@mindrian_os/cli 2.0.0-beta.15 → 2.0.0-beta.19

package/CHANGELOG.md

@@ -1,3 +1,222 @@
+## [2.0.0-beta.19] - 2026-09-04
+
+### Changed
+- **The flip.** `lib/core/brain-client.cjs` line 24's default origin moves from the incumbent
+  Brain to `https://theo-mcp.onrender.com`, a BARE origin (no path, no trailing slash). For a
+  user: Larry's methodology now comes from Theo, and nothing about how you use MindrianOS
+  changes. Rollback stays one line: revert line 24 in a patch release, or set
+  `MINDRIAN_BRAIN_URL` on one install. Both paths are valid only while the previous service is
+  still running. The previous service is SUSPENDED after a soak window, never deleted, compute
+  suspended before data.
+- Doctor's class M layer 6 store-identity check is now complete across both cuts. The
+  dual-shape `brain_stats` read shipped in the PREP cut (safe against both Brains). This cut
+  moves the two values that had to move WITH the origin: the canon endpoint (`CANON_BRAIN_URL`)
+  and the per-origin node floor (`CANON_NODE_FLOOR = 29000` for the incumbent,
+  `THEO_NODE_FLOOR = 1000` for Theo). The floor keys on the resolved origin, so a
+  `MINDRIAN_BRAIN_URL` rollback restores the incumbent's floor in the same motion.
+- The `test-245` tripwire (`tests/test-245-skill-frontmatter-inert-keys.cjs`) and `CLAUDE.md`
+  moved together with line 24, in the same commit, per the pairing that tripwire exists to
+  enforce.
+
+### Known, expected behavior after the flip
+- `/mos:leadership` and due-diligence consults answer thinner through Theo until the 30
+  uncovered names are ingested (Theo holds the `/mos:leadership` command node with zero
+  framework links); this is an honest-empty coverage block, not an error. Covered: 228 of 258,
+  88.4%. Uncovered: 30 of 258. The 30 names bind Theo's decommission task, not this flip.
+- `brain_write` always refuses with `WRITE_PATH_DISABLED`: canon writes go through Theo's own
+  governed payload path, and this is not a tier a better key opens.
+- A count-store query plan may draw `PLAN_REJECTED`; answer it by adding a property filter, not
+  by concluding the tool is broken.
+- `scripts/probe-brain-contract.cjs` legs invert as expected, documented not broken: legs a and
+  d port cleanly; leg b inverts because Theo SERVES `text2cypher` (the expected 403 does not
+  arrive) and `brain_ask_anything` still draws an unknown-tool error, but for a different reason
+  (Theo has no allowlist gate at all); leg c partially inverts because `BoundedReadRefusal` is
+  incumbent-authored text while Theo's refusals are typed codes; leg e inverts entirely because
+  it asserts Memgraph index names Theo's Aura instance does not have.
+- The enrichment queue will capture on nearly every `orchestration_readiness` call during soak.
+  That is canon thinness correctly measured, bounded and deduped by framework name, not a leak.
+
+## [2.0.0-beta.17] - 2026-09-04
+
+### Added
+- `scripts/check-tool-honesty.cjs`: a standing, advisory MCP tool-honesty gate that
+  statically scans every `server.tool()` registration and command branch across
+  `lib/mcp/tool-router.cjs`, `lib/mcp/tools/*.cjs` and `lib/mcp/contract-version.cjs`
+  for a description-vs-behavior mismatch (a tool description claiming it writes/files/
+  persists something its handler never actually reaches a write primitive for) - the
+  broader sweep `.planning/debug/meeting-file-meeting-false-success.md`'s Non-Code
+  Follow-ups section named as unscoped work once the `meeting` tool itself was fixed
+  (quick 260903-kwl). Wired advisory (`--check` WARNs and exits 0, `--strict` restores
+  hard-fail, `--report` prints the full per-branch table) at pre-commit (path-scoped to
+  the MCP tool surface), `doctor --acceptance` (new `tool-honesty` coverage-gate entry),
+  and `release.sh` (outside the SHAPE-GATE sentinel pair) - the same advisory-on-
+  introduction posture `check-shape-declaration.cjs` established at Phase 210. First live
+  run against the current tree (36 tools, 130 command branches scanned): 1 HIGH RISK
+  finding, 8 MEDIUM, 1 UNKNOWN, 0 fixed by this change. Every finding is untriaged;
+  human review is the named next step before any finding is fixed or the gate is
+  hardened to `--strict`.
