brainiac-cli 0.18.2__tar.gz → 0.19.0__tar.gz

{brainiac_cli-0.18.2/src/brainiac_cli.egg-info → brainiac_cli-0.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brainiac-cli
-Version: 0.18.2
+Version: 0.19.0
 Summary: Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index).
 License-Expression: Apache-2.0
 Requires-Python: >=3.9

{brainiac_cli-0.18.2 → brainiac_cli-0.19.0}/pyproject.toml

@@ -8,7 +8,7 @@ build-backend = "setuptools.build_meta"
 # check. The IMPORT package stays `brain` and the console script stays
 # `brain` — only the distribution/project name changes.
 name = "brainiac-cli"
-version = "0.18.2"
+version = "0.19.0"
 description = "Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index)."
 readme = "README.md"
 license = "Apache-2.0"

{brainiac_cli-0.18.2 → brainiac_cli-0.19.0}/src/brain/_assets/AGENTS.md

@@ -356,7 +356,11 @@ rules, in order:
    `-- N withheld …` line in text): when you see it, **re-run with
    `--max-tier Restricted`** (or `MNPI` for the most sensitive) — the
    human-gated elevation — instead of concluding the vault has nothing and
-   web-searching to compensate.
+   web-searching to compensate. **On `--role vm` this elevation is NOT
+   self-serve:** the VM leg clamps `--max-tier` to a hard ceiling
+   (`$BRAIN_VM_MAX_EGRESS_TIER`, default `Internal`), so a typed higher tier is
+   silently capped and the elevation hint is suppressed — raising a VM's ceiling
+   is a host-operator action, not something the model does on its own.
 
 3. **Never leak internal topics into a web search.** A web query for a
    Confidential-or-above subject — a deal codename, a counterparty, an internal

brainiac_cli-0.19.0/src/brain/_assets/overlay/template/cos/drafts.md

@@ -0,0 +1,25 @@
+---
+overlay_type: cos
+title: "Reply drafts — owner setting"
+setting: drafts
+---
+
+enabled: true
+
+## What this controls
+
+Whether the nightly chief-of-staff composes reply drafts into your Drafts
+folder for threads that warrant a response. It NEVER sends — sending is yours,
+structurally.
+
+- `enabled: true` (or this file absent) — compose drafts, cap 10/run.
+- `enabled: false` — no drafts; the run spends that budget on battlecards.
+
+## Why this file exists
+
+Without it a run has nowhere to read your answer, so a low draft-engagement
+count invites it to quietly stop drafting and ask you again every night. Your
+ruling lives here instead: durable, and outside the rolling skill-memory cap.
+
+Engagement (did you send/edit a draft?) is still measured and reported. It is
+DATA, not a verdict — an untouched draft may simply mean you have not looked.

brainiac_cli-0.19.0/src/brain/_assets/overlay/template/cos/priorities.md

@@ -0,0 +1,42 @@
+---
+overlay_type: cos
+title: "COS priority overrides — starter template"
+updated: 2026-07-13
+---
+
+# COS priority overrides
+
+OPTIONAL category (CUT-01E). `brain cos-priority-map` generates the
+VM-readable priority map from your `type: person` / `type: company` notes;
+list ids below to override the computed placement. One list line per note:
+
+`- <note-id>: high|normal|low|exclude`
+
+<!-- examples (replace with your own note ids):
+- contoso-acquisition-lead: high
+- northwind-vendor-contact: low
+- retired-supplier-x: exclude
+-->
+
+## Priority-chip taxonomy (chief-of-staff kernel v4.6 — companion block)
+
+The nightly run projects the act queue onto exactly three Outlook
+categories (recorded verbatim — category names are IMMUTABLE once created;
+a rename means delete + recreate + re-chip every tagged message):
+
+- `P0 · Now` — red
+- `P1 · Today` — orange
+- `P2 · This week` — blue
+
+`chips_confirmed` is the RUNTIME chip gate the nightly reads: chips are
+withheld (the legacy flat Action mark continues) until the owner's recorded
+YES to the queued name/color confirmation question, at which point the
+answering session sets:
+
+```
+chips_confirmed: false
+chips_confirmed_date:
+```
+
+(The answering session flips the value to `true` and dates it. Never
+pre-fill `true` — an uncommented `true` line IS the gate opening.)

{brainiac_cli-0.18.2 → brainiac_cli-0.19.0}/src/brain/_assets/scripts/brain-brief.sh

@@ -63,12 +63,14 @@ fi
 
 {
   echo "=== brain-daily-brief / brain-nightly $(date -u +%Y-%m-%dT%H:%M:%SZ) ==="
-  # cos-broker FIRST: the host broker fold claims VM proposal drops, releases due
-  # holds, runs auto-capture, enqueues the owner batch, and renders
-  # shared/spine-summary.md. Nothing else schedules it -- without this line the
-  # VM proposes into a drop dir no one drains (measured 2026-07-16: spine DB empty,
-  # candidates unclaimed ~29h) . It runs BEFORE maintain so notes it signs are
-  # indexed + published by the same run's sync. Host-only, idempotent, and
+  # cos-broker first — CORRECTION (2026-07-17): `brain maintain` ALSO runs the
+  # fold + the ingest sweep (core.py maintain, the CUT-01E block); the original
+  # claim here that "nothing else schedules it" was WRONG. The 2026-07-16 field
+  # failure (spine DB empty, candidates unclaimed ~29h) was actually the plist
+  # pinning a 0.17.0 engine whose fold predates the spine stage — maintain was
+  # calling the fold hourly all along, at a version that couldn't render it.
+  # This explicit call stays as defense-in-depth: idempotent, cheap, and it
+  # keeps the drain floor if maintain's internal block ever regresses.
   # NON-FATAL: a broker failure must never cost the vault its capture-drain floor.
   "$BRAIN_BIN" cos-broker --json || echo "brain-brief: cos-broker fold failed (non-fatal), continuing to maintain"
   # maintain: sync --publish (drain pending captures + reconcile index +

