brainiac-cli 0.18.0__tar.gz → 0.18.2__tar.gz

{brainiac_cli-0.18.0/src/brainiac_cli.egg-info → brainiac_cli-0.18.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brainiac-cli
-Version: 0.18.0
+Version: 0.18.2
 Summary: Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index).
 License-Expression: Apache-2.0
 Requires-Python: >=3.9

{brainiac_cli-0.18.0 → brainiac_cli-0.18.2}/pyproject.toml

@@ -8,7 +8,7 @@ build-backend = "setuptools.build_meta"
 # check. The IMPORT package stays `brain` and the console script stays
 # `brain` — only the distribution/project name changes.
 name = "brainiac-cli"
-version = "0.18.0"
+version = "0.18.2"
 description = "Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index)."
 readme = "README.md"
 license = "Apache-2.0"

{brainiac_cli-0.18.0 → brainiac_cli-0.18.2}/src/brain/_assets/scripts/brain-brief.sh

@@ -63,6 +63,14 @@ fi
 
 {
   echo "=== brain-daily-brief / brain-nightly $(date -u +%Y-%m-%dT%H:%M:%SZ) ==="
+  # cos-broker FIRST: the host broker fold claims VM proposal drops, releases due
+  # holds, runs auto-capture, enqueues the owner batch, and renders
+  # shared/spine-summary.md. Nothing else schedules it -- without this line the
+  # VM proposes into a drop dir no one drains (measured 2026-07-16: spine DB empty,
+  # candidates unclaimed ~29h) . It runs BEFORE maintain so notes it signs are
+  # indexed + published by the same run's sync. Host-only, idempotent, and
+  # NON-FATAL: a broker failure must never cost the vault its capture-drain floor.
+  "$BRAIN_BIN" cos-broker --json || echo "brain-brief: cos-broker fold failed (non-fatal), continuing to maintain"
   # maintain: sync --publish (drain pending captures + reconcile index +
   # republish snapshot) + brief, THEN whichever of health/integrity/digest is
   # due today (date-gated). graphify is documented-only (no build invoked --

{brainiac_cli-0.18.0 → brainiac_cli-0.18.2}/src/brain/_version.py

@@ -9,4 +9,4 @@ pip-installed host, importlib.metadata stays primary; brain/__init__.py reads
 this file only as the fallback before 0.0.0+unknown.
 """
 
-__version__ = "0.18.0"
+__version__ = "0.18.2"

{brainiac_cli-0.18.0 → brainiac_cli-0.18.2}/src/brain/core.py

@@ -482,6 +482,28 @@ class BrainCore:
                 except ValueError as exc:
                     skipped.append({"draft": draft.name, "reason": f"unsafe-id (fail-closed): {exc}"})
                     continue
+                # COS owner-gate integrity: never sign a draft whose id is still
+                # awaiting the owner's accept/reject in the proposal pipeline.
+                # The gated copy is authoritative; only the owner's answer may
+                # promote it (consume_answers moves it here itself on accept).
+                # Quarantined rather than skipped-in-place — see
+                # cos.quarantine_gate_bypass for why leaving it would let a
+                # later REJECT still leak the content on the next drain.
+                try:
+                    from . import cos as _cos_mod
+                    if nid in _cos_mod.undecided_proposal_ids(self.vault):
+                        dest = _cos_mod.quarantine_gate_bypass(self.vault, draft)
+                        skipped.append({
+                            "draft": draft.name,
+                            "reason": f"gate-bypass: {nid!r} is awaiting the owner's "
+                                      f"accept/reject — quarantined to {dest.parent.name}/{dest.name}",
+                        })
+                        continue
+                except Exception as exc:  # noqa: BLE001 — never break the drain floor
+                    skipped.append({"draft": draft.name,
+                                    "reason": f"gate-check-failed (fail-closed, left in place): "
+                                              f"{type(exc).__name__}: {exc}"})
+                    continue
                 # raw source -> raw/<id>.md ; otherwise a brain note -> resources/.
                 if note.type == "source" or note.zone == "raw":
                     rel, subtree = f"raw/{nid}.md", "raw"

{brainiac_cli-0.18.0 → brainiac_cli-0.18.2}/src/brain/cos.py

@@ -413,6 +413,49 @@ def claim_drops(vault, now: _dt.datetime | None = None) -> dict[str, Any]:
 
