brainiac-cli 0.20.32__tar.gz → 0.20.34__tar.gz

{brainiac_cli-0.20.32/src/brainiac_cli.egg-info → brainiac_cli-0.20.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brainiac-cli
-Version: 0.20.32
+Version: 0.20.34
 Summary: Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index).
 License-Expression: Apache-2.0
 Requires-Python: >=3.9

{brainiac_cli-0.20.32 → brainiac_cli-0.20.34}/pyproject.toml

@@ -8,7 +8,7 @@ build-backend = "setuptools.build_meta"
 # check. The IMPORT package stays `brain` and the console script stays
 # `brain` — only the distribution/project name changes.
 name = "brainiac-cli"
-version = "0.20.32"
+version = "0.20.34"
 description = "Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index)."
 readme = "README.md"
 license = "Apache-2.0"

{brainiac_cli-0.20.32 → brainiac_cli-0.20.34}/src/brain/_assets/AGENTS.md

@@ -65,7 +65,9 @@ profile-a-brain/
                             inbox, routines copy (gitignored). The live
                             index.sqlite + audit chain live in the per-user
                             app-data dir (`config.index_dir()`); override
-                            with $BRAIN_INDEX_DIR per vault.
+                            with $BRAIN_INDEX_DIR per vault, or move the
+                            whole app-data base with $BRAIN_APP_DATA_DIR
+                            (which keeps the per-vault nesting).
                             ├── memory/      ← session memory: handoff.md,
                             │                  hot.md, lessons.md, archive/
                             │                  (host-only, never indexed — §9)
@@ -1072,11 +1074,23 @@ Obsidian "five-step retrieval cascade" rule for any harness reading this file.
 > `brain-mcp` adapter. Full table: `docs/harness-wiring.md`.
 >
 > **Cowork-Windows VM (PRIMARY surface):** Cowork is Claude Desktop's Linux VM
-> sandbox execution mode (`docs/glossary.md`). Run `brain --role vm` (or
-> `export BRAIN_ROLE=vm`). The VM is **read + draft only** — it reads ONLY the
-> published read-only snapshot in `.brain/snapshot/` (never WAL), captures via
-> `brain draft-capture` into `.brain/capture-inbox/`, and never resolves a signing
-> key; the host drains + signs + indexes + republishes the snapshot. Install +
+> sandbox execution mode (`docs/glossary.md`). **Two shapes exist, and which
+> one a given workspace runs depends on whether it has been through Closed
+> Stacks s07's cutover (2026-08-27 → 2026-08-30, VULN-3385).** Pre-cutover /
+> co-located: run `brain --role vm` (or `export BRAIN_ROLE=vm`) — the VM is
+> **read + draft only**, reading ONLY the published read-only snapshot in
+> `.brain/snapshot/` (never WAL), capturing via `brain draft-capture` into
+> `.brain/capture-inbox/`, never resolving a signing key; the host drains +
+> signs + indexes + republishes the snapshot. **Post-cutover (a relocated
+> workspace):** the vault is not attached to the VM's mount at all — `brain`
+> is not on the session's `PATH`, and there is no local snapshot to read —
+> every read reaches the vault only through the host `brain-mcp` broker,
+> which applies the same classification filter and now writes a fail-closed
+> audit record before returning content. The broker's ceiling for this leg is
+> still the same full-vault default the host itself uses (no per-caller tier
+> narrowing is configured), so a relocated workspace is a MITIGATION of
+> VULN-3385, not a closure — full posture and residual:
+> `docs/install/cowork.md`, `docs/security/vuln-3385-risk-reduction.md`. Install +
 > per-session PATH/model re-export: `docs/cowork-windows-install.md`.
 >
 > **Where the kernel skills live per client:** the ten
@@ -1217,6 +1231,22 @@ The VM is a **read + draft** surface only; the host is the **only writer**.
    atomically republishes the read-only, generation-stamped snapshot into
    `.brain/snapshot/`. Only now is the note retrievable from the VM.
 
+**In-place updates (UPD-01, 2026-08-30).** A duplicate id used to be a dead
+end: the drain skipped it forever, silently — a Cowork session's rule update
+sat refused in `capture-inbox/` for 11 days while the session believed it had
+applied. A draft may now declare an IN-PLACE update of an existing note with
+two transport-only frontmatter keys: `updates: <id>` (must equal the draft's
+own id) and `base_sha256: <sha>` (the `sha256` that `brain get` returned for
+the version the author read). The drain applies it through the same signed
+`write_note` path ONLY when the live note is untrusted-lane-authored
+(`provenance.trust: untrusted`) and under `brain/` — the untrusted leg may
+rewrite what the untrusted lane wrote, never a host-authored note (those skip
+`update-needs-owner`; apply on the host with `brain write`) and never `raw/`
+(append-only). A base-hash mismatch skips as `stale-base` instead of
+clobbering a newer write. The transport keys are dropped before signing, and
+`brain alerts` now reports any draft still in the inbox after 48h
+(`stuck-drafts`) — a refusal is never silent again.
+
 ### VM-request → host-drain vault provisioning (PRV-10, 2026-08-17)
 