+
+### Fixed
+- The `meeting` MCP tool's `file-meeting` command returned a completion-shaped response
+  ("## File Meeting", room state, a filing-protocol section, the echoed transcript, a
+  "Meeting filed" footer) while writing nothing - no `writeClaimNode`, no `artifact_file`
+  call, no room.db mutation anywhere in the handler. Worse, the one thing the branch did
+  try to do (hand back `references/meeting/filing-protocol.md`) also returned nothing
+  usable, because that reference file did not exist on disk and the branch silently
+  dropped the section on a missed read. Fixed: an honest tool description naming
+  `artifact_file` as the real write path and `/mos:file-meeting` as the fuller CLI path;
+  a leading, machine-checkable `**filed: false**` marker on all three meeting branches
+  (`file-meeting`, `pipeline`, `speakers`); an explicit missing-reference signal instead
+  of silent omission; and a real `references/meeting/filing-protocol.md` carrying the
+  Phase 150.8 Claimify four-pass protocol in surface-neutral form, pinned by
+  `tests/test-kwl-meeting-mcp-honesty.cjs` (registered in `tests/run-all-266.sh`).
+  What did NOT change: the MCP surface still does not call `writeClaimNode` itself, and
+  the Tri-Polar parity gap this defect surfaced - the CLI (`/mos:file-meeting`) has had
+  real DIKW-typed meeting filing since 2026-06-12, Desktop and Cowork never have - remains
+  open, tracked in `.planning/debug/meeting-file-meeting-false-success.md`.
+- Bare `scripts/<name>` invocations (`bash scripts/foo`, `node scripts/foo.cjs`) are now
+  anchored with `CLAUDE_PLUGIN_ROOT` (or the fail-closed `MINDRIAN_OS_ROOT` form for
+  hand-authored skills), so a Bash tool invocation resolves against the plugin install
+  directory instead of the user's own session cwd. The real security finding, not just a
+  reliability improvement: a bare invocation previously executed whatever file happened to
+  exist at that relative path inside the user's own Data Room -- a local code-execution
+  shadowing vector, not only a portability bug, since a same-named file at `scripts/<name>`
+  in a user's room would silently substitute for the plugin's own script. Phase 274 (the
+  sibling of Phase 271's `references/` citation fix, and the fourth pass at this disease
+  class in this repo): 30 command-surface sites, 3 hand-authored skill sites, and 1 agent
+  site anchored; a fresh full-tree scan confirms zero unanchored sites remain (`sites=156
+  anchored=154 allowlisted=2 violations=0`, script tier). `scripts/verify-release` gains
+  gate 10f, cloning gate 10c's exact fail-closed shape, so this class cannot silently
+  return in a future command.
+- **MCP tool honesty, close of the triage phase (Phase 276).** The `check-tool-honesty.cjs`
+  gate's own `switch (command)` branch splitter was dead code (a masked-text regex
+  swallowed every case label), so `room_state`/`room_content`/`room_graph` were graded
+  against their whole handler body instead of per command; fixing the one-line bug took the
+  live sweep from 10 findings to a corrected 24 (5 HIGH RISK, 18 MEDIUM, 1 UNKNOWN) with
+  discovery totals unchanged (36 tools / 130 branches both before and after). Every one of
+  those 24 now carries a written disposition in a checked-in ledger a test diffs against the
+  live scan in both directions; global HIGH RISK is 0. Corrected the `orchestration`,
+  `export`, `room_content`, `gate_render` and `graph_write` descriptions so none claims a
+  write, a render, or a persisted mint its handler cannot perform, and removed every false
+  completion assertion ("Snapshot generated", "Dashboard generated", "Export complete",
+  "Scout intelligence gathered"). Propagated the Node >=22.16.0 busy-timeout option to every
+  room.db (and sibling-db) opener that can genuinely contend (proven under a held write lock:
+  elapsed time moved from ~0.3ms instant failure to a genuine ~5s bounded wait), and
+  `spine-events.cjs` now reports typed `room_db_busy`/`room_db_broken` reasons instead of
+  claiming there is no database about one it just proved exists. Shipped a new `claim_write`
+  MCP tool (the first Desktop/Cowork-reachable real DIKW claim write) and wired the `meeting`
+  tool's `file-meeting` command through the governed `gate_render`/`gate_answer` confirmation
+  gate, with promotion to `confirmed` proven against `room.db` independently of the tool's own
+  response text. Full record: `.planning/phases/276-mcp-tool-honesty-triage-and-close-the-
+  check-tool-honesty-cjs/`.
