@unson/brainbase-mcp 0.15.7 → 0.17.0

package/dist/cli.js

@@ -22,7 +22,6 @@ import { blockedJudgmentOutput, processJudgmentHook } from './judgment-host.js';
 import { applyCanonicalWrites, buildCanonicalEdge } from './canonical-edge-builder.js';
 import { defaultJudgmentJournalRoot } from './judgment-value-proof-review.js';
 import { createWorldExtension, readWorldVocabulary } from './world-extension.js';
-import { createOrganizationGraphSource } from './organization-graph-web.js';
 import { createLocalWebHost, LOCAL_WEB_DEFAULT_PORT } from './local-web-host.js';
 export async function runCli(argv = process.argv.slice(2), io = process) {
     const parsed = parseArgs(argv);
@@ -1052,30 +1051,16 @@ async function webServe(parsed, io, command) {
     if (worldVocabularyPath !== undefined && !world)
         throw new Error(`${command} --world-vocabulary requires --world`);
     const worldVocabulary = worldVocabularyPath === undefined ? undefined : await readWorldVocabulary(resolve(worldVocabularyPath));
-    // Ledger C1: the Graph screens read the owner's organization Graph read only.
-    let organizationGraph = null;
-    if (parsed.flags.has('organization-graph')) {
-        const source = await createOrganizationGraphSource();
-        if ('reason' in source) {
-            throw new Error(`${command} --organization-graph cannot read the organization Graph (${source.reason}); sign in with brainbase auth first`);
+    // The organization Graph is shown by the organization web, not by this local host (C1 ended 2026-10-05).
+    for (const removed of ['organization-graph', 'organization-web']) {
+        if (parsed.flags.has(removed) || first(parsed, removed) !== undefined) {
+            throw new Error(`${command} --${removed} was removed; open the organization web to see the organization Graph`);
         }
-        organizationGraph = source;
-    }
-    // Where the organization's records are corrected; the read-only screens link to it.
-    const organizationWeb = first(parsed, 'organization-web');
-    if (organizationWeb !== undefined) {
-        if (!organizationGraph)
-            throw new Error(`${command} --organization-web requires --organization-graph`);
-        if (!/^https:\/\/[^/?#@\s]+$/u.test(organizationWeb)) {
-            throw new Error(`${command} --organization-web must be an https origin such as https://org.example.com`);
-        }
-        organizationGraph = { ...organizationGraph, webUrl: organizationWeb };
     }
     const { server } = createLocalWebHost({
         dataDir,
         journalRoot,
-        extensions: world ? [createWorldExtension(worldVocabulary ? { vocabulary: worldVocabulary } : {})] : [],
-        ...(organizationGraph ? { organizationGraph } : {})
+        extensions: world ? [createWorldExtension(worldVocabulary ? { vocabulary: worldVocabulary } : {})] : []
     });
     await new Promise((resolveListen, rejectListen) => {
         server.once('error', rejectListen);
@@ -1091,8 +1076,6 @@ async function webServe(parsed, io, command) {
         `- プロジェクトと関係者: ${origin}/#projects`,
         `- 情報と関係: ${origin}/#graph`,
         ...(world ? [`- 世界: ${origin}/#world`] : []),
-        ...(organizationGraph ? [`組織のGraph（読み取りのみ）: ${organizationGraph.server}`] : []),
-        ...(organizationGraph?.webUrl ? [`組織版（訂正の入口）: ${organizationGraph.webUrl}`] : []),
         `データ: ${dataDir}`,
         `判断journal: ${journalRoot}`,
         '終了: Ctrl+C',
@@ -1249,7 +1232,7 @@ function usage() {
   brainbase judgment:install --target codex [--autonomy-mode off|canary|on] [--autonomy-project code] [--dry-run] [--output path]
   brainbase judgment:hook [--autonomy-mode off|canary|on] [--autonomy-project code]
   brainbase doctor [--dir path] [--judgment-hooks path]
-  brainbase web:serve [--dir path] [--journal path] [--port n] [--world [--world-vocabulary file]] [--organization-graph [--organization-web https-origin]]
+  brainbase web:serve [--dir path] [--journal path] [--port n] [--world [--world-vocabulary file]]
   brainbase review:serve [--dir path] [--journal path] [--port n]  （web:serveの別名）
 `;
 }

