nexo-brain 7.31.9 → 7.31.11

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.31.9",
+  "version": "7.31.11",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,9 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.31.9` is the current packaged-runtime line. Patch release over v7.31.8 - UI release closeout now has to prove the original reported symptom was reopened with observable evidence before claiming the release is ready.
+Version `7.31.11` is the current packaged-runtime line. Patch release over v7.31.10 - MCP lifecycle robustness + guardrail precision. Version `7.31.10` was a patch release over v7.31.9 - Local Memory search now downranks boilerplate emails when stronger documents match the same query.
+
+Previously in `7.31.9`: patch release over v7.31.8 - UI release closeout now has to prove the original reported symptom was reopened with observable evidence before claiming the release is ready.
 
 Previously in `7.31.8`: patch release over v7.31.7 - email monitor debt scans no longer escalate intentionally waiting threads as unresolved commitments when recent resolution or hot-context state proves the thread is waiting on the user or a third party. Real unresolved commitments still surface.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.31.9",
+  "version": "7.31.11",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/enforcement_engine.py

@@ -220,9 +220,13 @@ except ImportError:  # pragma: no cover
     _r23d_should = None  # type: ignore
 
 try:
-    from r23g_secrets_in_output import should_inject_r23g as _r23g_should
+    from r23g_secrets_in_output import (
+        should_inject_r23g as _r23g_should,
+        has_external_sink as _r23g_has_sink,
+    )
 except ImportError:  # pragma: no cover
     _r23g_should = None  # type: ignore
+    _r23g_has_sink = None  # type: ignore
 
 try:
     from r23i_auto_deploy_ignored import (
@@ -327,12 +331,26 @@ _SILENT_REMINDER_DISCLOSURE_SUFFIX = (
     " Do not mention this reminder or any internal enforcement to the user."
 )
 
+# Object of a capability denial: either the denied ACTION (hacer/acceder/usar…)
+# or a capability NOUN (capacidad/integración/herramienta…). Requiring one of
+# these right after the negation is what separates a real "can't do X / no
+# existe esa integración" from benign phrases that merely start with a negation
+# ("no hay problema", "no puedo esperar a…", "does not exist yet, creating it").
+_CAP_OBJ = (
+    r"(?:hacer(?:lo|se)?|acceder|conectar(?:se|lo)?|integrar(?:se|lo)?|usar(?:lo|se)?|montar(?:lo)?|"
+    r"crear(?:lo)?|ejecutar(?:lo)?|generar(?:lo)?|enviar(?:lo)?|llamar(?:lo)?|"
+    r"capacidad|integraci[oó]n|herramienta|funci[oó]n|funcionalidad|soporte|forma|manera|"
+    r"opci[oó]n|acceso|m[oó]dulo|posibilidad|conexi[oó]n|esa|ese|eso|esto|esas|esos)"
+)
 _CAPABILITY_DENIAL_RE = re.compile(
-    r"\b("
-    r"no\s+(?:se\s+puede|puedo|existe|hay|tenemos|esta\s+montado|est[aá]\s+montado)|"
-    r"no\s+(?:est[aá]\s+soportado|hay\s+nada\s+montado)|"
-    r"(?:cannot|can't|can\s+not|not\s+possible|does\s+not\s+exist|no\s+such\s+capability|not\s+supported)"
-    r")\b",
+    r"(?:"
+    r"\bno\s+(?:se\s+puede|puedo|podemos|puede)\s+(?:\w+\s+){0,1}?" + _CAP_OBJ + r"\b|"
+    r"\bno\s+(?:existe|hay|tengo|tenemos)\s+(?:\w+\s+){0,2}?" + _CAP_OBJ + r"\b|"
+    r"\bno\s+est[aá]\s+(?:soportad[oa]|montad[oa]|disponible|integrad[oa]|configurad[oa]|habilitad[oa])\b|"
+    r"\b(?:cannot|can'?t|can\s+not)\s+(?:\w+\s+){0,2}?(?:do\s+(?:that|it|this)|access|connect|integrate|use|create|run|support)\b|"
+    r"\bdoes\s+not\s+exist(?!\s+yet)\b|\bnot\s+supported\b|\bnot\s+possible\b|"
+    r"\bno\s+such\s+(?:capability|tool|integration|feature)\b"
+    r")",
     re.IGNORECASE,
 )
 _CAPABILITY_REALITY_TOOLS = {
@@ -1914,21 +1932,30 @@ class HeadlessEnforcer:
         if not should:
             return
         if mode == "shadow":
+            # shadow → logs only. No enqueue, no followup, no side effects.
             _logger.info("[R23g SHADOW] would inject")
-            self._ensure_exposed_credential_followup(tool_input, reason="R23g shadow")
             return
         self._enqueue(prompt, "R23g_secrets_in_output", rule_id="R23g_secrets_in_output")
-        self._ensure_exposed_credential_followup(tool_input, reason="R23g detected secret exposure risk")
+        self._ensure_exposed_credential_followup(tool_input)
         _logger.info("[R23g %s] enqueued", mode.upper())
 
