refactor(knowledge): publish retrieval adapter contracts - #266
Conversation
|
Warning Review limit reached
Next review available in: 24 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (5)
📒 Files selected for processing (10)
📝 WalkthroughWalkthroughThe retrieval module now exposes adapter interfaces while moving default, JDBC, and evidence-scope implementations to package-private classes. API and Worker wiring use these contracts, and architecture tests enforce the approved dependency boundaries. ChangesRetrieval boundaries
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
TegamiThis repository uses Tegami to manage releases. When your changes affect published packages, add a changelog file under Create a changelog → · Changelog format Release preview
This PR does not add changelog files. Pending changelogs from other branches are included in the preview above. Run Managed by Tegami. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java`:
- Around line 92-102: Update the catch block in
DefaultCanonicalHybridKnowledgeSearch to pass the caught
KnowledgeEvidenceScopeUnavailableException directly into
searchAuthorization.unavailable(...) when creating the mapped exception.
Preserve the existing actor, requestId, normalizedQuery, reasonCode, and
policyVersion arguments while retaining unavailable as the cause.
In
`@core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCitationContentService.java`:
- Around line 93-100: Update the integrity-check failure path in
DefaultCitationContentService to record a DENY audit using the existing
SOURCE_BLOB_INTEGRITY_FAILED reason code before closing content and throwing
KnowledgeRetrievalUnavailableException. Adjust
CitationContentServiceTests.storageIntegrityMismatchClosesContentBeforeAllowAudit
to assert the expected DENY audit record instead of asserting that no audit was
recorded.
In
`@core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.java`:
- Around line 611-637: Extract a private safeEmit helper in
DefaultGraphRagKnowledgeRetrievalService that accepts a
GraphRagEventSink.GraphRagEvent, calls events.emit, and suppresses
RuntimeException telemetry failures. Update emit, emitStage,
emitAssembledContext, emitPreparedStage, and emitSnapshotStage to build their
events and delegate through safeEmit, removing their duplicated try/catch
guards.
- Around line 386-389: Update the canonicalByChunk collector in
DefaultGraphRagKnowledgeRetrievalService to provide the same duplicate-key
handling as sameEvidence: retain the first SecureRetrievalCandidate when
multiple verified entries share a chunkId. Keep the existing key and value
mappings unchanged.
In
`@core/src/main/java/com/orgmemory/core/knowledge/retrieval/JdbcEmbeddingProfileRegistry.java`:
- Around line 35-56: Update the registration flow in
JdbcEmbeddingProfileRegistry to replace ON CONFLICT ... DO NOTHING with the
requested no-op UPSERT that updates embedding_profiles.profile_key and returns
the existing or inserted id. Capture that returned id and resolve the profile
through findByIdAndOrganizationId(...) instead of
findByOrganizationIdAndProfileKey(...), preserving the existing failure behavior
when resolution still fails.
In
`@core/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeAssetAccessInspector.java`:
- Around line 8-15: Move the relationship authorization check into
KnowledgeEvidenceScopeResolver.inspectAsset, including validating the requested
authorizationModelId and requiring relationship.state() to be
AccessState.ALLOWED before producing visibility evidence. Update
AdminPermissionController to stop performing the duplicated caller-side check
and rely on inspectAsset’s enforced authorization.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 661a539a-67ef-455e-ace4-e44c7f240dba
⛔ Files ignored due to path filters (6)
docs/increments/active/2026-07-31-spring-modulith-package-refactor/design.mdis excluded by!docs/**docs/increments/active/2026-07-31-spring-modulith-package-refactor/plan.mdis excluded by!docs/**docs/specs/domains/secure-graph-rag.mdis excluded by!docs/**docs/specs/domains/secure-retrieval.mdis excluded by!docs/**docs/tests/domains/secure-graph-rag.mdis excluded by!docs/**docs/tests/domains/secure-retrieval.mdis excluded by!docs/**
📒 Files selected for processing (35)
ARCHITECTURE.mdapps/api/build.gradle.ktsapps/api/src/main/java/com/orgmemory/api/admin/AdminPermissionController.javaapps/api/src/test/java/com/orgmemory/api/RetrievalAdapterBoundaryTests.javaapps/worker/build.gradle.ktsapps/worker/src/main/java/com/orgmemory/worker/OrgMemoryWorkerApplication.javaapps/worker/src/test/java/com/orgmemory/worker/RetrievalAdapterBoundaryTests.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorContentEditIntegrationTests.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorIdentityTrustIntegrationTests.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorPruningIntegrationTests.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorStagingIngestionIntegrationTests.javaapps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/AuthorizationResourceDirectory.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchConfiguration.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/CitationContentService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultAuthorizationResourceDirectory.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCitationContentService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultSourceContentService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/EmbeddingProfileRegistry.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalConfiguration.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/JdbcEmbeddingProfileRegistry.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeAssetAccessInspector.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeEvidenceScopeResolver.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/SourceContentService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/package-info.javacore/src/test/java/com/orgmemory/core/ModulithVerificationTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/CitationContentServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/EmbeddingProfileRegistryTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/SourceContentServiceTests.java
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: Backend · Java 25
- GitHub Check: Web · Node 24
🧰 Additional context used
📓 Path-based instructions (4)
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Treat the repository and runtime evidence as the engineering system of record; do not treat chat or Northstar as authoritative.
