nexusmem 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -11,6 +11,63 @@ built from, matched by publish timestamp: `v0.1.0` → `67a4776`, `v0.1.1` → `
 
 No unreleased changes yet.
 
+## [0.9.0] — 2026-08-27
+
+Closes the three remaining mechanisms from a recurring external review (Simon Strandgaard, Agent
+Memory Atlas): trust_state, bi-temporal reads, and a dismiss verb for standing suggestions. Also
+fixes two real Windows-specific correctness bugs found dogfooding.
+
+### Added
+
+- `nodes.trust_state` (`candidate` | `verified` | `rejected`, schema V10) and `nexusmem review
+  <nodeId> --verify|--reject`: a human verdict on a node, independent of the SLM contradiction
+  checker. `--reject` down-weights ranking (harsher than the existing supersede penalty, since a
+  human said no directly); `--verify` is a label only, no ranking boost. Both render as a tag in
+  packed context. Never deletes — same demote-not-delete rule as `mark-stale`.
+- `--as-of <date>` on `nexusmem query` and the MCP `search_memory` tool: restricts both the BM25
+  and vector arms to nodes recorded at or before that instant via `created_at` (record time),
+  independent of how old the events themselves (`ts`, event time) are. Read-only — there is no
+  equivalent write, and nodes stay write-once.
+- `nexusmem stale --dismiss`: silences a contradiction suggestion the user disagrees with, without
+  fabricating a `supersedes` relationship. Previously a wrong `--check-contradictions` verdict had
+  no way to be rejected — it re-decorated every future `stale`/`sync` run forever.
+- `--prune-source`/`--prune-stale-shell` now record a `mutation_audit` row on their `--yes` path,
+  matching what `forget` already did. The dry-run preview stays a pure read.
+
+### Fixed
+
+- `git rev-parse` failures reported as "error launching git: Access is denied." (Git for Windows'
+  launcher shim failing to exec `git.exe` under handle/AV contention) were treated as git's own
+  verdict instead of a transient spawn failure, turning a one-off environment hiccup into a hard
+  failure. Now retried the same as the other known transient-spawn classes.
+- The PowerShell prompt hook read only `$LASTEXITCODE`, which cmdlets (`Remove-Item`, `Copy-Item`,
+  …) never set — every failing cmdlet was silently logged as a success, and a stale
+  `$LASTEXITCODE` from an earlier native command could misattribute to later successful cmdlet
+  runs. Now reads `$?` alongside `$LASTEXITCODE`, before anything else can overwrite `$?`.
+
+## [0.8.0] — 2026-08-22
+
+### Added
+
+- Provenance widened from 2 tiers to a 4-tier trust hierarchy: `observed` (commits, diffs, shell
+  exit codes) > `authored` (doc sections — human-written claims) > `recorded` (conversation turns —
+  verbatim discourse) > `derived` (session summaries — a model's distillation). Schema V7 backfills
+  existing databases by kind. The ranker decays each tier at its own rate (lower trust fades
+  faster); the ordering is the design claim, the exact ratios are documented judgment calls.
+- Contradiction checking now runs automatically during `sync`: at most 3 new SLM judgments per run
+  (`contradictions.maxPerSync`; `contradictions.autoCheck: false` turns it off), gated on the
+  embedding provider already being reachable. Every judgment — either verdict — is memoized in a new
+  `contradiction_checks` table (schema V8), so a judged pair is never sent to the model again and
+  repeat syncs converge to zero model calls. Measured live against this repo's own database: 5.4s
+  for the first 10 judgments, 0.5s for the identical re-run. Still suggest-only: nothing ever writes
+  `supersedes` automatically.
+- Standing suggestions now surface everywhere without a model in the loop: plain `nexusmem stale`
+  decorates flagged candidates from the memoized judgments (instant, offline), `nexusmem status`
+  gains a `flagged` line, and the sync summary reports new/open suggestion counts.
+- `stale --check-contradictions` reuses each candidate's stored embedding instead of re-embedding
+  it, and stops after two consecutive null SLM replies so a down provider costs at most two timeouts
+  rather than one per candidate.
+
 ## [0.7.0] — 2026-08-21
 
 ### Added
@@ -481,7 +538,9 @@ First public release.
   there is no local-model summarization pass, and the conversation collector has never been audited
   for the stale-node bug that was found and fixed in the docs collector.
 
