Skip to content

Add person profile catalog and tracking foundation - #644

Merged
wesm merged 4 commits into
kenn-io:mainfrom
salmonumbrella:design/issue-628-profile-catalog-tracking
Aug 19, 2026
Merged

Add person profile catalog and tracking foundation#644
wesm merged 4 commits into
kenn-io:mainfrom
salmonumbrella:design/issue-628-profile-catalog-tracking

Conversation

@salmonumbrella

@salmonumbrella salmonumbrella commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

This is the no-model catalog and tracking foundation from #628.

  • Separates observed participant analytics under /api/v1/participants from durable people under /api/v1/people, with schema version 2.0 as an explicit compatibility break.
  • Adds portable is_sensitive metadata and eleven reconciled system profile fields, while keeping system sensitivity structural and user definitions revision-editable.
  • Adds row-presence person tracking across SQLite and PostgreSQL, the API and generated clients, the CLI, and web callers.
  • Keeps Last contacted canonical in person_contact_state.last_contact_at; it does not populate a duplicate attribute value.

Review boundary:

  • No scheduler, extraction provider, candidates or evidence, briefs, or model spend.
  • Old /people analytics and /persons durable routes are intentionally removed rather than aliased.
  • The final tracking API addition advances the schema to 2.1.

Refs #628.

@roborev-ci

roborev-ci Bot commented Aug 19, 2026

Copy link
Copy Markdown

roborev: Combined Review (a00aaae)

One medium-severity upgrade-path issue should be fixed before merge.

Medium

  • internal/store/attribute_seed.go:179 — A legacy user-defined field using a newly seeded slug (such as location) is mistaken for the seed, but reconciliation updates using a different universal ID and silently affects zero rows. The canonical catalog entry is never installed or repaired. Detect slug/universal-ID mismatches and migrate or reject them explicitly, verify exactly one row is updated, and add a legacy slug-collision test.

Reviewers: 2 done | Synthesis: codex, 9s | Total: 6m1s

@salmonumbrella
salmonumbrella force-pushed the design/issue-628-profile-catalog-tracking branch from a00aaae to 854f75a Compare August 19, 2026 06:32
@roborev-ci

roborev-ci Bot commented Aug 19, 2026

Copy link
Copy Markdown

roborev: Combined Review (854f75a)

The change is generally sound, but schema initialization can fail on reserved-slug collisions.

Medium

  • internal/store/attribute_seed.go:194 — Existing user attributes using newly reserved common slugs such as location can permanently prevent an archive from opening when their universal IDs differ. Use collision-resistant seed slugs, or migrate/alias collisions without failing initialization.

Reviewers: 2 done | Synthesis: codex, 5s | Total: 7m9s

@salmonumbrella
salmonumbrella force-pushed the design/issue-628-profile-catalog-tracking branch from 854f75a to 437a11b Compare August 19, 2026 07:46
@roborev-ci

roborev-ci Bot commented Aug 19, 2026

Copy link
Copy Markdown

roborev: Combined Review (437a11b)

No Medium, High, or Critical findings; the reviewed changes are clean.

Reviewers: 2 done | Synthesis: codex, 5s | Total: 10m21s

@salmonumbrella
salmonumbrella force-pushed the design/issue-628-profile-catalog-tracking branch from 437a11b to 430e4bc Compare August 19, 2026 08:08
@roborev-ci

roborev-ci Bot commented Aug 19, 2026

Copy link
Copy Markdown

roborev: Combined Review (430e4bc)

One medium-severity concurrency issue could cause intermittent failures during upgrades.

Medium

  • internal/store/attribute_seed.go:200 — Concurrent schema initializers can both observe a missing seed. The losing initializer treats the resulting uniqueness conflict as fatal, causing intermittent startup or CLI failures. Retry seed reconciliation after conflicts, or serialize the read-and-create/reconcile operation.

Reviewers: 2 done | Synthesis: codex, 6s | Total: 6m6s

@salmonumbrella
salmonumbrella force-pushed the design/issue-628-profile-catalog-tracking branch from 430e4bc to f0f1128 Compare August 19, 2026 08:42
@roborev-ci

roborev-ci Bot commented Aug 19, 2026

Copy link
Copy Markdown

roborev: Combined Review (f0f1128)

No issues found.

