Repository navigation
Security train: Node 24.22.1, post-#628 OSV fixes, and the live inline active-memory line - #630
Merged
Merged
Conversation
Foreground turns answered from the active memory context refreshed for the previous message: the refresh for the current message was scheduled fire-and-forget, so a memory relevant to what was just said arrived one turn late. With the decision backend making retrieval fast, the current message can be awaited again. settings.json activeMemoryRetrievalMode selects the behaviour: - background (default, unchanged): serve the last-good context, refresh for the next turn. - inline: schedule the same sticky-merge refresh first and await it for at most activeMemoryInlineBudgetMs before prompt assembly; on timeout or failure the turn uses the last-good context (logged at INFO, existing turn_degraded event) and the refresh lands for the next turn. A missing or invalid budget rejects the turn. The memory turn stage records activeMemoryRetrievalMode, activeMemoryInlineOutcome and activeMemoryInlineWaitMs. Also corrects the hardcoded-settings baseline for DEFAULT_FREE_TIME_CONFIG.budget.maxTurns, already drifted on main. Refs: psfn-framework-d5e0p.20 Co-Authored-By: Claude Opus 5.5 <[email protected]>
… builds Debian bookworm published security updates for jq/libjq1 (1.6-2.1+deb12u3), unzip (6.0-28+deb12u1) and zip (3.0-13+deb12u1). The old exact jq pin can no longer install because libjq1 resolves to the new build, so every agent image build failed in the apt layer. Pins stay exact. Co-Authored-By: Claude Opus 5.5 <[email protected]>
…curity-live-20261022
…ork-k1mt0) Bump @modelcontextprotocol/client and server to 2.3.0, vitest to 4.1.12, and vite to the patched 6.4.4/7.3.7 lines across every lockfile. Co-Authored-By: Claude Opus 5.5 <[email protected]>
axAilotl
added
the
change-budget:exception
axAilotl
marked this pull request as ready for review
October 22, 2026 21:57
github-actions
Bot
added
size:XL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Integration train that brings
mainup to what should run live, plus the outstanding security patches:security/node-24.22.1, merged as a lane): every Node runtime, CI, engine, and container pin moves from 24.19.0 to the CVE-2026-111497-fixed 24.22.1 (digest-pinnednode:24.22.1-slim), with the refreshed Debianjqpin and the fleet-restorecpSyncerrorOnExistfix.fix/inline-active-memory-retrieval, merged as a lane): live has rundf2739c2csince 2026-10-20 (psfn-config Refactor/pi agent boundary #37), and livesettings.jsonsetsactiveMemoryRetrievalMode: "inline". Without this lane, a rebuild frommainwould drop the feature, and the settings contract would reject the live key. It also repinsjq/unzip/zipto the current bookworm security builds.psfn-framework-k1mt0): advisories published after fix(ci): move scheduled scans into local gate and remediate OSV advisories #628 merged.@modelcontextprotocol/clientandservergo to 2.3.0 in the root and satellite-hub;vitestto 4.1.12 andviteto 6.4.4/7.3.7 across root, admin-ui, companion-ui, and tools/evals.node scripts/ci/run-osv-scan.mjsnow exits 0 on every lockfile.Beads
psfn-framework-tbddk(Node 24.22.1)psfn-framework-d5e0p.20(inline active-memory retrieval)psfn-framework-k1mt0(post-fix(ci): move scheduled scans into local gate and remediate OSV advisories #628 OSV advisories)Change-budget exception
Urgent security train: the Node pin has to change in all 33 of its files at once, and the OSV and live-feature lanes need to ship in the same image. Most of the lines are repeated version pins and lockfiles.
Supersedes #629.
🤖 Generated with Claude Code