brainiac-cli 0.18.2__tar.gz → 0.19.1__tar.gz

{brainiac_cli-0.18.2/src/brainiac_cli.egg-info → brainiac_cli-0.19.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brainiac-cli
-Version: 0.18.2
+Version: 0.19.1
 Summary: Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index).
 License-Expression: Apache-2.0
 Requires-Python: >=3.9

{brainiac_cli-0.18.2 → brainiac_cli-0.19.1}/pyproject.toml

@@ -8,7 +8,7 @@ build-backend = "setuptools.build_meta"
 # check. The IMPORT package stays `brain` and the console script stays
 # `brain` — only the distribution/project name changes.
 name = "brainiac-cli"
-version = "0.18.2"
+version = "0.19.1"
 description = "Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index)."
 readme = "README.md"
 license = "Apache-2.0"

{brainiac_cli-0.18.2 → brainiac_cli-0.19.1}/src/brain/_assets/AGENTS.md

@@ -356,7 +356,11 @@ rules, in order:
    `-- N withheld …` line in text): when you see it, **re-run with
    `--max-tier Restricted`** (or `MNPI` for the most sensitive) — the
    human-gated elevation — instead of concluding the vault has nothing and
-   web-searching to compensate.
+   web-searching to compensate. **On `--role vm` this elevation is NOT
+   self-serve:** the VM leg clamps `--max-tier` to a hard ceiling
+   (`$BRAIN_VM_MAX_EGRESS_TIER`, default `Internal`), so a typed higher tier is
+   silently capped and the elevation hint is suppressed — raising a VM's ceiling
+   is a host-operator action, not something the model does on its own.
 
 3. **Never leak internal topics into a web search.** A web query for a
    Confidential-or-above subject — a deal codename, a counterparty, an internal

brainiac_cli-0.19.1/src/brain/_assets/overlay/template/cos/drafts.md

@@ -0,0 +1,25 @@
+---
+overlay_type: cos
+title: "Reply drafts — owner setting"
+setting: drafts
+---
+
+enabled: true
+
+## What this controls
+
+Whether the nightly chief-of-staff composes reply drafts into your Drafts
+folder for threads that warrant a response. It NEVER sends — sending is yours,
+structurally.
+
+- `enabled: true` (or this file absent) — compose drafts, cap 10/run.
+- `enabled: false` — no drafts; the run spends that budget on battlecards.
+
+## Why this file exists
+
+Without it a run has nowhere to read your answer, so a low draft-engagement
+count invites it to quietly stop drafting and ask you again every night. Your
+ruling lives here instead: durable, and outside the rolling skill-memory cap.
+
+Engagement (did you send/edit a draft?) is still measured and reported. It is
+DATA, not a verdict — an untouched draft may simply mean you have not looked.

brainiac_cli-0.19.1/src/brain/_assets/overlay/template/cos/priorities.md

@@ -0,0 +1,42 @@
+---
+overlay_type: cos
+title: "COS priority overrides — starter template"
+updated: 2026-07-13
+---
+
+# COS priority overrides
+
+OPTIONAL category (CUT-01E). `brain cos-priority-map` generates the
+VM-readable priority map from your `type: person` / `type: company` notes;
+list ids below to override the computed placement. One list line per note:
+
+`- <note-id>: high|normal|low|exclude`
+
+<!-- examples (replace with your own note ids):
+- contoso-acquisition-lead: high
+- northwind-vendor-contact: low
+- retired-supplier-x: exclude
+-->
+
+## Priority-chip taxonomy (chief-of-staff kernel v4.6 — companion block)
+
+The nightly run projects the act queue onto exactly three Outlook
+categories (recorded verbatim — category names are IMMUTABLE once created;
+a rename means delete + recreate + re-chip every tagged message):
+
+- `P0 · Now` — red
+- `P1 · Today` — orange
+- `P2 · This week` — blue
+
+`chips_confirmed` is the RUNTIME chip gate the nightly reads: chips are
+withheld (the legacy flat Action mark continues) until the owner's recorded
+YES to the queued name/color confirmation question, at which point the
+answering session sets:
+
+```
+chips_confirmed: false
+chips_confirmed_date:
+```
+
+(The answering session flips the value to `true` and dates it. Never
+pre-fill `true` — an uncommented `true` line IS the gate opening.)

