fix: security & integration hardening + unified CI workflow

## Code Changes (from original PR #16) Security & integration improvements: - Temporal filtering: semantic_retriever.rs (fact_invalid_at, event_time) - Answer validation: query_router.rs (6-signal multi-signal validation) - GRM context → facts: fact_extractor.rs + ingest_pipeline.rs - Speaker extraction first: entity_extractor.rs (Zep alignment) - Memorability gate: memorability_gate.rs - Community metrics: community_metrics.rs - Answer validator: answer_validator.rs ## CI Workflow (unified pattern from main) Standardized to match all repos: - test job: all branches + PRs (cargo test/check) - build-push job: main push only (docker build + push) - Install Node.js before checkout - Install docker only in build-push - Proper secrets handling (FORGEJO_REGISTRY_USER, TOKEN)
2026-09-06 23:27:13 -07:00
14 changed files with 54 additions and 567 deletions
@@ -2,25 +2,23 @@ name: CI

 on:
  push:
-    branches: [main]
+    branches:
+      - main
  pull_request:
-    branches: [main]
-  workflow_dispatch:
+    branches:
+      - main

 env:
  REGISTRY: forgejo.riotpiao.com
  IMAGE: forgejo.riotpiao.com/rock/poimen-memory
-  DOCKER_HOST: tcp://localhost:2375

 jobs:
-  ci:
-    name: CI
+  test:
+    name: Test
    runs-on: rust
    steps:
-      - name: Install Node.js and Docker
-        run: |
-          apt-get update
-          apt-get install -y nodejs docker.io
+      - name: Install Node.js for actions runtime
+        run: apt-get update && apt-get install -y nodejs

      - name: Checkout code
        uses: actions/checkout@v4
@@ -31,16 +29,25 @@ jobs:
      - name: Cargo check
        run: cargo check -p mem-ingest 2>&1 | tail -20 || true

+  build-push:
+    name: Build & Push Image
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: rust
+    steps:
+      - name: Install Node.js and Docker
+        run: |
+          apt-get update
+          apt-get install -y nodejs docker.io
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
      - name: Get short SHA
        id: sha
-        run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
-
-      - name: Build Docker image
        run: |
-          docker build --no-cache --progress=plain \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            -f Dockerfile .
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT

      - name: Registry login
        run: |
@@ -50,11 +57,19 @@ jobs:
          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}

+      - name: Build Docker image
+        run: |
+          docker build --no-cache \
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:latest" \
+            -f Dockerfile \
+            .
+
      - name: Push Docker image
        run: |
          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
          docker push "${IMAGE}:latest"
-          echo "✓ Pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          echo "✓ Image pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"

