CortexDB 0.9.7
Two data-integrity fixes in the deletion path, and the JSON-attachment fix that unblocks connector uploads.
forget now honours the cascade you send. The scope-wide pass ignored
cascade and always ran a raw-event purge. So cascade: "derived_only" —
which by definition keeps raw events — stripped your event documents out of
the search indexes anyway, and reported deleted.events: N for events it had
not removed from the store. It both destroyed more than you asked for and
misreported what it did. A derived-only forget now leaves raw events intact
and recallable, and no longer counts them as deleted.
Deleted records no longer stay fetchable by id. GET /v1/events/{id}
checked only the per-event redaction mark, which only cascade: "redact_events" sets. When a forget suppressed a scope by tombstone instead,
that mark stayed clear — so /v1/recall and /v1/events correctly hid the
record while the by-id endpoint served it. /v1/facts/{id} had no such check
at all. Both now return 404, matching the listing paths.
If you rely on /v1/forget for data-subject deletion, upgrade. The audit
trail was accurate about the request but not about the outcome.
POST /v1/blobs accepts application/json. A guard meant to reject
multipart wrappers rejected the whole application/json MIME, silently
dropping every JSON attachment connectors tried to ingest — the one type the
extraction pipeline supported end to end. Only unambiguous multipart is
rejected now.
/v1/admin/ready,/v1/blobs,/v1/derivation/statusand the/v1/auth/*routes are described in the served OpenAPI document, with schemas. 42 of 117/v1routes are now documented, up from 31, and CI fails on new drift or a dangling schema reference.- The
wait=consolidatedlatency guidance was wrong: that stage blocks on an out-of-process LLM call, so its published ~500-3000ms band was not achievable. Documented as provider-bound; usewait=indexedwhen you need a bounded acknowledgement.
Drop-in. No API, schema or configuration changes.