Changelog — brain-server

All notable changes are documented here. The format is a simplified keep-a-changelog style. Version numbers follow Cargo.toml; “released” means the binary and docs are consistent at that tag.

[1.29.3] — 2026-10-06 — “Hardening”: two audit passes land as shipped behavior

Two full-spectrum remediation passes land as shipped behavior: erasure now covers the approved proposals behind purged memories, hostile attributes die at the read seam, wrong-typed configuration refuses to boot, the production cache is bounded, and the revoke verb can no longer report a success it did not perform. The memory plugin’s tools gain unambiguous brain_* names, the docs tree grows a complete three-tier course, and the release pipeline moves to the public repo: the release tag now runs the full test matrix there, and nothing publishes unless that matrix is green for the tagged commit.

Release notes

Security fixes

• Client-supplied style= and ping= attributes can no longer carry network fetches through the read seam; a fetch-bearing style attribute drops whole instead of being scheme-checked (54856695).
• DSAR erasure now also deletes the approved proposals behind the memories it purges, so an erasure certificate can no longer certify an erasure that left plaintext behind.
• The operator bearer can no longer be “revoked” into a false success: the revoke verb refuses identities it cannot actually kill and names rotation as the remedy (f886b2df).
• Wrong-typed server configuration refuses to boot — a string where an allowlist belongs or a typo’d enum can no longer silently downgrade the security posture (c25e8910).
• The recipient cache is bounded with eviction and TTL, phone-number mappings can no longer reach any log lane, group/world-readable config files are refused before reading, and signed webhook clients refuse redirects (b47187e8).
• The egress deny table now covers IPv4-compatible IPv6 embeddings, and a bind-port typo refuses the boot instead of silently binding a random port (fcace742, 472652bb).

Improvements

• The egress client cache’s miss path is single-flight: concurrent first calls can no longer each resolve DNS and diverge from the pin map — the first resolution wins and every served client is one the map recorded (a0b72d8).
• The alert sink verifies message freshness (±5 minutes) and the signal gateway rate-limits outbound sends, closing the replay and flood windows (43533767, f944c7ea).
• The API auth posture is a function of the bind address: an unauthenticated router is no longer built on a public interface (3715a33e).
• Markdown reference-style definitions are stripped before content reaches a model or a channel, closing the last auto-fetch image path (54856695).
• Plugin 0.6.12: every memory tool is namespaced brain_*, ending collisions with other MCP memory servers; channel-captured memories can be excluded from tool results, not only labeled (15f536f6).
• macOS app packaging refuses to ship a fork-built app pointing at the upstream update feed (a10bebe1).
• Releases now run their own test matrix: the release tag triggers the full CI suite on the public repo and publication fail-closes unless it is green (5bcaf39f).

Changed

• Dependencies refreshed across the workspace at current stable, with committed lockfiles pinned and CI refusing a stale lock (1207ab92, 8c55c6fe).
• Docs: a complete three-tier course (24 lessons), ten new source→docs coverage pages, and an AI-memory FAQ (32d464a1, e845eb94, 44458ab1).

Bug fixes

• Webhook route matching consults an explicit path list, so a template-versus-concrete path disagreement can no longer exempt or refuse the wrong requests (701a7e1e).
• Restore no longer silently drops legal holds across a backup/restore cycle (c89e8403).
• The wire contract passes its own gates again: the duplicated operation id is gone and the regenerated client schema matches (7e339cdb).

Engineering record

Everything since 1.29.2 lands here, in one release. The remediation rounds, in order: R68 “Silence” (three machine checks that under-delivered — the SQL statement counter became structural, the comment stripper became string-aware, the authz prose was made true by code); R69 “Erasure” (the DSAR erasure reaches the approved proposals behind purged memories; additive proposals.promoted_chunk_id, schema 1.32.25 → 1.32.26); R70 “Seams” (the write deadline moves inside its closure, the webhook exemption becomes an explicit list, the egress deny table normalizes IPv4-compatible embeddings, BIND_PORT fails closed); R72 “Truth” (the test-count badge derives from the build and refuses drift); R73 “Receipts” (the audit register stops disagreeing with the code); R74 “Dirty” (a green suite that does not describe the committed tree is not evidence — six suites repaired at committed HEAD); R75 “Greenlight” (the API auth posture becomes a function of the bind address); R76 “Cadence” (the alert sink verifies message freshness, the signal-gateway rate limiter is wired); R77 “Verity” (the revoke verb refuses the identity it cannot kill); R78 “Attrtwo” (the last fetch-capable attribute survivors die at the read seam); R79 “Locks” (the committed lock is the reviewed truth — --locked enforced, presage pinned to a rev); R80 “Gateway” (the bounded twin is THE production cache, PII operands off the log lanes, group/world-readable configs refused, signed clients refuse redirects); R81 “Types” (the plugin validates its own configuration boundary; the exclude posture reaches the tool path). Plus the fork lane (the Sparkle feed gate and the brain_* tool namespace, plugin 0.6.12), a workspace-wide dependency refresh with re-locked lockfiles, and the public-CI release reconciliation below.

Release pipeline: private-repo Actions were disabled on billing grounds (the 2026-10-06 law), so the release tag is now the PUBLIC CI trigger — ci.yml runs the full matrix on the tagged SHA and release.yml fail-closes publication on it; scripts/release.sh witnesses the runs and exits non-zero on a not-green verdict, and its watch cannot claim green from an empty query or a timeout. The public push URL is re-enabled; main is still never pushed to the public repo (tags-only, unchanged).

Local pre-tag gate for this release: cargo fmt --check, cargo clippy --all-targets --features bench -- -D warnings, the full cargo test --features bench suite, cargo metadata --locked (lock freshness), scripts/badges.sh --selfcheck, and scripts/docs-truth.sh. The remaining matrix lanes (feature lanes, engine crates, harness, tool gates, tier smoke, client, shell) run on the public tag matrix and fail this release closed — which is how the first cut of this tag caught two real defects the local macOS gate could not see, both fixed before the re-cut: eight delivery pins plus three neighbours passed only where the developer’s real operator key existed (the attestation fixtures now install their own key directory, so the suite no longer depends on the machine it runs on), and the signal-gateway lane needed protoc on the runner for the presage pin’s post-quantum ratchet build. Later cuts of the same tag caught four more never-ran-lane defects, all fixed in-tree: six integration binaries panicked when the private spine checkout was absent (those pins now ride the two-door rule — real where the sibling exists, a named skip on a public runner), a register pin and its findings table briefly landed split across two commits, the injection-classifier lane self-deadlocked (a non-reentrant lock taken twice, latent since v1.28.71), and the badge-count step’s plain YAML scalar folded its continuations into bash (command not found). The closing gates found two more: the docs-truth/env-truth step (the last never-executed gate in the matrix) needed ripgrep on the runner, and a Linux parity host caught the ump census fixture claiming ENV_LOCK in comments while never taking it — a real cross-test race narrower machines had hidden. This release’s tree also carries the single-flight promotion closing the two open tenth-pass egress findings (a0b72d8), two CodeQL test-surface fixes generated-key and no-secrets-in-assert-messages (e748d760), and the dependabot bumps applied on the development line (codeql-action pair, @lucide/svelte; tauri was already current). Schema 1.32.26 unchanged; no new dependency edges (the root Cargo.lock moves on its own version field only); SBOM regenerated for 1.29.3; test badge re-derived at 3164, the platform-normalized count — the OS-only sandbox families (seven seatbelt tests on macOS, two landlock tests on Linux) are excluded from the derivation in both badges.sh and the CI gate, so the badge measures the same test set on every platform.

Unreleased — fork lane (zero-conflict band)

Only fixes that cannot merge-conflict with openclaw/openclaw upstream (operator instruction). K9-01 (HIGH) and W9-02 closed; plugin bumps to 0.6.12. No upstream file touched in either repo — measured empty fork diffs on every relevant path before the work.

• K9-01: fork-owned scripts/fork/package-mac-app-gated.sh wraps upstream’s packager — a diverged tree refuses to build without an explicit fork Sparkle feed + key (an explicitly-upstream feed is refused too); clean upstream checkouts pass through. Drilled all four arms.
• W9-02: all eleven brain tools namespaced brain_* (extension-owned rename; upstream’s memory-core keeps its names). Fork lane measured 151/151 vitest + tsc clean.

Not shipped (real conflict surface, deliberately declined for now): K8-01/K8-03 (upstream-owned hot files; additive seam unproven), K9-02, D9-*, F9-02.

Unreleased — R79 “Locks”

Release notes

The committed lock is the reviewed truth; nothing may move it silently — not a CI runner, not a git branch pointer. Finding closed: S9-01 (ninth pass). No authz change, no route change, no wire change, no schema change (1.32.26 unchanged). The tools’ dependency GRAPHS move by design (that is the fix); no new dependency EDGES appear.

S9-01 — stale locks, silent re-locks, and a branch-pointed git stack

Both tools/ manifests were bumped (commit 0a1d48b9, 2026-10-04) without re-locking, so cargo metadata --locked refused on both workspaces — and every bare cargo invocation (the CI lanes, a local clippy) re-locked silently, reporting green against dependency versions nobody committed.

• Re-locked + committed, minimal resolution. channel-bridge: clap 4.6.6→4.6.7 (×3 crates), jsonwebtoken 11.0.0→11.1.0, reqwest 0.13.4→0.13.5, tokio 1.53.1→1.53.2, uuid 1.26.0→1.27.0. signal-gateway: the same class plus uuid 1.25.0→1.27.0. cargo audit advisory ID sets are identical old-lock vs new-lock — zero new advisories.
• presage + presage-store-sqlite pin rev = f74b96e0… (was branch = "main"). Upstream main had moved past the committed stack (newer libsignal-service past bb43e81); under a branch pointer, any re-lock rode the whole libsignal stack forward unreviewed. The pin holds the reviewed stack — the re-lock changed the lock’s presage source LINE and nothing else in the stack. Bumping is now an explicit act: new rev + re-lock + version bump (the package version tracks the libsignal tag) in one reviewed commit. The stack-policy comment in the manifest is rewritten to that posture.
• Both CI lanes pin resolution: channel-bridge-gate and signal-gateway-gate run clippy and test with --locked. cargo fmt cannot carry the flag (it rejects --locked; it resolves via --no-deps metadata, which is also why staleness probes must use the full form).
• The verification sweep gains lock-freshness — a full-form cargo metadata --locked lane over every TRACKED lockfile (tracked, not on-disk: fuzz/Cargo.lock is a gitignored local artifact no checkout ever sees). Local-only coverage; CI’s teeth are the --locked flags.
• Pins in tests/lock_discipline_pins.rs (manifest-vs-lock freshness, CI-lane --locked, git-deps-by-rev), red-proven on five mutants including the renamed-lane and rev≠lock arms. At the pinned rev: signal-gateway 53 passed / 0 failed; channel-bridge 39 passed / 0 failed. The round also fixed a PRE-EXISTING fmt drift in signal-gateway’s rate-limit test file (the lane’s fmt step was red at HEAD before this round touched it).
• Found at HEAD, pre-existing, fixed in passing: the comment guard (comments_never_reference_versions_plans_audit_ids) was RED on three src/ comments shipped by the two preceding rounds (audit-id labels in src/auth/policy.rs, src/gate.rs, src/handlers/mesh.rs) — neither predecessor claims a full-suite run. Labels dropped, invariant sentences kept verbatim; zero behaviour change.

Not shipped: --locked on the OTHER CI lanes (scoped to the two the register names; the sweep lane covers every tracked lockfile), any presage/libsignal bump (riding main is the defect), S9-02…S9-08/W9-04 (R80), S9-06 (R81), the fork lane, F9-02.

Unreleased — R80 “Gateway”

Release notes

The remedy that already existed in-tree becomes the one production uses, and the edge’s last law-gaps close. Findings closed: S9-02, S9-03, S9-04, S9-05, S9-08 (ninth pass). No authz/route/wire/schema change; no new dependency edges.

• S9-02: signal-gateway’s bounded recipient cache (cap 4096, oldest-quarter eviction — previously dead code) is now THE production cache; the unbounded inline HashMap and its [CACHE] Mapping / Self ACI INFO log lines are deleted. PII law on the module: no operand rides any log lane. POST /v1/cache/seed is audited at WARN with sha256 digests — loud and PII-lawful.
• S9-03: config.yaml (carries auth_token) refuses group/world bits at load — the 0600 law the other secret files already enforce.
• S9-04: BrainClient follows no redirects (Policy::none()), so signed webhook headers never re-send cross-origin (channel-bridge law mirrored).
• S9-05: valet-relay’s inbound dedup id derives from the envelope’s own platform timestamp (inboundDedupId), not time-of-forward — a retained envelope re-polled later keeps its id.
• S9-08: the main brain.db, the pre-migration VACUUM INTO backup and its marker join the 0600 family (enforce_private_mode — idempotent heal, warn-and-continue).

