nexo-brain 7.33.0 → 7.35.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.33.0",
+  "version": "7.35.0",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,7 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.33.0` is the current packaged-runtime line. Minor release - Cognitive OS Ola 1 (phase 2): memory search now finds by MEANING (observation embeddings + FTS/vector fusion), the KG/causal graph is read at answer time (kg_neighbors pre-answer source), local files are recalled via FTS5, nightly learning consolidation no longer times out, correction capture is reliable (soft), and the followup runner uses an atomic lock. Builds on v7.32.0 (causal-graph populate + workflow reaper + the 7.31.14 critical fixes).
+Version `7.35.0` is the current packaged-runtime line. Minor release - Cognitive OS Ola 4: selective forget lets you delete a leaked secret or a wrong memory and prove it is gone (zeroed across every live store, `secure_delete=ON`) or correct a fact reversibly, recurring failure archetypes are distilled into reusable diagnostic templates primed before a matching action (strong/weak marker tiers so benign success phrasing never triggers them, guidance-only), and closing a local-only followup-runner is no longer mis-flagged as an external real-world action. Builds on v7.34.0 (working memory + self-error learning + associative graph + deep-sleep rewrite + evals).
 
 Previously in `7.31.9`: patch release over v7.31.8 - UI release closeout now has to prove the original reported symptom was reopened with observable evidence before claiming the release is ready.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.33.0",
+  "version": "7.35.0",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/db/__init__.py

@@ -168,7 +168,7 @@ from db._entities import (
 # Episodic memory
 from db._episodic import (
     cleanup_old_changes, change_log_retention_days, change_log_retention_policy,
-    log_change, search_changes, update_change_commit, auto_resolve_followups,
+    log_change, search_changes, get_change_watermark, update_change_commit, auto_resolve_followups,
     cleanup_old_decisions, log_decision, update_decision_outcome,
     get_memory_review_queue, find_decisions_by_context_ref, search_decisions,
     cleanup_old_diaries, write_session_diary,
@@ -197,6 +197,7 @@ from db._protocol import (
     VALID_TASK_TYPES,
     VALID_CLOSE_OUTCOMES,
     create_protocol_task, get_protocol_task, close_protocol_task,
+    list_recent_closed_tasks,
     set_protocol_task_guard_acknowledged,
     create_protocol_debt, resolve_protocol_debts, list_protocol_debts,
     record_session_correction_requirement, list_session_correction_requirements,

package/src/db/_episodic.py

@@ -93,6 +93,38 @@ def search_changes(query: str = '', files: str = '', days: int = 30) -> list[dic
     return [dict(r) for r in rows]
 
 
+def get_change_watermark(sid: str | None = None) -> int:
+    """Cheap monotonic integer that rises whenever a relevant mutation lands.
+
+    Used by the resolution cache (working memory) as the "nothing changed"
+    invalidation signal — Francisco's third rule. ``change_log`` is the ledger
+    where the PostToolUse hook records every code/config/state mutation, so
+    ``MAX(id)`` is a one-SELECT, monotonic, append-only proxy for "did anything
+    change since I cached this answer?". If the watermark advanced, the cache
+    is invalidated by conservatism (prefer recomputing over serving stale).
+
+    ``sid`` optionally narrows the watermark to a single session's mutations.
+    Returns 0 when the ledger is empty or unavailable (which a fresh cache
+    entry will also store, so an empty ledger never spuriously invalidates).
+    """
+    try:
+        conn = get_db()
+        if sid:
+            row = conn.execute(
+                "SELECT MAX(id) FROM change_log WHERE session_id = ?", (str(sid),)
+            ).fetchone()
+        else:
+            row = conn.execute("SELECT MAX(id) FROM change_log").fetchone()
+    except Exception:
+        return 0
+    if not row or row[0] is None:
+        return 0
+    try:
+        return int(row[0])
+    except (TypeError, ValueError):
+        return 0
+
+
 def auto_resolve_followups(change: dict) -> list[str]:
     """Cross-reference a change_log entry with open followups. Auto-completes matches.
 

