feat(380): 注入前判定 preInjectGate——意见/立场记忆先判定后处置 - #381

sequenceDiagram
  participant Injector
  participant PreinjectGate
  participant callLLM
  participant AuditService
  Injector->>PreinjectGate: 应用查询的缓存判定
  PreinjectGate-->>Injector: 返回候选项
  Injector->>PreinjectGate: 渲染后异步预取
  PreinjectGate->>callLLM: 请求判定候选池
  callLLM-->>PreinjectGate: 返回标记 ID
  PreinjectGate->>AuditService: 写入判定审计

Merge Risk: 🔵 Low · up to a3b4d

The gate is off by default, so default behavior is unchanged. When enforcement is enabled, a filtered pinned memory can make the following normal memories be handled as pinned. Gate token usage is also counted under entity extraction in audit statistics. Fix both before enabling enforcement.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to a3b4d

Optional memory filtering can reuse outdated decisions and give ordinary memories treatment reserved for pinned entries. Ownership across reloads also remains uncertain. Both controls default off, limiting immediate exposure.

Retained concerns

• Medium · security · observed: Verdicts are cached solely by query text, and a successful cached query suppresses further classification. Memory content can change without changing its ID, and retrieval can produce different candidates for the same query. Enforcement therefore applies an old classification to current content and leaves newly selected IDs unclassified until eviction or recreation. Concurrent prefetches also lack coordination, allowing an older candidate snapshot to overwrite a newer result. This weakens the newly introduced filtering control beyond its intentional first-render fail-open behavior.
• Medium · security · observed: The gate can remove pinned entries without updating the original pinned count. Rendering then treats ordinary entries occupying those positions as pinned: they receive the larger content allowance and bypass the ordinary block budget. Rotation tracking also skips them using the stale count. Enabling enforcement can thus expand the injected content of a surviving ordinary memory and weaken existing content-containment rules. Candidate count, scope filtering, and the pinned content cap still constrain the effect.
• Medium · security · inferred: The newly introduced LLM adapter is module-global, while disposal clears only gate-local state. Startup with enforcement enabled but no current LLM service warns without resetting the adapter. If the same module survives unload and reapplication, a later gate can send its candidates through a previous lifecycle's captured LLM, routing selection, and audit service. The documented single-injector assumption limits simultaneous ownership concerns, but does not prove reset across reloads. Actual cross-context exposure remains conditional on host lifecycle behavior.

• Fix all pre-merge checks with AI

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Codecov Report

❌ Patch coverage is 92.72031% with 19 lines in your changes missing coverage. Please review.

📢 Thoughts on this report? Let us know!

关闭这条，#380 的实现收在 #382 一条线上。

#382 是这条的严格超集，#381 的差异基本是自身缺陷，不宜移植：

• 判分 prompt 不带 query——不知道「本次请求」是什么，就判不了「会不会向本次请求注入意见/立场」，协议不成立；preInjectGate 注入前判定：意见/立场记忆先判定后处置（#380，opt-in 默认关） #382 的 prompt 带查询且明写「先判相关性」。
• LIGHT_MODE_OFF 用点分键 + preset[key]=false 实际不生效，「lightMode 强制关」这条承诺不成立（preInjectGate 注入前判定：意见/立场记忆先判定后处置（#380，opt-in 默认关） #382 修了 applyLightModePreset 的点分键路径）。
• 过滤发生在 render 之前、记账在后 → pinnedStats.shown 前缀错位。
• CHANGELOG.md 的 standalone API：GET /context —— 把注入管线开放给第三方（#363 承诺） #370 条目前缀被吃掉。
• 无超时：判定挂起会一直挂着（preInjectGate 注入前判定：意见/立场记忆先判定后处置（#380，opt-in 默认关） #382 有超时 + 真取消 + 有界等待）。

#381 有、#382 当时缺、现已移植进 #382 的两点：判定生效就必有审计行（无模型路由时落 model_id:"unknown" 占位，不再因缺 modelId 整行不留）；disposed 护栏（dispose 后在飞判定不回写缓存）。见 #382 的 25e8944。

唯一需要拍板的设计分歧是 pin 池是否也受判：#381 让 pin 池（constraint / preference）也进判定，#382 按 #249「逐字保真」口径豁免，两版都没在 #380 里写死。当前口径取「豁免」（pin 是逐字保真槽，不受内容级过滤）；若日后要改成「pin 也受判」，建议做成独立开关并补回归，不必用这条 PR 承担。

分支 feat/380-preinject-gate 保留不删，需要时可随时重开——代码与这里的讨论都还在。