feat(assistant): add governed file evidence - #350
Conversation
…vidence-architecture # Conflicts: # docs/roadmap.md
|
Warning Review limit reached
Next review available in: 30 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (27)
📝 WalkthroughWalkthroughThe PR adds governed Assistant file evidence. The API, core services, retrieval paths, database schema, web composer, documentation, and tests support upload, readiness checks, ordered evidence selection, restricted retrieval, and citation validation. ChangesGoverned file evidence
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant AssistantComposer
participant AssistantController
participant AssistantEvidenceService
participant RetrievalService
participant ChatModel
User->>AssistantComposer: Upload and select governed files
AssistantComposer->>AssistantController: POST evidence multipart request
AssistantController->>AssistantEvidenceService: Create binding
AssistantEvidenceService-->>AssistantComposer: Binding status
User->>AssistantComposer: Submit chat message
AssistantComposer->>AssistantController: Chat request with binding IDs
AssistantController->>AssistantEvidenceService: Claim ordered evidence
AssistantEvidenceService-->>AssistantController: Restricted selection
AssistantController->>RetrievalService: Search with evidence selection
RetrievalService-->>AssistantController: Permission-verified evidence
AssistantController->>ChatModel: Generate grounded response
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
TegamiThis repository uses Tegami to manage releases. When your changes affect published packages, add a changelog file under Create a changelog → · Changelog format Release preview
Changelogs in this PR
Run Managed by Tegami. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
apps/web/src/features/sources/components/source-upload-dialog.tsx (1)
39-51: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winNarrow
triggertoReactElement | false.
DialogTriggeruses RadixasChild, which requires a single React element child so props and ref can be cloned/forwarded onto it. Allowing only the default button or explicitly omittedfalsematches the current runtime behavior.♻️ Proposed prop type
-import { useState, type FormEvent, type ReactNode } from "react" +import { useState, type FormEvent, type ReactElement, type ReactNode } from "react"- trigger?: ReactNode | false + trigger?: ReactElement | false description?: ReactNode🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/web/src/features/sources/components/source-upload-dialog.tsx` around lines 39 - 51, Update the `trigger` prop in the component props definition to accept only `ReactElement | false` instead of `ReactNode | false`, preserving support for the default trigger and explicit omission while ensuring `DialogTrigger` receives a single clonable element.core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java (1)
136-149: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winOne audit reason now covers two different authorization outcomes in both retrieval engines. Both engines narrow the resolved authorized-asset scope by
KnowledgeEvidenceSelection, then reuse the pre-existingNO_AUTHORIZED_KNOWLEDGE_ASSETSreason when the narrowed scope is empty. An auditor can no longer separate "the actor has no authorized Knowledge" from "the actor may not view the selected files". Add one new reason code for the selection-narrowed case and use it in both engines.
core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java#L136-L149: record whetherretainAll(selection.assetIds())emptied a previously non-empty set, then pass the selection-specific reason tosearchAuditat Line 146.core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.java#L392-L412: apply the same distinction around therestrict(resolve(...), selection)result, and pass the selection-specific reason tosearchAuthorization.commandat Line 409.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java` around lines 136 - 149, Introduce a selection-specific authorization audit reason and use it in both retrieval engines. In core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java#L136-L149, track whether retainAll(selection.assetIds()) empties a previously non-empty authorizedAssetIds set, then pass the new reason to searchAudit; retain NO_AUTHORIZED_KNOWLEDGE_ASSETS when the resolved scope was already empty. Apply the same distinction to the restrict(resolve(...), selection) result in core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.java#L392-L412 and pass the selection-specific reason to searchAuthorization.command.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java`:
- Around line 211-228: In the retrievalScheduler callback within
AssistantController, collapse the ternary’s duplicated assistant.startTurn calls
into one invocation that always passes turnClaim.selection() as the final
argument, relying on the overload’s unrestricted default behavior only where
appropriate.
In `@apps/docs/content/docs/reference/api-reference/assistant.mdx`:
- Around line 49-51: Update the assistant API reference page metadata by setting
lastReviewed to 2026-08-10 using the existing Asia/Bangkok date convention,
while preserving the documented governed-evidence navigation entries.
In `@apps/web/src/features/assistant/components/assistant-page.tsx`:
- Around line 944-972: Update the evidence-chip header rendered by the
currentEvidenceBindings block to act as an appropriate live region so assistive
technology announces status changes without disrupting keyboard interaction.
Replace binding.status?.toLowerCase() with the existing human-readable
status-label mapping or equivalent product-facing labels, including indexing and
unavailable, while preserving the current loading, disabled, and removal
behavior.
- Around line 660-682: Update the evidence polling flow in useQueries so
refetchInterval continues while each binding is not in a terminal state,
including failed requests with no data, rather than stopping when
query.state.data is undefined. Use the existing terminal/readiness status logic
around assistantEvidenceReady to preserve normal completion behavior. In the
evidence-binding UI, use evidenceStatusQueries[index]?.isError to render a
visible error message explaining why sending remains blocked.
- Around line 854-868: Move evidenceBindingIdsRef.current synchronization into a
useEffect dependent on evidenceBindings, and remove the ref assignments from the
setEvidenceBindings updater functions in addEvidence and removeEvidence.
Preserve the existing ID filtering behavior.
In
`@core/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.java`:
- Around line 67-73: Update AssistantConversationService.requireUserMessage to
accept normalized user messages up to 8,000 characters, matching
AssistantChatRequest and the web assistant constraint while preserving
assistant.message-invalid for longer or invalid content. Extend tests covering
both evidence and non-evidence turn flows, including messages between 4,001 and
8,000 characters.
In
`@core/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceService.java`:
- Around line 195-226: Move the CAN_VIEW authorization in the evaluation flow
before the source-state branches, using the knowledgeAssetId when available and
failing closed to UNAVAILABLE with failureCode cleared when access is denied.
Ensure view(binding, source, ...) cannot expose title, fileName, or failureCode
from the UNAVAILABLE, FAILED, or PROCESSING paths without authorization;
explicitly preserve the chosen fail-closed behavior for pre-asset sources where
knowledgeAssetId is null.
In
`@core/src/main/resources/db/migration/V32__assistant_governed_file_evidence.sql`:
- Around line 58-63: Update the fk_assistant_turn_evidence_binding foreign key
in the migration so deleting an assistant_evidence_bindings row cannot delete
its assistant turn evidence selection. Replace the ON DELETE CASCADE behavior
with ON DELETE NO ACTION and preserve the existing composite reference columns.
In
`@core/src/test/java/com/orgmemory/core/assistant/AssistantEvidenceServiceTests.java`:
- Around line 75-102: Expand
AssistantEvidenceServiceTests.claimsOnlyTheExactReadyRevisionAndPersistsTheTurnSelection()
to use multiple binding IDs, return repository bindings in a different order,
capture turnBindings.saveAll, and assert the saved binding IDs, ordinals,
turnId, and userMessageId match the request order. In
apps/web/test/e2e/assistant-pipeline.spec.ts lines 355-380, upload and select at
least two files and assert evidenceBindingIds preserves the visible selection
order.
