- Mitigate command injection in `src/services/governance/index.js` by using explicit array arguments with `execFileSync` and adding a security comment.
- Add regression test `test/governance-security.test.mjs` verifying the fix against simulated exploit attempts.
- Fix CI build failures by resolving circular dependencies and duplicate declarations in `src/lock-utils.mjs`, `src/lock-ops.mjs`, `src/lock-publisher.mjs`, and `src/relay-health.mjs`.
- Resolve linting errors in tests and implementation files.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Implemented throttling in `performSave` to limit disk writes to max 1 per second.
- Refactored `updateMemoryUsage` to use non-blocking (fire-and-forget) save calls, eliminating latency for memory reads.
- Added atomic write strategy using unique temporary files and `fs.rename` to prevent data corruption.
- Verified with benchmarks: `getRelevantMemories` latency reduced from ~100ms to ~30ms for 10k items.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Precompute vector norms during `upsertVector` in `InMemoryEmbedderAdapter`.
- Compute query vector norm once per query.
- Update `cosineSimilarity` to accept precomputed norms, avoiding redundant calculations.
- Optimize `cosineSimilarity` loop to iterate only up to `Math.min(left.length, right.length)` and remove redundant casts.
- Achieved ~27% improvement in query time (57ms vs 78ms for 50 queries against 2000 vectors).
Co-authored-by: PR0M3TH3AN <[email protected]>
Updates `validateProposal` to accept either a proposal ID or a proposal object.
Updates `applyProposal` to pass the already-fetched proposal object to `validateProposal`,
eliminating a redundant file system read. This improves efficiency and code health.
Tests were verified to ensure no regression.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Implemented LexicalIndex class in src/services/memory/retriever.js.
- Added WeakMap caching for indices based on memory array references.
- Improved memory array stability in src/services/memory/index.js using a storeVersion counter.
- Achieved ~2x speedup for 10k memories and ~9x speedup for 100k memories in benchmarks.
- Maintains compatibility with existing textMatchSimilarity scoring.
Co-authored-by: PR0M3TH3AN <[email protected]>
Extracted duplicated target path resolution and allowlist validation logic
into a shared `resolveAndValidateTarget` helper function in
`src/services/governance/index.js`.
Updated `createProposal`, `validateProposal`, `applyProposal`, and
`rollbackPrompt` to use the new helper, ensuring consistent validation
and path handling across the service.
Added `test/governance-health.test.mjs` to verify validation logic.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced `execSync` with `execFileSync` in `src/services/governance/index.js` to avoid shell interpretation of variable-derived inputs (such as agent IDs and file targets). This mitigates command injection risks in `createProposal`, `applyProposal`, and `rollbackPrompt`.
- Used `execFileSync` for all git operations.
- Updated logic to correctly handle `git diff` exit code 1.
- Removed unused `execSync` import.
Co-authored-by: PR0M3TH3AN <[email protected]>
- governance/index.js: archive filenames now include ISO timestamp for
deterministic sorting (<base>_<ts>_<hash>.md); write .meta.json sidecar
on every archive with proposalId, author, reason, and archivedAt
- governance/index.js: add listPromptVersions(target) — returns archived
versions for a prompt sorted newest-first with sidecar metadata surfaced
- cmd-rollback.mjs: add --list flag to list available versions without
restoring (delegates to listPromptVersions)
- cli-parser.mjs: add --list and --output flags
- lib.mjs: pass list flag to cmdRollback; add backup command dispatch
- cmd-backup.mjs: new torch-lock backup command — snapshots
.scheduler-memory/memory-store.json and scheduler run state to
.torch/backups/<timestamp>/; supports --output override and --list
- docs/prompt-versioning.md: comprehensive guide to the full
proposal → apply → list-versions → rollback workflow, state backup
and restore procedure, and storage location reference
- test/governance.test.mjs: 7 scenario-based tests (SCN-proposal-create,
SCN-proposal-list, SCN-proposal-reject, SCN-archive-naming,
SCN-version-list, SCN-rollback-latest, SCN-rollback-hash)
https://claude.ai/code/session_01Ndq2D72Kp77BYo4owD63uY
- Added `.github/workflows/ci.yml` to run build, lint, and test on PRs/push to main.
