brainiac-cli 0.20.46__tar.gz → 0.20.48__tar.gz

{brainiac_cli-0.20.46/src/brainiac_cli.egg-info → brainiac_cli-0.20.48}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brainiac-cli
-Version: 0.20.46
+Version: 0.20.48
 Summary: Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index).
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/Autopsias/brainiac

{brainiac_cli-0.20.46 → brainiac_cli-0.20.48}/pyproject.toml

@@ -8,7 +8,7 @@ build-backend = "setuptools.build_meta"
 # check. The IMPORT package stays `brain` and the console script stays
 # `brain` — only the distribution/project name changes.
 name = "brainiac-cli"
-version = "0.20.46"
+version = "0.20.48"
 description = "Brainiac — local any-LLM second-brain core engine + brain CLI (Markdown truth, derived SQLite index)."
 readme = "README.md"
 license = "Apache-2.0"

{brainiac_cli-0.20.46 → brainiac_cli-0.20.48}/src/brain/_assets/AGENTS.md

@@ -1028,6 +1028,12 @@ rules, in order:
    env-exported `$BRAIN_VM_MAX_EGRESS_TIER` is IGNORED (the session's own
    shell can set it; VULN-3386). Raising a VM's ceiling is a host-operator
    action (`brain vm-egress-tier <TIER>`, signed), never the model's own.
+   That clamp binds the VM's own `brain --role vm` CLI only. A Cowork session
+   that reads through the host broker (`brain-mcp`, the Desktop MCP entry)
+   gets the BROKER's ceiling — the full vault unless `$BRAIN_MAX_EGRESS_TIER`
+   narrows that entry — because the broker receives no caller role (owner
+   ruling, `docs/security-acceptances.md` A-01; pentest VULN-3419). When
+   asked for your cap, report the broker's, never the VM file's.
 
 3. **Ask it in every language the vault holds — the VARIANT CONTRACT
    (CON-01) — and paraphrase within your own.** The cross-language half is a
@@ -1850,8 +1856,9 @@ entry formats in `docs/session-memory.md`. Rules an agent needs at a glance:
   count match the host's; there is nothing enforcing that a session actually
   does it. When `N > 0`, do not tell the owner to go run `/brain-inbox` —
   open the exceptions page yourself and walk them through what is open using
-  `AskUserQuestion`, one at a time. The two host-home sources
-  (`~/.brainiac/update-state.json`, `~/.brain/synthesis-state.json`) stay out
+  `AskUserQuestion`, one at a time. The three host-home sources
+  (`~/.brainiac/update-state.json`, `~/.brain/synthesis-state.json`,
+  `~/.brain/retrieval-watch-state.json`) stay out
   of the VM's reach and are listed under `unreachable` rather than skipped.
   Claude Code and Codex both fire this from a SessionStart hook; run it first
   regardless of harness.
@@ -1928,8 +1935,8 @@ summary is the one authority for open owner questions on the VM leg now.
 That is the whole point of the first bullet above — until 2026-08-14 this
 logic lived only in a Claude Code hook, so a Cowork session worked for days
 against a vault whose invariants had regressed with no surface that could
-tell it. Only the two HOST-HOME sources (`~/.brainiac/update-state.json`,
-`~/.brain/synthesis-state.json`) are out of the VM's reach, and `alerts`
+tell it. Only the three HOST-HOME sources (`~/.brainiac/update-state.json`,
+`~/.brain/synthesis-state.json`, `~/.brain/retrieval-watch-state.json`) are out of the VM's reach, and `alerts`
 reports those under `unreachable` rather than skipping them. The reads are
 file-reads of counts and two findings files; the VM still never WRITES
 anything here,

{brainiac_cli-0.20.46 → brainiac_cli-0.20.48}/src/brain/_assets/scripts/brain-synthesis.sh