---
Outside diff comments:
In `@apps/web/src/features/sources/components/source-upload-dialog.tsx`:
- Around line 39-51: Update the `trigger` prop in the component props definition
to accept only `ReactElement | false` instead of `ReactNode | false`, preserving
support for the default trigger and explicit omission while ensuring
`DialogTrigger` receives a single clonable element.
In
`@core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java`:
- Around line 136-149: Introduce a selection-specific authorization audit reason
and use it in both retrieval engines. In
core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java#L136-L149,
track whether retainAll(selection.assetIds()) empties a previously non-empty
authorizedAssetIds set, then pass the new reason to searchAudit; retain
NO_AUTHORIZED_KNOWLEDGE_ASSETS when the resolved scope was already empty. Apply
the same distinction to the restrict(resolve(...), selection) result in
core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.java#L392-L412
and pass the selection-specific reason to searchAuthorization.command.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 00eb9b69-fbed-4e48-ae4e-505aa548d750
⛔ Files ignored due to path filters (13)
apps/docs/generated/openapi.public.jsonis excluded by!**/generated/**contracts/openapi.jsonis excluded by!contracts/openapi.jsondocs/decisions/0038-use-governed-source-bindings-for-assistant-files.mdis excluded by!docs/**docs/increments/active/2026-08-10-assistant-file-evidence/challenge-brief.mdis excluded by!docs/**docs/increments/active/2026-08-10-assistant-file-evidence/challenge-verdict.mdis excluded by!docs/**docs/increments/active/2026-08-10-assistant-file-evidence/design.mdis excluded by!docs/**docs/increments/active/2026-08-10-assistant-file-evidence/plan.mdis excluded by!docs/**docs/increments/active/2026-08-10-assistant-file-evidence/reference-study.mdis excluded by!docs/**docs/roadmap.mdis excluded by!docs/**docs/specs/domains/assistant-and-mcp.mdis excluded by!docs/**docs/specs/domains/knowledge-ingestion.mdis excluded by!docs/**docs/tests/domains/assistant-and-mcp.mdis excluded by!docs/**docs/tests/domains/knowledge-ingestion.mdis excluded by!docs/**
📒 Files selected for processing (59)
.tegami/2026-08-10-assistant-governed-file-evidence.mdARCHITECTURE.mdapps/api/src/main/java/com/orgmemory/api/assistant/AssistantChatRequest.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantConfiguration.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javaapps/api/src/test/java/com/orgmemory/api/OpenApiContractTests.javaapps/api/src/test/java/com/orgmemory/api/assistant/AssistantChatRequestValidationTests.javaapps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.javaapps/docs/content/docs/reference/api-reference/assistant.mdxapps/web/src/features/assistant/api/chat-transport.tsapps/web/src/features/assistant/assistant-draft-storage.test.tsapps/web/src/features/assistant/assistant-evidence.test.tsapps/web/src/features/assistant/assistant-evidence.tsapps/web/src/features/assistant/assistant-message-constraints.tsapps/web/src/features/assistant/components/assistant-page.tsxapps/web/src/features/sources/components/source-upload-dialog.tsxapps/web/test/e2e/assistant-pipeline.spec.tscore/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceAnswerabilityPort.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceBinding.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceBindingRepository.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceBindingView.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceService.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceStatus.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceTurnClaim.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceUploadService.javacore/src/main/java/com/orgmemory/core/assistant/AssistantService.javacore/src/main/java/com/orgmemory/core/assistant/AssistantTurnEvidenceBinding.javacore/src/main/java/com/orgmemory/core/assistant/AssistantTurnEvidenceBindingRepository.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedEvidenceQuery.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedEvidenceRef.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUpload.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUploadCommand.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUploadResult.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/package-info.javacore/src/main/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerability.javacore/src/main/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerabilityQuery.javacore/src/main/java/com/orgmemory/core/knowledge/graph/package-info.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/ResolvedKnowledgeEvidenceScope.javacore/src/main/java/com/orgmemory/core/knowledge/search/KnowledgeEvidenceSelection.javacore/src/main/java/com/orgmemory/core/knowledge/search/PermissionAwareKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceLedgerGovernedEvidenceQuery.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceLedgerGovernedFileUpload.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadRegistrationService.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadResult.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadService.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/package-info.javacore/src/main/resources/db/migration/V32__assistant_governed_file_evidence.sqlcore/src/test/java/com/orgmemory/core/ModulithVerificationTests.javacore/src/test/java/com/orgmemory/core/assistant/AssistantConversationServiceTests.javacore/src/test/java/com/orgmemory/core/assistant/AssistantEvidenceServiceTests.javacore/src/test/java/com/orgmemory/core/assistant/AssistantEvidenceUploadServiceTests.javacore/src/test/java/com/orgmemory/core/assistant/AssistantServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerabilityQueryTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadServiceTests.java
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: PostgreSQL GraphRAG
- GitHub Check: Public docs · Node 24
- GitHub Check: Backend · Java 25
- GitHub Check: Web · Node 24
🧰 Additional context used
📓 Path-based instructions (11)
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Treat the repository and runtime evidence as the engineering system of record; do not treat chat or Northstar as authoritative.
Before changing a domain, read its specification, test-coverage document, and applicable decision filenames.
Material decisions about domain boundaries, authorization, persistence, publication, concurrency, cache isolation, parity scope, or deployment require an independent architecture challenge and documented alternatives before implementation.
Do not use completed increment documents as the source for current behavior; use them only for history or archaeology.
Before using unfamiliar Spring Boot, Spring Modulith, Spring AI, Gradle, React, Vite, Tailwind, TypeScript, Next.js, or Fumadocs APIs, consult current official documentation, Context7, and the relevant verification skill.
Readdocs/guidelines/agent-safety.mdbefore retrieval, AI, MCP, permission, upload, graph, or export work; never commit secrets or customer data.
Keepddl-auto=validateand pair every persisted-model change with a Flyway migration.
Use the testing harness; a terminating clean test is the JVM context gate, andbootRunis not verification.