Pins: tests/s9_02_cache_wiring.rs (bounded-cache wiring, log-lane PII, redirect law), config 0600 refusal + anti-vacuity, cache resolve laws, relay dedup-id law, bootstrap mode law.

Not shipped: S9-06 + W9-04 (R81), the fork lane, F9-02.

Unreleased — R81 “Types”

Release notes

The plugin validates its own boundary, and the exclude posture means what its name says. Findings closed: S9-06 (was S8-05, re-routed) and W9-04 (ninth pass); carries the fork re-sync to 0.6.11. No authz/route/wire/schema change; no new dependency edges.

• S9-06: assertFieldTypes — a closed per-field census — runs first in resolveConfig: a string agents (which turned allowlists into substring matching), a string autoRecallTopK, a boolean-typed-as-string — all refuse registration with the field, the expected shape, and the got type. The host may or may not enforce the manifest’s configSchema; the plugin no longer depends on that. Disclosed posture change: unknown untrustedOrigins/captureMode enum values now refuse instead of degrading to default (a typo of “exclude” used to silently switch the posture down to label).
• W9-04: untrustedOrigins:"exclude" drops channel-captured hits from the memory_recall tool result as well as auto-inject; all-captured results return the no-memories shape (excludedByPosture). Default “label” byte-identical.
• Fork sync: the extension re-syncs 0.6.10 → 0.6.11 (scripts/sync-plugin.sh, byte-parity checked); the fork’s vitest lane is where the plugin’s pins execute (no runner exists in this repo).

Not shipped: the fork-lane remediation decisions (K9-, W9-02, K8-), F9-02.

Unreleased — R76 “Cadence”

Release notes

The two messaging edges never asked when or how often. valet-relay verified who signed an alert (HMAC, constant-time) but never asked whether the signature was still current, so a captured envelope replayed forever. signal-gateway owned a rate limiter it never called, so POST /v2/send — an outbound primitive driving the live identity’s websocket — had no request-rate control at all. One fix per edge, both red-first, both now wired to CI that actually runs them. Findings closed: S8-02, S8-04. No authz change; no route change; schema 1.32.26 unchanged; zero new dependency edges.

S8-02 — freshness at the alert sink

freshTimestamp (tools/valet-relay/relay.js) admits a webhook-timestamp only within ±300 s, and is now the second gate in verifyAlert. The constant is a mirrored law, not a chosen knob: the spec’s reference TOLERANCE_IN_SECONDS = 5 * 60, and the kernel’s own WEBHOOK_REPLAY_SECS (src/config.rs:892-896) plus WEBHOOK_TS_FUTURE_SKEW_SECS (src/webhook.rs:41-45), which enqueue_ts enforces together in one if (src/webhook.rs:267-275). No env var — this repo’s env-truth gate treats an undocumented knob as a finding.

The header parses two ways, and that is the fix rather than a nicety. The Standard Webhooks spec defines epoch seconds; the kernel’s alert sink actually sends chrono::Utc::now().to_rfc3339() (src/alert.rs:510). An epoch-only parser NaNs on every genuine envelope — a green suite over a fix that rejects all legitimate traffic. So: all-digits → epoch, otherwise RFC3339.

Id-dedup is DECLINED BY DECISION. The producer sets ts once and retries up to three times with the same delivery_id (src/alert.rs:508-535), so a receiver-side id-dedup would trade a duplicate alert for a silently lost one whenever the response was lost after the forward. The spec’s idempotency-key advice governs a receiver’s processing; this relay’s processing is a Signal send, and that must not be deduped. the same id and ts is admitted twice pins the decision so a future reader cannot “helpfully” add a Set.

18 clock-injected tests in tools/valet-relay/relay.test.js (zero dependencies, node --test), including a real end-to-end run: a loopback sink stands in for signal-cli, the relay is spawned as a child process, a fresh envelope must reach /v2/send and a replayed one must get 401 with no forward. All 18 fail against the unfixed relay; with only the freshness line mutated away, 7 fail while the MAC guarantees still pass.

CI: a new valet-relay-gate job runs node --test tools/valet-relay/ *.test.js on every push. The relay’s tests previously ran in no workflow — the other half of this finding. Testability required wrapping the bind, the poll timer and the self-test in require.main === module; behaviour when run as a process is unchanged.

S8-04 — the limiter, wired rather than deleted

The finding offered a dilemma — call the limiter from the router, or delete it. Both halves were false. It is now on the request path: apply_rate_limit (tools/signal-gateway/src/lib.rs) is a from_fn layer closing over a cloned RateLimiter (an Arc inside, so all instances share one budget), generic over router state — no AppState change, no with_state coupling.

The layering is the substance, not a detail. main.rs wraps the finished router, after .with_state(...) and after the auth match, so the limit is outermost. In the tokenless loopback posture there is no auth layer at all, so a layer placed inside create_router_with_auth would sit inside only one of its two arms and leave the unauthenticated flood unbounded exactly where the operator chose the loosest posture. A pinned e2e test proves the order over a real socket: 401s inside the budget, 429 outside it. Refusal is a bare 429 with RETRY-AFTER: 60 and an empty body — nothing request-derived in the reply or the single debug! line.

Global keying; per-IP declined by decision. The server is axum::serve( listener, app) with no ConnectInfo, and under this crate’s posture every client is 127.0.0.1 anyway, so per-IP discrimination would read as control while being an illusion; behind a proxy it collapses to one address regardless. The limiter stays generic over its key, so per-IP is a call-site change.

The module moved and lost its alibi. mod ratelimit; is gone from main.rs; the limiter is pub mod ratelimit in the lib target, so the binary and the integration tests share one definition rather than the binary compiling a private copy. The blanket #![allow(dead_code)] is gone — with the honest caveat that this does not make rustc police deadness (once pub in a lib target, every pub item is externally reachable). The structural pin is what holds the line.

The clock seam is the real find. admit_at(key, now) lets the window drain, which the old single Instant::now() call site made unrepresentable: the old suite could prove a budget fills up and never that it empties. The constants (100 / 60) are now named in the lib so prod and tests cannot drift — the values create_rate_limiter() hardcoded before, named, not chosen. remaining and reset were dropped: nothing consumed them, and an admin reset for an in-memory limiter with no admin endpoint is speculative API.

19 tests in tools/signal-gateway/tests/s8_04_rate_limit_wired.rs — behavioural, end-to-end over a real loopback socket, and structural. Red-proof: deleting the apply_rate_limit(app, line (the exact defect) fails 2 tests; making the layer never refuse fails 5. The e2e client is a hand-rolled TcpStream HTTP/1.1 GET rather than reqwest: reqwest 0.13 resolves rustls-no-provider, so Client::new() panics unless a rustls crypto provider is installed, which needs rustls as a direct dependency — a new dependency edge, refused.

Residuals, stated not absorbed. A burst of 100 still reaches Signal; the SSE long-poll on /api/v1/events draws from the same budget as /v2/send; max_sends_per_second in config.yaml is a concurrency cap (5 in-flight), not a rate limit — recorded, not renamed, since renaming a config key is a breaking config-surface change; 100/60 are not operator-tunable; and a within-window replay at the relay still fires once more (bounded: 5 minutes).

Unreleased — R75 “Greenlight”

Release notes

The tree main actually ships must pass the gates that guard it. main was red at R74’s tip on two independent jobs plus the badge drift gate — not because anything was mid-edit, but because the committed tree had carried a defect that a green local run had been hiding. Theme: a shippable tree, not an edited one. Findings closed: S8-01; registered: S8-02, S8-04. No authz change; schema 1.32.26 unchanged.

Two red jobs, and they were unrelated to each other

(1) openapi.yaml carried a duplicate operationId at HEAD. verifyClaim was bound twice — :1525 on /verify and :9163 on /workflow/claims/{id}/verify — and shell/tests/registry-contract.test.ts hard-fails on Redocly’s operation-operationId-unique rule (“Every operation must have a unique operationId”). Verified at the committed HEAD with git show HEAD:openapi.yaml, not merely in the working tree.

(2) The shell cmp gate exited 1, because shell/src/lib/api/schema.d.ts was stale against the spec. Same root cause as (1): the wire contract moved and the generated artifact and the spec were not moved with it.

(3) The badge drift gate was red at 3158 against a derived 3160. The committed README carried 3158 tests passed; the derivation said 3160.

The archaeology, and the prompt that lied about it

docs/EXECUTION_PROMPT_R70_Seams.md:323-325 states the duplicate-operationId defect was “already fixed in R69’s follow-up (verifyClaim → verifyClaimGate)” and instructs a reader who finds it still duplicated to assume “you are on a stale tree.”

It was never committed. git log -S'verifyClaimGate' -- openapi.yaml returns nothing — zero commits, ever. The prompt asserted a fix to a defect that was still live three releases later, and would have sent the next executor to re-verify their own checkout instead of fixing the file. The rename exists only in the working tree until R75.

S8-01, and the half of it the finding had right

The bind guard and auth guard are now one decision: resolve_api_auth (tools/signal-gateway/src/lib.rs:42) makes the credential a function of the address, so Ok(None) — unauthenticated serving — is reachable only on loopback. Ten behavioural tests in tools/signal-gateway/tests/s8_01_bind_coupled_auth.rs drive the production function, and a new signal-gateway-gate CI job runs them. That job exists because the crate’s tests previously ran in no workflow at all — which is precisely how “a path or import refactor could drop one without failing any test” stayed true.

Spire at ship — and the caveat that outranks it

The complete verification suite has now run and everything is green, but the figures are recorded with their sources, because a number nobody diffed against a measurement is the exact defect this round exists to remove. No count here is hand-typed. The README badge is machine-derived by scripts/badges.sh --verify-count (exit 0, OK README test-count badge matches the build (3160)), and that command — not this paragraph — is the authority for it.

cargo test --features bench → exit 0, 3 150 passed / 0 failed / 3 ignored across 48 result lines. That and the badge’s 3 160 are not a disagreement: the badge derives over the wider bench,migrate lane, so the two count different sets. cargo fmt --all -- --check exit 0; cargo clippy --all-targets --features bench -- -D warnings exit 0; cargo test --all-targets (default features) exit 0. crates/, steward-harness, channel-bridge (39 passed) and signal-gateway (35 passed = 5 lib + 20 pre-existing + 10 new) all exit 0. All seven feature lanes clippy-clean (compliance-pack, multivec, injection-classifier, neural-embed, loom, rerank-tier, otel). The spire floors printed exactly: main.rs 124≤300 · region absent · main routes 0=0 · router routes 258≥255 · crate tests 2958≥2758 · coverage rows 217≥214 · authz rows 203≥200.

Scripted gates: badges.sh --selfcheck exit 0; env-truth.sh exit 0; docs-truth.sh exit 0 with LOW=17 (pre-existing, unmoved) and 0 HIGH / 0 MED; check-doc-links.py exit 0 (405 links resolve); lipstyk-gate.sh exit 0; cargo audit --file Cargo.lock exit 0 (514 deps, 0 vulnerabilities). Shell: the openapi-typescript regeneration + cmp exit 0 with 0 bytes differ — the gate R75 was opened to fix; pnpm test 82 tests / 18 files with drift-gate.test.ts and registry-contract.test.ts both PASS; pnpm check 0 errors; tsc --noEmit clean; pnpm lint clean; pnpm build ok with CSP injected and no 'unsafe-inline'; pnpm audit --prod --audit-level high reports no known vulnerabilities.

Two lanes were NOT run, and nothing here should be read as covering them. client-gate was not run — client/ is untouched by this diff, and AGENTS.md scopes that lane to client changes. Shell E2E (pnpm test:e2e) was not run — it needs a Tauri build this environment does not provide. Both are named absences, not passes.

The caveat that outranks every green above: these were measured over the WORKING TREE, not over committed HEAD. Per R74’s own lesson, a green number measured over a dirty tree is not a property of HEAD — and this tree carries exactly the uncommitted wire and CI work this round produces. So this section records what was measured; it does not claim main is green. That claim belongs to the commit, and must be re-derived at the tagged SHA with scripts/badges.sh --verify-count.

Named residual — two stale lockfiles (PRE-EXISTING, not fixed here)

tools/channel-bridge/Cargo.lock and tools/signal-gateway/Cargo.lock are stale against their own committed Cargo.toml manifests. Measured, not inferred: channel-bridge locks tokio 1.53.1 against a manifest asking 1.53.2, clap 4.6.6 vs 4.6.7, reqwest 0.13.4 vs 0.13.5, uuid 1.26.0 vs 1.27.0, jsonwebtoken 11.0.0 vs 11.1.0; signal-gateway locks tokio 1.53.1, clap 4.6.6, reqwest 0.13.4, uuid 1.25.0 vs 1.27.0.