@@ -82,7 +82,9 @@ note and will be rejected; cite the source in the BODY as [[<bare-id>]], never
 edge, so it inflates the metric while linking nothing); put the [[raw/<id>]]
 form in the note's `source:` frontmatter as usual; set the note's
 classification to at least the HIGHEST classification among the sources it
-cites, read live off each source; and NEVER append these links into an
+cites, read live off each source; give each new note a SHORT kebab-case
+id of at most 80 characters, the same as its file name (a sentence-long id
+is refused at signing and the note stays unsigned); and NEVER append these links into an
 existing hand-curated note — always a new note. Work the list in order; in
 your final summary state HOW MANY of the file's candidates you covered (the
 file's own "consumed_today" field is the fold's count — quote yours beside
@@ -335,6 +337,16 @@ doctor: $DOCTOR_DIAG"
     find "$VAULT/brain" -type f -name '*.md' \
          ! -name 'backlinks.md' ! -name 'catalog.md' \
          -newer "$SIGN_MARKER" > "$SIGN_LIST" 2>/dev/null || true
+    # A sentence-long note name is refused by the drain's safe-id check
+    # (2026-10-25: 20 of 45 notes unsigned, rc=75). Give those a short id
+    # first; anything it cannot shorten safely is left for the drain to refuse.
+    SHORT_LIST="$(mktemp -t brain-synthesis-shortlist)"
+    if python3 "$(dirname "$0")/shorten_long_note_ids.py" "$SIGN_LIST" \
+         > "$SHORT_LIST" 2>>"$LOG"; then
+      mv -f -- "$SHORT_LIST" "$SIGN_LIST"
+    else
+      rm -f -- "$SHORT_LIST"
+    fi
     SIGNED=0; SIGN_FAIL=0
     # fd 3, not stdin: `brain write` reads the note body FROM STDIN, so a
     # plain `while read` loop would feed it the file list instead.

brainiac_cli-0.20.48/src/brain/_assets/scripts/shorten_long_note_ids.py

@@ -0,0 +1,100 @@
+"""Give a too-long note a short id before the synthesis sign-drain signs it.
+
+2026-10-25: the confined session named 20 of its 45 notes after a whole
+sentence (up to 208 characters). `notes.safe_slug` refuses an id over
+MAX_SLUG_BYTES, so all 20 stayed unsigned and the run failed rc=75.
+
+Reads the drain's file list (one path per line), and for each note whose
+file stem is over the limit AND equals its frontmatter `id:`, moves it to
+`<first words>-<8 hex of the old id>.md` and rewrites that one `id:` line.
+Anything else is left exactly as it was, so the drain still refuses it.
+Then rewrites `[[old-id]]` links to `[[new-id]]` in every listed note: the
+same session wrote the notes that link to these, and on 2026-10-26 a rename
+without this left 18 links pointing at files that no longer existed.
+Prints the list back with the new paths. Stdlib only: the script runs it
+with the host's `python3`, outside the engine's venv.
+"""
+from __future__ import annotations
+
+import hashlib
+import re
+import sys
+from pathlib import Path
+
+#: Same number as `brain.notes.MAX_SLUG_BYTES` (a test holds them equal).
+MAX_SLUG_BYTES = 180
+#: Short enough to read, long enough to keep the subject.
+KEEP_BYTES = 80
+
+
+def short_id(old: str) -> str:
+    head = old.encode("utf-8")[:KEEP_BYTES].decode("utf-8", "ignore")
+    if "-" in head:
+        head = head.rsplit("-", 1)[0]
+    return f"{head.rstrip('-.')}-{hashlib.sha256(old.encode('utf-8')).hexdigest()[:8]}"
+
+
+def shorten(path: Path) -> Path:
+    old = path.stem
+    if len(old.encode("utf-8")) <= MAX_SLUG_BYTES:
+        return path
+    lines = path.read_text(encoding="utf-8").split("\n")
+    if not lines or lines[0].strip() != "---":
+        return path
+    for i, line in enumerate(lines[1:], start=1):
+        if line.strip() == "---":
+            return path                      # no `id:` line: leave it to the drain
+        if line.startswith("id:"):
+            if line[3:].strip().strip("\"'") != old:
+                return path                  # the id is not the file name: leave it
+            new = short_id(old)
+            target = path.with_name(f"{new}.md")
+            if target.exists():
+                return path
+            lines[i] = f"id: {new}"
+            target.write_text("\n".join(lines), encoding="utf-8")
+            path.unlink()
+            return target
+    return path
+
+
+def relink(paths: list[str], renames: dict[str, str]) -> None:
+    """Point `[[old]]`, `[[old|..]]` and `[[old#..]]` at the new id."""
+    if not renames:
+        return
+    pattern = re.compile(r"\[\[(" + "|".join(map(re.escape, renames)) + r")(?=[\]|#])")
+    for raw in paths:
+        path = Path(raw)
+        try:
+            text = path.read_text(encoding="utf-8")
+        except (OSError, UnicodeDecodeError):
+            continue
+        new = pattern.sub(lambda m: "[[" + renames[m.group(1)], text)
+        if new != text:
+            path.write_text(new, encoding="utf-8")
+
+
+def main(argv: list[str]) -> int:
+    # "\n" only, as the shell's `read` splits: splitlines() also breaks on
+    # \r, \x1c, \u2028 ..., so a crafted file name could add a list entry.
+    with open(argv[1], encoding="utf-8", newline="") as fh:  # no \r translation
+        entries = fh.read().split("\n")
+    out: list[str] = []
+    renames: dict[str, str] = {}
+    for raw in entries:
+        if raw:
+            try:
+                new = shorten(Path(raw))
+            except (OSError, UnicodeDecodeError):
+                new = Path(raw)
+            if str(new) != raw:
+                renames[Path(raw).stem] = new.stem
+            out.append(str(new))
+    relink(out, renames)
+    for line in out:
+        print(line)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv))

{brainiac_cli-0.20.46 → brainiac_cli-0.20.48}/src/brain/_version.py

@@ -9,4 +9,4 @@ pip-installed host, importlib.metadata stays primary; brain/__init__.py reads
 this file only as the fallback before 0.0.0+unknown.
 """
 
-__version__ = "0.20.46"
+__version__ = "0.20.48"

{brainiac_cli-0.20.46 → brainiac_cli-0.20.48}/src/brain/alerts.py

@@ -12,7 +12,7 @@ identical list.
 
 Two design rules, both learned from earlier failures in this repo:
 
-* **Silence must never be able to mean "could not look."** Two of the five
+* **Silence must never be able to mean "could not look."** Some of the
   inputs live in the HOST home (``~/.brainiac``, ``~/.brain``) and the Cowork
   VM cannot reach them. On ``role=vm`` they are reported in ``unreachable``
   rather than quietly contributing nothing — the same posture ``doctor`` takes
@@ -42,7 +42,7 @@ from .alerts_staging import (  # noqa: F401 — re-exported for callers/tests
     _untriaged,
     _untriaged_key,
     _unwrap_untriaged,
-    host_vaults,
+    host_vaults, retrieval_watch_alerts, RETRIEVAL_WATCH_UNREACHABLE,
     staging_alerts,
 )
 
@@ -443,7 +443,7 @@ def collect(
     """Every alert this role can see, plus what it could not look at.
 
     ``host`` sweeps the workspace registry; ``vm`` reads only its own vault and
-    reports the two host-home sources as unreachable."""
+    reports the host-home sources as unreachable."""
     home = home or Path.home()
     today = today or datetime.date.today()
     alerts: list[dict[str, str]] = []
@@ -454,7 +454,7 @@ def collect(
             "auto-update state (~/.brainiac/update-state.json) — host-only, "
             "run `brain alerts` on the host Mac",
             "weekly synthesis task health (~/.brain/synthesis-state.json) — "
-            "host-only, run `brain alerts` on the host Mac",
+            "host-only, run `brain alerts` on the host Mac", RETRIEVAL_WATCH_UNREACHABLE,
         ]
         vaults = [Path(vault)] if vault else []
         if not vaults:
@@ -467,7 +467,7 @@ def collect(
     else:
         alerts += update_alerts(home, today)
         alerts += staging_alerts(home)
-        alerts += synthesis_alerts(home, today)
+        alerts += synthesis_alerts(home, today) + retrieval_watch_alerts(home, today)
         alerts += wiring_alerts()
         vaults = host_vaults(home)
         if not vaults and vault:

{brainiac_cli-0.20.46 → brainiac_cli-0.20.48}/src/brain/alerts_staging.py

@@ -186,3 +186,39 @@ def host_vaults(home: Path) -> list[Path]:
         if path not in seen:
             seen.append(path)
     return seen
+
+
+#: The monthly retrieval watch fires on day 1; past this its silence is the news.
+RETRIEVAL_WATCH_STALE_DAYS = 35
+
+
+def retrieval_watch_alerts(home: Path, today: Any) -> list[dict[str, str]]:
+    """The monthly retrieval-quality watch (``~/.brain/retrieval-watch-state.json``,
+    written by ``scripts/brain-retrieval-watch.sh``). Until 2026-10-27 a FAIL
+    went only to ``hot.md``, a log nobody has to read, and it failed unread on
+    three months running against a baseline from a retired embedder."""
+    from .alerts import _alert, _date, _read_json
+
+    state = _read_json(home / ".brain" / "retrieval-watch-state.json")
+    if not isinstance(state, dict):
+        return []  # never installed on this host — nothing to watch
+    day = _date(state.get("at"))
+    if state.get("verdict") == "FAIL":
+        return [_alert(
+            "retrieval-watch:fail",
+            f"monthly retrieval check FAILED on {state.get('at')} — run /autoresearch, "
+            "or re-baseline if the engine or embedder changed")]
+    if state.get("verdict") == "ERROR":
+        return [_alert(
+            "retrieval-watch:error",
+            f"monthly retrieval check could not run on {state.get('at')} — "
+            "read ~/.brain/logs/launchd-retrievalwatch-stderr.log")]
+    if day is None or (today - day).days > RETRIEVAL_WATCH_STALE_DAYS:
+        return [_alert(
+            "retrieval-watch:stale",
+            f"monthly retrieval check has not run since {state.get('at') or 'never'}")]
+    return []
+
+RETRIEVAL_WATCH_UNREACHABLE = (
+    "monthly retrieval check (~/.brain/retrieval-watch-state.json) — host-only, "
+    "run `brain alerts` on the host Mac")

{brainiac_cli-0.20.46 → brainiac_cli-0.20.48}/src/brain/cli_cmds/lifecycle_parser.py

@@ -95,7 +95,7 @@ def _add_doctor(sub) -> None:
 def _add_alerts(sub) -> None:
     sp = sub.add_parser(
         "alerts",
-        help="READ-ONLY degradation digest every harness can call: auto-update state, weekly-synthesis task health, engine-feedback backlog, the owner-decision queue, and whatever is degraded RIGHT NOW per the findings feed `brain maintain` rewrites each run. Pure file reads — no index, embedder, network or key. role=vm reads only its own vault and REPORTS the two host-home sources it cannot reach, so silence never means 'could not look'.",
+        help="READ-ONLY degradation digest every harness can call: auto-update state, weekly-synthesis task health, engine-feedback backlog, the owner-decision queue, and whatever is degraded RIGHT NOW per the findings feed `brain maintain` rewrites each run. Pure file reads — no index, embedder, network or key. role=vm reads only its own vault and REPORTS the host-home sources it cannot reach, so silence never means 'could not look'.",
     )
     sp.add_argument("--json", action="store_true")
     sp.add_argument(

{brainiac_cli-0.20.46 → brainiac_cli-0.20.48}/src/brain/ingest/handlers/concealment.py

@@ -178,9 +178,9 @@ from .concealment_gate import (AUTHORED, CHROME, COVERED_SOURCES,  # noqa: F401
 