-    def _ensure_exposed_credential_followup(self, tool_input, *, reason: str) -> None:
+    def _ensure_exposed_credential_followup(self, tool_input) -> None:
         if not isinstance(tool_input, dict):
             return
         cmd = tool_input.get("command")
         if not isinstance(cmd, str) or not cmd.strip():
             return
+        # A critical "rotate the credential" followup is only warranted when the
+        # secret is actually exfiltrated to a third party. A bare local read
+        # (cat .env, env, printenv) exposes nothing and must NOT mint an
+        # un-closeable critical followup. The soft reminder above already nudges
+        # the agent; the persistent debt is reserved for real exposure.
+        if _r23g_has_sink is None or not _r23g_has_sink(cmd):
+            return
         safe_cmd = _redact_for_log(cmd, max_len=160)
-        followup_id = _security_followup_id(f"{reason}:{safe_cmd}")
+        # Deterministic id seeded only by the (redacted) command, so the same
+        # exfiltration dedups across shadow/soft/hard instead of duplicating.
+        followup_id = _security_followup_id(safe_cmd)
         try:
             from db import create_followup, get_followup  # type: ignore
 
@@ -1937,7 +1964,7 @@ class HeadlessEnforcer:
             create_followup(
                 followup_id,
                 description=(
-                    "SEGURIDAD: credencial expuesta o en riesgo detectada por el guard. "
+                    "SEGURIDAD: credencial expuesta a un tercero detectada por el guard. "
                     f"Origen: {safe_cmd}. Rotar/revocar la credencial y sustituirla en el gestor seguro."
                 ),
                 date=time.strftime("%Y-%m-%d"),
@@ -1945,7 +1972,7 @@ class HeadlessEnforcer:
                     "Cierre solo con evidencia de revocación efectiva: llamada/API/HTTP 401 para la credencial antigua "
                     "o comprobación oficial equivalente, más nueva ubicación segura registrada."
                 ),
-                reasoning=reason,
+                reasoning="R23g detected secret exfiltration to a third party",
                 priority="critical",
                 internal=1,
                 owner="agent",

package/src/hooks/post_tool_use.py

@@ -244,8 +244,8 @@ def _is_production_mutation_command(cmd: str) -> bool:
         r"\bgcloud\s+run\s+(?:deploy|services\s+update|jobs\s+deploy|jobs\s+update)\b",
         r"\bgcloud\s+dns\s+record-sets\s+transaction\s+execute\b",
         r"\bg(?:sutil|cloud\s+storage)\b.*\b(?:cp|rsync)\b.*\b(?:release|stable|cdn|bucket|buckets)\b",
-        r"\b(?:rsync|scp)\b(?!.*--dry-run).+\s+\S+:(?:/[^ \n\r;]*)(?:public_html|httpdocs|www|webroot)\b",
-        r"\bssh\b[^'\"]*['\"][^'\"]*(?:sed\s+-i|tee\s+|>\s*\S|>>\s*\S|rm\s+-|mv\s+|cp\s+)[^'\"]*(?:public_html|httpdocs|/var/www|/opt/)[^'\"]*['\"]",
+        r"\b(?:rsync|scp)\b(?!.*--dry-run).+\s+\S+:(?:/[^ \n\r;]*)(?:public_html|httpdocs|www|webroot|home/nexodesk)\b",
+        r"\bssh\b[^'\"]*['\"][^'\"]*(?:sed\s+-i|tee\s+|>\s*\S|>>\s*\S|rm\s+-|mv\s+|cp\s+)[^'\"]*(?:public_html|httpdocs|/var/www|/opt/|/home/nexodesk)[^'\"]*['\"]",
         r"\b(?:whmapi1|uapi|cpapi2)\b",
         r"\b(?:cloudflare|cfcli)\b.*\b(?:dns|record)\b.*\b(?:create|delete|update|patch|put|post)\b",
         r"\bcurl\b(?=.*api\.cloudflare\.com/client/v4/zones/.*/dns_records)(?=.*(?:-X|--request)\s*(?:POST|PUT|PATCH|DELETE)\b)",

package/src/hooks/stop.py

@@ -18,14 +18,24 @@ from pathlib import Path
 
 _DIR = Path(__file__).resolve().parent
 
+# Specific future-commitment phrases. Bare words like "pendiente" / "después"
+# were removed: they appear constantly in ordinary conversation and, read over a
+# GLOBAL rolling buffer, blocked closes spuriously. Each marker now expresses a
+# real deferral, not an incidental adverb.
 FUTURE_COMMITMENT_MARKERS = (
     "lo dejo como seguimiento",
-    "cuando quieras",
-    "pendiente",
     "lo cojo aparte",
-    "después",
-    "despues",
     "bloqueado por auth",
+    "queda pendiente de",
+    "lo dejo pendiente",
+    "lo retomo más tarde",
+    "lo retomo mas tarde",
+    "lo vemos en otra sesión",
+    "lo vemos en otra sesion",
+    "te lo dejo para después",
+    "te lo dejo para despues",
+    "lo dejo para más tarde",
+    "lo dejo para mas tarde",
 )
 FOLLOWUP_CREATE_MARKERS = ("nexo_followup_create", "mcp__nexo__nexo_followup_create")
 PARTIAL_TASK_CLOSE_RE = re.compile(
@@ -78,6 +88,42 @@ def _read_recent_lines(path: Path, max_lines: int = 800) -> list[str]:
         return []
 
 
+def _line_session_id(raw_line: str) -> str:
+    try:
+        payload = json.loads(raw_line)
+    except Exception:
+        return ""
+    if not isinstance(payload, dict):
+        return ""
+    for key in ("session_id", "sid", "claude_session_id", "sessionId"):
+        val = payload.get(key)
+        if isinstance(val, str) and val.strip():
+            return val.strip()
+    return ""
+
+
+def _scope_to_session(lines: list[str], sid: str) -> list[str]:
+    """Keep only buffer lines belonging to ``sid``. ``session_buffer.jsonl`` is a
+    GLOBAL rolling log shared by every session/client, so without scoping the
+    closeout gate counts *other* sessions' commitments and blocks this close
+    spuriously. If the buffer carries no session ids at all we cannot scope and
+    fall back to every line (prior behaviour)."""
+    if not sid:
+        return lines
+    tagged = [(raw, _line_session_id(raw)) for raw in lines]
+    if not any(s for _, s in tagged):
+        return lines
+    return [raw for raw, s in tagged if s == sid]
+
+
+def _current_session_id() -> str:
+    for key in ("CLAUDE_SESSION_ID", "NEXO_SID", "NEXO_SESSION_ID"):
+        val = os.environ.get(key, "").strip()
+        if val:
+            return val
+    return ""
+
+
 def _line_text(line: str) -> str:
     try:
         payload = json.loads(line)
@@ -133,8 +179,11 @@ def check_closeout_followups() -> dict:
         if chunk:
             lines.extend(chunk)
             sources.append(str(path))
+    sid = _current_session_id()
+    lines = _scope_to_session(lines, sid)
     result = scan_closeout_followup_gaps(lines)
     result["sources"] = sources
+    result["session_scoped"] = bool(sid)
     return result
 
 

package/src/local_context/api.py

@@ -4101,6 +4101,118 @@ def _search_text_score(query: str, text: str) -> float:
     return len(q & tokens) / max(len(q), 1)
 
