topos-node 1.3.40__tar.gz → 1.3.42__tar.gz

{topos_node-1.3.40/topos_node.egg-info → topos_node-1.3.42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: topos-node
-Version: 1.3.40
+Version: 1.3.42
 Summary: Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://topos.dialogues.ai

{topos_node-1.3.40 → topos_node-1.3.42}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "topos-node"
-version = "1.3.40"
+version = "1.3.42"
 description = "Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client"
 readme = "README.md"
 license = "Apache-2.0"

{topos_node-1.3.40 → topos_node-1.3.42}/topos/__version__.py

@@ -1,6 +1,6 @@
 """Topos Control Plane Version Information."""
 
-__version__ = "1.3.40"
-__version_info__ = (1, 3, 40)
+__version__ = "1.3.42"
+__version_info__ = (1, 3, 42)
 
 __all__ = ["__version__", "__version_info__"]

{topos_node-1.3.40 → topos_node-1.3.42}/topos/core/handlers/graph_summary.py

@@ -44,8 +44,12 @@ def _counts() -> Dict[str, Any]:
         except Exception:  # noqa: BLE001
             out[key] = None
     try:
+        # The column is `last_run_at` -- what _mark_materialized writes. This read
+        # `materialized_at`, which does not exist, and the per-field try/except
+        # turned that into a permanent null rather than an error: shipped in
+        # 1.3.40 and noticed only because the live reply carried the null.
         row = conn.execute(
-            "SELECT MAX(materialized_at) FROM graph_materialization_state"
+            "SELECT MAX(last_run_at) FROM graph_materialization_state"
         ).fetchone()
         out["materialized_at"] = row[0] if row else None
     except Exception:  # noqa: BLE001

{topos_node-1.3.40 → topos_node-1.3.42}/topos/features/complexity/projection.py

@@ -401,7 +401,15 @@ class EvidenceCache:
             for row in conn.execute(
                 f"""
                 SELECT src_entity_id, dst_entity_id, edge_type, weight, evidence_count,
-                       COALESCE(last_event_at, valid_from, created_at) AS event_at
+                       -- last_event_at ONLY. valid_from is when the node started
+                       -- believing the relation (a recompute's clock for part_of
+                       -- and other structural edges) and created_at is the row's
+                       -- own birth; neither is an event. The fallback made an
+                       -- undated edge report activity at rebuild time, which is
+                       -- the defect fixed for the graph window in edges.py.
+                       -- EvidenceCache.add tolerates None: weight still counts,
+                       -- no date is invented.
+                       last_event_at AS event_at
                 FROM entity_edges
                 WHERE valid_to IS NULL
                   AND LOWER(TRIM(edge_type)) IN ({placeholders})

{topos_node-1.3.40 → topos_node-1.3.42}/topos/features/entities/edges.py

@@ -562,11 +562,21 @@ def graph_snapshot(
         clause = ""
     else:
         clause = " AND valid_to IS NULL"
+    # A TIME window asks "did anything happen between these dates". Only
+    # last_event_at answers that. valid_from is when the node started BELIEVING
+    # the relation -- for a structural edge written by a recompute (semantic
+    # affinity, part_of) that is the recompute's clock, and it carries no event
+    # at all. The old COALESCE fallback read that clock as activity, so every
+    # entity touched by a rebuild appeared in "the last 11 days" no matter when
+    # it was last mentioned: 69 of 4,602 dormant entities on the reference node,
+    # 60 of them through exactly these undated edges. An undated edge is no
+    # evidence of activity in any window; it stays in the unwindowed views,
+    # where valid_from remains the right recency key for ORDER BY.
     if after:
-        clause += " AND COALESCE(last_event_at, valid_from) >= ?"
+        clause += " AND last_event_at IS NOT NULL AND last_event_at >= ?"
         where_params.append(after)
     if before:
-        clause += " AND COALESCE(last_event_at, valid_from) <= ?"
+        clause += " AND last_event_at IS NOT NULL AND last_event_at <= ?"
         where_params.append(before)
 
     where_sql = (

{topos_node-1.3.40 → topos_node-1.3.42}/topos/features/entities/graph_refresh.py

@@ -28,6 +28,7 @@ import asyncio
 import logging
 import os
 import threading
+from typing import Any, Dict
 from datetime import datetime, timezone
 from typing import Any, Callable, Dict, Optional
 
