feat(ask): persist public claim admission - #784
Conversation
Require an exact cited public post and PROV-O evidence binding before Global Ask sends an opted-in claim to the existing verification client. Signed-off-by: Codex <codex@localhost>
…nvelope-current-stack
Apply migration 0257 in the API fixture and create a synthetic PROV-O-bound envelope for the opt-in verification contract. Signed-off-by: Codex <codex@localhost>
…nvelope-current-stack
Create PROV-O resource types before the assertion and retain the synthetic project mention used solely for authorized Ask retrieval. Signed-off-by: Codex <codex@localhost>
…nvelope-current-stack
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Cycle write probe 2026-08-28T19:15KST: confirming comment/push scope after prior empty X-OAuth-Scopes. Independent APPROVE still required; no self-approve. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| cited_ids = frozenset(cited_post_ids) | ||
| claims = ( | ||
| tuple(envelope.verification_candidate() for envelope in persisted_envelopes) | ||
| if persisted_envelopes is not None | ||
| else tuple( | ||
| claim | ||
| for claim in public_claim_candidates(sources, question) | ||
| if set(claim.source_post_ids).issubset(cited_ids) | ||
| ) | ||
| ) | ||
| claims = tuple( | ||
| claim | ||
| for claim in public_claim_candidates(sources, question) | ||
| if set(claim.source_post_ids).issubset(cited_ids) | ||
| claim for claim in claims if set(claim.source_post_ids).issubset(cited_ids) | ||
| ) |
There was a problem hiding this comment.
📝 Info: Production verification now requires a persisted envelope
In the production path, compute_global_ask_answer always passes persisted_envelopes, so the legacy token-overlap nomination in public_claim_candidates is unreachable outside tests. Any opted-in question whose cited public posts have no stored egress-eligible envelope now reports no public claims and issues no external request. This is the intended fail-closed change, but it hard-gates all public verification on producers first persisting governed envelopes.
Was this helpful? React with 👍 or 👎 to provide feedback.
| join provenance_resource_binding evidence | ||
| on evidence.resource_id = assertion.object_resource_id | ||
| and evidence.node_type_code = 'node_post' | ||
| and evidence.node_id = envelope.source_post_id | ||
| where envelope.egress_eligible | ||
| and post.visibility_code = 'public' | ||
| and envelope.source_post_id = any($1::uuid[]) | ||
| and ($2::timestamptz is null or ( | ||
| envelope.created_at <= $2 and post.created_at <= $2 | ||
| )) | ||
| order by envelope.created_at, envelope.public_claim_envelope_id | ||
| limit 4 |
There was a problem hiding this comment.
🔍 Duplicate evidence bindings can crowd the four-envelope cap
The admission query joins provenance_resource_binding on the assertion's object resource. If that resource has multiple node_post bindings to the same source post, the join emits the envelope more than once, and the limit 4 is applied to the joined rows, so duplicates can consume the budget and crowd out distinct envelopes. The insert trigger checks only that one binding matches, not uniqueness. Consider exists/distinct if duplicate bindings are possible.
Was this helpful? React with 👍 or 👎 to provide feedback.
8998c87
into
feat/orchestrator-routing-endpoint-consumer
1 participant
Summary
prov:wasDerivedFromStack
760d05896f96e5ce7fb9df0e4b62369448913fbdat creationVerification
uv run --extra dev --extra backend pytest -q tests/test_claim_verification.py tests/test_public_claim_envelope.py tests/test_global_ask_queue.py tests/test_migration_replay.py tests/test_public_docstrings.py tests/test_http_client.py(105 passed)git diff --checkNo real data is included.