2026-09-14 - 2026-10-14
Overview
16 Releases published by 1 user
Published
v0.24.0
Published
v0.23.1
Published
v0.23.0
Published
v0.22.0
Published
v0.21.1
Published
v0.21.0
Published
v0.20.1
Published
v0.20.0
Published
v0.19.1
Published
v0.19.0
Published
v0.18.4
Published
v0.18.3
Published
v0.18.2
Published
v0.18.1
Published
v0.18.0
Published
v0.17.0
36 Pull requests merged by 1 user
Merged
#201 chore(context): restore the root rules in AGENTS.md and system-prompt.txt (#200)
Merged
#189 fix: creating and generated writes go through the brain root (#188, #158 part A)
Merged
#191 fix(linkcheck): keep the write when the link index cannot be built (#178)
Merged
#190 fix(symlinkguard): report and remove FIFOs, sockets and devices too (#179)
Merged
#187 fix(brainfs): refuse a file behind a symlinked directory for reads and writes (#173)
Merged
#186 fix(tunnel): DetectTunnels walks and reads through brainfs (#174, #157 slice 5b)
Merged
#172 test(brainfs): per-caller in-brain symlink targets for slices 1-3 (#171)
Merged
#176 fix(pipeline,classification): read the brain through brainfs (#157, slice 6)
Merged
#170 fix: brain_tunnel, brain_update and session_log confine caller-supplied paths (#169)
Merged
#183 fix(ingestion): build /mcp's bearer and the metrics wrap inside buildMux (#154)
Merged
#180 fix(symlinkguard): deliver alerts beside the scan, not inside it (#164)
Merged
#181 fix(ingestion): bump mcp-chassis to v0.7.1; label refused REST requests by route (#155)
Merged
#175 fix(brain): wing indexes and the link check read through brainfs (#157, slice 5a)
Merged
#168 fix(graph,wiki): read the brain through brainfs (#157, slice 4)
Merged
#166 fix(vectorstore): walk and read the brain through brainfs (#157, slice 3)
Merged
#165 fix(brain): context, brain_get and brain_read read through brainfs (#157, slice 2)
Merged
#161 fix(search): walk and read the brain through an os.Root (#157, slice 1)
Merged
#160 feat(ingestion): runtime symlink tripwire removes what it finds, 30s scans (#157)
Merged
#156 fix(ingestion): brain/raw/ readers go through an os.Root; symlinks are inert (#153)
Merged
#159 feat(ingestion): symlink tripwire for the Syncthing-shared brain dir (#157)
Merged
#152 fix(ingestion): authenticate the REST API; confine ingest paths to brain/raw/ (#149)
Merged
#147 feat(brain): tool-call audit log (#144) + server-owned write provenance (#145)
Merged
#139 fix(frontmatter): consolidate 3 independent fence-parsers into one
Merged
#140 feat(server): say at startup when alerting is unconfigured (#107)
Merged
#136 fix(mcp): validate the claim envelope before brain_edit writes too
Merged
#137 fix(api): UpdateNote reserves updated_at/supersedes/supersede_reason from the caller's fragment
Merged
#135 fix(api): frontmatter parser must not misparse indented list items as keys
Merged
#133 feat(brain): add brain_reject — the missing third option for raw/ notes
Merged
#132 feat(pipeline): feed the current source page into the extraction prompt (#106)
Merged
#131 chore(brain): remove brain_write legacy params domain/type/knowledge-path (ADR-0012)
Merged
#129 feat(pipeline): report when a re-ingest disagrees with the page on disk (#104)
Merged
#126 feat(pipeline): skip extraction when the source has not changed (#105)
Merged
#103 feat(pipeline): ingest revises the existing page instead of clobbering it
Merged
#124 Brain-quality sweep, batch 1: brain_edit/brain_update correctness + close-session docs
Merged
#121 fix(taskfile): remove build targets for binaries deleted months ago, and make check build
Merged
#119 fix(config): delete the model-routing chain — nothing has called it since April
2 Pull requests proposed by 1 user
Proposed
#194 fix(brain_edit): snapshot, rollback and lock file go through the brain root (#192)
Proposed
#195 fix: pipeline, backfill, watcher and archive writes go through the brain root (#158 part B)
45 Issues closed from 1 user
Closed
#200 chore(context): restore the root rules in AGENTS.md and system-prompt.txt (project-only since 10-08)
Closed
#185 ingestion metrics: an authenticated request to an unregistered path is labelled with the raw URL path (unbounded series)
Closed
#193 symlinkguard: Watch alert-queue tests flake under -race and CPU load
Closed
#163 ntfy notifier hard-codes the title "brain-capture audit degraded" for every alert
Closed
#188 brain_write follows a symlinked wing directory, including one that points outside the brain
Closed
#178 brain_write loses the learning when any subdirectory under knowledge/ or wiki/ is unreadable
Closed
#179 symlinkguard ignores FIFOs and other special files: a planted FIFO classification.yaml crash-loops the pod
Closed
#157 SECURITY: symlinks anywhere in the Syncthing-shared brain dir are followed by search, vectorstore, context and graph readers
Closed