{brainiac_cli-0.18.2 → brainiac_cli-0.19.0}/src/brain/_version.py

@@ -9,4 +9,4 @@ pip-installed host, importlib.metadata stays primary; brain/__init__.py reads
 this file only as the fallback before 0.0.0+unknown.
 """
 
-__version__ = "0.18.2"
+__version__ = "0.19.0"

{brainiac_cli-0.18.2 → brainiac_cli-0.19.0}/src/brain/classification.py

@@ -44,6 +44,31 @@ if DEFAULT_MAX_TIER not in RANK:
 # Public + Internal only unless a human explicitly elevates with --max-tier.
 VM_DEFAULT_MAX_TIER = "Internal"
 
+# Hard server-side ceiling for the untrusted VM leg (codex 2026-07-19). On
+# role=vm, --max-tier is a caller-controlled argument the LLM can set itself;
+# without a clamp the egress-starvation hint ("re-run with --max-tier
+# Restricted") turns the intended HUMAN-gated elevation into an instruction the
+# model follows autonomously. This is the CLI analogue of the MCP adapter's
+# BRAIN_MAX_EGRESS_TIER: a VM caller can never exceed this ceiling regardless of
+# what it types. The host operator raises it deliberately via the env var (the
+# real human gate); an unrecognised value falls back to VM_DEFAULT_MAX_TIER.
+VM_EGRESS_CEILING_ENV = "BRAIN_VM_MAX_EGRESS_TIER"
+
+
+def vm_egress_ceiling() -> str:
+    """The tier a role=vm caller may never exceed. Operator-settable via
+    $BRAIN_VM_MAX_EGRESS_TIER; defaults to the conservative VM cap."""
+    val = os.environ.get(VM_EGRESS_CEILING_ENV, "").strip()
+    return val if val in RANK else VM_DEFAULT_MAX_TIER
+
+
+def clamp_to(requested: str, ceiling: str) -> str:
+    """Return the lower (less-sensitive) of two tiers by rank — a caller can
+    never widen egress past the ceiling, only narrow within it."""
+    req = requested if requested in RANK else DEFAULT_DENY_TIER
+    ceil = ceiling if ceiling in RANK else VM_DEFAULT_MAX_TIER
+    return req if RANK[req] <= RANK[ceil] else ceil
+
 
 def normalize(value: object) -> str:
     """Map a raw frontmatter value to a recognised tier, default-deny on miss."""

{brainiac_cli-0.18.2 → brainiac_cli-0.19.0}/src/brain/cli.py

@@ -164,6 +164,12 @@ def _emit(obj: Any, as_json: bool, human: str | None = None) -> None:
         sys.stdout.write((human if human is not None else str(obj)) + "\n")
 
 
+# Set True by main() on role=vm: the untrusted leg must not be told to
+# "re-run with --max-tier Restricted" — that hint is the self-elevation nudge
+# codex flagged, and the VM ceiling clamp makes the instruction a no-op anyway.
+_SUPPRESS_ELEVATION_HINT = False
+
+
 def _filter_dicts(items: list[dict], max_tier: str) -> tuple[list[dict], dict]:
     # THE single egress chokepoint — every content-returning subcommand routes
     # through egress.apply_gate so a new content path cannot silently bypass the
@@ -174,7 +180,8 @@ def _filter_dicts(items: list[dict], max_tier: str) -> tuple[list[dict], dict]:
     # web search — leaking internal topics outward. Say WHY it's thin and HOW to
     # elevate, in the report dict so it surfaces in BOTH --json (agent-facing)
     # and the text footer. The tier stays the human gate; this only signposts it.
-    if report.get("withheld", 0) > 0 and max_tier != cls.TIERS[-1]:
+    if (report.get("withheld", 0) > 0 and max_tier != cls.TIERS[-1]
+            and not _SUPPRESS_ELEVATION_HINT):
         report["hint"] = (
             f"{report['withheld']} note(s) withheld above the {max_tier} cap — "
             f"re-run with --max-tier Restricted (or MNPI for the most sensitive) "
@@ -1080,6 +1087,7 @@ VM_ALLOWED = frozenset({
 
 
 def main(argv: list[str] | None = None) -> int:
+    global _SUPPRESS_ELEVATION_HINT
     try:
         return _main(argv)
     except Exception as exc:  # H-4: top-level guard -- never a raw traceback
@@ -1088,6 +1096,11 @@ def main(argv: list[str] | None = None) -> int:
         _emit({"error": type(exc).__name__, "detail": str(exc)} if as_json
               else f"{exc.__class__.__name__}: {exc}", as_json)
         return 3
+    finally:
+        # The VM hint-suppression flag is INVOCATION-scoped (set by _main per
+        # role): reset it here so it never leaks into a later main() call or a
+        # direct _filter_dicts caller in the same process (e.g. across tests).
+        _SUPPRESS_ELEVATION_HINT = False
 