{brainiac_cli-0.18.2 → brainiac_cli-0.19.1}/src/brain/_assets/scripts/brain-brief.sh

@@ -63,12 +63,14 @@ fi
 
 {
   echo "=== brain-daily-brief / brain-nightly $(date -u +%Y-%m-%dT%H:%M:%SZ) ==="
-  # cos-broker FIRST: the host broker fold claims VM proposal drops, releases due
-  # holds, runs auto-capture, enqueues the owner batch, and renders
-  # shared/spine-summary.md. Nothing else schedules it -- without this line the
-  # VM proposes into a drop dir no one drains (measured 2026-07-16: spine DB empty,
-  # candidates unclaimed ~29h) . It runs BEFORE maintain so notes it signs are
-  # indexed + published by the same run's sync. Host-only, idempotent, and
+  # cos-broker first — CORRECTION (2026-07-17): `brain maintain` ALSO runs the
+  # fold + the ingest sweep (core.py maintain, the CUT-01E block); the original
+  # claim here that "nothing else schedules it" was WRONG. The 2026-07-16 field
+  # failure (spine DB empty, candidates unclaimed ~29h) was actually the plist
+  # pinning a 0.17.0 engine whose fold predates the spine stage — maintain was
+  # calling the fold hourly all along, at a version that couldn't render it.
+  # This explicit call stays as defense-in-depth: idempotent, cheap, and it
+  # keeps the drain floor if maintain's internal block ever regresses.
   # NON-FATAL: a broker failure must never cost the vault its capture-drain floor.
   "$BRAIN_BIN" cos-broker --json || echo "brain-brief: cos-broker fold failed (non-fatal), continuing to maintain"
   # maintain: sync --publish (drain pending captures + reconcile index +

{brainiac_cli-0.18.2 → brainiac_cli-0.19.1}/src/brain/_assets/scripts/brain-synthesis.sh

@@ -28,7 +28,10 @@ mkdir -p "$LOG_DIR"
 LOG="$LOG_DIR/synthesis-$(date +%F).log"
 REGISTRY="${BRAIN_WORKSPACES_JSON:-$HOME/.brainiac/workspaces.json}"
 CLAUDE_BIN="${BRAIN_CLAUDE_BIN:-$(command -v claude || echo "$HOME/.local/bin/claude")}"
-MAX_TURNS="${BRAIN_SYNTHESIS_MAX_TURNS:-60}"
+# 120, not 60: the 2026-07-19 08:00 run died error_max_turns at 61 while the
+# 22:26 rerun needed 96 turns for the same scope — 60 cannot fit a real
+# synthesis pass over a week's transcript batch.
+MAX_TURNS="${BRAIN_SYNTHESIS_MAX_TURNS:-120}"
 
 log() { printf '%s %s\n' "$(date '+%F %T')" "$*" >> "$LOG"; }
 
@@ -95,17 +98,30 @@ PY
   # A per-run unique name (date + pid + two $RANDOM draws) avoids the
   # same-second collision the old date-second+pid name allowed (finding [9]).
   OUT_JSON="$LOG_DIR/synthesis-out-$(date +%F)-$$-${RANDOM}${RANDOM}.json"
+  # Allowlist covers the read-only diagnostics the watchdog prompt itself
+  # requires (logs, state files, index probes) — the 2026-07-19 runs burned
+  # 10+ turns on ls/cat/find/sqlite3/python3 denials. `Bash(python3 *)` is
+  # not a widening in practice: Write + `Bash(python3 tools/*)` already
+  # allowed arbitrary code by writing a file into tools/ first.
   ( cd "$WS" && BRAIN_VAULT="$VAULT" "$CLAUDE_BIN" -p "$PROMPT" \
       --max-turns "$MAX_TURNS" \
       --permission-mode acceptEdits \
       --output-format stream-json \
       --verbose \
-      --allowedTools "Read,Grep,Glob,Edit,Write,Bash(brain *),Bash(python3 tools/*)" \
+      --allowedTools "Read,Grep,Glob,Edit,Write,Bash(brain *),Bash(python3 *),Bash(ls *),Bash(cat *),Bash(head *),Bash(tail *),Bash(find *),Bash(grep *),Bash(wc *),Bash(sed *),Bash(sort *),Bash(uniq *),Bash(file *),Bash(diff *),Bash(sqlite3 *)" \
   ) < /dev/null > "$OUT_JSON" 2>>"$LOG"
   # < /dev/null: claude -p hangs forever reading a non-TTY stdin — and inside
   # this while-read loop it would otherwise inherit (and eat) the registry pipe
   RC=$?
   log "END synthesis: vault=$VAULT rc=$RC"
+  # Immediate failure ping (owner ask 2026-07-19): WATCHDOG-01 only trips at
+  # >8 days stale, which let two consecutive Sunday failures hide for two
+  # weeks. Best-effort banner, never fails the run; the durable channels are
+  # the log line above + synthesis-state.json (read by the session-start
+  # alerts hook).
+  if [ "$RC" -ne 0 ] && command -v osascript >/dev/null 2>&1; then
+    osascript -e "display notification \"weekly synthesis FAILED (rc=$RC) for $VAULT — see $LOG\" with title \"Brainiac health\"" >/dev/null 2>&1 || true
+  fi
   # Render a human-readable transcript from the structured NDJSON into $LOG
   # (finding [5]): the prior `tee`'d raw NDJSON REPLACED the readable session
   # transcript the weekly-watchdog prompt tells an operator to open. Structured

{brainiac_cli-0.18.2 → brainiac_cli-0.19.1}/src/brain/_version.py

@@ -9,4 +9,4 @@ pip-installed host, importlib.metadata stays primary; brain/__init__.py reads
 this file only as the fallback before 0.0.0+unknown.
 """
 
-__version__ = "0.18.2"
+__version__ = "0.19.1"

{brainiac_cli-0.18.2 → brainiac_cli-0.19.1}/src/brain/classification.py

@@ -44,6 +44,31 @@ if DEFAULT_MAX_TIER not in RANK:
 # Public + Internal only unless a human explicitly elevates with --max-tier.
 VM_DEFAULT_MAX_TIER = "Internal"
 
+# Hard server-side ceiling for the untrusted VM leg (codex 2026-07-19). On
+# role=vm, --max-tier is a caller-controlled argument the LLM can set itself;
+# without a clamp the egress-starvation hint ("re-run with --max-tier
+# Restricted") turns the intended HUMAN-gated elevation into an instruction the
+# model follows autonomously. This is the CLI analogue of the MCP adapter's
+# BRAIN_MAX_EGRESS_TIER: a VM caller can never exceed this ceiling regardless of
+# what it types. The host operator raises it deliberately via the env var (the
+# real human gate); an unrecognised value falls back to VM_DEFAULT_MAX_TIER.
+VM_EGRESS_CEILING_ENV = "BRAIN_VM_MAX_EGRESS_TIER"
+
+
+def vm_egress_ceiling() -> str:
+    """The tier a role=vm caller may never exceed. Operator-settable via
+    $BRAIN_VM_MAX_EGRESS_TIER; defaults to the conservative VM cap."""
+    val = os.environ.get(VM_EGRESS_CEILING_ENV, "").strip()
+    return val if val in RANK else VM_DEFAULT_MAX_TIER
+
+
+def clamp_to(requested: str, ceiling: str) -> str:
+    """Return the lower (less-sensitive) of two tiers by rank — a caller can
+    never widen egress past the ceiling, only narrow within it."""
+    req = requested if requested in RANK else DEFAULT_DENY_TIER
+    ceil = ceiling if ceiling in RANK else VM_DEFAULT_MAX_TIER
+    return req if RANK[req] <= RANK[ceil] else ceil
+
 
 def normalize(value: object) -> str:
     """Map a raw frontmatter value to a recognised tier, default-deny on miss."""

{brainiac_cli-0.18.2 → brainiac_cli-0.19.1}/src/brain/cli.py

@@ -164,6 +164,12 @@ def _emit(obj: Any, as_json: bool, human: str | None = None) -> None:
         sys.stdout.write((human if human is not None else str(obj)) + "\n")
 
 
+# Set True by main() on role=vm: the untrusted leg must not be told to
+# "re-run with --max-tier Restricted" — that hint is the self-elevation nudge
+# codex flagged, and the VM ceiling clamp makes the instruction a no-op anyway.
+_SUPPRESS_ELEVATION_HINT = False
+
+
 def _filter_dicts(items: list[dict], max_tier: str) -> tuple[list[dict], dict]:
     # THE single egress chokepoint — every content-returning subcommand routes
     # through egress.apply_gate so a new content path cannot silently bypass the
@@ -174,7 +180,8 @@ def _filter_dicts(items: list[dict], max_tier: str) -> tuple[list[dict], dict]:
     # web search — leaking internal topics outward. Say WHY it's thin and HOW to
     # elevate, in the report dict so it surfaces in BOTH --json (agent-facing)
     # and the text footer. The tier stays the human gate; this only signposts it.
-    if report.get("withheld", 0) > 0 and max_tier != cls.TIERS[-1]:
+    if (report.get("withheld", 0) > 0 and max_tier != cls.TIERS[-1]
+            and not _SUPPRESS_ELEVATION_HINT):
         report["hint"] = (
             f"{report['withheld']} note(s) withheld above the {max_tier} cap — "
             f"re-run with --max-tier Restricted (or MNPI for the most sensitive) "
@@ -1080,6 +1087,7 @@ VM_ALLOWED = frozenset({
 
 
 def main(argv: list[str] | None = None) -> int:
+    global _SUPPRESS_ELEVATION_HINT
     try:
         return _main(argv)
     except Exception as exc:  # H-4: top-level guard -- never a raw traceback
@@ -1088,6 +1096,11 @@ def main(argv: list[str] | None = None) -> int:
         _emit({"error": type(exc).__name__, "detail": str(exc)} if as_json
               else f"{exc.__class__.__name__}: {exc}", as_json)
         return 3
+    finally:
+        # The VM hint-suppression flag is INVOCATION-scoped (set by _main per
+        # role): reset it here so it never leaks into a later main() call or a
+        # direct _filter_dicts caller in the same process (e.g. across tests).
+        _SUPPRESS_ELEVATION_HINT = False
 
 
 def _main(argv: list[str] | None = None) -> int:
@@ -1103,6 +1116,14 @@ def _main(argv: list[str] | None = None) -> int:
     if getattr(args, "max_tier", "unset") is None:
         args.max_tier = (cls.VM_DEFAULT_MAX_TIER if role == config.ROLE_VM
                          else cls.DEFAULT_MAX_TIER)
+    # VM egress ceiling (codex 2026-07-19): on the untrusted leg, --max-tier is
+    # a value the LLM can set itself, and the starvation hint nudges it to. Clamp
+    # any VM-side max_tier to the operator-set ceiling so a typed --max-tier MNPI
+    # cannot self-elevate past it; the hint is also suppressed for role=vm below.
+    global _SUPPRESS_ELEVATION_HINT
+    _SUPPRESS_ELEVATION_HINT = (role == config.ROLE_VM)  # deterministic per call
+    if role == config.ROLE_VM and hasattr(args, "max_tier"):
+        args.max_tier = cls.clamp_to(str(args.max_tier), cls.vm_egress_ceiling())
     # DV-03: the VM leg fails closed on a dead embedder rather than silently
     # answering semantic queries with random hash vectors (no-op when a real
     # embedder is present or hash was chosen explicitly).
@@ -1371,7 +1392,8 @@ def _main(argv: list[str] | None = None) -> int:
                 + srep["withheld_unlabelled_default_deny"],
             "max_tier": args.max_tier,
         }
-        if report["withheld"] > 0 and args.max_tier != cls.TIERS[-1]:
+        if (report["withheld"] > 0 and args.max_tier != cls.TIERS[-1]
+                and not _SUPPRESS_ELEVATION_HINT):
             report["hint"] = (
                 f"{report['withheld']} note(s) withheld above the "
                 f"{args.max_tier} cap — re-run with a higher --max-tier.")