-[Unreleased]: https://github.com/yaminbkk/NexusMem/compare/v0.7.0...HEAD
+[Unreleased]: https://github.com/yaminbkk/NexusMem/compare/v0.9.0...HEAD
+[0.9.0]: https://github.com/yaminbkk/NexusMem/compare/v0.8.0...v0.9.0
+[0.8.0]: https://github.com/yaminbkk/NexusMem/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/yaminbkk/NexusMem/compare/v0.6.0...v0.7.0
 [0.6.0]: https://github.com/yaminbkk/NexusMem/compare/v0.5.4...v0.6.0
 [0.5.4]: https://github.com/yaminbkk/NexusMem/compare/v0.5.3...v0.5.4

package/README.md

@@ -24,7 +24,7 @@ exists nowhere else, and it disappears when your terminal scrollback rolls over.
 **Contents:** [Try it](#try-it) · [Exact shell capture](#optional-exact-shell-capture) ·
 [Failure → fix chains](#failure--fix-chains-opt-in) · [How retrieval works](#how-retrieval-works) ·
 [Session summaries](#session-summaries-optional-local-model) · [Use it from an agent](#use-it-from-an-agent)
-· [What it costs you](#what-it-costs-you) · [Manual staleness & provenance](#manual-staleness--provenance) ·
+· [What it costs you](#what-it-costs-you) · [Staleness & provenance](#staleness--provenance) ·
 [Where it breaks](#where-it-breaks) · [Commands](#commands) · [Cross-project recall](#recall-across-projects)
 · [On disk](#on-disk) · [Development](#development)
 
@@ -48,11 +48,11 @@ Relevant history for: windows spawn failure
   readRepoInfo collapsed three unrelated failures into one error: git running and reporting
   the path is not a work tree, git not being installed, and the process failing to spawn at
   all. Dogfooding hit the third case in two separate sessions...
-- 2026-08-09 [inferred] README.md — Before a tagged release
+- 2026-08-09 [authored] README.md — Before a tagged release
   - [ ] Retry on transient process-spawn failures on Windows
 ```
 
-`[observed]`/`[inferred]` is the provenance tag (see [Manual staleness & provenance](#manual-staleness--provenance))
+`[observed]`/`[authored]` is the provenance tag (see [Staleness & provenance](#staleness--provenance))
 — a commit is a directly observed event, a doc section is a written claim that could go stale.
 
 A commit and a docs section, ranked against each other, inside whatever token budget you gave it.
@@ -248,7 +248,9 @@ One thing that is not a percentage: shell commands and conversation turns have n
 equivalent. Without something recording them, they are gone, not merely more expensive to find.
 
 For how these numbers compare to a similar tool's own claims, see
-[`docs/competitor-comparison.md`](docs/competitor-comparison.md).
+[`docs/competitor-comparison.md`](docs/competitor-comparison.md) (vs. projectmem) and
+[`docs/competitor-comparison-yesmem.md`](docs/competitor-comparison-yesmem.md) (vs. YesMem, including
+native Windows support vs. its documented WSL2 requirement).
 
 Latency on a ~530-node corpus, warm, p50 over 10 runs:
 
@@ -269,19 +271,23 @@ Two things a memory layer needs and this one only partly has: a way to tell an o
 guess, and a way to retire a conclusion once something contradicts it. This section is what exists
 and what doesn't.
 
-Every node carries a `provenance`: `observed` (a commit that landed, a shell command's real exit
-code) or `inferred` (a conversation turn, a session summary, a doc section — all readable as claims
-that could be wrong or go stale). Set once per collector at ingest time, shown as a `[observed]` /
-`[inferred]` tag on every query result, and now used to decay retrieval weight too — `inferred` nodes
-fade from ranking twice as fast as `observed` ones as they age.
+Every node carries a `provenance`, a four-tier trust hierarchy set once per collector at ingest
+time: `observed` (a commit that landed, a shell command's real exit code) > `authored` (a doc
+section — a human's own written claim) > `recorded` (a conversation turn — verbatim, but talk about
+events rather than the events) > `derived` (a session summary — a model's distillation). The tier is
+shown as a tag on every query result and decays retrieval weight — the lower the trust, the faster a
+node fades from ranking as it ages. The ordering is the design claim; the exact decay ratios are
+judgment calls, not measured optima.
 
