You’re viewing Paradaux’s public workspaceSign in to vote Get taskl.ie for your team

PAR-473

Loading issues

PAR-473 · Architecture R28: scope Caffeine caches by tenant and… · Paradaux · taskl.ie

PAR-473

Architecture R28: scope Caffeine caches by tenant and enforce permitted locations

Follow-up to the 2026-10-18 architecture audit, linked to PAR-449 and the completed architecture rebuild PAR-408. Rules are in docs/architecture.md. Audit baseline: commit 08d99ee; all 18 architecture checks passed, which does not establish full compliance.

Evidence: triage/ai/CodeSearch.java:58–80 caches code snippets by query and repository scope, without the workspace ID. discord/TriagePendingStore.java:30 keys pending decisions by a short token; discord/TaskInstructionListener.java:420 keys deduplication by channel/requester/instruction. These do not explicitly include the tenant as rule 28 requires. This is a rule violation; cross-tenant disclosure has not been demonstrated.

Acceptance:

Inventory all Caffeine caches, documenting location, scope, expiry and whether they hold permissions.
Include tenant identity in tenant-owned cache keys and in lookup/mutation APIs. Resolve how truly global infrastructure caches fit the written rule instead of forcing artificial tenant ownership.
Move caches to persistence or an outbound adapter where required; document any approved infrastructure exception.
Prove two workspaces cannot share or consume tenant-specific entries, including identical queries and confirmation-token access.
Add a focused regression guard for cache placement; run relevant tests and the architecture suite.

Activity

taskl.ie created the issue 5d ago
taskl.ie changed status from Backlog to In progress 5d ago
taskl.ie5d ago
Implementing as the first PR of the PAR-473–480 architecture stack. Inventory caches, tenant-scope code-search and confirmation/deduplication access, define genuinely global cache semantics, add isolation tests and a placement guard. Base is current main because rebuild has been retired; subsequent PRs will depend on the preceding branch.
taskl.ie5d ago
PR opened as layer 1 of the architecture stack: https://github.com/ParadauxIO/taskl.ie/pull/104 . Full backend suite: 1,311 passed on disposable PG16/pgvector 0.8.2. Web lint/typecheck passed; 1,207 unit tests passed, 1 skipped. Includes cross-tenant/code-search and confirmation ownership/concurrency tests. Awaiting review; not merged or deployed.
taskl.ie changed status from In progress to Done 4d ago
taskl.ie4d ago
Merged PR #104 into main after all eight stack PRs passed CI. Merge commits preserved dependency ancestry; every layer's retargeted diff and exact head were verified. The full stack head 46d7c31 is now an ancestor of main at b5d5ef5. Marked Done. The separate tenant-index clarification remains tracked in PAR-495.

Workspace permission required to comment

Comments and reactions require workspace permission. Ask a workspace owner or admin for access. You can sign in to vote.