@theronap/cortex-mcp 0.9.87 → 0.9.89

package/lib/server.mjs

@@ -192,15 +192,17 @@ export async function runServer(version) {
     'log_session',
     {
       title: 'Log this session to Agnoclast',
-      description: 'Persist a CURATED summary of this work session as its durable Agnoclast record (authoritative — supersedes the auto-capture hook). Call at session close after composing the summary. Pass sessionId (the Claude Code session id) if you have it so this dedupes with the auto-capture of the same session.',
+      description: 'Persist a CURATED summary of this work session as its durable Agnoclast record (authoritative — supersedes the auto-capture hook). Call at session close after composing the summary. Pass sessionId (the Claude Code session id) if you have it so this dedupes with the auto-capture of the same session. If you belong to more than one brain, pass `brain` — without it a session log has no route and is STAGED rather than recorded.',
       inputSchema: {
         summary: z.string().describe('the curated session summary (what was done, decided, left open) — becomes the durable record'),
         project: z.string().optional().describe('project key/name this session worked in'),
         title: z.string().optional().describe('short title for the session'),
         sessionId: z.string().optional().describe('the Claude Code session id (dedupes with the auto-capture hook of the same session)'),
+        brain: z.string().optional().describe('which brain to record this session in (name or org id, one of your own). REQUIRED IN EFFECT for a multi-brain member: session-class sources route only by an explicit brain or a sole membership, so omitting it stages the log instead of recording it.'),
+        privacy: z.enum(['accessible', 'scoped', 'confidential']).optional().describe('tier this record AT WRITE TIME. Use when the summary names confidential work (a candidate evaluation, a security finding) — safer than letting it land org-visible and re-tiering after, which leaves it readable in between.'),
       },
     },
-    async ({ summary, project, title, sessionId }) => {
+    async ({ summary, project, title, sessionId, brain, privacy }) => {
       const res = await fetchCortex(`${BASE}/api/ingest`, {
         method: 'POST',
         headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
@@ -211,6 +213,13 @@ export async function runServer(version) {
           ...(project ? { project } : {}),
           ...(title ? { title } : {}),
           ...(sessionId ? { sessionId } : {}),
+          // ADR-0022 deleted the write pointer, so a session-class source routes ONLY by an explicit
+          // brain or a sole membership — anything else STAGES. This tool never sent one, so every
+          // close-out from a multi-brain member landed in staged_records instead of the org. Measured
+          // 2026-08-09: 86 staged rows, and the pile is not drainable by /api/staged/promote because
+          // promote resolves through the same branch session-class sources skip.
+          ...(brain ? { brain } : {}),
+          ...(privacy ? { privacy } : {}),
           payload: { via: 'log_session' },
         }),
       })
@@ -219,7 +228,26 @@ export async function runServer(version) {
         throw new Error(classify(res.status, res.headers.get('content-type'), body, res.headers.get('x-vercel-id')).message)
       }
       const j = await res.json().catch(() => ({}))
-      return { content: [{ type: 'text', text: `Logged to Agnoclast (authoritative): "${j.title ?? title ?? 'session'}" — ${j.inserted ? 'new record' : 'updated existing'}.` }] }
+
+      // NEVER report a non-record as "logged". `staged` and `skipped` are 200 OK responses that wrote
+      // no record, and this line used to print "Logged to Agnoclast (authoritative) … updated existing"
+      // for both — `j.inserted` is merely falsy on a staged write, which reads as an UPDATE. That is
+      // how a session close-out was reported as saved when it had not been (2026-08-09), and it is the
+      // same failure shape the cortex-log skill warns about for `author`: a success string over a write
+      // that did not land. The caller cannot tell the difference, so the message has to.
+      if (j.staged) {
+        const why = j.reason === 'no_route_for_source' && !brain
+          ? 'no brain was named and you belong to more than one, so it had nowhere to route'
+          : `reason: ${j.reason ?? 'unknown'}`
+        return { content: [{ type: 'text', text: `NOT LOGGED — STAGED, not recorded (${why}). Re-run log_session with brain:"<name>" to record it. Staged session logs cannot currently be drained by /api/staged/promote.` }] }
+      }
+      if (j.skipped) {
+        return { content: [{ type: 'text', text: `NOT LOGGED — the server skipped this write: ${j.skipped}` }] }
+      }
+      if (!j.id) {
+        return { content: [{ type: 'text', text: `NOT LOGGED — the server returned no record id. Raw response: ${JSON.stringify(j).slice(0, 300)}` }] }
+      }
+      return { content: [{ type: 'text', text: `Logged to Agnoclast (authoritative): "${j.title ?? title ?? 'session'}" — ${j.inserted ? 'new record' : 'updated existing'} (id ${j.id}).` }] }
     },
   )
 
@@ -486,6 +514,45 @@ export async function runServer(version) {
     },
   )
 
+  server.registerTool(
+    'intake_discard',
+    {
+      title: 'Discard a private intake item',
+      description:
+        'The OTHER terminal outcome for a claimed intake unit: this is nothing, drop it. Use it for content that should never become a record — unsubscribe receipts, empty greetings, marketing blasts, a stranger\'s photo — instead of materializing junk into a brain because materialize was the only verb available. IRREVERSIBLE: the ciphertext and nonces are destroyed in the same transaction, and a content-free tombstone stops the connector re-delivering the unit. You must already hold the claim (discarding something you never read is refused), `reason` is required and is stored, and it is one item per call — a loop discarding a whole pile on one decision is a bulk job, not judgment.',
+      inputSchema: {
+        intakeItemId: z.string().describe('intake item uuid from intake_claim'),
+        reason: z.string().describe('why this is nothing — recorded on the claim, and the only surviving trace of the decision'),
+      },
+    },
+    async ({ intakeItemId, reason }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/intake/discard`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ intakeItemId, reason }),
+        })
+      } catch (e) {
+        return toolError(`Could not discard: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        if (out?.error === 'not_claimed') {
+          return toolError('You do not hold a claim on that item — intake_claim it first, so the discard follows from having read it.')
+        }
+        if (out?.error === 'already_materialized') {
+          return toolError('That unit already became a record. Discarding it now would orphan the record from its source — detach or retier the record instead.')
+        }
+        return toolError(`Could not discard: ${out?.error ?? res.status}${out?.detail ? ` — ${out.detail}` : ''}`)
+      }
+      if (out?.alreadyDiscarded) {
+        return { content: [{ type: 'text', text: 'Already discarded — nothing to do.' }] }
+      }
+      return { content: [{ type: 'text', text: 'Discarded. Content destroyed, tombstone written so the source cannot re-deliver it.' }] }
+    },
+  )
+
   server.registerTool(
     'intake_cleanup_status',
     {
@@ -1654,16 +1721,19 @@ export async function runServer(version) {
     },
   )
 
-  // ── Gate 4 record triage ──────────────────────────────────────────────────────────────────
+  // ── Gate 4 record triage, over timeline_claims ────────────────────────────────────────────
   // A connector event materializes in seconds and has no idea what the work WAS. The session that
   // did the work knows exactly, and arrives later. These three tools are that handoff: look at what
   // landed, claim what is yours, route it when you know where it goes.
+  //
+  // The ledger is `timeline_claims` (0105) — one claim discipline over one stream. Unclaimed means
+  // NO claim row: absence IS the backlog, and nothing is written at ingest.
 
   server.registerTool(
     'pending_records',
     {
       title: 'Records waiting for a home',
-      description: 'List connector records (GitHub pushes, PRs, email) that landed WITHOUT a confident home and are waiting for judgment. Check this when your session starts if the headline count sounds related to what you are about to work on — records from your own recent commits are usually in here. Returns titles and current homes only, never payloads. Use view "sweep" on one record to get graded page-name candidates without reading any pages.',
+      description: 'List recent connector records (GitHub pushes, PRs, email) that NOBODY HAS ATTENDED TO yet — no claim row in the Gate 4 ledger. Check this when your session starts if the headline count sounds related to what you are about to work on; records from your own recent commits are usually in here, and you are the only one who can recognize them as yours. Returns titles and current homes only, never payloads. Use view "sweep" on one record to get graded page-name candidates without reading any pages.',
       inputSchema: {
         view: z.enum(['digest', 'sweep']).optional().describe('digest = what is waiting (default); sweep = cheap graded candidates for one record'),
         recordId: z.string().optional().describe('required for view "sweep"'),
@@ -1728,7 +1798,7 @@ export async function runServer(version) {
     'claim_record',
     {
       title: 'Claim a pending record as your work',
-      description: 'Say "this record is mine, I will route it once I know where it goes." Use it as soon as you recognize your own work in pending_records, even before you know the destination page — the claim stops a cheap automatic sweep from guessing at something you have real context on. Claims expire, so a dead session never holds a record hostage. Pass release=true to give one back when it turns out not to be yours.',
+      description: 'Say "this record is mine, I will route it once I know where it goes." Use it as soon as you recognize your own work in pending_records, even before you know the destination page — the claim takes it out of the backlog so nothing else guesses at something you have real context on. Claims are leased and expire, so a dead session never holds a record hostage, and a record held by another LIVE session cannot be taken. Pass release=true to give one back when it turns out not to be yours — that deletes the claim, so the record looks untouched again rather than attended-to.',
       inputSchema: {
         recordId: z.string().describe('record id from pending_records'),
         note: z.string().optional().describe('what you think this is — kept for audit'),
@@ -1750,7 +1820,16 @@ export async function runServer(version) {
       const out = await res.json().catch(() => null)
       if (!res.ok) {
         if (out?.error === 'already_claimed') {
-          return toolError(`Another live session is already holding that record (${String(out.heldBy).slice(0, 16)}…). Leave it to them.`)
+          // Name the holder when the server knows it. The fallback matters: `heldBy` is absent when
+          // nothing holds a live lease, which means the record was not claimable rather than taken —
+          // printing "another session has it" there sends the reader chasing a session that does not
+          // exist. (This branch printed a bare `undefined` until 2026-08-14; the field was renamed
+          // server-side and the tool was never updated, which is the whole reason it says both now.)
+          if (out.heldBy) {
+            const until = out.heldUntil ? `, lease to ${out.heldUntil}` : ''
+            return toolError(`Session ${String(out.heldBy).slice(0, 16)}… is holding that record${until}. Leave it to them.`)
+          }
+          return toolError(out.detail || 'Could not claim that record and no session holds it — re-run pending_records; it may have been resolved already.')
         }
         return toolError(`Could not claim record: ${out?.error ?? res.status}`)
       }
@@ -1790,6 +1869,51 @@ export async function runServer(version) {
     },
   )
 
+  server.registerTool(
+    'unroute_record',
+    {
+      title: 'Remove pages a record should not be on',
+      description:
+        'Detach pages a record does not belong on — the inverse of route_record, and the only way a wrong placement can be undone. route_record is purely ADDITIVE, so attaching more pages can never fix a bad one. Use this when you can see a record sitting on a page it has no real relationship to — the classic case is a fuzzy title match, e.g. a commit attached to a page merely because both contain a common word. Two things it will refuse rather than surprise you: it will not remove every attachment (a record with no home is invisible, which is worse than a wrong home — route or park it instead), and detaching the page that GOVERNS the tier can tighten the record but never republish it, since a widening is pinned and proposed for a human to confirm.',
+      inputSchema: {
+        recordId: z.string().describe('record id from pending_records'),
+        documentIds: z.array(z.string()).describe('page document ids to REMOVE from this record'),
+        reason: z.string().describe('why these placements are wrong — recorded with the removal'),
+      },
+    },
+    async ({ recordId, documentIds, reason }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brain/triage`, {
+          method: 'POST',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ action: 'detach', recordId, documentIds, reason }),
+        })
+      } catch (e) {
+        return toolError(`Could not detach: ${e.message}`)
+      }
+      const out = await res.json().catch(() => null)
+      if (!res.ok) {
+        // These two are guard rails, not faults — say what to do instead of just naming the code.
+        if (out?.error === 'would_strand') {
+          return toolError(`Refused: ${out.detail ?? 'that would leave the record with no pages at all.'}`)
+        }
+        if (out?.error === 'not_attached') {
+          return toolError(`Nothing removed: ${out.detail ?? 'those pages are not attached to this record.'}`)
+        }
+        return toolError(`Could not detach: ${out?.error ?? res.status}${out?.detail ? ` — ${out.detail}` : ''}`)
+      }
+      const n = out?.detached?.length ?? 0
+      const left = out?.remaining ?? 0
+      return {
+        content: [{
+          type: 'text',
+          text: `Detached ${n} page(s); ${left} attachment(s) remain. Record tier: ${out?.privacy ?? 'unchanged'}. Recorded as a session judgment.`,
+        }],
+      }
+    },
+  )
+
   server.registerTool(
     'snooze_red_link',
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/cortex-mcp",
-  "version": "0.9.87",
+  "version": "0.9.89",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {

package/skills/log/SKILL.md

@@ -36,9 +36,22 @@ No arguments. Read the conversation context.
    session's authoritative Agnoclast record (`capture_source='skill'`). The background auto-capture is a
    fallback and will not overwrite it; passing the same `sessionId` the auto-capture uses dedupes them
    onto one record. This — not the raw-transcript re-derivation — is the canonical record going forward.
-4. **Confirm + flag privacy** — `log_session` returns a confirmation; if it errors, tell the user to
-   run `npx -y @theronap/cortex-mcp doctor`. If any record from this session should be confidential,
-   note it so the user can mark it (`set_record_privacy`). Default is org-visible under access rules.
+
+   ⚠ **If you belong to more than one brain, pass `brain`.** ADR-0022 deleted the write pointer, so a
+   session-class source routes only by an explicit brain or a sole membership — omit it and the log is
+   **STAGED, not recorded**, and staged session logs are not drainable by `/api/staged/promote`. Pick the
+   brain the work was actually in (`my_brains` shows what each holds). This silently swallowed 86 close-outs
+   before it was caught on 2026-08-09.
+4. **Confirm + flag privacy** — **read the result text, do not assume it succeeded.** `log_session` now
+   answers `NOT LOGGED — STAGED…` or `NOT LOGGED — the server skipped…` when no record was written; only a
+   message carrying a record id means it landed. (It previously printed "Logged … updated existing" for a
+   staged write, because `inserted` is merely falsy when nothing is recorded — an agent reported a session
+   as saved when it was not.) If it errors, tell the user to run `npx -y @theronap/cortex-mcp doctor`.
+
+   If any record from this session should be confidential, prefer passing `privacy: "confidential"` on the
+   `log_session` call itself so it is tiered **at write time** rather than landing org-visible and being
+   corrected after. Otherwise note it so the user can mark it (`set_record_privacy`). Default is org-visible
+   under access rules.
 5. **Sweep the wiki (author what you now understand)** — the HARD backstop for live authoring
    ([[cortex-wiki-authoring-spec]] D2). For each node whose understanding meaningfully advanced this
    session (the project(s) worked on, people you coordinated with, and yourself when your own focus