults instead.
+    const memoryValueRaw = raw.memoryValue;
+    const validMemoryValueConfig = memoryValueRaw === undefined || isMemoryValueConfig(memoryValueRaw);
+    if (!validMemoryValueConfig) {
+        log.warn(`config.json's "memoryValue" must be an object like {"enabled": true} ` +
+            `(got ${JSON.stringify(memoryValueRaw)}) - using defaults.`);
+    }
+    return memoryValueRaw !== undefined && isMemoryValueConfig(memoryValueRaw) ? memoryValueRaw : {};
+}
+function dormantSettings(raw) {
+    // Same rule as memoryValue above: a malformed value never silently
+    // changes what sleep does. Anything but a real object / boolean / number
+    // warns and falls back to the default, which keeps faded memories.
+    const dormantRaw = raw.dormant;
+    if (dormantRaw !== undefined && !isDormantConfig(dormantRaw)) {
+        log.warn(`config.json's "dormant" must be an object like {"enabled": false} ` +
+            `(got ${JSON.stringify(dormantRaw)}) - using the default (faded memories kept dormant).`);
+    }
+    const dormantOverride = dormantRaw !== undefined && isDormantConfig(dormantRaw) ? dormantRaw : {};
+    // Only a real boolean counts: {"enabled": "false"} is a truthy string.
+    let dormantEnabled = dormantOverride.enabled ?? DEFAULT_CONFIG.dormant.enabled;
+    if (dormantEnabled !== true && dormantEnabled !== false) {
+        log.warn(`config.json's "dormant.enabled" must be true or false ` +
+            `(got ${JSON.stringify(dormantEnabled)}) - using the default (faded memories kept dormant).`);
+        dormantEnabled = DEFAULT_CONFIG.dormant.enabled;
+    }
+    let dormantRetentionDays = dormantOverride.retentionDays ?? DEFAULT_CONFIG.dormant.retentionDays;
+    if (!Number.isFinite(dormantRetentionDays) || dormantRetentionDays < 0) {
+        log.warn(`config.json's "dormant.retentionDays" must be a number of days, 0 or more ` +
+            `(got ${JSON.stringify(dormantRetentionDays)}) - using ${DEFAULT_CONFIG.dormant.retentionDays}.`);
+        dormantRetentionDays = DEFAULT_CONFIG.dormant.retentionDays;
+    }
+    return { enabled: dormantEnabled, retentionDays: dormantRetentionDays };
+}
+function churnStalenessEnabled(raw) {
+    // Same "never silently wrong" rule as memoryValue/dormant above.
+    const churnStalenessRaw = raw.churnStaleness;
+    const validChurnStalenessConfig = churnStalenessRaw === undefined || isChurnStalenessConfig(churnStalenessRaw);
+    if (!validChurnStalenessConfig) {
+        log.warn(`config.json's "churnStaleness" must be an object like {"enabled": true} ` +
+            `(got ${JSON.stringify(churnStalenessRaw)}) - using defaults.`);
+    }
+    const enabled = churnStalenessRaw !== undefined && isChurnStalenessConfig(churnStalenessRaw)
+        ? churnStalenessRaw.enabled
+        : DEFAULT_CONFIG.churnStaleness.enabled;
+    if (enabled !== true && enabled !== false) {
+        log.warn(`config.json's "churnStaleness.enabled" must be true or false ` +
+            `(got ${JSON.stringify(enabled)}) - using false.`);
+        return false;
+    }
+    return enabled;
+}
+function defaultHalfLifeDays(raw) {
+    // Every writer starts a memory on this, and a zero or negative half-life scores zero strength, so sleep would retire it.
