mirror of
https://github.com/garrytan/gbrain.git
synced 2026-07-27 22:15:33 +00:00
* v0.40.4.0 T1: shared audit-writer primitive Extract createAuditWriter() helper. Five hand-rolled JSONL audit modules (rerank-audit, shell-audit, supervisor-audit, audit-slug- fallback, phantom-audit) duplicated the same ISO-week filename math, best-effort write loop, and read-current-plus-previous-week loop. T2 refactors all 5 onto this primitive. Behavior preservation: filename format, JSONL line shape, mkdir recursive, appendFileSync utf8, stderr-on-failure all byte-identical to the existing modules so their tests pass unchanged. resolveAuditDir() moves here from shell-audit.ts; shell-audit.ts will re-export for back-compat (T2). Honors GBRAIN_AUDIT_DIR with whitespace-trim, falls back to ~/.gbrain/audit/. Test coverage: 22 cases covering ISO-week math + year-boundary edges (2027-01-01 → 2026-W53), env override, mkdir-recursive, fail-open stderr-warn shape, cross-week readback, corrupt-row skip, non-finite- ts skip, round-trip with nested fields, computeFilename + resolveDir accessors. Plan ref: D5=B audit unification cathedral expansion. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 T2: refactor 5 audit modules onto shared writer Replace the duplicated ISO-week filename math + best-effort write loop + read-current-plus-previous-week loop in: - src/core/rerank-audit.ts (rerank-failures-*.jsonl) - src/core/audit-slug-fallback.ts (slug-fallback-*.jsonl) - src/core/minions/handlers/shell-audit.ts (shell-jobs-*.jsonl) - src/core/minions/handlers/supervisor-audit.ts (supervisor-*.jsonl) - src/core/facts/phantom-audit.ts (phantoms-*.jsonl) All five now delegate file I/O to createAuditWriter from T1. Public API preserved bit-for-bit: - logRerankFailure, readRecentRerankFailures, computeRerankAuditFilename - logSlugFallback, readRecentSlugFallbacks, computeSlugFallbackAuditFilename - logShellSubmission, computeAuditFilename, resolveAuditDir - writeSupervisorEvent, readSupervisorEvents, computeSupervisorAuditFilename plus isCrashExit, summarizeCrashes, CrashSummary (domain-specific helpers stay in supervisor-audit.ts; only file I/O moves) - logPhantomEvent, readRecentPhantomEvents, computePhantomAuditFilename Domain-specific behavior preserved: - audit-slug-fallback emits per-call stderr (D7 dual logging) in the caller; the shared writer is failure-only stderr - rerank-audit truncates error_summary to 200 chars before write - phantom-audit spreads optional fields conditionally (skip undefined) - supervisor-audit keeps single-file readback (no cross-week walk) to preserve pre-v0.40.4 doctor assertions resolveAuditDir lives in src/core/audit/audit-writer.ts; shell-audit.ts re-exports it so existing imports keep working (every other audit module + gbrain-home-isolation.test.ts + minions.test.ts + minions-shell.test.ts pull resolveAuditDir from shell-audit.ts). Operator-visible drift: rerank-audit stderr line drops the 'rerank-failure audit' qualifier — was '[gbrain] rerank-failure audit write failed (...)' now '[gbrain] write failed (...); search continues'. Stderr is human-debugging, not machine-parsed; the file written gives the qualifier away in `tail -f audit/*`. Test coverage: 128/128 audit-touching tests pass unchanged. Plan ref: D5=B audit unification cathedral expansion. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 T3: getAdjacencyBoosts engine method (PG+PGLite parity) Add BrainEngine.getAdjacencyBoosts(pageIds) returning Map<page_id, AdjacencyRow{hits, cross_source_hits}>. Returns ALL pages with hits >= 1 (callers apply their own threshold). Cross-source semantic (D15=A): cross_source_hits EXCLUDES the target page's own source. A page in source A linked from 2 pages in source A reports cross_source_hits = 0. Linked from 1 in source B + 1 in source C reports 2. Source-scope contract: pageIds MUST already be source-scoped by the caller. Method does NOT filter by source_id. The in-set restriction makes cross-source leakage impossible by construction. JSDoc spells this out; same trust posture as cosineReScore's chunk_id handling. COALESCE(p.source_id, 'default') on both target and from-page sides for defense-in-depth even though pages.source_id is NOT NULL today. JSDoc/SQL contract alignment (codex #2): HAVING >= 1 matches the "returns ALL pages with hits >= 1" contract; threshold of 2 is the caller's call in applyGraphSignals. Known limitation (codex #15): cross_source_hits cannot distinguish "genuinely linked from another team" from "mirrored imports from another source." T-todo-4 captures the v0.41+ refinement. SearchResult type extension (D4=A flat fields, D12=A attribution): - graph_adjacency_hits, graph_cross_source_hits, graph_session_demoted, graph_session_prefix - base_score, backlink_boost, salience_boost, recency_boost, exact_match_boost, graph_adjacency_boost, graph_cross_source_boost, session_demote_factor, reranker_delta All optional; T4-T6 populate them. Test coverage: 7/7 hermetic PGLite cases. Empty input, singleton, same-source hub, cross-source attribution including the "linked-only-from-other-source" case (widget in source b, linked from alice+bob in source a → cross_source_hits=1), JSDoc HAVING>=1 contract. Postgres parity asserted by SQL-shape identity (will get a mirror Postgres E2E in T10's eval gate work via DATABASE_URL when set; PGLite hermetic case shipped now). NULL source_id COALESCE branch noted as untestable in current PGLite schema (pages.source_id is NOT NULL); kept as defense-in-depth. Plan ref: T3 in v0.40.4.0 wave plan; D1=A, D3=A, D15=A. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 T4+T11: applyGraphSignals 4th stage in runPostFusionStages New file src/core/search/graph-signals.ts. Three signals: 1. Adjacency-within-top-K (×1.05): hits >= 2 inbound from in-set. 2. Cross-source adjacency (×1.10, stacks): cross_source_hits >= 2. Dormant on single-source brains. 3. Session diversification (×0.95): if multiple top-K share a slug prefix, keep highest scoring, DEMOTE the rest. NOT amplify — codex caught the original framing was backwards (amplification of redundancy makes the cited "weak chunks compete for budget" problem worse, not better). Conservative magnitudes (D14=B): 1.05/1.10/0.95. Score-distribution probe (onScoreDistribution) collects min/p25/p50/p75/p95/max + reorder_band_width to feed T-todo-2 magnitude calibration wave. Slot: 4th stage inside runPostFusionStages (hybrid.ts:248), AFTER backlink/salience/recency, pre-dedup. Inherits the v0.35.6.0 floor-ratio gate from computeFloorThreshold — this is the structural protection that prevents a low-cosine hub from outranking a strong non-hub (codex T2 / D1=A). PostFusionOpts extends with graphSignalsEnabled, onGraphMeta, onScoreDistribution. Caller (hybridSearch in subsequent T5 work) resolves graph_signals from the mode bundle. Source-scope contract preserved: getAdjacencyBoosts takes raw page_ids, no source filter. Adjacency is in-set restricted so cross-source leakage is impossible by construction (D3=A). Fail-open: engine throw → JSONL audit row via shared createAuditWriter (T1/T2 primitive, featureName='graph-signals-failures') + meta.errored + caller's results unchanged. Session diversification ALSO skips on failure (predictable all-or-nothing posture). Mutation note (codex #9): score mutated in place. base_score must be stamped at runPostFusionStages entry BEFORE this stage so eval-capture sees pre-boost score (T6 attribution wave). Test coverage (24 cases, including T11 IRON RULE regression): - sessionPrefix multi/single/empty cases - computeScoreDistribution percentile math - Disabled + empty short-circuits - Adjacency hit, no-hit, cross-source stacking, cross-source alone - Session diversification 3-share + single-segment + singleton - Test seam injection (no engine call) - Fail-open: throw → audit row + meta.errored + unchanged - Empty Map → session still runs - Score-distribution always emits when enabled - Meta carries fire counts + duration_ms - Missing page_id silently skipped from dedup set - **T11 IRON RULE regression (3 cases):** * weak hub BELOW floor_threshold does NOT get boosted past above-floor non-hub (the bug class the floor gate exists for) * hub AT floor still gets boosted (gate is < not <=) * NaN score → NaN >= threshold is false → no boost Plan ref: T4 + T11 in v0.40.4.0 wave plan; D1=A, D2=A, D11=B, D14=B, D9=A, D5=B. Codex outside-voice #1 + #2 + #6 + #8 + #9 addressed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 T5: graph_signals mode-bundle knob + KNOBS_HASH bump 3→4 ModeBundle gains graph_signals: boolean. Per-mode defaults: - conservative: false (cost-sensitive tier) - balanced: true (the wave's primary surface for default-on) - tokenmax: true (power-user tier, capstone fit) SearchKeyOverrides + SearchPerCallOpts gain optional graph_signals field. resolveSearchMode picks via the standard per-call → config override → mode bundle chain. loadOverridesFromConfig parses 'search.graph_signals' from the config table ('1' or 'true' → true). SEARCH_MODE_CONFIG_KEYS adds the key so `gbrain search modes --reset` clears it alongside other knobs. KNOBS_HASH_VERSION bump 3→4 (append-only per CDX2-F13). New `gs=` parts entry appended AFTER cross-modal + column + prov entries. A graph-on cache write cannot be served to a graph-off lookup — mid-deploy hit-rate dip clears within cache.ttl_seconds (3600s). src/commands/search.ts KNOB_DESCRIPTIONS gains graph_signals entry so `gbrain search modes` dashboard renders the new knob. Test coverage: - test/search-mode.test.ts (+ 8 new cases): per-mode defaults canonical, config override both directions, per-call override wins, knobsHash distinct for on/off, config key registered, attributeKnob reports per-call + mode sources correctly. - test/search/knobs-hash-reranker.test.ts: version assertion bumped 3→4 with v0.40.4 rationale comment. - test/cross-modal-phase1.test.ts: version assertion bumped 3→4 with v0.40.4 rationale comment. - Canonical-bundle assertions updated to include graph_signals in expected shape (3 cases). 50/50 search-mode tests pass. 45/45 cross-modal pass. 17/17 knobs-hash-reranker pass. 10/10 balanced-reranker pass. Plan ref: T5 in v0.40.4.0 wave plan. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 T6: per-stage attribution stamping in every boost Every boost stage that mutates SearchResult.score now stamps a field recording WHAT it multiplied: - applyBacklinkBoost → backlink_boost (skipped when count == 0) - applySalienceBoost → salience_boost (skipped when score == 0) - applyRecencyBoost → recency_boost (skipped on evergreen prefix) - applyExactMatchBoost → exact_match_boost (skipped on no-match OR when intent's exactMatchBoost == 1.0 no-op) - runPostFusionStages → base_score stamped ONCE at entry, BEFORE any boost mutates r.score. Idempotent: caller-pre-stamped value preserved. Empty-results short-circuit unchanged. - applyReranker → reranker_delta = original_index - new_index (positive = rank improved; raw rerank score stays in rerank_score) - applyGraphSignals → graph_adjacency_boost, graph_cross_source_boost, session_demote_factor (T4 already stamped these) Why: feeds the T7 `gbrain search --explain` formatter so it can attribute the final score to its components. Without these stamps, "why did this rank where it did?" is grep-and-guess. SearchResult.reranker_delta doc updated to clarify it's a RANK delta (positive = improved), not a score delta. The raw relevance score stays in `rerank_score` (untyped, for back-compat with telemetry that already reads it). Test coverage: 16 new cases in test/search/attribution-stamping.test.ts. Pins: every boost stamps when it fires AND skips stamping when it doesn't (no false attribution on no-op stages). base_score idempotency preserved. reranker_delta computed correctly across rank-improved + rank-degraded cases. All 178/178 search tests pass (no regressions). Plan ref: T6 cathedral expansion in v0.40.4.0 wave plan; D12=A. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 T7: gbrain search --explain per-stage attribution New file src/core/search/explain-formatter.ts renders SearchResult[] as a multi-line breakdown of how the final score was formed: 1. people/alice (score=12.4) base=10.2 (rrf+cosine) + backlink ×1.08 + salience ×1.05 + adjacency ×1.05 (hits=3) + cross_source ×1.10 (other_sources=2) ↑ reranker rank +2 = final 12.4 Reads the boost_* / base_score / *_hits fields populated by T4 + T6. Empty path: "no boosts applied" when no stage stamped anything. Session demote rendered with `-` prefix (not `+`) so the demotion direction is visually distinct from boosts. CliOptions gains `explain: boolean`; parseGlobalFlags recognizes `--explain` anywhere in argv. cli.ts formatResult for `search` + `query` cases reads CliOptions.explain via the module-level singleton and routes to formatResultsExplain when set. Lazy import keeps the hot path narrow for the common non-explain case. Number formatting: 4-decimal precision, trailing zeros stripped ('1.0000' → '1', '0.1234' → '0.1234'). NaN preserved as 'NaN'. Test coverage: - test/search/explain-formatter.test.ts: 19 cases pin output format. Each boost type renders correctly, every-stage stacking composes, reranker_delta=0 doesn't render, empty list short- circuits, rank numbering 1-based, number formatting edge cases. - test/cli-options.test.ts: 3 new cases for --explain parsing (basic, absent default, any-argv-position). Existing CliOptions literals in test/cli-options.test.ts + test/thin-client-upgrade-prompt.test.ts updated for new required explain field. JSON envelope unchanged — the same attribution fields surface in existing --json output via JSON.stringify; no separate JSON formatter needed. Plan ref: T7 cathedral expansion in v0.40.4.0 wave plan; D12=A + D6=A. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 T8: doctor check graph_signals_coverage New checkGraphSignalsCoverage in src/commands/doctor.ts. Wired into both runDoctor (local engine) and doctorReportRemote (HTTP MCP / JSON path) so local AND remote-server brains both surface the metric. Logic: 1. Resolve active graph_signals setting: config override 'search.graph_signals' wins, else mode bundle default ('search.mode' → conservative=false, balanced/tokenmax=true). 2. When disabled → silent ok ("disabled — coverage not checked"). Avoids polluting doctor output on installs that don't use the feature. 3. When enabled, compute global inbound-link density: COUNT(DISTINCT to_page_id) / COUNT(*) across non-deleted pages. 4. <10% → warn ("signal will rarely fire") with paste-ready `gbrain extract all` fix hint. 5. >=30% → ok ("fire on most queries") with metric. 6. 10-29% → ok ("fire occasionally") with metric. Known limitation (codex outside-voice #14): global density is an imperfect proxy for "top-K subgraphs have enough edges to fire." T-todo-5 captures the v0.41+ refinement that measures actual fire rate from search-stats after 30 days of data. Best-effort: SQL errors → warn with the underlying message. Never breaks doctor. Test coverage (7 new cases in test/doctor.test.ts): - conservative mode → silent ok regardless of coverage - balanced default + 0 links → warn at 0% with fix hint - balanced default + 40% inbound → ok "fire on most queries" - balanced default + 20% inbound → ok "fire occasionally" - explicit search.graph_signals=false overrides mode default - empty brain → ok with explanation - check is wired into runDoctor (source-grep regression guard) All 55/55 doctor.test.ts cases pass. Plan ref: T8 in v0.40.4.0 wave plan; D6=A. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 T9: gbrain search stats graph_signals section runStatsSubcommand in src/commands/search.ts gains a graph_signals section in both --json and human output: Graph signals: enabled: true (mode default) failures: 3 fail-open event(s) ECONNREFUSED 2 timeout 1 Data sources: - config: 'search.graph_signals' override → enabled + source=config, otherwise mode-bundle default → enabled + source=mode_default. - JSONL audit: readRecentGraphSignalsFailures(days) returns events; failures_count is len, failures_by_reason buckets by first word of error_summary (e.g. 