package/dist/graph-corrections.d.ts

@@ -11,11 +11,13 @@ export declare const GRAPH_CORRECTION_SCHEMA: "brainbase-graph-correction.v1";
 /** Relative to the data directory. Committed as a sidecar of the canonical SSOT transaction. */
 export declare const GRAPH_CORRECTIONS_FILE = "evidence/graph-corrections.jsonl";
 export declare const GRAPH_CORRECTION_ENTITY_FIELDS: readonly ["name", "aliases", "summary", "validFrom", "validTo"];
-export declare const GRAPH_CORRECTION_PROJECT_FIELDS: readonly ["goal", "status"];
+export declare const GRAPH_CORRECTION_PROJECT_FIELDS: readonly ["goal", "status", "icon"];
 export declare const GRAPH_CORRECTION_EDGE_FIELDS: readonly ["role", "context", "validTo"];
 export declare const GRAPH_CORRECTION_NEW_EDGE_RELATIONS: readonly ["participates_in", "accountable_for", "member_of"];
 /** MCP tools that read the same graph.json on every call and therefore see a saved correction next time. */
 export declare const GRAPH_CORRECTION_APPLIES_TO: readonly ["search", "get_context", "resolve_entity"];
+/** Decoded bytes, shared with the browser-side project-icon helper. */
+export declare const PROJECT_ICON_MAX_BYTES: number;
 export type GraphCorrectionKind = 'update_entity' | 'update_edge' | 'create_edge';
 export type GraphNewEdgeRelation = typeof GRAPH_CORRECTION_NEW_EDGE_RELATIONS[number];
 export interface GraphEntityCorrectionChanges {
@@ -28,6 +30,8 @@ export interface GraphEntityCorrectionChanges {
     goal?: string | null;
     /** Projects only. Stored as `metadata.status`. */
     status?: string | null;
+    /** Projects only. Stored as `metadata.icon` as a bounded PNG/JPEG/WebP data URL. */
+    icon?: string | null;
 }
 export interface GraphEdgeCorrectionChanges {
     role?: string | null;
@@ -155,3 +159,5 @@ export declare function readGraphCorrectionHistory(dataDir: string): Promise<{
     records: GraphCorrectionRecord[];
     issues: GraphCorrectionHistoryIssue[];
 }>;
+/** Returns true only for a bounded, signature-checked project icon data URL. */
+export declare function isProjectIconDataUrl(value: unknown): value is string;