Files:
core/src/main/java/com/orgmemory/core/knowledge/sourceledger/package-info.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/package-info.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceStatus.javaapps/web/src/features/assistant/assistant-message-constraints.tscore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUpload.javaapps/web/src/features/assistant/assistant-draft-storage.test.tscore/src/test/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalServiceTests.javaapps/web/src/features/assistant/assistant-evidence.test.tscore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUploadCommand.javacore/src/main/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerability.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedEvidenceQuery.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadRegistrationService.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceLedgerGovernedFileUpload.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceBindingView.javacore/src/test/java/com/orgmemory/core/assistant/AssistantEvidenceServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerabilityQueryTests.javacore/src/test/java/com/orgmemory/core/assistant/AssistantConversationServiceTests.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceTurnClaim.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedEvidenceRef.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadResult.javacore/src/main/java/com/orgmemory/core/knowledge/search/KnowledgeEvidenceSelection.javacore/src/test/java/com/orgmemory/core/assistant/AssistantEvidenceUploadServiceTests.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceBindingRepository.javacore/src/test/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadServiceTests.javaARCHITECTURE.mdcore/src/main/java/com/orgmemory/core/assistant/AssistantTurnEvidenceBinding.javacore/src/main/java/com/orgmemory/core/knowledge/graph/package-info.javaapps/api/src/test/java/com/orgmemory/api/OpenApiContractTests.javacore/src/main/java/com/orgmemory/core/assistant/AssistantTurnEvidenceBindingRepository.javaapps/web/src/features/assistant/api/chat-transport.tscore/src/test/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchTests.javacore/src/main/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerabilityQuery.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadService.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceLedgerGovernedEvidenceQuery.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceAnswerabilityPort.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUploadResult.javaapps/docs/content/docs/reference/api-reference/assistant.mdxcore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceUploadService.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantChatRequest.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/ResolvedKnowledgeEvidenceScope.javaapps/web/src/features/assistant/assistant-evidence.tscore/src/main/java/com/orgmemory/core/assistant/AssistantService.javacore/src/test/java/com/orgmemory/core/assistant/AssistantServiceTests.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantConfiguration.javaapps/api/src/test/java/com/orgmemory/api/assistant/AssistantChatRequestValidationTests.javacore/src/main/java/com/orgmemory/core/knowledge/search/PermissionAwareKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceBinding.javaapps/web/src/features/sources/components/source-upload-dialog.tsxcore/src/main/resources/db/migration/V32__assistant_governed_file_evidence.sqlapps/web/test/e2e/assistant-pipeline.spec.tsapps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceService.javacore/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.javaapps/web/src/features/assistant/components/assistant-page.tsxcore/src/test/java/com/orgmemory/core/ModulithVerificationTests.java
**/*.java
📄 CodeRabbit inference engine (AGENTS.md)
Apply IDE inspection only to edited backend Java files.
Files:
core/src/main/java/com/orgmemory/core/knowledge/sourceledger/package-info.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/package-info.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceStatus.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUpload.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalServiceTests.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUploadCommand.javacore/src/main/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerability.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedEvidenceQuery.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadRegistrationService.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceLedgerGovernedFileUpload.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceBindingView.javacore/src/test/java/com/orgmemory/core/assistant/AssistantEvidenceServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerabilityQueryTests.javacore/src/test/java/com/orgmemory/core/assistant/AssistantConversationServiceTests.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceTurnClaim.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedEvidenceRef.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadResult.javacore/src/main/java/com/orgmemory/core/knowledge/search/KnowledgeEvidenceSelection.javacore/src/test/java/com/orgmemory/core/assistant/AssistantEvidenceUploadServiceTests.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceBindingRepository.javacore/src/test/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadServiceTests.javacore/src/main/java/com/orgmemory/core/assistant/AssistantTurnEvidenceBinding.javacore/src/main/java/com/orgmemory/core/knowledge/graph/package-info.javaapps/api/src/test/java/com/orgmemory/api/OpenApiContractTests.javacore/src/main/java/com/orgmemory/core/assistant/AssistantTurnEvidenceBindingRepository.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchTests.javacore/src/main/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerabilityQuery.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadService.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceLedgerGovernedEvidenceQuery.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceAnswerabilityPort.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUploadResult.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceUploadService.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantChatRequest.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/ResolvedKnowledgeEvidenceScope.javacore/src/main/java/com/orgmemory/core/assistant/AssistantService.javacore/src/test/java/com/orgmemory/core/assistant/AssistantServiceTests.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantConfiguration.javaapps/api/src/test/java/com/orgmemory/api/assistant/AssistantChatRequestValidationTests.javacore/src/main/java/com/orgmemory/core/knowledge/search/PermissionAwareKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceBinding.javaapps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceService.javacore/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.javacore/src/test/java/com/orgmemory/core/ModulithVerificationTests.java
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java
⚙️ CodeRabbit configuration file
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java: Treat PostgreSQL ACL evidence as canonical and OpenFGA as the relationship
authorization decision point. Authorization must fail closed. Filtering
must happen before ranking, LIMIT, graph traversal, answer generation,
export, and citation rendering. Flag metadata or timing leak paths.
Files:
core/src/main/java/com/orgmemory/core/knowledge/sourceledger/package-info.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/package-info.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUpload.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUploadCommand.javacore/src/main/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerability.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedEvidenceQuery.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadRegistrationService.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceLedgerGovernedFileUpload.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedEvidenceRef.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadResult.javacore/src/main/java/com/orgmemory/core/knowledge/search/KnowledgeEvidenceSelection.javacore/src/main/java/com/orgmemory/core/knowledge/graph/package-info.javacore/src/main/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerabilityQuery.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadService.javacore/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceLedgerGovernedEvidenceQuery.javacore/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUploadResult.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/ResolvedKnowledgeEvidenceScope.javacore/src/main/java/com/orgmemory/core/knowledge/search/PermissionAwareKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java
apps/web/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
apps/web/**/*.{ts,tsx}: Extend the established OrgMemory product shell, design tokens, shadcn/Radix primitives, and existing layout patterns; do not introduce a separate visual system in the web application.
Generate ordinary REST clients fromcontracts/openapi.jsonusing Hey API.
Use TanStack Query for server state, TanStack Router for navigation, and limit Zustand to durable or high-frequency UI state.
Preserve keyboard accessibility, light/dark theme support, loading and error states, and responsive behavior in the web application.
Files:
apps/web/src/features/assistant/assistant-message-constraints.tsapps/web/src/features/assistant/assistant-draft-storage.test.tsapps/web/src/features/assistant/assistant-evidence.test.tsapps/web/src/features/assistant/api/chat-transport.tsapps/web/src/features/assistant/assistant-evidence.tsapps/web/src/features/sources/components/source-upload-dialog.tsxapps/web/test/e2e/assistant-pipeline.spec.tsapps/web/src/features/assistant/components/assistant-page.tsx
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Frontend changes must pass lint, typecheck, tests, and a production build; perform browser verification when the flow warrants it.
Files:
apps/web/src/features/assistant/assistant-message-constraints.tsapps/web/src/features/assistant/assistant-draft-storage.test.tsapps/web/src/features/assistant/assistant-evidence.test.tsapps/web/src/features/assistant/api/chat-transport.tsapps/web/src/features/assistant/assistant-evidence.tsapps/web/src/features/sources/components/source-upload-dialog.tsxapps/web/test/e2e/assistant-pipeline.spec.tsapps/web/src/features/assistant/components/assistant-page.tsx
apps/web/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
apps/web/src/**/*.{ts,tsx}: OAuth access and refresh tokens must never enter browser JavaScript or
browser storage. Use the HttpOnly BFF session, CSRF-protected mutations,
generated Hey API data clients, accessible states, and both light and
dark themes. Handwritten transport is reserved for documented protocol
flows such as navigation redirects and streaming.