@@ -253,6 +254,60 @@ def gc_status() -> Dict[str, Any]:
         return {"enabled": _gc_enabled(), "pending": _GC_TIMER is not None, **_GC_LAST}
 
 
+def refresh_now_if_dirty() -> Dict[str, Any]:
+    """Rebuild the graph inline, right now, if it is dirty and nothing is deriving.
+
+    Written for one caller: the post-canonical pipeline, at the point between
+    canonical enrichment and signal derivation. The debounced mark cannot do
+    this job there -- its timer fires ~90s later, by which time signal
+    derivation has raised the in-flight counter and _fire re-arms the timer
+    instead of rebuilding (DEBUG-logged). It keeps re-arming until derivation
+    ends, so the mid-import refresh collapses into the end-of-pipeline one. On
+    a file import that phase runs for hours, so "the graph fills before the
+    long phase" never happened. Measured on a 20-stage import: zero mid-import
+    rebuilds.
+
+    Costs a rebuild (~7-9 minutes on a 17k-edge node) inside the import, which
+    is the point. Skipped when the graph is not dirty, so a re-import that
+    changed nothing pays nothing.
+    """
+    from ...core.state import get_db_connection
+    from ...enrichment.pipeline_activity import is_derivation_in_flight
+
+    if not _enabled():
+        return {"skipped": "disabled"}
+    if is_derivation_in_flight():
+        return {"skipped": "derivation in flight"}
+    conn = get_db_connection()
+    if conn is None:
+        return {"skipped": "no database"}
+    try:
+        row = conn.execute(
+            "SELECT dirty_generation, materialized_generation FROM graph_materialization_state WHERE id=1"
+        ).fetchone()
+    except Exception as exc:  # noqa: BLE001
+        return {"skipped": f"state unreadable: {exc}"}
+    if not row or int(row[0]) <= int(row[1]):
+        return {"skipped": "not dirty"}
+    logger.info("graph refresh: inline, before signal derivation")
+    try:
+        _refresher._rebuild_fn()
+        return {"ran": True}
+    except WriteGateDeferred as exc:
+        _refresher.mark()
+        return {"skipped": f"deferred: {exc}"}
+    finally:
+        # This runs on an asyncio.to_thread worker. Pooled threads are reused;
+        # the rebuild route closes its thread-local connection for the same
+        # reason, or every call leaks one.
+        try:
+            from ...core.state import close_thread_db_connection
+
+            close_thread_db_connection()
+        except Exception:  # noqa: BLE001 — cleanup must not mask the result
+            pass
+
+
 def mark_graph_dirty() -> None:
     """Enrichment completed for a source — schedule a debounced graph rebuild."""
     try:

{topos_node-1.3.40 → topos_node-1.3.42}/topos/ingestion/canonical_pipeline.py

@@ -893,30 +893,6 @@ async def run_post_canonical_pipeline(
             logger.error("[PIPELINE:ENRICHMENT] post-canonical failed: %s", exc, exc_info=True)
             outcome["canonical_enrichment"] = {"errors": [str(exc)]}
 
-        # Materialise the graph HERE, not only at the end of the pipeline.
-        #
-        # The entity data lands early -- the entities job writes entities,
-        # message_entities and entity_mentions batch by batch -- but the graph
-        # a person actually looks at is derived by rebuild_entity_graph, and
-        # the only mark was after signal derivation. On a file import that is
-        # 13 more stages and hours of model work, so everything landed in the
-        # database with no visible change to the graph until the very end.
-        #
-        # One mark here, one at the end: two rebuilds per import. Deliberately
-        # NOT one per job. graph_refresh is single-flight and a mark landing
-        # mid-rebuild schedules exactly one follow-up, so marking per job would
-        # chain rebuilds back to back for the whole import and take CPU from
-        # the model work that is already the slow part.
-        try:
-            from ..features.entities.graph_refresh import mark_graph_dirty
-
-            mark_graph_dirty()
-            logger.info(
-                "[PIPELINE:ENRICHMENT] graph marked dirty after canonical enrichment "
-                "so the graph fills before signal derivation runs"
-            )
-        except Exception as exc:  # noqa: BLE001 — refresh must never break ingest
-            logger.debug("mid-import graph refresh mark skipped: %s", exc)
     elif canonical_jobs and enrichment_trigger == "manual":
         logger.debug(
             "[PIPELINE:ENRICHMENT] Skipping canonical enrichment (manual trigger): source_id=%s records=%d",
@@ -930,6 +906,32 @@ async def run_post_canonical_pipeline(
     signal_gate_open = (
         enrichment_trigger == "automatic" or force_signal or job_names is not None
     )
+    # Fill the graph HERE, before the long phase -- and actually do it.
+    #
+    # The entity data lands early; the graph a person looks at is derived by
+    # rebuild_entity_graph. The first version of this marked the graph dirty
+    # after canonical enrichment and left the rebuild to the debounced
+    # refresher. Two things defeated it, both measured on a live 20-stage
+    # import: the mark sat inside the enrichment guard, so an import with
+    # nothing left to enrich never marked at all; and the refresher's timer
+    # fires ~90s later, by which time signal derivation has raised its
+    # in-flight counter and the refresh re-arms itself until derivation ends
+    # -- collapsing into the end-of-pipeline rebuild. Zero mid-import
+    # rebuilds, every time.
+    #
+    # So: mark, then rebuild inline while nothing is deriving. ~7-9 minutes on
+    # a 17k-edge node, inside the import, which is the point. Skipped when the
+    # graph is not dirty, so a re-import that changed nothing pays nothing.
+    if canonical_records:
+        try:
+            from ..features.entities.graph_refresh import mark_graph_dirty, refresh_now_if_dirty
+
+            mark_graph_dirty()
+            outcome["graph_fill"] = await asyncio.to_thread(refresh_now_if_dirty)
+            logger.info("[PIPELINE:GRAPH] mid-import graph fill: %s", outcome["graph_fill"])
+        except Exception as exc:  # noqa: BLE001 -- the graph must never break ingest
+            logger.warning("mid-import graph fill skipped: %s", exc)
+
     if run_signal and signal_jobs and not signal_gate_open:
         logger.debug(
             "[PIPELINE:SIGNAL_DERIVE] Skipping signal derivation (manual trigger): source_id=%s records=%d",

{topos_node-1.3.40 → topos_node-1.3.42}/topos/protocol/narrowing_vocabulary.json

@@ -154,7 +154,8 @@
     "topic_thread_single_store",
     "unknown_scope",
     "unmatched_route",
-    "unrecognized"
+    "unrecognized",
+    "world_knowledge_no_retrieval"
   ],
   "empty_causes": [
     "gate_vetoed",

{topos_node-1.3.40 → topos_node-1.3.42}/topos/query/game_layer.py

@@ -106,6 +106,75 @@ def _extract_entity_labels(context_packet: Dict[str, Any]) -> List[str]:
     return labels[:10]
 
 
+#: availability:read licenses free/busy ONLY. The three sets below are the
+#: ENTIRE licensed vocabulary of an availability inference answer — a person
+#: name or a meeting title has no slot in it, so enforcement is a closed-set
+#: membership check, never a redaction pattern that has to recognize names.
+_AVAILABILITY_ANSWERS = frozenset({"yes", "conditional", "no", "unknown"})
+_AVAILABILITY_BANDS = frozenset(
+    {"overlap_found", "negotiable_overlap", "no_overlap", "unknown"}
+)
+#: Free text can only leave through a key, so unknown keys are dropped rather
+#: than inspected. Everything listed is either closed-set or pipeline-stamped
+#: metadata (exclusion/truncated/empty_cause carry slugs and integers only).
+_AVAILABILITY_ALLOWED_KEYS = frozenset(
+    {
+        "access_mode",
+        "scope_id",
+        "answer_type",
+        "band",
+        "answer",
+        "confidence",
+        "items",
+        "deferred",
+        "redaction",
+        "exclusion",
+        "truncated",
+        "empty_cause",
+        "packet_resolution",
+        "packet_resolution_reason",
+        "principal_cls",
+    }
+)
+
+
+def is_availability_scope(scope_id: str) -> bool:
+    return "availability" in (scope_id or "")
+
+
+def enforce_availability_inference_contract(payload: Dict[str, Any]) -> Dict[str, Any]:
+    """Free/busy-only egress gate for availability inference payloads.
+
+    The branches in ``DefaultGameLayer.apply`` already emit only closed-set
+    values for this scope — but the pipeline lanes that run AFTER the game
+    layer ``update()`` the payload in place, and any of them can re-open what
+    the game layer refused. Live 2026-09-02 the LLM inference lane did exactly
+    that: the who-guard's ``answer: "unknown"`` left the engine as a contact's
+    full name at confidence 1. This function is the last owner of the payload
+    before it is serialized, so a violation here is scrubbed to "unknown"
+    rather than trusted, and the scrub is declared via ``redaction`` (a
+    closed-set slug) instead of happening silently.
+    """
+    out = {k: v for k, v in payload.items() if k in _AVAILABILITY_ALLOWED_KEYS}
+    scrubbed = len(out) != len(payload)
+    if out.get("answer_type") not in ("band", "list"):
+        out["answer_type"] = "band"
+        scrubbed = True
+    if str(out.get("band") or "unknown") not in _AVAILABILITY_BANDS:
+        out.pop("band", None)
+        scrubbed = True
+    if str(out.get("answer")) not in _AVAILABILITY_ANSWERS:
+        out["answer"] = "unknown"
+        out["confidence"] = 0.0
+        scrubbed = True
+    if out.get("items"):
+        out["items"] = []
+        scrubbed = True
+    if scrubbed:
+        out["redaction"] = "availability_free_busy_only"
+    return out
+
+
 class DefaultGameLayer:
     reveal_strategy: RevealStrategy = RevealStrategy.DIRECT
 

{topos_node-1.3.40 → topos_node-1.3.42}/topos/query/narrowing.py

@@ -299,6 +299,7 @@ REASONS = frozenset(
         "source_has_live_tools",
         "source_ref",
         "summary_enrichment",
+        "world_knowledge_no_retrieval",
         # --- control plane: refusals that never reach the node. The human-readable
         # sentence stays on the response's own `deny_reason`; the ledger carries the code.
         "access_mode_above_ceiling",

{topos_node-1.3.40 → topos_node-1.3.42}/topos/query/pipeline.py

@@ -16,7 +16,11 @@ from .ddr import StageTimings, build_disclosure_decision_record, now_ms
 from .disclosure import DisclosureFilterPipeline
 from .fingerprint import compute_retrieval_fingerprint
 from .packet_resolution import effective_packet_resolution
-from .game_layer import DefaultGameLayer
+from .game_layer import (
+    DefaultGameLayer,
+    enforce_availability_inference_contract,
+    is_availability_scope,
+)
 from .inference import run_query_inference
 from .intent import compute_intent_hash
 from .manifest import ScopeResolutionManifest
@@ -779,7 +783,17 @@ class QueryPipelineOrchestrator:
             query_text=query_text,
         )
         timings.game_layer_ms = now_ms() - _t0
-        if access_mode == "inference" and public.payload.get("answer_type") != "band":
+        # availability:read licenses free/busy only, so the game layer's output
+        # (band, or the who-guard's refusal) is FINAL for this scope — same
+        # contract as `band`/`facts` below: deterministic answer_types are
+        # final. The lanes below `update()` the payload in place, and on
+        # 2026-09-02 the LLM lane overwrote the who-guard's "unknown" with a
+        # contact's full name at confidence 1 — the refusal has answer_type
+        # "list", which both lanes treated as an invitation.
+        availability_final = access_mode == "inference" and is_availability_scope(scope_id)
+        if (access_mode == "inference"
+                and not availability_final
+                and public.payload.get("answer_type") != "band"):
             # C7 facts-direct (W3.1): a known-item ask with live facts gets its
             # exact values, validity dates and evidence counts with ZERO LLM —
             # same contract as `band`: deterministic answer_types are final.
@@ -820,6 +834,7 @@ class QueryPipelineOrchestrator:
             if direct is not None:
                 public.payload.update(direct)
         if (access_mode == "inference"
+                and not availability_final
                 and public.payload.get("answer_type") not in ("band", "facts")):
             _t0 = now_ms()
             inf = await asyncio.to_thread(
@@ -831,6 +846,11 @@ class QueryPipelineOrchestrator:
             )
             public.payload.update(inf)
             timings.inference_ms = now_ms() - _t0
+        if availability_final:
+            # Closed-set egress scrub, applied even though the lanes above are
+            # gated off: the payload has one last owner before serialization,
+            # and a lane added later must hit this wall, not the wire.
+            public.payload = enforce_availability_inference_contract(public.payload)
 