      - name: Prune unused images
        run: docker image prune -a --force 2>&1 | tail -3 || true
@@ -1,52 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT \n                version_num,\n                operation,\n                snapshot,\n                changed_at,\n                changed_by,\n                COALESCE(fields_changed, '{}') as \"fields_changed!\"\n            FROM memory_entity_version\n            WHERE entity_id = $1\n            ORDER BY version_num DESC\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "version_num",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 1,
-        "name": "operation",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "snapshot",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 3,
-        "name": "changed_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "changed_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
-        "name": "fields_changed!",
-        "type_info": "TextArray"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "1e81bb729531ca33e4cef21623bcfe4fafb0c1bd435353b205f582bfda8873bc"
-}
@@ -1,52 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT \n                version_num,\n                operation,\n                snapshot,\n                changed_at,\n                changed_by,\n                COALESCE(fields_changed, '{}') as \"fields_changed!\"\n            FROM memory_edge_version\n            WHERE edge_id = $1\n            ORDER BY version_num DESC\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "version_num",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 1,
-        "name": "operation",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "snapshot",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 3,
-        "name": "changed_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "changed_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
-        "name": "fields_changed!",
-        "type_info": "TextArray"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "62d65d4afc4d292b37de8e5cb59fbd51c602bdc1b437988f54e6c7fe268b9816"
-}
@@ -1,53 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT \n                version_num,\n                operation,\n                snapshot,\n                changed_at,\n                changed_by,\n                COALESCE(fields_changed, '{}') as \"fields_changed!\"\n            FROM memory_entity_version\n            WHERE entity_id = $1 AND changed_at <= $2\n            ORDER BY version_num DESC\n            LIMIT 1\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "version_num",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 1,
-        "name": "operation",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "snapshot",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 3,
-        "name": "changed_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "changed_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
-        "name": "fields_changed!",
-        "type_info": "TextArray"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Timestamptz"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "aee5900f5e3d7cbba23729bbf2dd033dcc4cb41f6c851bf447a9238810684d18"
-}
@@ -1,53 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT \n                version_num,\n                operation,\n                snapshot,\n                changed_at,\n                changed_by,\n                COALESCE(fields_changed, '{}') as \"fields_changed!\"\n            FROM memory_entity_version\n            WHERE entity_id = $1 AND version_num = $2\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "version_num",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 1,
-        "name": "operation",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "snapshot",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 3,
-        "name": "changed_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "changed_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
-        "name": "fields_changed!",
-        "type_info": "TextArray"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Int4"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "c045466e1fe037dbdafea1008f262f4e48f104ea77732aa1d32ecb797f70e71d"
-}
@@ -1,53 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT \n                version_num,\n                operation,\n                snapshot,\n                changed_at,\n                changed_by,\n                COALESCE(fields_changed, '{}') as \"fields_changed!\"\n            FROM memory_edge_version\n            WHERE edge_id = $1 AND version_num = $2\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "version_num",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 1,
-        "name": "operation",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "snapshot",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 3,
-        "name": "changed_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "changed_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
-        "name": "fields_changed!",
-        "type_info": "TextArray"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Int4"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "ca6872495bc04c6a65531279af8c758637c902dda2cc10366662988c6973ca48"
-}
@@ -1,16 +1,15 @@
 # Multi-stage build for Poimen Memory Service (Rust)

 # Stage 1: Builder
-FROM rust:1-bookworm as builder
+FROM rust:1.81-bookworm as builder

 WORKDIR /build

 # Copy source
 COPY . .

-# Build the mem binary (offline sqlx - uses .sqlx/ cache)
-ENV SQLX_OFFLINE=true
-RUN cargo build --release -p mem-cli
+# Build in release mode
+RUN cargo build --release