Files:
apps/web/src/features/assistant/assistant-message-constraints.tsapps/web/src/features/assistant/assistant-draft-storage.test.tsapps/web/src/features/assistant/assistant-evidence.test.tsapps/web/src/features/assistant/api/chat-transport.tsapps/web/src/features/assistant/assistant-evidence.tsapps/web/src/features/sources/components/source-upload-dialog.tsxapps/web/src/features/assistant/components/assistant-page.tsx
apps/web/**/*.{test,spec}.{ts,tsx}
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
Preserve the existing browser test suite when changing the web application.
Files:
apps/web/src/features/assistant/assistant-draft-storage.test.tsapps/web/src/features/assistant/assistant-evidence.test.tsapps/web/test/e2e/assistant-pipeline.spec.ts
apps/docs/content/docs/**/*.{md,mdx}
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
apps/docs/content/docs/**/*.{md,mdx}: Public prose must live only inapps/docs/content/docs; internal engineering documents are source evidence, not publication input.
sourceRefsis build-time traceability metadata and must never be rendered in published content.
Draft pages must remain excluded unlessDOCS_INCLUDE_DRAFTS=trueis set for a local or controlled preview.
Files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
apps/docs/content/docs/**/*.mdx
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
Use
index.mdxfor a section root and<slug>.mdxfor a named English page; add Vietnamese pages individually as adjacentindex.vi.mdxor<slug>.vi.mdxfiles, using the/vi/docs/...route.
Files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
apps/api/src/main/java/**/*.java
⚙️ CodeRabbit configuration file
apps/api/src/main/java/**/*.java: Enforce the browser-BFF and resource-server boundaries. Authentication
must resolve an active internal actor through the explicit issuer and
subject binding. Reject identity, tenant, roles, or permissions supplied
by request payloads, JWT email, or untrusted JWT role claims.
Files:
apps/api/src/main/java/com/orgmemory/api/assistant/AssistantChatRequest.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantConfiguration.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java
core/src/main/resources/db/migration/*.sql
⚙️ CodeRabbit configuration file
core/src/main/resources/db/migration/*.sql: The repository is pre-release: V1 is the intentionally resettable clean
baseline and development data carries no migration cost. Once a release
baseline is frozen, later Flyway migrations are immutable. Check tenant
isolation, foreign keys, uniqueness, indexes, append-only evidence
semantics, safe defaults, and PostgreSQL 18 plus pgvector compatibility.
Files:
core/src/main/resources/db/migration/V32__assistant_governed_file_evidence.sql
🧠 Learnings (7)
📚 Learning: 2026-08-05T09:53:56.596Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 300
File: .tegami/2026-08-05-retrieval-recall-observations.md:7-7
Timestamp: 2026-08-05T09:53:56.596Z
Learning: For Tegami release fragments in `.tegami/*.md`, do not require a top-level H1 solely to satisfy markdownlint MD041. These fragments must instead contain an approved level-two public changelog section, such as `## Improvements`, as enforced by `scripts/check-release.mjs`; the generated release output contract prevents adding a second page-level H1.
Applied to files:
.tegami/2026-08-10-assistant-governed-file-evidence.md
📚 Learning: 2026-08-02T08:30:57.335Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 270
File: core/src/main/java/com/orgmemory/core/assetregistry/AssetDraftRepository.java:15-23
Timestamp: 2026-08-02T08:30:57.335Z
Learning: For OrgMemory JPA repository methods using `PESSIMISTIC_WRITE`, do not add a finite lock-timeout hint as part of a behavior-preserving refactor. The V1 PostgreSQL configuration uses `lock_timeout = 0`; any finite lock timeout must be established as a platform-wide database and transaction policy rather than configured on an individual method.
Applied to files:
core/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceBindingRepository.javacore/src/main/java/com/orgmemory/core/assistant/AssistantTurnEvidenceBindingRepository.java
📚 Learning: 2026-07-28T20:06:14.930Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 112
File: apps/docs/content/docs/developers/api-reference/administration.mdx:11-11
Timestamp: 2026-07-28T20:06:14.930Z
Learning: In OrgMemory public documentation MDX files, ensure any `lastReviewed` dates are set using the repository project timezone `Asia/Bangkok`, not the reviewer’s local timezone or the runtime/build timezone. When generating or updating API-reference pages, intentionally use the exact same `lastReviewed` date convention as the authored public documentation pages to keep timestamps consistent across both sources.
Applied to files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
📚 Learning: 2026-07-28T20:06:15.064Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 112
File: apps/docs/content/docs/developers/api-reference/authentication.mdx:12-12
Timestamp: 2026-07-28T20:06:15.064Z
Learning: In OrgMemory docs/tests that describe date-based review checks, treat the project timezone as Asia/Bangkok for all “date” comparisons/validations. Do not assume UTC when interpreting or validating fields like `lastReviewed`. For example, `lastReviewed: '2026-07-29'` should be considered valid when the effective “current date” in Asia/Bangkok is July 29, 2026 (not merely when the UTC date matches).
Applied to files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
📚 Learning: 2026-07-30T06:46:08.031Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 144
File: apps/docs/public-content.manifest.json:13-67
Timestamp: 2026-07-30T06:46:08.031Z
Learning: For the Fumadocs docs portal under apps/docs, follow the expected MDX filename conventions that drive section-root vs named-page routing. Use `index.mdx` for English section-root pages and `<slug>.mdx` for named pages. For Vietnamese, use adjacent locale-suffixed files: `index.vi.mdx` for section roots and `<slug>.vi.mdx` for named pages. Do not require or enforce a `page.mdx` filename; doing so would change/break the intended section-root route structure.
Applied to files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
📚 Learning: 2026-07-26T05:46:47.443Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 61
File: apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.java:50-52
Timestamp: 2026-07-26T05:46:47.443Z
Learning: In OrgMemory, treat the `apps/mcp` and `apps/api` as independent protocol adapter modules. When adjusting OAuth/wire-level scopes, do not introduce a shared Java constant or create a code dependency from `apps/mcp` to `apps/api` solely to deduplicate scope values. Instead, keep OAuth/scope constants adapter-local (e.g., in the relevant adapter/security configuration classes) and ensure cross-adapter consistency via automated realm/OAuth/authorization tests, rather than via shared wiring-level constants or cross-module references.