The consequence is measured too: cargo metadata --locked fails on both (exit 101, cannot update the lock file … because --locked was passed). And because both CI gates — channel-bridge-gate, and this round’s new signal-gateway-gate — invoke cargo without --locked, the runner silently regenerates the lockfile and reports green against versions that are not the committed tree. Reproducibility is lost with no red signal, and the new job inherits the property.

This is a pre-existing property of HEAD, not something this round introduced: no Cargo.toml and no Cargo.lock appears anywhere in this round’s diff. Deliberately NOT fixed here — re-locking is a dependency change this round avoided on purpose, and the remedy is a decision, not a patch: either re-lock and commit, or add --locked and let CI fail loudly until someone re-locks. Named residual.

What did NOT ship. Not S8-02 (valet-relay’s /alert sink verifies the HMAC correctly and never checks that ts is recent) and not S8-04 (signal-gateway/src/ratelimit.rs is a dead module, so POST /v2/send has no request-rate control) — both are registered in AUDIT.md, both unfixed. Not S8-05, which is re-routed off R71 because the defective file is in this repo (plugin/src/config.ts:234-235). Not the K8-/D8-01 fork rows (R71, a different repository) or the L8- external acts. No new dependency edge beyond the signal-gateway crate’s own, and no migration.

Unreleased — R74 “Dirty”

Release notes

A green suite that does not describe the committed tree is not evidence of anything. R74 shipped two commits (15964613, 50406b29) and no round notes at all. What they found is recorded here for the first time: six suites failed at committed HEAD, and the reason matters more than the fix — every green figure reported for R69, R70, R72 and R73 was measured over a dirty working tree. No authz change; schema 1.32.26 unchanged.

Two distinct root causes, not one

CLASS A — schema-version drift (5 suites). src/ carries 1.32.26 (R69’s proposals.promoted_chunk_id migration, src/migration.rs:3188), while five cross-round re-pins still asserted 1.32.25. Every repair is a pure literal re-pin — same assert, same operator, same operand shape — across tests/agreement_path_pins.rs, tests/clean_cycle_pins.rs, tests/per_domain_axis_pins.rs, tests/rbac_evaluation_pins.rs and tests/version_axis_pins.rs. No assertion was softened and no test was removed. The refuse-newer probe moved with the ceiling rather than being left stale: src/storage_layout.rs:786-787 probes 1.32.27 against a 1.32.26 ceiling, strictly greater, so it still exercises Greater rather than silently testing Equal — the exact failure mode its own message names.

CLASS B — a self-flagging pin (1 suite, unrelated to the schema). tests/no_engagement_name.rs scans git-TRACKED files, so it always flagged itself, on the two NAMES literals it must hold to police the vocabulary. That made the control permanently red — and worse, trained everyone to read it as pre-existing noise instead of a failure.

The second commit: a tautology, twice over

The exemption added by the first commit carried an anti-vacuity check to prove it was not a blanket pass. It could not fail.

#![allow(unused)]
fn main() {
NAMES.iter().all(|n| own.contains(n))
}

is x ∈ S with x drawn from S: own is this file and NAMES is built from literals in it, so the assertion holds for every possible value of NAMES. Proven by the decisive mutation — replacing the whole vocabulary with a token occurring nowhere in the tree left the pin fully green, policing nothing. A first rewrite failed identically: the shared matcher finds the literals on the const NAMES declaration line, so the declaration satisfied the check meant to police the declaration. What is worth checking is a use, not a declaration; the arm now requires an occurrence elsewhere in the file.

The same commit fixed a latent hang: occurrences() looped forever on an empty name, because str::find("") returns Some(0) and end == start. Unreachable behind the hand-written literal, but a function whose contract is “return the occurrences” must not be able to hang.

What did NOT ship

Not the wire change — openapi.yaml (verifyClaim → verifyClaimGate) and the regenerated shell/src/lib/api/schema.d.ts were explicitly deferred, because they are a wire-contract change and need their own decision. That deferral is what made the tree red at R74’s tip and became R75. No schema change, no new dependency edge.

Unreleased — R70 “Seams”

Release notes

The cheap enforcement wins: six seams where the machine was right for the wrong reason, or right by luck. Six audit findings, one theme — enforcement, not behaviour. Each becomes a machine-enforced invariant rather than a convention a future author can silently violate. No runtime authorization change: git diff src/authz/ is empty, no new route, no wire field, no new dependency edge, no schema change (1.32.26 unchanged).

Every §1 premise was re-measured, and two of the round’s own claims were wrong. All six §1 figures matched (raw needle 2 957, stripped 2 941, lib 2 319, 52 handler files, schema 1.32.26). The F8-03 VACUUM half is confirmed already closed by R68 (domains.rs:266 is if let Err(e) = …), so it was not re-fixed. But two other premises did not survive measurement:

• The prompt’s suggested reuse of spire_inventory::strip_rust_comments is IMPOSSIBLE and was not attempted. It is pub fn, but spire_inventory is #[cfg(test)] pub mod (src/lib.rs:346), so it does not exist in the lib an integration test links against — the cfg is the blocker, not visibility. The F8-04 pin therefore lives in tests/main_suite.rs and reuses the two existing test-side house lexers (strip_line_comments / strip_cfg_test_regions). No second src/ stripper was written; dup_guard is untouched.
• F8-09’s reachability claim was wrong in the direction that matters. The note predicted the row-mapping arm unreachable because TEXT affinity coerces every storage class. Measured against SQLite: true for INTEGER and REAL, false for BLOB. A BLOB roster_json IS reachable, so the honest behavioural pin (option 1) was available after all rather than the shape pin option 2. Had the premise been taken at face value — or the note’s suggested 42/1.5 fixtures used — the pin would have been green before the fix while proving the arm that was not changed. The pin asserts typeof(roster_json) == 'blob' as a precondition so it fails loudly if that ever stops discriminating.

Four findings shipped as specified; two had their scope widened by what the fixes actually required, and both widenings are named below rather than absorbed.

(1) The log seam is now unskippable (F8-04). sanitize_log_value had one production call site and fourteen tests, none asserting any call site uses it — a seam nothing forces through is a convention. The guard found eight request/config-derived sites before any was fixed: recall.rs {domain}, domains.rs {name}, webhooks.rs ×2 path = %…, mod.rs error = %message, observe.rs {url}, ump_ops.rs owner/declared. Three of those five files were not named by the audit — domains.rs in particular was found by the guard, not by the brief. The fix is a LogValue newtype beside the seam whose only constructor is sanitize_log_value: no From<&str>, no From<String>, no Deref, no Default, private field, each pinned because any one re-opens the hole. The scan handles both value-carrying syntaxes — {ident} placeholders AND %ident/?ident structured fields — because the webhooks.rs offender is the field form and a placeholder-only scan would have passed it; multi-line invocations are scanned whole. The remaining 31 sites are exempt by category, each justified in code; the integer-id exemption is a closed list, not a shape, because a shape rule would have exempted exactly the request-derived names.

(2) The webhook exemption is an explicit list (F8-06). path.starts_with("/webhooks/") exempted whatever landed under /webhooks/, including any future route — not a live hole (all six verify and fail closed) and precisely an unenforced convention. Replaced with WEBHOOK_PATHS, naming all six. THE REGRESSION THIS NEARLY SHIPPED: the three is_public_path call sites disagree — auth.rs:129 passes axum’s MatchedPath (the template) while :277/:549 pass req.uri().path() (the concrete path). A contains() on the template list would have exempted the template and refused every real request, silently disabling all six webhooks. is_webhook_path therefore matches segment-wise. The pin caught two fail-open bugs in the first draft: split('/') on {kind} never equals the literal "{kind}", and a stale list entry would keep exempting a path nothing serves (so both directions are checked against the router, never the list against itself).

(3) The write deadline moves inside the closure (F8-03, the surviving half). TimeoutLayer drops the handler future at 30 s, but a spawn_blocking closure is not cancellable — it runs to completion and commits, so the client sees a 408 while the row lands anyway and a retry double-commits. A check outside the closure is decorative: the work is already queued and nothing can call it back. src/service/write_deadline.rs reads the clock at the moment work starts and refuses before any statement runs, on DELETE /domains/{name} — the gate is the closure’s first statement, before pool.get(), so a refusal provably took no connection and opened no transaction. The 30 s is now config::REQUEST_TIMEOUT_SECS with WRITE_DEADLINE_MARGIN_SECS held back, so the handler and middleware cannot drift (two literals in two files is how both look right and are wrong at runtime).

(4) BIND_PORT fails closed (F8-10). .parse().unwrap_or(8765) meant a typo bound the production port with no diagnostic. Reuses the WRITE_POSTURE shape (absent = default, only present-and-invalid refuses; empty = unset), so no deployment changes behaviour. The values were measured, not assumed, with a throwaway probe since deleted: abc/65536/-1/"" all fail to parse, and 0 parses successfully — so a parse-only fix would not have closed the finding, since port 0 binds a kernel-chosen ephemeral port that changes every restart. It is refused separately, naming the hazard rather than restating the range. 876 is deliberately not a refusal: it is a valid u16 and a legitimate choice, and refusing every “surprising” number would invent policy the audit did not ask for.

(5) The egress deny table, and the ::/96 normalisation (F8-07). Two missing IANA v4 rows (224.0.0.0/4, 192.88.99.0/24) — the multicast row’s v6 twin ff00::/8 was already present, and 240/4 was present while 224/4 was not, so the hole sat in the middle of the table’s own numbering. The harder half, verified rather than assumed: to_ipv4_mapped() unwraps only ::ffff:0:0/96 (confirmed against the std source — it matches bytes 10..12 == 0xff,0xff), not the IPv4-compatible ::/96. So ::a.b.c.d reached ipv6_denied unnormalised and IPV6_DENY has no ::/96 row: ::169.254.169.254 was ADMITTED, as were ::10.0.0.1 and ::192.168.1.77 — the v4 table was fully present and simply never consulted. Normalised, not “add a row”, and the two are different guarantees: a row refuses the ::/96 block, while normalisation subjects the embedded v4 to the whole v4 table, so a row added tomorrow is inherited free and the refusal names the real reason. :: and ::1 are deliberately not embeddings.

(6) The roster sweep stops dropping rows (F8-09). .flatten() discarded every row whose r.get() failed, so an unreadable cell was silently skipped and the DSAR certified a crew_rows count that excluded it — while the adjacent corrupt-JSON arm correctly failed closed. Two failure shapes, two answers; that inconsistency is the finding. Now maps to DsarError::Database like its neighbour.

Red-proofs — all eight recorded

Every pin was proven able to fail, per §3. Two of these caught real defects in this round’s own first draft, which is the point of writing them:

Red-proof #8 is the load-bearing one: keeping the gate but moving it one line down is exactly the “machine checks under-delivered” shape, and only the ordering assertion kills it.

Spire at ship

lib 2 325 passed / 0 failed / 2 ignored (baseline 2 319, +6); full suite green, 0 failed; crates/ green; harness green; cargo fmt --check clean; clippy clean on bench, default, otel, crates/ and all six feature lanes; lipstyk-gate 0 findings; badges.sh --selfcheck clean; env-truth.sh clean; docs-truth.sh LOW=17 (pre-existing, unmoved); check-doc-links.py clean (404 links); cargo audit clean (514 deps); shell gate 82 passed / 18 files including the drift gate, tsc --noEmit clean. main.rs 124≤300, router routes 258≥255, coverage 217≥214, authz rows 203≥200. The floor was NOT raised: CRATE_TEST_FLOOR is unchanged at 2 758 (measured 2 954 stripped — headroom 183 → 196; raw 2 970). Raw and stripped moved by the same +13, so this round contributed no fixture-string inflation — the raw−stripped gap is unchanged at 16 and belongs to the baseline. Zero new dependency edges: all Cargo.lock files byte-identical; src/authz/ 0 diff; openapi.yaml and shell/src/lib/api/schema.d.ts 0 diff this round, so no regeneration was owed; src/migration.rs 0 diff; no new OPENAPI_ROUTES/PUBLIC_PATHS row (WEBHOOK_PATHS is a new const of six). R69’s no_sql_in_handlers_enforced green.

One house gate fired on this round’s own code and was fixed at the root rather than waived: comments_never_reference_versions_plans_audit_ids rejected the finding labels in fifteen source comments (“drop the label, keep the invariant sentence”). Every comment kept its reasoning; provenance moved to the commit log and this note.