+    const days = raw.defaultHalfLifeDays ?? DEFAULT_CONFIG.defaultHalfLifeDays;
+    if (!Number.isFinite(days) || days <= 0) {
+        log.warn(`config.json's "defaultHalfLifeDays" must be a number of days above 0 ` +
+            `(got ${JSON.stringify(days)}) - using ${DEFAULT_CONFIG.defaultHalfLifeDays}.`);
+        return DEFAULT_CONFIG.defaultHalfLifeDays;
+    }
+    return days;
+}
 export function loadConfig(hippoRoot) {
     const configPath = path.join(hippoRoot, 'config.json');
     if (!fs.existsSync(configPath))
@@ -149,66 +228,12 @@ export function loadConfig(hippoRoot) {
         const raw = JSON.parse(fs.readFileSync(configPath, 'utf8'));
         const basis = raw.decayBasis;
         const validBasis = basis === 'clock' || basis === 'session' || basis === 'adaptive';
-        // Review-round F6: {...DEFAULT_CONFIG.memoryValue, ...raw.memoryValue}
-        // silently no-ops when raw.memoryValue is a non-object (e.g. the user
-        // wrote {"memoryValue": true}) — spreading a boolean/primitive/array
-        // contributes no enumerable own properties, so `enabled` stays at the
-        // default `false` with zero indication anything was wrong. This
-        // feature's whole point is "never silently off": warn loudly and fall
-        // back to defaults instead of merging garbage.
-        const memoryValueRaw = raw.memoryValue;
-        const validMemoryValueConfig = memoryValueRaw === undefined || isMemoryValueConfig(memoryValueRaw);
-        if (!validMemoryValueConfig) {
-            log.warn(`config.json's "memoryValue" must be an object like {"enabled": true} ` +
-                `(got ${JSON.stringify(memoryValueRaw)}) - using defaults.`);
-        }
-        const memoryValueOverride = memoryValueRaw !== undefined && isMemoryValueConfig(memoryValueRaw) ? memoryValueRaw : {};
-        // Same rule as memoryValue above: a malformed value never silently
-        // changes what sleep does. Anything but a real object / boolean / number
-        // warns and falls back to the default, which keeps faded memories.
-        const dormantRaw = raw.dormant;
-        if (dormantRaw !== undefined && !isDormantConfig(dormantRaw)) {
-            log.warn(`config.json's "dormant" must be an object like {"enabled": false} ` +
-                `(got ${JSON.stringify(dormantRaw)}) - using the default (faded memories kept dormant).`);
-        }
-        const dormantOverride = dormantRaw !== undefined && isDormantConfig(dormantRaw) ? dormantRaw : {};
-        // Only a real boolean counts: {"enabled": "false"} is a truthy string.
-        let dormantEnabled = dormantOverride.enabled ?? DEFAULT_CONFIG.dormant.enabled;
-        if (dormantEnabled !== true && dormantEnabled !== false) {
-            log.warn(`config.json's "dormant.enabled" must be true or false ` +
-                `(got ${JSON.stringify(dormantEnabled)}) - using the default (faded memories kept dormant).`);
-            dormantEnabled = DEFAULT_CONFIG.dormant.enabled;
-        }
-        let dormantRetentionDays = dormantOverride.retentionDays ?? DEFAULT_CONFIG.dormant.retentionDays;
-        if (!Number.isFinite(dormantRetentionDays) || dormantRetentionDays < 0) {
-            log.warn(`config.json's "dormant.retentionDays" must be a number of days, 0 or more ` +