Before changing a domain, read its specification, test-coverage document, and applicable decision filenames.
Material decisions about domain boundaries, authorization, persistence, publication, concurrency, cache isolation, parity scope, or deployment require an independent architecture challenge and documented alternatives before implementation.
Do not use completed increment documents as the source for current behavior; use them only for history or archaeology.
Before using unfamiliar Spring Boot, Spring Modulith, Spring AI, Gradle, React, Vite, Tailwind, TypeScript, Next.js, or Fumadocs APIs, consult current official documentation, Context7, and the relevant verification skill.
Readdocs/guidelines/agent-safety.mdbefore retrieval, AI, MCP, permission, upload, graph, or export work; never commit secrets or customer data.
Keepddl-auto=validateand pair every persisted-model change with a Flyway migration.
Use the testing harness; a terminating clean test is the JVM context gate, andbootRunis not verification.
Files:
apps/worker/build.gradle.ktsapps/api/build.gradle.ktsapps/api/src/test/java/com/orgmemory/api/RetrievalAdapterBoundaryTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchConfiguration.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorStagingIngestionIntegrationTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchTests.javaapps/worker/src/test/java/com/orgmemory/worker/RetrievalAdapterBoundaryTests.javaARCHITECTURE.mdcore/src/main/java/com/orgmemory/core/knowledge/retrieval/package-info.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultAuthorizationResourceDirectory.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/JdbcEmbeddingProfileRegistry.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCitationContentService.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/SourceContentServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/CitationContentServiceTests.javaapps/worker/src/main/java/com/orgmemory/worker/OrgMemoryWorkerApplication.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalService.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorPruningIntegrationTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/SourceContentService.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorContentEditIntegrationTests.javaapps/api/src/main/java/com/orgmemory/api/admin/AdminPermissionController.javaapps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeAssetAccessInspector.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalConfiguration.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeEvidenceScopeResolver.javacore/src/test/java/com/orgmemory/core/ModulithVerificationTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/AuthorizationResourceDirectory.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/EmbeddingProfileRegistry.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorIdentityTrustIntegrationTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/EmbeddingProfileRegistryTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultSourceContentService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/CitationContentService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.java
**/*.java
📄 CodeRabbit inference engine (AGENTS.md)
Apply IDE inspection only to edited backend Java files.
Files:
apps/api/src/test/java/com/orgmemory/api/RetrievalAdapterBoundaryTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchConfiguration.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorStagingIngestionIntegrationTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchTests.javaapps/worker/src/test/java/com/orgmemory/worker/RetrievalAdapterBoundaryTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/package-info.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultAuthorizationResourceDirectory.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/JdbcEmbeddingProfileRegistry.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCitationContentService.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/SourceContentServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/CitationContentServiceTests.javaapps/worker/src/main/java/com/orgmemory/worker/OrgMemoryWorkerApplication.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalService.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorPruningIntegrationTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/SourceContentService.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorContentEditIntegrationTests.javaapps/api/src/main/java/com/orgmemory/api/admin/AdminPermissionController.javaapps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeAssetAccessInspector.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalConfiguration.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeEvidenceScopeResolver.javacore/src/test/java/com/orgmemory/core/ModulithVerificationTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/AuthorizationResourceDirectory.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/EmbeddingProfileRegistry.javaapps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorIdentityTrustIntegrationTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/retrieval/EmbeddingProfileRegistryTests.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultSourceContentService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/CitationContentService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.java
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java
⚙️ CodeRabbit configuration file
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java: Treat PostgreSQL ACL evidence as canonical and OpenFGA as the relationship
authorization decision point. Authorization must fail closed. Filtering
must happen before ranking, LIMIT, graph traversal, answer generation,
export, and citation rendering. Flag metadata or timing leak paths.