{brainiac_cli-0.18.2 → brainiac_cli-0.19.1}/src/brain/core.py

@@ -2125,19 +2125,59 @@ class BrainCore:
         """Append ``entry_md`` to ``hot.md`` guarded by an idempotency-key
         HTML comment; a no-op (returns ``False``) if the key is already
         present — the per-branch/per-run-date idempotency guard for every
-        scheduled fold that queues a hot-queue entry (HARDENED:codex)."""
+        scheduled fold that queues a hot-queue entry (HARDENED:codex).
+
+        Two shared gates live HERE so every fold renderer inherits them:
+        (1) vault-absolute paths are rewritten vault-relative (retro
+        signature ``absolute-paths`` — an absolute path in fold output goes
+        stale on a vault move); (2) the idempotency check also scans rotated
+        ``archive/hot-*.md`` segments, so an entry rotated out by
+        ``_rotate_hot_md`` is never re-appended under the same key."""
+        import os as _os
         path = self._hot_md_path()
         path.parent.mkdir(parents=True, exist_ok=True)
+        for root in {str(self.vault), str(Path(self.vault).resolve())}:
+            entry_md = entry_md.replace(root.rstrip(_os.sep) + _os.sep, "")
         marker = f"<!-- idempotency-key: {key} -->"
         existing = path.read_text(encoding="utf-8") if path.exists() else ""
         if marker in existing:
             return False
+        # ponytail: linear scan of rotated segments; index them if they ever
+        # number in the hundreds.
+        for seg in sorted((path.parent / "archive").glob("hot-*.md")):
+            try:
+                if marker in seg.read_text(encoding="utf-8"):
+                    return False
+            except OSError:
+                continue
         with path.open("a", encoding="utf-8") as fh:
             if existing and not existing.endswith("\n"):
                 fh.write("\n")
             fh.write(marker + "\n" + entry_md.rstrip("\n") + "\n\n")
         return True
 
+    def _rotate_hot_md(self, today: Any) -> bool:
+        """Rotate aged, resolved hot.md entries into ``archive/hot-<date>.md``
+        once the live file exceeds the soft cap (retro signature
+        ``hot-md-bloat``) — same auto-rotate posture handoff.md already has.
+        Pure judgment lives in ``maintenance.rotate_hot_md``; this method is
+        the file I/O. Returns True when a rotation happened."""
+        from . import maintenance as maint
+        path = self._hot_md_path()
+        if not path.exists():
+            return False
+        kept, rotated = maint.rotate_hot_md(
+            path.read_text(encoding="utf-8"), today)
+        if not rotated:
+            return False
+        archive_dir = path.parent / "archive"
+        archive_dir.mkdir(parents=True, exist_ok=True)
+        seg = archive_dir / f"hot-{today.isoformat()}.md"
+        with seg.open("a", encoding="utf-8") as fh:
+            fh.write(rotated)
+        path.write_text(kept, encoding="utf-8")
+        return True
+
     # -- Tier-2 owner question queue (PUSH redesign, 2026-07-13) --------------
     def _inbox_path(self) -> Path:
         return config.memory_dir(self.vault) / "inbox.jsonl"
@@ -2970,8 +3010,13 @@ class BrainCore:
                                     curate_res["stale_links"], curate_res["revisit_sample"], d),
                             )
                         if promote_res.get("candidates"):
+                            # Idempotency key = hash of the DISTINCT candidate-id
+                            # set, NOT the run date — an unchanged candidate set
+                            # isn't re-reported every run under a fresh key
+                            # (retro signature: duplicate-findings).
                             self._append_hot_once(
-                                f"maintain:promote-scan:{d.isoformat()}",
+                                "maintain:promote-scan:"
+                                + maint.promote_scan_finding_key(promote_res["candidates"]),
                                 maint.render_promote_scan_hot_entry(promote_res["candidates"], d),
                             )
                         results["digest_html"] = self.digest_html(days=7, today=d)
@@ -3371,6 +3416,13 @@ class BrainCore:
             results["notifications"] = notifications
 
             if not dry_run:
+                # hot-md-bloat: rotate aged/resolved entries to archive/ once
+                # the live file exceeds the soft cap. Best-effort hygiene —
+                # never allowed to fail the maintain run.
+                try:
+                    self._rotate_hot_md(d)
+                except Exception:  # noqa: BLE001
+                    pass
                 # In-process graphify (owner decision 2026-07-11): the
                 # `_graphify_drift` marker is written by `_run_bounded_graphify`
                 # within THIS process, into THIS `state` dict, so `state` already

{brainiac_cli-0.18.2 → brainiac_cli-0.19.1}/src/brain/cos.py

@@ -963,6 +963,132 @@ def shadow_ledger_entries(vault) -> list[dict[str, Any]]:
     return list(by_key.values())
 
 
+# -- behavioural grading (2026-07-17, owner decision) --------------------------
+# The corrections-based calibration required ~10 mornings of the owner grading
+# email by hand; across 6 rounds / 308 verdicts he filed ZERO — the ritual will
+# never happen, so auto-archive was permanently gated on evidence that could
+# not accrue. Behavioural grading replaces stated preference with revealed
+# preference: the VM already reads the mailbox nightly, so it OBSERVES what the
+# owner actually did to previously-verdicted mail (read / replied / flagged /
+# archived himself / untouched) and drops raw observations; THIS module grades
+# them, in one testable place. Owner ruling: also mine his own archive actions
+# as pattern evidence — "albeit not exclusively".
+
+BEHAVIOUR_OBSERVATIONS = ("owner_replied", "owner_flagged", "owner_read",
+                          "owner_archived", "untouched")
+
+# Legacy VM-drop key scheme (pre-canonical-msg_key): `content-rejoin:<sender>|
+# <subject>` rows join 0/10 to any verdict row's msg_key (field evidence,
+# behaviour-r12.jsonl 2026-07-18) — grading them double-counts mail that is
+# already graded under its canonical key, so they are excluded from BOTH the
+# numerator and denominator of the consistency/contradiction rates.
+LEGACY_REJOIN_PREFIX = "content-rejoin:"
+
+
+def grade_behaviour(bucket: str, observed: str, *,
+                    auto_archived: bool = False) -> str:
+    """One verdict row + one observed behaviour -> a grade.
+
+    The error that matters for auto-archive is exactly one: "would have
+    archived mail the owner needed". So a NOISE verdict the owner then replied
+    to or flagged is `contradicted` — the hard, gate-relevant failure. A noise
+    row he merely opened is `read_anyway`: a weak signal (people open
+    newsletters), reported but never gated on. Noise he left untouched or
+    archived himself is `consistent`. An act/read row he archived without
+    engaging is `overcalled` — over-caution, harmless, informational.
+    """
+    b, o = str(bucket).lower(), str(observed).lower()
+    # Aged-read lane (owner policy 2026-07-17): priority-list mail may be
+    # auto-archived when read + no-action + >7d old. Those rows are bucket
+    # `read`, not `noise` — so the drift contradiction must key on the ACTION
+    # (we auto-archived it), not the bucket: the owner replying to or flagging
+    # ANY row we auto-archived is the gate error, whichever lane moved it.
+    if auto_archived and o in ("owner_replied", "owner_flagged"):
+        return "contradicted"
+    if b == "noise":
+        if o in ("owner_replied", "owner_flagged"):
+            return "contradicted"
+        if o == "owner_read":
+            return "read_anyway"
+        if o in ("untouched", "owner_archived"):
+            return "consistent"
+    elif b in ("act", "read") and o == "owner_archived":
+        return "overcalled"
+    return "neutral"
+
+
+def behaviour_entries(vault) -> list[dict[str, Any]]:
+    """Raw behaviour observations from the VM drop (``behaviour-*.jsonl``),
+    deduped by (round, msg_key) — last write wins, same idempotency shape as
+    the shadow ledger. Rows are VM-authored and untrusted: consumed as data."""
+    vdir = verdict_drop_dir(vault)
+    files = sorted(vdir.glob("behaviour-*.jsonl")) if vdir.is_dir() else []
+    by_key: dict[tuple[int, str], dict[str, Any]] = {}
+    for f in files:
+        for e in _read_jsonl(f):
+            r, k = e.get("round"), e.get("msg_key")
+            if isinstance(r, int) and isinstance(k, str):
+                by_key[(r, k)] = e
+    return list(by_key.values())
+
+
+def behaviour_report(vault) -> dict[str, Any]:
+    """Aggregate observed-behaviour evidence: per-bucket grade counts, the
+    noise-safety numbers an auto-archive re-arm decision needs, and the
+    owner's own archive patterns (top senders he archives himself — evidence
+    for FUTURE noise-signals, never an actuator by itself)."""
+    entries = behaviour_entries(vault)
+    # Exclusion (2026-07-18 field report): legacy `content-rejoin:` keys — and,
+    # when a shadow ledger exists, any row whose msg_key joins no verdict —
+    # never enter the rates. No ledger at all ⇒ only the legacy scheme is
+    # excludable (can't prove a join miss against nothing).
+    ledger = known_ledger_keys(vault)
+    verdict_keys = {k for _, k in ledger} if ledger else None
+    excluded = 0
+    joined: list[dict[str, Any]] = []
+    for e in entries:
+        k = str(e.get("msg_key", ""))
+        if k.startswith(LEGACY_REJOIN_PREFIX) or (
+                verdict_keys is not None and k not in verdict_keys):
+            excluded += 1
+            continue
+        joined.append(e)
+    entries = joined
+    per_bucket: dict[str, dict[str, int]] = {}
+    contradicted_rows: list[dict[str, Any]] = []
+    owner_archive_patterns: dict[str, int] = {}
+    rounds: set[int] = set()
+    for e in entries:
+        b = str(e.get("bucket", "?")).lower()
+        o = str(e.get("observed", "?")).lower()
+        g = grade_behaviour(b, o, auto_archived=bool(e.get("auto_archived")))
+        per_bucket.setdefault(b, {})[g] = per_bucket.setdefault(b, {}).get(g, 0) + 1
+        rounds.add(int(e["round"]))
+        if g == "contradicted":
+            contradicted_rows.append(
+                {k: e.get(k) for k in ("round", "msg_key", "sender", "subject",
+                                        "observed")})
+        if o == "owner_archived":
+            key = str(e.get("sender") or e.get("sender_domain") or "unknown").lower()
+            owner_archive_patterns[key] = owner_archive_patterns.get(key, 0) + 1
+    noise = per_bucket.get("noise", {})
+    noise_observed = sum(noise.values())
+    contradicted = noise.get("contradicted", 0)
+    return {
+        "observations": len(entries),
+        "excluded_unjoined": excluded,
+        "rounds_observed": len(rounds),
+        "per_bucket": per_bucket,
+        "noise_observed": noise_observed,
+        "noise_contradicted": contradicted,
+        "noise_consistency": (round((noise_observed - contradicted) / noise_observed, 4)
+                              if noise_observed else None),
+        "contradicted_rows": contradicted_rows[:20],
+        "owner_archive_patterns": dict(sorted(owner_archive_patterns.items(),
+                                              key=lambda kv: -kv[1])[:20]),
+    }
+
+
 def calibration_report(vault) -> dict[str, Any]:
     """Shadow-mode trust-gate report: calibration = reduce(verdicts,
     correction_events). A verdict is bucket-correct when no correction exists
@@ -998,6 +1124,10 @@ def calibration_report(vault) -> dict[str, Any]:
         "overall_bucket_precision": (round(bucket_correct / total, 4)
                                      if total else None),
         "per_bucket": buckets,
+        # revealed preference alongside stated preference: the corrections
+        # count above stays authoritative where it exists, but 0 corrections
+        # no longer means 0 evidence.
+        "behaviour": behaviour_report(vault),
     }
 
