Skip to content

fix: gate retrieval-utility logging behind enabled config flag (#1480) - #1500

Merged
Lexus2016 merged 1 commit into
mainfrom
evolution/issue-1480-privacy-gate
Jul 29, 2026
Merged

fix: gate retrieval-utility logging behind enabled config flag (#1480)#1500
Lexus2016 merged 1 commit into
mainfrom
evolution/issue-1480-privacy-gate

Conversation

@Lexus2016

Copy link
Copy Markdown
Owner

Summary

The memory.retrieval_utility.enabled config flag defaults to False (opt-in), but _record_retrieval_utility and _record_retrieval_outcomes in MemoryManager ran unconditionally — writing a per-retrieval record to disk on every memory hit in every session despite the user never opting in.

This was identified in the PR #1483 code review but never fixed. PR #1485 attempted to fix it but is stuck in a conflicting/dirty state (834 additions, mergeable_state=dirty). This PR is the minimal standalone fix.

Changes

  • agent/memory_manager.py: Added _retrieval_utility_enabled() static method that reads memory.retrieval_utility.enabled via load_config_readonly(). Both _record_retrieval_utility and _record_retrieval_outcomes now early-return when the flag is False. When disabled, _pending_retrievals is also cleared to prevent stale accumulation.
  • tests/agent/test_memory_retrieval_utility.py: Existing test classes now mock _retrieval_utility_enabled to True (autouse fixture) so the logging path is still exercised. Added TestRetrievalUtilityGate with 3 new tests verifying the disabled path: no sidecar written, no pending retrievals accumulated, sync does not record outcomes.

Verification

  • ruff check ✓ (both files)
  • pytest tests/agent/test_memory_retrieval_utility.py ✓ (10/10 passed)
  • Diff: 99 insertions, 0 deletions (well under 200-line merge cap)

Design

The fix reads config lazily at call time via load_config_readonly() rather than passing a config reference into the MemoryManager constructor — this avoids changing the constructor signature (which would ripple through all callers in run_agent.py, cli.py, gateway, etc.). The try/except wrapper ensures a missing or corrupt config never breaks memory operations.

The memory.retrieval_utility.enabled config flag defaults to False
(opt-in), but _record_retrieval_utility and _record_retrieval_outcomes
in MemoryManager ran unconditionally — writing a per-retrieval record
to disk on every memory hit in every session despite the user never
opting in.

This adds a _retrieval_utility_enabled() check that reads the config
flag via load_config_readonly() and gates both methods. When disabled
(the default), no sidecar file is written and no pending retrievals
accumulate.

Identified in PR #1483 code review. Issue #1480 was closed as completed
but the privacy gate fix was never landed — PR #1485 is stuck in a
conflicting state. This is the minimal standalone fix.

Co-Authored-By: Hermes Evolution <evolution@hermes.ai>
@github-actions github-actions Bot added the fix Bug or fix label Jul 29, 2026
@Lexus2016
Lexus2016 merged commit d7158e1 into main Jul 29, 2026
37 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

fix Bug or fix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant