Queue clear — shared ACL on lists, semantic q, full telemetry ledger, --color-* retired #103

Merged

bvandeusen merged 5 commits from dev into main 2026-08-08 22:45:26 -04:00

Conversation 0 Commits 5 Files Changed 81

+2030 -1920

bvandeusen commented 2026-08-08 22:45:15 -04:00

Owner

Copy Link

Copy Source

Six commits, no migration. CI green on 4ba544e (run 3549). Closes the last four survey-era items: #2462, #2463, #2477, #2533.

• Lists honor shares (#2462): list_notes uses the shared browse clause — shared-project tasks appear everywhere they were invisible. Guarded by source inspection. And a list's q is now semantic (your "make it match"), relevance-ordered, ILIKE only as embedder-down fallback.
• Telemetry ledger complete (#2463, #2477): reuse slot and Browse search log retrievals; enter_project and the skill sync emit surfaced events as ambient sources, with the readout split in the same commit — surfaced_count stays ranked-only, ambient_count is new. /api/search takes project_id/system_id (measured: zero frontend consumers, so API callers state scope).
• --color-* shim retired (#2533): 73 aliases deleted, 69 files renamed to --fs-* direct, zero survivors. Recipes re-recorded and re-verified. Acceptance test passed: check_snippets_against_design_system → findings: [].

After deploy: the interactive floor and semantic list-q go live; the Knowledge view search behaviour changes accordingly. Worth an eyeball on light/dark after the theme sweep — a mode regression would be visual and silent, though both CSS checkers say nil.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UaYUaouG9jjhATyuxCKrQs

Six commits, no migration. CI green on `4ba544e` (run 3549). Closes the last four survey-era items: #2462, #2463, #2477, #2533. - **Lists honor shares (#2462):** `list_notes` uses the shared browse clause — shared-project tasks appear everywhere they were invisible. Guarded by source inspection. And a list's `q` is now **semantic** (your "make it match"), relevance-ordered, ILIKE only as embedder-down fallback. - **Telemetry ledger complete (#2463, #2477):** reuse slot and Browse search log retrievals; `enter_project` and the skill sync emit surfaced events as **ambient** sources, with the readout split in the same commit — `surfaced_count` stays ranked-only, `ambient_count` is new. `/api/search` takes `project_id`/`system_id` (measured: zero frontend consumers, so API callers state scope). - **`--color-*` shim retired (#2533):** 73 aliases deleted, 69 files renamed to `--fs-*` direct, zero survivors. Recipes re-recorded and re-verified. **Acceptance test passed: `check_snippets_against_design_system` → `findings: []`.** After deploy: the interactive floor and semantic list-q go live; the Knowledge view search behaviour changes accordingly. Worth an eyeball on light/dark after the theme sweep — a mode regression would be visual and silent, though both CSS checkers say nil. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01UaYUaouG9jjhATyuxCKrQs

bvandeusen added 5 commits 2026-08-08 22:45:16 -04:00

fix(lists): shared-project records appear, and a list's q means what search means ... f11a547cd2

#2462, both decided halves.

## The ACL defect

list_notes filtered on Note.user_id == user_id with no scope parameter at all
— never a per-call decision, the capability was absent. query_knowledge beside
it was deliberately browse-scoped with a comment saying why. So a task in a
shared project was invisible in list_tasks, enter_project's open-task list,
the SessionStart todo count and the web UI's task views, while the same
project's notes and snippets appeared.

Now the shared clause: notes_visibility_clause(user_id, "browse"). Browse and
not read, per decision #2094 — an ambient list must never surface a record
someone shared one-to-one; those stay search-only. This is the remaining half
of a fix made twice before (#2159 widened fetch, #2092 widened meaning), and
the guard below is what stops a fourth half appearing.

Guarded by source inspection in test_retrieval_scopes: every list-shaped
service references a shared visibility clause AND carries no bare
Note.user_id comparison that would quietly re-narrow it. An owner-only list
returns correct-looking rows and simply omits the shared ones — the shape no
behavioural test catches.

## q is semantic (operator: "make it match")

The UI's note list keyword-matched while the UI's Browse search
semantic-matched, over the same records, with nothing saying so. Now one
meaning: q joins the embedding index and orders by cosine distance at the
interactive floor, with every lifecycle filter still applied in the same
indexed query. Relevance ordering wins over `sort` when q is present — a query
is a relevance claim, and sorting its results by date would shuffle the
answer. ILIKE survives only as the embedder-down fallback: degraded, never
empty.

Stated position: superseded records are NOT demoted in list-q. The penalty
reorders a top-k; reordering a paginated, counted list would make page
boundaries lie. The search surfaces carry the demotion.

## The interactive floor becomes one constant

INTERACTIVE_SEARCH_THRESHOLD = 0.3 in embeddings.py, consumed by
routes/search.py (was a commented constant), knowledge.py (was a bare
literal), and the new list-q. This closes #2463's finding 3 early — the same
number lived in two files with the reasoning attached to only one.

## Deferred, deliberately

The return-shape unification (ORM objects vs dicts) stays undone. It is a
14-caller refactor whose motivation — callers being unable to swap paths —
shrinks now that both paths share the clause and the meaning of q. If swap
pressure recurs it deserves its own change, not a rider on an ACL fix.