Applied to files:
apps/api/src/main/java/com/orgmemory/api/assistant/AssistantChatRequest.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantConfiguration.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java
📚 Learning: 2026-07-23T23:30:44.585Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 30
File: core/src/main/resources/db/migration/V32__evidence_scoped_graph_semantics.sql:0-0
Timestamp: 2026-07-23T23:30:44.585Z
Learning: For OrgMemory PostgreSQL Flyway migrations under core/src/main/resources/db/migration, do not recommend using `CREATE INDEX CONCURRENTLY` or `DROP INDEX CONCURRENTLY` inside application-owned Flyway migration SQL. Flyway’s schema-history connection may hold a transaction that can cause concurrent index operations to wait indefinitely (e.g., on a `virtualxid`), and docs/conventions.md forbids this pattern. If you need large production-table index replacement, pre-stage online index operations via the deployment pipeline (outside Flyway) rather than inside the migration; “ordinary” index replacement is acceptable for unreleased projections before production traffic.
Applied to files:
core/src/main/resources/db/migration/V32__assistant_governed_file_evidence.sql
🪛 ast-grep (0.45.0)
core/src/main/java/com/orgmemory/core/assistant/AssistantService.java
[warning] 177-182: Avoid LDAP injections
Context: retrieval.search(
actor,
question,
requestedLimit,
requestId,
selection)
Note: [CWE-90] Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'). Security best practice.
(ldap-injection-java)
[warning] 183-187: Avoid LDAP injections
Context: retrieval.search(
actor,
question,
requestedLimit,
requestId)
Note: [CWE-90] Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'). Security best practice.
(ldap-injection-java)
🪛 markdownlint-cli2 (0.23.2)
.tegami/2026-08-10-assistant-governed-file-evidence.md
[warning] 7-7: First line in a file should be a top-level heading
(MD041, first-line-heading, first-line-h1)
🪛 SQLFluff (4.2.2)
core/src/main/resources/db/migration/V32__assistant_governed_file_evidence.sql
[error] 31-34: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 84-87: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
🪛 Squawk (2.61.0)
core/src/main/resources/db/migration/V32__assistant_governed_file_evidence.sql
[warning] 37-38: By default new constraints require a table scan and block writes to the table while that scan occurs. Use NOT VALID with a later VALIDATE CONSTRAINT call.
(constraint-missing-not-valid)
[warning] 37-38: Adding a UNIQUE constraint requires an ACCESS EXCLUSIVE lock which blocks reads and writes to the table while the index is built. Create an index CONCURRENTLY and create the constraint using the index.
(disallowed-unique-constraint)
[warning] 44-44: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 49-49: Using 32-bit integer fields can result in hitting the max int limit. Use 64-bit integer values instead to prevent hitting this limit.
(prefer-bigint-over-int)
🔇 Additional comments (59)
ARCHITECTURE.md (2)
166-170: LGTM!
338-344: LGTM!core/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedEvidenceQuery.java (1)
1-13: LGTM!core/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUploadCommand.java (1)
1-18: LGTM!core/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUploadResult.java (1)
1-18: LGTM!core/src/main/java/com/orgmemory/core/knowledge/evidence/package-info.java (1)
1-5: LGTM!core/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceLedgerGovernedEvidenceQuery.java (1)
1-68: LGTM!core/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadRegistrationService.java (1)
39-39: LGTM!Also applies to: 70-79
core/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedEvidenceRef.java (1)
6-46: LGTM!core/src/main/java/com/orgmemory/core/knowledge/evidence/GovernedFileUpload.java (1)
5-11: LGTM!core/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceLedgerGovernedFileUpload.java (1)
9-35: LGTM!core/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadResult.java (1)
6-17: LGTM!core/src/main/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadService.java (1)
42-101: LGTM!core/src/main/java/com/orgmemory/core/knowledge/sourceledger/package-info.java (1)
12-22: LGTM!apps/api/src/main/java/com/orgmemory/api/assistant/AssistantChatRequest.java (1)
5-21: LGTM!apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java (1)
110-169: LGTM!Also applies to: 182-199
apps/web/src/features/assistant/api/chat-transport.ts (1)
8-13: LGTM!Also applies to: 38-38
apps/web/src/features/assistant/assistant-evidence.ts (1)
1-33: LGTM!apps/web/src/features/assistant/assistant-message-constraints.ts (1)
1-1: LGTM!apps/web/src/features/assistant/components/assistant-page.tsx (2)
2-17: LGTM!Also applies to: 49-49, 60-64, 79-111, 380-382, 398-398, 407-407, 437-439, 477-480, 492-492, 590-593, 722-723, 768-775, 817-853
989-1035: LGTM!.tegami/2026-08-10-assistant-governed-file-evidence.md (1)
1-21: LGTM!apps/api/src/test/java/com/orgmemory/api/OpenApiContractTests.java (1)
10-11: LGTM!Also applies to: 55-73
apps/api/src/test/java/com/orgmemory/api/assistant/AssistantChatRequestValidationTests.java (1)
15-21: LGTM!Also applies to: 32-34, 44-63, 83-91
apps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.java (1)
25-26: LGTM!Also applies to: 97-98, 158-159, 205-206, 259-260, 333-334, 442-443, 463-464
core/src/test/java/com/orgmemory/core/assistant/AssistantEvidenceUploadServiceTests.java (1)
24-99: LGTM!core/src/test/java/com/orgmemory/core/assistant/AssistantServiceTests.java (1)
11-19: LGTM!Also applies to: 116-155
core/src/test/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchTests.java (1)
21-21: LGTM!Also applies to: 140-174, 427-435
core/src/test/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalServiceTests.java (1)
28-28: LGTM!Also applies to: 96-132
core/src/test/java/com/orgmemory/core/knowledge/sourceledger/SourceUploadServiceTests.java (1)
60-60: LGTM!apps/web/src/features/assistant/assistant-draft-storage.test.ts (1)
27-35: LGTM!apps/web/src/features/assistant/assistant-evidence.test.ts (1)
1-30: LGTM!core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java (1)
173-173: LGTM!Also applies to: 731-731, 890-890, 1086-1119, 1141-1142
core/src/test/java/com/orgmemory/core/assistant/AssistantConversationServiceTests.java (1)
56-56: LGTM!core/src/test/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerabilityQueryTests.java (1)
18-78: LGTM!apps/web/test/e2e/assistant-pipeline.spec.ts (1)
1228-1244: 🎯 Functional CorrectnessRetain the
__streamMonitordeclarations and reset call.The declarations are in separate type assertions, and the block calls
reset()once.> Likely an incorrect or invalid review comment.core/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceAnswerabilityPort.java (1)
1-30: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceStatus.java (1)
1-9: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceTurnClaim.java (1)
1-14: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantTurnEvidenceBinding.java (1)
10-59: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantTurnEvidenceBindingRepository.java (1)
1-8: LGTM!core/src/main/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerability.java (1)
1-23: LGTM!core/src/main/java/com/orgmemory/core/knowledge/graph/GraphEvidenceAnswerabilityQuery.java (1)
30-67: LGTM!core/src/main/java/com/orgmemory/core/knowledge/graph/package-info.java (1)
16-16: LGTM!core/src/main/java/com/orgmemory/core/knowledge/search/PermissionAwareKnowledgeSearch.java (1)
13-32: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantService.java (1)
14-14: LGTM!Also applies to: 147-195
apps/api/src/main/java/com/orgmemory/api/assistant/AssistantConfiguration.java (1)
7-18: LGTM!Also applies to: 76-98
core/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceBinding.java (1)
10-66: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceBindingRepository.java (1)
9-31: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceBindingView.java (1)
6-17: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceService.java (2)
124-184: LGTM!