'ECONNREFUSED', 'timeout'). JSON envelope (schema_version 2 unchanged; graph_signals is a new sibling property of stats, so consumers reading the existing fields keep working): { "schema_version": 2, ...stats..., "graph_signals": { "enabled": bool, "source": "config" | "mode_default", "failures_count": int, "failures_by_reason": { reason: count } }, "_meta": { metric_glossary: { ..., graph_signals_enabled: ..., graph_signals_failures_count: ... } } } Fire-rate metrics (adjacency_fires, cross_source_fires, session_demotions) and score-distribution stats are NOT in this section yet — they require telemetry-table writes from the applyGraphSignals onMeta callback. Wired in v0.41+ via T-todo-2 calibration wave (the wave that needs them). For v0.40.4: status + error count is the actionable surface for "is graph_signals on, and is it failing?" Human output: prints the section after the existing stats block. Edge case: when total_calls is 0 BUT graph_signals is enabled OR has historical failures, still prints the section so operators don't lose the signal on a brain with no telemetry yet. Test coverage (6 cases in test/search/search-stats-graph-signals.test.ts): - search.graph_signals=true → enabled true, source=config - mode=conservative → enabled false, source=mode_default - no config → enabled true (balanced default), source=mode_default - JSONL failures bucketed by first word of error_summary - empty audit → failures_count 0, empty failures_by_reason - human output includes "Graph signals:" header Plan ref: T9 in v0.40.4.0 wave plan; D6=A. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 T10: eval gates (longmemeval-mini A/B + paired bootstrap) New test/e2e/graph-signals-eval.test.ts runs each longmemeval-mini question twice (graph_signals off, graph_signals on) and asserts: Gate 1 (QUALITY) — paired bootstrap, 10,000 resamples: - If signals-on is significantly WORSE than off (delta < 0 AND p < 0.05) → fail. - Otherwise pass. p>=0.05 either direction OR delta >= 0 → ok. Gate 2a (CHANGE-MAGNITUDE): mean Jaccard@5 over result-set overlap must be >= 0.5. If results overlap less than half, the change is too large and needs human review before default-on. Gate 2b (CHANGE-MAGNITUDE): top-1 stability rate >= 0.7. If 30%+ of top picks change, hard look required. Gate 3 (HARD ABSOLUTE FLOOR): recall@5 drop <= 5pt. Catastrophic regression catch (codex outside-voice #18 — addresses the "top-5 must not drop at all" brittleness on tiny fixtures). Bootstrap implementation: - Per-question observation is binary (recall@5 hit/miss). - Paired pairing on question_id between on/off branches. - Centered distribution under null (subtract observed mean) per standard paired-bootstrap-shift approach for binary outcomes. - Two-tailed p-value: |resampled delta| >= |observed delta|. - Deterministic seeded RNG so test runs are stable across CI. pairedBootstrapPValue exported as a pure function with separate tests for edge cases (empty input, all-equal, strong positive, strong negative, determinism). Reusable from future calibration waves. Hermetic: in-memory PGLite via createBenchmarkBrain + resetTables between questions. No API keys needed (--no-embed import path exercises keyword-only retrieval). Skips gracefully via describe.skip when the fixture is missing. Plan ref: T10 in v0.40.4.0 wave plan; D7=C absolute floor + D13=A paired bootstrap; codex #4 + #18 stability-vs-quality distinction. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 T12: VERSION + package.json + CHANGELOG + TODOS VERSION: 0.37.11.0 → 0.40.4.0 package.json: 0.37.11.0 → 0.40.4.0 CHANGELOG.md: top entry for v0.40.4.0 in ELI10-lead voice per CLAUDE.md release rules. Lead is plain-English ("Your search now notices when a page is a hub for your query"); precise file paths / SQL semantics / numbers live in the "Itemized changes" section below. Includes the cathedral-expansion notes (D5=B audit unification, D12=A per-stage attribution, D13=A eval gates) and the "To take advantage of v0.40.4.0" verify-and-fix block. TODOS.md: 5 new items captured under "v0.40.4 graph signals — deferred follow-ups (v0.41+)": - T-todo-1: profile graph-signal SQL latency, merge if hot (D8=C) - T-todo-2: magnitude calibration wave from probe data (D14=B / D17) - T-todo-3: DB-backed audit table for cross-deploy observability (codex #15) - T-todo-4: sync-topology-aware cross-source signal (codex #11) - T-todo-5: replace doctor's global density with fire-rate (codex #14) Verified the 3-line audit: VERSION + package.json + CHANGELOG topmost all match 0.40.4.0. `bun install` ran (lockfile unchanged — root package version isn't stored in bun.lock). `bun run build:llms` refreshed llms.txt + llms-full.txt for the next commit. Plan ref: T12 in v0.40.4.0 wave plan. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 TODO: document pre-existing shard-2 flake noticed during ship 3 isCacheSafe test failures in shard 2 reproduce on stashed clean master. Confirmed pre-existing — not introduced by v0.40.4. Filed under "Pre-existing flake on master (noticed during v0.40.4 ship)" with reproduction commands + remediation options. Shipping v0.40.4 through it; future wave can fix. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 privacy scrub: replace wintermute → media in example slugs CLAUDE.md line 550 bans the private OpenClaw fork name in public artifacts. Example session prefix in sessionPrefix() docs + 3 test fixtures swept to 'media/chat/...' instead. Pre-existing scripts/check-privacy.sh in `bun run verify` caught it. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 fix: wire graph_signals from mode bundle to runPostFusionStages CRITICAL: pre-landing review (codex outside-voice via /ship Step 9) caught that hybrid.ts's `postFusionOpts` literal at line 566 was building PostFusionOpts WITHOUT threading `resolvedMode.graph_signals` to `graphSignalsEnabled`. The gate at hybrid.ts:358 read the field from a literal that never set it. Result before this fix: the entire v0.40.4 graph-signals wave was dead code in production. Mode bundles set `balanced.graph_signals = true` and `tokenmax.graph_signals = true`, but no production call site ever reached applyGraphSignals. The KNOBS_HASH bump 3→4 correctly varied the cache key by the flag, so contamination was prevented — but the feature itself never fired. All shipped infrastructure (engine SQL, fail-open audit, attribution stamps, --explain formatter, doctor coverage check, search-stats section) was reachable only through the unit-test seam (`opts.adjacencyFn`). The CHANGELOG-advertised behavior never landed in user-visible search. Fix: thread `graphSignalsEnabled: resolvedMode.graph_signals` into the postFusionOpts literal (1 line). Inline comment names codex's catch so future refactors see the regression class. Tests: new test/search/graph-signals-wire-integration.test.ts pins the wire end-to-end. Three cases: 1. balanced mode → hybridSearch on a seeded brain with adjacency hub produces a result with base_score stamped (proves runPostFusionStages actually ran). 2. search.graph_signals=false config override → no graph_* fields stamped (proves the gate honors the override path). 3. Source-grep regression guard pinning the `graphSignalsEnabled: resolvedMode.graph_signals` literal in hybrid.ts so a future refactor can't silently disconnect. All 57 existing v0.40.4 wave tests still pass. Typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 fix: pre-landing review AUTO-FIX findings (audit msg drift + deleted_at) Two informational findings from /ship pre-landing review (Step 9): 1. Stderr message qualifier drift (rerank/slug-fallback/phantom audits) Pre-v0.40.4 messages included a per-feature qualifier: [gbrain] rerank-failure audit write failed (...) [gbrain] slug-fallback audit write failed (...) [gbrain] phantom audit write failed (...) The T2 refactor dropped the qualifier (plan promised "byte-identical" operator-visible behavior, but stderr lines did drift). Restored via new `errorMessagePrefix` option on `createAuditWriter` (optional, '' default). Three modules pass the per-feature qualifier; shell-audit and supervisor-audit unaffected (their pre-v0.40.4 messages didn't have a separate qualifier — label already carried the feature name). 2. Defense-in-depth `deleted_at IS NULL` on getAdjacencyBoosts SQL was previously protected by-construction (hybridSearch's visibility filter ensures input pageIds are live), but matches the v0.35.5.0 findOrphanPages pattern and closes the bug class if a future caller bypasses hybridSearch. Added to both Postgres and PGLite engines for parity. Three JOIN sites guarded (targets CTE, FROM-pages join). One inline comment per engine cites the codex review and the v0.35.5.0 precedent. Plan ref: /ship pre-landing review v0.40.4.0 (codex finding C and F). All 84 audit+graph-signals tests pass. Typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 fix: adversarial review HIGH findings (codex H1+H2 + Claude F1) Three HIGH-severity issues from /ship adversarial pass: H1 (Codex): Eval gate was a no-op. Test passed `graph_signals: graphSignalsOn` via `as any` cast, but SearchOpts had no field and hybridSearch's perCall didn't thread it. Both off/on branches resolved to the mode-bundle default — gate measured identical behavior, could pass while detecting nothing. Fix: add `graph_signals?: boolean` to SearchOpts (types.ts:794). Thread `opts.graph_signals` into perCall in both hybridSearch (hybrid.ts:425) AND hybridSearchCached (hybrid.ts:1027) so the cache-key resolver also sees the override. Drop the `as any` from the eval test — types are real now. H2 (Codex): Session diversification fired on entity directories. sessionPrefix() used "any shared parent directory" as the session signal. Result: a search for "people in SF" returned `people/alice` + `people/bob` + `people/charlie` and the latter two got demoted to 0.95×. Every common entity-search query silently penalized legitimate same-type results. Default-on for balanced/tokenmax means production behavior was wrong. Fix: narrow sessionPrefix() to fire ONLY when the slug contains a session-like marker (`chat`/`session`/`sessions` segment OR a `YYYY-MM-DD` date segment). Entity directories (`people/`, `companies/`, `docs/`) return null → diversification skips. Returns NULL (not the slug itself) so the loop skips clean. Examples in JSDoc: your-agent/chat/2026-05-20-foo → 'your-agent/chat/2026-05-20-foo' daily/2026-05-20/journal-entry-1 → 'daily/2026-05-20' transcripts/chat/funding-discussion → 'transcripts/chat/funding-discussion' people/alice → null ← codex H2 regression docs/quickstart → null F1 (Claude adversarial subagent): case-sensitivity drift across 3 sites. loadOverridesFromConfig in mode.ts is case-insensitive + whitespace-trimmed for 'search.graph_signals' values. But doctor's checkGraphSignalsCoverage (doctor.ts:899) AND search-stats's readGraphSignalsStats (search.ts:288) used case-sensitive compare. User sets `search.graph_signals TRUE`: production enables the feature, but doctor + search-stats both silently report disabled. Operators lose the only observability surface for the new feature on values like 'True'/'TRUE'. Fix: trim + lowercase parity at both sites. Mirror the parser's semantic. Also case-normalized `search.mode` reads at both sites for the same divergence class. Tests: - sessionPrefix block rewritten with 7 cases covering chat marker + date anchor + entity dirs (now-NULL) + degenerate (no /). - Added regression test pinning codex H2: people/alice + people/bob + people/charlie do NOT get diversified. - graph-signals-eval.test.ts drops `as any` — typed field works. - Existing tests using `chat/a`/`chat/b` updated to session-shaped `media/2026-05-20/chunk-a` so the date anchor actually fires. 