Building cachly (MCP): your coding agent remembers your codebase and every decision made — not just the chat. Follows you between editors, stays when someone leaves. I post what I learn shipping it.
"Persistence is not permission" belongs on the short list of sentences that settle design reviews - and the most impressive artifact in this post isn't the gate, it's the TEST: asserting the session and turn queries were never even awaited when the toggle is off. Most fail-closed claims are checked by looking at the response; yours is checked by proving the protected reads never ran. That's a negative control in its purest form, and it's rare.
Full disclosure before the rest: I build a memory layer for coding agents, and your article just cost me an audit. Our recalls are your replays - lessons written under one visibility scope, retrievable months later. Reading your write-time/read-time table, I could not answer with certainty whether OUR read path re-checks visibility at recall time in every branch, including the subtle one: a supersession banner that names a successor lesson - does it check the successor's visibility for the CALLER before naming it? That question is now a card on our board, with your not-awaited test as the acceptance standard. I'll come back with what we find, including if it's embarrassing.
On your open question - cards or the whole turn: I'd defend your line, with one refinement. The boundary isn't "text vs cards", it's "delivered speech vs derived artifact" - and text that VERBATIM quotes a document is a card wearing prose. Where provenance is segmentable, redaction should follow it per segment; where it isn't (paraphrase), keeping the words is defensible because they were already delivered - but I'd stamp the replayed turn with "generated under an entitlement no longer granted" rather than silently replaying it. Provenance footnote instead of redaction: the record stays honest without becoming a leak.
One small probe on the 404 posture: uniform status is necessary but not sufficient - is the TIMING uniform too? An entitlement-denied 404 that returns in 2ms next to a real lookup 404 at 40ms confirms existence through the side channel. You flagged latency as unmeasured; that's the measurement I'd do first.
"Delivered speech vs derived artifact" is the line I should have drawn, and it's closer to where we landed than my original one. Since the post, the transcript replays turns as they were shown, cards included; a revoked capability now governs the next turn, not the record (note at the top).
That makes your provenance stamp more relevant, not less. If the record replays as seen, the honest version tells the reader the capability behind it is no longer granted, and the replay response carries no field for that today. "A card wearing prose" is the right name for the verbatim-quote case, too.
On timing: the existence oracle you're worried about is unknown-vs-foreign session id, and both go through the same owner-scoped lookup (session id, tenant and user in one WHERE), so same query, same plan. Malformed ids short-circuit before any query, but a malformed id reveals nothing about existence. Entitlement denial left the 404 bucket entirely: it's a typed 403 now, the same answer the turn gate gives, and it only tells a caller something about their own org. I still haven't put a number on any of it, and you're right that it's the first measurement to run.
Do come back with the supersession-banner result. That kind of leak never shows up in a response-shape test, which is the whole case for not-awaited assertions
For further actions, you may consider blocking this person and/or reporting abuse
We're a place where coders share, stay up-to-date and grow their careers.
"Persistence is not permission" belongs on the short list of sentences that settle design reviews - and the most impressive artifact in this post isn't the gate, it's the TEST: asserting the session and turn queries were never even awaited when the toggle is off. Most fail-closed claims are checked by looking at the response; yours is checked by proving the protected reads never ran. That's a negative control in its purest form, and it's rare.
Full disclosure before the rest: I build a memory layer for coding agents, and your article just cost me an audit. Our recalls are your replays - lessons written under one visibility scope, retrievable months later. Reading your write-time/read-time table, I could not answer with certainty whether OUR read path re-checks visibility at recall time in every branch, including the subtle one: a supersession banner that names a successor lesson - does it check the successor's visibility for the CALLER before naming it? That question is now a card on our board, with your not-awaited test as the acceptance standard. I'll come back with what we find, including if it's embarrassing.
On your open question - cards or the whole turn: I'd defend your line, with one refinement. The boundary isn't "text vs cards", it's "delivered speech vs derived artifact" - and text that VERBATIM quotes a document is a card wearing prose. Where provenance is segmentable, redaction should follow it per segment; where it isn't (paraphrase), keeping the words is defensible because they were already delivered - but I'd stamp the replayed turn with "generated under an entitlement no longer granted" rather than silently replaying it. Provenance footnote instead of redaction: the record stays honest without becoming a leak.
One small probe on the 404 posture: uniform status is necessary but not sufficient - is the TIMING uniform too? An entitlement-denied 404 that returns in 2ms next to a real lookup 404 at 40ms confirms existence through the side channel. You flagged latency as unmeasured; that's the measurement I'd do first.
"Delivered speech vs derived artifact" is the line I should have drawn, and it's closer to where we landed than my original one. Since the post, the transcript replays turns as they were shown, cards included; a revoked capability now governs the next turn, not the record (note at the top).
That makes your provenance stamp more relevant, not less. If the record replays as seen, the honest version tells the reader the capability behind it is no longer granted, and the replay response carries no field for that today. "A card wearing prose" is the right name for the verbatim-quote case, too.
On timing: the existence oracle you're worried about is unknown-vs-foreign session id, and both go through the same owner-scoped lookup (session id, tenant and user in one WHERE), so same query, same plan. Malformed ids short-circuit before any query, but a malformed id reveals nothing about existence. Entitlement denial left the 404 bucket entirely: it's a typed 403 now, the same answer the turn gate gives, and it only tells a caller something about their own org. I still haven't put a number on any of it, and you're right that it's the first measurement to run.
Do come back with the supersession-banner result. That kind of leak never shows up in a response-shape test, which is the whole case for not-awaited assertions