livepilot 1.21.1 → 1.21.3

package/CHANGELOG.md

@@ -1,5 +1,272 @@
 # Changelog
 
+## 1.21.3 — Third audit-response: manual-docs drift + sync_metadata file-list widening + unicode-escape regex fix (April 24 2026)
+
+Fourth same-day patch in 48 hours, third audit-response in 24 hours.
+Audit #3 surfaced that v1.21.2's `sync_metadata` scope expansion had
+added new check TYPES but didn't widen the FILE LISTS — so docs/manual
+pages kept drifting (1305 devices, 135 enriched, 52 domains) while
+`sync_metadata --check` passed. This patch widens the file lists AND
+fixes a latent regex bug that v1.21.2's new "device" check would have
+triggered with data-corrupting consequences.
+
+No API changes. No test additions beyond what `sync_metadata` newly
+enforces. No new features.
+
+### P2 — Manual-doc atlas/domain drift (audit finding)
+
+Three manual pages shipped with stale counts through v1.21.2 because
+they weren't in the `sync_metadata` file lists for `enriched` /
+`domain` / the new `device` check:
+
+| File | Stale claim | Corrected to |
+|---|---|---|
+| `docs/manual/device-atlas.md` | 1305 devices / 135 enriched / 641 pack-indexed | 5264 / 120 / (claim dropped) |
+| `docs/manual/index.md` | 1305 devices | 5264 |
+| `docs/manual/tool-reference.md` | 1305 devices / 135 enriched / 52 domains | 5264 / 120 / 53 |
+
+The 5 numeric substitutions (device count, enriched count, domain count)
+were auto-closed by `sync_metadata --fix` once the file lists were
+widened. The `641 pack-indexed` claim was manually dropped (the fixer
+substitutes numbers, doesn't delete claims) — the shipped atlas has an
+empty `.packs` list, so any specific pack-indexed number would be
+meaningless anyway.
+
+### Critical — Latent regex bug in `check_prose_claim` and `_fix_count`
+
+Adding the `"device"` noun to `PROSE_CLAIM_FILES` exposed a regex
+vulnerability that had existed since v1.15-era. `check_prose_claim`'s
+pattern was:
+
+```python
+r"(\d+)[-\s]+(?:[A-Za-z]+\s+)?{noun}s?\b"
+```
+
+No word-boundary assertion at the start. In `manifest.json`, the em-dash
+is stored as the JSON escape `\u2014`. Raw characters are
+`\`, `u`, `2`, `0`, `1`, `4` — so the literal text "2014" appears
+next to a space, next to "device atlas". The regex matched:
+
+```
+...\u2014 device atlas...
+       ^^^^^^^^^^^^^^^
+       (captures "2014", next optional word is empty, then "device")
+```
+
+Reported as `manifest.json: has '2014 device', expected '5264 device'`.
+If `sync_metadata --fix` had run, it would have rewritten `\u2014`
+(em-dash) to `\u5264` (CJK ideograph `剤`). The JSON would become
+visually corrupted and linguistically nonsensical.
+
+**Prior versions got away with this** because no earlier PROSE_CLAIM
+noun could align adjacent to the 4-char "2014":
+  - "tool" starts with `t` — no match
+  - "bridge command" starts with `b` — no match
+  - "enriched" starts with `e` — no match
+  - "semantic move" / "analyzer tool" / "genre default" — none start with `d`
+
+The new `"device"` noun (starts with `d`) was the first to align.
+v1.21.2's extension would have shipped a corrupting `--fix` if anyone
+had run it immediately.
+
+Fix: leading `\b` assertion on all 4 regex patterns in sync_metadata
+(`check_tool_count`, `check_prose_claim`, `fix_tool_count`,
+`_fix_count`). Word-boundary before `\d+` means the digit must start
+at a non-word-to-word transition — which excludes digits adjacent to
+other word chars (like the `u` in `\u2014`).
+
+Verified: post-fix, `check_prose_claim(noun="device")` reports only
+the intended `5264 devices` in `manifest.json` — the `2014` ghost is
+gone. All existing checks (tool count, bridge command, enriched, etc.)