+- **The phase's one true silent failure: a Theo readiness miss vanishing with nothing written
+  anywhere (Phase 339, plan 339-05, D-03 consumer 3).** `lib/core/enrichment-queue.cjs`'s
+  `captureReadinessMiss` gains two additive capture arms recognizing Theo's own
+  `orchestration_readiness` payload shapes, a scored RESOLVED miss and a REFUSAL miss, each
+  guarded so an incumbent-shaped payload cannot reach either new branch;
+  `tests/test-339-enrichment-theo-shapes.cjs` went from 3 of 7 fixtures green to 7 of 7.
+  Operational expectation for the soak window, named so nobody reads it as a leak: post-flip
+  nearly every `orchestration_readiness` call will capture, because Theo's own header reports
+  148 of 149 Frameworks with zero technique linkage, the queue is bounded (`SOFT_CAP`/
+  `HARD_CAP`) and deduped by framework name, and that is canon thinness correctly measured,
+  not a defect. What did NOT change: the incumbent's own two capture shapes (`grounded`,
+  `readiness_score`) are untouched, proven by `tests/test-249-enrichment-queue.cjs` staying
+  13 of 13 green.
+
+### Changed
+- **RS pipeline spine-wiring + expert-graph reconciliation (Phase 296, SEED-030).** `lib/core/rs_cache.py`'s remote `rs-external` Pinecone index/namespace path (one namespace per topic, 1024-dim `multilingual-e5-large` integrated embeddings) is retired and replaced by a per-room local sidecar cache at `<room>/research/<topic-slug>/.rs-signal-cache/{vectors.jsonl,manifest.json}`, embedded through the one shipped local encoder (`embedding-spine.cjs::embedTexts`) via the new `scripts/rs-vector-bridge.cjs` JSON-stdio bridge (the D-02 answer). `scripts/rs-engine.py` Mode B/C, `lib/core/rs_hybrid.py`, `lib/core/rs-pinecone-bridge.cjs` and `lib/core/rs-differential-scorer.cjs` all thread an explicit room scope end to end.
+  - **SEED-029 F8 consequence:** the signal corpus is now per room, so a topic cached in one room is never served into another. This is a real Cowork behavior change, named rather than buried: two rooms working the same topic now each fetch and embed once, independently, rather than sharing one cache entry -- a real duplicated-work cost paid to close a cross-room data-bleed bug.
+  - **Dimensional consequence:** the external/hybrid corpus now lives in the same 384-dimensional local encoder space as every other vector in the room, so the 384-vs-1024-dim mixed-space cosine hazard documented in `scripts/rs-engine.py` and `lib/core/rs-engine.cjs` is removed by construction rather than guarded at runtime (`tests/296-dim-invariant.sh` now asserts, no longer SKIPs).
+  - **`rs-experts` degrade split:** the old Tier-0 message conflated three distinct causes (no transport ships / transport unreachable / topic genuinely has zero experts) into one hand-rolled string, with the third case -- a correct answer -- mis-dressed as a fault. Now routes through the already-shipped `lib/core/refusal-messaging.cjs` (`REFUSAL_KINDS.unreachable`), producing three pairwise-distinguishable outcomes; a genuinely empty expert list renders as a success, not a refusal.
+  - **Deliberately NOT done, and why:** `PINECONE_API_KEY` and the `pinecone` package stay (D-06) -- still load-bearing for `scripts/compute-hsi.py` Tier 2 and `lib/core/pinecone-inference.cjs` (Phase 272, out of scope here); `scripts/auto-explore-fire.cjs`'s direct `rs-engine.py --mode hybrid` spawn was not moved onto the `rs-backend-dispatch.cjs` chokepoint, only named in source and fenced by an argv-contract test (Phase 272-10 remains its own open item); `scripts/rs-engine.py` and `lib/core/rs_corpus.py` stay Python (D-04, Phase 283 is the eventual home for eliminating that runtime).
+  - **Three corrected premises**, recorded so the record is not lost: `embedding-spine.cjs` never wrote to `room.db` (F-1, `vector-store.cjs` owns persistence); RS internal and cross-room modes were already Pinecone-free before this phase (F-3); `rs-experts` has had no remote Brain-Cypher coupling since 2026-05-22 (F-6) -- the seed's original Option A/B Aura framing did not apply.
+  - **Phase 228** is this same seed's orphaned earlier registration in the closed v1.15.0 milestone (directory holds only a `.gitkeep`, no CONTEXT/RESEARCH/PLAN/SUMMARY ever landed); Phase 296 is its live successor in v2.1.0.