#173 Writes follow a static intermediate in-brain directory symlink (brain_update, brain_tunnel, session_log)
Closed
#174 DetectTunnels blocks on a FIFO under wiki/, hanging brain_update and brain_write
Closed
#171 #157 slices 1–3: per-caller tests with in-brain symlink targets (search, hydrate, vectorstore, context excerpt, ReadNote)
Closed
#169 brain_tunnel: path traversal lets an MCP token holder rewrite any file the pod can write
Closed
#154 Test that /mcp authenticates through the production router; close the re-wrap gap in main.go
Closed
#164 symlinkguard: a hung ntfy delays symlink removal (alert flush runs in the scan goroutine)
Closed
#155 ingestion pins mcp-chassis v0.2.0: auth rejections aren't logged; REST metrics collapse to path="/"
Closed
#177 brainfstest: swap-race asserts can pass vacuously (no read/iteration floor, swallowed Query errors)
Closed
#83 ingestion: retry OIDC discovery instead of exiting on cold-boot 502
Closed
#43 Brain interface: intent↔interface mismatch analysis (problem statement, evidence-backed)
Closed
#162 test(ingestion): raw swap-race tests do not join the swapper goroutine; TempDir cleanup flakes CI
Closed
#153 brain/raw/ readers follow symlinks (pending, promote); raw/ is writable via Syncthing
Closed
#149 SECURITY: ingestion REST routes have no in-process auth; brain_ingest/ingest-path read any server file
Closed
#144 brain-mcp: one shared bearer for every client, no per-caller read scoping (OWASP MCP07/MCP10)
Closed
#145 brain_write is an ungated persistent prompt-injection path into every future session (OWASP MCP06)
Closed
#142 claudewatcher scrubber misses https://user:secret@host — the git credential-store shape passes every rule
Closed
#138 Consolidate the three independent frontmatter-fence parsers
Closed
#107 Say so at startup when a security-relevant alert is unconfigured, instead of skipping silently
Closed
#82 Surface aging brain/raw/ pending notes instead of relying on someone remembering to check
Closed
#101 cd.yml fails on a duplicate run: "nothing to commit" is treated as an error
Closed
#120 Procfile, Taskfile and smoke-routing.sh still invoke cmd/supervisor and cmd/routing, neither of which exists
Closed
#134 Live-triage the real brain/raw/ backlog with brain_reject (deferred from #81)
Closed
#123 Audit remaining write paths that reach disk without claim-envelope validation (brain_edit, ingestion pipeline)
Closed
#125 UpdateNote: supersede_reason settable via caller's own frontmatter fragment, bypassing the Reason option
Closed
#128 api/frontmatter.go's parseFrontmatter misparses an indented list item containing a colon as a top-level key
Closed
#81 Add brain_reject: brain/raw/ pending notes can only be promoted, never discarded
Closed
#106 Compile-on-ingest, second half: let the extraction see the page it is revising
Closed
#79 chore(brain): deprecate + remove brain_write legacy params (domain/type/knowledge-path) (ADR-0012)
Closed
#104 Contradiction flagging at ingest — reuse brain-gardener's Judge, do not build a second one
Closed
#105 Source drift: hash the ingested body, skip an unchanged re-ingest, flag a changed one
Closed
#111 brain_update bypasses claim-envelope validation — a note can be superseded into a bad envelope
Closed
#112 close-session: teach it the claim envelope, and refresh its stale classification hint list
Closed
#115 brain_edit always fails with "old_str is empty" even when old_str is non-empty
Closed
#67 capture: populate classification.yaml at brain root (untagged repos fail-safe to confidential, block claude.ai capture)
Closed
#117 ~385 auto-written See-also edges point at one-word TELOS entries — the graph's top two nodes are artifacts
Closed
#118 CD runs twice per push and the second run fails on "nothing to commit" — a red CI signal with nothing wrong
Closed
#116 config/models.yaml is not read by the deployed service, and names two models that no longer exist
49 Issues created by 1 user
Opened
#116 config/models.yaml is not read by the deployed service, and names two models that no longer exist
Opened
#117 ~385 auto-written See-also edges point at one-word TELOS entries — the graph's top two nodes are artifacts
Opened
#118 CD runs twice per push and the second run fails on "nothing to commit" — a red CI signal with nothing wrong
Opened
#120 Procfile, Taskfile and smoke-routing.sh still invoke cmd/supervisor and cmd/routing, neither of which exists
Opened
#122 Brain search requires Postgres, so there is no offline or portable path — decide whether that matters
Opened
#123 Audit remaining write paths that reach disk without claim-envelope validation (brain_edit, ingestion pipeline)
Opened
#125 UpdateNote: supersede_reason settable via caller's own frontmatter fragment, bypassing the Reason option
Opened
#128 api/frontmatter.go's parseFrontmatter misparses an indented list item containing a colon as a top-level key