+continue to match correctly because their valid matches are always
+preceded by non-word chars (space, parenthesis, start-of-string, etc.).
+
+### `sync_metadata.py` expansion — new scope + 3 new file-list entries
+
+Added:
+  * **`get_atlas_device_count()`** + `PROSE_CLAIM_FILES["device"]`
+    (threshold=1000) — enforces atlas device-count claims match
+    `stats.total_devices`. Deferred from v1.21.2 because generic
+    noun="device" was thought too broad; threshold=1000 filters
+    historical "5 devices" mentions entirely. Enabled here based on
+    audit #3 finding.
+  * **`PROSE_CLAIM_FILES["enriched"]`** file list widened: added
+    `docs/manual/device-atlas.md`, `docs/manual/tool-reference.md`.
+    These had stale "135 enriched" while README said "120".
+  * **`DOMAIN_COUNT_FILES`** file list widened: added
+    `docs/manual/tool-reference.md`. Its "52 domains" had drifted
+    while the rest of the repo was at 53.
+
+New `sync_metadata --check` banner reports:
+`version=1.21.3, tools=430, domains=53, bridge_cmds=31, enriched=120,
+genres=4, moves=44, analyzer_tools=38, atlas_devices=5264`.
+
+### Deferred to v1.22
+
+- **`check_prose_claim` regex slash-prefix broadening** — still needs
+  doing (would let "spectral/analyzer tools" match the "analyzer tool"
+  check). Not landed in this patch because it would touch every
+  existing noun and warrants its own regression test pass.
+- **Atlas `.enriched` schema decision** — three definitions (87 stats,
+  120 YAML files, 135 flag count). v1.21.3 standardized on 120 across
+  all descriptions via widened `enriched` check, but the schema
+  question is still open.
+- **`dev-install` path** — still open.
+
+### Scope stats
+
+- 1 code fix (`sync_metadata.py` regex `\b` insertion on 4 patterns —
+  prevents future unicode-escape corruption)
+- 1 code expansion (`sync_metadata.py` — new `device` check type +
+  file-list widening on 2 existing checks)
+- 3 doc corrections auto-closed by `sync_metadata --fix` (9 numeric
+  substitutions across 3 manual files) + 1 manual prose-drop (641
+  pack-indexed in device-atlas.md)
+- 15 version-string sites + `.amxd` binary patch (2 bytes) + `.maxpat`
+  source label + `package-lock.json` (2 fields) bumped 1.21.2 → 1.21.3
+- Test suite: 3124 passed, 1 skipped (unchanged — no-regression patch)
+
+### Credits
+
+Third external audit by the repo owner. Fourth same-day patch since
+v1.20.1. Audit-to-ship pattern stable at ~2h per round.
+
+---
+
+## 1.21.2 — Second audit-response: atlas reconciliation + manual hygiene + sync_metadata expansion (April 24 2026)
+
+Second same-day audit-response patch. After v1.21.1 shipped, the repo
+owner ran another audit and surfaced one code bug (`AtlasManager`
+reported `version="unknown"` because the atlas JSON has `.version` at
+top level, not under `.meta.version`) plus four documentation drifts
+(atlas claims in 11 description fields, stale "32" analyzer counts in
+3 locations, reversibility overclaim in the manual, `.maxpat` source
+displaying `v1.17.5`), and the meta-observation that `sync_metadata.py`
+had been blind to the entire category of drift that keeps surfacing
+in audit rounds.
+
+This patch closes all five findings AND expands `sync_metadata`'s
+scope so future drift of the same classes fails CI instead of requiring
+another manual audit.
+
+### P2 — `AtlasManager.version` now reads top-level `.version`
+
+Pre-fix (`mcp_server/atlas/__init__.py:21`):
+
+```python
+self._meta = data.get("meta", {})
+# ...
+@property
+def version(self) -> str:
+    return self._meta.get("version", "unknown")
+```
+
+The shipped `device_atlas.json` has `.version = "2.0.0"` at top level,
+not nested under `.meta.version`. So `self._meta` was always `{}` and
+`.version` always returned `"unknown"`. Fixed by reading both locations
+with top-level winning; `.meta.version` preserved as fallback for any
+internal/dev atlas using the older schema. After fix:
+`AtlasManager.version` returns `"2.0.0"` on the shipped atlas.
+
+### P2 — Atlas description claims: 1305 devices → 5264, drop "641 pack-indexed"
+
+The "1305 devices" claim was false in every public surface (actual
+shipped JSON has `stats.total_devices = 5264`). The "641 pack-indexed"
+claim was meaningless — the shipped atlas has an empty `.packs` list;
+device-side pack count via `.devices[*].pack` field is 50 across 13
+unique pack names (not 641 or 655).
+
+Updated 11 surfaces: `README.md` (5 hits), `AGENTS.md`, `CLAUDE.md`,
+`package.json`, `server.json`, `manifest.json` (2 hits), `marketplace.json`,
+`Codex-plugin/plugin.json`, `claude-plugin/plugin.json`,
+`livepilot-core/SKILL.md`, `livepilot-core/references/overview.md` (2 hits).
+
+"120 enriched" kept — defensible as the YAML enrichment file count
+(120 files on disk). The `stats.enriched_devices` value (87) and the
+`.enriched=true` flag count (135) are two other valid definitions; the
+three-way divergence is a schema question for v1.22+ scope, not a
+drift fix here.
+
+### P2 — Manual analyzer-tool count 32 → 38
+
+`docs/manual/getting-started.md:256` and `livepilot/skills/livepilot-release/SKILL.md`
+(3 lines) still said "32 spectral/analyzer tools" despite the actual
+`@mcp.tool` count in `analyzer.py` being 38. Corrected.
+
+### P2 — `.maxpat` source label v1.17.5 → v1.21.2
+
+`m4l_device/LivePilot_Analyzer.maxpat:1611` had a stale visible version
+label `"text": "v1.17.5"`. The compiled `.amxd` had been binary-patched
+to the correct version across releases, but the source patch Max uses
+when someone opens/rebuilds the device never got updated. Fixed.
+
+### P3 — Manual reversibility language hedge
+
+`docs/manual/index.md:31` said "All 430 tools... reversible with undo"
+— the README was hedged in v1.21.1 but the manual missed. Corrected
+with matching language: Live-session mutations route through Ableton's
+undo stack; side effects outside the Live project (Splice downloads,
+memory/ledger writes, installer actions, atlas scans, filesystem writes)
+persist beyond undo.
+
+### `sync_metadata.py` expansion — converts this drift class into CI failures
+
+Added to close the audit-memory gap that made v1.21.0, v1.21.1, and
+now v1.21.2 each need a manual sweep:
+
+- **`check_lockfile_version(version)`** — asserts `package-lock.json`
+  root `.version` matches `package.json`. Would have caught the
+  lockfile-stuck-at-1.17.5 drift at CI time from pre-v1.18 onwards.
+- **`PROSE_CLAIM_FILES["semantic move"]`** — enforces every registered
+  "N semantic moves" claim matches `registry.count()` (currently 44).
+  Would have caught v1.21.0's "43 semantic moves" drift at CI time.
+- **`PROSE_CLAIM_FILES["analyzer tool"]`** — enforces "N analyzer tools"
+  claims match `@mcp.tool` count in `analyzer.py` (currently 38).
+  Catches plain-form drift; "spectral/analyzer tools" slashed variants
+  bypass the current `check_prose_claim` regex's optional-word prefix
+  (noted in an inline comment — left for a future patch to broaden).
+
+`sync_metadata --check` banner now reports 2 new counts:
+`moves=44, analyzer_tools=38` alongside the previous 6.
+
+### Deferred to v1.22
+
+- **`sync_metadata.py` atlas-stats check** — catching drift in
+  "5264 devices" or "87 enriched" claims requires either a noun-specific
+  regex (generic "device" is too broad — false-positives on every
+  historical "5 devices" mention) or a different check strategy.
+  Worth doing but nontrivial.
+- **`check_prose_claim` regex broadening** to catch slashed compounds
+  like "spectral/analyzer tools". Current regex's `(?:[A-Za-z]+\s+)?`
+  prefix misses `spectral/` because the slash breaks the character class.
