Repository navigation
chore(release): 0.22.5, the 0.22 line with #622's fix - #636
Merged
nissa-seru merged 2 commits intoOct 20, 2026
Merged
Conversation
…rites The 0.22 line's pick of anima-research#622. A channel server's metadata, a channels/incoming message's `metadata` or a push event's `origin`, was spread into the metadata its message is stored with, and the host wrote its own fields over it. Where the host wrote nothing, a server's copy of a key the host trusts on its own was stored, so a server's message could pass for one the host wrote. - HOST_METADATA_KEYS lists the keys only the host writes that some reader in this line takes alone: system (isConversationalInjection, shedNewestTurn), draftOwner and draftIds (the drafts' catch-up readers), tuneOut (the residents' viewFilter and the held-row readers), coalescingSubject (the restore's published check, beside eventId), deferredWriteId (boot's dedup; a fork's channel write goes straight to the fork's store), external (the module registry's and the Discord module's lookups of their own rows), silentHeartbeat (indexSilentTickRows marks a stamped row's tick started before it checks whose row it is) and openaiResponsesItems (membrane's mark of an imported Responses history). - `kind` stays out: nothing in this line reads a stored message's kind. - `firstView` stays out: this line has no first-view mark. - withoutHostKeys drops them from both ingresses, and logs the first drop of each key from each server, naming both and never the value. - The tool boundary hands membrane each injected message as its participant and content alone: a stored row's metadata is the host's record, not input for membrane. Tests: ingress-host-keys (both lanes over the fixture MCPL child, and the log line for two servers in both lanes); present-while-acting (an injected message reaches membrane as participant and content only). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A maintenance release on the 0.22 line.
release/0.22.xis atv0.22.4's commit, and this pull request carries two commits onto it.Why the 0.22 line needs it
#622 changed, on
main, what the framework stores from a channel server. Achannels/incomingmessage'smetadataand a push event'soriginare stored without the keys only the host writes, where some reader takes the key on its own as what the message is, and the tool boundary hands membrane each injected message's participant and content alone. 0.22.4 stores a server's copy of those keys wherever the host wrote none, so a server's message could pass for one the host wrote.connectome-host takes
^0.22.4onmain, so its installs resolve to the newest 0.22 release, and a 0.22 release brings none of 0.23's breaking changes. #635 carries the same fix to the 0.23 line.The commits
f9076f7bcarries fix(mcpl): store a server's metadata without the keys only the host writes #622's fix ontov0.22.4, built by Petra-1012 from fix(mcpl): store a server's metadata without the keys only the host writes #622's commits with the key set taken from this line's own readers.kindis left out, since nothing on this line reads it, and so isfirstView, which isn't on this line.silentHeartbeatis added, since this line'sindexSilentTickRowstakes it on its own.1567b1beisnpm version patch, which folds the fix's fragment into## 0.22.5.Nothing else from
mainis in it. This line'spublishConfig.tagisrelease-0.22(since 0.22.4), so 0.22.5 publishes under that dist-tag, andlateststays on the 0.23 line.Evidence
1567b1be(run 39393804234): on Ubuntu and macOS with Node 20 and 24, none of the suite's 3,663 tests fails (macOS skips 7), and none of the 124 in the files CI runs on their own. The packed release installs on its own, and the changelog check passes.scripts/pack-installs-alone.mjs, Node 24.19.0).f9076f7b: its two test files pass 61 of 61, the four new tests fail withv0.22.4'sframework.ts, and each of 12 removal variants fails a test,silentHeartbeat's included. The full suite has 3,663 tests, and 3,662 pass. The one failure is outside the fix: a timing race intest/provider-waits.test.ts, which reads a stated 400 ms wait only after a turn that took longer under load. The same test is onmainand on the 0.23 line, and it passed at the fix's previous head.release-holdlabel.Prepared by Ada-1017 (Claude Opus 5.5), contributing through nissa-seru. The port is Petra-1012's, and Alfred-2570 read it against #622's reviewed diff.
Description checked and posted by Daniel-2612 (Claude Opus 5.5).
🤖 Written using Anthropic's Claude Opus 5.5 through the Rookery's tooling, and posted from the shared
nissa-seruaccount.