package/src/db/_hot_context.py

@@ -570,6 +570,21 @@ def build_pre_action_context(
     reminders = _find_related_items("reminders", clean_query, hours=hours, limit=4) if clean_query else []
     followups = _find_related_items("followups", clean_query, hours=hours, limit=4) if clean_query else []
 
+    # Ola 4 SCHEMA-ABSTRACTION: if the current action CLEARLY matches a distilled
+    # recurring-incident archetype (e.g. "cron exit 0 but the tool failed
+    # silently"), prime the complete diagnosis instead of re-diagnosing from
+    # scratch. Best-effort, non-authoritative, precision-first: a template is
+    # surfaced only on a clear archetype match, never in general, and it NEVER
+    # blocks. Any failure here must not break pre-action context.
+    diagnostic_templates: list[dict] = []
+    if clean_query:
+        try:
+            import schema_abstraction as sa
+
+            diagnostic_templates = sa.match_templates_for_action(query=clean_query, limit=1)
+        except Exception:
+            diagnostic_templates = []
+
     return {
         "query": clean_query,
         "context_key": clean_key,
@@ -578,7 +593,8 @@ def build_pre_action_context(
         "events": events,
         "reminders": reminders,
         "followups": followups,
-        "has_matches": bool(contexts or events or reminders or followups),
+        "diagnostic_templates": diagnostic_templates,
+        "has_matches": bool(contexts or events or reminders or followups or diagnostic_templates),
     }
 
 
@@ -592,6 +608,19 @@ def format_pre_action_context_bundle(bundle: dict, *, compact: bool = False) ->
         header += f" — query: {bundle['query'][:120]}"
     lines.append(header)
 
+    # Ola 4: primed diagnosis from a matched recurring-incident archetype goes
+    # FIRST — the whole point is to lead with the right diagnosis.
+    templates = bundle.get("diagnostic_templates") or []
+    if templates:
+        try:
+            import schema_abstraction as sa
+
+            rendered = sa.format_templates_for_injection(templates)
+            if rendered:
+                lines.append(rendered)
+        except Exception:
+            pass
+
     contexts = bundle.get("contexts") or []
     if contexts:
         lines.append("Contexts:")

package/src/db/_protocol.py

@@ -436,6 +436,41 @@ def close_protocol_task(
     return get_protocol_task(task_id) or {}
 
 
+def list_recent_closed_tasks(
+    *,
+    outcome: str = "done",
+    exclude_task_id: str = "",
+    limit: int = 200,
+    within_days: int = 0,
+) -> list[dict]:
+    """Return recently CLOSED protocol tasks for self-error detection.
+
+    Read-only. Ordered most-recent-first by ``closed_at``. The self-error
+    detector compares the just-closed task against these prior closures to
+    spot a later action that corrects something a previous task already
+    claimed as ``done``. Kept deliberately narrow (status filter + small
+    limit) so it never scans the whole history on every close.
+    """
+    conn = get_db()
+    clauses = ["status = ?", "closed_at IS NOT NULL"]
+    params: list[object] = [str(outcome).strip() or "done"]
+    if exclude_task_id:
+        clauses.append("task_id != ?")
+        params.append(exclude_task_id.strip())
+    if within_days and within_days > 0:
+        clauses.append("closed_at >= datetime('now', ?)")
+        params.append(f"-{int(within_days)} days")
+    where = " AND ".join(clauses)
+    rows = conn.execute(
+        f"""SELECT * FROM protocol_tasks
+            WHERE {where}
+            ORDER BY closed_at DESC
+            LIMIT ?""",
+        (*params, max(1, int(limit))),
+    ).fetchall()
+    return [dict(row) for row in rows]
+
+
 def create_protocol_debt(
     session_id: str,
     debt_type: str,

package/src/db/_schema.py

@@ -2714,6 +2714,68 @@ def _m75_failure_prevention_ledger(conn):
     _migrate_add_index(conn, "idx_antibody_actions_verification", "antibody_actions", "verification_status, review_due_at")
 