+- **Atlas JSON schema decision** — whether `stats.enriched_devices`,
+  `.enriched=true` flag count, or YAML file count is THE canonical
+  "enriched" number. Picking one + renaming fields ends the three-way
+  ambiguity.
+
+### Credits
+
+Second external audit by the repo owner, performed ~30 min after
+v1.21.1 shipped. Same-day patch #2 ships ~2 hours after audit receipt
+(matches the v1.20.1 / v1.21.1 same-day-hotfix precedent — this is the
+third such same-day patch in 48 hours).
+
+### Scope stats
+
+- 1 code fix (`mcp_server/atlas/__init__.py` — `AtlasManager` reads
+  top-level `.version`)
+- 1 code expansion (`scripts/sync_metadata.py` — 3 new checks:
+  move_count, analyzer_tool_count, lockfile_version)
+- 4 doc corrections (atlas claims across 11 files + analyzer count in
+  4 files + reversibility hedge + .maxpat label)
+- 15 version-string sites + `.amxd` binary patch (2 bytes) +
+  package-lock.json (2 fields) bumped 1.21.1 → 1.21.2
+- Test suite: 3124 passed, 1 skipped (unchanged — this is a
+  no-regression patch; the AtlasManager fix makes a previously-
+  untested code path produce the right answer).
+
+---
+
 ## 1.21.1 — Audit-response patch: experiment-commit safety + doc hygiene + lockfile (April 24 2026)
 
 Small patch release responding to an external audit of v1.21.0 performed

package/README.md

@@ -40,7 +40,7 @@ Most MCP servers are tool collections — they execute commands. LivePilot is an
 | Layer | What it provides |
 |-------|-----------------|
 | **Deterministic Tools** | Direct control: transport, tracks, clips, notes, devices, scenes, mixing, arrangement, browser, automation |
-| **Device Atlas** | Knowledge of every device in Ableton's library — 1305 devices indexed 7 ways (by_id, by_name, by_uri, by_category, by_tag, by_genre, by_pack — 641 pack-indexed). 120 enriched with sonic intelligence (47 with aesthetic-tagged `signature_techniques`). 683 drum kits mapped. Free-text `atlas_describe_chain` ("a granular pad like Tim Hecker") and reverse-lookup `atlas_techniques_for_device` cross-reference 146 techniques across 58 devices |
+| **Device Atlas** | Knowledge of every device in Ableton's library — 5264 devices indexed 7 ways (by_id, by_name, by_uri, by_category, by_tag, by_genre, by_pack). 120 enriched with YAML sonic intelligence (47 with aesthetic-tagged `signature_techniques`). 683 drum kits mapped. Free-text `atlas_describe_chain` ("a granular pad like Tim Hecker") and reverse-lookup `atlas_techniques_for_device` cross-reference 146 techniques across 58 devices |
 | **Concept Surface** | Two reference files let the LLM's training translate into LivePilot: `artist-vocabularies.md` maps ~25 producers (Villalobos, Hawtin, Basic Channel, Gas, Basinski, Hecker, Aphex, Autechre, Dilla, Burial, Henke, Daft Punk, …) to `reach_for` / `avoid` / `key_techniques`; `genre-vocabularies.md` maps 15 genres to tempo / kick / bass / percussion / harmonic / texture / devices. The LLM reads "sound like Gas" and gets a concrete device chain, not guesswork |
 | **Sample Engine** | Three-source sample intelligence — Ableton's browser, your filesystem, and Splice's catalog (plan-aware: Ableton Live plan uses daily quota, Sounds+/Creator uses credits, free samples bypass both). 6 fitness critics. 29 processing techniques. Collections, presets, preview-URL audition, LIVE Describe-a-Sound + Variations via Splice GraphQL |
 | **Spectral Perception** | Real-time ears via M4L — 9-band FFT (with sub_low split at 20-60 Hz for kick fundamentals), RMS/peak metering, Krumhansl-Schmuckler key detection, pitch tracking, FluCoMa mel/chroma/onset. Auto-loaded via `ensure_analyzer_on_master` (v1.20.3) — no more silently-degraded mix moves from forgotten analyzer |
@@ -60,7 +60,7 @@ Most MCP servers are tool collections — they execute commands. LivePilot is an
 │  ──────────────          ──────────────          ──────────────       │
 │                                                                      │
 │  Device Atlas            9-band FFT              recall by mood,     │
-│  1305 devices            RMS / peak              genre, texture      │