What this round does NOT ship

• Not the write idempotency/receipt registry, and not the openapi ceiling note on every write route. The deadline-in-closure is the enforcement half; the receipt is a wire contract and a new table, and it is the next decision. Named residual: a write that starts within budget and is then killed mid-commit (process crash, not timeout) is still not covered — nothing in this round addresses crash-atomicity.
• Not F8-03’s VACUUM half — R68 already closed it. Not re-fixed.
• Not every DB-touching handler. The deadline lands on the named route plus the shared helper. Unreached: the ~50 other spawn_blocking write handlers in src/handlers/** (domains.rs ×5, ump.rs, workflow.rs ×5, recall.rs, observe.rs, ump_ops.rs ×2, …) still admit the abandoned-write window; the sweep is named, not silently skipped.
• Not the audit’s proposed per-route openapi ceiling annotations.
• Not K8-01…K8-07 (R71, a different repository, and K8-04 needs a decision).
• Not R8-01/02/03, S8-11, L8-01/05/06/07, P8-01, K8-15 (R72).
• Not any authz or runtime-authorization change.

Ceilings recorded, not hidden

• F8-07’s normalisation is prefix-scoped by construction. ::/96 is refused through the v4 table, but a v4-mapped-and-compatible address under a different v6 embedding scheme would still need its own row; the transition families (NAT64, 6to4, Teredo) are denied wholesale, so the practical exposure is a bespoke prefix, not a standard one.
• F8-04’s scanner cannot type-check. An identifier named like a request field is treated as one until proven otherwise; the only proof available is to route it through LogValue, which is never wrong, merely redundant.
• F8-06’s matcher is segment-wise. It admits exactly one non-empty segment per {param}; a future wildcard route (/webhooks/{*rest}) would need a rule here.
• F8-03’s window narrows; it does not close. The reserve is a fixed 5 s, so a write needing more than that refuses near the deadline rather than being attempted and abandoned.

No migration is added by R70, so there is no irreversible risk in this round.

Unreleased — R73 “Receipts”

Release notes

The register disagrees with the code. All ten F8-* dispositions in AUDIT.md still read OPEN — R68/R69/R70, naming the rounds that had already shipped them, while all ten are closed in code. The register lagged three releases: an auditor reading only AUDIT.md would have re-triaged ten fixed findings, and a new contributor would have re-fixed code that already works.

Two findings that the register could see but did not enforce are now enforced too: a filename gate that let a quote through directly above an eval, and a citation a green pin could not fail on.

No authz change, no new route, no wire change, no new dependency edge, no schema change (1.32.26 unchanged).

The register

Each F8-* row is now stamped with what the code does, verified by reading the fixing code rather than the commit subject. Six rows record where the audit was itself wrong, because that is part of the same defect:

F8-02 is recorded as PARTIALLY CLOSED, and that is the point. The prose was corrected and the self-asserting pin replaced, but the oracle still does not read required_action and both dead DenyReason arms remain. The audit offered two remedies and neither was taken, by deliberate decision on second-opinion-surface grounds. A flat CLOSED would misrepresent a declined design decision as a fix.

S8-06 — a quote in a filename, sitting above an eval

safe_filename refused traversal, separators and control characters but let a single quote through, and the web arm spliced the result raw into a.download='{safe}'. Measured: safe_filename("x';alert(1)//.json") returned Some("x';alert(1)__.json") and the emitted script carried a.download='x';alert(1)//.json'; — the quote ends the literal and the rest lands in statement position.

Both halves were latent, not live, which is worth stating rather than overstating: all three call sites pass a literal or i64-derived name, and all three bodies are serde_json re-serialisations. It is one call-site edit from live.

The quote is refused, not escaped — a name the browser cannot accept as a download attribute is not a safe one — with an anti-always-refuse pin covering the real callers. The body moved from {body:?} to serde_json::to_string, the helper client/src/panels/mod.rs already uses for this job.

Corrected mid-round. The first pin asserted U+2028/U+2029 must not appear raw, on the premise they are invalid JS string content. They are not — ES2019’s JSON-superset proposal made them legal (verified in Node v24: parses to length 3), and serde_json emits them raw. The pin was red against its own fix. The hazard that does remain is the legacy octal escape: Debug writes NUL as \0, so \05 becomes U+0005 in JS.

L8-03 — a citation a green pin could not fail on

reg_watch.rs cited recital 38 — explanatory, conferring no obligation — as the basis for the 2026-12-02 horizon. The operative provision is Article 111(4).

The reason this mattered beyond a stale comment: the pin that looked like it guarded the constant cannot fail on a miscitation. It asserts the date, the provenance surface, and two date strings in the docs — it never read the comment. Proven: reverting only the comment leaves it green. The new pin reads the file’s own source, slices the comment to the constant, and asserts the operative cite is present, the recital is not stated as granting the period, and the provenance is recorded.

Provenance labelled, not laundered: no EUR-Lex fetch is reachable from a build and Context7 carries no AI Act coverage, so the article number is recorded audit-asserted, not source-verified — in the code, in the doc, and as an assertion. Only the citation’s kind was corrected; the date was independently confirmed and is unchanged.

Two more rows corrected

• S8-09 was already closed and the audit read it backwards. The manual tag push sits inside the gh-MISSING refusal branch, followed by exit 1, and git blame shows the guard introduced it.
• S8-06’s file:line was wrong (client/src/download.rs:35, not panels/mod.rs:66 — which is the remedy pattern), and S8-01/S8-06 were routed to a round that never owned them.
• L8-02 closed as a claim: the well-known notice is an input the deployer builds the first-interaction disclosure from. No wire change — build_ai_notice keeps its seven fields, because a disclosure_timing field would not discharge the duty anyway.

A gate was itself wrong

Writing this round’s receipts introduced six new docs-truth MED findings — all for correctly prefixed citations like client/src/download.rs:35. scripts/docs-truth.py’s regex was `?src/(...): the optional backtick left no boundary before src/, so it matched the tail of client/src/…, discarded the client/ segment, and tested ROOT/src/download.rs. The diagnostic re-printed only the truncated path, which is why it looked like the citations were wrong. Fixed by requiring the backtick and capturing the whole path. Anti-vacuity: a probe doc with two genuinely non-existent paths still produces exactly two MED findings — the checker is more precise, not more permissive.

Spire at ship

lib 2 326 passed / 0 failed / 2 ignored; main_suite 339 passed / 0 failed / 1 ignored; client 245 passed; full suite green; crates/ green; harness green; cargo fmt --check clean; clippy clean on bench and client; badges.sh --selfcheck clean; env-truth.sh clean; docs-truth.sh LOW=17 (pre-existing, unmoved), MED 6 → 0; check-doc-links.py clean (405 links). Raw needle 2 974, stripped 2 958 (gap 16, unchanged). The floor was NOT raised: CRATE_TEST_FLOOR is unchanged at 2 758 (headroom 200). Zero new dependency edges: all Cargo.lock files byte-identical; src/authz/ 0 diff; openapi.yaml and shell/src/lib/api/schema.d.ts 0 diff; src/migration.rs 0 diff; schema 1.32.26.

Red-first. The S8-06 pins were proven red by reverting the production change (three of four; the pre-existing traversal test stayed green through the revert). The L8-03 pin was proven red by reverting only its comment — and the anti-vacuity control proved the finding, because the pre-existing pin stayed green on the miscitation. The register pin was proven by reverting the F8-10 row, which fires the per-id arm rather than an earlier assertion.

Four pins caught defects in this round’s own first draft: the U+2028 over-strict assertion; download_script becoming dead code on the host bin target; the register pin’s .find matching the first of seven identical table headers — with a rows.len() >= 30 floor that passed at both 73 and 38 rows, so it could not detect the very scope bug it existed to catch; and a status vocabulary with no word for K8-04, which is filed as a DECISION rather than a patch.

What this round does NOT ship

• Not the fork’s K8-01…K8-15 or D8-01 (R71); K8-04 needs a decision, not a patch.
• Not L8-05, L8-06’s refresh, or L8-07’s Aug half — all three need primary sources this environment cannot reach. Deferred, not closed.
• Not L8-04 or L8-11 — external (a deployer identity; BIS/ECFR).
• Not S8-01, S8-05, S8-07, D8-02 — genuinely open, genuinely out of this round’s theme, now re-routed with a reason.
• Not F8-02’s enforcement; the decline is recorded, not reversed.
• No migration is added, so there is no irreversible risk in this round.

Unreleased — R72 “Truth”

Release notes

A number nobody diffed against a measurement. The failure this repo’s own header documents as having occurred six times, found once more — in the gate that exists to catch it. Eight findings; three of the audit’s premises were wrong, which is the round’s first result. No authz change, no new route, no new dependency edge, no schema change (1.32.26 unchanged).

The finding that mattered: a green gate that could not fail

scripts/badges.sh --selfcheck was described as a drift guard. It was not: it grepped for the string "not selfcheck-verified" and nothing else, and the derivation function sat below the selfcheck path’s own exit 0, so the comparison was physically unreachable from that path.

Red-first, recorded. The README badge read 3 120 while the build derived 3 156. --selfcheck exited 0. A planted 999999 also passed. A control planted version drift (version-0.0.1) correctly failed — proving the exit path was live and that the missing count arm was the only defect, rather than a broken gate that fails for unrelated reasons.

Fixed by splitting the modes by cost, which is also the honest shape:

The cheap path could not carry the compare: ci.yml and verification-sweep.sh both invoke it on every push, and a gate too slow to run is the same unenforced-convention defect a second time. --verify-count is wired into ci.yml’s lint-test job; the cost is one extra full compile there, measured and stated in the step’s comment.

A second defect surfaced while fixing the first. The disclaimer arm was a whole-file grep, satisfied by a sentence 28 lines below the badge — so the badge could be arbitrarily wrong while the guard stayed green. It is now scoped to the badge’s own block, and the disclaimer was moved next to the badge it describes. Proven non-vacuous: the same bytes relocated to a distant paragraph still satisfy the old grep and now fail the guard.

The gate then caught this round’s own first re-baseline. The badge was re-pasted as 3 157 from a run in which the docs_truth badge pin was still failing, and therefore counted as failed rather than passed. Fixing it added exactly one test; the derive said 3 158 and --verify-count refused the badge. Corrected, then re-verified.

The other seven findings

• S8-11 — the lockfile claim. “All three Cargo.lock files” was false, and the audit’s replacement number (eight) is also wrong: there are 8 on disk / 7 tracked, because fuzz/Cargo.lock is gitignored. Eight is a working-tree figure a CI checkout never sees. The three historical rows now say “all tracked”.
• R8-02 — one dead reference, not two, and the audit’s stated reason was also wrong (check-doc-links.py does walk docs/; the reference was invisible because it was bare backtick text, not a ](…) link). Repointed to the private archive by prose — deliberately not a markdown link, which would newly expose it to a checker that cannot resolve a private path.
• L8-01 (HIGH) — the CT CART general duties (Oct 1 2026) had passed and were still filed under “Scheduled”. Corrected, with the scope stated in the file: the date arithmetic is provable from the repo, the statute text is not.
• L8-06 — the map’s quarterly refresh. The audit’s framing was too strong: quarterly from 2026-09-14 is not due until 2026-12-14. The map now discloses that the pass has not run and why, and the status date is deliberately not re-stamped — bumping it would claim a verification that never happened.
• L8-07 — the OWASP Agentic date reconciled to 2025-12-09 across two files, labelled a repo-internal reconciliation rather than a publisher-verified fact.
• R8-01 — the hand-typed count in AGENTS.md is gone; the line now names --verify-count and carries no number, so it cannot go stale unremarked.
• P8-01 — premise refuted: four in-repo fixture lanes, not two. client/ consumes the canonical fixture cross-tree and runs in CI. The real residual — the plugin’s lane runs in no workflow here, and cannot, because plugin/package.json has no scripts block and depends on workspace:* — is recorded as R71’s.

Spire at ship

lib 2 325 passed / 0 failed / 2 ignored (baseline 2 325, +2 — the two new pins are in main_suite); full suite green; crates/ green; harness green; cargo fmt --check clean; clippy clean on bench; badges.sh --selfcheck clean; env-truth.sh clean; docs-truth.sh LOW=17 (pre-existing, unmoved); check-doc-links.py clean (404 links); cargo audit clean across 8 lockfiles. Raw needle 2 972, stripped 2 956 (raw−stripped gap unchanged at 16). CRATE_TEST_FLOOR unchanged at 2 758. Zero new dependency edges: all Cargo.lock files byte-identical; src/authz/ 0 diff; src/migration.rs 0 diff; schema 1.32.26.