111/111 graph-signals + doctor + search-stats tests pass. Typecheck clean. Plan ref: /ship adversarial review v0.40.4.0 (codex H1, H2; Claude F1). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * v0.40.4.0 TODOs: capture 11 LOW adversarial findings for v0.41+ Codex L1 (audit window underreport) + Claude F2/F3/F5-F8/F11/F12/F14/F16 from /ship adversarial review. None are load-bearing; all captured under 'v0.40.4 adversarial review LOW findings — captured for v0.41+'. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * docs: update project documentation for v0.40.4.0 - README: surface v0.40.4.0 graph signals + --explain in Hybrid search capability - CLAUDE.md: annotate engine.ts getAdjacencyBoosts, new graph-signals.ts / explain-formatter.ts / audit/audit-writer.ts, plus hybrid.ts post-fusion 4th stage, mode.ts graph_signals knob + KNOBS_HASH 3→4, cli-options.ts --explain flag, search stats + doctor coverage check - llms-full.txt: regenerated from CLAUDE.md per the build:llms chaser rule Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(ci): pin bun-version to 1.3.13 across all workflows setup-bun action with `bun-version: latest` calls the GitHub API (https://api.github.com/repos/oven-sh/bun/git/refs/tags) to resolve the tag. CI started failing today with HTTP 401 "Bad credentials" even though the action receives a token (visible as `token: ***` in the run log). Pinning the version eliminates the API call entirely. Affected workflows: test.yml, e2e.yml, release.yml, heavy-tests.yml (5 invocations total). Pinned to 1.3.13 — matches package.json engines (`bun >= 1.3.10`) and the version v0.40.4.0 was developed against. Bump cadence: when a new bun version is required, update this pin in one PR. Trading "always-latest" for "always-deterministic" is the right trade for a 5-shard CI matrix. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
303 lines
11 KiB
TypeScript
303 lines
11 KiB
TypeScript
/**
|
|
* v0.40.4.0 — Eval gates for graph_signals default-on (T10, D13=A).
|
|
*
|
|
* Three load-bearing gates against longmemeval-mini fixture:
|
|
*
|
|
* Gate 1 (QUALITY): paired-bootstrap p>=0.05 in the WRONG direction
|
|
* (signals-on significantly worse than off) → fail. Plus a hard
|
|
* 5pt absolute floor on recall@5 drop as the sanity catch.
|
|
*
|
|
* Gate 2 (CHANGE-MAGNITUDE): Jaccard@5 >= 0.5 + top-1 stability
|
|
* >= 0.7. These are NOT quality metrics (codex outside-voice #18 +
|
|
* #4 caught the framing); their purpose is regression-magnitude
|
|
* detection — if results overlap less than 50%, the change is too
|
|
* large and needs human review before shipping default-on.
|
|
*
|
|
* Gate 3 (HARD ABSOLUTE FLOOR): recall@5 must NOT drop by more than
|
|
* 5 absolute points (catastrophic regression catch).
|
|
*
|
|
* Hermetic via in-memory PGLite seeded from the fixture. No API keys.
|
|
* Skips gracefully when the fixture is missing.
|
|
*
|
|
* Paired bootstrap implementation: 10,000 resamples (D13=A spec).
|
|
* Per-question observation is binary (recall@5 hit/miss); paired
|
|
* pairing is on the same question id across on/off branches. Test
|
|
* statistic: mean(on) - mean(off). p-value is the two-tailed
|
|
* proportion of resamples where the resampled delta is on the
|
|
* opposite side of the observed delta.
|
|
*/
|
|
|
|
import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
|
|
import { existsSync, readFileSync } from 'fs';
|
|
import { join } from 'path';
|
|
import {
|
|
createBenchmarkBrain,
|
|
resetTables,
|
|
} from '../../src/eval/longmemeval/harness.ts';
|
|
import { haystackToPages, type LongMemEvalQuestion } from '../../src/eval/longmemeval/adapter.ts';
|
|
import { importFromContent } from '../../src/core/import-file.ts';
|
|
import { hybridSearch } from '../../src/core/search/hybrid.ts';
|
|
import type { PGLiteEngine } from '../../src/core/pglite-engine.ts';
|
|
|
|
const FIXTURE_PATH = join(import.meta.dir, '..', 'fixtures', 'longmemeval-mini.jsonl');
|
|
const TOP_K = 5;
|
|
|
|
let engine: PGLiteEngine;
|
|
|
|
beforeAll(async () => {
|
|
if (!existsSync(FIXTURE_PATH)) return; // skipped at describe level
|
|
engine = await createBenchmarkBrain();
|
|
});
|
|
|
|
afterAll(async () => {
|
|
if (engine) await engine.disconnect();
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Run one question with graph_signals on or off; return recall@k hit + top-k
|
|
// session IDs (for Jaccard + top-1 stability metrics).
|
|
// ---------------------------------------------------------------------------
|
|
|
|
interface QuestionResult {
|
|
question_id: string;
|
|
hit: boolean;
|
|
session_ids: string[]; // ordered top-K
|
|
}
|
|
|
|
async function runQuestion(
|
|
q: LongMemEvalQuestion,
|
|
graphSignalsOn: boolean,
|
|
): Promise<QuestionResult> {
|
|
await resetTables(engine);
|
|
const pages = haystackToPages(q);
|
|
for (const p of pages) {
|
|
await importFromContent(engine, p.slug, p.content, { noEmbed: true });
|
|
}
|
|
// Keyword-only path is most stable on tiny fixtures with no embedder.
|
|
// Use hybridSearch which honors per-call graph_signals override
|
|
// (v0.40.4 — typed field on SearchOpts, threaded into perCall in
|
|
// hybrid.ts via resolveSearchMode chain).
