3 Commits

Include renames

Author	SHA1	Message	Date
jpmschweitzerandClaude Fable 5	8a1c9ba5f3	fix(security): scope every HybridRAG leg and ingestion path to the caller's tenant ... A live /query/hybrid probe as user=llm_tester returned jpmschweitzer pages. Audit of all legs (vector, graph, web-persistence, volatile, documents) plus enrichment/persistence found and fixed these unscoped paths: - vector_service.update_from_page and graph_service.update_from_page now refuse pages outside users/{user}/ - previously any tenant could ingest any wiki page (incl. another tenant's) into its own collection and graph labels, which is how foreign content entered the vector leg. - ingestion_service.ingest_all_pages clamps path_prefix to the caller's namespace (segment-exact, sanitized comparison) and defaults to users/{user}; /ingest/all returns 400 on cross-tenant prefixes. - hybrid_rag_service._persist_search_for_librarian linked SearchQuery nodes to unscoped (d:Document {page_id}); now matches only User_{Tenant}_Document nodes. - graph_service: _get_entity_mention_count, entity-stub mention/related queries, generate_entity_stubs, find/purge_orphan_entities matched unscoped Document nodes; cleanup_broken_relationships matched all tenants' SearchQuery nodes; _entity_has_wiki_page listed all wiki pages. All are now tenant-label / namespace scoped. - volatile_service collection names now use the sanitized user id. - is_path_in_user_namespace enforces a path-segment boundary (users/llm_tester2 is not llm_tester's namespace) and treats hyphen/underscore tenant spellings as the same sanitized tenant. - New offline unit tests per leg (mocked clients) assert the tenant-scoped collection/label/path is used and cross-tenant access is refused. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 11:15:43 +02:00
jpmschweitzerandClaude Opus 4.5	37f8e1819e	feat: refactor volatile cache to vector storage with HybridRAG integration ... - Migrate volatile backend from Redis to Qdrant for semantic search - Add natural language conversion for structured data embedding - Simplify API: /volatile/search, /volatile/store, /{namespace}/{key} - Integrate volatile into HybridRAG with priority boost in RRF fusion - Add POST /maintenance/cleanup/volatile for expiry purging - Update tests for new Qdrant-based architecture (37/37 pass) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2025-12-24 20:03:37 +01:00
jpmschweitzerandClaude Opus 4.5	7297e6b9f1	feat: add volatile cache system for ephemeral data ... Phase 2 of Memory Management System - volatile memory tier: - VolatileCacheService: Redis-backed TTL storage - Volatile router with full CRUD operations - Predefined namespaces: weather, news, financial, transit, traffic, air_quality, sports, social, system, context, custom - Each namespace has appropriate default TTL (1min to 1hr) - Refresh schedule support via cron expressions - Scheduler integration endpoint: GET /volatile/scheduled Endpoints: - GET/POST/DELETE /volatile/{namespace}/{key} - GET/DELETE /volatile/{namespace} - GET /volatile/stats - GET /volatile/scheduled - GET /volatile/namespaces 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2025-12-24 17:31:45 +01:00