Performance, security and provenance hardening (ann/io/migrate/agent) + two audit fixes #2

Merged
osobh merged 23 commits from verify/v3-plus-v6 into main 2026-08-17 14:22:14 +00:00
2 changed files with 35 additions and 10 deletions
Showing only changes of commit 4051d5c16e - Show all commits
+34 -10
View File
@@ -50,6 +50,9 @@ impl RelationType {
pub struct Entity {
pub id: u64,
pub name: String,
/// Lowercased `name`, cached at construction time to avoid re-allocating
/// and re-lowercasing on every entity-resolution scan.
pub name_lower: String,
pub entity_type: String,
/// Index into the memory embeddings array, or -1 if none.
pub embedding_idx: i64,
@@ -69,6 +72,7 @@ impl Default for Entity {
Self {
id: 0,
name: String::new(),
name_lower: String::new(),
entity_type: String::new(),
embedding_idx: -1,
properties: HashMap::new(),
@@ -198,6 +202,7 @@ impl KnowledgeCache {
self.entities.push(Entity {
id,
name: name.to_owned(),
name_lower: name.to_lowercase(),
entity_type: entity_type.to_owned(),
embedding_idx,
properties: HashMap::new(),
@@ -310,16 +315,22 @@ impl KnowledgeCache {
) -> (u64, bool) {
let lower_name = name.to_lowercase();
// Search for the closest existing entity.
let best = self
.entities
.iter()
.map(|e| {
let dist = levenshtein(&lower_name, &e.name.to_lowercase());
(e.id, dist)
})
.filter(|&(_, dist)| dist <= max_distance)
.min_by_key(|&(_, dist)| dist);
// Search for the closest existing entity, short-circuiting on an
// exact match since no closer candidate can exist.
let mut best: Option<(u64, usize)> = None;
for e in &self.entities {
let dist = levenshtein(&lower_name, &e.name_lower);
if dist > max_distance {
continue;
}
if dist == 0 {
best = Some((e.id, dist));
break;
}
if best.is_none_or(|(_, best_dist)| dist < best_dist) {
best = Some((e.id, dist));
}
}
if let Some((id, _)) = best {
return (id, false);
@@ -855,6 +866,19 @@ mod tests {
assert_eq!(id, orig_id);
}
/// An exact match must win even when a near-match with a smaller Levenshtein
/// distance-to-zero gap was scanned first — the early exit on dist == 0
/// must not skip past a later exact match.
#[test]
fn test_resolve_or_create_exact_match_beats_earlier_fuzzy_candidate() {
let mut cache = KnowledgeCache::new();
cache.add_entity("Alyce", "person", -1); // dist 1 from "Alice"
let exact_id = cache.add_entity("Alice", "person", -1); // dist 0
let (id, created) = cache.resolve_or_create("Alice", "person", -1, 2);
assert!(!created);
assert_eq!(id, exact_id);
}
#[test]
fn test_resolve_or_create_no_match_beyond_threshold() {
let mut cache = KnowledgeCache::new();
+1
View File
@@ -480,6 +480,7 @@ fn load_knowledge_group(file: &clawhdf5::File) -> Result<KnowledgeCache, MemoryE
cache.entities.push(crate::knowledge::Entity {
id: entity_ids[i] as u64,
name: entity_names[i].clone(),
name_lower: entity_names[i].to_lowercase(),
entity_type: entity_types[i].clone(),
embedding_idx: emb_idxs[i],
..Default::default()