+  - `tests/296-pinecone-residue.sh` is the two-sided boundary gate for this change: it asserts PRESENCE of the surfaces D-06 kept (`requirements-hsi.txt`'s `pinecone` declaration, `compute-hsi.py`'s `PINECONE_API_KEY` read, `pinecone-inference.cjs`'s `api.pinecone.io` egress) and ABSENCE of the retired surface, since an over-eager cleanup silently breaking `compute-hsi.py` Tier 2 was judged the likelier failure mode here, not a missed removal.
+- **Usher-division doctrine corrected (navigator-directed, 2026-08-28).** `skills/larry-personality/SKILL.md`'s Hierarchical Navigator section previously divided authority by step ownership: the tool owned Usher steps 1-2, the human owned steps 3-4, and Larry "NEVER crosses into step 3." Product evidence falsified that rule -- in December 2025 Mindrian produced a non-obvious cross-framework synthesis (how McKinsey's Seven Steps, Usher's own cumulative-synthesis model, and Abbie's three pathways relate) that the navigator had not already seen, which the old text would have forbidden it from ever producing. The division is now per-step and shared at generation: step 1 either party may surface an incomplete pattern; step 2 is Mindrian's strongest lane; step 3 either the human or Mindrian may generate a candidate synthesis; **step 4 the navigator retains final authority**, with Mindrian helping challenge, test and refine. Human-in-Command is preserved and made more explicit, not weakened -- only the flat step-3 prohibition changed. The navigator's framing: "Insight generation is not insight authority." New pull-quote replaces the old Aronhime line: "Mindrian may propose the leap. The navigator decides whether the leap is real." `tests/test-posture-ids-drift.cjs` re-pinned to the new quote in the same commit; its exactly-three posture-id assertion (`push_forward` / `hold` / `pull_back`) and the "restraint is the product working correctly" pin are byte-untouched, since this correction concerns the step-3 authority split and not the posture-dial mechanism. The Phase 141 CHANGELOG entry that records the original doctrine is deliberately left as-is; history is not retconned.
+- **The Brain problem-type alias table is now origin-selected (Phase 339, plan 339-04,
+  FLIP-02, D-03 consumer 1).** `lib/core/brain-client.cjs`'s single
+  `BRAIN_PROBLEM_TYPE_ALIASES` table is replaced by two frozen tables,
+  `BRAIN_PROBLEM_TYPE_ALIASES_INCUMBENT` and `BRAIN_PROBLEM_TYPE_ALIASES_THEO`, selected by
+  a new `_brainProblemTypeAliases()` function reading the resolved origin against a new
+  exported `THEO_ORIGINS` set, so a future `MINDRIAN_BRAIN_URL` change moves vocabulary and
+  URL together instead of the two drifting apart. What did NOT change: today's wire traffic
+  is byte-identical, because the incumbent origin still selects the incumbent table
+  (`tests/test-254-normalize-roundtrip-probe.cjs` Arms 4-5 green).
+- **The `brain_schema` memo is now keyed by origin, as defense in depth (Phase 339, plan
+  339-04, FLIP-05, D-13 as corrected).** The original D-13 ask was a flush mechanism;
+  research corrected the premise, recorded here plainly: no flush exists to perform, because
+  `BRAIN_URL` is a module-scope const resolved once at require time and the memo is
+  process-local, so no running process can ever observe an origin change during its own
+  lifetime. The origin-keyed guard ships anyway, becoming load-bearing the day anything
+  makes the origin mutable per process. What did NOT change: the 30-minute cache TTL and
+  the existing sentinel guard are untouched; `tests/test-339-schema-memo-origin-keyed.cjs`
+  (all 7 arms) is green.
+- **A fourth silent-degrade consumer, now disclosed rather than shipped unnamed (Phase 339,
+  plan 339-05, D-03b).** `lib/mcp/brain-router.cjs`'s Tier-3 `brainRoute()` previously fell
+  back to the Tier-2 local heuristic with no trace whenever a Brain response arrived without
+  a usable `next_gate`. `recommend()` now attaches an additive `brain_router_note:
+  'answered_no_next_gate'` field when that happens, carried through a module-scope variable
+  that never changes `brainRoute()`'s own return contract. What did NOT change: an
+  incumbent-shaped payload with `next_gate` present produces a byte-identical return object,
+  with no new field.
+- **The update path is now named in the `unreachable` and `no_key` refusal copy, from a
+  single frozen source (Phase 339, plan 339-06, FLIP-04, D-08).** `lib/core/update-path.cjs`
+  is the one place the two-command update path (`/plugin marketplace update`, then
+  `claude plugin update mos@mindrian-marketplace`) is spelled out; both refusal shapes in
+  `lib/core/refusal-messaging.cjs` now name it, and `unreachable`'s old bare-retry promise is
+  replaced with copy that does not promise what a suspended origin cannot deliver. The
+  honest limit, carried verbatim from this plan's own code comment: "This copy ships in
+  bytes. An install that has not updated prints the OLD string, because a main commit is not
+  live until released AND picked up. This change is the durable fix for the next origin move
+  and for honesty; the levers that reach today's stale population are the soak window and
+  the tester note."