-                `(got ${JSON.stringify(dormantRetentionDays)}) - using ${DEFAULT_CONFIG.dormant.retentionDays}.`);
-            dormantRetentionDays = DEFAULT_CONFIG.dormant.retentionDays;
-        }
-        // Same "never silently wrong" rule as memoryValue/dormant above.
-        const churnStalenessRaw = raw.churnStaleness;
-        const validChurnStalenessConfig = churnStalenessRaw === undefined || isChurnStalenessConfig(churnStalenessRaw);
-        if (!validChurnStalenessConfig) {
-            log.warn(`config.json's "churnStaleness" must be an object like {"enabled": true} ` +
-                `(got ${JSON.stringify(churnStalenessRaw)}) - using defaults.`);
-        }
-        let churnStalenessEnabled = churnStalenessRaw !== undefined && isChurnStalenessConfig(churnStalenessRaw)
-            ? churnStalenessRaw.enabled
-            : DEFAULT_CONFIG.churnStaleness.enabled;
-        if (churnStalenessEnabled !== true && churnStalenessEnabled !== false) {
-            log.warn(`config.json's "churnStaleness.enabled" must be true or false ` +
-                `(got ${JSON.stringify(churnStalenessEnabled)}) - using false.`);
-            churnStalenessEnabled = false;
-        }
-        // Every writer starts a memory on this, and a zero or negative half-life scores zero strength, so sleep would retire it.
-        let defaultHalfLifeDays = raw.defaultHalfLifeDays ?? DEFAULT_CONFIG.defaultHalfLifeDays;
-        if (!Number.isFinite(defaultHalfLifeDays) || defaultHalfLifeDays <= 0) {
-            log.warn(`config.json's "defaultHalfLifeDays" must be a number of days above 0 ` +
-                `(got ${JSON.stringify(defaultHalfLifeDays)}) - using ${DEFAULT_CONFIG.defaultHalfLifeDays}.`);
-            defaultHalfLifeDays = DEFAULT_CONFIG.defaultHalfLifeDays;
-        }
+        const memoryValue = memoryValueOverride(raw);
+        const dormant = dormantSettings(raw);
+        const churnEnabled = churnStalenessEnabled(raw);
+        const halfLifeDays = defaultHalfLifeDays(raw);
         return {
-            defaultHalfLifeDays,
+            defaultHalfLifeDays: halfLifeDays,
             defaultBudget: raw.defaultBudget ?? DEFAULT_CONFIG.defaultBudget,
             defaultContextBudget: raw.defaultContextBudget ?? DEFAULT_CONFIG.defaultContextBudget,
             decayBasis: validBasis ? basis : DEFAULT_CONFIG.decayBasis,
@@ -232,18 +257,16 @@ export function loadConfig(hippoRoot) {
             ambient: { ...DEFAULT_CONFIG.ambient, ...(raw.ambient ?? {}) },
             memoryValue: {
                 ...DEFAULT_CONFIG.memoryValue,
-                ...memoryValueOverride,
-            },
-            dormant: {
-                enabled: dormantEnabled,
-                retentionDays: dormantRetentionDays,
+                ...memoryValue,
             },
+            dormant,
             churnStaleness: {
-                enabled: churnStalenessEnabled,
+                enabled: churnEnabled,
             },
             agentMemories: { tools: agentMemoryTools(raw.agentMemories?.tools) },
             deliveryLedger: { enabled: deliveryLedgerEnabled(raw.deliveryLedger) },
             pilot: { holdoutRateBp: pilotHoldoutRate(raw.pilot) },
+            projectIdentity: { remote: projectIdentityRemote(raw.projectIdentity) },
         };
     }
     catch (err) {