 
 def _main(argv: list[str] | None = None) -> int:
@@ -1103,6 +1116,14 @@ def _main(argv: list[str] | None = None) -> int:
     if getattr(args, "max_tier", "unset") is None:
         args.max_tier = (cls.VM_DEFAULT_MAX_TIER if role == config.ROLE_VM
                          else cls.DEFAULT_MAX_TIER)
+    # VM egress ceiling (codex 2026-07-19): on the untrusted leg, --max-tier is
+    # a value the LLM can set itself, and the starvation hint nudges it to. Clamp
+    # any VM-side max_tier to the operator-set ceiling so a typed --max-tier MNPI
+    # cannot self-elevate past it; the hint is also suppressed for role=vm below.
+    global _SUPPRESS_ELEVATION_HINT
+    _SUPPRESS_ELEVATION_HINT = (role == config.ROLE_VM)  # deterministic per call
+    if role == config.ROLE_VM and hasattr(args, "max_tier"):
+        args.max_tier = cls.clamp_to(str(args.max_tier), cls.vm_egress_ceiling())
     # DV-03: the VM leg fails closed on a dead embedder rather than silently
     # answering semantic queries with random hash vectors (no-op when a real
     # embedder is present or hash was chosen explicitly).
@@ -1371,7 +1392,8 @@ def _main(argv: list[str] | None = None) -> int:
                 + srep["withheld_unlabelled_default_deny"],
             "max_tier": args.max_tier,
         }
-        if report["withheld"] > 0 and args.max_tier != cls.TIERS[-1]:
+        if (report["withheld"] > 0 and args.max_tier != cls.TIERS[-1]
+                and not _SUPPRESS_ELEVATION_HINT):
             report["hint"] = (
                 f"{report['withheld']} note(s) withheld above the "
                 f"{args.max_tier} cap — re-run with a higher --max-tier.")

{brainiac_cli-0.18.2 → brainiac_cli-0.19.0}/src/brain/cos.py

@@ -963,6 +963,108 @@ def shadow_ledger_entries(vault) -> list[dict[str, Any]]:
     return list(by_key.values())
 
 
+# -- behavioural grading (2026-07-17, owner decision) --------------------------
+# The corrections-based calibration required ~10 mornings of the owner grading
+# email by hand; across 6 rounds / 308 verdicts he filed ZERO — the ritual will
+# never happen, so auto-archive was permanently gated on evidence that could
+# not accrue. Behavioural grading replaces stated preference with revealed
+# preference: the VM already reads the mailbox nightly, so it OBSERVES what the
+# owner actually did to previously-verdicted mail (read / replied / flagged /
+# archived himself / untouched) and drops raw observations; THIS module grades
+# them, in one testable place. Owner ruling: also mine his own archive actions
+# as pattern evidence — "albeit not exclusively".
+
+BEHAVIOUR_OBSERVATIONS = ("owner_replied", "owner_flagged", "owner_read",
+                          "owner_archived", "untouched")
+
+
+def grade_behaviour(bucket: str, observed: str, *,
+                    auto_archived: bool = False) -> str:
+    """One verdict row + one observed behaviour -> a grade.
+
+    The error that matters for auto-archive is exactly one: "would have
+    archived mail the owner needed". So a NOISE verdict the owner then replied
+    to or flagged is `contradicted` — the hard, gate-relevant failure. A noise
+    row he merely opened is `read_anyway`: a weak signal (people open
+    newsletters), reported but never gated on. Noise he left untouched or
+    archived himself is `consistent`. An act/read row he archived without
+    engaging is `overcalled` — over-caution, harmless, informational.
+    """
+    b, o = str(bucket).lower(), str(observed).lower()
+    # Aged-read lane (owner policy 2026-07-17): priority-list mail may be
+    # auto-archived when read + no-action + >7d old. Those rows are bucket
+    # `read`, not `noise` — so the drift contradiction must key on the ACTION
+    # (we auto-archived it), not the bucket: the owner replying to or flagging
+    # ANY row we auto-archived is the gate error, whichever lane moved it.
+    if auto_archived and o in ("owner_replied", "owner_flagged"):
+        return "contradicted"
+    if b == "noise":
+        if o in ("owner_replied", "owner_flagged"):
+            return "contradicted"
+        if o == "owner_read":
+            return "read_anyway"
+        if o in ("untouched", "owner_archived"):
+            return "consistent"
+    elif b in ("act", "read") and o == "owner_archived":
+        return "overcalled"
+    return "neutral"
+
+
+def behaviour_entries(vault) -> list[dict[str, Any]]:
+    """Raw behaviour observations from the VM drop (``behaviour-*.jsonl``),
+    deduped by (round, msg_key) — last write wins, same idempotency shape as
+    the shadow ledger. Rows are VM-authored and untrusted: consumed as data."""
+    vdir = verdict_drop_dir(vault)
+    files = sorted(vdir.glob("behaviour-*.jsonl")) if vdir.is_dir() else []
+    by_key: dict[tuple[int, str], dict[str, Any]] = {}
+    for f in files:
+        for e in _read_jsonl(f):
+            r, k = e.get("round"), e.get("msg_key")
+            if isinstance(r, int) and isinstance(k, str):
+                by_key[(r, k)] = e
+    return list(by_key.values())
+
+
+def behaviour_report(vault) -> dict[str, Any]:
+    """Aggregate observed-behaviour evidence: per-bucket grade counts, the
+    noise-safety numbers an auto-archive re-arm decision needs, and the
+    owner's own archive patterns (top senders he archives himself — evidence
+    for FUTURE noise-signals, never an actuator by itself)."""
+    entries = behaviour_entries(vault)
+    per_bucket: dict[str, dict[str, int]] = {}
+    contradicted_rows: list[dict[str, Any]] = []
+    owner_archive_patterns: dict[str, int] = {}
+    rounds: set[int] = set()
+    for e in entries:
+        b = str(e.get("bucket", "?")).lower()
+        o = str(e.get("observed", "?")).lower()
+        g = grade_behaviour(b, o, auto_archived=bool(e.get("auto_archived")))
+        per_bucket.setdefault(b, {})[g] = per_bucket.setdefault(b, {}).get(g, 0) + 1
+        rounds.add(int(e["round"]))
+        if g == "contradicted":
+            contradicted_rows.append(
+                {k: e.get(k) for k in ("round", "msg_key", "sender", "subject",
+                                        "observed")})
+        if o == "owner_archived":
+            key = str(e.get("sender") or e.get("sender_domain") or "unknown").lower()
+            owner_archive_patterns[key] = owner_archive_patterns.get(key, 0) + 1
+    noise = per_bucket.get("noise", {})
+    noise_observed = sum(noise.values())
+    contradicted = noise.get("contradicted", 0)
+    return {
+        "observations": len(entries),
+        "rounds_observed": len(rounds),
+        "per_bucket": per_bucket,
+        "noise_observed": noise_observed,
+        "noise_contradicted": contradicted,
+        "noise_consistency": (round((noise_observed - contradicted) / noise_observed, 4)
+                              if noise_observed else None),
+        "contradicted_rows": contradicted_rows[:20],
+        "owner_archive_patterns": dict(sorted(owner_archive_patterns.items(),
+                                              key=lambda kv: -kv[1])[:20]),
+    }
+
+
 def calibration_report(vault) -> dict[str, Any]:
     """Shadow-mode trust-gate report: calibration = reduce(verdicts,
     correction_events). A verdict is bucket-correct when no correction exists
@@ -998,6 +1100,10 @@ def calibration_report(vault) -> dict[str, Any]:
         "overall_bucket_precision": (round(bucket_correct / total, 4)
                                      if total else None),
         "per_bucket": buckets,
+        # revealed preference alongside stated preference: the corrections
+        # count above stays authoritative where it exists, but 0 corrections
+        # no longer means 0 evidence.
+        "behaviour": behaviour_report(vault),
     }
 
