brainlayer 1.5.76__tar.gz → 1.5.77__tar.gz

{brainlayer-1.5.76 → brainlayer-1.5.77}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: brainlayer
-Version: 1.5.76
+Version: 1.5.77
 Summary: Persistent local memory for AI agents — 16 BrainBar MCP tools, semantic search, knowledge graph, SQLite
 Project-URL: Homepage, https://brainlayer.etanheyman.com
 Project-URL: Repository, https://github.com/EtanHey/brainlayer

{brainlayer-1.5.76 → brainlayer-1.5.77}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brainlayer"
-version = "1.5.76"
+version = "1.5.77"
 description = "Persistent local memory for AI agents — 16 BrainBar MCP tools, semantic search, knowledge graph, SQLite"
 license = {text = "Apache-2.0"}
 readme = "README.md"

{brainlayer-1.5.76 → brainlayer-1.5.77}/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.etanhey/brainlayer",
   "title": "BrainLayer",
   "description": "Persistent local memory for AI agents \u2014 semantic search, knowledge graph, and 16 BrainBar MCP tools with ToolAnnotations over SQLite.",
-  "version": "1.5.76",
+  "version": "1.5.77",
   "websiteUrl": "https://brainlayer.etanheyman.com",
   "repository": {
     "url": "https://github.com/EtanHey/brainlayer",
@@ -14,7 +14,7 @@
       "registryType": "pypi",
       "registryBaseUrl": "https://pypi.org",
       "identifier": "brainlayer",
-      "version": "1.5.76",
+      "version": "1.5.77",
       "runtimeHint": "pipx",
       "transport": {
         "type": "stdio"

{brainlayer-1.5.76 → brainlayer-1.5.77}/src/brainlayer/__init__.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-__version__ = "1.5.76"
+__version__ = "1.5.77"
 # Git sha the distributed package was built from; stamped by the release build, None in a source tree.
 # scripts/sprint_gate.py reads it in "keg" mode to prove the served package is the code under test.
 # No runtime `str | None` annotation: launchd/install.sh imports this under /usr/bin/python3 (3.9).

brainlayer-1.5.77/src/brainlayer/_build.py

@@ -0,0 +1 @@
+BUILD_SHA = "54c580ca6849c2d32628f9ad38d924c54109f055"

{brainlayer-1.5.76 → brainlayer-1.5.77}/src/brainlayer/backup_daily.py

@@ -2763,6 +2763,8 @@ def _verified_drive_file_ids(log_path: Path) -> set[str] | None:
         return None
     latest: dict[str, Mapping[str, Any]] = {}
     for receipt in receipts:
+        if receipt.get("event") == "local_sweep":
+            continue
         drive_file = receipt.get("drive_file")
         file_id = drive_file.get("id") if isinstance(drive_file, dict) else None
         if isinstance(file_id, str) and file_id:
@@ -2876,17 +2878,116 @@ def _recent_local_verified_backup(
     return None
 
 
-def _protected_snapshot_names(staging_dir: Path) -> set[str]:
+def _weekly_pin_protection(staging_dir: Path) -> tuple[set[str], str | None]:
+    """No snapshot-bound completion receipt exists; weekly custody expires the next day."""
     pin = staging_dir / ".weekly-backup-pin.json"
     try:
         payload = json.loads(pin.read_text())
-        if payload["date"] == local_backup_date().isoformat():
-            return {Path(payload["snapshot"]).name}
+        if dt.date.fromisoformat(payload["date"]) == local_backup_date():
+            return {Path(payload["snapshot"]).name}, "weekly_pin_pending"
     except FileNotFoundError:
         pass
     except (OSError, ValueError, KeyError, TypeError):
-        return {p.name for p in staging_dir.iterdir() if _snapshot_suffix(p.name)}  # unreadable custody fails closed
-    return set()
+        return {
+            p.name for p in staging_dir.iterdir() if _parse_snapshot_date(p.name) == local_backup_date()
+        }, "pin_unreadable"
+    return set(), None
+
+
+def _protected_snapshot_names(staging_dir: Path) -> set[str]:
+    return _weekly_pin_protection(staging_dir)[0]
+
+
+def _archive_drive_md5_matches(receipt: Mapping[str, Any]) -> bool:
+    """Local deletion needs both recorded checksums, including Drive's stored-byte MD5."""
+    drive = receipt.get("drive_file")
+    local_md5 = receipt.get("local_md5")
+    return (
+        isinstance(local_md5, str)
+        and bool(local_md5)
+        and isinstance(drive, dict)
+        and drive.get("md5Checksum") == local_md5
+    )
+
+
+def _sweep_verified_local_archives(
+    log_path: Path, staging_dir: Path, context: Mapping[str, Any], *, remove_local: bool
+) -> list[str]:
+    """Remove older archives only with latest, matching Drive proof, under the job's lock."""
+    if not log_path.exists():
+        return []
+    try:
+        receipts = _read_backup_receipts(log_path, strict=True)
+    except (OSError, ValueError):
+        print("Cannot validate Drive receipts; retaining local archives", flush=True)
+        return []
+    latest = {
+        r["snapshot"]: r for r in receipts if r.get("event") != "local_sweep" and isinstance(r.get("snapshot"), str)
+    }
+    last_sweep = {
+        r["archive"]: r for r in receipts if r.get("event") == "local_sweep" and isinstance(r.get("archive"), str)
+    }
+    verified_ids = _verified_drive_file_ids(log_path) or set()
+    protected, pin_reason = _weekly_pin_protection(staging_dir)
+    removed = []
+    for receipt in latest.values():
+        path = Path(receipt["snapshot"])
+        day = _parse_snapshot_date(path.name)
+        if (
+            receipt.get("db") != context.get("db")
+            or path.parent.resolve() != staging_dir.resolve()
+            or day is None
+            or path.name != f"{day.isoformat()}{_snapshot_suffix(path.name)}"
+            or day >= local_backup_date()
+            or path.is_symlink()
+            or not path.is_file()
+            or path.resolve() == Path(context["db"]).resolve()
+        ):
+            continue
+        drive = receipt.get("drive_file")
+        verified = (
+            receipt.get("uploaded") is True
+            and receipt.get("verified") is True
+            and isinstance(drive, dict)
+            and isinstance(drive.get("id"), str)
+            and drive.get("id") in verified_ids
+            and drive.get("name") == path.name
+            and str(drive.get("size")) == str(path.stat().st_size)
+        )
+        reason = (
+            "not_verified"
+            if not verified
+            else "md5_unverified"
+            if not _archive_drive_md5_matches(receipt)
+            else "opt_out"
+            if not remove_local
+            else pin_reason
+            if path.name in protected
+            else None
+        )
+        if reason is None:
+            try:
+                if _md5_file(path) != drive["md5Checksum"]:
+                    reason = "md5_current_mismatch"
+                else:
+                    path.unlink()
+            except OSError as exc:
+                print(f"Cannot delete local archive {path}: {exc}", flush=True)
+                reason = "delete_failed"
+            else:
+                if reason is None:
+                    removed.append(path.name)
+        # Local housekeeping cannot grant/revoke Drive verification or refresh last-backup status.
+        update = {
+            "event": "local_sweep",
+            "archive": str(path),
+            "at": dt.datetime.now(dt.UTC).isoformat(),
+            "local_removed": reason is None,
+            "local_removed_skip_reason": reason,
+        }
+        if reason is None or last_sweep.get(str(path), {}).get("local_removed_skip_reason") != reason:
+            _append_json_log(log_path, update)
+    return removed
 
 
 def _reclaim_superseded_local(log_path: Path, result: dict[str, Any], staging_dir: Path) -> None:
@@ -3191,6 +3292,7 @@ def run_backup(
         "db": str(resolved_db_path),
         "uploaded": False,
         "local_removed": False,
+        "local_removed_skip_reason": "not_verified",
         "verified": False,
         "backup_log_provenance": _backup_log_provenance(),
         "attempt_reclamation": "unknown",
@@ -3232,6 +3334,9 @@ def run_backup(
                 "machine_id": resolved_machine_id,
             }
         )
+        result["local_gzip_retention_deleted"] = _sweep_verified_local_archives(
+            resolved_log_path, Path(staging_dir), result, remove_local=remove_local_after_upload
+        )
         result["consumed_raw_crash_leftovers_deleted"] = _cleanup_consumed_raw_remnants(Path(staging_dir))
         if resolved_log_path.exists():
             try:
@@ -3533,6 +3638,16 @@ def run_backup(
                         )
             result["upload_state"] = "verified" if result["verified"] else "failed"
             if result["verified"]:
+                protected, pin_reason = _weekly_pin_protection(snapshot.parent)
+                result["local_removed_skip_reason"] = (
+                    "md5_unverified"
+                    if not _archive_drive_md5_matches(result)
+                    else "opt_out"
+                    if not remove_local_after_upload
+                    else pin_reason
+                    if snapshot.name in protected
+                    else None
+                )
                 _append_json_log(resolved_log_path, result)  # remote proof precedes reclamation
                 _reclaim_superseded_local(resolved_log_path, result, snapshot.parent)
                 from . import job_alerts
@@ -3543,23 +3658,16 @@ def run_backup(
                 result["temp_dirs_removed_after_verification"] = _prune_owned_temps_after_verified(
                     snapshot.parent, snapshot
                 )
-                if remove_local_after_upload and snapshot.name not in _protected_snapshot_names(snapshot.parent):
-                    snapshot.unlink()
-                    result["local_removed"] = True
+                if result["local_removed_skip_reason"] is None:
+                    try:
+                        snapshot.unlink()
+                    except OSError as exc:
+                        print(f"Cannot delete local archive {snapshot}: {exc}", flush=True)
+                        result["local_removed_skip_reason"] = "delete_failed"
+                    else:
+                        result["local_removed"] = True
                 if resume is None:
                     _remove_superseded_stalls(stalled, result, snapshot.name[:10])
-                verified_drive_names = _verified_snapshot_names_from_log(
-                    resolved_log_path, db_path=Path(resolved_db_path)
-                )
-                verified_drive_names.add(snapshot.name)
-                result["local_gzip_retention_deleted"] = prune_local_compressed_snapshots(
-                    snapshot.parent,
-                    verified_drive_names=verified_drive_names,
-                    protected_names=_protected_snapshot_names(snapshot.parent)
-                    | {
-                        name for name in _compressed_snapshot_names(snapshot.parent) if name not in verified_drive_names
-                    },
-                )
                 if retention_enabled:
                     try:
                         result["retention_deleted"] = prune_drive_backups(
@@ -3620,6 +3728,13 @@ def run_backup(
             result.setdefault("error_code", "drive_upload_interrupted")
         if not nothing_pending:
             _append_json_log(resolved_log_path, result)
+        swept = _sweep_verified_local_archives(
+            resolved_log_path, Path(staging_dir), result, remove_local=remove_local_after_upload
+        )
+        if swept:
+            result["local_gzip_retention_deleted"].extend(swept)
+            if not nothing_pending:
+                _append_json_log(resolved_log_path, result)
     return result
 
 

{brainlayer-1.5.76 → brainlayer-1.5.77}/src/brainlayer/health_check.py

@@ -1415,23 +1415,24 @@ def _run_health_check_locked(
             }
         )
 
-    if config.heal:
-        from .supervisor_adapters import adapt_commands
-
-        command_runner = adapt_commands(
-            command_runner,
-            config.pause_sentinel_path,
-            required=(
-                config.watch_label,
-                config.drain_label,
-                config.hotlane_label,
-                config.health_check_label,
-                config.observability_label,
-            ),
-            tolerate_unavailable=True,
-        )
-        if error := getattr(command_runner, "control_error", ""):
-            add_issue("supervisor_control_unavailable", "critical", f"supervisor control unavailable: {error}")
+    from .supervisor_adapters import adapt_commands
+
+    command_runner = adapt_commands(
+        command_runner,
+        config.pause_sentinel_path,
+        required=(
+            config.watch_label,
+            config.drain_label,
+            config.hotlane_label,
+            config.health_check_label,
+            config.observability_label,
+        ),
+        tolerate_unavailable=True,
+        discover_ownership=True,
+    )
+    if error := getattr(command_runner, "control_error", ""):
+        add_issue("supervisor_control_unavailable", "critical", f"supervisor control unavailable: {error}")
+        if config.heal:
             result.actions.append("heal_failed:supervisor_control_unavailable")
 
     if state.get("_state_corrupt_now"):

{brainlayer-1.5.76 → brainlayer-1.5.77}/src/brainlayer/observability_backup.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import json
 import math
 import os
+import plistlib
 import re
 import subprocess
 from datetime import UTC, datetime
@@ -301,6 +302,27 @@ def _unmeasurable(reason: str, inputs: list[dict[str, Any]]) -> dict[str, Any]:
     return {"state": "unmeasurable", "reason": reason, "inputs": inputs}
 
 
+def _maintenance_schedule_error(path: Path) -> str | None:
+    """A loaded parent is usable schedule evidence only with a readable Hour/Minute calendar."""
+    try:
+        with path.open("rb") as handle:
+            definition = plistlib.load(handle)
+    except Exception as exc:
+        reason = f"cannot read plist ({type(exc).__name__})"
+    else:
+        interval = definition.get("StartCalendarInterval") if isinstance(definition, dict) else None
+        if (
+            isinstance(interval, dict)
+            and type(interval.get("Hour")) is int
+            and 0 <= interval["Hour"] <= 23
+            and type(interval.get("Minute")) is int
+            and 0 <= interval["Minute"] <= 59
+        ):
+            return None
+        reason = "expected plist dictionary with StartCalendarInterval Hour (0-23) and Minute (0-59)"
+    return f"maintenance_schedule_unavailable: {path}: {reason}"
+
+
 def build_backups_section(
     *,
     env: Mapping[str, str],
@@ -321,6 +343,7 @@ def build_backups_section(
     launchd_override = env.get("BRAINLAYER_OBSERVABILITY_LAUNCHD_OUTPUT")
     observed_label, extra_inputs = LABEL, []
     launchd_not_loaded = False
+    schedule_error: str | None = None
     command_failure: str | None = None
     if launchd_override:
         launchd_path = Path(launchd_override).expanduser()
@@ -368,6 +391,7 @@ def build_backups_section(
                     )
                 )
                 observed_label = "com.brainlayer.maintenance"
+                schedule_error = _maintenance_schedule_error(agents / f"{observed_label}.plist")
                 argv = ["launchctl", "print", f"gui/{os.getuid()}/{observed_label}"]
                 completed = subprocess.run(argv, capture_output=True, text=False, timeout=5, check=False, shell=False)
             exit_code = completed.returncode
@@ -491,6 +515,11 @@ def build_backups_section(
     if error_type is None and db_reason is not None:
         error_type = db_reason
     bootstrapped = not launchd_not_loaded and observed_label in launchd_text
+    if schedule_error is not None:
+        bootstrapped = False
+        # Schedule uncertainty must not discard dated receipts or mask an existing failure.
+        if not error_type:
+            error_type = schedule_error
 
     # Optional evidence, never synthesized from a missing upload or a zero archive count.
     evidence: dict[str, Any] = {}

{brainlayer-1.5.76 → brainlayer-1.5.77}/src/brainlayer/supervisor_adapters.py

@@ -50,6 +50,48 @@ ARCHIVED = {
 }
 
 
+def supervisor_owns_jobs() -> bool:
+    """Read the canonical migration owner with BrainBarJobOwnership's custody rules."""
+    path = Path.home() / ".local/share/brainlayer/supervisor/migration.json"
+    limit = 4 * 1024 * 1024
+    fd = os.open("/", os.O_RDONLY | os.O_DIRECTORY | os.O_CLOEXEC)
+    try:
+        parts = path.parts[1:]
+        for index, part in enumerate(parts):
+            if part in {".", ".."}:
+                raise ValueError("unsafe migration journal path")
+            flags = os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK | os.O_CLOEXEC
+            if index < len(parts) - 1:
+                flags |= os.O_DIRECTORY
+            next_fd = os.open(part, flags, dir_fd=fd)
+            os.close(fd)
+            fd = next_fd
+        info = os.fstat(fd)
+        if (
+            not stat.S_ISREG(info.st_mode)
+            or info.st_uid != os.getuid()
+            or info.st_nlink != 1
+            or info.st_mode & 0o077
+            or info.st_size > limit
+        ):
+            raise PermissionError("migration journal is untrusted")
+        with os.fdopen(os.dup(fd), "rb") as stream:
+            raw = stream.read(limit + 1)
+        if len(raw) > limit:
+            raise ValueError("migration journal exceeds read limit")
+        row = json.loads(raw)
+        phase = row.get("phase") if isinstance(row, dict) else None
+        if isinstance(phase, str) and phase in {"migrating", "migrated", "reverting"}:
+            return True
+        if isinstance(phase, str) and phase in {"reverted", "rolled_back"}:
+            return False
+        raise ValueError("migration journal has unknown phase")
+    except FileNotFoundError:
+        return False
+    finally:
+        os.close(fd)
+
+
 class SupervisorCommands:
     """Adapt legacy *policy*, never launch archived component plists.
 
@@ -99,6 +141,15 @@ class SupervisorCommands:
                 or type(value["exit_timeout"]) not in {int, float}
                 or not math.isfinite(value["exit_timeout"])
                 or value["exit_timeout"] < 0
+                or type(value.get("interval", 0)) not in {int, float}
+                or not math.isfinite(value.get("interval", 0))
+                or value.get("interval", 0) < 0
+                or value.get("next_run_at") is not None
+                and (
+                    type(value["next_run_at"]) not in {int, float}
+                    or not math.isfinite(value["next_run_at"])
+                    or value["next_run_at"] < 0
+                )
                 or value["pid"] is not None
                 and (type(value["pid"]) is not int or value["pid"] <= 1)
             ):
@@ -168,15 +219,30 @@ class SupervisorCommands:
                     raise PermissionError("wrong launchd target")
                 if verb == "print":
                     state = states[name]
+                    # An interval job remains loaded between runs, including a health
+                    # check that exits 1 to report issues. A dead worker with no next
+                    # scheduled run must remain unhealthy.
+                    down = (
+                        state["configured"]
+                        and not state["paused"]
+                        and not state["pid"]
+                        and not (state.get("interval") and state.get("next_run_at") is not None)
+                    )
                     return result(
+                        code=113 if down else 0,
                         out=f"state = {'running' if state['pid'] else 'waiting'}\nruns = {state['starts']}\n"
-                        + (f"pid = {state['pid']}\n" if state["pid"] else "")
+                        + (f"pid = {state['pid']}\n" if state["pid"] else ""),
                     )
                 if verb == "bootstrap":
                     if args[2] != self.domain:
                         raise PermissionError("wrong launchd domain")
-                    action = "resume"
+                    state = states[name]
+                    # Resume only selects paused children. Heal an already-unpaused
+                    # dead worker directly, without creating an owner-less pause.
+                    action = "restart" if state["configured"] and not state["paused"] and not state["pid"] else "resume"
                 elif verb == "bootout":
+                    if not states[name]["pid"]:
+                        return result()
                     action = "pause"
                 elif verb == "kickstart":
                     action = "restart"
@@ -201,9 +267,18 @@ class SupervisorCommands:
             return result(127, error=f"supervisor control failed: {exc}")
 
 
-def adapt_commands(runner, pause_path=None, *, required=(), tolerate_unavailable=False):
+def adapt_commands(runner, pause_path=None, *, required=(), tolerate_unavailable=False, discover_ownership=False):
     path = os.environ.get("BRAINLAYER_SUPERVISOR_SOCKET")
-    if not path or isinstance(runner, SupervisorCommands):
+    if isinstance(runner, SupervisorCommands):
+        return runner
+    ownership_error = ""
+    if discover_ownership:
+        try:
+            if not supervisor_owns_jobs():
+                return runner
+        except (OSError, ValueError) as exc:
+            ownership_error = f"can't determine job owner: {exc}"
+    elif not path:
         return runner
     backend = SupervisorCommands(
         supervisor_socket_path(),
@@ -211,6 +286,8 @@ def adapt_commands(runner, pause_path=None, *, required=(), tolerate_unavailable
         pause_path=pause_path or Path(os.environ.get("BRAINLAYER_PAUSE_SENTINEL", str(DEFAULT_PAUSE_SENTINEL_PATH))),
     )
     try:
+        if ownership_error:
+            raise RuntimeError(ownership_error)
         states = backend.request()
         if any(backend.aliases[label] not in states for label in required if label in backend.aliases):
             raise RuntimeError("required supervisor component is unavailable")

brainlayer-1.5.76/src/brainlayer/_build.py

@@ -1 +0,0 @@
-BUILD_SHA = "184525f889a9552f6f08a5f3fe499b41f3fbc6dc"