The brain dir is a Syncthing sendreceive folder and Syncthing syncs
symlinks; search, vectorstore, context and graph readers follow one out
of the brain and would index or return what it points to (reproduced
with search.Query). Decision (#157): a tripwire now, brain-wide os.Root
readers next.
- symlinkguard.Scan lists every symlink inside the brain dir (skipping
.git; the brain dir itself may be a mount symlink).
- At startup the server refuses to start while any exists, naming them.
- symlinkguard.Watch rescans every BRAIN_SYMLINK_SCAN_INTERVAL seconds
(default 300) and sends one ntfy alert per new set of symlinks.
The live brain dir had 0 symlinks on 2026-10-03, checked before this
change, so deploying it does not trip.
Refs #157
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