Reviewers: 2 done | Synthesis: codex | Total: 8m47s

@salmonumbrella
salmonumbrella force-pushed the design/issue-628-profile-catalog-tracking branch from f0f1128 to 74449a1 Compare August 19, 2026 09:31
@roborev-ci

roborev-ci Bot commented Aug 19, 2026

Copy link
Copy Markdown

roborev: Combined Review (74449a1)

One medium-severity upgrade compatibility issue needs fixing.

Medium

  • internal/store/attribute_seed.go:346 — Upgrades silently rename user-defined fields when their immutable slug conflicts with a new generic seed such as location. Existing automation may then target the new system field instead of the field containing historical values. Preserve existing user slugs; assign conflicting shipped fields a non-conflicting slug or provide a compatibility alias.

Reviewers: 2 done | Synthesis: codex, 10s | Total: 4m55s

@salmonumbrella
salmonumbrella force-pushed the design/issue-628-profile-catalog-tracking branch from 74449a1 to 21969b7 Compare August 19, 2026 10:52
@roborev-ci

roborev-ci Bot commented Aug 19, 2026

Copy link
Copy Markdown

roborev: Combined Review (21969b7)

No issues found.

Reviewers: 2 done | Synthesis: codex | Total: 7m47s

@wesm @claude
docs: record 2.x API break and fix stale participant references
f0e7239 
Add the missing Unreleased changelog entry for the 1.44.0 -> 2.1.0
schema break and the person catalog/tracking features, update the
relationship index design doc to the /participants/search route, and
correct comments and a test title that still cited the pre-2.0
searchPeople operation and /people analytical paths.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@roborev-ci

roborev-ci Bot commented Aug 19, 2026

Copy link
Copy Markdown

roborev: Combined Review (f0e7239)

Review identified one medium-severity compatibility issue.

Medium

  • cmd/msgvault/cmd/store_resolver.go:143 — Remote clients do not verify the API schema major version. A 2.x CLI may silently decode a 1.x /api/v1/people/{id} analytical response as a mostly empty durable profile. Probe the remote schema version when opening the client and reject incompatible major versions before issuing commands.

Reviewers: 2 done | Synthesis: codex, 8s | Total: 7m45s

@wesm @claude
cli: verify remote daemon API schema major on connect
eeceb67 
Roborev flagged that a configured remote skipped the schema-major gate
local daemons get from their runtime record, so a 2.x CLI could decode
a 1.x /api/v1/people/{id} analytical response as a mostly empty durable
profile. The daemon now reports api_schema_version on authenticated
/api/v1/health, and openRemoteStore probes it once per connection,
rejecting a differing major or a daemon too old to report one. The CLI
test package disables the probe in TestMain since its stub daemons
serve single routes; the probe has its own stub-backed tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@roborev-ci

roborev-ci Bot commented Aug 19, 2026

Copy link
Copy Markdown

roborev: Combined Review (eeceb67)

Medium — Legacy local daemons may bypass schema compatibility checks

  • cmd/msgvault/cmd/daemon_runtime.go:338: An empty api_schema_version is accepted, allowing the 2.x CLI to reuse a pre-2.x daemon despite changed route semantics.
  • Fix: Treat missing local schema metadata as incompatible with API major 2, or probe authenticated health before reuse. Add coverage for legacy runtime records.

Reviewers: 2 done | Synthesis: codex, 9s | Total: 5m55s

@wesm @claude
cli: treat unreported daemon API schema version as incompatible
4ca4343 
An empty api_schema_version now fails the shared compatibility gate
instead of passing, closing the local runtime-record variant of the
remote gap: every daemon that writes a record or serves authenticated
health has stamped its schema version since the daemon-only migration,
so absence means a pre-2.0 daemon whose routes changed meaning. The
remote path drops its duplicate empty-check and reuses the shared
message. Test fixtures that hand-write runtime records now stamp the
current schema version, and a direct gate test covers current, legacy,
and prior-major records.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@roborev-ci

roborev-ci Bot commented Aug 19, 2026

Copy link
Copy Markdown

roborev: Combined Review (4ca4343)

No issues found.

Reviewers: 2 done | Synthesis: codex | Total: 8m11s

@wesm
wesm merged commit d0f1719 into kenn-io:main Aug 19, 2026
20 checks passed
@salmonumbrella salmonumbrella mentioned this pull request Aug 22, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@salmonumbrella @wesm