@mindrian_os/cli 2.0.0-beta.31 → 2.0.0-beta.35

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mos",
   "description": "MindrianOS -- Your AI innovation co-founder. Larry thinks with you through PWS methodology, builds your Data Room as you explore, and chains frameworks intelligently. Install and go.",
-  "version": "2.0.0-beta.31",
+  "version": "2.0.0-beta.35",
   "author": {
     "name": "Jonathan Sagir",
     "url": "https://mindrian-os.com"

package/CHANGELOG.md

@@ -1,3 +1,89 @@
+## [2.0.0-beta.35] - 2026-09-11
+
+### Added - doctor sees the Tier 0 shadow, Theo's node floor stops rubber-stamping (quick task 260911-axz)
+
+- `node scripts/doctor.cjs --brain-smoke` grows a new layer 0 (`origin_shadow`), ahead of the
+  existing 6-layer probe, closing the exact blind spot a live install hit: on 2026-09-11 a
+  beta.33 install ran Larry at Tier 0 for an entire session because a user-scope
+  `~/.claude.json` `mindrian-brain` entry (type `http`, stale `Authorization` header) shadowed
+  the plugin's own `.mcp.json` stdio shim of the same name and returned HTTP 503. Doctor did not
+  detect it, because the smoke probe runs IN PROCESS through `lib/core/brain-client.cjs`, which
+  resolves to Theo, so every other layer passed. Layer 0 reports, in one row: the resolved Brain
+  origin, whether it is Theo, whether `MINDRIAN_BRAIN_URL` overrode it, Theo's live `mode` and
+  `build_stamp.sha`, and (when present) the exact scope, host, and `claude mcp remove
+  mindrian-brain -s <scope>` fix line for a shadowing connector. It never prints an
+  `Authorization` value or any other header value, and it never short-circuits layers 1-6: a
+  shadow finding is reported alongside their own verdicts, not instead of them.
+- `THEO_NODE_FLOOR` (`lib/core/doctor/class-m-brain-smoke.cjs`) moved from `1000` to `27000`,
+  a 3.4 percent margin under the 27,951 nodes measured live on 2026-09-11. The old floor would
+  have passed a 96 percent content loss without a single not-ok row. `CANON_NODE_FLOOR` (29000,
+  for a rolled-back origin) is unchanged.
+- `data/brain-census.generated.json` and `docs/BRAIN-GRAPH-CENSUS.generated.md` regenerated
+  against the live Theo origin (`https://theo-mcp.onrender.com`), naming the origin and the
+  2026-09-11 run date in the document's own prose. The incumbent census lane still renders
+  byte-identically from the pre-existing incumbent data.
+
+### Changed - Larry's chain leads with a runnable framework, and a cold Theo stops losing the race (quick task 260911-ddd)
+
+- `brain_ask` through the plugin now orders `next_gate.options` command-bearing first: frameworks that
+  at least one `/mos:` command declares come before frameworks that none does, with Theo's own order
+  kept inside each group. Every option carries `theo_rank` (the step Theo returned) and the envelope's
+  `grounding.option_order` reads `command_bearing_first`, so Theo's ranking is reconstructible from the
+  envelope. On the IllDefined chain this puts Red Teaming (`challenge-assumptions`) ahead of Design
+  Thinking, which no command declares; the count of command-less options does not change, only the
+  order. `/mos:act`'s routed confidence now describes the option actually surfaced.
+- The Brain MCP shim fires one content-free `theo_health` probe, detached, when it starts, so the
+  hosted origin is awake before the first real question on every surface (the shim loads on CLI,
+  Desktop and Cowork alike); the CLI `session-start` hook fires the same probe. The probe writes only
+  `{at, ok, origin_host}` to `~/.mindrian/brain-prewarm.json`, never a response body, and nothing on
+  the MCP channel.
+- `/mos:act`'s Tier 3 Brain race bound moved from a frozen 2000 ms literal to one constant,
+  `lib/mcp/brain-route-bound.cjs`, default 6000 ms (the measured 2.034 s cold wake plus two warm
+  follow-on calls, since `ask()` now makes three Theo calls per question), overridable with
+  `MINDRIAN_BRAIN_ROUTE_TIMEOUT_MS`; the composition census reads the same constant. The local
+  heuristic is still computed before the race, so a genuinely down Theo still answers at once.
+
+### Changed
+
+- `docs/339-NOTE-theo-desktop-connector-key.md` gains a new Section 9 scoping the keep-the-name
+  Desktop/Cowork connector advice away from Claude Code: the plugin already provides
+  `mindrian-brain` there through its own stdio shim, so a user-level twin of the same name
+  shadows rather than complements it.
+- `.planning/seeds/SEED-082-bidirectional-command-framework-sync-drift-detection.md` moved to
+  `status: triggered`, carrying the 21-beta command-registry version skew, the zero-Sensor /
+  84-Reach projection gap, the 9-methodology-command framework sync gap, and the Sensor
+  claim-side-versus-existence-side open design question.
+
+## [2.0.0-beta.33] - 2026-09-10
+
+### Fixed - Theo answers Larry end to end (quick task 260910-hni)
+
+- `brain_ask` through the plugin no longer returns an empty DirectiveEnvelope on every Theo answer.
+  `lib/core/brain-client.cjs` `ask()` now composes `directive.guided.framework`, `next_gate.options`
+  (ranked framework chain with the `/mos:` commands Theo links to each framework) and a new additive
+  `grounding` field (Theo's ranked book rows: chapterId, section, score, snippet) from Theo's
+  `structured_rows` + `recommend_chain`. The question's own words are never echoed back (Canon Part 8).
+  Incumbent-shaped responses pass through byte-unchanged. Live e2e through the MCP shim: framework
+  Design Thinking, 4 chain options, 8 grounding rows.
+- `askOp()` accepts Theo's op-mode shape (`rows` + `coverage`); it had been degrading every curated op to
+  zero rows because Theo never sends a `count` key.
+- `lib/mcp/brain-router.cjs` routes `/mos:act` chains from the commands Theo attaches to each framework,
+  so Tier 3 is graph-grounded again instead of silently falling to the local heuristic.
+- `lib/core/part8-egress-guard.cjs` recognizes the `recommend_chain` payload shape (rung enum +
+  step budget) as a known safe shape. `tests/run-all-339.sh` now counts a `.cjs` leg that prints SKIP
+  as skipped, not passed.
+- Larry's thin-grounding clause (`skills/larry-personality/SKILL.md`) keys on an empty `grounding.rows`
+  instead of the retired "empty signals set" wording.
+
+### Removed - Canon Part 8 (quick task 260910-h32)
+
+- `scripts/sync-rooms-brain` and its three detached spawns (`scripts/session-start`, twice in
+  `scripts/room-registry`). It string-interpolated every room's name, venture, stage, status and path
+  into `brain_write` Cypher and sent it to the Brain origin on every SessionStart (observed: 1,498
+  POSTs, 55 rooms, Authorization header on each). Room state already lives in local SQLite via
+  `sync-rooms-graph`. A default-deny census test (`tests/test-quick-260910-h32-no-brain-write-from-scripts.cjs`,
+  registered in `run-all-257.sh`) keeps it from coming back.
+
 ## [2.0.0-beta.31] - 2026-09-10
 