 
+def _m88_schema_abstraction_templates(conn):
+    """Ola 4 — diagnostic templates distilled from recurring incident archetypes.
+
+    NOTE (append-only migration discipline): this used to be called inline from
+    ``_m75_failure_prevention_ledger`` (as ``_m75b_...``). That meant any install
+    already at schema v75 would NEVER create ``diagnostic_templates`` through
+    ``run_migrations()`` (v75 was already marked applied), so the table only
+    appeared via the lazy ``_ensure_tables`` fallback. Promoting it to its own
+    appended migration version makes a normal upgrade from v75 create the table
+    through the standard migration path. Idempotent (``IF NOT EXISTS``), so it is
+    a no-op on installs where ``_ensure_tables``/the old inline call already
+    created it.
+
+    A diagnostic template is the destillation of a GENUINELY recurring class of
+    incident (>= MIN_CLUSTER_SIZE distinct failure cases of the same archetype,
+    by symptom similarity) into a reusable, complete-diagnosis-first checklist
+    that primes the right diagnosis instantly when the archetype reappears,
+    instead of re-diagnosing from scratch (Francisco's canonical case: "cron
+    exit 0 but the tool failed in SILENCE").
+
+    Non-authoritative guidance: templates never block; they only inject a primed
+    diagnosis into pre_action_context on a clear archetype match. Idempotent:
+    deduped by ``template_uid`` (stable hash of archetype key). A template is
+    minted only at high confidence; ambiguity yields nothing (a low-confidence
+    candidate, never an active template).
+    """
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS diagnostic_templates (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            template_uid TEXT NOT NULL UNIQUE,
+            policy_version TEXT NOT NULL DEFAULT 'schema_abstraction.v1',
+            archetype TEXT NOT NULL,
+            archetype_key TEXT NOT NULL,
+            failure_type TEXT NOT NULL DEFAULT 'other',
+            area TEXT NOT NULL DEFAULT '',
+            symptom_pattern TEXT NOT NULL DEFAULT '',
+            diagnosis_steps_json TEXT NOT NULL DEFAULT '[]',
+            prevention TEXT NOT NULL DEFAULT '',
+            match_tokens_json TEXT NOT NULL DEFAULT '[]',
+            member_uids_json TEXT NOT NULL DEFAULT '[]',
+            incident_count INTEGER NOT NULL DEFAULT 0,
+            confidence REAL NOT NULL DEFAULT 0.0,
+            status TEXT NOT NULL DEFAULT 'active',
+            privacy_level TEXT NOT NULL DEFAULT 'normal',
+            created_at REAL NOT NULL,
+            updated_at REAL NOT NULL,
+            retired_at REAL,
+            retired_reason TEXT NOT NULL DEFAULT '',
+            metadata_json TEXT NOT NULL DEFAULT '{}',
+            CHECK(status IN ('active','candidate','retired','superseded')),
+            CHECK(privacy_level IN ('public','normal','private','sensitive','secret')),
+            CHECK(incident_count >= 0),
+            CHECK(confidence >= 0.0 AND confidence <= 1.0)
+        )
+        """
+    )
+    _migrate_add_index(conn, "idx_diagnostic_templates_archetype", "diagnostic_templates", "archetype_key")
+    _migrate_add_index(conn, "idx_diagnostic_templates_status", "diagnostic_templates", "status, area")
+    _migrate_add_index(conn, "idx_diagnostic_templates_type", "diagnostic_templates", "failure_type, status")
+
+
 def _m76_semantic_layers(conn):
     """SemanticLayers cache for compact, source-backed continuity.
 