 
@@ -1451,7 +1581,18 @@ def _is_keeper_counterparty(vault, counterparty: str | None) -> bool:
     if not counterparty:
         return False
     overrides = load_priority_overrides(vault)
-    return overrides.get(str(counterparty).lower()) == "high"
+    name = str(counterparty).lower()
+    if overrides.get(name) == "high":
+        return True
+    # Override keys are NOTE-ID SLUGS (the only form _OVERRIDE_LINE_RE parses),
+    # but a commitment's counterparty is a display name from mail — e.g. a name
+    # like "Renée Dûval" could never equal "renee-duval", so keeper detection
+    # silently never fired (found 2026-07-17, the day the first real roster was
+    # written). Compare in slug space, accents folded.
+    import unicodedata
+    folded = unicodedata.normalize("NFKD", name).encode("ascii", "ignore").decode()
+    slug = re.sub(r"[^a-z0-9]+", "-", folded).strip("-")
+    return overrides.get(slug) == "high"
 
 
 def _spine_ingest_commitment(vault, meta: dict[str, Any], *, source_ref: str,
@@ -1527,6 +1668,13 @@ DEFAULT_INGEST_SWEEP_MAX_BYTES = 200 * 1024 * 1024
 INGEST_SWEEP_DOWNLOADS_ENV = "BRAIN_COS_DOWNLOADS_DIR"
 INGEST_SWEEP_SKEW_SECONDS = 300          # manifest ts vs file mtime clock skew
 INGEST_SWEEP_SIZE_TOLERANCE = 0.10       # when the manifest carries a size
+# Host-observed freshness floor (codex 2026-07-19): a candidate whose mtime is
+# older than this relative to the sweep's OWN clock is a pre-existing host file,
+# not something the VM just downloaded — the un-forgeable provenance anchor. The
+# maintain umbrella fires hourly; a 6h window tolerates a few missed runs / a
+# sleeping Mac while still excluding files that have sat in Downloads for days.
+INGEST_SWEEP_RECENCY_ENV = "BRAIN_COS_SWEEP_RECENCY_SECONDS"
+DEFAULT_INGEST_SWEEP_RECENCY_SECONDS = 6 * 3600
 
 
 def ingest_manifest_dir(vault=None) -> Path:
@@ -1550,6 +1698,14 @@ def _sweep_max_bytes() -> int:
         return DEFAULT_INGEST_SWEEP_MAX_BYTES
 
 
+def _sweep_recency_seconds() -> int:
+    try:
+        return int(os.environ.get(INGEST_SWEEP_RECENCY_ENV,
+                                  DEFAULT_INGEST_SWEEP_RECENCY_SECONDS))
+    except ValueError:
+        return DEFAULT_INGEST_SWEEP_RECENCY_SECONDS
+
+
 def _unique_dest(inbox: Path, filename: str) -> Path:
     dest = inbox / filename
     if not dest.exists():
@@ -1572,8 +1728,12 @@ def ingest_sweep(vault, *, downloads_dir: Path | str | None = None,
     - filenames are basename-only — any path separator / ``..`` is refused;
     - a symlinked candidate (or manifest file) is refused, never followed;
     - files above the size cap (default 200 MB) are refused;
-    - a match requires exact filename, size within tolerance when the
-      manifest carries one, and mtime newer than the manifest ts minus skew;
+    - a candidate must be a FRESH download — mtime within the recency window of
+      the sweep's own clock — so a VM manifest cannot claim a pre-existing host
+      Downloads file it did not just download (codex 2026-07-19, VM/host
+      boundary): the mtime is the one provenance signal the VM cannot forge;
+    - a match requires exact filename, size within tolerance when the manifest
+      carries one, and mtime newer than the manifest ts minus skew;
     - claims are append-only, one per manifest line — a re-run never
       double-moves (idempotent);
     - NOTHING the manifest does not name is ever touched, moved, or deleted.
@@ -1653,6 +1813,26 @@ def ingest_sweep(vault, *, downloads_dir: Path | str | None = None,
                 report["refused"].append({"filename": fname,
                                           "reason": "over size cap"})
                 continue
+            # SECURITY (codex 2026-07-19, VM/host boundary): the manifest is
+            # VM-writable, so its own fields cannot prove provenance — the VM
+            # can name any basename and BACKDATE `ts` to defeat the staleness
+            # check on an old host file. The one thing a VM-side attacker CANNOT
+            # forge is a host file's mtime, so the sweep's OWN clock is the
+            # anchor: only a file whose mtime is recent relative to `now` — i.e.
+            # one genuinely downloaded within this maintenance window — is
+            # eligible. A guessed sensitive file that has been sitting in
+            # ~/Downloads (tax.pdf, statement.pdf …) is refused regardless of
+            # what the manifest claims. Widen the window via env for slow hosts.
+            age = now.timestamp() - cand.stat().st_mtime
+            if age > _sweep_recency_seconds():
+                report["unmatched"].append(fname)
+                report.setdefault("unmatched_reasons", []).append({
+                    "filename": fname,
+                    "reason": f"not a fresh download: host mtime is {age / 3600.0:.1f}h "
+                              f"old (recency window {_sweep_recency_seconds() // 3600}h) "
+                              f"— a pre-existing host file the VM manifest cannot claim",
+                })
+                continue
             want = entry.get("approx_size_bytes")
             if isinstance(want, int) and want > 0:
                 if abs(size - want) > max(want * INGEST_SWEEP_SIZE_TOLERANCE, 4096):