 ### Changed - install and update overhaul, Phase 341 waves 1-5 (SEED teardown 2026-09-09)

package/bin/mindrian-brain-mcp-client.cjs

@@ -163,7 +163,7 @@ const server = new McpServer({ name: 'mindrian-brain', version: version });
 server.registerTool(
   'brain_ask',
   {
-    description: 'Ask the remote teaching graph a natural-language methodology question. Routing happens server-side. Returns a DirectiveEnvelope carrying the directive content; the envelope degrades harmlessly to an empty signals set when the upstream response carries none. Reach for this first for an open methodology question; use brain_search when you already know the topic and want matching nodes directly.',
+    description: 'Ask the remote teaching graph a natural-language methodology question. Routing happens server-side. Returns a DirectiveEnvelope whose directive and next_gate are composed from the graph-grounded rows behind the answer plus a recommended framework chain; grounding.rows names the rows the answer stands on, and an empty grounding.rows means thin footing, not a clean answer. Reach for this first for an open methodology question; use brain_search when you already know the topic and want matching nodes directly.',
     inputSchema: z.strictObject({ question: z.string().describe('A methodology question (generic framework handles only -- never user artifacts or personal data per Canon Part 8).') }),
   },
   async ({ question }) => {
@@ -311,6 +311,20 @@ async function main() {
   const transport = new StdioServerTransport();
   await server.connect(transport);
   process.stderr.write('[mindrian-brain] MCP server v' + version + ' started (stdio)\n');
+
+  // Quick 260911-ddd (DDD-02): fire a content-free Brain pre-warm here,
+  // never awaited and never referenced by any tool handler below. Tri-Polar
+  // point: .mcp.json registers this shim with alwaysLoad: true, so it
+  // starts on Claude Code CLI, Claude Desktop and Cowork alike -- this is
+  // the one surface-neutral pre-warm point (brain-prewarm). The
+  // scripts/session-start detached spawn is a CLI-only extra, never the
+  // only path.
+  try {
+    const { prewarm } = require('../lib/core/brain-prewarm.cjs');
+    prewarm().catch(() => {});
+  } catch (_e) {
+    // Pre-warm is best-effort; it must never block or fail shim startup.
+  }
 }
 