 ```bash
 nexusmem stale
 ```
 
-Lists `inferred` nodes old enough (45+ days by default) that nothing has confirmed they still hold —
-a heuristic on age and provenance, not on content. It writes nothing; you decide which candidates are
-actually wrong.
+Lists non-`observed` nodes old enough (45+ days by default) that nothing has confirmed they still
+hold — a heuristic on age and provenance, not on content. It writes nothing; you decide which
+candidates are actually wrong. Any candidate the SLM has already flagged (see below) is decorated
+with its standing `likely superseded by` suggestion — reading those costs nothing, so the plain
+command stays instant and offline.
 
 ```bash
 nexusmem mark-stale <oldNodeId> --supersedes <newNodeId>
@@ -297,15 +303,35 @@ nexusmem stale --check-contradictions
 For each candidate, finds the most similar newer node (local embedding search) and asks a local SLM
 (Ollama, `qwen2.5:3b` by default) whether it actually contradicts the older one — real content
 comparison, not just age. A match is printed as `likely superseded by <id> <title> -- <reason>`
-under the candidate; nothing is written, same as plain `stale`. Needs Ollama running; costs one
-embedding call and, when a plausible newer node exists, one chat completion per candidate (capped at
-10 by default — pass `-n` to raise it).
+under the candidate. Every judgment (either verdict) is memoized, so a judged pair is never sent to
+the model again; nothing else is written — `supersedes` stays yours to set via `mark-stale`.
+
+**This also runs automatically during `sync`** — at most 3 new judgments per run (configurable via
+the `contradictions` block in `.nexusmem/config.json`; set `autoCheck: false` to turn it off), only
+when the embedding provider was reachable anyway, and free on repeat syncs thanks to the
+memoization. New and open suggestions show up in the sync summary, `nexusmem status` (a `flagged`
+line), and plain `nexusmem stale`.
 
 **What this doesn't do:** it is one small model's yes/no judgment on one older/newer pair, not a
 verified fact — treat a match as a lead to check, not a conclusion. It also only ever compares a
 candidate against nodes *found by embedding similarity*; a contradiction from an unrelated-sounding
-node would never surface. Real contradiction detection (comprehensively, not just for the pair the
-vector search happens to surface) is still an open problem.
+node would never surface. Comprehensive contradiction detection (not just for the pair the vector
+search happens to surface) is still an open problem, and nothing here supersedes a node on its own.
+
+`provenance` is a separate question from `trust_state`: provenance says where a claim came from,
+never whether anyone checked it.
+
+```bash
+nexusmem review <nodeId> --verify
+nexusmem review <nodeId> --reject
+```
+
+Records your own verdict on one node, independent of the SLM contradiction checker above (which only
+ever writes a suggestion, never a verdict). `--reject` down-weights the node in ranking — same
+demote-not-delete rule as `mark-stale`, it stays queryable, just usually loses to better matches —
+and both verdicts are shown as a `[verified]`/`[rejected]` tag on every query result that returns the
+node afterward. `--verify` is a label only; it does not boost ranking. Every node starts `candidate`
+(untagged) until reviewed, and a re-sync never overwrites a verdict once one is set.
 