Files:
core/src/main/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchConfiguration.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/package-info.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultAuthorizationResourceDirectory.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/JdbcEmbeddingProfileRegistry.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCitationContentService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/SourceContentService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeAssetAccessInspector.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalConfiguration.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeEvidenceScopeResolver.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/AuthorizationResourceDirectory.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/EmbeddingProfileRegistry.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultSourceContentService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/CitationContentService.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.javacore/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.java
apps/api/src/main/java/**/*.java
⚙️ CodeRabbit configuration file
apps/api/src/main/java/**/*.java: Enforce the browser-BFF and resource-server boundaries. Authentication
must resolve an active internal actor through the explicit issuer and
subject binding. Reject identity, tenant, roles, or permissions supplied
by request payloads, JWT email, or untrusted JWT role claims.
Files:
apps/api/src/main/java/com/orgmemory/api/admin/AdminPermissionController.java
🧠 Learnings (1)
📚 Learning: 2026-07-26T05:46:47.443Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 61
File: apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.java:50-52
Timestamp: 2026-07-26T05:46:47.443Z
Learning: In OrgMemory, treat the `apps/mcp` and `apps/api` as independent protocol adapter modules. When adjusting OAuth/wire-level scopes, do not introduce a shared Java constant or create a code dependency from `apps/mcp` to `apps/api` solely to deduplicate scope values. Instead, keep OAuth/scope constants adapter-local (e.g., in the relevant adapter/security configuration classes) and ensure cross-adapter consistency via automated realm/OAuth/authorization tests, rather than via shared wiring-level constants or cross-module references.
Applied to files:
apps/api/src/main/java/com/orgmemory/api/admin/AdminPermissionController.java
🪛 ast-grep (0.45.0)
core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java
[warning] 53-53: Avoid user-generated class names for reflection
Context: Class.forName(implementation)
Note: [CWE-470] Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection').
(unsafe-reflection-java)
🪛 PMD (7.26.0)
core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCitationContentService.java
[Medium] 61-66: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'denied' on all code paths
(PreserveStackTrace (Best Practices))
core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java
[Medium] 96-101: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'unavailable' on all code paths
(PreserveStackTrace (Best Practices))
core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.java
[Medium] 602-607: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'unavailable' on all code paths
(PreserveStackTrace (Best Practices))
🔇 Additional comments (51)
core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultGraphRagKnowledgeRetrievalService.java (15)
91-147: Null validation is applied only toeventsandtasks. Other collaborators are unchecked. Practical risk is low because construction happens through Spring configuration.
601-608: PMD flags the dropped cause. The same translation pattern exists inDefaultCanonicalHybridKnowledgeSearch, so it is an established convention, andsearchAuthorization.unavailablehas no visible cause-accepting overload. Not raising.
52-90: LGTM!
149-200: LGTM!
202-237: LGTM!
343-384: LGTM!
447-479: LGTM!
549-581: LGTM!
645-683: LGTM!
748-805: LGTM!
807-842: LGTM!
879-925: LGTM!
927-976: LGTM!
978-1026: LGTM!
516-544: 🩺 Stability & AvailabilityManual verification needed: snapshot query timeouts
DefaultGraphRagKnowledgeRetrievalServicewaits onfuture.get()inqueryPublishedSpaces, but the query path delegates vector, graph, and content reads to storage adapters. Confirm each adapter enforces timeout semantics beforeexecutePreparedreturns and before the virtual-thread executor shutdown can complete.core/src/test/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalServiceTests.java (1)
321-321: LGTM!Also applies to: 944-944
core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCitationContentService.java (3)
22-39: LGTM!
101-155: LGTM!
53-70: 🩺 Stability & AvailabilityNo change needed for
verified.candidates().getFirst().
verifyenforces non-empty inputs, rejects missing canonical chunks as not-visible before the OpenFGA check, and requires all OpenFGA decisions to succeed. It does not return an empty candidate list for authorized filtering.> Likely an incorrect or invalid review comment.core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultSourceContentService.java (4)
16-34: LGTM!
61-81: LGTM!
82-136: LGTM!