 main().catch((err) => {

package/commands/doctor.md

@@ -78,7 +78,7 @@ Every check has a stable class letter (or a registry id). The class flag that ac
 - **class J -- deployment-surfaces** (shares `--install-state`; `--fix` supported) -- reconciles every owned surface in `data/deployment-surfaces.json` against disk. Reads topology / active-root / active-version from class I's same-invocation result (self-derives via `shared.cjs` when absent). `--fix` re-stamps `ok:false` session-start-owned surfaces and prunes the marketplace cache.
 - **class K -- stale-first-touch-copy** (`--stale-first-touch`; check-only) -- greeting surfaces declared by `data/first-touch-surfaces.json` (banner, splash, onboard, sessionstart, operator-update, larry-extended) scanned for stale version literals and U+2014 em-dash violations. SEED-007 absorption. Also activated by `--all`.
 - **class L -- deprecated-usage** (`--deprecated-usage`; check-only) -- scans the last 7 days of `~/.claude/projects/.../*.jsonl` session transcripts for `/mos:<deprecated>` patterns and surfaces a per-command "use `/mos:<new>` instead" hint. Pure LOCAL scan; zero network, zero Brain. Also activated by `--all`.
-- **class M -- brain-smoke** (`--brain-smoke`; check-only) -- 5-layer Brain end-to-end probe (plugin root resolver, key resolver, HTTPS schema, MCP stdio handshake, e2e brain_schema via the bundled shim). Diagnostic-only; reports the exact failing layer. This is an async runner and stays special-cased (carve-out, below). Activated by `--all`.
+- **class M -- brain-smoke** (`--brain-smoke`; check-only) -- 7-layer Brain end-to-end probe: layer 0 origin and shadow connector (quick task 260911-axz -- resolved Brain origin, Theo status, `MINDRIAN_BRAIN_URL` override, Theo's live mode/build sha, and any Claude Code `~/.claude.json` entry shadowing the plugin's own `mindrian-brain` shim), then plugin root resolver, key resolver, HTTPS schema, MCP stdio handshake, e2e brain_schema via the bundled shim, and store identity (stale-replica detection). Diagnostic-only; reports the exact failing layer. This is an async runner and stays special-cased (carve-out, below). Activated by `--all`.
 - **class N -- plugin-enabled-state** (no flag; bare run + `--all`; check-only) -- the silent-disable watchdog (DRIFT-12). Reads `~/.claude/settings.json` enabledPlugins + installed_plugins.json; installed && enabled===false is CRITICAL with a re-enable hint. It runs on a bare run and under `--all` precisely because a DISABLED plugin cannot fire its own SessionStart hooks to report itself. LOCAL read only; never writes settings.json.
 - **class P / Q / R -- drift** (`--drift`; opt-in, NOT in `--all`) -- class P is prose-vs-code drift (skill-vs-code + first-touch, report-only even under `--fix`), class Q is gsd-record drift (shells out to `gsd-tools validate health`, parses W007 ROADMAP gaps + I001 missing SUMMARYs; `--fix` writes the DRIFT.md baseline and stubs missing SUMMARYs), class R is runtime-reachability drift (FAILS NON-ZERO when a capability is WIRED in the connector registry but UNREACHABLE by `decide()` at runtime). LOCAL-only, zero network.
 - **class S -- eureka-smoke** (`--eureka-smoke`; check-only) -- 4-layer Eureka local-embedding-stack probe (deps present, vec backend, model cache, graceful degrade). Non-cascading; never downloads a model unless `MINDRIAN_EUREKA_SMOKE_ALLOW_DOWNLOAD=1`; rolls into `--acceptance`. Another async carve-out (below). `--fix eureka` installs the local embedding stack into `~/.mindrian/eureka-deps/` (one-time, about 380 MB), the same action as `/mos:eureka enable`.
@@ -104,7 +104,7 @@ Look at the user's invocation:
 - `/mos:doctor --install-state` -> class I (install-state + topology + 6-way version-of-record) + class J (deployment-surface reconciliation)
 - `/mos:doctor --stale-first-touch` -> class K
 - `/mos:doctor --deprecated-usage` -> class L
-- `/mos:doctor --brain-smoke` -> class M (5-layer Brain probe)
+- `/mos:doctor --brain-smoke` -> class M (7-layer Brain probe)
 - `/mos:doctor --eureka-smoke` -> class S (4-layer Eureka probe; opt-in)
 - `/mos:doctor --drift` -> class P + class Q + class R (opt-in; NOT in `--all`)
 - `/mos:doctor --report-registration-bug` -> READ-ONLY escalation reporter (below). NOT a class flag, NOT part of `--all`, NOT a `--fix`.