+│  5264 devices            RMS / peak              genre, texture      │
 │  120 enriched             pitch tracking          29 techniques       │
 │  683 drum kits           key detection           replay into session │
 │                                                                      │
@@ -105,7 +105,7 @@ Most MCP servers are tool collections — they execute commands. LivePilot is an
 
 **M4L Bridge** (`m4l_device/`) — Optional Max for Live Audio Effect on the master track. Provides deep LOM access through Max's LiveAPI that the ControlSurface API can't reach. UDP 9880 (M4L to server) carries spectral data and LiveAPI responses. OSC 9881 (server to M4L) sends commands. The 38 spectral/analyzer tools strictly require the bridge; device and sample tools that call the bridge also have graceful fallbacks, so core functionality works without it. Backed by 31 bridge commands for hidden parameters, Simpler internals, warp markers, display values, and Simpler warp / Compressor sidechain writes that live on child objects Python can't reach.
 
-**Device Atlas** (`mcp_server/atlas/`) — In-memory indexed JSON database. 1305 devices with browser URIs, 120 enriched with YAML sonic intelligence profiles (mood, genre, texture, recommended chains). 7 indexes: by_id, by_name, by_uri, by_category, by_tag, by_genre, by_pack (641 devices mapped to their source pack). Reverse-index `device_techniques_index.json` powers `atlas_techniques_for_device` (146 cross-references across 58 devices). The AI never hallucinates a device name or preset — it always resolves against the atlas first.
+**Device Atlas** (`mcp_server/atlas/`) — In-memory indexed JSON database. 5264 devices with browser URIs, 120 enriched with YAML sonic intelligence profiles (mood, genre, texture, recommended chains). 7 indexes: by_id, by_name, by_uri, by_category, by_tag, by_genre, by_pack. Reverse-index `device_techniques_index.json` powers `atlas_techniques_for_device` (146 cross-references across 58 devices). The AI never hallucinates a device name or preset — it always resolves against the atlas first.
 
 **Sample Engine** (`mcp_server/sample_engine/`) — Searches three sources simultaneously: BrowserSource (Ableton's library), SpliceSource (local Splice catalog via SQLite), FilesystemSource (user directories). Every result passes through a 6-critic fitness battery (key, tempo, spectral, genre, mood, technical). 29 processing techniques (Surgeon precision vs. Alchemist experimentation). Builds complete sample processing plans with warp, slice, and effect recommendations.
 
@@ -235,7 +235,7 @@ WARP ─────────── get / add / move / remove markers
 The atlas is an in-memory indexed database of Ableton's entire device library.
 
 ```
-1305 devices total
+5264 devices total
   120 enriched with sonic intelligence (mood, genre, texture, chains)
    47 with aesthetic-tagged signature_techniques
   683 drum kits mapped with note assignments
@@ -620,7 +620,7 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for architecture details, code guidelines
 |----------|---------------|
 | [Manual](docs/manual/index.md) | Complete reference: architecture, all 430 tools, workflows |
 | [Intelligence Layer](docs/manual/intelligence.md) | How the 12 engines connect — conductor, moves, preview, evaluation |
-| [Device Atlas](docs/manual/device-atlas.md) | 1305 devices indexed — search, suggest, chain building |
+| [Device Atlas](docs/manual/device-atlas.md) | 5264 devices indexed — search, suggest, chain building |
 | [Samples & Slicing](docs/manual/samples.md) | 3-source search, fitness critics, slice workflows |
 | [Automation](docs/manual/automation.md) | 16 curve types, 15 recipes, spectral suggestions |
 | [Composition](docs/manual/composition.md) | Composer, section analysis, arrangement planning |

package/m4l_device/livepilot_bridge.js

@@ -34,7 +34,7 @@ outlets = 2; // 0: to udpsend (responses), 1: to buffer~/status
 // Single source of truth for the bridge version — bumped alongside the
 // rest of the release manifest. Surfaced in the UI via messnamed("livepilot_version", ...)