|
|
const results = await hybridSearch(engine, q.question, {
|
|
limit: TOP_K,
|
|
expansion: false,
|
|
graph_signals: graphSignalsOn,
|
|
});
|
|
const sessionIds = uniqSessionIds(results);
|
|
const gt = new Set(q.answer_session_ids ?? []);
|
|
const hit = sessionIds.some(s => gt.has(s));
|
|
return { question_id: q.question_id, hit, session_ids: sessionIds };
|
|
}
|
|
|
|
function uniqSessionIds(results: any[]): string[] {
|
|
const seen = new Set<string>();
|
|
const out: string[] = [];
|
|
for (const r of results) {
|
|
// slug is `chat/<session_id>` per adapter.ts.
|
|
const sid = (r.slug ?? '').replace(/^chat\//, '');
|
|
if (sid && !seen.has(sid)) {
|
|
seen.add(sid);
|
|
out.push(sid);
|
|
}
|
|
}
|
|
return out;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Paired bootstrap (D13=A). Bernoulli observations per question; pairing on
|
|
// question_id between on/off branches. Returns two-tailed p-value for the
|
|
// null hypothesis "no difference."
|
|
// ---------------------------------------------------------------------------
|
|
|
|
export function pairedBootstrapPValue(
|
|
pairs: Array<{ on: number; off: number }>, // observed Bernoulli (0/1) per question
|
|
resamples = 10_000,
|
|
rng: () => number = Math.random,
|
|
): { pValue: number; observedDelta: number; ci95: [number, number] } {
|
|
const n = pairs.length;
|
|
if (n === 0) return { pValue: 1.0, observedDelta: 0, ci95: [0, 0] };
|
|
|
|
const observedDelta = pairs.reduce((s, p) => s + (p.on - p.off), 0) / n;
|
|
|
|
// Center the distribution under the null (subtract observed mean to
|
|
// simulate "no real effect"). This is the conventional pairing-aware
|
|
// bootstrap-shift approach for binary outcomes.
|
|
const centered = pairs.map(p => (p.on - p.off) - observedDelta);
|
|
|
|
const resampledDeltas: number[] = new Array(resamples);
|
|
for (let i = 0; i < resamples; i++) {
|
|
let sum = 0;
|
|
for (let j = 0; j < n; j++) {
|
|
const idx = Math.floor(rng() * n);
|
|
sum += centered[idx];
|
|
}
|
|
resampledDeltas[i] = sum / n;
|
|
}
|
|
|
|
// Two-tailed p-value: proportion of resampled |delta| >= observed |delta|.
|
|
const abs = Math.abs(observedDelta);
|
|
let extreme = 0;
|
|
for (const d of resampledDeltas) {
|
|
if (Math.abs(d) >= abs) extreme++;
|
|
}
|
|
const pValue = extreme / resamples;
|
|
|
|
// 95% CI on the bootstrap (uncentered) for the observed delta.
|
|
const rawDeltas = pairs.map(p => p.on - p.off);
|
|
const sorted = [...rawDeltas].sort((a, b) => a - b);
|
|
const lowIdx = Math.max(0, Math.floor(0.025 * sorted.length));
|
|
const highIdx = Math.min(sorted.length - 1, Math.ceil(0.975 * sorted.length));
|
|
return {
|
|
pValue,
|
|
observedDelta,
|
|
ci95: [sorted[lowIdx] ?? 0, sorted[highIdx] ?? 0],
|
|
};
|
|
}
|
|
|
|
function jaccard(a: string[], b: string[]): number {
|
|
const sa = new Set(a);
|
|
const sb = new Set(b);
|
|
let intersect = 0;
|
|
for (const x of sa) if (sb.has(x)) intersect++;
|
|
const union = sa.size + sb.size - intersect;
|
|
return union === 0 ? 1.0 : intersect / union;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Test suite
|
|
// ---------------------------------------------------------------------------
|
|
|
|
const fixtureExists = existsSync(FIXTURE_PATH);
|
|
const describeFn = fixtureExists ? describe : describe.skip;
|
|
|
|
describeFn('v0.40.4 — graph_signals eval gates (longmemeval-mini A/B)', () => {
|
|
let questions: LongMemEvalQuestion[];
|
|
let onResults: QuestionResult[];
|
|
let offResults: QuestionResult[];
|
|
|
|
beforeAll(async () => {
|
|
if (!fixtureExists) return;
|
|
const raw = readFileSync(FIXTURE_PATH, 'utf8');
|
|
questions = raw.trim().split('\n').map(l => JSON.parse(l));
|
|
|
|
// Run each question twice: off, then on. resetTables between runs is
|
|
// handled inside runQuestion.
|
|
offResults = [];
|
|
onResults = [];
|
|
for (const q of questions) {
|
|
offResults.push(await runQuestion(q, false));
|
|
onResults.push(await runQuestion(q, true));
|
|
}
|
|
});
|
|
|
|
test('Gate 0: fixture loaded with >=3 questions (sanity)', () => {
|
|
expect(questions.length).toBeGreaterThanOrEqual(3);
|
|
});
|
|
|
|
test('Gate 1 (QUALITY): no statistically significant regression in wrong direction', () => {
|
|
// Build paired observations. recall@5 hit = 1 if any retrieved session
|
|
// matches ground truth.
|
|
const pairs = onResults.map((r, i) => ({
|
|
on: r.hit ? 1 : 0,
|
|
off: offResults[i].hit ? 1 : 0,
|
|
}));
|
|
|
|
// Deterministic RNG for stable test runs. Linear-congruential.