44-52: 🔒 Security & PrivacyNo change needed for
resolve(actor, null)or the scope-unavailable path.A
nullexpected authorization model id does not bypass the relationship authorization check; model validation only runs when a non-null value is provided. This service path already fails closed and uses the domainKnowledgeResourceNotFoundException; the audit trail is out of scope for this service.> Likely an incorrect or invalid review comment.core/src/test/java/com/orgmemory/core/knowledge/retrieval/CitationContentServiceTests.java (1)
180-180: LGTM!core/src/test/java/com/orgmemory/core/knowledge/retrieval/SourceContentServiceTests.java (1)
45-46: LGTM!core/src/main/java/com/orgmemory/core/knowledge/retrieval/AuthorizationResourceDirectory.java (1)
7-12: LGTM!core/src/main/java/com/orgmemory/core/knowledge/retrieval/CitationContentService.java (1)
6-9: LGTM!core/src/main/java/com/orgmemory/core/knowledge/retrieval/EmbeddingProfileRegistry.java (1)
6-18: LGTM!core/src/main/java/com/orgmemory/core/knowledge/retrieval/SourceContentService.java (1)
6-9: LGTM!core/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeAssetAccessInspector.java (1)
17-18: LGTM!core/src/main/java/com/orgmemory/core/knowledge/retrieval/KnowledgeEvidenceScopeResolver.java (2)
176-176: LGTM!
34-35: 🩺 Stability & AvailabilityEnsure class-based transaction proxies for the scope resolver.
KnowledgeEvidenceScopeResolveris injected by bothKnowledgeAssetAccessInspectorand concreteKnowledgeEvidenceScopeResolvertypes, but itsresolve(...)method is not declared on the interface. Add and cover a context test that uses the concrete type, or makeresolve(...)part of the public adapter contract if those callers must go through the transactional proxy.core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultAuthorizationResourceDirectory.java (1)
19-33: LGTM!Also applies to: 35-61
core/src/main/java/com/orgmemory/core/knowledge/retrieval/JdbcEmbeddingProfileRegistry.java (1)
12-21: LGTM!Also applies to: 66-88
core/src/test/java/com/orgmemory/core/knowledge/retrieval/EmbeddingProfileRegistryTests.java (1)
19-20: LGTM!core/src/main/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearch.java (1)
5-6: 🩺 Stability & AvailabilityNo change needed.
PermissionAwareKnowledgeSearchis public and already declaressearch(...), soCanonicalHybridKnowledgeSearchandGraphRagKnowledgeRetrievalServiceexpose their inherited API through a public contract.core/src/main/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchConfiguration.java (1)
1-10: LGTM!core/src/main/java/com/orgmemory/core/knowledge/retrieval/DefaultCanonicalHybridKnowledgeSearch.java (1)
1-91: LGTM!Also applies to: 103-401
core/src/test/java/com/orgmemory/core/knowledge/retrieval/CanonicalHybridKnowledgeSearchTests.java (1)
76-76: LGTM!Also applies to: 339-339
ARCHITECTURE.md (1)
172-177: LGTM!apps/worker/src/main/java/com/orgmemory/worker/OrgMemoryWorkerApplication.java (1)
5-5: LGTM!Also applies to: 54-54
apps/api/build.gradle.kts (1)
36-36: No change needed.
spring-modulith-starter-testalready provides ArchUnit for these test compile classpaths via the declared module BOM.apps/api/src/main/java/com/orgmemory/api/admin/AdminPermissionController.java (1)
17-17: LGTM!Also applies to: 67-67, 76-76, 214-214
apps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorContentEditIntegrationTests.java (1)
37-37: LGTM!Also applies to: 92-92
apps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorIdentityTrustIntegrationTests.java (1)
34-34: LGTM!Also applies to: 88-88
apps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorPruningIntegrationTests.java (1)
34-34: LGTM!Also applies to: 85-85
apps/worker/src/test/java/com/orgmemory/worker/connector/ConnectorStagingIngestionIntegrationTests.java (1)
25-25: LGTM!Also applies to: 80-80
apps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.java (1)
36-36: LGTM!Also applies to: 90-90
core/src/main/java/com/orgmemory/core/knowledge/retrieval/GraphRagKnowledgeRetrievalConfiguration.java (1)
3-3: LGTM!Also applies to: 33-33
core/src/main/java/com/orgmemory/core/knowledge/retrieval/package-info.java (1)
11-17: LGTM!core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java (1)
10-20: LGTM!Also applies to: 36-57, 800-808, 865-865, 915-915, 957-957
1 participant
Summary
Verification
clean test: 108 tasks, passedpython scripts/check_docs.py: 506 Markdown files, 8 mirrored pairspnpm release:check: 41 tests on Node 24.15.0skip-release: intermediate modular refactor; release follows completion of the full refactor goal
Summary by CodeRabbit
New Features
Documentation
Tests