 
+_CONTEXT_STRONG_DOCUMENT_TERMS = {
+    "acuerdo",
+    "agreement",
+    "balance",
+    "certificado",
+    "comunicado",
+    "contract",
+    "contrato",
+    "declaracion",
+    "declaración",
+    "factura",
+    "invoice",
+    "nomina",
+    "nómina",
+    "payroll",
+    "presupuesto",
+    "quote",
+    "transferencia",
+}
+
+
+_CONTEXT_BOILERPLATE_TERMS = {
+    "-ms-text-size-adjust",
+    "-webkit-text-size-adjust",
+    "body, table",
+    "cancelar suscripcion",
+    "cancelar suscripción",
+    "css",
+    "newsletter",
+    "no puedes ver el correo",
+    "politica de privacidad",
+    "política de privacidad",
+    "unsubscribe",
+    "version web",
+    "versión web",
+}
+
+
+_CONTEXT_MARKETING_TERMS = {
+    "bajan los precios",
+    "campaña",
+    "descuento",
+    "encuesta satisfaccion",
+    "encuesta satisfacción",
+    "hazte con tu regalo",
+    "oferta",
+    "promocion",
+    "promoción",
+    "prueba gratis",
+    "satisfaccion clientes",
+    "satisfacción clientes",
+    "view online",
+}
+
+
+_CONTEXT_LOW_SIGNAL_EMAIL_TERMS = {
+    "acceso bloqueado",
+    "actividad inusual",
+    "bloqueada temporalmente",
+    "cuenta esta en revision",
+    "cuenta está en revisión",
+}
+
+
+def _contains_any_text(text: str, terms: set[str]) -> bool:
+    if not text:
+        return False
+    return any(term in text for term in terms)
+
+
+def _context_quality_adjusted_score(score: float, row: Any) -> float:
+    """Apply deterministic tie-breaks for local search candidates.
+
+    The base scorer is intentionally simple, which can make boilerplate emails
+    tie with PDFs/contracts when a query has a few common terms. Keep this
+    adjustment small and explainable: strong document signals stay high, while
+    newsletter/CSS/legal-footer noise loses the tie.
+    """
+    try:
+        path = str(row["path"] or "")
+        file_type = str(row["file_type"] or "").strip().lower()
+        text = str(row["text"] or "")
+        summary = str(row["summary"] or "")
+    except Exception:
+        return max(0.0, min(float(score), 1.6))
+
+    haystack = f"{path}\n{summary}\n{text}".lower()
+    suffix = Path(path).suffix.lower()
+    adjustment = 0.0
+
+    if suffix in HIGH_VALUE_DOCUMENT_SUFFIXES or file_type in {"document", "spreadsheet", "presentation"}:
+        adjustment += 0.12
+    has_strong_document_signal = _contains_any_text(haystack, _CONTEXT_STRONG_DOCUMENT_TERMS)
+    if has_strong_document_signal:
+        adjustment += 0.12
+
+    if file_type == "email" or suffix in EMAIL_DOCUMENT_SUFFIXES:
+        if _contains_any_text(haystack, _CONTEXT_BOILERPLATE_TERMS):
+            adjustment -= 0.22
+        if _contains_any_text(haystack, _CONTEXT_MARKETING_TERMS):
+            adjustment -= 0.18
+        if _contains_any_text(haystack, _CONTEXT_LOW_SIGNAL_EMAIL_TERMS):
+            adjustment -= 0.16
+        if has_strong_document_signal:
+            adjustment += 0.08
+        else:
+            adjustment -= 0.22
+
+    base = min(float(score), 1.6)
+    return max(0.0, min(base + adjustment, 1.6))
+
+
 _QUERY_STOPWORDS = {
     "about",
     "archivos",
@@ -4739,7 +4851,7 @@ def _context_query_conn(
                 # unrelated chunks from a long document outrank direct evidence.
                 score = max(score, min(0.48, 0.28 + entity_score * 0.2))
         if score > 0:
-            scored.append((min(float(score), 1.6), row))
+            scored.append((_context_quality_adjusted_score(float(score), row), row))
     scored.sort(key=lambda item: item[0], reverse=True)
     scored = _rerank_scored_candidates(search_query, scored, limit=int(limit))
     assets = []