 
@@ -1451,7 +1557,18 @@ def _is_keeper_counterparty(vault, counterparty: str | None) -> bool:
     if not counterparty:
         return False
     overrides = load_priority_overrides(vault)
-    return overrides.get(str(counterparty).lower()) == "high"
+    name = str(counterparty).lower()
+    if overrides.get(name) == "high":
+        return True
+    # Override keys are NOTE-ID SLUGS (the only form _OVERRIDE_LINE_RE parses),
+    # but a commitment's counterparty is a display name from mail — e.g. a name
+    # like "Renée Dûval" could never equal "renee-duval", so keeper detection
+    # silently never fired (found 2026-07-17, the day the first real roster was
+    # written). Compare in slug space, accents folded.
+    import unicodedata
+    folded = unicodedata.normalize("NFKD", name).encode("ascii", "ignore").decode()
+    slug = re.sub(r"[^a-z0-9]+", "-", folded).strip("-")
+    return overrides.get(slug) == "high"
 
 
 def _spine_ingest_commitment(vault, meta: dict[str, Any], *, source_ref: str,
@@ -1527,6 +1644,13 @@ DEFAULT_INGEST_SWEEP_MAX_BYTES = 200 * 1024 * 1024
 INGEST_SWEEP_DOWNLOADS_ENV = "BRAIN_COS_DOWNLOADS_DIR"
 INGEST_SWEEP_SKEW_SECONDS = 300          # manifest ts vs file mtime clock skew
 INGEST_SWEEP_SIZE_TOLERANCE = 0.10       # when the manifest carries a size
+# Host-observed freshness floor (codex 2026-07-19): a candidate whose mtime is
+# older than this relative to the sweep's OWN clock is a pre-existing host file,
+# not something the VM just downloaded — the un-forgeable provenance anchor. The
+# maintain umbrella fires hourly; a 6h window tolerates a few missed runs / a
+# sleeping Mac while still excluding files that have sat in Downloads for days.
+INGEST_SWEEP_RECENCY_ENV = "BRAIN_COS_SWEEP_RECENCY_SECONDS"
+DEFAULT_INGEST_SWEEP_RECENCY_SECONDS = 6 * 3600
 
 
 def ingest_manifest_dir(vault=None) -> Path:
@@ -1550,6 +1674,14 @@ def _sweep_max_bytes() -> int:
         return DEFAULT_INGEST_SWEEP_MAX_BYTES
 