- Updated `.github/workflows/ci-resilience-nightly.yml` to use Node.js 22.
- Fixed lint errors in `src/services/governance/index.js` (no-empty, preserve-caught-error).
- Added `governance-agent` to daily roster and scheduler prompt to fix `npm test` scheduler validation failure.
Co-authored-by: PR0M3TH3AN <[email protected]>
Implement a comprehensive governance system to manage agent prompt changes safely.
Key features:
- **Proposal Workflow:** Prompt changes are now "proposals" stored in `src/proposals/` with metadata and diffs.
- **Governance Agent:** A new `governance-agent` reviews and applies proposals using `scripts/governance/process-proposals.mjs`.
- **Validation:** Strict validation ensures changes are limited to allowed directories (`src/prompts/daily|weekly`) and preserve required headers.
- **Lock Enhancements:** Lock events now include `promptHash`, `promptPath`, and `gitCommit` for full auditability.
- **Rollback:** New `torch-lock rollback` command restores prompts from local history (`.torch/prompt-history/`) or git.
- **CLI:** Added `proposal` (create, list, show, apply, reject) and `rollback` commands.
This establishes a "Stage -> Evaluate -> Apply" gate for prompt evolution, preventing silent drift and ensuring constitutional stability.
Co-authored-by: PR0M3TH3AN <[email protected]>
Optimizes `saveMemoryStore` in `src/services/memory/index.js` to use `fs.promises.writeFile` instead of synchronous `fs.writeFileSync`.
Implements a coalescing mechanism to handle concurrent save requests efficiently, preventing race conditions and reducing I/O operations by batching pending updates into a single write.
Reduces event loop blocking from ~420ms (sync) to ~3ms (async) for large write operations in benchmarks.
Updates all `memoryRepository` methods to await the async save operation.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Use Promise.all to execute memory lifecycle actions concurrently.
- Maintain intra-item dependency order (merged_into before action).
- Update tests to support non-deterministic execution order of independent items.
- Benchmark shows ~65x improvement for 100 items with 10ms latency.
Co-authored-by: PR0M3TH3AN <[email protected]>
Avoids redundant string concatenation and lowercasing in the inner loop of `buildSimilarityIndex`.
Pre-computes query terms and regexes once per query.
Uses RegExp.test for case-insensitive matching without allocation.
Benchmark shows ~2x speedup (99ms vs 191ms for 10k memories).
Co-authored-by: PR0M3TH3AN <[email protected]>
Sorts memories by created_at and uses an early exit condition in the inner loop to avoid checking all pairs. This reduces complexity from O(N^2) to roughly O(N * k) where k is the number of items within the duplicate window.
Measured improvement for 30k items: ~2.1s -> ~0.25s (8x speedup).
Co-authored-by: PR0M3TH3AN <[email protected]>
Moved the `ensureDir` utility function from `src/ops.mjs` to `src/utils.mjs` to promote code reuse and centralization.
Updated `src/ops.mjs` and `src/services/memory/index.js` to use the shared utility.
Added unit tests for `ensureDir` in `test/utils.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Modified `getRelevantMemories` in `src/services/memory/index.js` to accept optional `ranker` and `cache` parameters for dependency injection.
- Added `test/memory-index.test.mjs` with comprehensive unit tests for `getRelevantMemories` using `node:test` mocks.
- Verified that existing behavior is preserved via default parameters.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Update `markMemoryMerged` to accept `options.repository` for better testability.
- Add unit tests in `test/memory-admin.test.mjs` to verify:
- Delegation to repository.
- Cache clearing side effect.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced `console.log` with `util.debuglog('torch-memory')` in `src/services/memory/index.js` to prevent stdout pollution. Telemetry and metrics are now logged to stderr only when `NODE_DEBUG=torch-memory` is set, improving library behavior and observability control.
Added regression test `test/memory-telemetry.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Add `test/memory-pinning.test.mjs` to test `pinMemory` happy path and edge cases.
- Update `getRelevantMemories` in `src/services/memory/index.js` to use `repository.listMemories` when available, enabling isolated unit testing.
- Verified all memory tests pass.
Co-authored-by: PR0M3TH3AN <[email protected]>