package/src/plugins/protocol.py

@@ -1289,6 +1289,59 @@ SPECIFIC_OK_AFTER_EVIDENCE_RE = re.compile(
     r".{0,120}\b(evidencia|evidence|smoke|verificad[oa]|verified)\b",
     re.IGNORECASE | re.DOTALL,
 )
+PUBLIC_RELEASE_EVIDENCE_RE = re.compile(
+    r"("
+    r"screenshot|captura|"
+    r"url\s+p[uú]blica|public\s+url|url-public|"
+    r"https?://[^\s]+|"
+    r"\bHTTP/?\d?(?:\.\d)?\s+200\b|"                   # HTTP 200, HTTP/1.1 200, HTTP/2 200
+    r"\b200\s+OK\b|"                                    # 200 OK
+    r"\bhttp[_\s-]?code\b[^\n]{0,40}\b200\b|"          # http_code: 200 (curl -w '%{http_code}')
+    r"\bstatus(?:[_\s-]?code)?\b[^\n]{0,20}\b200\b|"   # status 200 / status_code 200
+    r"\bc[oó]digo\b[^\n]{0,20}\b200\b"                 # código 200 / código de estado 200
+    r")",
+    re.IGNORECASE,
+)
+PUBLIC_RELEASE_WORK_RE = re.compile(
+    r"\b(release|deploy|deployment|publish|publicar|desplegar|lanzar|stable|producci[oó]n|production)\b",
+    re.IGNORECASE,
+)
+HIGH_STAKES_WORK_TYPES = {"release", "deploy", "deployment", "publish", "publicar", "desplegar"}
+
+
+def _normalize_artifact_hash(value: str) -> str:
+    clean = (value or "").strip().lower()
+    clean = re.sub(r"^(sha256|sha1|md5):", "", clean).strip()
+    return clean
+
+
+def _requires_irreversible_artifact_hash(closure_text: str, artifact_hash: str, validated_hash: str) -> tuple[bool, str]:
+    if not IRREVERSIBLE_ACTION_RE.search(closure_text):
+        return False, ""
+    current = _normalize_artifact_hash(artifact_hash)
+    validated = _normalize_artifact_hash(validated_hash)
+    if not current or not validated:
+        return True, "missing"
+    if current != validated:
+        return True, "mismatch"
+    return False, ""
+
+
+def _is_high_stakes_public_work(task: dict, work_type: str, stakes: str, closure_text: str) -> bool:
+    high_override = _parse_high_stakes_override(stakes or "")
+    high_stakes = bool(task.get("response_high_stakes")) if high_override is None else high_override
+    if not high_stakes:
+        return False
+    clean_work_type = (work_type or "").strip().lower()
+    if clean_work_type in HIGH_STAKES_WORK_TYPES:
+        return True
+    return bool(PUBLIC_RELEASE_WORK_RE.search(closure_text or ""))
+
+
+def _has_public_release_evidence(evidence: str) -> bool:
+    if _is_trivial_evidence(evidence)[0]:
+        return False
+    return bool(PUBLIC_RELEASE_EVIDENCE_RE.search(evidence or ""))
 
 
 def _active_followup_snapshot(limit: int = 5) -> list[dict]:
@@ -1729,6 +1782,10 @@ def handle_task_close(
     summary: str = "",
     verification: str = "",
     evidence_refs: str = "",
+    work_type: str = "",
+    stakes: str = "",
+    artifact_hash: str = "",
+    last_human_validation_of_artifact_hash: str = "",
 ) -> str:
     """Close a protocol task and automatically record the required discipline artifacts."""
     task = get_protocol_task(task_id.strip())
@@ -1865,6 +1922,41 @@ def handle_task_close(
                 ensure_ascii=False,
                 indent=2,
             )
+        hash_blocked, hash_reason = _requires_irreversible_artifact_hash(
+            closure_text,
+            artifact_hash,
+            last_human_validation_of_artifact_hash,
+        )
+        if hash_blocked:
+            debt = _ensure_open_debt(
+                task["session_id"],
+                task_id,
+                "irreversible_artifact_hash_unverified",
+                severity="error",
+                evidence=(
+                    "Irreversible action close lacks matching human-validated artifact hash. "
+                    f"reason={hash_reason} artifact_hash={_normalize_artifact_hash(artifact_hash)[:16]} "
+                    f"validated_hash={_normalize_artifact_hash(last_human_validation_of_artifact_hash)[:16]}"
+                ),
+                debts=debts_created,
+            )
+            return json.dumps(
+                {
+                    "ok": False,
+                    "error": "Cannot close irreversible publish/broadcast/payment action without a matching human-validated artifact hash.",
+                    "hint": (
+                        "Run the release decision in verify mode and retry with "
+                        "`artifact_hash` plus `last_human_validation_of_artifact_hash`; both values must match."
+                    ),
+                    "task_id": task_id,
+                    "blocked_by": "irreversible_artifact_hash",
+                    "debt_id": debt.get("id"),
+                    "debt_type": "irreversible_artifact_hash_unverified",
+                    "hash_status": hash_reason,
+                },
+                ensure_ascii=False,
+                indent=2,
+            )
 
     if (task.get("task_type") or "").strip() == "analyze" and clean_outcome == "done":
         artifact_paths = _existing_analyze_artifact_paths(all_evidence_refs)
@@ -2353,6 +2445,37 @@ def handle_task_close(
                     indent=2,
                 )
 
+    if (
+        clean_outcome == "done"
+        and _is_high_stakes_public_work(task, work_type, stakes, closure_text)
+        and not _has_public_release_evidence(live_surface_evidence)
+    ):
+        debt = _ensure_open_debt(
+            task["session_id"],
+            task_id,
+            "high_stakes_public_evidence_missing",
+            severity="error",
+            evidence=(
+                "High-stakes release/deploy/publish close lacked screenshot, public URL, or curl HTTP 200 evidence. "
+                f"Evidence provided: {live_surface_evidence[:240]!r}"
+            ),
+            debts=debts_created,
+        )
+        return json.dumps(
+            {
+                "ok": False,
+                "error": "Cannot close high-stakes release/deploy/publish as done without public verification evidence.",
+                "hint": "Attach screenshot path, public URL evidence, or curl output showing HTTP 200, then retry.",
+                "task_id": task_id,
+                "blocked_by": "high_stakes_public_evidence",
+                "debt_id": debt.get("id"),
+                "debt_type": "high_stakes_public_evidence_missing",
+                "response_mode": "verify",
+            },
+            ensure_ascii=False,
+            indent=2,
+        )
+
     if task.get("guard_has_blocking") and not files_changed_list:
         open_task_debts = list_protocol_debts(status="open", task_id=task_id, limit=200)
         has_guard_touch_violation = any(

package/src/presets/guardian_default.json

@@ -61,7 +61,7 @@
     "R23m_message_duplicate": "soft",
     "R23h_shebang_mismatch": "shadow",
     "R34_identity_coherence": "hard",
-    "R37_pre_answer_evidence_gate": "hard"
+    "R37_pre_answer_evidence_gate": "shadow"
   },
   "core_rules": [
     "R13_pre_edit_guard",

package/src/r23g_secrets_in_output.py

@@ -70,3 +70,40 @@ def should_inject_r23g(tool_name: str, tool_input) -> tuple[bool, str]:
         reason=reason,
     )
     return True, prompt
+
+
+# A secret READ on its own (cat .env, env, printenv) is benign: it stays on
+# the operator's machine and exposes nothing to a third party. A rotate/revoke
+# followup is only warranted when the same command also EXFILTRATES the output
+# to a third party — piped into a network/email/cloud/repo sink. Distinguishing
+# the two is what keeps R23g from minting un-closeable "rotate credential"
+# critical followups on every local read.
+_EXTERNAL_SINK_RE = re.compile(
+    r"(?:"
+    # piped into a transmitting client (network/email)
+    r"\|\s*(?:curl|wget|https?\b|nc|ncat|netcat|socat|mail|mailx|sendmail|mutt|msmtp|ssmtp|telnet)\b"
+    # curl/wget that upload a body
+    r"|\bcurl\b[^\n;|&]*(?:--data(?:-binary|-urlencode|-raw)?|--form|--upload-file|-d\b|-F\b|-T\b|-X\s*(?:POST|PUT|PATCH))"
+    r"|\bwget\b[^\n;|&]*(?:--post-data|--post-file|--body-data|--body-file)"
+    # direct mail senders
+    r"|\b(?:mail|mailx|sendmail|mutt|msmtp|ssmtp)\b"
+    # remote transfer / cloud upload
+    r"|\bscp\b[^\n;|&]*:"
+    r"|\brsync\b[^\n;|&]*[\w.-]+@[\w.-]+:"
+    r"|\baws\s+s3\b[^\n;|&]*\bcp\b|\bgsutil\b[^\n;|&]*\bcp\b|\bgcloud\s+storage\b[^\n;|&]*\bcp\b"
+    r"|\bgh\s+(?:gist\s+create|release\s+upload)\b"
+    # secret committed/pushed into a repository
+    r"|\bgit\s+(?:commit|push)\b"
+    # NEXO messaging / outbound channels
+    r"|\bnexo_(?:send|email_send)\b"
+    r")",
+    re.IGNORECASE,
+)
+
+
+def has_external_sink(cmd: str) -> bool:
+    """True when `cmd` pipes/sends its output to a third party (network, email,
+    cloud, remote host, repository). A bare local read returns False."""
+    if not isinstance(cmd, str) or not cmd.strip():
+        return False
+    return bool(_EXTERNAL_SINK_RE.search(cmd))

package/src/scripts/nexo-daily-self-audit.py

@@ -511,6 +511,48 @@ def _upsert_inline_learning(
     return {"ok": True, "action": "created", "learning_id": int(learning_id)}
 