 
+def _sweep_recency_seconds() -> int:
+    try:
+        return int(os.environ.get(INGEST_SWEEP_RECENCY_ENV,
+                                  DEFAULT_INGEST_SWEEP_RECENCY_SECONDS))
+    except ValueError:
+        return DEFAULT_INGEST_SWEEP_RECENCY_SECONDS
+
+
 def _unique_dest(inbox: Path, filename: str) -> Path:
     dest = inbox / filename
     if not dest.exists():
@@ -1572,8 +1704,12 @@ def ingest_sweep(vault, *, downloads_dir: Path | str | None = None,
     - filenames are basename-only — any path separator / ``..`` is refused;
     - a symlinked candidate (or manifest file) is refused, never followed;
     - files above the size cap (default 200 MB) are refused;
-    - a match requires exact filename, size within tolerance when the
-      manifest carries one, and mtime newer than the manifest ts minus skew;
+    - a candidate must be a FRESH download — mtime within the recency window of
+      the sweep's own clock — so a VM manifest cannot claim a pre-existing host
+      Downloads file it did not just download (codex 2026-07-19, VM/host
+      boundary): the mtime is the one provenance signal the VM cannot forge;
+    - a match requires exact filename, size within tolerance when the manifest
+      carries one, and mtime newer than the manifest ts minus skew;
     - claims are append-only, one per manifest line — a re-run never
       double-moves (idempotent);
     - NOTHING the manifest does not name is ever touched, moved, or deleted.
@@ -1653,6 +1789,26 @@ def ingest_sweep(vault, *, downloads_dir: Path | str | None = None,
                 report["refused"].append({"filename": fname,
                                           "reason": "over size cap"})
                 continue
+            # SECURITY (codex 2026-07-19, VM/host boundary): the manifest is
+            # VM-writable, so its own fields cannot prove provenance — the VM
+            # can name any basename and BACKDATE `ts` to defeat the staleness
+            # check on an old host file. The one thing a VM-side attacker CANNOT
+            # forge is a host file's mtime, so the sweep's OWN clock is the
+            # anchor: only a file whose mtime is recent relative to `now` — i.e.
+            # one genuinely downloaded within this maintenance window — is
+            # eligible. A guessed sensitive file that has been sitting in
+            # ~/Downloads (tax.pdf, statement.pdf …) is refused regardless of
+            # what the manifest claims. Widen the window via env for slow hosts.
+            age = now.timestamp() - cand.stat().st_mtime
+            if age > _sweep_recency_seconds():
+                report["unmatched"].append(fname)
+                report.setdefault("unmatched_reasons", []).append({
+                    "filename": fname,
+                    "reason": f"not a fresh download: host mtime is {age / 3600.0:.1f}h "
+                              f"old (recency window {_sweep_recency_seconds() // 3600}h) "
+                              f"— a pre-existing host file the VM manifest cannot claim",
+                })
+                continue
             want = entry.get("approx_size_bytes")
             if isinstance(want, int) and want > 0:
                 if abs(size - want) > max(want * INGEST_SWEEP_SIZE_TOLERANCE, 4096):

brainiac_cli-0.19.0/src/brain/cos_chips.py

@@ -0,0 +1,361 @@
+"""Priority-chip projection (chief-of-staff kernel v4.7) — tested reference
+implementation for the executable halves of the P-taxonomy contract.
+
+The nightly chief-of-staff run is executed by a model reading SKILL.md; the
+behaviours here are the parts that must never drift on a prompt rewrite, so
+they live as engine code with contract tests (``tests/test_cos_chips.py``,
+fake mailbox adapter + fault injection):
+
+- ``assign_chip``       — the authoritative P0/P1/P2 assignment rules
+- ``desired_categories``— category-set PRESERVATION diff (never a bare-set write)
+- ``verify_write``      — whole-set server-state verification
+- ``apply_chip_to_conversation`` — message-level apply + journal, per-row verified
+- ``recover_from_journal``       — journal recovery after a partial/failed pass
+- ``lease_state``       — the cos-ops/_mutation_lease.json semantics
+- ``desired_chip_and_trigger`` — v4.7 LIF-01/02 nightly reconciliation (auto-clear +
+  re-level), full-evidence desired-state diff, never rule-ordering
+- ``apply_relevel_to_conversation`` — v4.7 add-before-remove re-level apply
+- ``dedupe_automated_p2`` — v4.7 recurring-automated-sender P2 collapse (s02 finding)
+
+Chips are a PROJECTION of the act queue — never a verdict. Classification
+(Phase 1.5 buckets/tiers) is untouched by this module.
+"""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import Any, Iterable, Protocol
+
+CHIP_P0 = "P0 · Now"          # red
+CHIP_P1 = "P1 · Today"        # orange
+CHIP_P2 = "P2 · This week"    # blue
+CHIPS = (CHIP_P0, CHIP_P1, CHIP_P2)
+LEGACY_ACTION = "Action"
+#: every category this projection owns and may add/remove; anything else on a
+#: message belongs to the owner and must survive every write untouched.
+MANAGED_CATEGORIES = frozenset(CHIPS) | {LEGACY_ACTION}
+
+CHIP_COLORS = {CHIP_P0: "red", CHIP_P1: "orange", CHIP_P2: "blue"}
+
+
+# --------------------------------------------------------------------------
+# Assignment (PRJ-01 hardened rules — roster tier alone never makes P0)
+# --------------------------------------------------------------------------
+
+def assign_chip(
+    *,
+    bucket: str,
+    roster_high: bool = False,
+    direct_ask: bool = False,
+    deadline_hours: float | None = None,
+    blocking_others: bool = False,
+) -> str | None:
+    """Return the ONE chip for a conversation, or ``None`` for non-``act``.
+
+    P0 · Now       = (roster-high AND (direct ask OR any stated deadline))
+                     OR hard deadline < 48h OR blocking others.
+    P1 · Today     = a direct ask on the owner.
+    P2 · This week = every other act row.
+    Roster tier alone NEVER makes P0.
+    """
+    if bucket != "act":
+        return None
+    has_deadline = deadline_hours is not None
+    if (
+        (roster_high and (direct_ask or has_deadline))
+        or (has_deadline and deadline_hours < 48)
+        or blocking_others
+    ):
+        return CHIP_P0
+    if direct_ask:
+        return CHIP_P1
+    return CHIP_P2
+
+
+# --------------------------------------------------------------------------
+# Desired-state category diff (codex-r2 i — preservation, never a bare set)
+# --------------------------------------------------------------------------
+
+def desired_categories(existing: Iterable[str], chip: str | None) -> list[str]:
+    """``existing − MANAGED + {chip}`` with the owner's categories preserved
+    in their original order; ``chip=None`` strips every managed category."""
+    if chip is not None and chip not in CHIPS:
+        raise ValueError(f"not a managed P-chip: {chip!r}")
+    kept = [c for c in existing if c not in MANAGED_CATEGORIES]
+    return kept + ([chip] if chip else [])
+
+
+def verify_write(
+    pre_categories: Iterable[str], post_categories: Iterable[str], chip: str | None
+) -> bool:
+    """A chip write verifies ONLY when the entire post-write set is right:
+    the chip present (or absent, on removal) AND the non-managed subset
+    unchanged. Order of the owner's categories is not significant."""
+    pre_kept = sorted(c for c in pre_categories if c not in MANAGED_CATEGORIES)
+    post = list(post_categories)
+    post_kept = sorted(c for c in post if c not in MANAGED_CATEGORIES)
+    if pre_kept != post_kept:
+        return False
+    managed_present = [c for c in post if c in MANAGED_CATEGORIES]
+    return managed_present == ([chip] if chip else [])
+
+
+# --------------------------------------------------------------------------
+# Message-level apply under the conversation abstraction + journal recovery
+# --------------------------------------------------------------------------
+
+class MailboxAdapter(Protocol):
+    """The minimal mutation surface (fake in tests, Chrome/REST in life)."""
+
+    def inbox_message_ids(self, conversation_id: str) -> list[str]: ...
+    def get_categories(self, message_id: str) -> list[str]: ...
+    def set_categories(self, message_id: str, categories: list[str]) -> None: ...
+
+
+def apply_chip_to_conversation(
+    mailbox: MailboxAdapter, conversation_id: str, chip: str | None
+) -> list[dict[str, Any]]:
+    """Apply (or, with ``chip=None``, remove) the conversation's chip on EVERY
+    message currently in Inbox. Per message: compute the preserved desired
+    set, write it, RE-READ SERVER STATE, and journal the row with its
+    verification result. A failure on one message never aborts the rest.
+
+    Journal rows: ``{conversation_id, message_id, chip, verification}`` with
+    verification ∈ ``response-confirmed`` (server re-read verified) ·
+    ``verified-failed`` (write landed wrong / silently dropped) ·
+    ``error:<msg>`` (the mutation call raised).
+    """
+    journal: list[dict[str, Any]] = []
+    for mid in mailbox.inbox_message_ids(conversation_id):
+        row = {"conversation_id": conversation_id, "message_id": mid, "chip": chip}
+        try:
+            pre = list(mailbox.get_categories(mid))
+            mailbox.set_categories(mid, desired_categories(pre, chip))
+            post = list(mailbox.get_categories(mid))  # server re-read, never trust the write
+            row["verification"] = (
+                "response-confirmed" if verify_write(pre, post, chip) else "verified-failed"
+            )
+        except Exception as exc:  # fault-injection boundary: journal, continue
+            row["verification"] = f"error:{exc}"
+        journal.append(row)
+    return journal
+
+
+def rows_needing_recovery(journal: Iterable[dict[str, Any]]) -> list[dict[str, Any]]:
+    """Journal rows whose write is NOT server-confirmed — the re-apply set."""
+    return [r for r in journal if r.get("verification") != "response-confirmed"]
+
+
+def recover_from_journal(
+    mailbox: MailboxAdapter, journal: Iterable[dict[str, Any]]
+) -> list[dict[str, Any]]:
+    """Re-drive every unconfirmed journal row, idempotently: a row whose
+    server state already matches the desired set verifies as
+    ``already-applied`` without a write; otherwise re-apply + re-verify.
+    Returns the recovery journal (same row shape)."""
+    out: list[dict[str, Any]] = []
+    for r in rows_needing_recovery(journal):
+        mid, chip = r["message_id"], r["chip"]
+        row = {**r}
+        try:
+            current = list(mailbox.get_categories(mid))
+            if verify_write(current, current, chip):
+                row["verification"] = "already-applied"
+            else:
+                mailbox.set_categories(mid, desired_categories(current, chip))
+                post = list(mailbox.get_categories(mid))
+                row["verification"] = (
+                    "response-confirmed" if verify_write(current, post, chip)
+                    else "verified-failed"
+                )
+        except Exception as exc:
+            row["verification"] = f"error:{exc}"
+        out.append(row)
+    return out
+
+
+# --------------------------------------------------------------------------
+# Lifecycle v4.7 (LIF-01/02/03) — desired-state reconciliation, never
+# rule-ordering: every conversation's desired chip is recomputed from the
+# FULL current evidence each night, so a reply followed by NEW actionable
+# inbound still chips (a stale rule-order clear-on-reply would silently drop
+# it under the "no chip = don't look" runbook rule — codex-r2 (i)).
+# --------------------------------------------------------------------------
+
+#: the ONLY trigger that clears a chip outright — every other signal below
+#: (thread-closed / meeting-passed / handled-by-others) may only de-escalate.
+CLEAR_TRIGGER = "owner_reply_is_latest_no_open_items"
+DEESCALATE_TRIGGERS = frozenset({"thread_closed", "meeting_passed", "handled_by_others"})
+_DEESCALATE_STEP = {CHIP_P0: CHIP_P1, CHIP_P1: CHIP_P2, CHIP_P2: CHIP_P2}
+
+
+def desired_chip_and_trigger(
+    *,
+    bucket: str,
+    roster_high: bool = False,
+    direct_ask: bool = False,
+    deadline_hours: float | None = None,
+    blocking_others: bool = False,
+    owner_reply_is_latest: bool = False,
+    has_unsent_draft: bool = False,
+    has_flag: bool = False,
+    has_open_commitment: bool = False,
+    has_pending_deadline: bool = False,
+    thread_closed: bool = False,
+    meeting_passed: bool = False,
+    handled_by_others: bool = False,
+) -> tuple[str | None, str]:
+    """Nightly desired-state reconciliation for ONE conversation, over the
+    FULL current evidence (LIF-01/02, hardened (i)/(ii)).
+
+    Clear (chip=None) fires ONLY on the closed enum: owner's reply is the
+    LATEST message (no later inbound), AND no unsent draft, no flag, no open
+    spine commitment, no pending deadline — every clear ledgers this trigger
+    verbatim. 'thread_closed' / 'meeting_passed' / 'handled_by_others' NEVER
+    clear alone; at most they de-escalate one level (P0->P1->P2, floor P2).
+    """
+    if (
+        owner_reply_is_latest
+        and not has_unsent_draft
+        and not has_flag
+        and not has_open_commitment
+        and not has_pending_deadline
+    ):
+        return None, CLEAR_TRIGGER
+
+    chip = assign_chip(
+        bucket=bucket, roster_high=roster_high, direct_ask=direct_ask,
+        deadline_hours=deadline_hours, blocking_others=blocking_others,
+    )
+    if chip is None:
+        return None, "not-act"
+
+    if handled_by_others or thread_closed or meeting_passed:
+        trigger = ("handled_by_others" if handled_by_others
+                   else "thread_closed" if thread_closed else "meeting_passed")
+        return _DEESCALATE_STEP[chip], trigger
+
+    return chip, "assignment"
+
+
+def reconcile_action(existing_chip: str | None, desired: str | None) -> str:
+    """Diff existing vs. desired -> the ledger action bucket."""
+    if existing_chip == desired:
+        return "none"
+    if existing_chip is None:
+        return "added"
+    if desired is None:
+        return "cleared"
+    return "re-leveled"
+
+
+def ledger_entry(
+    conversation_id: str, *, existing_chip: str | None, desired: str | None, trigger: str,
+) -> dict[str, Any]:
+    """One CHIP LEDGER row (LIF-03) — added/re-leveled/cleared, with reason."""
+    return {
+        "conversation_id": conversation_id,
+        "action": reconcile_action(existing_chip, desired),
+        "from": existing_chip,
+        "to": desired,
+        "trigger": trigger,
+    }
+
+
+def apply_relevel_to_conversation(
+    mailbox: MailboxAdapter, conversation_id: str, old_chip: str, new_chip: str,
+) -> list[dict[str, Any]]:
+    """Re-level a conversation ADD-BEFORE-REMOVE (hardened (b)): every
+    message first gets BOTH chips written (transient two-chip state is
+    acceptable), then the old chip is stripped in a second pass. A zero-chip
+    gap never occurs even under a mid-pass failure — the next nightly
+    reconciliation heals any partial state, since desired-state diff is
+    idempotent (add step re-detects "already has new_chip", remove step
+    re-detects "already single-chip")."""
+    journal: list[dict[str, Any]] = []
+    mids = mailbox.inbox_message_ids(conversation_id)
+    for mid in mids:
+        row = {"conversation_id": conversation_id, "message_id": mid,
+               "chip": new_chip, "step": "add-new"}
+        try:
+            pre = list(mailbox.get_categories(mid))
+            kept = [c for c in pre if c not in MANAGED_CATEGORIES]
+            both = kept + [c for c in (old_chip, new_chip) if c not in kept]
+            mailbox.set_categories(mid, both)
+            post = list(mailbox.get_categories(mid))
+            row["verification"] = (
+                "response-confirmed" if new_chip in post and old_chip in post
+                else "verified-failed"
+            )
+        except Exception as exc:
+            row["verification"] = f"error:{exc}"
+        journal.append(row)
+    for mid in mids:
+        row = {"conversation_id": conversation_id, "message_id": mid,
+               "chip": new_chip, "step": "remove-old"}
+        try:
+            pre = list(mailbox.get_categories(mid))
+            mailbox.set_categories(mid, desired_categories(pre, new_chip))
+            post = list(mailbox.get_categories(mid))
+            row["verification"] = (
+                "response-confirmed" if verify_write(pre, post, new_chip) else "verified-failed"
+            )
+        except Exception as exc:
+            row["verification"] = f"error:{exc}"
+        journal.append(row)
+    return journal
+
+
+# --------------------------------------------------------------------------
+# Automated-sender P2 dedupe (s02 finding, folded into v4.7 assignment)
+# --------------------------------------------------------------------------
+
+def dedupe_automated_p2(rows: Iterable[dict[str, Any]]) -> list[dict[str, Any]]:
+    """Collapse recurring-automated-sender act rows to ONE P2 chip per
+    sender per cycle. ``rows``: dicts carrying ``chip`` and ``automated_sender``
+    (the overlay-driven flag naming a known recurring bulk sender, e.g. an
+    automated notification system) and ``sender``. Only P2 rows from a
+    flagged automated sender are collapsed — P0/P1 rows (a direct ask or
+    deadline from that sender) are never suppressed."""
+    seen: set[str] = set()
+    out: list[dict[str, Any]] = []
+    for r in rows:
+        if r.get("chip") == CHIP_P2 and r.get("automated_sender"):
+            key = r["sender"]
+            if key in seen:
+                continue
+            seen.add(key)
+        out.append(r)
+    return out
+
+
+# --------------------------------------------------------------------------
+# Mutation lease (codex-r3 — one mutator at a time)
+# --------------------------------------------------------------------------
+
+def lease_state(
+    lease: dict[str, Any] | None, *, now: datetime, run_id: str
+) -> tuple[str, str | None]:
+    """Judge ``cos-ops/_mutation_lease.json`` content for a run.
+
+    Returns ``(state, holder)`` — state ∈:
+    ``clear``   no lease / our own lease ⇒ mutations allowed;
+    ``held``    unexpired foreign lease (or malformed — unreadable intent
+                fails closed) ⇒ ZERO mailbox mutations this pass;
+    ``expired`` stale foreign lease ⇒ ignored but REPORTED in the banner.
+    """
+    if lease is None:
+        return "clear", None
+    holder = lease.get("owner") or lease.get("run_id") or "unknown"
+    try:
+        if not isinstance(lease, dict) or not lease.get("run_id"):
+            return "held", str(holder)
+        if lease["run_id"] == run_id:
+            return "clear", str(holder)
+        exp = datetime.fromisoformat(str(lease["ttl_expires"]))
+        if exp.tzinfo is None:
+            exp = exp.replace(tzinfo=timezone.utc)
+    except Exception:
+        return "held", str(holder)  # malformed ⇒ fail closed, reported
+    if exp <= now:
+        return "expired", str(holder)
+    return "held", str(holder)