Opened
#134 Live-triage the real brain/raw/ backlog with brain_reject (deferred from #81)
Opened
#138 Consolidate the three independent frontmatter-fence parsers
Opened
#141 internal/wiki/merge.go:184 is a fourth hand-rolled frontmatter-fence parser, not folded into frontmatter.Split
Opened
#142 claudewatcher scrubber misses https://user:secret@host — the git credential-store shape passes every rule
Opened
#143 url-userinfo-credential: two residual shapes still pass — secret containing "/" and the scheme-less form
Opened
#144 brain-mcp: one shared bearer for every client, no per-caller read scoping (OWASP MCP07/MCP10)
Opened
#145 brain_write is an ungated persistent prompt-injection path into every future session (OWASP MCP06)
Opened
#146 brain-mcp: per-client bearer tokens instead of one shared token (split from #144)
Opened
#148 Provenance: first-party writers (claudewatcher, pipeline) stamp origin: unknown — add an internal origin
Opened
#149 SECURITY: ingestion REST routes have no in-process auth; brain_ingest/ingest-path read any server file
Opened
#150 Provenance residuals: brain_tunnel edits without re-stamping; generated aggregates carry none
Opened
#151 provenance follow-ups: decode written_by on read; promote leaves empty dir on refusal; partial multi-page ingest
Opened
#153 brain/raw/ readers follow symlinks (pending, promote); raw/ is writable via Syncthing
Opened
#154 Test that /mcp authenticates through the production router; close the re-wrap gap in main.go
Opened
#155 ingestion pins mcp-chassis v0.2.0: auth rejections aren't logged; REST metrics collapse to path="/"
Opened
#157 SECURITY: symlinks anywhere in the Syncthing-shared brain dir are followed by search, vectorstore, context and graph readers
Opened
#158 Writes under brain/raw/ follow symlinks: processed/, rejected/, .processed markers, tunnel-candidates
Opened
#162 test(ingestion): raw swap-race tests do not join the swapper goroutine; TempDir cleanup flakes CI
Opened
#163 ntfy notifier hard-codes the title "brain-capture audit degraded" for every alert
Opened
#164 symlinkguard: a hung ntfy delays symlink removal (alert flush runs in the scan goroutine)
Opened
#167 brainfs: fd-relative walk to close the directory-swap race (accepted residual from #157)
Opened
#169 brain_tunnel: path traversal lets an MCP token holder rewrite any file the pod can write
Opened
#171 #157 slices 1–3: per-caller tests with in-brain symlink targets (search, hydrate, vectorstore, context excerpt, ReadNote)
Opened
#173 Writes follow a static intermediate in-brain directory symlink (brain_update, brain_tunnel, session_log)
Opened
#174 DetectTunnels blocks on a FIFO under wiki/, hanging brain_update and brain_write
Opened
#177 brainfstest: swap-race asserts can pass vacuously (no read/iteration floor, swallowed Query errors)
Opened
#178 brain_write loses the learning when any subdirectory under knowledge/ or wiki/ is unreadable
Opened
#179 symlinkguard ignores FIFOs and other special files: a planted FIFO classification.yaml crash-loops the pod
Opened
#182 ingestion main.go: symlink tripwire wiring, buildMux arguments and ListenAndServe line remain untested (split from #154)
Opened
#184 ingestion: cmd/server has no signal handling; symlinkguard.Watch gets context.Background() so its shutdown flush never runs
Opened
#185 ingestion metrics: an authenticated request to an unregistered path is labelled with the raw URL path (unbounded series)
Opened
#188 brain_write follows a symlinked wing directory, including one that points outside the brain
Opened
#192 brain_edit path I/O: snapshot read hangs on a FIFO, lock file and rollback write by path
Opened
#193 symlinkguard: Watch alert-queue tests flake under -race and CPU load
Opened
#196 brain_edit: snapshot taken outside the lock and rollback after unlock can overwrite a concurrent edit
Opened
#197 Only notes.Edit takes the per-note edit lock; other writers of the same notes do not
Opened
#199 watcher: a marker write that fails for a reason other than ErrNotRegular is only logged, so the note is retried every round
Opened
#198 watcher: archive copy reads the whole note into memory (io.ReadAll), with no size cap
Opened
#200 chore(context): restore the root rules in AGENTS.md and system-prompt.txt (project-only since 10-08)
Opened
#202 brain_answer synthesises from ~300-char excerpts only, so it cannot answer from any long note
Opened
#203 brain_query's "BM25" is raw substring counting: no IDF, no length normalisation, one-letter terms count every letter
3 Unresolved Conversations
Open
#92
chore: Configure Renovate
Open
#80
design(brain): remember + recall consolidations under ADR-0009/0012 (blocked on 0009 design)
Open
#64
capture follow-up: harvest adapters (transcript-parse / chat-reconstruct / agent-runlog)