 
+def _find_retired_learning_by_title(conn: sqlite3.Connection, title: str) -> sqlite3.Row | None:
+    if not _table_exists(conn, "learnings"):
+        return None
+    columns = _table_columns(conn, "learnings")
+    if "title" not in columns:
+        return None
+    status_expr = "COALESCE(status, 'active')"
+    return conn.execute(
+        f"""SELECT *
+            FROM learnings
+            WHERE title = ?
+              AND lower({status_expr}) IN ('archived', 'deleted', 'superseded')
+            ORDER BY updated_at DESC, id DESC
+            LIMIT 1""",
+        (title,),
+    ).fetchone()
+
+
+def _link_protocol_tasks_to_learning(
+    conn: sqlite3.Connection,
+    tasks: list[sqlite3.Row],
+    learning_id: int,
+) -> int:
+    if learning_id <= 0 or not tasks or not _table_exists(conn, "protocol_tasks"):
+        return 0
+    columns = _table_columns(conn, "protocol_tasks")
+    if "learning_id" not in columns or "task_id" not in columns:
+        return 0
+    task_ids = [str(row["task_id"]) for row in tasks if str(row["task_id"] or "").strip()]
+    if not task_ids:
+        return 0
+    placeholders = ",".join("?" for _ in task_ids)
+    cur = conn.execute(
+        f"""UPDATE protocol_tasks
+            SET learning_id = ?
+            WHERE task_id IN ({placeholders})
+              AND (learning_id IS NULL OR learning_id = 0)""",
+        [learning_id] + task_ids,
+    )
+    return int(cur.rowcount or 0)
+
+
 def _supersede_learning_inline(conn: sqlite3.Connection, *, keep_id: int, retire_id: int, note: str) -> bool:
     if not _table_exists(conn, "learnings"):
         return False
@@ -1336,6 +1378,13 @@ def check_error_memory_loop():
             prevention = (
                 f"Before working around {signature}, review this cluster and capture the prevention rule in the task contract."
             )
+            retired_learning = _find_retired_learning_by_title(conn, title)
+            if retired_learning:
+                linked = _link_protocol_tasks_to_learning(conn, items, int(retired_learning["id"]))
+                if linked:
+                    resolved += 1
+                continue
+
             result = _upsert_inline_learning(
                 conn,
                 category=area,
@@ -1348,6 +1397,7 @@ def check_error_memory_loop():
             )
             if result.get("ok"):
                 resolved += 1
+                _link_protocol_tasks_to_learning(conn, items, int(result.get("learning_id") or 0))
                 if applies_to:
                     _queue_public_core_handoff(
                         conn,

package/src/server.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 import os
 import signal
 import sys
+import threading
 import json
 import time
 from pathlib import Path
@@ -155,9 +156,25 @@ from local_context.db import close_local_context_db
 
 # ── Graceful shutdown: close DB on any termination signal ──────────
 def _shutdown_handler(signum, frame):
-    close_local_context_db()
-    close_db()
-    sys.exit(0)
+    # Guarantee the process actually dies on SIGTERM/SIGINT. A prior failure mode
+    # left orphaned servers ignoring SIGTERM for *days*: cleanup (close_db) blocked
+    # on a never-released lock and sys.exit() never ran while the stdio loop held
+    # the main thread. Arm a hard-exit watchdog FIRST, then best-effort close, then
+    # os._exit. WAL + autocommit means there is no open transaction to lose and the
+    # durable write queue replays unprocessed items on next start, so a hard exit is
+    # safe even if cleanup is skipped.
+    try:
+        watchdog = threading.Timer(3.0, lambda: os._exit(0))
+        watchdog.daemon = True
+        watchdog.start()
+    except Exception:
+        pass
+    try:
+        close_local_context_db()
+        close_db()
+    except Exception:
+        pass
+    os._exit(0)
 
 
 def _resolved_nexo_home() -> str:
@@ -360,6 +377,75 @@ def _load_startup_plugins() -> None:
     print(f"[NEXO] MCP essential plugins ready: {loaded} tools.", file=sys.stderr)
 