package/dist/connectors/github/backfill.d.ts

@@ -5,13 +5,13 @@
  *   - /repos/{repo}/issues/comments      -> issue_comments_hwm
  *   - /repos/{repo}/pulls/comments       -> pr_review_comments_hwm
  *
- * Crash safety (codex P1 #3): each stream's HWM is persisted ONLY after
+ * Crash safety: each stream's HWM is persisted ONLY after
  * the stream fully drains. If stream 2 throws mid-flight, stream 1's HWM
  * is committed and stream 2's stays NULL (or its prior value). Rerun
  * picks up from stream 1's saved HWM and re-fetches stream 2 from its
  * last committed point.
  *
- * Codex P1 #2: the /issues endpoint returns BOTH issues and PRs (a PR is
+ * The /issues endpoint returns BOTH issues and PRs (a PR is
  * an issue with a `pull_request` field). We skip PRs here so they don't
  * get ingested under the issues schema. PRs are handled via webhook in
  * V1 (no /pulls backfill stream — review comments cover the discussion

package/dist/connectors/github/backfill.js

@@ -5,13 +5,13 @@
  *   - /repos/{repo}/issues/comments      -> issue_comments_hwm
  *   - /repos/{repo}/pulls/comments       -> pr_review_comments_hwm
  *
- * Crash safety (codex P1 #3): each stream's HWM is persisted ONLY after
+ * Crash safety: each stream's HWM is persisted ONLY after
  * the stream fully drains. If stream 2 throws mid-flight, stream 1's HWM
  * is committed and stream 2's stays NULL (or its prior value). Rerun
  * picks up from stream 1's saved HWM and re-fetches stream 2 from its
  * last committed point.
  *
- * Codex P1 #2: the /issues endpoint returns BOTH issues and PRs (a PR is
+ * The /issues endpoint returns BOTH issues and PRs (a PR is
  * an issue with a `pull_request` field). We skip PRs here so they don't
  * get ingested under the issues schema. PRs are handled via webhook in
  * V1 (no /pulls backfill stream — review comments cover the discussion
@@ -110,18 +110,15 @@ function isCommentItem(x) {
 }
 /**
  * Drain one stream end-to-end. Pauses and retries on rate-limit. Throws on
- * any other fetch error so the caller leaves the HWM unchanged (round 1
- * codex P1 #3 crash safety).
+ * any other fetch error so the caller leaves the HWM unchanged.
  *
- * v1.3.1 (round 2 codex P1s + claude P1):
  *   - Tracks max(updated_at) across ALL fetched items, including ones
  *     `toIngestEvent` rejects (e.g., PRs returned via `/issues`). Otherwise
  *     a page of pure PRs would never advance the HWM and the next run would
  *     re-fetch the same window forever.
  *   - Returns `drained: boolean` — true only when the stream actually ran
- *     to next=null. Callers MUST NOT advance the HWM when drained=false.
- *     Was a bug in v1.3.0: hitting maxPerStream cap returned the partial
- *     maxUpdatedAt and the caller persisted it, skipping the unfetched tail.
+ *     to next=null. Callers MUST NOT advance the HWM when drained=false,
+ *     or a capped run would persist a partial HWM and skip the unfetched tail.
  */
 async function drainStream(ctx, url0, toIngestEvent, fetcher, token, sleep, maxItems) {
     let url = url0;
@@ -141,9 +138,7 @@ async function drainStream(ctx, url0, toIngestEvent, fetcher, token, sleep, maxI
         }
         pages++;
         for (const item of page.items) {
-            // v1.3.1: track updated_at on EVERY item, before the toIngestEvent
-            // filter. Skipped PRs from /issues still contribute to the HWM so
-            // PR-only pages don't loop forever.
+            // Track updated_at on EVERY item, before the toIngestEvent filter, so PR-only pages don't loop forever.
             // SAFETY: updated_at is GitHub's ISO-timestamp field on every item
             // shape this stream returns; a non-string value would only fail the
             // string comparisons below, matching pre-migration passthrough.
@@ -175,7 +170,7 @@ async function drainStream(ctx, url0, toIngestEvent, fetcher, token, sleep, maxI
 function issueItemToEvent(item, repository) {
     if (!isIssuesItem(item))
         return null;
-    // Codex P1 #2: /issues returns PRs too — skip them.
+    // /issues returns PRs too; skip them.
     if (item.pull_request)
         return null;
     const payload = {
@@ -240,9 +235,7 @@ function prReviewCommentItemToEvent(item, repository) {
 /** Drains one stream, then persists its HWM only when the stream ran to the end. */
 async function backfillStream(ctx, opts, sleep, stream) {
     const res = await drainStream(ctx, stream.url, stream.toIngestEvent, opts.fetcher, opts.token, sleep, opts.maxPerStream);
-    // v1.3.1: only advance HWM when the stream actually drained. A capped run
-    // (--max) must leave the HWM at its previous value so the next invocation
-    // re-fetches the unprocessed tail.
+    // A capped run (--max) must leave the HWM at its previous value so the next run re-fetches the unprocessed tail.
     if (res.drained && res.maxUpdatedAt) {
         writeOneHwm(ctx.hippoRoot, ctx.tenantId, opts.repoFullName, stream.column, res.maxUpdatedAt);
     }