 A Cowork session can also create a whole NEW vault, with the same trust

{brainiac_cli-0.20.32 → brainiac_cli-0.20.34}/src/brain/_assets/scripts/install-brief-mac.sh

@@ -40,9 +40,14 @@ if [ -z "$LABEL" ]; then
     LABEL="com.brainiac.nightly.$_h"
 fi
 
+# THE SAME override brain.config.nightly_plist_path reads. A test (or a
+# sandboxed install) that redirects one must redirect both, or a test that
+# merges a sweep dir reads, backs up and rewrites the developer's REAL plist --
+# $HOME is not enough, because launchctl talks to the login domain by uid.
+LAUNCH_AGENTS_DIR="${BRAIN_LAUNCH_AGENTS_DIR:-$HOME/Library/LaunchAgents}"
 LEGACY_LABEL="com.profile-a-brain.daily-brief"
-LEGACY_PLIST="$HOME/Library/LaunchAgents/$LEGACY_LABEL.plist"
-PLIST_DST="$HOME/Library/LaunchAgents/$LABEL.plist"
+LEGACY_PLIST="$LAUNCH_AGENTS_DIR/$LEGACY_LABEL.plist"
+PLIST_DST="$LAUNCH_AGENTS_DIR/$LABEL.plist"
 LOGDIR="${BRAIN_LOG_DIR:-$HOME/.brain/logs}"
 
 # Audit signing key: the drain resolves it from the macOS Keychain AT RUNTIME
@@ -53,6 +58,12 @@ LOGDIR="${BRAIN_LOG_DIR:-$HOME/.brain/logs}"
 # injected BRAIN_AUDIT_KEY_PEM (custom custody / unattended box) — and the
 # plist is chmod 600 below either way.
 KEYCHAIN_SERVICE="${BRAIN_AUDIT_KEYCHAIN_SERVICE:-profile-a-brain-audit-key}"
+# `set -u` + an unset $USER is a hard abort, not a fallback: launchd, cron and
+# any `env -i` caller hand this script an environment without USER, and both
+# uses below took the script down at line 75 with "USER: unbound variable"
+# BEFORE it could write a plist. Measured 2026-08-30 running
+# `brain provision-local` end to end: wire 1 reported `init: exit 1`.
+KEY_ACCOUNT="${USER:-$(id -un)}"
 AUDIT_KEY="${BRAIN_AUDIT_KEY_PEM:-}"
 
 # Managed endpoints (BRAIN_MANAGED=1) resolve the key ONLY from the OS keystore
@@ -67,14 +78,65 @@ if [ -n "${BRAIN_MANAGED:-}" ] && [ "${BRAIN_MANAGED}" != "0" ] && [ -n "$AUDIT_
 fi
 
 if [ -z "$AUDIT_KEY" ]; then
-    if ! security find-generic-password -s "$KEYCHAIN_SERVICE" -a "$USER" >/dev/null 2>&1; then
+    if ! security find-generic-password -s "$KEYCHAIN_SERVICE" -a "$KEY_ACCOUNT" >/dev/null 2>&1; then
         echo "WARNING: No Keychain entry for '$KEYCHAIN_SERVICE'." >&2
         echo "         Captures will not be signed (drain fails closed). Run 'brain audit-key'" >&2
         echo "         (create-if-absent, never rotates) — no reinstall needed after." >&2
     fi
 fi
 