57-122: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceUploadService.java (1)
27-45: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.java (1)
28-42: LGTM!Also applies to: 90-117
core/src/main/java/com/orgmemory/core/knowledge/search/KnowledgeEvidenceSelection.java (2)
17-43: LGTM!Also applies to: 49-92
45-47: 🩺 Stability & AvailabilityNo change needed.
Set.copyOfde-duplicated input elements, soassetIds()does not need a pre-existing uniqueness check onknowledgeAssetId.core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java (1)
86-115: LGTM!Also applies to: 171-179, 257-267, 299-313
core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.java (1)
205-224: LGTM!Also applies to: 239-246, 257-262, 286-287, 392-402, 473-490, 529-542, 1086-1097, 1107-1113
core/src/main/java/com/orgmemory/core/knowledge/retrieval/ResolvedKnowledgeEvidenceScope.java (1)
55-78: LGTM!
| CONSTRAINT fk_assistant_turn_evidence_binding | ||
| FOREIGN KEY (binding_id, organization_id, conversation_id, actor_user_id) | ||
| REFERENCES public.assistant_evidence_bindings( | ||
| id, organization_id, conversation_id, created_by_user_id | ||
| ) | ||
| ON DELETE CASCADE, |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Prevent binding deletion from deleting turn evidence.
ON DELETE CASCADE deletes the turn-level evidence selection when assistant_evidence_bindings is deleted. This table must retain the evidence ceiling for retries and citations. Use ON DELETE NO ACTION and retain referenced bindings, or persist the source revision identity directly in assistant_turn_evidence_bindings.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@core/src/main/resources/db/migration/V32__assistant_governed_file_evidence.sql`
around lines 58 - 63, Update the fk_assistant_turn_evidence_binding foreign key
in the migration so deleting an assistant_evidence_bindings row cannot delete
its assistant turn evidence selection. Replace the ON DELETE CASCADE behavior
with ON DELETE NO ACTION and preserve the existing composite reference columns.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java`:
- Around line 136-142: Restrict retrieval using the complete
KnowledgeEvidenceSelection identity—asset ID plus source-object/source-revision
pairs—before ranking, LIMIT, and GraphRAG traversal by extending the
retrieval-scope and GraphRAG query contracts and applying exact predicates.
Update
core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java:136-142
and
core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.java:401-401,1110-1115;
retain the late selection.contains checks unchanged as defense in depth at
DefaultCanonicalHybridKnowledgeSearch.java:312-318 and
DefaultGraphRagKnowledgeRetrievalService.java:535-545. Add coverage proving
another revision of the same asset cannot enter the candidate set or GraphRAG
query.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: cf6a8263-03c5-4641-b611-7a0b7fffda65
⛔ Files ignored due to path filters (2)
docs/specs/domains/assistant-and-mcp.mdis excluded by!docs/**docs/tests/domains/assistant-and-mcp.mdis excluded by!docs/**
📒 Files selected for processing (20)
apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javaapps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.javaapps/docs/content/docs/reference/api-reference/assistant.mdxapps/docs/scripts/generate-openapi.tsapps/web/src/features/assistant/assistant-evidence.test.tsapps/web/src/features/assistant/assistant-evidence.tsapps/web/src/features/assistant/components/assistant-page.tsxapps/web/src/features/sources/components/source-upload-dialog.tsxapps/web/test/e2e/assistant-pipeline.spec.tscore/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceService.javacore/src/main/java/com/orgmemory/core/assistant/AssistantTurnEvidenceBinding.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeSearchAuthorizationService.javacore/src/main/resources/db/migration/V32__assistant_governed_file_evidence.sqlcore/src/test/java/com/orgmemory/core/assistant/AssistantConversationServiceTests.javacore/src/test/java/com/orgmemory/core/assistant/AssistantEvidenceServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalServiceTests.java
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: Public docs · Node 24
- GitHub Check: PostgreSQL GraphRAG
- GitHub Check: Backend · Java 25
- GitHub Check: Web · Node 24
🧰 Additional context used
📓 Path-based instructions (12)
apps/docs/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
Verify unfamiliar Next.js and Fumadocs APIs against current official documentation or installed dependency types before using them.
Files:
apps/docs/scripts/generate-openapi.ts
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Treat the repository and runtime evidence as the engineering system of record; do not treat chat or Northstar as authoritative.
Before changing a domain, read its specification, test-coverage document, and applicable decision filenames.
Material decisions about domain boundaries, authorization, persistence, publication, concurrency, cache isolation, parity scope, or deployment require an independent architecture challenge and documented alternatives before implementation.
Do not use completed increment documents as the source for current behavior; use them only for history or archaeology.
Before using unfamiliar Spring Boot, Spring Modulith, Spring AI, Gradle, React, Vite, Tailwind, TypeScript, Next.js, or Fumadocs APIs, consult current official documentation, Context7, and the relevant verification skill.
Readdocs/guidelines/agent-safety.mdbefore retrieval, AI, MCP, permission, upload, graph, or export work; never commit secrets or customer data.
Keepddl-auto=validateand pair every persisted-model change with a Flyway migration.
Use the testing harness; a terminating clean test is the JVM context gate, andbootRunis not verification.
Files:
apps/docs/scripts/generate-openapi.tscore/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeSearchAuthorizationService.javacore/src/main/resources/db/migration/V32__assistant_governed_file_evidence.sqlcore/src/main/java/com/orgmemory/core/assistant/AssistantTurnEvidenceBinding.javaapps/web/src/features/sources/components/source-upload-dialog.tsxcore/src/test/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.javacore/src/test/java/com/orgmemory/core/assistant/AssistantConversationServiceTests.javaapps/web/src/features/assistant/assistant-evidence.test.tscore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceService.javacore/src/test/java/com/orgmemory/core/assistant/AssistantEvidenceServiceTests.javaapps/web/src/features/assistant/assistant-evidence.tscore/src/test/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalServiceTests.javaapps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.javaapps/docs/content/docs/reference/api-reference/assistant.mdxcore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.javaapps/web/test/e2e/assistant-pipeline.spec.tsapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javaapps/web/src/features/assistant/components/assistant-page.tsxcore/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.java
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Frontend changes must pass lint, typecheck, tests, and a production build; perform browser verification when the flow warrants it.
Files:
apps/docs/scripts/generate-openapi.tsapps/web/src/features/sources/components/source-upload-dialog.tsxapps/web/src/features/assistant/assistant-evidence.test.tsapps/web/src/features/assistant/assistant-evidence.tsapps/web/test/e2e/assistant-pipeline.spec.tsapps/web/src/features/assistant/components/assistant-page.tsx
**/*.java
📄 CodeRabbit inference engine (AGENTS.md)
Apply IDE inspection only to edited backend Java files.
