weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ctxmgr): wire fail-closed gray REPLACE for chat semantic narrative

Browse Source 
Unseal SEMANTIC_SUMMARY_REPLACE under explicit user authorization with a
defense-in-depth session allowlist (SEMANTIC_SUMMARY_REPLACE_SESSIONS):
swap happens only for allowlisted sessions after result digests and served
watermark validation, bounded narrative size; facts/counts stay deterministic
and the daily digest stays advisory. Master flag alone replaces nothing.
This commit is contained in:
weichen
2026-09-25 22:56:36 +00:00
parent 4d5d695c75
commit ffa41d78df
8 changed files with 368 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/ctxmgr/summary_flags.go
+44 -15
View File
@@ -8,20 +8,25 @@ import (
const (
EnvSemanticSummaryShadow = "SEMANTIC_SUMMARY_SHADOW"
// SEALED (Wave 5 X-2, 2026-09-18): REPLACE must stay unwired indefinitely per
// system-health-remediation-plan.md Wave5 + red-line "SEMANTIC_SUMMARY_REPLACE
// 不接线". Enabling REPLACE to swap served narrative requires a separate
// explicit user authorization + fail-closed rollout design; do not wire it as
// a side effect of an unrelated change. See .doc/ops/short-term/2026-09-18-
// wave5-deadcode-decisions.md#x-2.
// REPLACE was sealed by Wave 5 X-2 (2026-09-18). Unsealed 2026-09-26 under an
// explicit user authorization for the chat-semantic-replace closeout task:
// wiring is fail-closed and gray-released via a session allowlist. Enabling
// the master flag alone replaces nothing while the allowlist is empty.
// See .doc/ops/short-term/2026-09-26-chat-semantic-replace.md and
// .doc/ops/short-term/2026-09-18-wave5-deadcode-decisions.md#x-2 (history).
EnvSemanticSummaryReplace = "SEMANTIC_SUMMARY_REPLACE"
// EnvSemanticSummaryReplaceSessions is the fail-closed gray-release
// allowlist: comma-separated chat session IDs eligible for narrative
// replacement. Empty allowlist (default) replaces no session.
EnvSemanticSummaryReplaceSessions = "SEMANTIC_SUMMARY_REPLACE_SESSIONS"
)
// SummaryFeatureFlags controls semantic summary rollout.
// REPLACE is reserved and must remain unwired in PU6 shadow delivery (Wave 5 X-2 sealed).
// SummaryFeatureFlags controls semantic summary rollout. REPLACE swaps the
// served chat Narrative only for allowlisted sessions (fail-closed gray).
type SummaryFeatureFlags struct {
Shadow bool
Replace bool
Shadow bool
Replace bool
ReplaceSessions map[string]struct{}
}
var (
@@ -31,11 +36,23 @@ var (
func loadSummaryFlagsFromEnv() SummaryFeatureFlags {
return SummaryFeatureFlags{
Shadow: envBoolDefault(EnvSemanticSummaryShadow, false),
Replace: envBoolDefault(EnvSemanticSummaryReplace, false),
Shadow: envBoolDefault(EnvSemanticSummaryShadow, false),
Replace: envBoolDefault(EnvSemanticSummaryReplace, false),
ReplaceSessions: parseReplaceSessions(os.Getenv(EnvSemanticSummaryReplaceSessions)),
}
}
func parseReplaceSessions(raw string) map[string]struct{} {
out := make(map[string]struct{})
for _, part := range strings.Split(raw, ",") {
id := strings.TrimSpace(part)
if id != "" {
out[id] = struct{}{}
}
}
return out
}
func envBoolDefault(key string, def bool) bool {
v := strings.TrimSpace(os.Getenv(key))
if v == "" {
@@ -56,13 +73,25 @@ func SemanticSummaryShadowEnabled() bool {
return CurrentSummaryFlags().Shadow
}
// SemanticSummaryReplaceEnabled reports the REPLACE env bit.
// SEALED (Wave 5 X-2): PU6 must not use this to swap the served deterministic narrative.
// See .doc/ops/short-term/2026-09-18-wave5-deadcode-decisions.md#x-2.
// SemanticSummaryReplaceEnabled reports the REPLACE master env bit.
// Narrative replacement additionally requires the session allowlist
// (SemanticReplaceEnabledFor); the master bit alone replaces nothing.
func SemanticSummaryReplaceEnabled() bool {
return CurrentSummaryFlags().Replace
}
// SemanticReplaceEnabledFor reports fail-closed gray eligibility: the master
// flag must be on AND the session must be in the allowlist (empty allowlist
// replaces no session).
func SemanticReplaceEnabledFor(sessionID string) bool {
f := CurrentSummaryFlags()
if !f.Replace || sessionID == "" {
return false
}
_, ok := f.ReplaceSessions[sessionID]
return ok
}
// SetSummaryFlagsForTest overrides flags in tests.
func SetSummaryFlagsForTest(f SummaryFeatureFlags) {
summaryFlagsMu.Lock()