package/dist/connectors/github/cli-impl.js

@@ -162,9 +162,7 @@ export async function cmdGithubDlqReplay(hippoRoot, args, flags) {
         tenantId: resolveTenantId({}),
         actor: adminActor('cli:github-dlq-replay'),
     };
-    // v1.3.1 hotfix (codex P1): without an ingestHook the v1.3.0 CLI was a
-    // dry-run that printed "replay ok" while only bumping retry_count. Wire the
-    // real hook so `replay` actually re-runs the ingest path.
+    // Without an ingestHook replay only bumps retry_count while printing "replay ok"; the real hook re-runs ingest.
     const result = await replayDlqEntry(ctx, id, {
         force,
         webhookSecret: envGithubWebhookSecret(),
@@ -175,11 +173,8 @@ export async function cmdGithubDlqReplay(hippoRoot, args, flags) {
             if (!event) {
                 return { memoryId: null };
             }
-            // v1.3.2 (codex round 3 P1): a replayed `issue_comment.deleted` or
-            // `pull_request_review_comment.deleted` row must route to the deletion
-            // handler, NOT to ingestEvent. The v1.3.1 hook unconditionally called
-            // ingestEvent and would have written the deleted comment as a NEW raw
-            // memory instead of archiving the matching ones.
+            // A replayed comment `.deleted` row must route to the deletion handler, NOT to ingestEvent,
+            // which would write the deleted comment as a NEW raw memory instead of archiving the matching ones.
             if ((event.eventName === 'issue_comment' || event.eventName === 'pull_request_review_comment') &&
                 event.payload.action === 'deleted') {
                 const repo = event.payload.repository?.full_name ?? '';

package/dist/connectors/github/deletion.d.ts

@@ -19,21 +19,14 @@ export interface DeletionResult {
 /**
  * Handle GitHub `issue_comment.deleted` and `pull_request_review_comment.deleted`.
  *
- * Codex round 1 P0 #5: filter by tenant_id + kind='raw'. Multi-row archive:
+ * Filter by tenant_id + kind='raw'. Multi-row archive:
  * GitHub edits keep the same artifact_ref, so multiple active raw rows can
  * match a single deletion event. Archive ALL of them.
  *
- * Claude round 2 P0 #2 (v1.3.1 hotfix): the v1.3.0 implementation called
- * archiveRaw N times in a loop, each opening its own DB handle and SAVEPOINT.
- * The first archive's afterArchive committed the idempotency mark. If archive
- * 2..N threw, idempotency was already committed and retry returned 'duplicate'
- * with archivedCount=0 — survivors stayed searchable, leaking private bodies.
- *
- * v1.3.1 fix: ONE shared DB handle wrapping ALL archives + the idempotency
- * mark in a single outer SAVEPOINT. Any per-row failure rolls back the entire
- * batch (including idempotency), so retry re-attempts cleanly. archiveRawMemory
- * (the lower-level function from raw-archive.js) runs its own inner SAVEPOINT
- * which nests safely inside the outer one.
+ * ONE shared DB handle wraps ALL archives + the idempotency mark in a single
+ * outer SAVEPOINT: a per-row failure rolls back the whole batch, idempotency
+ * included, so a retry re-attempts cleanly instead of leaving searchable
+ * survivors. archiveRawMemory's own inner SAVEPOINT nests safely inside it.
  *
  * Tenant scope and kind='raw' filtering are load-bearing: without them a
  * deletion event from tenant A could archive tenant B's row sharing the same

package/dist/connectors/github/deletion.js

@@ -4,21 +4,14 @@ import { hasSeenKey, markKeySeen } from './idempotency.js';
 /**
  * Handle GitHub `issue_comment.deleted` and `pull_request_review_comment.deleted`.
  *
- * Codex round 1 P0 #5: filter by tenant_id + kind='raw'. Multi-row archive:
+ * Filter by tenant_id + kind='raw'. Multi-row archive:
  * GitHub edits keep the same artifact_ref, so multiple active raw rows can
  * match a single deletion event. Archive ALL of them.
  *
- * Claude round 2 P0 #2 (v1.3.1 hotfix): the v1.3.0 implementation called
- * archiveRaw N times in a loop, each opening its own DB handle and SAVEPOINT.
- * The first archive's afterArchive committed the idempotency mark. If archive
- * 2..N threw, idempotency was already committed and retry returned 'duplicate'
- * with archivedCount=0 — survivors stayed searchable, leaking private bodies.
- *
- * v1.3.1 fix: ONE shared DB handle wrapping ALL archives + the idempotency
- * mark in a single outer SAVEPOINT. Any per-row failure rolls back the entire
- * batch (including idempotency), so retry re-attempts cleanly. archiveRawMemory
- * (the lower-level function from raw-archive.js) runs its own inner SAVEPOINT
- * which nests safely inside the outer one.
+ * ONE shared DB handle wraps ALL archives + the idempotency mark in a single
+ * outer SAVEPOINT: a per-row failure rolls back the whole batch, idempotency
+ * included, so a retry re-attempts cleanly instead of leaving searchable
+ * survivors. archiveRawMemory's own inner SAVEPOINT nests safely inside it.
  *
  * Tenant scope and kind='raw' filtering are load-bearing: without them a
  * deletion event from tenant A could archive tenant B's row sharing the same