package/dist/graph-corrections.js

@@ -18,7 +18,7 @@ export const GRAPH_CORRECTION_SCHEMA = 'brainbase-graph-correction.v1';
 /** Relative to the data directory. Committed as a sidecar of the canonical SSOT transaction. */
 export const GRAPH_CORRECTIONS_FILE = 'evidence/graph-corrections.jsonl';
 export const GRAPH_CORRECTION_ENTITY_FIELDS = ['name', 'aliases', 'summary', 'validFrom', 'validTo'];
-export const GRAPH_CORRECTION_PROJECT_FIELDS = ['goal', 'status'];
+export const GRAPH_CORRECTION_PROJECT_FIELDS = ['goal', 'status', 'icon'];
 export const GRAPH_CORRECTION_EDGE_FIELDS = ['role', 'context', 'validTo'];
 export const GRAPH_CORRECTION_NEW_EDGE_RELATIONS = ['participates_in', 'accountable_for', 'member_of'];
 /** MCP tools that read the same graph.json on every call and therefore see a saved correction next time. */
@@ -27,6 +27,8 @@ const MAX_REASON_LENGTH = 500;
 const MAX_NAME_LENGTH = 200;
 const MAX_TEXT_LENGTH = 2000;
 const MAX_ALIASES = 50;
+/** Decoded bytes, shared with the browser-side project-icon helper. */
+export const PROJECT_ICON_MAX_BYTES = 256 * 1024;
 const DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/u;
 const PROJECTED_RELATIONS = new Set(['participates_in', 'accountable_for']);
 export class GraphCorrectionError extends Error {
@@ -213,8 +215,8 @@ function planEntityUpdate(graph, relationships, correction, at) {
     const before = matches[0];
     assertExpectedDigest('entity', before, correction.expectedDigest);
     const changes = correction.changes;
-    if ((changes.goal !== undefined || changes.status !== undefined) && before.type !== 'project') {
-        invalid('correction_field_not_allowed', 'goal and status can be corrected only on a project');
+    if ((changes.goal !== undefined || changes.status !== undefined || changes.icon !== undefined) && before.type !== 'project') {
+        invalid('correction_field_not_allowed', 'goal, status and icon can be corrected only on a project');
     }
     const after = structuredClone(before);
     const diff = {};
@@ -228,7 +230,7 @@ function planEntityUpdate(graph, relationships, correction, at) {
         setField(after, 'validFrom', changes.validFrom, before, diff);
     if (changes.validTo !== undefined)
         setField(after, 'validTo', changes.validTo, before, diff);
-    if (changes.goal !== undefined || changes.status !== undefined) {
+    if (changes.goal !== undefined || changes.status !== undefined || changes.icon !== undefined) {
         const metadata = { ...(before.metadata ?? {}) };
         for (const key of ['goal', 'status']) {
             const next = changes[key];
@@ -243,6 +245,18 @@ function planEntityUpdate(graph, relationships, correction, at) {
                 metadata[key] = next;
             diff[`metadata.${key}`] = { before: previous, after: next };
         }
+        if (changes.icon !== undefined) {
+            const previous = typeof metadata.icon === 'string' ? metadata.icon : null;
+            const next = changes.icon;
+            if (previous !== next) {
+                if (next === null)
+                    delete metadata.icon;
+                else
+                    metadata.icon = next;
+                // Keep image bytes and the long data URL out of append-only history.
+                diff['metadata.icon'] = { before: projectIconSummary(previous), after: projectIconSummary(next) };
+            }
+        }
         if (Object.keys(metadata).length > 0)
             after.metadata = metadata;
         else
@@ -488,6 +502,8 @@ function parseEntityChanges(value) {
         changes.goal = optionalText(value.goal, 'changes.goal', MAX_TEXT_LENGTH);
