Skip to content

fix: isolate Chroma recall by user and session - #57

Merged
EvanProgramming merged 1 commit into
mainfrom
codex/issue-49-chroma-isolation
Sep 4, 2026
Merged

fix: isolate Chroma recall by user and session#57
EvanProgramming merged 1 commit into
mainfrom
codex/issue-49-chroma-isolation

Conversation

@EvanProgramming

@EvanProgramming EvanProgramming commented Sep 4, 2026

Copy link
Copy Markdown
Owner

Fixes #49

  • Add authenticated user and session scope to Chroma metadata and filters.
  • Join vector hits to scoped SQLite records by durable memory ID before returning data.
  • Keep file-index cleanup scoped to the owning user and workspace.
  • Add real Chroma and API regression tests for cross-user and cross-session leakage.

Validation:

  • tests.test_multi_party_memory passed with real Chroma 1.5.9.
  • make check passed.
  • make lint passed.
  • make test passed: 122 tests.
  • GPG-signed PR head verified by GitHub.

@EvanProgramming
EvanProgramming merged commit 83ec64e into main Sep 4, 2026
3 checks passed
@EvanProgramming
EvanProgramming deleted the codex/issue-49-chroma-isolation branch September 4, 2026 13:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

security: enforce user and session isolation in Chroma memory recall

1 participant

@EvanProgramming