Files:
core/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeSearchAuthorizationService.javacore/src/main/java/com/orgmemory/core/assistant/AssistantTurnEvidenceBinding.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.javacore/src/test/java/com/orgmemory/core/assistant/AssistantConversationServiceTests.javacore/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceService.javacore/src/test/java/com/orgmemory/core/assistant/AssistantEvidenceServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalServiceTests.javaapps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javacore/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.java
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java
⚙️ CodeRabbit configuration file
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java: Treat PostgreSQL ACL evidence as canonical and OpenFGA as the relationship
authorization decision point. Authorization must fail closed. Filtering
must happen before ranking, LIMIT, graph traversal, answer generation,
export, and citation rendering. Flag metadata or timing leak paths.
Files:
core/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeSearchAuthorizationService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.java
core/src/main/resources/db/migration/*.sql
⚙️ CodeRabbit configuration file
core/src/main/resources/db/migration/*.sql: The repository is pre-release: V1 is the intentionally resettable clean
baseline and development data carries no migration cost. Once a release
baseline is frozen, later Flyway migrations are immutable. Check tenant
isolation, foreign keys, uniqueness, indexes, append-only evidence
semantics, safe defaults, and PostgreSQL 18 plus pgvector compatibility.
Files:
core/src/main/resources/db/migration/V32__assistant_governed_file_evidence.sql
apps/web/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
apps/web/**/*.{ts,tsx}: Extend the established OrgMemory product shell, design tokens, shadcn/Radix primitives, and existing layout patterns; do not introduce a separate visual system in the web application.
Generate ordinary REST clients fromcontracts/openapi.jsonusing Hey API.
Use TanStack Query for server state, TanStack Router for navigation, and limit Zustand to durable or high-frequency UI state.
Preserve keyboard accessibility, light/dark theme support, loading and error states, and responsive behavior in the web application.
Files:
apps/web/src/features/sources/components/source-upload-dialog.tsxapps/web/src/features/assistant/assistant-evidence.test.tsapps/web/src/features/assistant/assistant-evidence.tsapps/web/test/e2e/assistant-pipeline.spec.tsapps/web/src/features/assistant/components/assistant-page.tsx
apps/web/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
apps/web/src/**/*.{ts,tsx}: OAuth access and refresh tokens must never enter browser JavaScript or
browser storage. Use the HttpOnly BFF session, CSRF-protected mutations,
generated Hey API data clients, accessible states, and both light and
dark themes. Handwritten transport is reserved for documented protocol
flows such as navigation redirects and streaming.
Files:
apps/web/src/features/sources/components/source-upload-dialog.tsxapps/web/src/features/assistant/assistant-evidence.test.tsapps/web/src/features/assistant/assistant-evidence.tsapps/web/src/features/assistant/components/assistant-page.tsx
apps/web/**/*.{test,spec}.{ts,tsx}
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
Preserve the existing browser test suite when changing the web application.
Files:
apps/web/src/features/assistant/assistant-evidence.test.tsapps/web/test/e2e/assistant-pipeline.spec.ts
apps/docs/content/docs/**/*.{md,mdx}
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
apps/docs/content/docs/**/*.{md,mdx}: Public prose must live only inapps/docs/content/docs; internal engineering documents are source evidence, not publication input.
sourceRefsis build-time traceability metadata and must never be rendered in published content.
Draft pages must remain excluded unlessDOCS_INCLUDE_DRAFTS=trueis set for a local or controlled preview.
Files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
apps/docs/content/docs/**/*.mdx
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
Use
index.mdxfor a section root and<slug>.mdxfor a named English page; add Vietnamese pages individually as adjacentindex.vi.mdxor<slug>.vi.mdxfiles, using the/vi/docs/...route.
Files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
apps/api/src/main/java/**/*.java
⚙️ CodeRabbit configuration file
apps/api/src/main/java/**/*.java: Enforce the browser-BFF and resource-server boundaries. Authentication
must resolve an active internal actor through the explicit issuer and
subject binding. Reject identity, tenant, roles, or permissions supplied
by request payloads, JWT email, or untrusted JWT role claims.
Files:
apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java
🧠 Learnings (6)
📚 Learning: 2026-07-28T20:06:14.375Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 112
File: apps/docs/scripts/generate-openapi.ts:211-219
Timestamp: 2026-07-28T20:06:14.375Z
Learning: When generating OrgMemory documentation and authored documentation metadata (e.g., `lastReviewed`), evaluate and format any generated/derived dates using the project timezone `Asia/Bangkok`. Ensure the generated dates stay consistent with the authored corpus when interpreted in that timezone (i.e., avoid UTC/local-time defaults or timezone drift during OpenAPI/docs generation).
Applied to files:
apps/docs/scripts/generate-openapi.ts
📚 Learning: 2026-07-23T23:30:44.585Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 30
File: core/src/main/resources/db/migration/V32__evidence_scoped_graph_semantics.sql:0-0
Timestamp: 2026-07-23T23:30:44.585Z
Learning: For OrgMemory PostgreSQL Flyway migrations under core/src/main/resources/db/migration, do not recommend using `CREATE INDEX CONCURRENTLY` or `DROP INDEX CONCURRENTLY` inside application-owned Flyway migration SQL. Flyway’s schema-history connection may hold a transaction that can cause concurrent index operations to wait indefinitely (e.g., on a `virtualxid`), and docs/conventions.md forbids this pattern. If you need large production-table index replacement, pre-stage online index operations via the deployment pipeline (outside Flyway) rather than inside the migration; “ordinary” index replacement is acceptable for unreleased projections before production traffic.
Applied to files:
core/src/main/resources/db/migration/V32__assistant_governed_file_evidence.sql
📚 Learning: 2026-07-28T20:06:14.930Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 112
File: apps/docs/content/docs/developers/api-reference/administration.mdx:11-11
Timestamp: 2026-07-28T20:06:14.930Z
Learning: In OrgMemory public documentation MDX files, ensure any `lastReviewed` dates are set using the repository project timezone `Asia/Bangkok`, not the reviewer’s local timezone or the runtime/build timezone. When generating or updating API-reference pages, intentionally use the exact same `lastReviewed` date convention as the authored public documentation pages to keep timestamps consistent across both sources.
Applied to files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
📚 Learning: 2026-07-28T20:06:15.064Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 112
File: apps/docs/content/docs/developers/api-reference/authentication.mdx:12-12
Timestamp: 2026-07-28T20:06:15.064Z
Learning: In OrgMemory docs/tests that describe date-based review checks, treat the project timezone as Asia/Bangkok for all “date” comparisons/validations. Do not assume UTC when interpreting or validating fields like `lastReviewed`. For example, `lastReviewed: '2026-07-29'` should be considered valid when the effective “current date” in Asia/Bangkok is July 29, 2026 (not merely when the UTC date matches).