+- **The origin literal sweep (Phase 339, plan 339-07, FLIP-01, D-12).**
+  `scripts/probe-brain-contract.cjs` and `scripts/build-brain-census.cjs`, the two remaining
+  runtime sites that declared their own Brain origin literal, now resolve it through
+  `getBrainUrl()` like every other call site; `tests/test-339-origin-single-source.cjs` is
+  fully green (0 violations, was 6). The generated census artifacts
+  (`data/brain-census.generated.json`, `docs/BRAIN-GRAPH-CENSUS.generated.md`) are left
+  unchanged, for three recorded reasons: the generator carries no `--check` release gate by
+  design, because a release gate must never depend on live network; Lane B requires an
+  operator-supplied admin key and Theo has none, so `brain_write` refuses unconditionally;
+  and re-running Lane A against Theo today would silently discard the census record the
+  2026-08 phases were measured against, replacing a census of the incumbent's 29,200-node
+  graph with one of Theo's own (measured live at 1,253 nodes). Re-census against Theo is
+  registered as a deferred item, not addressed by any plan in this phase.
+- **Desktop and Cowork connector docs now point at Theo (Phase 339, plan 339-08, FLIP-06,
+  D-09).** Six hand-authored sources and their generated mirrors now name
+  `https://theo-mcp.onrender.com/mcp`, WITH the `/mcp` path, as the connector URL, under the
+  unchanged connector key `mindrian-brain`, with the `Authorization` header dropped, because
+  Theo returns byte-identical payloads for a real key, a garbage key, and no header at all.
+  What did NOT change: `BRAIN_TOOL_MATCHER` and `hooks/hooks.json` were not touched.
+- **The reciprocal cross-repo record and the 269-05 readiness-gate rewrite (Phase 339, plan
+  339-09, FLIP-07, FLIP-08, D-10, D-14).** `docs/339-NOTE-theo-desktop-connector-key.md` now
+  exists at the path Theo's own shipped README already cites, naming `mindrian-brain` as the
+  sole prescribed connector key; a third alternation token for `BRAIN_TOOL_MATCHER` was
+  deliberately not added. Phase 269-05's Task 1 checklist, which read PASS from facts that
+  were never in question, is rewritten to three legs sourced from live, dated Theo records;
+  the three retired items are kept in place with a dated reason rather than deleted.
+
+**The flip-day content fact, verbatim from Session T (D-06a):** `/mos:leadership` and
+due-diligence consults answer thinner through Theo until the 30 names are ingested (Theo
+holds the `/mos:leadership` command node with zero framework links); this is an
+honest-empty coverage block, not an error. The 30 uncovered names bind Theo's own
+decommission task, NOT this flip, per the coverage ruling. The named-Frameworks ratio is
+RETIRED as a coverage measure: coverage is a set question, `Covered: 228 of 258, 88.4%`,
+`Uncovered: 30 of 258`.
+
+**What this release does NOT reach.** Two populations are unreachable by any release code
+can touch. Every install that has not run the two-command update prints the OLD refusal
+copy, because a main commit is not live until released AND picked up. Every hand-registered
+Claude Desktop or Cowork connector lives in a config file that is not in any git repo.
+Neither is reachable by code; the soak window and the tester note (`docs/testers/outbox/
+2026-09-03-theo-cutover.md`) are the only levers that reach them.
+
+Also worth naming so nobody compresses it: decommission of the incumbent Brain waits for the
+soak window; the incumbent is SUSPENDED and never deleted; the two Render services are
+stopped compute-before-data (`pws-brain-mcp` then `pws-brain-db`); and the per-install
+`MINDRIAN_BRAIN_URL` rollback lever is valid ONLY while the incumbent still runs.
+
 ## [2.0.0-beta.15] - 2026-08-28
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindrian_os/cli",
-  "version": "2.0.0-beta.15",
+  "version": "2.0.0-beta.19",
   "description": "Install MindrianOS into Claude Code with one command -- `npx @mindrian_os/cli`. Ships the MindrianOS plugin (Larry + PWS methodology + Data Room) plus a setup/diagnostics CLI (install/doctor/update).",
   "scripts": {
     "mcp": "node bin/mindrian-mcp-server.cjs",