package/dist/connectors/github/dlq.d.ts

@@ -3,9 +3,8 @@ import type { Context } from '../../api.js';
 /**
  * GitHub webhook DLQ. Mirrors the Slack DLQ shape (src/connectors/slack/dlq.ts)
  * but carries GitHub-specific metadata: event_name, delivery_id, signature,
- * installation_id, repo_full_name. Codex P1 #5 mandates this rich context
- * so a `hippo gh dlq replay` operator can triage without re-deriving anything
- * from the raw payload.
+ * installation_id, repo_full_name, so a `hippo gh dlq replay` operator can
+ * triage without re-deriving anything from the raw payload.
  *
  * Buckets:
  *   - parse_error     — raw_payload was not valid JSON
@@ -56,7 +55,7 @@ export interface ReplayDlqOpts {
     /** Current webhook secret. If omitted, signature check is skipped (force-only path). */
     webhookSecret?: string;
     /**
-     * Previous webhook secret during rotation (v1.3.1 hotfix — claude P1).
+     * Previous webhook secret during rotation.
      * Operators rotating GITHUB_WEBHOOK_SECRET would otherwise be forced into
      * --force on DLQ rows written under the old secret. Plumbed through to
      * verifyGitHubSignature.previousSecret.
@@ -79,10 +78,8 @@ export interface ReplayResult {
  * route already knows how to route an envelope, so it passes that capability
  * back in.
  *
- * v1.3.2 (claude review): the v1.3.1 contract advertised an `idempotencyKey`
- * field, but the v1.3.1 ingest re-derives the key from the parsed event
- * itself, so the field was a phantom — any future hook that trusted the
- * passed-in value would dedupe against a stale key. Field removed.
+ * No `idempotencyKey` field: ingest re-derives the key from the parsed event,
+ * so a hook trusting a passed-in key would dedupe against a stale one.
  */
 export type IngestHook = (ctx: Context, args: {
     rawPayload: string;
@@ -101,7 +98,7 @@ export type IngestHook = (ctx: Context, args: {
  *   4. Type-guard the envelope. Fail → bump, `unhandled`.
  *   5. If an `ingestHook` is supplied, call it and return its memoryId.
  *      If not (dry-run path), bump retry_count and return status `replayed`
- *      with memoryId=null. The webhook route wires the real hook in Task 14.
+ *      with memoryId=null. The webhook route wires the real hook.
  *
  * Mirrors Slack's "always use current routing" policy: replays use the
  * deployment state NOW, not at the time of original DLQing.

package/dist/connectors/github/dlq.js

@@ -79,7 +79,7 @@ function bumpRetryCount(hippoRoot, id) {
  *   4. Type-guard the envelope. Fail → bump, `unhandled`.
  *   5. If an `ingestHook` is supplied, call it and return its memoryId.
  *      If not (dry-run path), bump retry_count and return status `replayed`
- *      with memoryId=null. The webhook route wires the real hook in Task 14.
+ *      with memoryId=null. The webhook route wires the real hook.
  *
  * Mirrors Slack's "always use current routing" policy: replays use the
  * deployment state NOW, not at the time of original DLQing.
@@ -125,8 +125,7 @@ export async function replayDlqEntry(ctx, id, opts = {}) {
     // Real replay path. The route's IngestHook is responsible for routing,
     // idempotency, and writing the memory. The DLQ module only validates the
     // surface and bumps the retry counter.
-    // v1.3.2: dropped the stale idempotencyKey arg — the hook re-derives it
-    // from the parsed event (artifact_ref + updated_at) since v1.3.1.
+    // No idempotencyKey arg: the hook re-derives it from the parsed event (artifact_ref + updated_at).
     const eventName = row.eventName ?? '';
     const deliveryId = row.deliveryId ?? '';
     const { memoryId } = await opts.ingestHook(ctx, {