@@ -3213,6 +3275,108 @@ def _m83_observation_embeddings(conn):
     conn.commit()
 
 
+def _m85_eval_runs(conn):
+    """Time series for the memory eval bench (recall@k / MRR / semantic gain).
+
+    One row per (run, metric) so the table is queryable as a series: the
+    before/after delta of an Ola 1 change is just two rows for the same metric
+    with different ``ola1_enabled``. ``model_warm`` distinguishes numbers from
+    the real embedding model (1) vs the deterministic offline fallback (0), so
+    a CI run (fallback, pipeline check) is never confused with a Deep Sleep run
+    (real model, semantic quality). Append-only and additive — re-running the
+    harness inserts new rows, never mutates old ones.
+
+    Mirrors the existing _m28_automation_runs / _m34_cortex_evaluations shape.
+    """
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS eval_runs (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            suite TEXT NOT NULL DEFAULT '',
+            case_set_id TEXT DEFAULT '',
+            case_set_version TEXT DEFAULT '',
+            fixture_hash TEXT DEFAULT '',
+            metric TEXT NOT NULL DEFAULT '',
+            value REAL NOT NULL DEFAULT 0.0,
+            ola1_enabled INTEGER NOT NULL DEFAULT 1,
+            model_warm INTEGER NOT NULL DEFAULT 0,
+            created_at TEXT DEFAULT (datetime('now'))
+        )
+        """
+    )
+    conn.execute("CREATE INDEX IF NOT EXISTS idx_eval_runs_suite ON eval_runs(suite)")
+    conn.execute("CREATE INDEX IF NOT EXISTS idx_eval_runs_metric ON eval_runs(suite, metric)")
+    conn.execute("CREATE INDEX IF NOT EXISTS idx_eval_runs_created ON eval_runs(created_at)")
+    conn.commit()
+
+
+def _m86_resolution_cache(conn):
+    """Working-memory / resolution cache for the pre-answer router and repo maps.
+
+    Non-authoritative, like semantic_layers (_m76): the canonical facts still
+    live in diary/workflows/tasks/evidence/memory/learnings/change_log and in
+    the git repos themselves. This table only caches the FINAL organized
+    result of a retrieval (a ``PreAnswerRoute.to_dict()`` for ``kind='route'``)
+    or a lightweight repo snapshot (``kind='repo_map'``), keyed by a
+    deterministic ``cache_key`` (route_cache_key | ``repo:{project_key}``).
+
+    The anti-stale contract (Francisco's rule of gold) lives in the read path
+    (``resolution_cache.is_valid``): a HIT is only valid when ALL hold —
+    (1) now() < expires_at, (2) status=='fresh',
+    (3) source_fingerprint recomputed == stored, (4) change_watermark global ==
+    stored. The columns below exist to support exactly that check. The
+    ``instant`` tier (ttl=0) never writes here.
+    """
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS resolution_cache (
+            cache_key          TEXT PRIMARY KEY,
+            kind               TEXT NOT NULL DEFAULT 'route',
+            intent             TEXT NOT NULL DEFAULT '',
+            area               TEXT NOT NULL DEFAULT '',
+            sid                TEXT NOT NULL DEFAULT '',
+            result_json        TEXT NOT NULL,
+            source_fingerprint TEXT NOT NULL,
+            source_refs_json   TEXT NOT NULL DEFAULT '[]',
+            change_watermark   INTEGER NOT NULL DEFAULT 0,
+            status             TEXT NOT NULL DEFAULT 'fresh',
+            policy_version     TEXT NOT NULL DEFAULT '',
+            resolved_at        REAL NOT NULL,
+            expires_at         REAL NOT NULL DEFAULT 0,
+            hit_count          INTEGER NOT NULL DEFAULT 0,
+            CHECK(kind IN ('route', 'repo_map')),
+            CHECK(status IN ('fresh', 'stale', 'expired', 'invalid'))
+        )
+        """
+    )
+    _migrate_add_index(conn, "idx_resolution_cache_status_exp", "resolution_cache", "status, expires_at")
+    _migrate_add_index(conn, "idx_resolution_cache_kind", "resolution_cache", "kind, sid")
+    _migrate_add_index(conn, "idx_resolution_cache_fingerprint", "resolution_cache", "source_fingerprint")
+    conn.commit()
+
+
+def _m87_resolution_cache_content_snapshot(conn):
+    """Per-row content snapshot for the resolution cache's anti-stale check.
+
+    The fingerprint (``source_fingerprint``) is a single opaque digest over the
+    versions of the consulted refs. It proved the AGGREGATE changed but could
+    not by itself say WHICH ref moved, and — more importantly — it relied on
+    ``semantic_layers.source_version_for`` keyed by CANONICAL prefixes
+    (``followup:``), while the pre-answer router emits its own SOURCE-NAME refs
+    (``followups:``). Those source-name refs resolved to an ``unsupported``
+    namespace → empty version → an inert fingerprint, so a followup completed by
+    a plain UPDATE (no change_log write → watermark unmoved) was served stale.
+
+    This column stores an explicit ``{ref: version}`` map captured from the REAL
+    rows at write time (``resolution_cache.row_version_snapshot``). On read we
+    re-read those same rows by id and compare — the snapshot is now the PRIMARY
+    freshness guarantee; TTL and the global watermark remain cheap fast-fails.
+    Idempotent, append-only ALTER (non-destructive).
+    """
+    _migrate_add_column(conn, "resolution_cache", "content_snapshot_json", "TEXT NOT NULL DEFAULT '{}'")
+    conn.commit()
+
+
 MIGRATIONS = [
     (1, "learnings_columns", _m1_learnings_columns),
     (2, "followups_reasoning", _m2_followups_reasoning),
@@ -3297,6 +3461,10 @@ MIGRATIONS = [
     (81, "core_rules_product_metadata", _m81_core_rules_product_metadata),
     (82, "confidence_checks", _m82_confidence_checks),
     (83, "observation_embeddings", _m83_observation_embeddings),
+    (85, "eval_runs", _m85_eval_runs),
+    (86, "resolution_cache", _m86_resolution_cache),
+    (87, "resolution_cache_content_snapshot", _m87_resolution_cache_content_snapshot),
+    (88, "schema_abstraction_templates", _m88_schema_abstraction_templates),
 ]
 