-mkdir -p "$LOGDIR" "$HOME/Library/LaunchAgents"
+mkdir -p "$LOGDIR" "$LAUNCH_AGENTS_DIR"
+
+# THE PLIST IS THE DURABLE HOME OF THE SWEEP LIST, for every caller.
+# This script re-renders the whole body on every run and reinstalls when it
+# differs, so an UNSET $BRAIN_WORKSPACE_SWEEP_DIRS used to bake an empty string
+# -- and any `brain init --full --apply` from a bare shell (a reinstall, a
+# second vault, an old doc, `brain update`) silently wiped a list somebody had
+# configured. Unset now means "keep what is installed"; an explicitly SET value
+# still wins, including an explicit empty one (the operator's intent).
+if [ -n "${BRAIN_WORKSPACE_SWEEP_DIRS+set}" ]; then
+    SWEEP_DIRS="$BRAIN_WORKSPACE_SWEEP_DIRS"
+elif [ -f "$PLIST_DST" ]; then
+    SWEEP_DIRS="$(/usr/libexec/PlistBuddy -c \
+        "Print :EnvironmentVariables:BRAIN_WORKSPACE_SWEEP_DIRS" \
+        "$PLIST_DST" 2>/dev/null || true)"
+else
+    SWEEP_DIRS=""
+fi
+# EVERY value substituted into the plist below goes through this, because each
+# one is escaped TWICE over and both stages are load-bearing.
+#
+# 1. The value lands inside an XML <string>, so `&` and `<` in a folder name
+#    would render a plist nothing can parse -- and the PlistBuddy round-trip
+#    above reads the value back out unescaped, so it would corrupt a little
+#    more on every run.
+# 2. ...and THEN it becomes a sed REPLACEMENT, where `\`, `&` and the `|`
+#    delimiter are metacharacters of their own. A bare `&` in a replacement
+#    means "the whole match", so the `&` stage 1 just wrote as `&amp;`
+#    re-inserts the literal placeholder text: probed 2026-08-30,
+#    BRAIN_WORKSPACE_SWEEP_DIRS=/tmp/A&B<C rendered as
+#    `/tmp/ASWEEP_DIRS_PLACEHOLDERamp;BSWEEP_DIRS_PLACEHOLDERlt;C`, and
+#    VAULT=/tmp/A&B<C rendered `<string>/tmp/AVAULT_PATHB<C</string>` --- an
+#    unparseable plist from an ORDINARY path (`R&D`, `Smith & Co`).
+#
+# It is a function because doing it for the sweep list alone left the two
+# substitutions directly below it raw (probed 2026-08-30). $AUDIT_KEY needs no
+# metacharacter escaping -- base64 and the PEM header contain none of \ & | < --
+# and $LABEL is `com.brainiac.nightly.<hex8>` by construction. It is NOT used
+# on $AUDIT_KEY, though: a real PEM carries embedded NEWLINES (multi-line,
+# `-----BEGIN...-----\n<body>\n-----END...-----\n`), and a `sed -e` REPLACEMENT
+# cannot hold a raw newline without a `\`-continuation before each one -- an
+# unescaped one is a parse error, not silent corruption. AUDIT_KEY gets its own
+# newline-safe substitution below instead of going through this sed pipeline.
+xml_sed_escape() {
+    printf '%s' "$1" | sed -e 's/&/\&amp;/g' -e 's/</\&lt;/g' \
+                     | sed -e 's/[\\&|]/\\&/g'
+}
+
+SWEEP_DIRS_SED="$(xml_sed_escape "$SWEEP_DIRS")"
+VAULT_SED="$(xml_sed_escape "$VAULT")"
+HOME_SED="$(xml_sed_escape "$HOME")"
+SCRIPTS_SED="$(xml_sed_escape "$SCRIPTS")"
 
 # Render the plist to a scratch file first so we can diff against whatever is
 # already installed — the nightly-diff contract (docs/install/plugin-distribution.md
@@ -84,18 +146,60 @@ PLIST_NEW="$(mktemp "${TMPDIR:-/tmp}/brain-brief-mac.plist.XXXXXX")"
 trap 'rm -f "$PLIST_NEW"' EXIT
 
 sed -e "s|LABEL_PLACEHOLDER|$LABEL|g" \
-    -e "s|SCRIPTS_DIR|$SCRIPTS|g" \
-    -e "s|VAULT_PATH|$VAULT|g" \
-    -e "s|HOME_DIR|$HOME|g" \
-    -e "s|AUDIT_KEY_PEM_PLACEHOLDER|$AUDIT_KEY|g" \
-    -e "s|SWEEP_DIRS_PLACEHOLDER|${BRAIN_WORKSPACE_SWEEP_DIRS:-}|g" \
+    -e "s|SCRIPTS_DIR|$SCRIPTS_SED|g" \
+    -e "s|VAULT_PATH|$VAULT_SED|g" \
+    -e "s|HOME_DIR|$HOME_SED|g" \
+    -e "s|SWEEP_DIRS_PLACEHOLDER|$SWEEP_DIRS_SED|g" \
     "$PLIST_SRC" > "$PLIST_NEW"
 