 #: Every marker this module can emit. A run record carries exactly one.
 MARKERS = (
-    "hidden_white_text",       # text the same colour as the ground it sits on
+    "hidden_white_text",       # text too close to its ground to read
     "hidden_transparent_text",  # zero-alpha colour: invisible on any ground
-    "hidden_tiny_text",        # resolved font size below 2pt
+    "hidden_tiny_text",        # resolved font size below TINY_PT
     "hidden_offscreen_text",   # parked far off the page / outside the slide
     "hidden_vanish_run",       # Word w:vanish / w:webHidden
     "hidden_render_mode",      # PDF text render mode 3 or 7 (invisible)
@@ -195,8 +195,18 @@ MARKERS = (
 NEAR = 0xF0
 #: Per-channel distance at which text is "the same colour as its ground".
 GROUND_DELTA = 0x10
-#: Resolved sizes below this many CSS pixels are hidden (design: < 2pt).
-TINY_PX = 2 * 4 / 3
+#: Below this WCAG contrast ratio against its ground, text is hidden too. A
+#: coloured near-white walked past ``GROUND_DELTA`` alone: ``#ffffdd`` on
+#: white is 1.02:1, fainter than the ``#f0f0f0`` (1.14:1) it caught (pentest
+#: VULN-3418, 2026-10-28). Measured on 1,055 real originals that day: 0
+#: convictions at 1.2, 1.3 and 1.5; new labels in 32 documents at 1.5 (mostly
+#: headings and slide labels), 25 at 1.3, 10 at 1.2.
+MIN_CONTRAST = 1.2
+#: Text below this size is hidden. Was 2pt, and 2.7px (2.03pt) text passed it
+#: (VULN-3418). 4pt added 1,805 runs of real 3-4pt slide labels; 3pt added 1.
+#: One value for every lane: the Office walkers take it in points.
+TINY_PT = 3
+TINY_PX = TINY_PT * 4 / 3
 #: An offset at least this far negative is off the page, not a layout nudge.
 OFFSCREEN_PX = 1000.0
 
@@ -306,21 +316,34 @@ def colour_marker(colour: tuple[int, int, int, float] | None,
     """The marker a resolved text colour earns against its resolved ground.
 
     ``hidden_transparent_text`` for a zero alpha (invisible whatever is
-    behind it) and ``hidden_white_text`` when the text is within
-    ``GROUND_DELTA`` of its ground — white-on-white being the case this was
-    measured on. Named for that case because that is what it catches in
-    practice; the test is "the same colour as what is behind it".
+    behind it) and ``hidden_white_text`` when the text, blended over its
+    ground by its alpha, is within ``GROUND_DELTA`` of it on every channel or
+    below ``MIN_CONTRAST``. Named for white-on-white because that is what it
+    catches in practice; the test is "too close to what is behind it to read".
     """
     if colour is None:
         return None
     if colour[3] <= 0.0:
         return "hidden_transparent_text"
     bg = ground if ground is not None and ground[3] > 0.0 else (*WHITE, 1.0)
-    if all(abs(colour[i] - bg[i]) <= GROUND_DELTA for i in range(3)):
+    a = min(colour[3], 1.0)
+    seen = tuple(a * colour[i] + (1 - a) * bg[i] for i in range(3))
+    if (all(abs(seen[i] - bg[i]) <= GROUND_DELTA for i in range(3))
+            or contrast_ratio(seen, bg) < MIN_CONTRAST):
         return "hidden_white_text"
     return None
 
 
+def contrast_ratio(fg: tuple[float, ...], bg: tuple[float, ...]) -> float:
+    """WCAG 2 contrast ratio of two sRGB colours, from 1.0 (same) to 21.0."""
+    def luminance(rgb: tuple[float, ...]) -> float:
+        lin = [c / 255 / 12.92 if c / 255 <= 0.04045
+               else ((c / 255 + 0.055) / 1.055) ** 2.4 for c in rgb[:3]]
+        return 0.2126 * lin[0] + 0.7152 * lin[1] + 0.0722 * lin[2]
+    hi, lo = sorted((luminance(fg), luminance(bg)), reverse=True)
+    return (hi + 0.05) / (lo + 0.05)
+
+
 def to_px(value: str) -> float | None:
     """A CSS length in pixels, or ``None`` when the value carries no unit."""
     m = _SIZE.search(value or "")

{brainiac_cli-0.20.46 → brainiac_cli-0.20.48}/src/brain/ingest/handlers/concealment_office.py

@@ -21,7 +21,7 @@ from __future__ import annotations
 
 from typing import Any, Callable
 
-from .concealment import colour_marker, normalise, note_degraded, run_record
+from .concealment import TINY_PT, colour_marker, normalise, note_degraded, run_record
 
 #: Theme slots that are white in every stock Office theme. ``pptx.py`` reads no
 #: theme part, so this is a NAME test, not a resolved colour — see the gap list
@@ -170,7 +170,7 @@ def docx_runs(document: Any,
     from docx.shared import Pt
     from docx.text.run import Run
 
-    rgb_type, tiny, run_tag = MSO_COLOR_TYPE.RGB, Pt(2), qn("w:r")
+    rgb_type, tiny, run_tag = MSO_COLOR_TYPE.RGB, Pt(TINY_PT), qn("w:r")
     runs: list[dict[str, Any]] = []
     for index, paragraph in enumerate(_docx_paragraphs(document), start=1):
         container = f"docx:p{index}"
@@ -253,7 +253,7 @@ def pptx_runs(presentation: Any,
 
     runs: list[dict[str, Any]] = []
     width, height = presentation.slide_width, presentation.slide_height
-    style = (MSO_COLOR_TYPE.RGB, Pt(2))
+    style = (MSO_COLOR_TYPE.RGB, Pt(TINY_PT))
     for si, slide in enumerate(presentation.slides, start=1):
         for k, shape in enumerate(slide.shapes):
             offscreen = _shape_offscreen(shape, width, height)

{brainiac_cli-0.20.46 → brainiac_cli-0.20.48}/src/brain/injection_scan.py

@@ -87,6 +87,35 @@ _HIDDEN_STYLE = re.compile(
     r"""color\s*:\s*#?(fff(fff)?|white)\b)""",
     re.I,
 )
+#: An inline ``style`` value: double-quoted, single-quoted or bare, one group
+#: each, so a quote of the OTHER kind inside the value cannot end it early.
+_STYLE_ATTR = re.compile(
+    r"""\bstyle\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>"']+))""", re.I)
+
+
+def _hidden_style_offsets(text: str) -> list[int]:
+    """Where hiding styling starts: the literal patterns above, plus any inline
+    ``style=""`` the handler walkers would call hidden — too little contrast on
+    a white page, or below the size floor. ``color:#ffffdd;font-size:2.7px``
+    matched no literal (pentest VULN-3418, 2026-10-28)."""
+    found = {m.start() for m in _HIDDEN_STYLE.finditer(text)}
+    if _STYLE_ATTR.search(text):
+        from .ingest.handlers import concealment as c
+
+        for m in _STYLE_ATTR.finditer(text):
+            if any(m.start() <= f < m.end() for f in found):
+                continue  # a literal already marked this attribute
+            decl = c.declarations("".join(g or "" for g in m.groups()))
+            try:
+                hidden = bool(
+                    c.colour_marker(c.parse_colour(decl.get("color", "")), None)
+                    or c.is_tiny(c.to_px(decl.get("font-size", ""))))
+            except (ValueError, OverflowError):
+                hidden = True  # unparseable: fail closed, the instruction check decides
+            if hidden:
+                found.add(m.start())
+    return sorted(found)
+
 
 # --------------------------------------------------------------------------
 # Instruction: imperative phrasing in the clear. Flagged, never quarantined.
@@ -243,14 +272,14 @@ def _concealment_hits(text: str) -> list[dict[str, Any]]:
                 "offset": m.start(),
                 "excerpt": " ".join(body.split())[:160],
             })
-    for m in _HIDDEN_STYLE.finditer(text):
-        window = text[m.start(): m.start() + 400]
+    for start in _hidden_style_offsets(text):
+        window = text[start: start + 400]
         found = _instruction_hits(window)
         if found:
             out.append({
                 "marker": "hidden_styled_instruction",
                 "revealed": found[0]["marker"],
-                "offset": m.start(),
+                "offset": start,
                 "excerpt": " ".join(window.split())[:160],
             })
     return out

{brainiac_cli-0.20.46 → brainiac_cli-0.20.48}/src/brain/mcp_housekeeping_verbs.py

@@ -26,7 +26,7 @@ UNCHANGED and keep real paths. Both already branch correctly on
 pinned workspace identity, schema, freshness — ``exceptions_verify.verify``,
 called from inside
 ``alerts.exceptions_alerts``/``exceptions_cli.vault_row``) before anything in
-it is trusted, and the two host-home sources
+it is trusted, and the host-home sources
 (``~/.brainiac/update-state.json``, ``~/.brain/synthesis-state.json``) come
 back under ``unreachable`` rather than being silently skipped. That
 verification is NOT reimplemented here — it is the same call the CLI makes,

{brainiac_cli-0.20.46 → brainiac_cli-0.20.48}/src/brain/remediation.py

@@ -72,6 +72,8 @@ from .remediation_schema import (  # noqa: F401  (facade re-export)
     UNTRIAGED_PREFIX as UNTRIAGED_PREFIX,
 )
 from . import remediation_schema as _schema
+from .remediation_invariants import (  # the invariant:* rows, split out by size
+    _AUTO_INVARIANTS, _OWNER_INVARIANTS, _SHELF_INVARIANTS)
 
 # ---------------------------------------------------------------------------
 # Owning branches and their cadences (in days). The scheduler reads THIS, so a
@@ -131,89 +133,6 @@ def validate_mechanical_allow_list(
 validate_mechanical_allow_list()
 MECHANICAL_QUARANTINE_REASONS = ALLOWED_MECHANICAL_QUARANTINE_REASONS
 