         public_dict = public.to_dict()
         # Declared, never silent: every turn says what resolution actually applied and

{topos_node-1.3.40 → topos_node-1.3.42}/topos/query/scope_registry.json

@@ -186,6 +186,110 @@
         "canonical_address_book"
       ]
     },
+    {
+      "scope_id": "facts:read",
+      "description": "Derived facts about the owner from standard packs (work, interests, preferences, places, behavior): predicate/value pairs with validity windows. Excludes special-class packs \u2014 health, inner-state and finances live behind facts_sensitive:read.",
+      "example_questions": [
+        "What do the derivation packs know about my work?",
+        "Which projects am I recorded as pursuing?",
+        "What are my stated preferences?"
+      ],
+      "primary_dimensions": [
+        "Profile"
+      ],
+      "raw_tables": [],
+      "canonical_tables": [],
+      "signal_objects": [
+        "fact"
+      ],
+      "summary_objects": [
+        "fact"
+      ],
+      "inference_objects": [
+        "fact"
+      ],
+      "default_mode_ceiling": "inference",
+      "implementation_status": "stub",
+      "fact_classes": [
+        "standard"
+      ]
+    },
+    {
+      "scope_id": "facts_sensitive:read",
+      "description": "Derived facts from special-class packs: health, inner state (mind.*), and finances (money.*). Split from facts:read so a grant can carry everyday facts without carrying these; mirrors the engine's facts vs facts_all packet distinction.",
+      "example_questions": [
+        "What medications am I recorded as taking?",
+        "What does the pack record about my reported state?"
+      ],
+      "primary_dimensions": [
+        "Profile"
+      ],
+      "raw_tables": [],
+      "canonical_tables": [],
+      "signal_objects": [
+        "fact"
+      ],
+      "summary_objects": [
+        "fact"
+      ],
+      "inference_objects": [
+        "fact"
+      ],
+      "default_mode_ceiling": "inference",
+      "implementation_status": "stub",
+      "fact_classes": [
+        "special"
+      ]
+    },
+    {
+      "scope_id": "goals:read",
+      "description": "Stated and derived goals: the user_goals store and Goal signal objects, with their dates and status. Aspirations are sensitive; answers are summaries and bands, not raw dumps.",
+      "example_questions": [
+        "What goals have I set this quarter?",
+        "Which goals went quiet?"
+      ],
+      "primary_dimensions": [
+        "Profile"
+      ],
+      "raw_tables": [],
+      "canonical_tables": [
+        "user_goals"
+      ],
+      "signal_objects": [
+        "Goal",
+        "user_goals"
+      ],
+      "summary_objects": [
+        "Goal"
+      ],
+      "inference_objects": [
+        "Goal"
+      ],
+      "default_mode_ceiling": "inference",
+      "implementation_status": "stub"
+    },
+    {
+      "scope_id": "graph:read",
+      "description": "The entity graph: people, projects, places and topics as nodes, and the derived relations between them (communicates_with, co_occurrence, pursues, participates_in, located_at). Structure and strength, resolved through aliases; not message text.",
+      "example_questions": [
+        "Who is connected to this project?",
+        "What links me to this person?",
+        "Which people bridge my communities?"
+      ],
+      "primary_dimensions": [
+        "Relationships"
+      ],
+      "raw_tables": [
+        "entities",
+        "entity_edges"
+      ],
+      "canonical_tables": [],
+      "signal_objects": [],
+      "summary_objects": [],
+      "inference_objects": [],
+      "default_mode_ceiling": "raw",
+      "implementation_status": "stub"
+    },
     {
       "scope_id": "health:read",
       "description": "Wellbeing signals from journal entries and role-filtered message emotions: moods, wellness summaries, and wellness scores.",
@@ -381,6 +485,31 @@
         "calendar_stub"
       ]
     },
+    {
+      "scope_id": "topics:read",
+      "description": "Derived topic clusters and their membership: what themes the owner's activity organizes into, by dimension. Labels and counts; member pointers stay on the node.",
+      "example_questions": [
+        "What themes does my work cluster into?",
+        "How big is each interest cluster?"
+      ],
+      "primary_dimensions": [
+        "Interests"
+      ],
+      "raw_tables": [],
+      "canonical_tables": [
+        "topic_clusters",
+        "topic_cluster_members"
+      ],
+      "signal_objects": [
+        "message_topics"
+      ],
+      "summary_objects": [
+        "message_topics"
+      ],
+      "inference_objects": [],
+      "default_mode_ceiling": "summary",
+      "implementation_status": "stub"
+    },
     {
       "scope_id": "work_context:read",
       "description": "Work goals and context: roles, skills and employment history from profile records, plus goals extracted from AI conversations and owner journals.",