|
|
let seed = 0xDEADBEEF;
|
|
const rng = () => {
|
|
seed = (seed * 1664525 + 1013904223) >>> 0;
|
|
return seed / 0xFFFFFFFF;
|
|
};
|
|
|
|
const result = pairedBootstrapPValue(pairs, 10_000, rng);
|
|
// If signals-on is significantly WORSE (delta < 0) AND p < 0.05, fail.
|
|
// If p >= 0.05 either direction OR delta >= 0, pass.
|
|
if (result.pValue < 0.05 && result.observedDelta < 0) {
|
|
throw new Error(
|
|
`Gate 1 FAILED: graph_signals on is significantly worse than off ` +
|
|
`(delta=${result.observedDelta.toFixed(3)}, p=${result.pValue.toFixed(3)}, ` +
|
|
`n=${pairs.length}). Recall@5 dropped meaningfully.`,
|
|
);
|
|
}
|
|
// Log the observed delta for posterity (informational, not assertion).
|
|
if (process.env.GBRAIN_EVAL_VERBOSE) {
|
|
console.log(`Gate 1: observedDelta=${result.observedDelta.toFixed(3)}, p=${result.pValue.toFixed(3)}`);
|
|
}
|
|
expect(true).toBe(true); // gate passed
|
|
});
|
|
|
|
test('Gate 2a (CHANGE-MAGNITUDE): mean Jaccard@5 >= 0.5', () => {
|
|
const jaccards = onResults.map((r, i) => jaccard(r.session_ids, offResults[i].session_ids));
|
|
const mean = jaccards.reduce((s, x) => s + x, 0) / jaccards.length;
|
|
expect(mean).toBeGreaterThanOrEqual(0.5);
|
|
});
|
|
|
|
test('Gate 2b (CHANGE-MAGNITUDE): top-1 stability >= 0.7', () => {
|
|
let stable = 0;
|
|
for (let i = 0; i < onResults.length; i++) {
|
|
const onTop = onResults[i].session_ids[0];
|
|
const offTop = offResults[i].session_ids[0];
|
|
if (onTop && offTop && onTop === offTop) stable++;
|
|
}
|
|
const rate = stable / onResults.length;
|
|
expect(rate).toBeGreaterThanOrEqual(0.7);
|
|
});
|
|
|
|
test('Gate 3 (HARD ABSOLUTE FLOOR): recall@5 drop <= 5pt', () => {
|
|
const onRecall = onResults.filter(r => r.hit).length / onResults.length;
|
|
const offRecall = offResults.filter(r => r.hit).length / offResults.length;
|
|
const dropPts = (offRecall - onRecall) * 100;
|
|
expect(dropPts).toBeLessThanOrEqual(5);
|
|
});
|
|
});
|
|
|
|
// Always-on tests for the pure bootstrap function — these run even
|
|
// without the fixture so the helper has coverage.
|
|
describe('pairedBootstrapPValue — pure-function tests', () => {
|
|
test('empty input → p=1.0 (no information)', () => {
|
|
const r = pairedBootstrapPValue([], 100);
|
|
expect(r.pValue).toBe(1.0);
|
|
expect(r.observedDelta).toBe(0);
|
|
});
|
|
|
|
test('all pairs equal → delta=0, p large', () => {
|
|
const pairs = Array(50).fill(0).map(() => ({ on: 1, off: 1 }));
|
|
const r = pairedBootstrapPValue(pairs, 1000);
|
|
expect(r.observedDelta).toBe(0);
|
|
expect(r.pValue).toBeGreaterThan(0.5); // null is true; p should be large
|
|
});
|
|
|
|
test('strong positive effect (on always wins) → small p, positive delta', () => {
|
|
const pairs = Array(30).fill(0).map(() => ({ on: 1, off: 0 }));
|
|
let seed = 42;
|
|
const rng = () => {
|
|
seed = (seed * 1664525 + 1013904223) >>> 0;
|
|
return seed / 0xFFFFFFFF;
|
|
};
|
|
const r = pairedBootstrapPValue(pairs, 5000, rng);
|
|
expect(r.observedDelta).toBe(1.0);
|
|
expect(r.pValue).toBeLessThan(0.01);
|
|
});
|
|
|
|
test('strong negative effect (off always wins) → small p, negative delta', () => {
|
|
const pairs = Array(30).fill(0).map(() => ({ on: 0, off: 1 }));
|
|
let seed = 42;
|
|
const rng = () => {
|
|
seed = (seed * 1664525 + 1013904223) >>> 0;
|
|
return seed / 0xFFFFFFFF;
|
|
};
|
|
const r = pairedBootstrapPValue(pairs, 5000, rng);
|
|
expect(r.observedDelta).toBe(-1.0);
|
|
expect(r.pValue).toBeLessThan(0.01);
|
|
});
|
|
|
|
test('determinism: same seed → same p-value', () => {
|
|
const pairs = Array(20).fill(0).map((_, i) => ({ on: i % 3 === 0 ? 1 : 0, off: i % 4 === 0 ? 1 : 0 }));
|
|
let s1 = 12345;
|
|
const r1 = pairedBootstrapPValue(pairs, 1000, () => { s1 = (s1 * 1664525 + 1013904223) >>> 0; return s1 / 0xFFFFFFFF; });
|
|
let s2 = 12345;
|
|
const r2 = pairedBootstrapPValue(pairs, 1000, () => { s2 = (s2 * 1664525 + 1013904223) >>> 0; return s2 / 0xFFFFFFFF; });
|
|
expect(r1.pValue).toBe(r2.pValue);
|
|
expect(r1.observedDelta).toBe(r2.observedDelta);
|
|
});
|
|
});
|