Complete projection integrity follow-up hardening - #123
Merged
Conversation
Reviewer's GuideThis PR hardens projection integrity by making declaration comparison quote-aware, adding regression tests for case-sensitive lifecycle identity and unexpected schema objects, and updating quickstart guidance to verify SQLite/FTS5 capability through an actual temporary projection read rather than a version floor. Sequence diagram for behavioral SQLite capability verificationsequenceDiagram
participant User
participant CLI
participant SQLite
User->>CLI: project(record, --out temporary_directory)
CLI->>SQLite: Build synthetic projection
User->>CLI: search(records.sqlite, synthetic)
CLI->>SQLite: Read projection and exercise FTS5 behavior
alt capability demonstrated
SQLite-->>CLI: Successful projection read
CLI-->>User: Search result
else capability unavailable
SQLite-->>CLI: Capability failure
CLI-->>User: projection-unavailable
end
Flow diagram for quote-aware projection declaration validationflowchart TD
A[Read packaged declaration and sqlite_master declaration] --> B{Inside quoted token?}
B -->|Yes| C[Preserve case whitespace and escapes]
B -->|No| D[Ignore whitespace and normalize case]
C --> E[Compare normalized declarations]
D --> E
E --> F{Declarations match?}
F -->|Yes| G[Continue projection integrity checks]
F -->|No| H[Reject projection]
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
PR Summary by QodoHarden SQLite projection declaration integrity
AI Description
Diagram
High-Level Assessment
Files changed (5)
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="docs/quickstart.md" line_range="31" />
<code_context>
+projection outside the repository:
+
+```shell
+am_probe_dir="$(mktemp -d)"
+python3 -m artifact_memory project \
+ fixtures/synthetic/contracts/v0-valid-record.json \
+ --out "$am_probe_dir" \
+ --json
+python3 -m artifact_memory search \
+ "$am_probe_dir/records.sqlite" \
+ synthetic \
+ --json
+```
+
+A successful search demonstrates the required behavior for that loaded
</code_context>
<issue_to_address>
**nitpick (bug_risk):** The documented probe creates a directory with `mktemp -d` and never removes it, so every successful or failed quickstart verification leaves the generated SQLite projection and receipt files in the system temporary directory.
**Triggers:** When a user follows the documented capability probe.
**Suggested fix:** Wrap the commands in a cleanup trap, such as `trap 'rm -rf "$am_probe_dir"' EXIT`, after creating the temporary directory.
```suggestion
am_probe_dir="$(mktemp -d)"
trap 'rm -rf "$am_probe_dir"' EXIT
```
</issue_to_address>Sourcery assessment
Approved.
Owner
Author
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Code Review by Qodo
1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
This was referenced Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Contract and compatibility impact
No schema identifiers, default query outputs, or published contracts change. Current v1 projection declarations remain compatible; formatting case and whitespace outside quoted tokens remain normalized, while quoted values and identifiers remain exact.
Security and authority
This strengthens generated projection identity and its regression evidence. It does not establish canonical-record authenticity or truth and creates no execution, disclosure, deployment, approval, or merge authority.
Validation
python3 -m unittest discover -s tests— 628 passed./scripts/run_conformance.sh— passed./scripts/validate_contracts.sh— 628 passed plus schema/fixture validationpython3 scripts/public_safety_check.py— passed across 350 commits, 4,559 historical objects, and 638 current pathspython3 scripts/run_cross_sqlite_matrix.py— passed across six discovered runtimesgit diff --check— passedCloses #121
Closes #122
Summary by Sourcery
Harden SQLite projection integrity checks and capability validation without changing existing projection contracts.
Bug Fixes:
Enhancements:
Documentation:
Tests: