Make engram deletes/updates immutable (tombstone + supersede)
The soul was hard-deleting engram nodes: memory/delete and node/delete called engram_forget (frees the node and drops its incident edges), and node/update created a replacement then forgot the original with no link back. That violates the day-one rule that engram nodes are immutable — memory could be silently, irrecoverably destroyed via the API. Convert the three destructive handlers to Will's immutability semantics, mirroring the pattern memory/update and knowledge evolve/promote already use: - node/update -> create the new node, wire a "supersedes" edge new->old, KEEP the original. No engram_forget. (Was: create + forget old, no edge.) - memory/delete and node/delete -> TOMBSTONE: keep the node AND its edges, create a Tombstone marker node (content = target id, label "tombstone:<id>") wired with a "tombstones" edge. Never engram_forget. Default bounded list reads (handle_api_list_typed / the memory list) hide tombstoned nodes and the markers; ?include_deleted=1 returns them, and internal cognition + /api/graph/nodes still traverse them. memory/update was already correct and is unchanged. Full-graph hiding on /api/graph/nodes is deliberately NOT done at the el layer: json_array_get is O(index), so filtering that endpoint (called with limit up to 999999) would be O(n^2). That hide needs a runtime scan filter and is a separate follow-up; nodes there remain traversable, tagged status:deleted via the marker edge. Regenerated dist/soul.c from these sources (flat single-TU amalgamation, compiled under a 3GB physical-RSS watchdog, peak ~32MB). Verified with scripts/verify-soul-contract.sh in neuron-ui: PRESENCE passes (all 27 routes) and IMMUTABILITY passes (all four mutation routes KEPT; deletes produce a real tombstone marker and hide from the default list).
This commit is contained in:
+94
-21
@@ -104,6 +104,73 @@ fn api_not_persisted(id: String) -> String {
|
||||
return "{\"ok\":false,\"error\":\"write_not_persisted\",\"id\":\"" + id + "\"}"
|
||||
}
|
||||
|
||||
// ── Immutability: tombstone instead of hard-delete ────────────────────────────
|
||||
//
|
||||
// Day-one rule: engram nodes are immutable. A "delete" must never engram_forget
|
||||
// (which frees the node and drops its incident edges). Instead we TOMBSTONE: the
|
||||
// original node and all its edges are KEPT and stay traversable; a small
|
||||
// Tombstone marker node records the deletion (content = target id, label
|
||||
// "tombstone:<id>"), wired to the target with a "tombstones" edge. Default
|
||||
// bounded list reads hide tombstoned nodes (memory_hide_tombstoned); internal
|
||||
// cognition and explicit ?include_deleted reads still see them.
|
||||
fn tombstone_node(id: String) -> String {
|
||||
let tags: String = "[\"Tombstone\",\"status:deleted\"]"
|
||||
let marker: String = engram_node_full(
|
||||
id, "Tombstone", "tombstone:" + id,
|
||||
el_from_float(0.01), el_from_float(0.01), el_from_float(1.0),
|
||||
"Episodic", tags)
|
||||
if !str_eq(marker, "") {
|
||||
engram_connect(marker, id, el_from_float(1.0), "tombstones")
|
||||
}
|
||||
return marker
|
||||
}
|
||||
|
||||
// tombstoned_id_set — delimited "|id1|id2|" of every tombstoned target id.
|
||||
// Empty string when nothing is tombstoned (callers fast-path on that).
|
||||
fn tombstoned_id_set() -> String {
|
||||
let markers: String = engram_scan_nodes_by_type_json("Tombstone", 5000, 0)
|
||||
if str_eq(markers, "") || str_eq(markers, "[]") { return "" }
|
||||
let n: Int = json_array_len(markers)
|
||||
let acc: String = "|"
|
||||
let i: Int = 0
|
||||
while i < n {
|
||||
let m: String = json_array_get(markers, i)
|
||||
let tid: String = json_get(m, "content")
|
||||
let acc = if str_eq(tid, "") { acc } else { acc + tid + "|" }
|
||||
let i = i + 1
|
||||
}
|
||||
return acc
|
||||
}
|
||||
|
||||
// memory_hide_tombstoned — drop tombstone markers and tombstoned nodes from a
|
||||
// scanned node array. BOUNDED use only (typed/paginated lists), NOT the full
|
||||
// graph scan: json_array_get is O(index), so a full pass is O(n^2). Safe for the
|
||||
// ~50-item memory list; a hard cap protects against a large limit. The full
|
||||
// /api/graph/nodes hide needs a runtime scan filter and is deferred (see PR).
|
||||
// ?include_deleted bypasses the filter (explicit traversal).
|
||||
fn memory_hide_tombstoned(raw: String, path: String) -> String {
|
||||
if str_contains(path, "include_deleted") { return raw }
|
||||
if str_eq(raw, "") || str_eq(raw, "[]") { return raw }
|
||||
let dead: String = tombstoned_id_set()
|
||||
if str_eq(dead, "") { return raw }
|
||||
let n: Int = json_array_len(raw)
|
||||
if n > 1000 { return raw }
|
||||
let out: String = "["
|
||||
let first: Bool = true
|
||||
let i: Int = 0
|
||||
while i < n {
|
||||
let node: String = json_array_get(raw, i)
|
||||
let nid: String = json_get(node, "id")
|
||||
let ntype: String = json_get(node, "node_type")
|
||||
let is_dead: Bool = !str_eq(nid, "") && str_contains(dead, "|" + nid + "|")
|
||||
let keep: Bool = !str_eq(ntype, "Tombstone") && !is_dead
|
||||
let out = if keep { if first { out + node } else { out + "," + node } } else { out }
|
||||
let first = if keep { false } else { first }
|
||||
let i = i + 1
|
||||
}
|
||||
return out + "]"
|
||||
}
|
||||
|
||||
// ── Session ───────────────────────────────────────────────────────────────────
|
||||
|
||||
// handle_api_begin_session — full context bootstrap.
|
||||
@@ -191,25 +258,26 @@ fn handle_api_node_create(body: String) -> String {
|
||||
return "{\"id\":\"" + id + "\",\"ok\":true}"
|
||||
}
|
||||
|
||||
// handle_api_node_delete — remove a node by id (engram_forget) and verify it is gone.
|
||||
// handle_api_node_delete — TOMBSTONE a node by id (immutable delete).
|
||||
// Backs /api/neuron/node/delete and the /api/neuron/memory/delete alias the UI calls.
|
||||
// The node and all its incident edges are KEPT; a Tombstone marker records the
|
||||
// deletion. Never engram_forget — engram nodes are immutable by design.
|
||||
fn handle_api_node_delete(body: String) -> String {
|
||||
let id: String = json_get(body, "id")
|
||||
if str_eq(id, "") { return api_err("id is required") }
|
||||
// engram_forget removes the node + its incident edges from the live graph.
|
||||
// Delete is NOT read-back-verified: engram_get_node_json can return a stale hit
|
||||
// for a just-forgotten id because the id→index map is not rebuilt on forget.
|
||||
// A stale hit would cause a false "delete_failed" on a successful deletion.
|
||||
// This exception is correct: read-back-verify guards WRITES; for deletes,
|
||||
// the graph endpoints (/api/graph/nodes) reflect the removal and are the source of truth.
|
||||
engram_forget(id)
|
||||
return "{\"ok\":true,\"id\":\"" + id + "\"}"
|
||||
if is_protected_node(id) { return api_err_protected(id) }
|
||||
let existing: String = engram_get_node_json(id)
|
||||
if str_eq(existing, "{}") { return api_err("node not found: " + id) }
|
||||
let marker: String = tombstone_node(id)
|
||||
if str_eq(marker, "") { return api_err("tombstone failed: " + id) }
|
||||
return "{\"ok\":true,\"id\":\"" + id + "\",\"tombstoned\":true}"
|
||||
}
|
||||
|
||||
// handle_api_node_update — update a node's content/fields. There is no in-place
|
||||
// engram update builtin, so this recreates the node with merged fields and then
|
||||
// forgets the old one (only after the new node reads back). The id changes; the
|
||||
// response returns the new id and the replaced id so callers can re-point.