What this round does NOT ship

• Not L8-05 — the two federal EOs. Unverifiable from this environment: the EOs appear only in the register that cites them, and Context7 carries no federal EO coverage. Writing them would be an unsupported legal claim about a live instrument.
• Not L8-06’s quarterly refresh — an external act (NCSL + legislature pages).
• Not L8-07’s Aug 3/4 correction — seven repo sources carry 2026-08-04 backed by a DOI and a prior live fetch, against one unsourced audit claim.
• Not a CI job for the plugin’s fixture lane — workspace:* cannot resolve outside the openclaw workspace. That lane is R71’s.
• Not L8-02 (re-scoped out of this round) and not S8-09 (open; the release gate’s documentary manual-tag escape is a separate decision).
• No authz or runtime-authorization change. No migration. No irreversible risk in this round.

Unreleased — R69 “Erasure”

Release notes

A compliance certificate can certify an erasure that did not happen. The DSAR erasure now reaches the approved proposals behind the memories it deletes.

F8-08 (HIGH, drill-proven) from docs/audit8/. The hazard was named in the code that failed to close it: the erasure’s only reach into proposals was DELETE … WHERE content LIKE '%subject%', and a proposal’s text almost never contains its owner’s identity, so the approved proposal’s full plaintext (possibly PII about the subject) survived a certificate reading completed.

The §9.3 plan’s prescribed fix was IMPOSSIBLE as written, and the tree won. The plan said “carry the approved chunk ids the erasure just deleted and delete their proposals by id IN (…) — the proposal that produced a memory is reachable from the memory”. Reproduced by hand at 1c00c83a, no such id exists: knowledge carries no proposal ref (base CREATE TABLE plus every ALTER TABLE knowledge ADD COLUMN); neither promote_chunk_insert nor kcs_draft_insert binds one; cas_proposal_approved records none; there is no linking table; and the two tables share no hash column (proposals has no content_hash). Option (a), the audit chain, was measured closed first: audit_events stores only SHA-256 digests and a hash is not reversible.

Fixed

• proposals.promoted_chunk_id INTEGER (schema 1.32.25 → 1.32.26): one additive, NULLable, pragma_table_info-guarded column — the proposal→chunk correspondence is now recorded where it is created, at approve time. knowledge gains nothing, so every FK-children map of the knowledge parent delete stays accurate. NULL means the approval promoted nothing.
• record_promoted_chunk writes the edge beside the shared decision CAS, as a SEPARATE write rather than a new CAS parameter: cas_proposal_approved has seven call sites and four of them promote nothing, so a NULL edge is the correct recorded state there. Wired into the two arms that actually create a memory — the generic promote, and the KCS draft (which deliberately records no edge for KIND_LINK_ONLY, which reuses an existing article).
• purge_promoted_proposals erases those proposals by id, inside the caller’s transaction, after the knowledge purge so it walks the chunks genuinely deleted. A failure rolls the proposals delete back with the memory delete and the ledger row: no certificate is ever issued over a partial erasure. The content LIKE arm is kept, not replaced — removing it would reduce coverage for subjects whose text genuinely appears in a proposal.
• The IN-list is chunked at 900, below a measured ceiling: this crate’s bundled SQLite prepares 32,766 bound parameters and refuses 32,767 with “too many SQL variables” (measured, then deleted the probe). An unbounded id IN (…) against a large purge would fail the erasure at the worst possible moment.
• Red-first, and red twice. The §3 pin failed before the fix (left: 1, right: 0 — the proposal still present), and the red-proof was re-run on the finished fixture by disabling the arm, which failed identically.
• Six further tests, each proven able to fail (§4.4): regression, positive (the content LIKE arm survives), two negatives, chunking, idempotence, and atomicity (a poisoned trigger proves both halves roll back and no ledger row is written). Four mutants were planted and all four were killed — wrong column, chunking removed, swallowed delete error, arm disabled. Two of the tests could not fail under the first mutant run and were rewritten: their fixtures did not collide ids, so an arm keyed on the wrong column passed them. Deleted-and-redone is the honest outcome, not deleted.

Ceilings recorded, not hidden

• The migration is this round’s one irreversible change. Additive and NULLable, so a revert leaves the column orphaned (harmless — NULL means “no recorded edge”) and touches no existing column’s value. Schema 1.32.26; the refuse-newer probe moved to 1.32.27, and the seven coupled ceiling pins moved with it, each naming the round that moved it.
• Historical approved proposals keep a NULL edge and are NOT retro-linked. A proposal approved before this release promoted a memory that may be purged tomorrow, and the correspondence was never stored — so the erasure reaches it only if the subject’s string appears in its body. This is the largest residual and it is not backfilled: inferring the edge from content would be the substring match the round exists to stop trusting.
• No certificate wire field. The count is reported via tracing, not added to the certificate JSON — shell/src/lib/api/schema.d.ts is already stale against openapi.yaml (§6.1), and a certificate field nothing consumes is a field no one verifies.
• audit_events still cannot answer this. The edge is on the row, not the chain; a future proposal-erasure surface that wanted the chain to carry it would need a different design.

What this round does NOT ship

• Not the §9.3 fix as specified — it is impossible (§0 of the prompt, six measurements). The substitution and its reason are recorded above.
• Not F8-09, F8-03/04/06/07/10 (R70); not K8-* (R71, the openclaw fork repo); not R8-01/02/03, S8-11, L8-01/05/06/07, P8-01, K8-15 (R72).
• Not any authz or runtime-authorization change: git diff src/authz/ is empty.
• Not an owner column on proposals — declined by the audit, and the correspondence belongs on the proposal→chunk edge.

Validation. Lib 2 319 passed / 0 failed / 2 ignored (baseline 2 310, +9 new #[test]); main_suite 329; crates/ 308; harness 44; default-features all-targets 3 144; clippy clean on bench, default, otel, crates/, and all six feature lanes; cargo fmt --check clean; lipstyk 0 findings; badges.sh --selfcheck clean; env-truth.sh clean; docs-truth.sh LOW=17 (pre-existing, unchanged); check-doc-links.py clean (404 links); cargo audit clean over 514 dependencies; shell 82/82 across 18 files. Zero new dependency edges — all Cargo.lock files byte-identical; route_guards.rs and src/authz/ diff-empty; CRATE_TEST_FLOOR unchanged at 2 758 (measured 2 941 stripped, headroom 137 → 183). R68’s no_sql_in_handlers_enforced still green. After the three gap fixes the whole suite is green: 3 133 passed / 0 failed, and three consecutive full-lib runs were clean.**

Known pre-existing, NOT fixed here. tests/no_engagement_name.rs fails — re-verified at the baseline this round by stashing the whole diff and re-running it there, where it fails identically. It is the only red in the suite and it is not R69’s. One intermittent flake surfaced during validation and is not R69’s either: handlers::webhooks::inbound_signal_becomes_screened_ steering sets a process-global env var (BRAIN_SIGNAL_WEBHOOK_SECRET_FILE) without taking an env lock, so it raced once and passed on three subsequent full-suite runs; R69’s diff does not touch that file.

Follow-up, shipped in the same line — three gaps closed. (1) The suite’s only red was not a leak. tests/no_engagement_name.rs scans git-TRACKED files and was flagging itself, on the two NAMES literals it must hold to police the vocabulary. The control could never pass, which made it permanently unreadable as “pre-existing noise” — the same failure mode this programme keeps naming. Fixed by naming the pin’s own file in ALLOWED_FILES (a listed exception, never a blanket skip) plus an anti-vacuity assertion that fails if the vocabulary ever leaves the file, so the exemption cannot rot into a silent pass. Proven non-vacuous: planting the name in src/storage_layout.rs fails it. (2) The intermittent flake is closed by a fence, and the fence is proven the only way: the natural race fired ~1 run in several, which is not evidence, so two deterministic red-proof tests were added. Measured 20/20 green with the fence and 20/20 red with it bypassed, and the bypassed mutant still passes the original signal test. It is a tokio::sync::Mutex, not std::sync::Mutex, because the guard is held across .await (clippy’s await_holding_lock correctly refuses the std form) — and it is non-reentrant and FIFO, which an early version learned the hard way by acquiring it twice and deadlocking. (3) shell/src/lib/api/schema.d.ts drift is closed, and it was hiding a real openapi.yaml defect. The gate’s failure was a broken local pnpm shim pointing at a deleted version directory, so the gate had been failing for the WRONG reason and never compared a byte. With a working pnpm it found 9 lines of genuine drift from two earlier rounds, and behind that a duplicate operationId: verifyClaim shared by POST /verify and POST /workflow/claims/{id}/verify — which made openapi-typescript refuse the whole contract and broke registry-contract.test.ts outright. Fixed at the source: the duplicate renamed to verifyClaimGate (the later, narrower claims route, matching its sibling promoteClaim; no consumer referenced the name, and the typed client keys by PATH not operationId), then schema.d.ts regenerated and the gate red-proofed (mutating the committed file fails it, restoring passes). This is the one openapi.yaml change in this line and it is disclosed, not incidental — it is a contract-hygiene fix, not a route change; no route, guard-table row, or wire field was added.

§0 note — the prompt’s baseline was stale and was re-verified rather than carried. The prompt pins schema 1.32.24; measured at 1c00c83a it is 1.32.25 (the model-citation-key round moved it after the prompt was written). Every §1 figure was re-measured and all matched: floors 2 758 / 255 / 214 / 200, 52 handler files, 8 router files, stripped needle 2 934, raw needle 2 954. The prompt’s is_newer_than_known(Some("1.32.26")) probe was likewise already in the tree, i.e. the prompt was written against the 1.32.24 ceiling and the tree had moved twice.

Unreleased — R68 “Silence”

Release notes

The machine checks under-delivered. Three guards/pins passed while their subject was violated, or asserted a property they could not fail.

F8-01 (HIGH), F8-02 (HIGH), F8-05 (MEDIUM) from docs/audit8/. No runtime authorization behaviour changes — the authz half is prose and pins only, and src/authz/policy.rs is diff-empty.

Fixed

• no_sql_in_handlers_enforced now runs a second, STRUCTURAL counter. The keyword counter recognised exactly four statement openers (select / insert / update / delete … from) and was blind to PRAGMA, VACUUM, BEGIN/COMMIT/ROLLBACK, REPLACE INTO, and the entire rusqlite method surface — while ten production violations were live under src/handlers/ and the guard reported ok. The new counter matches CALL SHAPES (Connection::open(, .execute_batch(, .query_row(, …), which is what makes it see those shapes without false-firing on h.update( / policy.insert(. A keyword extension would have false-fired 15 times per run (measured) — the wrong instrument.
• All ten sites migrated into service cores: the per-domain census open (domains_admin::file_domain_counts_at), the post-delete VACUUM — which also stops discarding its error with let _ =, forbidden by the fail-closed law — the UMP consent-denial audit open (ump_ops:: record_forbidden_scope_at_db), the snapshot probe (new core), and shifts’ hand-rolled transaction.
• shifts transaction: three defects closed at once. The hand-rolled BEGIN IMMEDIATE / COMMIT / ROLLBACK became the RAII WorkflowTx, which discards the ROLLBACK error, returns an open transaction to the pool when a panic unwinds past the rollback, and bypasses note_busy_error contention telemetry.
• The snapshot probe now opens READ-ONLY. Connection::open does not set SQLITE_OPEN_READ_ONLY, so a surface whose own doc comment said “Read-only — it never creates or mutates a snapshot” was opening every .bak read-write. It is now SQLITE_OPEN_READ_ONLY | SQLITE_OPEN_URI, and a probe can no longer alter the evidence it reports on. Measured: the PRAGMA integrity_check works on the read-only handle, so the rollback contingency in the round’s §9 was not needed.
• CRATE_TEST_FLOOR is no longer gameable. Ten #[test] written inside a doc comment satisfied the floor; the needle now strips comments first. Red-proof: a planted 10-attribute doc comment moved the raw needle by +11 and the stripped needle by +0. The floor is NOT re-baselined (still 2 758) — 137 units of real headroom survived, so raising it would have spent the guard’s budget on a measurement.
• The authz middleware’s prose is now true. It claimed three enforced properties; two were unreachable in production (the agent-class arm was deliberately removed — see policy.rs:205-220; the deny-only capability arm is dead because the sole production constructor hardcodes required_capability: ""). The opposite-direction overclaim is corrected too: the authz matrix pins handler-side agreement, it does not make the oracle enforce the action.
• The self-asserting authz pin is replaced. r47_gate_rows_read_their_ declared_action used gate_for as its own oracle, so it proved the action column survives the parse and could not fail if enforcement was never wired. It now reads its expectation from the AUTHZ_GATES table literal.