     if (value.status !== undefined)
         changes.status = optionalText(value.status, 'changes.status', MAX_NAME_LENGTH);
+    if (value.icon !== undefined)
+        changes.icon = parseProjectIcon(value.icon);
     return changes;
 }
 function parseEdgeChanges(value) {
@@ -577,6 +593,75 @@ function optionalDateTime(value, field) {
     }
     return value;
 }
+const PROJECT_ICON_DATA_URL = /^data:(image\/(?:png|jpeg|webp));base64,([A-Za-z0-9+/]*={0,2})(?![\s\S])/u;
+function parseProjectIcon(value) {
+    if (value === null)
+        return null;
+    if (typeof value !== 'string')
+        invalid('correction_invalid', 'changes.icon must be a PNG, JPEG, WebP data URL or null');
+    const match = PROJECT_ICON_DATA_URL.exec(value);
+    if (!match || value.length === 0)
+        invalid('correction_invalid', 'changes.icon must be a PNG, JPEG, WebP data URL or null');
+    const payload = match[2];
+    if (!payload || payload.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/u.test(payload)) {
+        invalid('correction_invalid', 'changes.icon must contain canonical base64 data');
+    }
+    let decoded;
+    try {
+        decoded = Buffer.from(payload, 'base64');
+    }
+    catch {
+        invalid('correction_invalid', 'changes.icon contains invalid base64 data');
+    }
+    if (decoded.length === 0 || decoded.toString('base64') !== payload) {
+        invalid('correction_invalid', 'changes.icon contains invalid base64 data');
+    }
+    if (decoded.length > PROJECT_ICON_MAX_BYTES) {
+        invalid('correction_invalid', `changes.icon must be at most ${PROJECT_ICON_MAX_BYTES} decoded bytes`);
+    }
+    const mimeType = match[1];
+    const validSignature = mimeType === 'image/png'
+        ? decoded.length >= 8 && Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]).equals(decoded.subarray(0, 8))
+        : mimeType === 'image/jpeg'
+            ? decoded.length >= 4 && decoded[0] === 0xff && decoded[1] === 0xd8 && decoded[2] === 0xff
+                && decoded[decoded.length - 2] === 0xff && decoded[decoded.length - 1] === 0xd9
+            : decoded.length >= 12 && decoded.subarray(0, 4).toString('ascii') === 'RIFF'
+                && decoded.subarray(8, 12).toString('ascii') === 'WEBP';
+    if (!validSignature)
+        invalid('correction_invalid', 'changes.icon image signature does not match its MIME type');
+    return value;
+}
+/** Returns true only for a bounded, signature-checked project icon data URL. */
+export function isProjectIconDataUrl(value) {
+    if (value === null)
+        return false;
+    try {
+        return parseProjectIcon(value) !== null;
+    }
+    catch (error) {
+        if (error instanceof GraphCorrectionError && error.kind === 'invalid')
+            return false;
+        throw error;
+    }
+}
+function projectIconSummary(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value !== 'string')
+        return { present: true, valid: false };
+    const match = PROJECT_ICON_DATA_URL.exec(value);
+    if (!match)
+        return { present: true, valid: false };
+    if (!isProjectIconDataUrl(value))
+        return { present: true, valid: false };
+    try {
+        const decoded = Buffer.from(match[2], 'base64');
+        return { present: true, valid: true, mimeType: match[1], bytes: decoded.length };
+    }
+    catch {
+        return { present: true, valid: false };
+    }
+}
 function requireId(value, field) {
     if (typeof value !== 'string' || value.trim() === '' || value.length > 500)
         invalid('correction_invalid', `${field} must be a non-empty id`);

package/dist/graph-web-http.d.ts

@@ -1,5 +1,4 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { type GraphWebAnySource, type InMemoryGraphReader } from './graph-web.js';
 export declare const GRAPH_WEB_HTTP_VERSION: "graph-web-http.v1";
 export interface GraphWebHttpOptions {
     /** Personal OS data directory chosen by the host. Never taken from the request. */
@@ -12,12 +11,6 @@ export interface GraphWebHttpOptions {
      */
     readonly assertWriteAllowed?: (request: IncomingMessage) => void | Promise<void>;
     readonly now?: () => Date;
-    /**
-     * Ledger C1: read every route from a Graph the host holds in memory (the
-     * owner's organization Graph) instead of the data directory. Corrections
-     * are refused as read only.
-     */
-    readonly readGraph?: () => Promise<InMemoryGraphReader<GraphWebAnySource>>;
 }
 export type GraphWebHttpHandler = (request: IncomingMessage, response: ServerResponse) => Promise<boolean>;
 /**

package/dist/graph-web-http.js

@@ -2,7 +2,9 @@ import { applyGraphCorrection, GraphCorrectionError } from './graph-corrections.
 import { GraphWebError, listGraphProjects, readGraphEntity, readGraphOntology, readGraphProject, readGraphWebStatus, searchGraphEntities } from './graph-web.js';
 export const GRAPH_WEB_HTTP_VERSION = 'graph-web-http.v1';
 const DEFAULT_BASE_PATH = '/api/graph';
-const MAX_BODY_BYTES = 16 * 1024;
+// A 256KiB decoded image becomes roughly 350KiB as base64 in JSON. Keep a
+// bounded request envelope while allowing the project-icon correction through.
+const MAX_BODY_BYTES = 512 * 1024;
 class HttpError extends Error {
     statusCode;
     code;
@@ -52,9 +54,6 @@ export function createGraphWebHttpHandler(options) {
             if (route.name === 'corrections') {
                 if (request.method !== 'POST')
                     throw methodNotAllowed('POST');
-                if (options.readGraph) {
-                    throw new HttpError(403, 'organization_graph_read_only', 'This host reads the organization Graph read only; correct it in the organization edition');
-                }
                 await assertWriteAllowed(options.assertWriteAllowed, request);
                 const body = await readJsonBody(request);
                 const result = await applyGraphCorrection(dataDir, body, { now: now() });
@@ -65,17 +64,6 @@ export function createGraphWebHttpHandler(options) {
                 throw methodNotAllowed('GET');
             const asOf = queryValue(url, 'as_of');
             const readOptions = { ...(asOf !== undefined ? { asOf } : {}), now: now() };
-            if (options.readGraph) {
-                const reader = await options.readGraph();
-                const body = route.name === 'status' ? reader.status(readOptions)
-                    : route.name === 'projects' ? reader.listProjects(readOptions)
-                        : route.name === 'project' ? reader.readProject(route.id, readOptions)
-                            : route.name === 'search' ? reader.search({ q: queryValue(url, 'q'), type: queryValue(url, 'type'), asOf, limit: parseLimit(queryValue(url, 'limit')), now: readOptions.now })
-                                : route.name === 'entity' ? reader.readEntity(route.id, readOptions)
-                                    : reader.ontology(readOptions);
-                writeJson(response, 200, body);
-                return true;
-            }
             switch (route.name) {
                 case 'status':
                     writeJson(response, 200, await readGraphWebStatus(dataDir, readOptions));

package/dist/graph-web.d.ts

@@ -1,7 +1,7 @@
 import { GRAPH_CORRECTIONS_FILE, type GraphCorrectionRecord } from './graph-corrections.js';
 import { type PortableGraphOwner } from './portable-graph.js';
 import type { FoundationAdoptionState, FoundationOperator } from './ontology-foundation.js';
-import type { CanonicalEdge, CanonicalEntityKind, CoreRelation, GraphFileV2 } from './types.js';
+import type { CanonicalEdge, CanonicalEntityKind, CoreRelation } from './types.js';
 /**
  * Read views of the canonical local Graph for the local Web screens
  * "プロジェクトと関係者" and "情報と関係".
@@ -34,20 +34,7 @@ export interface GraphWebOwnerPrivateSource {
     graphFormat: 2;
     authority: 'owner_private';
 }
-/**
- * The owner's organization Graph read through the host (ledger C1): read only,
- * held in memory, never written to the data directory.
- */
-export interface GraphWebOrganizationSource {
-    dataDir: null;
-    graphFormat: 2;
-    authority: 'organization_graph';
-    /** Organization server origin, without credentials. */
-    server: string;
-    /** When the host last read the organization Graph. */
-    readAt: string;
-}
-export type GraphWebAnySource = GraphWebSource | GraphWebOwnerPrivateSource | GraphWebOrganizationSource;
+export type GraphWebAnySource = GraphWebSource | GraphWebOwnerPrivateSource;
 export interface GraphMigrationRequired {
     status: 'migration_required';
     source: GraphWebSource;
@@ -87,6 +74,8 @@ export interface GraphEntityView {
     digest: string;
     goal?: string | null;
     status?: string | null;
+    /** Projects only. A validated PNG/JPEG/WebP data URL, or null when unset. */
+    icon?: string | null;
 }
 export type GraphProvenanceReference = {
     status: 'none';
@@ -374,21 +363,4 @@ export interface OwnerPrivateGraph {
  * machine, so a relation's source ID is shown unresolved.
  */
 export declare function openOwnerPrivateGraph(bundle: unknown, owner: PortableGraphOwner): OwnerPrivateGraph;
-/** Read views of one in-memory Graph v2 held by the host (no data directory, no corrections). */
-export interface InMemoryGraphReader<S extends GraphWebAnySource> {
-    readonly source: S;
-    status(options?: GraphWebReadOptions): GraphWebStatus<S>;
-    listProjects(options?: GraphWebReadOptions): GraphProjectList<S>;
-    readProject(projectId: string, options?: GraphWebReadOptions): GraphProjectDetail<S>;
-    search(input?: GraphEntitySearchInput): GraphEntitySearchResult<S>;
-    readEntity(entityId: string, options?: GraphWebReadOptions): GraphEntityDetail<S>;
-    ontology(options?: GraphWebReadOptions): GraphOntologySummary<S>;
-}
-/**
- * The same read views as the local Graph routes over a Graph v2 the host
- * holds in memory (the organization Graph read under C1).  The Graph is
- * checked with the canonical validator first; nothing is written, and there
- * are no correction records or relation sources to resolve.
- */
-export declare function openInMemoryGraph<S extends GraphWebAnySource>(graph: GraphFileV2, source: S): InMemoryGraphReader<S>;
 export {};

package/dist/graph-web.js

@@ -1,8 +1,8 @@
 import { access, readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { isActiveAt, validateCanonicalGraph } from './canonical-graph.js';
+import { isActiveAt } from './canonical-graph.js';
 import { assertFoundationCatalog, findFoundationRecord } from './foundation-catalog.js';
-import { GRAPH_CORRECTION_EDGE_FIELDS, GRAPH_CORRECTION_ENTITY_FIELDS, GRAPH_CORRECTION_NEW_EDGE_RELATIONS, GRAPH_CORRECTION_PROJECT_FIELDS, GRAPH_CORRECTIONS_FILE, graphRecordDigest, readGraphCorrectionHistory } from './graph-corrections.js';
+import { GRAPH_CORRECTION_EDGE_FIELDS, GRAPH_CORRECTION_ENTITY_FIELDS, GRAPH_CORRECTION_NEW_EDGE_RELATIONS, GRAPH_CORRECTION_PROJECT_FIELDS, GRAPH_CORRECTIONS_FILE, graphRecordDigest, isProjectIconDataUrl, readGraphCorrectionHistory } from './graph-corrections.js';
 import { ONTOLOGY_VERSION, portableOntology } from './ontology.js';
 import { canonicalRelationRegistry, getCanonicalRelation } from './relation-registry.js';
 import { loadPersonalOs } from './ssot.js';
@@ -305,46 +305,6 @@ export function openOwnerPrivateGraph(bundle, owner) {
         }
     });
 }
-/**
- * The same read views as the local Graph routes over a Graph v2 the host
- * holds in memory (the organization Graph read under C1).  The Graph is
- * checked with the canonical validator first; nothing is written, and there
- * are no correction records or relation sources to resolve.
- */
-export function openInMemoryGraph(graph, source) {
-    try {
-        validateCanonicalGraph(graph);
-    }
-    catch (error) {
-        throw new GraphWebError('unavailable', 'graph_invalid', errorMessage(error));
-    }
-    return Object.freeze({
-        source,
-        status: (options = {}) => {
-            const asOf = resolveAsOf(options);
-            const entities = Object.fromEntries(ENTITY_KINDS.map((kind) => [kind, graph.entities.filter((entity) => entity.type === kind).length]));
-            return {
-                status: 'ok',
-                version: GRAPH_WEB_VERSION,
-                source,
-                asOf,
-                ontology: { ...graph.ontology, currentVersion: ONTOLOGY_VERSION },
-                counts: {
-                    entities: { ...entities, total: graph.entities.length },
-                    edges: { total: graph.edges.length, active: graph.edges.filter((edge) => isActiveAt(edge, asOf)).length },
-                    relationships: 0,
-                    corrections: 0
-                },
-                issues: []
-            };
-        },
-        listProjects: (options = {}) => projectListOf(graph, source, resolveAsOf(options)),
-        readProject: (projectId, options = {}) => projectDetailOf(graph, source, projectId, resolveAsOf(options), NO_REFERENCES),
-        search: (input = {}) => entitySearchOf(graph, source, parseSearchInput(input)),
-        readEntity: (entityId, options = {}) => entityDetailOf(graph, source, entityId, resolveAsOf(options), NO_REFERENCES),
-        ontology: (options = {}) => ontologyOf(graph, source, resolveAsOf(options))
-    });
-}
 function decisionRecordView(record) {
     return {
         title: record.title,
@@ -574,11 +534,23 @@ function entityView(entity, asOf) {
         validTo: entity.validTo ?? null,
         active: isActiveAt(entity, asOf),
         digest: graphRecordDigest(entity),
-        ...(entity.type === 'project' ? { goal: metadataString(entity, 'goal'), status: metadataString(entity, 'status') } : {})
+        ...(entity.type === 'project'
+            ? { goal: metadataString(entity, 'goal'), status: metadataString(entity, 'status'), icon: projectIconString(entity) }
+            : {})
     };
 }
 function projectView(project, asOf) {
-    return { ...entityView(project, asOf), type: 'project', goal: metadataString(project, 'goal'), status: metadataString(project, 'status') };
+    return {
+        ...entityView(project, asOf),
+        type: 'project',
+        goal: metadataString(project, 'goal'),
+        status: metadataString(project, 'status'),
+        icon: projectIconString(project),
+    };
+}
+function projectIconString(entity) {
+    const value = entity.metadata?.icon;
+    return isProjectIconDataUrl(value) ? value : null;
 }
 function historyFor(records, ids) {
     return records.filter((record) => ids.has(record.target.id)).reverse();

package/dist/local-web-host.d.ts

@@ -1,8 +1,6 @@
 import { type IncomingMessage, type Server, type ServerResponse } from 'node:http';
 import { type ObjectiveDefinitionBuilder } from './foundation-http.js';
-import type { GraphWebAnySource, InMemoryGraphReader } from './graph-web.js';
 import { JudgmentValueProofJournalCache } from './judgment-value-proof-review.js';
-import type { GraphFileV2 } from './types.js';
 /**
  * General local single-owner Web host (`brainbase web:serve`).
  *
@@ -41,8 +39,6 @@ export interface LocalWebModuleContext {
     readonly journalRoot: string;
     readonly token: string;
     readonly now: () => Date;
-    /** Present when the host reads the organization Graph (C1). */
-    readonly organizationGraph?: LocalWebOrganizationGraph;
     /** The host's one listing cache for the judgment journal, shared by every screen that reads it. */
     readonly journalCache: JudgmentValueProofJournalCache;
 }
@@ -80,25 +76,6 @@ export interface LocalWebHostOptions {
     readonly uiDir?: string;
     readonly now?: () => Date;
     readonly extensions?: readonly LocalWebExtension[];
-    /**
-     * Ledger C1: the owner's organization Graph, read only. When given, the Graph
-     * screens read it instead of the data directory and the status reports it.
-     */
-    readonly organizationGraph?: LocalWebOrganizationGraph;
-}
-export interface LocalWebOrganizationGraph {
-    /** Organization server origin shown as the source, without credentials. */
-    readonly server: string;
-    /** The organization's own web (where its records are corrected), when the owner configured it. */
-    readonly webUrl?: string;
-    read(): Promise<InMemoryGraphReader<GraphWebAnySource>>;
-    /** The same Graph as plain records (the world reads project metadata from it). */
-    readGraphFile?(): Promise<GraphFileV2>;
-    /**
-     * The organization's words for field values (glossary terms with `payload.vocabulary`), or null when
-     * they could not be read.  The rest of the Graph is read even when these are not.
-     */
-    readVocabularyTerms?(): Promise<readonly GraphVocabularyTerm[] | null>;
 }
 /** One organization term that names a field value, e.g. project.kind = product → プロダクト. */
 export interface GraphVocabularyTerm {

package/dist/local-web-host.js

@@ -138,9 +138,7 @@ export function createLocalStatusModule(context) {
                 writeJson(response, 405, { error: { code: 'method_not_allowed', message: 'Use GET' } });
                 return true;
             }
-            const local = await readLocalGraphState(context.dataDir);
-            // Under C1 the Graph screens read the organization Graph, so they are not gated on the local file.
-            const graph = context.organizationGraph ? { ...local, status: 'ready', format: 'v2', message: undefined } : local;
+            const graph = await readLocalGraphState(context.dataDir);
             writeJson(response, 200, {
                 version: LOCAL_WEB_HOST_VERSION,
                 data_dir: context.dataDir,
@@ -150,15 +148,7 @@ export function createLocalStatusModule(context) {
                     format: graph.format,
                     ...(graph.message ? { message: graph.message } : {}),
                     commands: graphCommands(graph, context.dataDir)
-                },
-                organization_graph: context.organizationGraph
-                    ? {
-                        status: 'connected',
-                        server: context.organizationGraph.server,
-                        mode: 'read_only',
-                        ...(context.organizationGraph.webUrl ? { web_url: context.organizationGraph.webUrl } : {})
-                    }
-                    : { status: 'not_connected' }
+                }
             });
             return true;
         }
@@ -683,7 +673,6 @@ export function createGraphWebModule(context) {
         dataDir: context.dataDir,
         basePath: LOCAL_WEB_GRAPH_PREFIX,
         now: context.now,
-        ...(context.organizationGraph ? { readGraph: context.organizationGraph.read } : {}),
         assertWriteAllowed(request) {
             if (isTrustedLocalWrite(request, context.token))
                 return;
@@ -694,6 +683,7 @@ export function createGraphWebModule(context) {
     return {
         id: 'graph',
         uiFiles: [
+            'project-icon.js',
             'graph-view-shared.js',
             'graph-view-shared.css',
             'graph-projects-view.js',
@@ -782,8 +772,7 @@ export function createLocalWebHost(options = {}) {
         journalRoot,
         token,
         now: options.now ?? (() => new Date()),
-        journalCache: new JudgmentValueProofJournalCache(),
-        ...(options.organizationGraph ? { organizationGraph: options.organizationGraph } : {})
+        journalCache: new JudgmentValueProofJournalCache()
     };
     const modules = defaultLocalWebModules(context);
     const extensions = [...options.extensions ?? []];

package/dist/organization-graph-web.d.ts

@@ -1,10 +1,10 @@
-import type { GraphVocabularyTerm, LocalWebOrganizationGraph } from './local-web-host.js';
+import type { GraphVocabularyTerm } from './local-web-host.js';
 import type { CanonicalEntityKind, GraphFileV2 } from './types.js';
 /**
- * Ledger C1 (adopted 2026-09-24): while the owner validates the Web, the host
- * reads the owner's organization Graph read only. The records are projected
- * into an in-memory Graph v2 so the existing Graph screens read them through
- * the same views as a local Graph. Nothing is written locally or remotely.
+ * Projects organization Graph records (as an organization host reads them for
+ * its member) into a Graph v2, so shared parts such as the world draw them the
+ * same way as a local Graph. This module never reads a network or a token: the
+ * host that owns the records passes them in (`projectOrganizationWorld`).
  *
  * Relations come only from what the organization Graph states:
  *   - `member_of` person → project       → `participates_in` (role = role_code)
@@ -55,26 +55,4 @@ export declare function projectOrganizationGraph(records: OrganizationGraphRecor
     id: string;
     name?: string;
 }): OrganizationGraphProjection;
-interface OrganizationAccess {
-    readonly server: string;
-    readonly token: string;
-}
-/** The owner's Brainbase server and token, read at request time (tokens rotate hourly). Never logged or returned. */
-export declare function readOrganizationAccess(home?: string): Promise<OrganizationAccess | {
-    readonly reason: string;
-}>;
-export interface OrganizationGraphSourceOptions {
-    readonly home?: string;
-    readonly fetch?: typeof fetch;
-    readonly now?: () => Date;
-    readonly cacheMs?: number;
-}
-/**
- * The organization Graph for the local host (C1). Reads are cached briefly and
- * shared while in flight; a failure is reported as `unavailable`, never as an
- * empty Graph.
- */
-export declare function createOrganizationGraphSource(options?: OrganizationGraphSourceOptions): Promise<LocalWebOrganizationGraph | {
-    readonly reason: string;
-}>;
 export {};