Event 79 · v1.0.1 polish cleanup · audit_id auto-prefix + regex validation#36
Merged
Event 79 · v1.0.1 polish cleanup · audit_id auto-prefix + regex validation#36
Conversation
…e audit ack (Event 79) CP-AUDIT-ACK-01 cleanup. Smoke test of Event 78 (PR #35) surfaced a UX bug: operator copy-pasted the audit-id stem '20260424-155444-14e5' without the 'audit-' prefix; the permissive CLI accepted it and silently wrote a malformed entry to the ack-store. Suppression then failed because the run_id in profile_audit.jsonl carries the prefix — the IDs didn't match and the SessionStart banner kept firing. Fix: new normalize_audit_id() helper in _profile_audit_ack.py that: 1. Auto-prepends 'audit-' if the input is the bare stem (YYYYMMDD-HHMMSS-NNNN format). 2. Regex-validates the result against '^audit-\\d{8}-\\d{6}-[0-9a-f]{4}$' — strict on lowercase hex per uuid4().hex[:4] generation convention; rejects malformed input with a diagnostic ValueError. Integrated into write_ack + write_revoke so the chain only ever stores well-formed IDs going forward. The legacy malformed entry from the dogfood discovery (already revoked + re-acked correctly via the local-state fix) remains in the chain per Pillar 2 append-only ethos — historical record preserved, but no longer findable via well-formed lookup. Tests at tests/test_profile_audit_ack.py — 29/29 pass (20 from Event 78 + 9 new): - NormalizeAuditIdTests (8 cases): already-prefixed unchanged, bare-stem auto-prefixed, malformed rejected, uppercase-hex rejected, wrong-date-length rejected, empty rejected, non-string rejected, write_ack functional test (bare stem stored as full id). - Existing tests updated to use well-formed test ids (audit-20260427-NNNNNN-XXXX format) to pass the new regex. CLI handler unchanged — write_ack / write_revoke handle normalization internally; success messages echo the normalized id from the envelope. Soak-protected surfaces touched: ZERO. Module-internal validator update + test extension only.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v1.0.1 polish cleanup — closes the UX gap surfaced on first dogfood of CP-AUDIT-ACK-01 (Event 78 / PR #35).
Bug story. Operator copy-pasted the audit-id stem
20260424-155444-14e5without theaudit-prefix; the permissive CLI accepted it and silently wrote a malformed entry to the ack-store. Suppression then failed because therun_idinprofile_audit.jsonlcarries the prefix — the IDs didn't match and the SessionStart banner kept firing.Local state was fixed by revoke + re-ack with the correct full id. This PR ships the code-level fix so it can't happen again.
What this changes
src/episteme/_profile_audit_ack.pygets a newnormalize_audit_id()helper that:audit-if the input is the bare stem (YYYYMMDD-HHMMSS-NNNN).^audit-\d{8}-\d{6}-[0-9a-f]{4}$— strict on lowercase hex peruuid4().hex[:4]generation convention.ValueErrorwith a diagnostic message pointing the operator atepisteme profile audit ack --listfor valid IDs.Integrated into
write_ack+write_revokeso the chain only ever stores well-formed IDs going forward.Behavior matrix:
audit-20260427-063251-913120260427-063251-9131(bare stem)audit-20260427-063251-9131audit-20260427-063251-91FF(uppercase hex)audit-2026-04-27-063251-9131(wrong date format)abracadabra""/" "/NoneThe legacy malformed entry from the dogfood discovery (already revoked + re-acked correctly via the local-state fix) remains in the chain per Pillar 2 append-only ethos — historical record preserved, but no longer findable via well-formed lookup.
Tests
tests/test_profile_audit_ack.py— 29/29 pass (20 from Event 78 + 9 new).New
NormalizeAuditIdTestsclass:test_already_prefixed_audit_id_returned_unchangedtest_bare_stem_gets_audit_prefix_auto_prependedtest_malformed_format_rejectedtest_uppercase_hex_in_suffix_rejectedtest_wrong_date_length_rejectedtest_empty_audit_id_rejectedtest_non_string_rejectedtest_write_ack_with_bare_stem_normalizes_in_chain(functional)test_write_ack_with_malformed_id_rejectedExisting tests updated to use well-formed test ids (
audit-20260427-NNNNNN-XXXX) so they pass the new regex.CLI behavior unchanged
The CLI handler in
cli.pydoesn't need direct changes —write_ack/write_revokehandle normalization internally. The success message echoes the normalized id from the envelope, so an operator who types the bare stem sees the prefixed id in the confirmation output.Soak-invariant
ZERO touches to
kernel/*/core/hooks/*/core/blueprints/*/cli.py/templates/*/labs/*. Module-internal validator update + test extension only.v1.0.1 polish queue post-Event-79
v1.0.1 polish track effectively complete after this merges. Next major: v1.1 cycle with CP-CHAIN-RECOVERY-PROTOCOL-01.
Cross-references
20260424-155444-14e5+ re-ackaudit-20260424-155444-14e5with substantive rationale + evidence_refs["Event 65", "Event 66", "Event 67"]src/episteme/_profile_audit.py:run_auditline 157 —f"audit-{now.strftime('%Y%m%d-%H%M%S')}-{uuid.uuid4().hex[:4]}"~/episteme-private/docs/PROGRESS.mdEvent 79 entry (private)