Applied to files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
📚 Learning: 2026-07-30T06:46:08.031Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 144
File: apps/docs/public-content.manifest.json:13-67
Timestamp: 2026-07-30T06:46:08.031Z
Learning: For the Fumadocs docs portal under apps/docs, follow the expected MDX filename conventions that drive section-root vs named-page routing. Use `index.mdx` for English section-root pages and `<slug>.mdx` for named pages. For Vietnamese, use adjacent locale-suffixed files: `index.vi.mdx` for section roots and `<slug>.vi.mdx` for named pages. Do not require or enforce a `page.mdx` filename; doing so would change/break the intended section-root route structure.
Applied to files:
apps/docs/content/docs/reference/api-reference/assistant.mdx
📚 Learning: 2026-07-26T05:46:47.443Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 61
File: apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.java:50-52
Timestamp: 2026-07-26T05:46:47.443Z
Learning: In OrgMemory, treat the `apps/mcp` and `apps/api` as independent protocol adapter modules. When adjusting OAuth/wire-level scopes, do not introduce a shared Java constant or create a code dependency from `apps/mcp` to `apps/api` solely to deduplicate scope values. Instead, keep OAuth/scope constants adapter-local (e.g., in the relevant adapter/security configuration classes) and ensure cross-adapter consistency via automated realm/OAuth/authorization tests, rather than via shared wiring-level constants or cross-module references.
Applied to files:
apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java
🪛 ast-grep (0.45.0)
apps/web/test/e2e/assistant-pipeline.spec.ts
[warning] 151-153: Regular expression constructed from variable input detected. This can lead to Regular Expression Denial of Service (ReDoS) attacks if the variable contains malicious patterns. Use libraries like 'recheck' to validate regex safety or use static patterns.
Context: new RegExp(
^/api/assistant/conversations/${CONVERSATION_ID}/evidence/([^/]+)$,
)
Note: [CWE-1333] Inefficient Regular Expression Complexity
(regexp-from-variable)
🪛 OpenGrep (1.26.0)
apps/web/test/e2e/assistant-pipeline.spec.ts
[ERROR] 152-154: Dynamic command passed to child_process.exec/execSync. Use child_process.execFile or spawn with an argument array instead.
(coderabbit.command-injection.exec-js)
🔇 Additional comments (18)
apps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.java (1)
88-113: 📐 Maintainability & Code QualityVerify the configured Java IDE inspection.
The supplied context has no inspection result for this edited backend Java file. Run the configured IDE inspection before merge.
As per coding guidelines: "
**/*.java: Apply IDE inspection only to edited backend Java files."Also applies to: 115-169, 182-219
Source: Coding guidelines
apps/web/src/features/assistant/components/assistant-page.tsx (1)
655-685: 📐 Maintainability & Code QualityVerify the required frontend quality gates.
The supplied context has no repository or CI evidence for lint, typecheck, tests, production build, or browser verification.
apps/web/src/features/assistant/components/assistant-page.tsx#L655-L685: Verify evidence polling, retrying status, and submit blocking in a browser.apps/web/src/features/sources/components/source-upload-dialog.tsx#L30-L235: Verify controlled dialog opening, upload errors, and retry behavior in a browser.apps/web/src/features/assistant/assistant-evidence.ts#L9-L32: Run lint, typecheck, and unit tests for the helper contracts.apps/web/src/features/assistant/assistant-evidence.test.ts#L33-L48: Run the extended test suite and retain these tests.As per coding guidelines: "Frontend changes must pass lint, typecheck, tests, and a production build; perform browser verification when the flow warrants it."
Source: Coding guidelines
apps/docs/scripts/generate-openapi.ts (1)
218-218: LGTM!apps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.java (1)
25-30: LGTM!Also applies to: 98-99, 159-160, 206-207, 246-247, 261-262, 315-316, 336-337, 445-446, 466-467
apps/docs/content/docs/reference/api-reference/assistant.mdx (1)
10-10: LGTM!Also applies to: 49-51, 85-90, 117-118, 141-144, 157-157
core/src/test/java/com/orgmemory/core/assistant/AssistantConversationServiceTests.java (1)
12-18: LGTM!Also applies to: 43-44, 60-60, 160-216
core/src/test/java/com/orgmemory/core/assistant/AssistantEvidenceServiceTests.java (1)
1-75: LGTM!Also applies to: 77-175, 177-242, 244-272, 274-299, 301-349, 351-411
apps/web/test/e2e/assistant-pipeline.spec.ts (2)
10-10: LGTM!Also applies to: 36-36, 49-50, 130-180, 229-229, 395-418, 421-440, 462-462
893-897: 📐 Maintainability & Code QualityRun the web validation gates before approval. Run
pnpm --filter@orgmemory/webcheck:weband the relevanttest:e2eflow forassistant-pipeline.spec.ts.core/src/main/resources/db/migration/V32__assistant_governed_file_evidence.sql (1)
22-22: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantEvidenceService.java (1)
195-208: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantTurnEvidenceBinding.java (1)
59-74: LGTM!core/src/main/java/com/orgmemory/core/assistant/AssistantConversationService.java (1)
28-43: LGTM!Also applies to: 58-118, 375-378
core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java (1)
86-115: LGTM!core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.java (1)
193-246: LGTM!core/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeSearchAuthorizationService.java (1)
21-22: LGTM!core/src/test/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchTests.java (1)
132-152: LGTM!Also applies to: 162-196, 449-457
core/src/test/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalServiceTests.java (1)
134-165: LGTM!
1 participant
Scope
knowledge::evidenceinterfaces for Assistant and GraphRAG consumersVerification
gradlew.bat --no-daemon clean test --no-parallel --console=plain— 105 tasks, greencorepack pnpm --filter @orgmemory/web check:api— greencorepack pnpm release:check— green after the final main syncUI approval
The project owner approved candidate tree
bde47ee2c937a1fd7671095fbfb757f7b0dd7b8aafter desktop/mobile review. The following approved UI paths are unchanged after merging currentorigin/main:apps/web/src/features/assistant/api/chat-transport.tsapps/web/src/features/assistant/assistant-evidence.tsapps/web/src/features/assistant/assistant-evidence.test.tsapps/web/src/features/assistant/components/assistant-page.tsxapps/web/src/features/sources/components/source-upload-dialog.tsxapps/web/test/e2e/assistant-pipeline.spec.tsSanitized screenshot SHA-256 values:
27dcce964da9e2b5dada8f575e61e19f48024149a2a711b02862b47002e582723f754b8d16e101ff8e2553e6ba49cc9a64e6e36dbf51314c12292a5acbb56cd4ebb458bf264e7f06369e8e59f9290d6abb84fd6edba95e05509b0266f19c6c209ed4d50de1904d8ce809226d360b45b313a1f892abb0067129969be2a31d1ff5Known limits
Summary by CodeRabbit