Ceilings recorded, not hidden

• DenyReason::MethodNotPermitted and CapabilityDenyOnly are unreachable in production (gates.rs:163 MethodPolicy::Any, :167 required_capability: ""). They are now machine-pinned as ceilings: a future constructor that populates either field fails a pin, so the note cannot go stale silently.
• /ops/authz/explain reports required_action next to a verdict the action never influenced. The endpoint does not disclose this. Deferred — the shell’s schema.d.ts is already stale against openapi.yaml, and touching the contract now would entangle two unrelated drifts.
• #[cfg(test)] handler regions are exempt from the structural counter only. Test fixtures legitimately open in-memory databases and there is no shared test-DB helper in src/ to migrate them to (measured: pub test_db / test_conn return zero matches), so that migration is a design decision, not a mechanical move. Test regions remain held to the keyword counter.
• The comment stripper removes COMMENTS, not string contents: a #[test] inside a string literal still counts. The round’s own fixture pins carry those literals, which is why the measured count rose +39 while only 10 real test attributes were added — a ceiling, disclosed rather than absorbed by re-baselining.

Not shipped: the /ops/authz/explain disclosure field; end-to-end pins for the two unreachable deny reasons; ROUTER_SITES_FLOOR hardening; the 16 cfg(test) handler sites; any change to runtime authorization; F8-08 (erasure, the highest-severity item still open); F8-03/04/06/07/09/10; K8-; R8-01/02/03, S8-11, L8-, P8-01, K8-15.

Pre-existing, not fixed here: tests/no_engagement_name.rs fails at the baseline commit — proven by running it in a pristine worktree of d11326c5, where it fails identically. shell/src/lib/api/schema.d.ts is stale against openapi.yaml (drift gate already red before this round).

Unreleased — R50 “Create”

Release notes

The first loop that authors knowledge — shipped inert.

Five phase cores, a typed claim record, a four-trigger database fence, and six routes. No claim reaches durable state. The promotion route exists, is authorized, is audited, and returns promotion_disabled in every configuration for every actor. The switch is a compile-time constant with no environment variable and no flag behind it, because the decision to enable promotion belongs to a named owner against a published measurement, not to a runtime preference.

Added

• claim_schemas — a human-authored slot schema. Only a human principal may write one and a self-authored schema is refused at admission, not warned about. The stored author string is mapped from the typed principal kind inside the service core, so no request body can name its own author.
• claims — a typed tuple against a ratified schema, so a free-text proposal cannot mint one. Carries a pre-computed digest of its own public id, because SQLite cannot hash a column and the fence needs a real predicate.
• claim_evidence — byte-range citations, resolved over admitted bytes by the workspace evidence crate and never by a live substring match.
• claim_batches — the set-level verdict that withholds a whole ratified batch’s recall visibility.
• The gate (src/workflow/create/verify.rs) — six deterministic checks in a fixed order, each a pure function over rows: shape, bounds, referential, citation resolvability, contradiction, premise discipline. No model, no score, no threshold, no judgement tie-break. Repairs additionally require an independent-support floor, because the agent that notices an error fixes it wrongly more often than it fixes it right.
• The corpus — twelve planted adversarial claims as compiled data, each naming its attack class and the control that stops it. Two of the twelve target cleanup of what already landed rather than admission, because the residue operators leave behind is a separate failure surface and a corpus that only tested entry would have called itself complete.
• Six routes — /workflow/claim-schemas, /workflow/claims (POST and the gated GET), /workflow/claims/{id}, .../verify, .../promote.
• docs/create-loop.md — the operator record, including the four things the loop does not claim.

The four non-claims, stated in the docs in those words

1. The out-of-sample false-promotion rate is not yet measured. No long-run figure has been published for a deterministic gate by anyone.
2. The promotion route is disabled, in every configuration.
3. Gap generation has no reliable published detection method — the loop generates rather than detects because the techniques that exist are unsafe as detectors.
4. The set-level control has no published prior art and is a declared approximation: it catches declared predicate interactions and not arbitrary semantic composition.

The database fence, and its stated ceiling

Recall visibility is protected by four BEFORE UPDATE triggers in the schema, not by an application guard — a guard sits behind the same API the model talks to, so a socially-engineered write walks past it. The fence keys on application-set strings, so it defends a compromised model path and not host compromise: that is the same boundary this repository already draws for the audit chain, where the signing key and the verification pin share the host.

Schema

• Additive only, stamp 1.32.19: four new tables. No column dropped, no table rebuilt — a rebuild is the one operation that can lose rows under a crash. The gated read model is a query, never a view, and a standing pin keeps it that way.

Dependencies

• One new WORKSPACE PATH edge — the workspace evidence crate, which the gate calls and does not reimplement. Zero new registry edges: the lockfile block carries neither a source nor a checksum, so cargo audit over the root lockfile sees exactly what it saw before. This edge was previously forbidden by a shipped pin whose own message named this round as the one to add it; the pin is amended rather than deleted, and a registry edge is still refused. jsonschema and schemars remain declined: the schema is typed Rust plus SQL CHECK constraints, because a JSON Schema document is a syntax contract and cannot express the disjointness the contradiction arithmetic depends on.

Unreleased — R48 “Cleancycle”

Release notes

Security fixes

• The server now refuses to start on a volume that cannot do write-ahead logging. PRAGMA journal_mode=WAL does not fail when it cannot be applied — SQLite returns the prior mode and the statement succeeds — and the pragma was issued inside an execute_batch that reports success in exactly that case. The only assertion on the mode in the whole tree lived inside a test module, so a test proved the code worked and nothing made the server refuse anything. A site on a network filesystem would have booted, run, and silently downgraded the durability that brain standby and brain shred are both built around. The boot now reads the mode back and refuses, naming the cause and the remedy.
• New Linux install path, hardened to match the measured Compose posture: a systemd unit (NoNewPrivileges, PrivateTmp, ProtectSystem=strict with one ReadWritePaths, all capabilities dropped and none added back), install.sh that refuses to overwrite an existing store, uninstall.sh that never removes the data, and a morning clean-cycle-check.sh.
• The morning check verifies before serving — integrity_check, the audit chain, and whether the last shutdown was clean — so a killed process is reported at 08:00 rather than discovered three weeks later.
• The stop is surgical. A pkill -f '<db path>' matches nothing, because BRAIN_DB_PATH lives in the environment and not in argv; the reference install shipped exactly that bug and reported a clean stop while the process kept running. install.sh matches an absolute binary path.
• brain standby ship runs exactly one cycle and exits with its status. standby start is an infinite loop that returns only after three consecutive failures, so nothing scheduled could run it.

Corrections to the record

• Both published baseline timings were artifacts of the measuring scripts: a “12.1 s” stop was a fixed sleep 12 in the measuring script, and a “1,056 ms” boot came from a sleep 1 poll loop. Re-measured: 31–65 ms stop, 344–349 ms boot, and a wal_checkpoint(TRUNCATE) of 0.2 ms on a 14 MB store. The state fingerprint was byte-identical throughout; only the timings were wrong.
• The severity beneath them was also wrong: a truncated shutdown checkpoint does not lose rows (SQLite replays the WAL on the next open). It costs recovery latency and WAL growth.

Disclosed non-claims

• The clean-cycle drill proves the clean path. A power cut is a different event, covered today only by the clean-shutdown stamp. Nothing pulled a plug.
• The systemd unit was never started under systemd on the drill host.
• Split-brain protection is deferred — the lease is designed, not built. Do not run two active instances.
• No Helm chart. The earlier one used a primitive Kubernetes’ own docs document as a failure mode; the corrected shape is recorded in docs/deployment-reference-architecture.md.
• No compliance claim. The runbooks state what the code does and what RA 10173 says; scope is for an assessor and, in the Philippines, for counsel.

Unreleased — R47 “Ledgerhead”

Release notes

Security fixes

• The route gate table is now a runtime policy, not a test fixture. A new authz module ships a closed, deterministic, pure (Principal?, Gate, Method) -> Verdict oracle (Allow / Defer(reason) / Deny(reason)) and a route_layer middleware that runs it on every matched, non-exempt route. The concrete win is coverage: a matched, non-public route with no row in the AUTHZ_GATES table is now refused (route_ungated) by the running server, where before it was only a test assertion. The middleware is unconditional — no flag, no env var, no feature — and is applied as a route_layer so unmatched paths keep their probe-blind 404s.
• Every refusal writes one hash-chained audit_events row carrying the closed reason, the method, the matched route pattern, the mask_sub-hashed subject and the tenant. The row never records what another principal could have done.
• GET /ops/authz/explain?route=&method= (Admin on global) returns the caller’s OWN verdict and reason. It deliberately refuses a ?roles= set (400 authz_explain_role_set_refused) — it will never answer “what would another role get” — and answers a probe-blind 404 for an ungated route. The Admin gate is consulted before any query validation, so the surface is not a probe.
• BRAIN_RBAC_ROLELESS_POSTURE (pass | deny, default pass) selects how a principal with an EMPTY roles claim is treated. Unknown values refuse boot; the resolved value is printed at boot and echoed on explain. The middleware itself has no off switch.

Corrections to the record (found and measured, not assumed)

• CAN_ACTIONS does name workflow, and the shipped workflow-operator preset grants exactly can:["workflow"]. Two in-tree comments claimed otherwise; both are corrected. The agent remains refused on the workflow surfaces — for the correct reason: the agent’s own preset role holds can:["read","write","reject"].
• The route_guards module doc claimed the module was “compiled nowhere outside test builds”. It is production data and always has been (pub at server/router/mod.rs, consumed by both auth middlewares). The claim is removed, because a comment that lies about where code is compiled is a wire-adjacent defect.
• A live authorization defect, found and NOT fixed by this round: the KCS publish gate calls authorize_role(.., "publish"), but publish is not in CAN_ACTIONS and role::validate rejects it, so no role row can hold it. KCS article publication is therefore impossible for every role-bearing principal, including the admin preset; only role-less JWT principals and the unconfigured superuser can publish. The fix is minting publish into CAN_ACTIONS, which this round’s frozen-vocabulary rule forbids. The capability is declared in a named DENY_ONLY_CAPABILITIES class and the premise is pinned so it cannot drift silently.

Disclosed non-claims

• The middleware enforces the ROUTE COVERAGE property, the deny-only capability class, and the public/exempt deferrals. It does not enforce the per-route role CAPABILITY or the scope ACTION: the capability cannot move to a (path, method) layer because the publish gate is conditional on a request body field, and the action already agrees with the handlers by construction. The handlers’ own authorize / authorize_role remain the inner gate.
• The agent principal class is refused by the handlers, not by this middleware: measured against the authz matrix, /reindex is an Admin row yet the agent receives a 200 soft-deny, so the agent’s per-route posture is not derivable from the action column and reproducing it here would be a second source of truth.
• This is not an ACL engine and not tenant isolation. tenant_id is audit-scoping and DSAR partitioning; no row-level isolation exists.

Wire

• One additive route: GET /ops/authz/explain. openapi.yaml + OPENAPI_ROUTES + AUTHZ_GATES + all four spire floors move in one commit. No new table, no schema stamp, no migration, no new dependency edge (root [dependencies] still exactly 51; Cargo.lock byte-identical).

Unreleased — R45-0 “Correction”

Release notes

Security fixes

• The audit chain’s mechanism is now described accurately wherever it is published. We previously described it as an Ed25519-signed hash-chained audit; that was two layers described as one. The chain is a keyed HMAC-SHA256 hash chain — chain_link is SHA-256 over five pipe-delimited fields in the legacy epoch, and HMAC-SHA256 over eight length-prefixed fields once keyed. Ed25519 signs other artifacts — standby manifests, parcels, provenance marks — at the boundaries; the audit chain is never signed per row. The signing key for the chain is not stored with the record, so an attacker with database access who rewrites history still cannot forge a valid chain. This round changes what we SAY; no verdict, key, epoch, check, or audit row changes (the chain module is byte-untouched and pinned as such).

Engineering record

• Two preregistered measurements: the real audit-append rate (the “crypto is a small share of append cost” figure was an estimate from primitive costs and is now retired in favour of a measured rate), and a false-positive-rate benchmark over a 500+ row benign corpus with a one-sided Clopper-Pearson upper bound at 95%, reported per surface and never blended.
• New brain bench audit-append subcommand (bench-gated, off by default).
• Zero new dependency edges; the Clopper-Pearson bound is hand-rolled from f64::ln_gamma and the regularized incomplete beta.

Release-notes convention (v1.21.0+): every section splits into ### Release notes (written for USERS — Bug fixes / Improvements / Security fixes, marked “None” when a category is empty) followed by ### Engineering record (the milestone detail, validation counts, honest ceilings). The release workflow publishes ONLY the ### Release notes block as the GitHub release body (older sections fall back to the intro paragraph) and strips internal references (implementation plans, agent history) before publishing.