package/dist/connectors/github/ingest.d.ts

@@ -2,11 +2,11 @@
  * GitHub event ingest with afterWrite race-safe idempotency.
  *
  * Mirrors src/connectors/slack/ingest.ts. The dedupe key is sha256(eventName +
- * ':' + rawBody) (codex P0 #3) — derived from the signed body, not from the
+ * ':' + rawBody), derived from the signed body, not from the
  * unsigned X-GitHub-Delivery header, so a replay attacker cannot bypass
  * idempotency by rotating the delivery UUID.
  *
- * Race semantics (codex P1 #6):
+ * Race semantics:
  *   - Fast path: hasSeenKey pre-check returns 'duplicate' for the common case.
  *   - Slow path: hasSeenKey passes (no row yet). Two workers may race into
  *     remember() concurrently. Inside the writeEntry SAVEPOINT, INSERT OR
@@ -15,10 +15,8 @@
  *     rolls back this worker's memory row). Exactly one memory exists per
  *     idempotency_key.
  *
- * The Slack precedent's race test was insufficient — it tested the fast path,
- * not the SAVEPOINT collision. The `__testInjectBeforeLog` hook below lets
- * tests pre-populate github_event_log inside the SAVEPOINT to actually
- * exercise the changes=0 -> rollback path.
+ * The `__testInjectBeforeLog` hook below lets tests pre-populate github_event_log
+ * inside the SAVEPOINT to exercise the changes=0 -> rollback path, not just the fast path.
  */
 import { type Context } from '../../api.js';
 import { type DatabaseSyncLike } from '../../db.js';
@@ -50,7 +48,7 @@ export type IngestEvent = {
 export interface IngestInput {
     /** The X-GitHub-Event header value + parsed body, discriminated. */
     event: IngestEvent;
-    /** The raw HTTP body — used for the idempotency key (replay-safe per codex P0 #3). */
+    /** The raw HTTP body, used for the idempotency key (replay-safe). */
     rawBody: string;
     /** X-GitHub-Delivery header value, audit metadata only. */
     deliveryId: string;

package/dist/connectors/github/ingest.js

@@ -2,11 +2,11 @@
  * GitHub event ingest with afterWrite race-safe idempotency.
  *
  * Mirrors src/connectors/slack/ingest.ts. The dedupe key is sha256(eventName +
- * ':' + rawBody) (codex P0 #3) — derived from the signed body, not from the
+ * ':' + rawBody), derived from the signed body, not from the
  * unsigned X-GitHub-Delivery header, so a replay attacker cannot bypass
  * idempotency by rotating the delivery UUID.
  *
- * Race semantics (codex P1 #6):
+ * Race semantics:
  *   - Fast path: hasSeenKey pre-check returns 'duplicate' for the common case.
  *   - Slow path: hasSeenKey passes (no row yet). Two workers may race into
  *     remember() concurrently. Inside the writeEntry SAVEPOINT, INSERT OR
@@ -15,10 +15,8 @@
  *     rolls back this worker's memory row). Exactly one memory exists per
  *     idempotency_key.
  *
- * The Slack precedent's race test was insufficient — it tested the fast path,
- * not the SAVEPOINT collision. The `__testInjectBeforeLog` hook below lets
- * tests pre-populate github_event_log inside the SAVEPOINT to actually
- * exercise the changes=0 -> rollback path.
+ * The `__testInjectBeforeLog` hook below lets tests pre-populate github_event_log
+ * inside the SAVEPOINT to exercise the changes=0 -> rollback path, not just the fast path.
  */
 import { remember } from '../../api.js';
 import { openHippoDb, closeHippoDb } from '../../db.js';
@@ -39,7 +37,7 @@ function transformEvent(event) {
     }
 }
 /**
- * v1.3.1: extract the source-normalized identifier the idempotency key needs.
+ * Extract the source-normalized identifier the idempotency key needs.
  * Backfill and webhook both produce IngestEvent objects describing the same
  * source revision, so deriving the key from these fields collapses both paths
  * onto the same dedupe row. Mirrors the artifactRef strings in transform.ts.
@@ -113,10 +111,8 @@ export function ingestEvent(ctx, input) {
             }
         }
         if (e instanceof RejectedValueError) {
-            // AT1 (plan §3 containment): a tombstone hit is a PERMANENT skip, not
-            // a transient failure — never DLQ-retry it. Mark the idempotency key
-            // seen exactly like the empty-body branch above so a GitHub retry of
-            // the same delivery acks as done, not error.
+            // A tombstone hit is a PERMANENT skip, never DLQ-retried: mark the key seen like the empty-body
+            // branch above so a GitHub retry of the same delivery acks as done, not error.
             markKeySeenWithoutMemory(ctx.hippoRoot, idempotencyKey, input);
             return { status: 'skipped', memoryId: null };
         }
@@ -135,7 +131,7 @@ function markKeySeenWithoutMemory(hippoRoot, idempotencyKey, input) {
     }
 }
 function rememberWithEventLog(ctx, input, idempotencyKey, opts) {
-    // v1.12.0: drop the legacy `|| 'connector:github'` fallback (see slack/ingest.ts:73 for rationale).
+    // No `|| 'connector:github'` fallback (see rememberWithEventLog in slack/ingest.ts for rationale).
     const result = remember(ctx, {
         ...opts,
         untrusted: true,

