Repository navigation
fix(hooks): Drop advisory audit rows that repeat a recorded dedupe key - #19
Merged
Merged
Conversation
…e key Every installed dev plugin registers its own copy of these two hooks and all of them fire on the same event, so one tool call landed in audit.jsonl six times — twelve for subagent-stop, which fires twice per stop. A measured five-hour run produced 2,837 rows of which 2,265 (80%) were advisory duplicates, and every reader of the trail paid to parse them. metadata.dedupe_key was already present and already identical across all copies; nothing consulted it. Both header comments promise that the orchestrator's audit-dedup hook reconciles these rows, but no such hook exists. Reconcile at the point of writing instead: if the key is already in the tail of audit.jsonl, the advisory row adds nothing. The canonical orchestrator row is never suppressed — it is written by a different hook carrying no advisory flag and performing no such check. Distinct events are unaffected; only exact dedupe_key repeats are dropped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Every installed dev plugin registers its own copy of
hooks/audit-tooluse.shandhooks/audit-subagent.sh, and all of them fire on the same event. One tool call was recorded six times — twelve for subagent-stop, which fires twice per stop.Measured over one five-hour multi-platform run: 2,265 of 2,837 audit rows (80%) were advisory duplicates.
metadata.dedupe_keywas already present and identical across every copy, and nothing consulted it — both hooks' headers promise that "the orchestrator's audit-dedup hook" reconciles them, but no such hook exists.Found while stress-testing the corpflow pipeline across four platforms. Companion fixes: IGRSoft/corpflow#300.
Changes
audit.jsonlfor the row'sdedupe_keybefore appending, and drop the row if it is already recorded.CHANGELOG.md,MEMORY.mdandREADME.mdversion rows re-pointed atplugin.json(they had drifted a patch behind).Test plan
Verified against a scratch audit log, driving the real hooks with real payloads:
dedupe_key. No over-suppression.advisory=false) is present. The canonical row is never suppressed; worst case is 1 advisory + 1 canonical instead of 6.--self-testpasses on both hooks in all six plugins (12/12).bash -nclean on all modified hooks.Notes
A tail window (400 lines) rather than a whole-file scan: the duplicate copies fire within milliseconds of each other, so the key is always near the end, and a full-file grep would grow linearly with a log that reached ~2,800 rows in a single run.
This is a per-plugin reconciliation because it needs no cross-plugin coordination. If a central audit-dedup hook is ever added to corpflow — as the header comments assume — these checks become redundant but stay harmless.