 

package/src/email_sent_events.py

@@ -8,6 +8,7 @@ sent even when the send path did not originate from an inbound email row.
 from __future__ import annotations
 
 import json
+import os
 import sqlite3
 from datetime import datetime, timedelta
 from pathlib import Path
@@ -43,6 +44,12 @@ RECENT_SENT_EMAILS_TITLE = "EMAILS ENVIADOS ULTIMAS 24H POR LA OPERATIVA"
 
 
 def sent_email_db_path() -> Path:
+    # NEXO_EMAIL_DB lets tests (and the selective-forget live-DB enumerator)
+    # isolate / discover the email store deterministically without rewiring
+    # NEXO_HOME. Falls back to the canonical runtime location.
+    override = os.environ.get("NEXO_EMAIL_DB", "").strip()
+    if override:
+        return Path(override).expanduser()
     return paths.nexo_email_dir() / "nexo-email.db"
 
 

package/src/local_context/usage_events.py

@@ -352,6 +352,7 @@ def record_router_usage(
     elapsed_ms: int | None = None,
     deadline_ms: int | None = None,
     used_before_response: bool = True,
+    cache_hit: bool = False,
     db_path: str | os.PathLike[str] | None = None,
 ) -> dict[str, Any]:
     evidence_refs = router_payload.get("evidence_refs") or []
@@ -374,6 +375,7 @@ def record_router_usage(
         "escalated_from": router_payload.get("escalated_from") or budget_policy.get("escalated_from") or "",
         "escalated_to": router_payload.get("escalated_to") or budget_policy.get("escalated_to") or "",
         "route_cache_key": budget_policy.get("route_cache_key") or "",
+        "cache_hit": bool(cache_hit or router_payload.get("cache_hit")),
         "max_sources": budget_policy.get("max_sources") or 0,
         "max_source_timeout_ms": budget_policy.get("max_source_timeout_ms") or 0,
         "allowed_sources": budget_policy.get("allowed_sources") or [],