Honesty note: retrieval-quality claims below describe what the code does, not measured parity against external engines (e.g. QMD). Where a benchmark has not been run, it is marked pending rather than asserted.

[Unreleased] — 2026-09-28 — “Operate”: the derived delivery read model, and the delivery line’s close

Release notes

Improvements

• GET /workflow/delivery/outcomes?domain=&window= serves the derived delivery read model: throughput and instability as ONE coupled cluster over the domain’s own audited release rows and authority-fact findings, computed read-time only — no table, no schema stamp, no writer, no egress. The window is days, default 30, bounded 1..=366 and validated in the core (out of bounds is a 400, never a silent clamp); the derivation is deterministic for (window, now). Every metric carries a typed state — computed with a value, or insufficient with a closed reason — so an absent metric is never rendered 0 and a zero is never rendered absent.
• Where DORA (DevOps Research and Assessment) names are used at all, the readings carry dora_name + definition_match: proxy + a one-line definition note; the native measures (approval_to_promotion_elapsed, governed_release_cadence) are named natively and never presented as DORA change lead time. Metrics vocabulary only; no thresholds, tables, figures, or performance bands are reproduced anywhere, and the run’s OWN history (own_baseline, a fixed 90-day window) is the only baseline the response carries.

Engineering record

• The line’s closing round: the delivery line R37→R44 is complete — the pure crate → the run substrate → the engine wiring → the attestation chain → replay-verify → the authority bindings + connectors → releases + promote + the /due crank → the derived read model. Every zero-consumer substrate the line shipped now holds its reader.
• The change-fail filter law: the signal is the authority contradiction the reconcile writes — a findings row with the CLOSED source vocabulary (source LIKE 'delivery:%') narrowed by the typed confidence column (0.0 is the mismatch arm; the match arm writes 1.0). The claim text is never read: findings.claim is free text, and matching it would be a forged metric. The measured substrate stores the evidence kind as a claim prefix only (no kind column, and the contradictions table carries no source or kind at all), so the typed confidence column is the structured discriminator within the closed family. The denominator is the window’s promoted releases (deployed_at in-window); a contradiction on a run whose release is not promoted in-window is out of the denominator.
• The change-lead-time honesty branch: commit-anchored change lead time computes only when the release’s commit_sha joins to a recorded vcs commit-time fact (a typed-evidence row whose machine-written evidence slot carries commit_time=, bound to the revision when both name one). No production writer records such a fact today — the adapters fetch facts at call time and persist only claims — so the LIVE branch is insufficient (no_vcs_revision_recorded), the honest answer; the computed branch is implemented and unit-proven over a seeded fact, so the metric is correct the day the facts exist. No timestamp is approximated.
• Always-honest metrics: failed_deployment_recovery_time and deployment_rework_rate declare insufficient with their reasons always — the two-authority (vcs, ci) surface carries no incident or rework facts.
• The baseline renders the same typed metric objects as the cluster (an empty baseline is insufficient_history, never a bare number): the plan’s illustrative JSON shows the populated happy path with bare numbers, which cannot express insufficiency; the typed contract governs.
• Floors re-measured, never inherited: router routes 247→248, crate tests 2276→2301, coverage rows 207→208, authz rows 192→193. The route census widened to nine reads (the registration census to seventeen) in the same commit as the route.
• The authz matrix drives the outcomes route through all seven principal classes with the required-domain arm; the route is listed in ROLE_GATED_FOR_AGENT (domain-scoped, so the agent cell really reaches it) and deliberately NOT in PRE_GATE_404 — there is no id to resolve; the domain gate answers first.
• Observed while wiring (pre-existing at the round’s open, disclosed, not fixed here): openapi.yaml carries a duplicated /webhooks/delivery/{kind}: path key (landed with the release round’s openapi edit). Harmless to the string-based gates, but it is a real defect in that file for a future correction to remove.
• Honest ceilings: the metrics are first-moment statistics over a moving ledger — nothing is persisted, so a historical rate changes when the authority facts arrive late; the change-fail signal is only as complete as the inbound observations (a pipeline that never reconciles looks perfectly compliant); the baseline window is fixed at 90 days by design.

[Unreleased] — 2026-09-28 — “Releases”: the governed release, the approval binding, and the /due crank

Release notes

Improvements

• POST /workflow/delivery/releases files a governed release: the machine’s proposal to move ONE artifact toward ONE external authority. The kernel names everything that binds — the artifact digest is derived from the run’s own typed-artifact bytes and the authority binding is resolved from the run’s own domain — while the request names only the run, the target kind, the governed ref, the OTel environment, and, honestly optionally, the OTel revision (vcs.repository.ref.revision is Release Candidate — cited by name, never claimed stable).
• POST /workflow/delivery/releases/{id}/approve records the approval as COLUMNS on the release row (no sixth table), bound THREE-WAY: content digest, authority digest, and the run’s state revision at approval. The expiry is measured from approved_at and is evaluated inside the promote transaction.
• POST /workflow/delivery/releases/{id}/promote re-verifies everything inside one transaction — the signature chain, the live digest, the authority (drift is a 409), the revision, the approver’s principal, the tier agreement — then hands the pure crate’s total gate the decision, deny-wins, first reason reported. A permitted promotion walks the crate’s one-step-at-a-time transition law, lands promoted, and mints the dispatch intents. Promotion IS the outbox write; nothing here touches the network.
• POST /workflow/delivery/due is the crank: request-scoped, a bounded batch that drains, every intent re-verified before any network contact, each row marked delivered only on connector success, remaining reported and audited.
• The run read census completes the DO’s unassigned surface: the domain’s releases and delivery runs (keyset-paginated), and the two id-scoped reads (head, steps), all Read-scoped, probe-blind, and bounded.
• The phase gate’s prompt disposition now writes a bounded, screened pending question the /answer route consumes — the AskHuman seam is exercisable by route for the first time, and a second prompt while a question is pending is a typed 409.

Security fixes

• The promotion family is the first route family whose writes leave the host: the agent preset is refused EXPLICITLY in the handlers, before any work (agents hold write:*, so the role gate alone would admit them). The route-guards comment that claimed such a refusal already existed — it did not — is corrected in the same commit.
• Budgets are enforced at PROMOTION TIME, inside the promote transaction, and fail closed: every enforced budget kind needs explicit, unexhausted headroom, a ledger is built from the operator’s stored rows and never from a default (a default grants nothing), and blast_radius is never enforced (crate law). The hostcall seam the design named is a 30 s wall clock the delivery loop never touches; the re-scope is a measured correction, recorded here.
• An approval that binds content but not the AUTHORITY is replayable against a different external system, and one that binds both but not the REVISION is replayable across a later phase pass; the approval is therefore bound to all three, re-verified inside the promote transaction, with drift failing closed.
• A crash between commit and send can never double-release: promotion IS the outbox write (durable, UNIQUE-keyed intents), and the crank’s dispatch is a read through the pinned exact-host path, marked delivered only on connector success.
• The ledger’s belief moves only when the inbound authority observation reconciles: the reconcile path records verified_at on a match (promoted → verified via the crate’s transition law); the crank never writes it.

Bug fixes

• resolve_binding selects delivery_bindings.secret_file_name, but the bindings batch never created the column and the provisioner never wrote it — the resolver’s first real caller arrives with this round and caught it. The column now ships in the batch (fresh builds), rides a guarded ALTER (existing databases), and the provisioner writes it.

Engineering record

Schema 1.32.17 → 1.32.18. New table delivery_releases (nine-value status CHECK — the pure crate’s ReleaseStatus vocabulary, which does not fit delivery_traces’ trace-vocabulary CHECK; approval columns; the OTel revision/environment columns). PARITY_TABLES and the expected-table census moved with it in the same commit; the refuse-newer probe moved to 1.32.19 so it keeps testing Greater.

The chain writer now carries the run’s admission policy into every signed link — the field existed for exactly the comparison the promotion gate makes. A run admitted under no policy still refuses, fail-closed.

The pin asserting the intents were “demonstrably undispatchable” is re-scoped to its positive successor, in the same commit as the code that breaks it: an intent leaves pending only through a promotion that minted it, and the drain re-verifies before any network contact. The route census pins are re-scoped the same way (eight writes, eight reads). The comment guard’s law held: zero round labels in src/ production comments.

Honest ceilings.

• An already-granted approval is not independently revokable this round: the mitigations are the expiry window (measured from approved_at), the principal kill-switch checked inside the promote transaction, and the three-way digest binding. A revocation mechanism for the ARTIFACT itself is a new decision, not an omission silently inherited.
• The DSAR sweep gains no delivery arm: approval evidence is the authorization artifact, not an identity record, and pruning it would unexplain a promotion. Widening the sweep is a new decision.
• Promotion audit rows ride AuditKind::Workflow in audit_events, and the audit-retention prune is kind-blind: promotion evidence ages exactly like every other audit row, per the operator’s BRAIN_AUDIT_RETENTION_DAYS. The durable lifecycle record is the release row itself, which no retention pass touches, so a pruned promotion is still explained by its row.
• Step-up/re-authentication is ABSENT: the digest-in-hand pattern is co-presence, not freshness. The approval’s freshness law is the expiry window, named here rather than overstated.
• The crank’s dispatch is a READ through the pinned adapter path (the only egress the tree has); the external state change is made by the operator’s own pipeline, not by this server, and the intent is drained when that observation contact succeeds.
• Multi-subject chains refuse: the crate’s law requires every link to describe the same artifact, so a run mixing artifact and phase-only links in its chain promotes nothing (reported as attestation_chain_broken, first in push order).

None for these categories is not claimed anywhere: this entry asserts what the code does, not a conformance, certification, or compliance finding. No AI Act / CRA / GDPR / DORA conclusion is drawn or claimable from any of it; the project envelope is not DSSE; a verifying chain is well-formed and digest-bound, NOT authenticated.

[Unreleased] — 2026-09-27 — “Bindings”: the machine’s standing authority to read an external system

Release notes

Improvements

• GET /workflow/delivery/bindings?domain=… lists the external authorities a domain is configured to read, with the operator’s declared capability surface and a pending-intent census. Read on the domain plus the workflow role.
• Two read-only adapters (vcs for repository commits/statuses, ci for GitHub Actions runs) read authority facts through the existing pinned egress family.
• Signed delivery intents are minted with a kernel-only key and are demonstrably undispatchable — the release act belongs to the promote gate, which does not exist yet.
• /metrics gains brain_delivery_intents_pending and brain_delivery_untrusted_rows_pending, per domain.

Security fixes

• The exact-host refusal (https://api.github.com only) is re-implemented for the new adapters and pinned, because the shipped GitHub connector’s copy is private behind a feature gate. A 3xx is refused rather than parsed — under redirect::Policy::none() reqwest returns it as a success.
• Per-binding secrets ride the existing root-confined reader (symlink-refused, 0600, 16 KiB, no path text in any error). The authority_digest covers the endpoint, the target ref, and the secret’s FILE NAME — never the secret and never its path.
• delivery_bindings is domain-scoped end to end, and the target_kind CHECK is enforced by the database. There is no write route: consent is given by configuring a binding at boot and withdrawn with active = 0.
• Boot refuses an invalid bindings profile in the same region as the existing provider gate, so an authority is never provisioned unvalidated.

Bug fixes

• A reserved outbox topic is now refused as topic_reserved before the topic charset is checked, so a forged reserved topic is answered with the refusal that actually applies rather than a misleading topic_invalid. Its denied audit row is written on that path, so a refused reserved enqueue leaves the same record it always did.

None for these categories is not claimed anywhere: this entry asserts what the code does, not a conformance, certification, or compliance finding.

Engineering record

Schema 1.32.16 → 1.32.17 (the line’s first outbound-egress round). New table delivery_bindings; PARITY_TABLES and the expected-table census moved with it in the same commit. The crate version is unchanged and nothing is pushed or tagged.

The negative census pin that asserted “no fourth delivery_% table” is re-scoped, not deleted: this round IS the fourth table, so the pin now asserts the current census and still fails on a fifth.

Honest ceilings.

• Intents are minted and left pending with no reader. A non-zero intent gauge is the expected steady state, not an alarm.
• registry/deploy/pm/incident are declared in the CHECK and are consumer-less — no adapter reads them.
• The reconcile binds an observation to the most recent active delivery run in the binding’s domain; a domain with two concurrent runs reconciles both to the newest, because nothing in an inbound payload distinguishes them.
• The adapters read ONE page. The page ceiling is enforced against the response, and following a Link next URL is a future round’s work.
• NOT DSSE. The project envelope convention, which verifies against no DSSE verifier. Authorship is not authority: a valid signature says the holder of the key signed, and nothing about whether the act was permitted. Whether an external system’s data may be read, retained, or re-published is a question for a human with the contract in hand — a mismatch becomes typed evidence and a human decides. No AI Act, CRA, GDPR, DORA, or HIPAA conclusion is drawn from any of this.

