kyleandClaude Opus 5.5
10d2e41f43
memoryd's writes go through bxcore::sanitize::refuse, then flag; check.rs and its test go. A refused write answers with the rule's sentence and is logged with the rule's name; a flagged identity write becomes untrusted notes with the rule in the answer, the journal (new optional field `flag`) and the log, and is never staged for review; the block leaves out an entry that breaks a refuse rule and logs the rule. The three runbook entries the new pointers need are given here as fragments, because the gate's runbook check fails on a pointer without its entry. Checks, on titan (rustc 1.98.1, clippy 0.1.98): - given tests fail before as the task says: 7 failing in edit, serve and serve_sanitize; files and sanitize do not compile (E0609; E0432, E0609, E0615) - the task's edits, parsed from the task file and applied to a fresh ref-05 worktree with its own target/, give a tree byte-identical to the reference; its gate: ok, 1033 tests; /private/tmp unchanged - 26 one-line mutations of the reference, each caught by the given tests - new tests stressed under load: 30 runs, 0 failures - no chat-template tag and no whole fake key in the task or given files Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
21 lines
1.2 KiB
Markdown
21 lines
1.2 KiB
Markdown
## memory-entry-excluded
|
|
|
|
**What you see.** `memoryd` logged `memoryd: an entry of memory.md was left out of the block by
|
|
the rule <rule>; see docs/runbook.md#memory-entry-excluded` (or `user.md`), each time a session
|
|
starts. Sessions start as usual, but the agent does not know that entry.
|
|
|
|
**Why.** When a session starts, every entry of `memory.md` and `user.md` is checked again against
|
|
the sanitizer's refuse rules (M5b spec, section 7), and an entry that breaks one is left out of
|
|
the prompt. So a rule added later, or an entry an editor put in by hand, protects at once, with no
|
|
migration. The file itself is not changed. Flag rules are not checked here, so an entry you moved
|
|
from `notes.md` by hand stays in, and `soul.md` is the owner's and is not checked at all.
|
|
|
|
**Confirm.** The rule in the log line names the kind of text (`secret-github`, `invisible`, …).
|
|
Run each entry of the file through `bxctl sanitize check`: the one it reports is the one left out.
|
|
|
|
**Fix.** Edit the file with an editor: remove the entry, or the part of it that breaks the rule.
|
|
Entries are separated by a line holding only `§`. A secret does not belong in memory: rotate it
|
|
if it was real.
|
|
|
|
**Check.** Start a new conversation: `memoryd` does not log the line again.
|