Close the last X-User-Id gaps — completion notes
Date: 2026-07-09
Spec: specs/2026-07-09-identity-internal-embed-design.md
Plan: plans/2026-07-09-identity-internal-embed.md
Status: implemented, gated green, deployed + observatory-verified
(commit 8320dcd).
Report back (per the prompt)
Gap 1 — internal staff chat: already closed (verified, no code change)
The 66 blank internal/chat rows are historical: all use the pre-nonce
${uuid}-t0 trace format and stop at 2026-07-08 08:50 — before e12ae68's
dash-proxy X-User-Id injection deployed (~09:43). The internal-agent registers
only [dash, reasoning_dash] (one data agent); its only engine=ahu-chatbot,
surface=internal egress is that agent via the identity-injecting dash-proxy
(fixed by e12ae68) + the eval worker (fixed by 0ce6a72). There is no second
"guidance" agent and no internal-web → gateway direct LLM path. Live re-check
after this deploy: a staff data-agent turn produced 2 internal/chat events,
both staff-<hmac>, 0 blank.
Gap 2 — embeddings: split by call-path
| Path | Actor now | How |
|---|---|---|
query-time search_knowledge_base / save_query (in a run) |
the run's actor | already inherited via user_id_var (RequestIdMiddleware) — no change |
admin console knowledge writes (admin/knowledge/{tables,business,content,seed-templates}) |
the admin (opaqueStaffId) |
the 4 routes now forward X-User-Id to the agent (they already had the verified session) |
offline dash/scripts/load_knowledge.py |
system:reingest |
new SYSTEM_REINGEST_ACTOR + seed_reingest_actor() in dash/gateway.py, called before its inserts |
reload-schema rebuilds only text context (no embed); the agent doesn't embed at
boot — so load_knowledge is the sole offline embed path.
- Staff id = the existing
actor-id.tsHMAC, not a new source (server-derived
from the verified staff JWT; non-PII). - Query-time-vs-reingest split: query-time = in-run knowledge search (rare —
the agent prefers preloaded context); reingest = the load script. Admin writes
are human-triggered → attributed to the admin, notsystem:reingest.
Verification (live, this deploy)
- Admin knowledge write (
POST /api/admin/knowledge/business) → embed event
operation=embed, surface=internal, user_id=staff-604287292ba92ba0(the admin
HMAC). ✅ python -m dash.scripts.load_knowledge(inahu-ai-agent-internal) → 8
system:reingestembed events. ✅- Refreshed table (last 15 min):
| surface | operation | actor | count |
|---|---|---|---|
| internal | chat | staff-id | 2 |
| internal | embed | system:reingest | 8 |
| internal | embed | staff-id | 1 |
No blank. embed splits into batch (system:reingest) + real-actor (admin
write); chat is staff-id — exactly the acceptance shape. No PII in any
X-User-Id (opaque HMAC / system:reingest).
Deploy
Additive X-* only. Rebuilt ahu-ai-chatbot-internal + both agent images
(8320dcd); recreated ahu-internal, ahu-workers, ahu-public. In-image
agent pytest green (internal 63 / public 42). Removed the one test knowledge
entry created during verification.