 // so the frozen .amxd visibly reports which build it was last exported from.
-var VERSION = "1.21.1";
+var VERSION = "1.21.3";
 
 // ── State ──────────────────────────────────────────────────────────────────
 

package/mcp_server/__init__.py

@@ -1,2 +1,2 @@
 """LivePilot MCP Server — bridges MCP protocol to Ableton Live."""
-__version__ = "1.21.1"
+__version__ = "1.21.3"

package/mcp_server/atlas/__init__.py

@@ -18,7 +18,17 @@ class AtlasManager:
         with open(atlas_path, "r") as f:
             data = json.load(f)
 
-        self._meta = data.get("meta", {})
+        # v1.21.2 audit-response #2: atlas JSONs ship with `.version` at
+        # top level (e.g. "2.0.0"), not under `.meta.version`. Pre-fix,
+        # `self._meta = data.get("meta", {})` always evaluated to {} on
+        # the shipped atlas because there's no `meta` key, which made
+        # `self.version` return "unknown". Read both locations and let
+        # the top-level win — falling back to `.meta.version` preserves
+        # backward-compat with any internal/dev atlas using the older
+        # schema.
+        self._meta = dict(data.get("meta", {}))
+        if "version" in data and "version" not in self._meta:
+            self._meta["version"] = data["version"]
         self._devices: List[Dict[str, Any]] = data.get("devices", [])
 
         # ── Build indexes ───────────────────────────────────────────

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "livepilot",
-  "version": "1.21.1",
+  "version": "1.21.3",
   "mcpName": "io.github.dreamrec/livepilot",
-  "description": "Agentic production system for Ableton Live 12 — 430 tools, 53 domains, 44 semantic moves. Device atlas (1305 devices, 120 enriched, 7 indexes), Splice intelligence (gRPC + GraphQL describe-a-sound + preview + collections + presets), 9-band spectral perception auto-loaded via ensure_analyzer_on_master, Creative Director skill, technique memory, 12 creative intelligence engines",
+  "description": "Agentic production system for Ableton Live 12 — 430 tools, 53 domains, 44 semantic moves. Device atlas (5264 devices, 120 enriched, 7 indexes), Splice intelligence (gRPC + GraphQL describe-a-sound + preview + collections + presets), 9-band spectral perception auto-loaded via ensure_analyzer_on_master, Creative Director skill, technique memory, 12 creative intelligence engines",
   "author": "Pilot Studio",
   "license": "BSL-1.1",
   "type": "commonjs",

package/remote_script/LivePilot/__init__.py

@@ -5,7 +5,7 @@ Entry point for the ControlSurface. Ableton calls create_instance(c_instance)
 when this script is selected in Preferences > Link, Tempo & MIDI.
 """
 
-__version__ = "1.21.1"
+__version__ = "1.21.3"
 
 from _Framework.ControlSurface import ControlSurface
 from . import router

package/server.json

@@ -1,17 +1,17 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.dreamrec/livepilot",
-  "description": "430-tool agentic MCP production system for Ableton Live 12 — 53 domains, 44 semantic moves, device atlas (1305 devices), Splice intelligence (gRPC + GraphQL), 9-band spectral perception auto-loaded, Creative Director skill, technique memory, 12 creative engines",
+  "description": "430-tool agentic MCP production system for Ableton Live 12 — 53 domains, 44 semantic moves, device atlas (5264 devices), Splice intelligence (gRPC + GraphQL), 9-band spectral perception auto-loaded, Creative Director skill, technique memory, 12 creative engines",
   "repository": {
     "url": "https://github.com/dreamrec/LivePilot",
     "source": "github"
   },
-  "version": "1.21.1",
+  "version": "1.21.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "livepilot",
-      "version": "1.21.1",
+      "version": "1.21.3",
       "transport": {
         "type": "stdio"
       }