 ## Where it breaks
 
@@ -372,16 +398,20 @@ vector search happens to surface) is still an open problem.
 
 ## Commands
 
-`init`, `sync`, `query <text>`, `status` (add `--share` for a plain-text summary worth pasting
-somewhere), `projects`, `mcp`, `forget <value>`, `stale` (add `--check-contradictions` for a local-SLM
-content check, see above), `mark-stale <nodeId> --supersedes <newNodeId>`, and
-`hook install|remove|status`.
-
-There are also five dry-run previews (`scan-git`, `scan-diff`, `scan-shell`, `scan-docs`,
-`scan-conversation`)
-that write nothing and print the nodes ingestion *would* create along with their signal scores. That
-is the intended way to tune scoring against a real repository before committing to a change. Add
-`--json` to pipe them somewhere.
+`init`, `sync`, `query <text>` (add `--as-of <date>` for a bi-temporal read, see below), `status` (add
+`--share` for a plain-text summary worth pasting somewhere), `projects`, `mcp`, `forget <value>`,
+`stale` (add `--check-contradictions` for a local-SLM content check, see above), `mark-stale
+<nodeId> --supersedes <newNodeId>`, `review <nodeId> --verify|--reject` (record a human verdict on
+one node, see above), `precheck` (advisory — warns about staged files with an unresolved past
+failure or high recent churn; exits 0 unless `--strict`), `hook install|remove|status` (the
+PowerShell exit-code hook), and `hook git install|remove|status` (a git pre-commit hook that runs
+`precheck` before each commit).
+
+There are also seven dry-run previews (`scan-git`, `scan-diff`, `scan-shell`, `scan-docs`,
+`scan-conversation`, `scan-session`, `scan-structure`) that write nothing and print what ingestion
+*would* produce — nodes and their signal scores for the first six, import-graph edges for
+`scan-structure`. That is the intended way to tune scoring against a real repository before
+committing to a change. Add `--json` to pipe them somewhere.
 
 Every command takes `-C <path>` to target another repository. On `sync`, `--conversation` opts the
 transcript source in for one run without persisting it, `--no-embed` skips the vector pass,
@@ -414,6 +444,24 @@ scope   2 project(s): NexusMem, uploader
 - 2026-08-09 [observed] [NexusMem] fix(git): retry a transient failure to spawn git
 ```
 
+## Bi-temporal reads
+
+Every node carries two clocks: `ts`, the event's own time ("what happened then"), and `created_at`,
+the moment the store actually recorded it ("what did the store hold then") — normally the same
+question, but not when a sync runs late, a backfill lands weeks after the events it describes, or a
+teammate's clone catches up all at once. `query`/`search_memory` answer the first by default;
+`--as-of <date>` switches to the second:
+
+```bash
+nexusmem query "why does the ranker cap joint priors" --as-of 2026-08-10
+```
+
+Only nodes recorded at or before that instant are considered, even if the events they describe are
+older still. There is no equivalent write — this is a read-time filter over `created_at`, not a
+snapshot or a way to query a value that has since changed, since nodes are write-once (see
+[Staleness & provenance](#staleness--provenance) for what changes a node's *weight*, not its
+record).
+
 Databases stay per-repository — there is no shared global store, and deleting one repo's
 `.nexusmem/` still removes exactly that repo's memory. What makes the others findable is a plain
 index at `~/.nexusmem/projects.json`, written by `init` and refreshed by every `sync`. `nexusmem
@@ -449,7 +497,7 @@ Deleting `.nexusmem/` loses nothing that `sync` cannot rebuild.
 
 ## Status
 
-Ingestion, hybrid retrieval, budgeted packing and the MCP server all work and are covered by 493
+Ingestion, hybrid retrieval, budgeted packing and the MCP server all work and are covered by 701
 tests running on Linux and Windows across Node 22 and 24.
 
 ## Development