Skip to content

fix: remediate all 9 yield audit findings (issue #355)#365

Merged
CalebisGross merged 10 commits intomainfrom
fix/yield-audit-355
Mar 29, 2026
Merged

fix: remediate all 9 yield audit findings (issue #355)#365
CalebisGross merged 10 commits intomainfrom
fix/yield-audit-355

Conversation

@CalebisGross
Copy link
Copy Markdown
Collaborator

@CalebisGross CalebisGross commented Mar 29, 2026

Summary

  • Fixes all 9 open findings from the v0.33.0 Yield Framework audit
  • 10 commits, each addressing one finding with build+test verification
  • Net reduction of ~400 lines despite adding new packages and config fields

Changes

Finding Commit Impact
CosineSimilarity duplicated 4x 179e4ee New internal/mathutil/, deleted 3 copies, float64 precision
HeuristicFilter goroutine leak c8848cd Added done channel + Close() method
Encoding agent context leak 6a77042 Cancel old context in Start()
Config fallback helpers 3x acf9324 New agentutil/config.go, deleted 2 local copies
Hardcoded CORS origins dc836b1 New AllowedOrigins config field with defaults
SearchByConcepts LIKE queries 2b2eabe Replaced with FTS5 column-scoped queries
Encoding finalization ~145 lines duped e1ff61f Extracted persistEncodedMemory(), -236 lines
110 hardcoded heuristic entries a59ba04 Extracted defaults + Extra* config overrides
Store god interface (115 methods) 9bcefb1 16 composable sub-interfaces, zero behavior change
main.go monolith (3407 lines) 8771e7b Split into 16 files, main.go now 241 lines

Test plan

  • make build passes
  • make test passes (0 failures)
  • golangci-lint run — only 3 pre-existing issues, none from this branch
  • Daemon restart + systemd health check
  • API health endpoint returns OK
  • Dashboard loads, WebSocket upgrades with config-driven CORS
  • MCP recall (exercises FTS5 concept search path)
  • MCP remember + check_memory (exercises persistEncodedMemory extraction)
  • Memory encoded successfully with 10 associations created

Closes #355

🤖 Generated with Claude Code

CalebisGross and others added 10 commits March 29, 2026 12:52
@CalebisGross @claude
refactor: deduplicate CosineSimilarity into shared mathutil package
179e4ee 
Extract canonical CosineSimilarity to internal/mathutil with float64
accumulation for better numerical precision. Remove 3 duplicate
implementations from retrieval agent, sqlite store, and main.go.
agentutil.CosineSimilarity now delegates to mathutil.

Addresses finding #1 from yield audit (issue #355).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@CalebisGross @claude
fix: add cancellation to HeuristicFilter cleanup goroutine
c8848cd 
Add done channel and Close() method to HeuristicFilter so the
cleanupLoop goroutine can be stopped gracefully. Call Close() in
the perception agent's Stop() method.

Addresses finding #2 from yield audit (issue #355).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@CalebisGross @claude
fix: cancel constructor context in encoding agent Start()
6a77042 
The encoding agent constructor creates a default context for
test-friendliness. Start() replaces it but never cancelled the
original, leaking a context. Now cancels the old context before
creating the new one.

Addresses finding #3 from yield audit (issue #355).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@CalebisGross @claude
refactor: consolidate config fallback helpers into agentutil
acf9324 
Extract IntOr, Float32Or, Float64Or into agentutil/config.go.
Remove duplicate cfgFloat64/cfgFloat32/cfgInt from consolidation
agent and intOr/f32Or from retrieval agent.

Addresses finding #7 from yield audit (issue #355).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@CalebisGross @claude
refactor: make CORS allowed origins configurable
dc836b1 
Add AllowedOrigins field to APIConfig and wire it through the API
server. The built-in localhost defaults are used when no origins
are configured, preserving current behavior.

Addresses finding #4 from yield audit (issue #355).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@CalebisGross @claude
refactor: replace LIKE concept search with FTS5
2b2eabe 
SearchByConcepts and SearchByConceptsInProject now use the existing
memories_fts virtual table with column-scoped queries (concepts:term*)
instead of LIKE '%concept%' OR chains. Eliminates full table scans
and scales properly beyond 5K memories.

Addresses finding #6 from yield audit (issue #355).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@CalebisGross @claude
refactor: extract shared encoding finalization into persistEncodedMemory
e1ff61f 
Both encodeMemory and finalizeEncodedMemory had ~145 lines of
identical finalization logic (dedup check, memory write, resolution,
concepts, attributes, associations, event publishing). Extract into
persistEncodedMemory with a persistResult return type. Both callers
now delegate to it.

Addresses finding #8 from yield audit (issue #355).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@CalebisGross @claude
refactor: extract hardcoded heuristic filter lists to config
a59ba04 
Move 110 hardcoded filter entries (ignored paths, lockfiles, app
dirs, sensitive files, commands, keywords, etc.) into package-level
defaults in heuristic_defaults.go. Add Extra* config fields that
extend the defaults without replacing them, merged at construction
time.

Addresses finding #8 from yield audit (issue #355).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@CalebisGross @claude
refactor: decompose store.Store into 16 composable sub-interfaces
9bcefb1 
Define focused sub-interfaces (RawMemoryStore, MemoryStore,
SearchStore, AssociationStore, ConceptStore, EpisodeStore,
PatternStore, AbstractionStore, MetacognitionStore, FeedbackStore,
ConsolidationStore, SessionStore, ExclusionStore, UsageStore,
ForumStore, AnalyticsStore) and redefine Store as their composition.

Zero behavior change — the method set is identical, SQLiteStore and
MockStore still satisfy the interface. Consumers can be gradually
migrated to accept sub-interfaces in follow-up work.

Addresses finding #9 from yield audit (issue #355).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@CalebisGross @claude
refactor: split main.go monolith into 16 focused files
8771e7b 
Break cmd/mnemonic/main.go (3407 lines) into logical files:
- main.go (241 lines): router, constants, printUsage
- serve.go (730): daemon serve command
- dedup_cli.go (368): dedup and reset-patterns commands
- cycle.go (263): meta-cycle, dream-cycle, mcp, autopilot
- status.go (251): status command and helpers
- runtime.go (233): config builders, LLM provider factory
- daemon.go (207): start/stop/restart commands
- memory_cli.go (182): remember, recall, consolidate
- purge.go (175): purge and cleanup commands
- diagnose.go (174): diagnose command
- export.go (143): export, import, backup
- watch.go (134): watch command
- web.go (124): agent web server
- update.go (90): check-update, update, generate-token
- insights.go (89): insights command
- restore.go (73): restore command
- install.go (60): install/uninstall commands
- util.go (9): truncate helper

All files remain in package main. No function signatures changed.

Addresses finding #10 from yield audit (issue #355).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@CalebisGross
Copy link
Copy Markdown
Collaborator Author

CalebisGross commented Mar 29, 2026

All 9 findings verified against the live daemon — recall, remember, encoding pipeline, dashboard, and WebSocket all working. Merging this one.

@jkbennitt heads up — this touches a lot of surface area (store interface decomposition, main.go split into 16 files, FTS5 concept search migration). Nothing should break since it's all backward-compatible, but worth a scan if you're working in any of these areas.

@CalebisGross CalebisGross mentioned this pull request Mar 29, 2026
Closed
8 tasks
@CalebisGross CalebisGross merged commit 0af0268 into main Mar 29, 2026
@CalebisGross CalebisGross deleted the fix/yield-audit-355 branch March 29, 2026 18:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Yield Framework Audit: v0.33.0 findings and action plan

1 participant

@CalebisGross