Refs #2462, #2463

fix(telemetry): the two invisible retrievals log, and /api/search takes scope ... 45ba4aab25

#2463, the remaining findings (finding 3 landed with f11a547).

## The reuse slot logs (source: reuse_slot)

A real semantic query competing for an auto-inject menu slot, and the ledger
was asymmetric: the scored hit it DISPLACED was in retrieval_logs, the query
that displaced it was not — so the slot could never be evaluated against what
it replaced. #1038 and #2085 are gated on this ledger being complete.

## Browse search logs (source: browse_search)

The human's main search surface, and it logged nothing — so retrieval_logs
claimed the web's search was /api/search. Measured while fixing: /api/search
has ZERO frontend consumers; the web UI searches through /api/knowledge
exclusively. The table wasn't just under-describing the UI, it was describing
a surface the UI never touches.

The task's check — does folding human queries into the corpus skew the
precision signal thresholds are tuned against? — is answered by the source
column: distinct values (browse_search, reuse_slot beside the existing four)
mean tuning includes or excludes human traffic deliberately rather than by
accident. Same resolution as the mcp_/rest_ split in note_usage_events.

## /api/search takes project_id (and logs it)

The route logged project_id=None unconditionally while the MCP tool insists
the agent pass the active project. Now optional, default global: with no
frontend consumer, this route serves API callers, and an API caller states
its scope explicitly — the default-scope UI decision the task flagged is moot
until a UI actually consumes the route, which is recorded rather than guessed.

Refs #2463

test: the auto-inject path now logs two retrievals, and that is the point ... 9b3874b657

45ba4aa made the reuse slot log its query (source: reuse_slot). The margin-gate
test pinned record_retrieval to exactly one call, which was asserting the very
asymmetry #2463 fixed — the displaced hit logged, the displacing query not.
Assert both sources in order instead.

Refs #2463

feat(telemetry): ambient surfacings count, apart — enter_project and the skill sync emit ... 2d1e26f38f

#2477, option (a) as decided, with the readout changed in the same commit.

## The two silent surfaces

enter_project returns open tasks + recent notes on every project entry —
probably the largest surfacing by volume — and emitted nothing, so the pulls
it caused floated unattributed and the surfaced:pulled ratio ran against a
denominator missing its biggest contributor. Now source "enter_project".

build_process_manifest installs every reachable Process as an auto-surfacing
skill on the operator's machine — its own docstring calls it the most
consequential passive surface Scribe has — and emitted nothing, so a Process
matched on every relevant turn and never opened was indistinguishable from
one never installed. Now source "process_skill_sync": the honest event is
"installed", which is a surfacing in effect since the description sits in
front of the model each session.

## The readout, same commit — the condition option (a) carried

Both surfaces are AMBIENT: top-N-by-recency and install-everything are not
ranked choices. Pooling them into surfaced_count would make a note's number
dominated by "recently updated in a project you opened", and dead-weight
detection would read that as popularity — the wrong number read confidently,
which is the corrupts-data tier the survey ranked above everything else.

So usage_for_notes splits: surfaced_count stays RANKED-ONLY (every existing
consumer's reading — "surfaced often, never pulled → dead weight" — keeps
meaning what it meant), and ambient_count is new. Classified in SQL via a
CASE on AMBIENT_SOURCES so the group count stays three rows per note, not one
per distinct source. Pulls stay pooled: "did anyone ever open this?" does not
depend on how it was found.

#1038 and #2085 read agent pulls and ranked surfacings; both are unaffected
by ambient volume, which is the point.

Refs #2477

refactor(theme): retire the --color-* shim — the sweep it promised, run ... 4ba544e2af

#2533. theme.css claimed "removing this block is a rename sweep across the
components, tracked separately" — written in 67a529a, never filed, which made
the comment itself an instance of the survey's presence-without-reference
pattern. This is that sweep.

73 alias declarations deleted; 69 files rewritten; every --color-*-style name
now references its --fs-* token directly. Mechanical by construction: the map
IS the alias block, applied longest-name-first with a boundary guard so
--color-text never matched inside --color-text-muted. Zero survivors outside
theme.css, verified by grep rather than assumed.

One deliberate survivor: --color-shadow stays DECLARED, because it was never
an alias — it is a literal value the design system has no token for. Marked
in place as a recorded gap: promote it to an --fs-* token when a second app
needs it, don't copy the line.

Nothing is lost mode-wise: the aliases' resolve-at-use-time trick (which
absorbed 48 dark-mode overrides) lives one layer down in the --fs-* tokens'
own derivations, which is why the sweep is a pure rename. Both CSS checkers
green.

Why now rather than never: check_snippets_against_design_system reports every
--color-* reference as "unknown — renders as NOTHING", and nine recipe
snippets recorded from components.css carried the deprecated names, making
them prior art pointing the wrong way. With the sweep in, the checker's
report over re-recorded snippets should be EMPTY — the acceptance test that
proves the checker was right all along (#2517's correction).

Refs #2533

bvandeusen merged commit 875f6a7b5e into main 2026-08-08 22:45:26 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

renovate-bot bvandeusen

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bvandeusen/FabledScribe#103