{brainiac_cli-0.18.2 → brainiac_cli-0.19.0}/src/brain/index.py

@@ -457,7 +457,56 @@ class BrainIndex:
 
     # -- build (full) -----------------------------------------------------
     def rebuild(self, vault: Path) -> dict[str, Any]:
-        """Drop and rebuild the entire index from vault/. Always safe.
+        """Rebuild the entire index from vault/ — crash-safe.
+
+        Builds into a TEMP db file and atomically swaps it into place on
+        success (same posture as ``snapshot.publish_snapshot``), so a killed
+        rebuild leaves the prior live index untouched. Before this fix,
+        ``_create_schema`` dropped the live tables FIRST and inserts landed at
+        the end — a kill mid-rebuild (a full re-embed of a large vault can run
+        an hour+) left the live index wiped (field report 2026-07-16: a killed
+        rebuild on a 2,312-note vault left 0 notes / 0 chunks).
+
+        In-memory DBs (``:memory:``, test-only) build in place — there is
+        nothing to swap."""
+        if self.db_path == Path(":memory:"):
+            return self._rebuild_impl(vault)
+
+        tmp_path = self.db_path.with_name(self.db_path.name + f".rebuild.tmp.{os.getpid()}")
+        for p in (tmp_path, Path(str(tmp_path) + "-wal"), Path(str(tmp_path) + "-shm")):
+            p.unlink(missing_ok=True)
+
+        orig_db_path = self.db_path
+        self.close()
+        self.db_path = tmp_path
+        try:
+            result = self._rebuild_impl(vault)
+            # Checkpoint the temp DB's WAL into its main file so the file we
+            # swap in is fully self-contained (mirrors snapshot.py's
+            # wal_checkpoint(TRUNCATE) before publish).
+            self.conn.execute("PRAGMA wal_checkpoint(TRUNCATE)")
+            self.close()
+            os.replace(tmp_path, orig_db_path)
+        except BaseException:
+            self.close()
+            self.db_path = orig_db_path
+            for p in (tmp_path, Path(str(tmp_path) + "-wal"), Path(str(tmp_path) + "-shm")):
+                p.unlink(missing_ok=True)
+            raise
+        finally:
+            for p in (tmp_path, Path(str(tmp_path) + "-wal"), Path(str(tmp_path) + "-shm")):
+                p.unlink(missing_ok=True)
+        # The just-replaced live DB has no matching sidecars of its own yet
+        # (the temp ones were checkpointed away above) — drop any stale
+        # leftovers from the PRIOR live DB so the next open starts clean.
+        for suffix in ("-wal", "-shm"):
+            Path(str(orig_db_path) + suffix).unlink(missing_ok=True)
+        self.db_path = orig_db_path
+        result["db"] = str(self.db_path)
+        return result
+
+    def _rebuild_impl(self, vault: Path) -> dict[str, Any]:
+        """Drop and rebuild the tables at ``self.db_path`` in place.
 
         S11 indexing speed fix: chunking / embedding / writing are now THREE
         separate passes. Previously ``_insert_note`` was called once per note

{brainiac_cli-0.18.2 → brainiac_cli-0.19.0/src/brainiac_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brainiac-cli
-Version: 0.18.2
+Version: 0.19.0
 Summary: Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index).
 License-Expression: Apache-2.0
 Requires-Python: >=3.9

{brainiac_cli-0.18.2 → brainiac_cli-0.19.0}/src/brainiac_cli.egg-info/SOURCES.txt

@@ -18,6 +18,7 @@ src/brain/connect.py
 src/brain/context.py
 src/brain/core.py
 src/brain/cos.py
+src/brain/cos_chips.py
 src/brain/doctor.py
 src/brain/egress.py
 src/brain/embed.py
@@ -43,6 +44,7 @@ src/brain/update.py
 src/brain/vectors.py
 src/brain/_assets/AGENTS.md
 src/brain/_assets/overlay/template/brand/brand-guide.md
+src/brain/_assets/overlay/template/cos/drafts.md
 src/brain/_assets/overlay/template/cos/priorities.md
 src/brain/_assets/overlay/template/keywords/glossary.md
 src/brain/_assets/overlay/template/people/roster.md

brainiac_cli-0.18.2/src/brain/_assets/overlay/template/cos/priorities.md

@@ -1,19 +0,0 @@
----
-overlay_type: cos
-title: "COS priority overrides — starter template"
-updated: 2026-07-13
----
-
-# COS priority overrides
-
-OPTIONAL category (CUT-01E). `brain cos-priority-map` generates the
-VM-readable priority map from your `type: person` / `type: company` notes;
-list ids below to override the computed placement. One list line per note:
-
-`- <note-id>: high|normal|low|exclude`
-
-<!-- examples (replace with your own note ids):
-- contoso-acquisition-lead: high
-- northwind-vendor-contact: low
-- retired-supplier-x: exclude
--->