package/dist/connectors/github/octokit-client.d.ts

@@ -4,13 +4,11 @@
  * Production uses `realGitHubFetcher` against `https://api.github.com`.
  * Tests inject a fake `GitHubFetcher` so they never hit the network.
  *
- * Codex P1 #4 mandate: any non-200 response that is NOT a recognized
- * rate-limit pause MUST throw `GitHubFetchError`. Silently turning
- * 401/403/404/500 into empty pages produced empty backfills with no
- * operator signal, so this code path is now load-bearing.
+ * Any non-200 response that is NOT a recognized rate-limit pause MUST throw
+ * `GitHubFetchError`: an empty page would be an empty backfill with no operator signal.
  */
-import type { JsonValue } from './types.js';
 import { type RateLimitInfo } from './ratelimit.js';
+import type { JsonValue } from '../../json.js';
 export declare class GitHubFetchError extends Error {
     readonly status: number;
     readonly bodyExcerpt: string;

package/dist/connectors/github/octokit-client.js

@@ -4,10 +4,8 @@
  * Production uses `realGitHubFetcher` against `https://api.github.com`.
  * Tests inject a fake `GitHubFetcher` so they never hit the network.
  *
- * Codex P1 #4 mandate: any non-200 response that is NOT a recognized
- * rate-limit pause MUST throw `GitHubFetchError`. Silently turning
- * 401/403/404/500 into empty pages produced empty backfills with no
- * operator signal, so this code path is now load-bearing.
+ * Any non-200 response that is NOT a recognized rate-limit pause MUST throw
+ * `GitHubFetchError`: an empty page would be an empty backfill with no operator signal.
  */
 import { parseRateLimit } from './ratelimit.js';
 import { fetchWithRetry } from '../../http-retry.js';
@@ -44,6 +42,7 @@ function headersToRecord(h) {
     return Object.fromEntries(entries);
 }
 const GITHUB_TIMEOUT_MS = 30_000;
+const ERROR_BODY_SNIPPET_CHARS = 256;
 export const realGitHubFetcher = async ({ url, token }) => {
     const res = await fetchWithRetry(url, {
         headers: {
@@ -54,10 +53,10 @@ export const realGitHubFetcher = async ({ url, token }) => {
     }, { timeoutMs: GITHUB_TIMEOUT_MS });
     const headers = headersToRecord(res.headers);
     const rateLimit = parseRateLimit(headers, res.status);
-    // Codex P1 #4: don't silently turn 401/403/404/500 into empty pages.
+    // Don't silently turn 401/403/404/500 into empty pages.
     if (res.status !== 200 && rateLimit.reason === 'none') {
         const body = await res.text().catch(() => '');
-        throw new GitHubFetchError(res.status, body.slice(0, 256), url);
+        throw new GitHubFetchError(res.status, body.slice(0, ERROR_BODY_SNIPPET_CHARS), url);
     }
     // SAFETY: GitHub's list/paginated endpoints (issues, comments, etc. — the
     // only endpoints this backfill fetcher targets) return a JSON array body