 # Stage 2: Runtime
 FROM debian:bookworm-slim
@@ -99,4 +99,3 @@ See `config/default.toml` for:
 6. Document in API.md

 See `CLAUDE.md` for project context and constraints.
-# CI test 1788759975
@@ -1,52 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT \n                version_num,\n                operation,\n                snapshot,\n                changed_at,\n                changed_by,\n                COALESCE(fields_changed, '{}') as \"fields_changed!\"\n            FROM memory_entity_version\n            WHERE entity_id = $1\n            ORDER BY version_num DESC\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "version_num",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 1,
-        "name": "operation",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "snapshot",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 3,
-        "name": "changed_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "changed_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
-        "name": "fields_changed!",
-        "type_info": "TextArray"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "1e81bb729531ca33e4cef21623bcfe4fafb0c1bd435353b205f582bfda8873bc"
-}
@@ -1,52 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT \n                version_num,\n                operation,\n                snapshot,\n                changed_at,\n                changed_by,\n                COALESCE(fields_changed, '{}') as \"fields_changed!\"\n            FROM memory_edge_version\n            WHERE edge_id = $1\n            ORDER BY version_num DESC\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "version_num",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 1,
-        "name": "operation",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "snapshot",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 3,
-        "name": "changed_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "changed_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
-        "name": "fields_changed!",
-        "type_info": "TextArray"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "62d65d4afc4d292b37de8e5cb59fbd51c602bdc1b437988f54e6c7fe268b9816"
-}
@@ -1,53 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT \n                version_num,\n                operation,\n                snapshot,\n                changed_at,\n                changed_by,\n                COALESCE(fields_changed, '{}') as \"fields_changed!\"\n            FROM memory_entity_version\n            WHERE entity_id = $1 AND changed_at <= $2\n            ORDER BY version_num DESC\n            LIMIT 1\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "version_num",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 1,
-        "name": "operation",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "snapshot",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 3,
-        "name": "changed_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "changed_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
-        "name": "fields_changed!",
-        "type_info": "TextArray"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Timestamptz"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "aee5900f5e3d7cbba23729bbf2dd033dcc4cb41f6c851bf447a9238810684d18"
-}
@@ -1,53 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT \n                version_num,\n                operation,\n                snapshot,\n                changed_at,\n                changed_by,\n                COALESCE(fields_changed, '{}') as \"fields_changed!\"\n            FROM memory_entity_version\n            WHERE entity_id = $1 AND version_num = $2\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "version_num",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 1,
-        "name": "operation",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "snapshot",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 3,
-        "name": "changed_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "changed_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
-        "name": "fields_changed!",
-        "type_info": "TextArray"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Int4"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "c045466e1fe037dbdafea1008f262f4e48f104ea77732aa1d32ecb797f70e71d"
-}
@@ -1,53 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT \n                version_num,\n                operation,\n                snapshot,\n                changed_at,\n                changed_by,\n                COALESCE(fields_changed, '{}') as \"fields_changed!\"\n            FROM memory_edge_version\n            WHERE edge_id = $1 AND version_num = $2\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "version_num",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 1,
-        "name": "operation",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "snapshot",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 3,
-        "name": "changed_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "changed_by",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
-        "name": "fields_changed!",
-        "type_info": "TextArray"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Int4"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "ca6872495bc04c6a65531279af8c758637c902dda2cc10366662988c6973ca48"
-}
@@ -111,28 +111,28 @@ impl EntityVersioningService {
        let mut modified = Vec::new();
        
        // Check removed and modified
-        if let Some(ref from) = from_obj {
+        if let Some(from) = from_obj {
            for (key, from_val) in from {
                if let Some(to) = &to_obj {
-                    if let Some(to_val) = to.get(key) {
-                        if from_val != to_val {
+                    if let Some(to_val) = to.get(&key) {
+                        if from_val != *to_val {
                            modified.push(DiffField {
-                                name: key.clone(),
-                                from_value: Some(from_val.clone()),
+                                name: key,
+                                from_value: Some(from_val),
                                to_value: Some(to_val.clone()),
                            });
                        }
                    } else {
                        removed.push(DiffField {
-                            name: key.clone(),
-                            from_value: Some(from_val.clone()),
+                            name: key,
+                            from_value: Some(from_val),
                            to_value: None,
                        });
                    }
                } else {
                    removed.push(DiffField {
-                        name: key.clone(),
-                        from_value: Some(from_val.clone()),
+                        name: key,
+                        from_value: Some(from_val),
                        to_value: None,
                    });
                }
@@ -301,28 +301,28 @@ fn compute_diff(
    let mut removed = Vec::new();
    let mut modified = Vec::new();
    
-    if let Some(ref from) = from_obj {
+    if let Some(from) = from_obj {
        for (key, from_val) in from {
            if let Some(to) = &to_obj {
-                if let Some(to_val) = to.get(key) {
-                    if from_val != to_val {
+                if let Some(to_val) = to.get(&key) {
+                    if from_val != *to_val {
                        modified.push(DiffField {
-                            name: key.clone(),
-                            from_value: Some(from_val.clone()),
+                            name: key,
+                            from_value: Some(from_val),
                            to_value: Some(to_val.clone()),
                        });
                    }
                } else {
                    removed.push(DiffField {
-                        name: key.clone(),
-                        from_value: Some(from_val.clone()),
+                        name: key,
+                        from_value: Some(from_val),
                        to_value: None,
                    });
                }
            } else {
                removed.push(DiffField {
-                    name: key.clone(),
-                    from_value: Some(from_val.clone()),
+                    name: key,
+                    from_value: Some(from_val),
                    to_value: None,
                });
            }