|
||||
// engram update builtin, so this creates a new node with merged fields and wires
|
||||
// a "supersedes" edge new->old. The original is KEPT (immutable); the id changes,
|
||||
// and the response returns the new id and the superseded id so callers re-point.
|
||||
// Mirrors handle_api_memory_update / evolve exactly. Never engram_forget.
|
||||
fn handle_api_node_update(body: String) -> String {
|
||||
let id: String = json_get(body, "id")
|
||||
if str_eq(id, "") { return api_err("id is required") }
|
||||
@@ -240,8 +308,8 @@ fn handle_api_node_update(body: String) -> String {
|
||||
el_from_float(0.5), el_from_float(0.5), el_from_float(0.8),
|
||||
tier, tags)
|
||||
if !api_persisted(new_id) { return api_not_persisted(new_id) }
|
||||
engram_forget(id)
|
||||
return "{\"id\":\"" + new_id + "\",\"replaced\":\"" + id + "\",\"ok\":true}"
|
||||
engram_connect(new_id, id, el_from_float(0.9), "supersedes")
|
||||
return "{\"id\":\"" + new_id + "\",\"supersedes\":\"" + id + "\",\"ok\":true}"
|
||||
}
|
||||
|
||||
// handle_api_recall — search or activate memory by query.
|
||||
@@ -541,10 +609,10 @@ fn handle_api_evolve_memory(body: String) -> String {
|
||||
}
|
||||
|
||||
// handle_api_memory_delete — POST /api/neuron/memory/delete {"id":"..."}.
|
||||
// Hard delete: engram_forget (via mem_forget) removes the node and all
|
||||
// incident edges from the engram store, so no soft-delete fallback is
|
||||
// needed. Existence is checked first because engram_forget silently
|
||||
// no-ops on unknown ids — a bad id must return an error, not fake success.
|
||||
// Immutable delete: TOMBSTONE via tombstone_node — the node and all its incident
|
||||
// edges are KEPT and stay traversable; a Tombstone marker records the deletion
|
||||
// and default bounded list reads hide it. Never engram_forget. Existence is
|
||||
// checked first so a bad id errors rather than faking success.
|
||||
// Blocked for protected identity nodes, same as /memory/forget.
|
||||
fn handle_api_memory_delete(body: String) -> String {
|
||||
let node_id: String = json_get(body, "id")
|
||||
@@ -552,8 +620,10 @@ fn handle_api_memory_delete(body: String) -> String {
|
||||
if is_protected_node(node_id) { return api_err_protected(node_id) }
|
||||
let existing: String = engram_get_node_json(node_id)
|
||||
if str_eq(existing, "{}") { return api_err("memory not found: " + node_id) }
|
||||
mem_forget(node_id)
|
||||
return "{\"ok\":true,\"id\":\"" + node_id + "\",\"deleted\":true}"
|
||||
// Immutable delete: tombstone, never mem_forget/engram_forget. Node + edges KEPT.
|
||||
let marker: String = tombstone_node(node_id)
|
||||
if str_eq(marker, "") { return api_err("tombstone failed: " + node_id) }
|
||||
return "{\"ok\":true,\"id\":\"" + node_id + "\",\"tombstoned\":true}"
|
||||
}
|
||||
|
||||
// handle_api_memory_update — POST /api/neuron/memory/update {"id","content"}.
|
||||
@@ -646,7 +716,10 @@ fn handle_api_cultivate(body: String) -> String {
|
||||
// handle_api_list_typed — list nodes by node_type.
|
||||
fn handle_api_list_typed(node_type: String, path: String, body: String) -> String {
|
||||
let limit: Int = api_query_int(path, "limit", 50)
|
||||
return api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0))
|
||||
let raw: String = api_or_empty(engram_scan_nodes_by_type_json(node_type, limit, 0))
|
||||
// Hide tombstoned nodes from the default (bounded) memory list.
|
||||
// ?include_deleted=1 returns them for explicit traversal.
|
||||
return memory_hide_tombstoned(raw, path)
|
||||
}
|
||||
|
||||
// ── Consolidate ───────────────────────────────────────────────────────────────
|
||||
|
||||
Reference in New Issue
Block a user