-_AUTO_INVARIANTS = {
-    "invariant:unsigned_notes": Remedy(
-        AUTO, "sign_repair", 3, "additive", shadow_nights=3,
-        note="signs ONLY notes with host-side provenance of an interrupted "
-             "host write; an unsigned note without it is a TAMPER exception"),
-    "invariant:unguarded_ingests": Remedy(
-        AUTO, "reguard", 3, "raising", shadow_nights=3,
-        note="ENF-04 re-run; only ever raises, undecided fails closed high"),
-    "invariant:subfloor_families": Remedy(
-        AUTO, "extract_retry", 3, "additive",
-        note="heals only when re-extraction clears the ENF-01 floor, never by "
-             "merging stubs"),
-    "invariant:unlinked_sources": Remedy(
-        AUTO, "link_lane", 2, "additive",
-        note="fix-05: keyed to BAK-04 lane health, not the raw count; "
-             "escalate_after is 2 MISSED WEEKS at the link_lane cadence"),
-}
-
-_OWNER_INVARIANTS = {
-    "invariant:cross_tier_duplicates": Remedy(
-        OWNER, note="CUR-01-style proposal batch; re-tiering cascades"),
-    "invariant:cross_tier_candidates": Remedy(
-        OWNER, note="the UNDECIDED band — a guess here is the failure mode"),
-    "invariant:cross_tier_twins": Remedy(
-        OWNER, note="proposal batch, same store as the other two"),
-    "invariant:unreachable_gold": Remedy(
-        OWNER, note="usually a retirement mistake; reinstating is an owner act"),
-}
-
-#: DLV-05's three shelf counters. BANNER, and deliberately neither of the two
-#: dispositions its neighbours in this block carry.
-#:
-#: NOT ``auto``: an auto row is a promise about the REMEDIATION apparatus — an
-#: owning branch that writes a `_remediation.branches.<name>` row every night,
-#: which `branch_liveness`, `coverage` and `thrashing_targets` then read to
-#: decide whether to suppress the finding. The nightly fold that actually
-#: converges these three (`deliverables_shelf_fold`, and the drop lane's
-#: recovery pass at the top of every drain) is an ordinary maintain fold, not a
-#: remediation branch, and writes no such row — so declaring `auto` here would
-#: claim an escalation apparatus that does not exist and park a permanently
-#: empty branch on the exceptions page.
-#:
-#: NOT ``owner``: an owner row must be ONE decidable question with options and
-#: a stated default. A count that stayed above its floor is not that — and each
-#: CAUSE already has its own named, answerable surface (`shelf:move-cap`,
-#: `shelf:refused`, `shelf:diverged`, `shelf:sole-copy`, the five
-#: `deliverables:*` resolver refusals). Asking a second time here would be the
-#: same finding twice.
-#:
-#: So: the same "something stopped" class as those nine keys, and structurally
-#: visible for as long as it is true.
-_SHELF_INVARIANTS = {
-    "invariant:unshelved_deliverables": Remedy(
-        BANNER,
-        note="marked deliverables the shelf ledger claims no copy of. The "
-             "nightly shelf fold copies every censused deliverable, so a count "
-             "above the floor means that fold declined or could not finish — "
-             "and the reason it declined carries its own key"),
-    "invariant:stale_shelf_entries": Remedy(
-        BANNER,
-        note="shelf ledger rows whose note has left the census. Nothing is "
-             "lost (the shelf never deletes; displaced copies go to "
-             "_previous/), but the shelf has stopped telling the truth about "
-             "what the vault holds"),
-    "invariant:unanchored_deliverable_payloads": Remedy(
-        BANNER,
-        note="drop-lane payloads with no anchor note. The lane's own recovery "
-             "pass retries the anchor at the top of every drain, so a count "
-             "that stays up means that write keeps failing — the one metric "
-             "that can see the shelf mechanism having stopped entirely, since "
-             "the other two read 0 of 0 when nothing is being marked at all"),
-    "invariant:supersede_declared_failed": Remedy(
-        BANNER,
-        note="live notes whose `replaces:` names a note that is NOT retired "
-             "under them (SUP-01) — the old version is still live in search. "
-             "`brain health-report` samples the pairs; `brain supersede <old> "
-             "<new>` on the host clears each"),
-    "supersede_declared_failed": Remedy(
-        BANNER,
-        note="this run's owner-declared supersession(s) that could not be "
-             "applied; the corpus count above keeps reporting them"),
-}
-
 _EXACT: dict[str, Remedy] = {
     **_AUTO_INVARIANTS,
     **_OWNER_INVARIANTS,
@@ -253,6 +172,16 @@ _EXACT: dict[str, Remedy] = {
         AUTO, "synthesis_retry", 1, "process",
         note="retried at most once per night — it costs real money"),
     "synthesis:stale": Remedy(AUTO, "synthesis_retry", 1, "process"),
+    # Monthly retrieval watch (alerts_staging.retrieval_watch_alerts). BANNER,
+    # all three: no branch can rerun or re-baseline it, and LOG would put it
+    # back in hot.md alone, where three false FAILs went unread (974cf75b).
+    "retrieval-watch:fail": Remedy(
+        BANNER, note="quality dropped below the baseline; the owner runs "
+                     "/autoresearch, or re-baselines after an engine change"),
+    "retrieval-watch:error": Remedy(
+        BANNER, note="the watch could not run; its launchd stderr log says why"),
+    "retrieval-watch:stale": Remedy(
+        BANNER, note="no monthly run in 35 days: the job itself stopped"),
     # Mechanical quarantine: an operator action on THIS host, retryable.
     **{f"quarantine:{r}": Remedy(AUTO, "extract_retry", 3, "process")
        for r in MECHANICAL_QUARANTINE_REASONS},