 
 # -- proposal state helpers ----------------------------------------------------
+def undecided_proposal_ids(vault) -> set[str]:
+    """Candidate ids the owner has NOT yet ruled on — staged in the VM's
+    proposal drop, or claimed into host ``pending/``. Both states mean "the
+    owner's answer is still outstanding".
+
+    A capture draft carrying one of these ids is a GATE BYPASS: the same
+    content is simultaneously travelling the gated route (cos-propose ->
+    broker -> owner batch -> selective commit) and the UNGATED one
+    (draft-capture -> capture-inbox -> signed on the next drain). The ungated
+    one always wins the race, so the owner gets asked to approve a note that is
+    already authoritative in the vault, and a "reject" has nothing to reject.
+
+    Measured 2026-07-16 (run 14/15): the COS skill forbids SUBSTITUTING
+    draft-capture for cos-propose in Phase 1.6, but Phase 5 separately requires
+    draft-capture for anything the owner must see. A finding that is also an
+    ingestion candidate satisfies both rules and bypasses the gate — no rule
+    violated. Policy cannot fix a collision between two obeyed rules; the
+    engine must.
+    """
+    ids: set[str] = set()
+    for d in (proposal_drop_dir(vault), proposals_dir(vault) / "pending"):
+        if d.is_dir():
+            ids.update(p.stem for p in d.glob("*.md"))
+    return ids
+
+
+def quarantine_gate_bypass(vault, draft: Path, *, now: _dt.datetime | None = None) -> Path:
+    """Move a bypassing capture draft out of the drain's path, reversibly.
+
+    NOT deleted (recoverable, auditable) and NOT left in place: leaving it
+    would re-offer it to every subsequent drain, and — the real hazard — a
+    later owner REJECT clears the gated copy out of ``pending/``, after which
+    the leftover draft no longer matches an undecided id and the next drain
+    would sign the very content the owner just rejected.
+    """
+    dest_dir = host_dir(vault) / "gate-bypass"
+    dest_dir.mkdir(parents=True, exist_ok=True)
+    stamp = (now or _utcnow()).strftime("%Y%m%dT%H%M%S")
+    dest = dest_dir / f"{stamp}-{draft.name}"
+    shutil.move(str(draft), dest)
+    return dest
+
+
 def _pending_metas(vault) -> list[dict[str, Any]]:
     pending = proposals_dir(vault) / "pending"
     out = []
@@ -1587,7 +1630,16 @@ def ingest_sweep(vault, *, downloads_dir: Path | str | None = None,
                 continue
             fname = next((n for n in safe if (ddir / n).exists()), None)
             if fname is None:
-                report["unmatched"].extend(safe)  # unclaimed — retry next run
+                # WHY matters: "not in the downloads dir at all" is a different
+                # problem from "present but rejected by a guard", and the old
+                # bare-name list could not tell them apart — the 2026-07-16
+                # field read was "sweeper stalled ~32h" when the sweeper was in
+                # fact correctly refusing stale namesakes. Reasons are additive:
+                # the plain names stay in `unmatched` for compatibility.
+                report["unmatched"].extend(safe)
+                report.setdefault("unmatched_reasons", []).extend(
+                    {"filename": n, "reason": "not present in the downloads dir"}
+                    for n in safe)
                 continue
             cand = ddir / fname
             if cand.is_symlink() or not cand.is_file():
@@ -1605,11 +1657,26 @@ def ingest_sweep(vault, *, downloads_dir: Path | str | None = None,
             if isinstance(want, int) and want > 0:
                 if abs(size - want) > max(want * INGEST_SWEEP_SIZE_TOLERANCE, 4096):
                     report["unmatched"].append(fname)  # wrong file — leave it
+                    report.setdefault("unmatched_reasons", []).append({
+                        "filename": fname,
+                        "reason": f"size mismatch: on disk {size}B, manifest expects "
+                                  f"{want}B (tolerance "
+                                  f"{int(max(want * INGEST_SWEEP_SIZE_TOLERANCE, 4096))}B) "
+                                  f"— a DIFFERENT file of the same name",
+                    })
                     continue
             ets = _parse_ts(str(entry.get("ts", "")))
             if ets is not None and cand.stat().st_mtime < (
                     ets.timestamp() - INGEST_SWEEP_SKEW_SECONDS):
                 report["unmatched"].append(fname)  # older than the download
+                age_h = (ets.timestamp() - cand.stat().st_mtime) / 3600.0
+                report.setdefault("unmatched_reasons", []).append({
+                    "filename": fname,
+                    "reason": f"stale namesake: file mtime is {age_h:.1f}h OLDER than the "
+                              f"manifest's download ts {ets.isoformat()} (skew allowance "
+                              f"{INGEST_SWEEP_SKEW_SECONDS}s) — the VM's download did not "
+                              f"land; this is a pre-existing file with the same name",
+                })
                 continue
             dest = _unique_dest(inbox, fname)
             if not dry_run:

{brainiac_cli-0.18.0 → brainiac_cli-0.18.2}/src/brain/embed.py

@@ -210,8 +210,8 @@ class ArcticEmbedder:
                 from fastembed import TextEmbedding
             except Exception as exc:  # pragma: no cover - exercised when absent
                 raise EmbedderUnavailable(
-                    "fastembed/onnxruntime not importable; install the 'embed' "
-                    "extra or bundle the model"
+                    f"fastembed/onnxruntime not importable; install the 'embed' "
+                    f"extra or bundle the model: {type(exc).__name__}: {exc}"
                 ) from exc
             self._model = TextEmbedding(
                 model_name=self.model_id, cache_dir=self._cache_dir,
@@ -315,7 +315,8 @@ class CatalogEmbedder:
                 from fastembed import TextEmbedding
             except Exception as exc:  # pragma: no cover
                 raise EmbedderUnavailable(
-                    "fastembed/onnxruntime not importable for CatalogEmbedder"
+                    f"fastembed/onnxruntime not importable for CatalogEmbedder: "
+                    f"{type(exc).__name__}: {exc}"
                 ) from exc
             self._register_custom()
             self._model = TextEmbedding(
@@ -470,7 +471,8 @@ class OnnxEmbedder:
                 from tokenizers import Tokenizer
             except Exception as exc:  # pragma: no cover
                 raise EmbedderUnavailable(
-                    "onnxruntime/tokenizers not importable for OnnxEmbedder"
+                    f"onnxruntime/tokenizers not importable for OnnxEmbedder: "
+                    f"{type(exc).__name__}: {exc}"
                 ) from exc
             try:
                 onnx_path, base = self._resolve_model_files()
@@ -721,14 +723,42 @@ _HASH_FALLBACK_MSG = (
 )
 
 
+def embedder_unavailable_reason() -> str:
+    """Probe WHY no real embedder resolved and report the ACTUAL error.
+
+    The old message guessed ("onnxruntime/tokenizers missing OR the model is
+    absent") because both ``available()`` and the raise sites discard the
+    exception. Field cost (2026-07-16): the Cowork VM reported the identical
+    opaque line for SEVEN consecutive runs — every one grounding on lexical
+    search only, every dedup `inconclusive` — and no operator could tell a
+    missing package from an ABI mismatch from a missing model without shell
+    access to the VM. An error that cannot distinguish its own causes cannot
+    be fixed remotely; that is the defect this repairs.
+
+    Carries the interpreter version deliberately: the vendored VM wheels are
+    built for one CPython minor (`vendor_semantic_deps.py` pins cp311), so an
+    image whose python moved yields `undefined symbol` / `No module named` —
+    indistinguishable from "never installed" unless the version is printed.
+    """
+    parts: list[str] = [f"python {sys.version.split()[0]}"]
+    for mod in ("onnxruntime", "tokenizers"):
+        try:
+            __import__(mod)
+        except Exception as exc:  # noqa: BLE001 — the reason IS the payload
+            parts.append(f"{mod}: {type(exc).__name__}: {exc}")
+        else:
+            parts.append(f"{mod}: ok")
+    return "; ".join(parts)
+
+
 def _implicit_hash_fallback() -> Embedder:
     """Return HashEmbedder for the IMPLICIT auto-path, but never silently:
     fail closed when the operator demanded a real embedder, else warn loudly."""
     if os.environ.get("BRAIN_REQUIRE_REAL_EMBEDDER"):
         raise EmbedderUnavailable(
             "BRAIN_REQUIRE_REAL_EMBEDDER is set but no real semantic embedder is "
-            "available (onnxruntime/tokenizers missing or e5-small model absent). "
-            "Refusing to degrade to the non-semantic HashEmbedder."
+            "available. Refusing to degrade to the non-semantic HashEmbedder. "
+            f"Probe: {embedder_unavailable_reason()}"
         )
     print(_HASH_FALLBACK_MSG, file=sys.stderr, flush=True)
     return HashEmbedder()

{brainiac_cli-0.18.0 → brainiac_cli-0.18.2}/src/brain/spine.py

@@ -55,6 +55,19 @@ def _utcnow() -> _dt.datetime:
     return _dt.datetime.now(_dt.timezone.utc)
 
 
+def _json_safe(v: Any) -> Any:
+    """The event log is JSON text, but callers hand us values straight out of
+    YAML frontmatter, where an unquoted `due: 2026-07-17` parses as a
+    `datetime.date` — not JSON-serializable. Normalize dates to ISO at this one
+    boundary: every source (ingestion candidates, `brain cos-spine record`,
+    calendar follow-ups) routes through record_event, and the reducer/radar
+    read `due` back as ISO text either way.
+    """
+    if isinstance(v, (_dt.date, _dt.datetime)):
+        return v.isoformat()
+    return v
+
+
 def _ts(dt: _dt.datetime | None = None) -> str:
     return (dt or _utcnow()).strftime("%Y-%m-%dT%H:%M:%SZ")
 
@@ -227,7 +240,7 @@ def record_event(vault, *, event: str, direction: str | None = None,
                  ("text", text), ("topic", _topic_of(text or "", topic) if text or topic else None),
                  ("due", due), ("source_ref", source_ref), ("note", note)):
         if v is not None:
-            evidence[k] = v
+            evidence[k] = _json_safe(v)
 
     conn = _conn(vault)
     try:

{brainiac_cli-0.18.0 → brainiac_cli-0.18.2/src/brainiac_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brainiac-cli
-Version: 0.18.0
+Version: 0.18.2
 Summary: Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index).
 License-Expression: Apache-2.0
 Requires-Python: >=3.9