 
+def _select_reapable_servers(processes, *, self_pid, resident_pid):
+    """Pure selection: given ps rows [{pid, ppid, cmdline}], return the PIDs of
+    NEXO MCP servers that are safe to reap.
+
+    A server is reapable iff it is ORPHANED (ppid == 1 — its launching client is
+    gone, so it serves nobody) and runs a NEXO ``server.py``. We never touch a
+    server that still has a live parent (ppid != 1 → a connected client), nor the
+    warm runtime-service resident (``resident_pid``), nor ourselves (``self_pid``).
+    """
+    reapable: list[int] = []
+    for proc in processes:
+        try:
+            pid = int(proc.get("pid"))
+            ppid = int(proc.get("ppid"))
+        except (TypeError, ValueError):
+            continue
+        if pid in (self_pid, resident_pid):
+            continue
+        if ppid != 1:
+            continue  # has a live parent/client — leave it alone
+        cmd = str(proc.get("cmdline") or "")
+        if "server.py" not in cmd or "nexo" not in cmd.lower():
+            continue
+        reapable.append(pid)
+    return reapable
+
+
+def reap_orphaned_mcp_servers() -> int:
+    """Best-effort cleanup of orphaned NEXO MCP servers left behind by dead
+    clients. Runs once at stdio startup so the process count can't grow without
+    bound (the historical cause of SQLite contention + wedged servers). Never
+    raises; returns how many SIGTERMs were signalled."""
+    try:
+        import subprocess
+
+        self_pid = os.getpid()
+        resident_pid = -1
+        try:
+            from runtime_service import read_service_state
+
+            resident_pid = int((read_service_state() or {}).get("pid") or -1)
+        except Exception:
+            resident_pid = -1
+        proc = subprocess.run(
+            ["ps", "-eo", "pid=,ppid=,command="],
+            capture_output=True,
+            text=True,
+            timeout=5,
+        )
+        rows = []
+        for line in proc.stdout.splitlines():
+            parts = line.split(None, 2)
+            if len(parts) < 3:
+                continue
+            rows.append({"pid": parts[0], "ppid": parts[1], "cmdline": parts[2]})
+        reaped = 0
+        for pid in _select_reapable_servers(rows, self_pid=self_pid, resident_pid=resident_pid):
+            try:
+                os.kill(pid, signal.SIGTERM)
+                reaped += 1
+            except Exception:
+                pass
+        if reaped:
+            print(f"[NEXO] Reaped {reaped} orphaned MCP server(s).", file=sys.stderr)
+        return reaped
+    except Exception:
+        return 0
+
+
 def _server_init():
     """Run side effects needed by the MCP server.
 
@@ -376,6 +462,13 @@ def _server_init():
         with open(_pid_file, "w") as f:
             f.write(str(os.getpid()))
 
+    # ── Reap orphaned servers from dead clients (stdio only) ───────
+    # Defense against unbounded process growth: a client that crashed/reconnected
+    # leaves its old server orphaned (reparented to init, ppid==1). Those serve
+    # nobody yet still open the shared SQLite. Clean them on each fresh start.
+    if not _env_flag("NEXO_MCP_PROBE") and not is_runtime_service_process():
+        reap_orphaned_mcp_servers()
+
     # ── Database initialization with recovery ─────────────────────
     _init_db_or_exit()
 
@@ -773,8 +866,18 @@ def nexo_task_close(
     summary: str = "",
     verification: str = "",
     evidence_refs: str = "",
+    work_type: str = "",
+    stakes: str = "",
+    artifact_hash: str = "",
+    last_human_validation_of_artifact_hash: str = "",
 ) -> str:
-    """Close a protocol task with evidence and optional artifacts."""
+    """Close a protocol task with evidence and optional artifacts.
+
+    For high-stakes/irreversible closures (publish stable, broadcast, payment,
+    force-push, revoke) pass ``work_type``/``stakes`` plus ``artifact_hash`` and
+    ``last_human_validation_of_artifact_hash`` (both must match) so the close
+    gates can be satisfied instead of dead-ending.
+    """
     return handle_task_close(
         sid,
         task_id,
@@ -802,6 +905,10 @@ def nexo_task_close(
         summary,
         verification,
         evidence_refs,
+        work_type,
+        stakes,
+        artifact_hash,
+        last_human_validation_of_artifact_hash,
     )