{topos_node-1.3.40 → topos_node-1.3.42}/topos/sources/bundled_canonical_triples.py

@@ -32,6 +32,17 @@ BUNDLED_CANONICAL_TRIPLES: Dict[str, Tuple[str, str]] = {
     "gcal.events.v1": ("google_calendar", "schedule"),
 }
 
+# Known drift variants of bundled schema ids, seen in the wild: a 2026-07
+# operator install template invented "gdrive.files.v1" (the bundled id is
+# "gdrive.file.v1"). Deliberately NOT keys of BUNDLED_CANONICAL_TRIPLES: an
+# exact key makes normalize_canonical_source_payload raise and rehydrate
+# demote, and the live drive_files install carries this schema with no bundled
+# replacement to fall back to — enforcement would orphan a working connector.
+# Callers use bundled_schema_drift() and decide per source_id.
+BUNDLED_SCHEMA_ALIASES: Dict[str, str] = {
+    "gdrive.files.v1": "gdrive.file.v1",
+}
+
 VALID_CANONICAL_GROUP_IDS = frozenset(
     {
         "ai_messages",
@@ -97,6 +108,32 @@ def bundled_lane_conflict(payload: Dict[str, Any]) -> Optional[str]:
     )
 
 
+def bundled_schema_drift(payload: Dict[str, Any]) -> Optional[str]:
+    """Reason when the payload's schema is a drift variant of a bundled id and
+    its declared lane contradicts the bundled triple, else None.
+
+    Advisory, unlike bundled_lane_conflict: the caller decides whether the row
+    can be retired (its source_id has a bundled replacement) or only reported.
+    """
+    group_id = str(payload.get("canonical_group_id") or "").strip()
+    if not group_id:
+        return None
+    for key in (
+        str(payload.get("schema_id") or "").strip(),
+        str(payload.get("parser_id") or "").strip(),
+    ):
+        bundled_key = BUNDLED_SCHEMA_ALIASES.get(key)
+        if not bundled_key:
+            continue
+        _, bundled_lane = BUNDLED_CANONICAL_TRIPLES[bundled_key]
+        if group_id != bundled_lane:
+            return (
+                f"schema {key!r} is a drift variant of bundled {bundled_key!r} and "
+                f"canonical_group_id {group_id!r} contradicts bundled lane {bundled_lane!r}"
+            )
+    return None
+
+
 def normalize_canonical_source_payload(payload: Dict[str, Any]) -> Dict[str, Any]:
     """
     Fill bundled canonical_mapper_id from schema/parser; drop deprecated connected flag.