+# AUDIT_KEY_PEM_PLACEHOLDER: substituted OUTSIDE the sed pipeline above with
+# awk, whose replacement text is an ordinary string (no per-`-e`-argument
+# newline restriction) rather than a sed script fragment --- the same
+# multi-line value that breaks `sed -e "s|X|$AUDIT_KEY|g"` (probed 2026-08-31,
+# running `provision-local` end to end with a synthetic Ed25519 test key:
+# "sed: 1: ...: unescaped newline inside substitute pattern") assigns straight
+# through `ENVIRON["AUDIT_KEY"]` here. Trailing newline(s) are stripped by the
+# `$( )` around printf below (command substitution always strips them),
+# matching what the OLD single-line sed substitution effectively produced too.
+# NOT guarded on a non-empty $AUDIT_KEY. Managed mode (line 74) and a box with
+# no key both set it to "", and the placeholder MUST still be replaced --- by
+# nothing. A guard here skipped the awk and left the literal string
+# `AUDIT_KEY_PEM_PLACEHOLDER` baked into the plist as BRAIN_AUDIT_KEY_PEM
+# (probed 2026-08-31 against the pre-change script, which rendered
+# `<string></string>`), handing every managed endpoint a garbage PEM instead of
+# the empty value that makes the runtime fall back to the Keychain. `split("")`
+# yields no fields, so `pem[1]` is "" and the placeholder collapses to nothing.
+AUDIT_KEY_TRIMMED="$(printf '%s' "$AUDIT_KEY")"
+AUDIT_KEY="$AUDIT_KEY_TRIMMED" awk '
+        function xml_awk_escape(s) {
+            # Same two-char XML entity escape as xml_sed_escape above --- `&`
+            # first, so `<` does not re-encode the `&` that step just wrote.
+            # No sub()/gsub()-replacement-side "&" concern here: this gsub
+            # RUNS the escape, it is not used as another calls REPLACEMENT
+            # argument (that is the substr()-based split below, precisely to
+            # avoid needing a second round of escaping on top of this one).
+            gsub(/&/, "\\&amp;", s); gsub(/</, "\\&lt;", s); return s
+        }
+        {
+            pos = index($0, "AUDIT_KEY_PEM_PLACEHOLDER")
+            if (!pos) { print; next }
+            n = split(ENVIRON["AUDIT_KEY"], pem, "\n")
+            prefix = substr($0, 1, pos - 1)
+            suffix = substr($0, pos + length("AUDIT_KEY_PEM_PLACEHOLDER"))
+            # substr()/printf concatenation only, below --- never sub()/gsub()
+            # with pem[i] as the REPLACEMENT argument, which would reinterpret
+            # any literal "&" the escape above just wrote as "insert match".
+            printf "%s%s", prefix, xml_awk_escape(pem[1])
+            for (i = 2; i <= n; i++) printf "\n%s", xml_awk_escape(pem[i])
+            print suffix
+        }
+    ' "$PLIST_NEW" > "$PLIST_NEW.awk" && mv "$PLIST_NEW.awk" "$PLIST_NEW"
+
 # ponytail: real launchctl talks to the login launchd domain by uid, not by
 # $HOME — a sandboxed HOME does NOT sandbox launchctl. BRAIN_LAUNCHD_DRY_RUN=1
 # (or a non-default HOME, detected below) skips the real bootstrap/load calls
 # so test/sandbox runs never touch the real user's launchd domain.
-if [ -z "${BRAIN_LAUNCHD_DRY_RUN:-}" ] && [ "$HOME" != "$(eval echo ~"$USER")" ]; then
+if [ -z "${BRAIN_LAUNCHD_DRY_RUN:-}" ] && [ "$HOME" != "$(eval echo ~"$KEY_ACCOUNT")" ]; then
     BRAIN_LAUNCHD_DRY_RUN=1
 fi
 
@@ -140,10 +244,13 @@ echo "✓ Installed: $LABEL (hourly umbrella, vault: $VAULT)"
 # vault in ~/.brainiac/workspaces.json, so re-running this installer for a
 # second vault just refreshes the same host-level agent. Weekly Sun 08:00.
 SYNTH_SRC="$SCRIPTS/brain-synthesis-mac.plist"
-SYNTH_DST="$HOME/Library/LaunchAgents/com.brainiac.synthesis.plist"
+SYNTH_DST="$LAUNCH_AGENTS_DIR/com.brainiac.synthesis.plist"
 if [ -f "$SYNTH_SRC" ]; then
     SYNTH_NEW="$(mktemp "${TMPDIR:-/tmp}/brain-synthesis-mac.plist.XXXXXX")"
-    sed -e "s|SCRIPTS_DIR|$SCRIPTS|g" -e "s|HOME_DIR|$HOME|g" \
+    # Same two-stage escaping as the nightly block above: a raw $SCRIPTS or
+    # $HOME carrying `&`, `<` or `|` corrupts this plist too (see the worked
+    # example at the top of the nightly substitution).
+    sed -e "s|SCRIPTS_DIR|$SCRIPTS_SED|g" -e "s|HOME_DIR|$HOME_SED|g" \
         "$SYNTH_SRC" > "$SYNTH_NEW"
     if ! cmp -s "$SYNTH_NEW" "$SYNTH_DST" 2>/dev/null; then
         cp "$SYNTH_NEW" "$SYNTH_DST"

{brainiac_cli-0.20.32 → brainiac_cli-0.20.34}/src/brain/_assets/scripts/vm-boundary-probe.sh

@@ -38,7 +38,13 @@ export PATH="$BRAIN_RUNTIME_DIR:$PATH"
 # refusal, whatever the exit code says.
 REFUSAL_RE='is host-broker only|RoleError|role=vm is read\+draft'
 
-BREACHED=0        # the boundary itself failed
+BREACHED=0        # the boundary itself failed — the VM did something it must not
+DEGRADED=0        # section D only: the VM cannot do something it legitimately may.
+                  # Counted SEPARATELY and never printed as BREACHED. These are
+                  # opposite failures with opposite remediations, and summing them
+                  # is how a real breach eventually gets ignored (2026-08-30: a
+                  # cut-over workspace with no local snapshot printed BREACHED
+                  # while all 27 containment probes passed).
 INVALID=0         # this script asked the wrong question
 OBSERVED=0        # true-but-expected conditions (see section B)
 say(){ echo "$@"; }
@@ -266,16 +272,53 @@ case "$KEY_OUT" in
 esac
 say ""
 
-say "### D. the two things a VM legitimately CAN do must still work"
+say "### D. the things a VM legitimately CAN do must still work"
 say "-- snapshot read"
+# A LOCAL snapshot is no longer the VM's read surface. s06b moved all 14 Cowork
+# skills onto the broker's MCP tools, and s07 ruled `snapshot/` GOES because it
+# carries 3105 non-empty MNPI note bodies — publishing one back onto the mount
+# would re-open the very finding the cutover closed. So its ABSENCE is the fix
+# working, and this probe must not read as a capability loss. Where no snapshot
+# is present the read surface is the broker, which this script cannot exercise.
 # --no-rerank (RK-02 caller policy, 2026-08-04): a liveness check on the
 # snapshot read path — it discards stdout entirely, so paying for BR-03's
 # default-on cross-encoder here buys literally nothing.
-if brain search "${VM_PROBE_TERM:-project}" --no-rerank --json >/dev/null 2>&1; then
+# ASK `brain status` ONCE, AND KEEP ITS EXIT CODE. Until 2026-08-30 this line
+# read `brain status` inside the test itself, so a status that FAILED --- no
+# engine on PATH, a role refusal, a broken index --- produced empty output and
+# was scored identically to a real absence. That is the "clean because the
+# input was empty" shape the rest of this change set exists to remove, sitting
+# inside the script that reports it.
+_status_out="$(brain status 2>/dev/null)" && _status_rc=0 || _status_rc=$?
+_snap_line="$(printf '%s\n' "$_status_out" | sed -n 's/^snapshot:[[:space:]]*//p')"
+# THREE WAYS TO KNOW NOTHING, AND ONLY ONE OF THEM IS THE DESIGN WORKING.
+# A status that FAILED, a status that answered but never mentions a snapshot,
+# and a status that says `absent` all produced the same empty string once. Only
+# the third is the post-cutover N/A. The first two are the probe failing to
+# ask, and reporting them as N/A is the "clean because the input was empty"
+# all-clear this script exists to catch elsewhere. Both earlier shapes were
+# reproduced against stub interpreters before this was written.
+if [ "$_status_rc" -ne 0 ] || [ -z "$_status_out" ]; then
+  say "   INCONCLUSIVE — \`brain status\` did not answer (rc=$_status_rc), so"
+  say "                  whether a snapshot is present was never established."
+  say "                  This is NOT the post-cutover N/A below; it is the"
+  say "                  probe failing to ask."
+  INVALID=$((INVALID+1))
+elif [ -z "$_snap_line" ]; then
+  say "   INCONCLUSIVE — \`brain status\` answered but reported no \`snapshot:\`"
+  say "                  line at all, so this probe learned nothing. An older"
+  say "                  or differently-configured engine reads this way; it is"
+  say "                  not evidence that no snapshot exists."
+  INVALID=$((INVALID+1))
+elif [ -z "$(printf '%s\n' "$_snap_line" | grep -v '^absent')" ]; then
+  say "   N/A — no local snapshot on this mount, which is the post-cutover"
+  say "         design (it carries MNPI bodies). The VM reads through the"
+  say "         broker's MCP tools instead; exercise that from the session."
+elif brain search "${VM_PROBE_TERM:-project}" --no-rerank --json >/dev/null 2>&1; then
   say "   PASS — snapshot search returned"
 else
-  say "   FAIL — the VM cannot read the snapshot (boundary is over-tight)"
-  BREACHED=$((BREACHED+1))
+  say "   DEGRADED — a snapshot is present but the VM cannot read it"
+  DEGRADED=$((DEGRADED+1))
 fi
 say "-- proposal drop (unsigned, into a dir \`sync\` never reads)"
 # This leaves a real file in the drop dir for as long as it takes to delete it.
@@ -288,7 +331,7 @@ DROP_OUT="$(printf -- '---\nid: %s\ntitle: "VM boundary probe — safe to reject
 printf '%s\n' "$DROP_OUT" | sed 's/^/   | /'
 case "$DROP_OUT" in
   *dropped*) say "   PASS — unsigned drop accepted, nothing signed";;
-  *)         say "   FAIL — the VM cannot even drop a proposal"; BREACHED=$((BREACHED+1));;
+  *)         say "   DEGRADED — the VM cannot even drop a proposal"; DEGRADED=$((DEGRADED+1));;
 esac
 # Delete the file the engine actually reported, not one this script guesses at
 # — a guessed path that has drifted cleans up nothing and says it did.
@@ -296,25 +339,33 @@ PROBE_FILE="$(printf '%s' "$DROP_OUT" | sed -n 's/.*"proposal"[[:space:]]*:[[:sp
 [ -n "$PROBE_FILE" ] || PROBE_FILE="$BRAIN_RUNTIME_DIR/cos/drop/proposal-drop/$PROBE_ID.md"
 rm -f "$PROBE_FILE" 2>/dev/null
 if [ -e "$PROBE_FILE" ]; then
-  say "   FAIL — could not clean up $PROBE_FILE; delete it before the next"
-  say "          broker fold or it becomes an owner-batch question"
-  BREACHED=$((BREACHED+1))
+  say "   DEGRADED — could not clean up $PROBE_FILE; delete it before the next"
+  say "              broker fold or it becomes an owner-batch question."
+  say "              (A Cowork shell has deletion blocked by policy, so this"
+  say "              is expected there — remove it from the host instead.)"
+  DEGRADED=$((DEGRADED+1))
 else
   say "   cleanup: probe drop removed ($PROBE_FILE)"
 fi
 say ""
 
 say "=== SUMMARY ==="
-say "  boundary failures : $BREACHED"
+say "  boundary failures : $BREACHED   (the VM did something it must not)"
+say "  degraded          : $DEGRADED   (section D: the VM cannot do something it may)"
 say "  invalid probes    : $INVALID   (this script asked the wrong question)"
 say "  observations      : $OBSERVED   (host-private bytes readable over the mount)"
-if [ $BREACHED -eq 0 ] && [ $INVALID -eq 0 ]; then
-  say "=== VERDICT: BOUNDARY INTACT ==="
-  exit 0
+if [ $BREACHED -gt 0 ]; then
+  say "=== VERDICT: BREACHED — $BREACHED probe(s) failed ==="
+  exit 1
 fi
-if [ $BREACHED -eq 0 ]; then
+if [ $INVALID -gt 0 ]; then
   say "=== VERDICT: INCONCLUSIVE — $INVALID probe(s) never reached the gate ==="
   exit 2
 fi
-say "=== VERDICT: BREACHED — $BREACHED probe(s) failed ==="
-exit 1
+if [ $DEGRADED -gt 0 ]; then
+  say "=== VERDICT: BOUNDARY INTACT, DEGRADED — $DEGRADED capability probe(s) failed ==="
+  say "    The containment held. Something the VM is ALLOWED to do did not work."
+  exit 3
+fi
+say "=== VERDICT: BOUNDARY INTACT ==="
+exit 0

{brainiac_cli-0.20.32 → brainiac_cli-0.20.34}/src/brain/_version.py

@@ -9,4 +9,4 @@ pip-installed host, importlib.metadata stays primary; brain/__init__.py reads
 this file only as the fallback before 0.0.0+unknown.
 """
 
-__version__ = "0.20.32"
+__version__ = "0.20.34"

{brainiac_cli-0.20.32 → brainiac_cli-0.20.34}/src/brain/alerts.py

@@ -69,6 +69,14 @@ UPDATE_STATE_MAX_AGE_DAYS = 7
 # A weekly task that has not succeeded in longer than this has missed a run.
 SYNTHESIS_STALE_DAYS = 8
 
+# The hourly nightly drains capture drafts on every firing, so a draft still
+# sitting in the inbox after this many hours has been REFUSED by the drain
+# (duplicate-id, stale-base, update-needs-owner, ...) and will never promote
+# on its own. Until 2026-08-30 nothing reported this: a 19-Aug rule update
+# sat refused for 11 days while the session that staged it believed it had
+# applied (UPD-01).
+STUCK_DRAFT_HOURS = 48
+
 # The feed's `findings[].key` vocabulary is closed (see maintenance_notify.py:
 # "blocked", "synthesis-watchdog", "trend:<metric>", "invariant:<metric>",
 # "branch-escalate:<branch>", "ingest_quarantine*", ...). The dir is on the
@@ -181,6 +189,22 @@ def synthesis_alerts(home: Path, today: datetime.date) -> list[dict[str, str]]:
     return out
 
 
+def wiring_alerts() -> list[dict[str, str]]:
+    """The ONE push channel for ``doctor``'s non-gating "Vault wiring" row
+    (DOC-01): ``brain doctor`` reports it, but nothing was watching it
+    between session starts before this. ``check_vault_wiring`` resolves the
+    registry from ``$BRAINIAC_HOME`` itself and stays at the same file-reads
+    budget (no ``maintain*``/``notify-sent`` file touched), so this needs no
+    vault list handed in and covers every registered vault in one line."""
+    from . import doctor as _doctor
+    from .doctor_wiring import check_vault_wiring
+
+    warn = sum(1 for row in check_vault_wiring() if row["status"] == _doctor.WARN)
+    if not warn:
+        return []
+    return [_alert("vault-wiring", f"vault wiring: {warn} warn — run `brain doctor`")]
+
+
 # ---------------------------------------------------------------------------
 # Per-vault sources — on the shared mount, so BOTH roles read them
 # ---------------------------------------------------------------------------
@@ -201,9 +225,45 @@ def vault_alerts(
 
     out += exceptions_alerts(vault, today, name, role=role)
     out += degradation_alerts(vault, today, name)
+    if role != "vm":
+        # Host-only: the capture inbox lives on the host's filesystem
+        # (closed-stacks), and the fix the alert names (`brain sync`,
+        # `brain write`) is a host action anyway. The VM leg does not read
+        # this, and a VM zero would be a fabricated one.
+        out += stuck_draft_alerts(vault, name)
     return out
 
 
+def stuck_draft_alerts(vault: Path, name: str) -> list[dict[str, str]]:
+    """Capture drafts the drain keeps refusing (UPD-01). Pure mtime reads."""
+    import time
+
+    cutoff = time.time() - STUCK_DRAFT_HOURS * 3600
+    stuck: list[str] = []
+    for d in (_config.capture_inbox_dir(vault), vault / ".brain" / "drafts"):
+        try:
+            entries = sorted(d.glob("*.md"))
+        except OSError:
+            continue
+        for f in entries:
+            try:
+                if f.stat().st_mtime < cutoff:
+                    # Same posture as _FINDING_KEY_RE: a draft filename is
+                    # untrusted-leg-authored and this line is rendered into
+                    # the host SessionStart context — never verbatim.
+                    stuck.append(re.sub(r"[^A-Za-z0-9._-]", "_", f.name)[:64])
+            except OSError:
+                continue
+    if not stuck:
+        return []
+    shown = ", ".join(stuck[:3]) + ("…" if len(stuck) > 3 else "")
+    return [_alert(
+        "stuck-drafts",
+        f"{len(stuck)} capture draft(s) stuck >{STUCK_DRAFT_HOURS}h ({shown}) — "
+        "run `brain sync` and read the skip reasons; an `update-needs-owner` "
+        "refusal applies with `brain write`", name)]
+
+
 def exceptions_alerts(
     vault: Path, today: datetime.date, name: str, *, role: str,
 ) -> list[dict[str, str]]:
@@ -384,6 +444,7 @@ def collect(
         alerts += update_alerts(home, today)
         alerts += staging_alerts(home)
         alerts += synthesis_alerts(home, today)
+        alerts += wiring_alerts()
         vaults = host_vaults(home)
         if not vaults and vault:
             vaults = [Path(vault)]

{brainiac_cli-0.20.32 → brainiac_cli-0.20.34}/src/brain/alerts_staging.py

@@ -10,6 +10,8 @@ from __future__ import annotations
 
 import re
 from pathlib import Path
+
+from .cowork_staging import staging_root
 from typing import Any
 
 #: What an undeclared key renders as when the registry cannot be loaded AT
@@ -69,16 +71,44 @@ def _untriaged(key: str) -> bool:
         return True
 
 
-def _staged_versions(vault: Path) -> set[str]:
+def _root_for(entry: dict, raw: str) -> Path:
+    """The `.brain` staging root this registry row actually stages into.
+
+    RELOCATION-AWARE since 2026-08-31. This read derived the root as
+    `<vault>/.brain`, which is right only while the vault sits inside the
+    workspace. On a RELOCATED vault the engine is staged at
+    `<workspace>/vault/.brain`, so the old derivation read the vault-side
+    LEFTOVER --- frozen at whatever version was current when the vault moved
+    --- and reported the workspace permanently stale. `brain update` could
+    never clear it: it writes the workspace side.
+
+    Measured 2026-08-31, minutes after the 0.20.33 restage: the staged engine
+    on disk and `brain doctor` both read 0.20.33 while this digest cried
+    0.20.32 for both live vaults. Sixth relocation-unaware surface, and the
+    first on the digest every session is told to read FIRST. The three doctor
+    rows before it went SILENT, which is the milder failure; a permanent false
+    alarm teaches sessions to ignore the channel.
+
+    Never raises: `alerts` reporting nothing is the one outcome this module may
+    never produce, so an unresolvable path falls back to the co-located root.
+    """
+    try:
+        return staging_root(raw, entry.get("workspace_path") or None)
+    except (OSError, ValueError):
+        return Path(raw) / ".brain"
+
+
+def _staged_versions(root: Path) -> set[str]:
     """Every version stamp a staged Cowork workspace carries, as file reads.
 
+    Takes the `.brain` STAGING ROOT, not the vault --- see :func:`_root_for`.
     Two stamp kinds exist: the staged engine's ``_version.py`` and the
     ``brain-linux-*.version`` sidecars beside the VM ELFs. A missing stamp
     contributes nothing — absence means "never staged", which is not
     staleness."""
     found: set[str] = set()
     try:
-        text = (vault / ".brain" / "engine" / "brain" / "_version.py").read_text(
+        text = (root / "engine" / "brain" / "_version.py").read_text(
             encoding="utf-8")
         m = re.search(r'__version__\s*=\s*"([^"]+)"', text)
         if m:
@@ -86,7 +116,7 @@ def _staged_versions(vault: Path) -> set[str]:
     except OSError:
         pass
     try:
-        for stamp in sorted((vault / ".brain" / "bin").glob("brain-linux-*.version")):
+        for stamp in sorted((root / "bin").glob("brain-linux-*.version")):
             v = stamp.read_text(encoding="utf-8").strip()
             if v:
                 found.add(v)
@@ -128,7 +158,7 @@ def staging_alerts(home: Path) -> list[dict[str, str]]:
         if not raw or raw in seen:
             continue
         seen.add(raw)
-        stale = sorted(_staged_versions(Path(raw)) - {running})
+        stale = sorted(_staged_versions(_root_for(entry, raw)) - {running})
         if stale:
             out.append(_alert(
                 "staging:stale",

{brainiac_cli-0.20.32 → brainiac_cli-0.20.34}/src/brain/cli.py

@@ -118,10 +118,15 @@ def _json_default(o: Any) -> Any:
 
 def _emit(obj: Any, as_json: bool, human: str | None = None) -> None:
     if as_json:
-        json.dump(obj, sys.stdout, ensure_ascii=False, indent=2, default=_json_default)
-        sys.stdout.write("\n")
+        text = json.dumps(obj, ensure_ascii=False, indent=2, default=_json_default) + "\n"
     else:
-        sys.stdout.write((human if human is not None else str(obj)) + "\n")
+        text = (human if human is not None else str(obj)) + "\n"
+    # Gated content is HELD until its SEC-06 record is written; everything else
+    # streams as before. See brain.cli_read_record for why.
+    from . import cli_read_record as _crr
+
+    if not _crr.hold(text):
+        sys.stdout.write(text)
 
 
 def _excluded_note(res: dict[str, Any]) -> str:
@@ -440,29 +445,24 @@ def _main(argv: list[str] | None = None) -> int:
     # a stale count would be attributed to this command. One-shot in the CLI,
     # load-bearing in the long-lived MCP server.
     _egress_reset.take_tally()
+    from . import cli_read_record as _crr
+
+    _crr.begin()
     started = _time.perf_counter()
     try:
-        return group.run(args, ctx)
-    finally:
-        # SEC-06: one access record per invocation, from the counts the egress
-        # chokepoint accumulated. Hooked HERE rather than in each handler so a
-        # content verb added later is logged the day it routes through the gate
-        # — the same argument that put the gate itself at one chokepoint.
-        # In `finally` because a command that raised still read what it read.
-        try:
-            from . import egress as _egress, read_log as _read_log
-
-            _read_log.record_from_tally(
-                vault=getattr(core, "vault", None),
-                role=role,
-                cmd=args.cmd,
-                max_tier=getattr(args, "max_tier", None),
-                tally=_egress.take_tally(),
-                latency_ms=(_time.perf_counter() - started) * 1000.0,
-            )
-        except Exception:  # never let logging fail a read
-            pass
-
+        rc = group.run(args, ctx)
+    except BaseException:
+        # A command that raised still read what it read, so the record is still
+        # owed. Its held output is dropped: the caller above renders the error.
+        _crr.settle_for(core, role, args, started)
+        raise
+    withhold, held = _crr.settle_for(core, role, args, started)
+    if withhold:
+        print(_crr.refusal(args.cmd), file=sys.stderr)
+        return _crr.EXIT_RECORD_FAILED
+    for chunk in held:
+        sys.stdout.write(chunk)
+    return rc
 
 
 # The --help epilog text lives in cli_help.py and the read-surface render

{brainiac_cli-0.20.32 → brainiac_cli-0.20.34}/src/brain/cli_cmds/index_storage_parser.py

@@ -8,7 +8,7 @@ from .. import classification as cls
 def _add_draft_capture(sub) -> None:
     sp = sub.add_parser(
         "draft-capture",
-        help="VM-side capture: stage a candidate note as a plain DRAFT (no sign, no index, no WAL) for the host to drain later",
+        help="VM-side capture: stage a candidate note as a plain DRAFT (no sign, no index, no WAL) for the host to drain later. To UPDATE an existing note in place (UPD-01), give the draft the SAME id plus two frontmatter keys: `updates: <id>` and `base_sha256: <the sha256 `brain get` returned for the version you read>` — accepted only when the live note is untrusted-lane-authored and under brain/; a host-authored target needs the owner (`brain write`), and a base mismatch refuses as stale-base",
     )
     sp.add_argument(
         "--id", default=None, help="note id (default: from frontmatter or content hash)"