[Unreleased] — 2026-09-26 — “Ledger”: the delivery loop can prove what it did, offline

UNRELEASED — deliberately. The SCHEMA stamp moved to 1.32.16 (a release boundary the refuse-newer law reads), but the CRATE version did not: a version bump drags the SBOM artifact and the generated badge block, and no release is in this round’s scope. The version, the badge, and the SBOM move together when the release round runs.

NOT pushed, NOT tagged. CI is billing-blocked on this repository, so no CI-green claim is made anywhere in this entry. The local battery is recorded in the spine evidence file, item by item, including what was NOT run.

Release notes

Improvements

• Delivery runs now carry a signed attestation chain. Every phase pass appends ONE link — inside the same transaction as the step row, the compare-and-swap, and the trace row — naming the kernel-derived subject, the artifact digest, the phase, the tier, and the key that signed. The new GET /workflow/delivery/runs/{id}/attestations returns the chain with an unconditional verification verdict: no parameter can switch verification off, and a link that does not verify is reported per link with a named refusal code rather than hidden or downgraded into a mark that reads as verified. The chain is verified offline — no key file, no network, no clock — so anyone holding the chain can re-derive the verdict themselves.
• A phase pass may now cite the model that acted. The advance body takes an optional model binding; the server resolves it through the model registry and the signed predicate carries that row’s artifact digest, so a model name with no bytes behind it is refused. Registry refusals stay distinct (model_not_registered / model_not_promoted / model_retired / model_digest_missing).
• Trace rows carry a stored ordinal. delivery_traces gains seq with a UNIQUE(run_id, seq) index, allocated as MAX(seq)+1 in the caller’s transaction. A deleted middle row no longer makes the next write collide.
• A delivery run’s trace can now be re-derived and checked. Two new reads, GET /workflow/delivery/runs/{id}/replay-verify and GET /workflow/delivery/runs/{id}/trace, give delivery_traces its first readers. The verdict re-computes each row’s content address from its own stored columns and compares it against the address stored beside it, in ordinal order, and separately checks that the ordinal series is contiguous — a gap is reported as an order diff. Models are never re-run: the comparator lives in a crate whose entire dependency set is serde/serde_json/sha2, so the zero-model property is structural, and the verdict says nothing about whether an outcome was correct. A mismatch is returned as data, never as an error status, and both windows are bounded with the bound disclosed in every response.

Security fixes

• The delivery loop’s read surfaces are now covered by route-level authorization tests. The attestation read shipped with no authz coverage at all: nothing proved a Read-capable principal without the workflow role was refused, and nothing proved a foreign run was probe-blind. The three reads are now in the class matrix, in the role-gated list, and in the probe-blind list, and a seeded test opens a real run and proves the agent class is refused 403 on each of the six — the four writes and the three reads — while the operator is not refused on any of them. (The test asserts the operator is never 403’d, which is the gate property; it does not assert every route returns 200, because two of the writes legitimately return 409 once the phase pass has moved the revision.) A 403-for-everybody is not a gate. Revocation is proven to be not write-scoped: a revoked identity dies at the middleware on the read surfaces too. The keyless-host 409 delivery_attestation_refused is now proven at an HTTP hop, not only at the core, with the posture armed rather than assumed.
• The delivery read surfaces no longer answer for a run that is not a delivery run. GET .../replay-verify and GET .../trace queried delivery_traces directly and did not check the run’s kind, while every write path resolves its run through the kind-filtered head. Because workflow_runs is shared with the GDL, account, and valet engines, a principal with Read on a domain could pass a non-delivery run id and receive a structurally-valid delivery payload — answering 200 where every write answers 404, which is the existence oracle the module’s probe-blind law exists to prevent. Both reads now resolve the kind-filtered head first, so a foreign-kind run and a missing one are one answer.
• The trace appendix no longer serves the agent loop’s conversation log. The ddl_* narrative appendix read from the shared agent_session_events table with only the control:* family excluded, so it could return user, assistant, and tool_result rows — the model transcript — to any principal with Read on the run’s domain. The read now filters positively to the ddl_* family, so the appendix is the delivery narrative it is documented to be.
• A phase pass now refuses to proceed without a usable operator key. An absent key and a refused one are different causes of the same refusal, and neither ever degrades into an unsigned link. On a host with no operator key, a delivery run is created but never advances past its admission. Operators who relied on keyless phase passes will see 409 delivery_attestation_refused — install the operator key (brain ump keygen / the shipped installer) to advance runs.

Consumer-affecting

• Every stored and published trc_ id changes. The trace id digests the row’s stored ordinal, and the ordinal is new, so ids are re-addressed once. Any consumer that persisted a trace_id across this upgrade must re-read it. Four published response schemas carry trace_id (DeliveryRunCreated, DeliveryRunAdvanced, DeliveryRunAnswered, DeliveryGateVerdict). A database that predates the ordinal column has its existing rows numbered 1..n per run in (created_at, rowid) order, so their stored order is preserved; their ids are still re-addressed.
• The schema stamp is 1.32.16. A binary built before this release refuses a migrated database by design (refuse_newer_schema); downgrading needs a pre-upgrade backup or a forward build.

Non-claims — these are contract, not disclaimers

• The attestation envelope is not DSSE. It is the project envelope convention and will not verify against any DSSE verifier.
• The field names subject_digest / predicate_type / predicate mirror the in-toto Attestation Framework’s Statement v1 model as naming adjacency only. The envelope is not an in-toto Statement and verifies against no in-toto verifier.
• No SLSA provenance and no SLSA build level is produced or claimed.
• The IETF WIMSE agent-audit drafts are contemporaneous prior art, not a standard: four drafts, zero RFCs, two of them individual submissions.
• Authorship is not authority. A verified link proves who signed. There is no PKI, no revocation oracle, and no key epoch, so a rotated key leaves history verifiable, and a signature says nothing about whether the act was permitted.
• The signed predicate carries 4 of its 13 fields today; gate_verdicts, approval_ref, authority_receipts, and budget_spend stay empty until the rounds that populate them ship. It is not a rich claim.
• The replay verdict is tamper EVIDENCE over stored bytes, not tamper-proofing. It detects a row whose stored content address and stored columns disagree. It does not survive an attacker who edits a column AND recomputes the address, and it does not bind a trace row to the signed attestation chain — the chain is what binds; this checks. A verified replay authorises nothing: a byte-identical replay is not a compliance finding, and classification, retention, and any legal sufficiency of this output are operator-and-counsel determinations. No AI Act, CRA, GDPR, or operational-resilience conclusion is drawn from it anywhere.
• POST /workflow/decision-runs/{id}/replay-diff is a different route with the opposite philosophy. It publishes a similar concept under similar wire keys and re-executes the pipeline with a bound model. The two are deliberately not unified and share no code.

Engineering record

• New table delivery_attestations (twelve columns, the design owner’s list and no others) plus the delivery_traces.seq ordinal; stamp 1.32.16; PARITY_TABLES, expected_tables, and the refuse-newer probe all move in the same commit.
• src/workflow/attestations.rs (new): the envelope, the signer, the chain writer, and the offline verifier. Module-level #![deny(unsafe_code)]. All cryptography is routed through the shipped ump_integrity stack — a second canonicalizer or a second content hash would be how a signature drifts onto the wrong bytes, and a pin forbids one.
• One writer. advance() is the only caller of the chain append, and a tree-wide source scan proves exactly one production INSERT exists. The admission, the answer, and the gate each read the chain head into their trace row and append nothing.
• A migration bug this release found and fixed: the ADD COLUMN for seq defaults every existing row to 0, so a run with three trace rows held three (run_id, 0) pairs and the CREATE UNIQUE INDEX that follows would have failed the migration on exactly the databases the guarded block exists to upgrade. The ordinals are backfilled per run in (created_at, rowid) order before the index is created, and a pin builds a populated pre-ordinal database and proves the upgrade survives it.
• Three existing pins reversed, deliberately and by name: the delivery route census (four routes → five), the “zero reads” rule (R38’s four-writes-no-reads decision, which the attestation read revokes), and the schema stamp literal. Each was widened rather than deleted, so a sixth route or a seventh stamp still fails.
• One vacuous check found and rewritten. The old “no GET under the delivery prefix” pin filtered lines containing the path and then looked for get( on that same line — never true, because the method is on a later line. It is now a path-to-method pairing, so a second read would actually be seen.
• Full record, with the RED→GREEN ledger, the red-proofs, the exact commands and exit codes, the forbidden-path outputs, the re-measured floors, the envelope as shipped, and the honest NOT RUN list: plans/R40_EVIDENCE_ATTESTATIONS_2026-09-26.md in the brain-steward-ip planning repository.

[1.29.2] — 2026-09-26 — “Engines”: the delivery loop grows an executor it can actually call

Internal release. Prepared and tagged locally; not pushed, and deliberately without the CI-green gate. CI is billing-blocked on this repository, so scripts/release.sh can never be satisfied and the gate was bypassed by explicit operator decision, not skipped by accident. Nothing here claims the release passed CI — see “The CI gate was not run”. The full local battery did pass: 2318 tests across all lanes, clippy -D warnings on four shapes, fmt on two targets, lipstyk-gate with zero diagnostics, eight cargo audits, cargo machete, env-truth, badges --selfcheck, and repo-brief all green.

Why a patch line and not a minor one. The duplication-debt ledger (src/dup_guard.rs) requires a new minor line to be earned by burning real duplication debt; DEBT_LEDGER carries a row for 1.29 (14) and this release adds no debt, so opening 1.30 would fail debt_ledger_reflects_reality_and_burns_down_per_line. The house precedent settles it: patch lines carry additive work.

Release notes

Improvements

• The delivery run lifecycle can now carry a typed artifact on a phase pass. Advancing a run with an artifact files it as a pending proposal in the same transaction as the step row, the compare-and-swap, and the trace row, and returns its proposal_id — so a caller holding that id has evidence that the proposal, the trace, and the audit all committed together, or that none did.
• Advancing a run into the build phase with an artifact now runs the shipped checkpoint gate: an artifact whose QA evidence is not a live surface is refused before anything is written, with the gate’s own refusal carried through rather than restated.
• The two engine crates the delivery loop consumes (brain-consensus-core, brain-executor-core) are now described accurately in docs/engine-sdk.md, and that description is machine-checked for the first time.

Security fixes

• The typed artifact is treated as untrusted input at the route boundary: its content is screened exactly as proposal content is screened, and a rejected artifact is a 400 while a quarantined one is a 409.
• A client can no longer name the digest of an artifact it supplies. The SHA-256 is derived server-side by the engine; the request body has no digest field to lie with.
• An executor-produced artifact has no write path to a decision. It files a pending proposal with no disposition and no decision timestamp, and it cannot move the run’s status or its pending question. A model proposes; only the gate disposes.

Engineering record

The round. R39 wires the D2/D3 engines into the delivery run lifecycle and lands the per-phase typed-artifact proposal seam. It adds no new route, no table, no schema stamp, and no migration — src/migration.rs, src/storage_layout.rs, and src/spire_inventory.rs are byte-untouched and LATEST_KNOWN_SCHEMA stays 1.32.15. The seam rides the existing POST /workflow/delivery/runs/{id}/advance.

The route’s CONTRACT moved, and that is disclosed rather than claimed away. No path was added or removed — the composed chain still registers 234 route sites — but the advance route gained an optional artifact request field and the response gained proposal_id, and both openapi.yaml schemas are additionalProperties: false. Leaving the spec frozen would have made it a false contract in both directions: a spec-conformant client would reject every real response, and a strict request validator would reject a valid body. openapi.yaml therefore ships in this release, adding the DeliveryArtifact component, the artifact $ref, proposal_id, and the two new error codes. x-api-version stays at 1.23.0 — that stamp tracks breaking wire changes, and it has not moved since v1.20.1 (the previous release added four routes without moving it either).

That break was invisible to the whole battery, and the pin that now catches it says why. The existing route guards are path-level only — It stayed green because the existing route guards are path-level only — test_openapi_covers_routes proves every path is documented, never that a documented path’s FIELDS match the handler. Nothing in the repository compared a Rust response struct to its schema, so 2317 green tests could not see a spec that no longer described the server. delivery_advance_wire_schema_matches_the_handler is that comparison, scoped to the route this round changed: it parses the response schema’s property keys by indentation (a substring test is vacuous — renaming the field to xproposal_id satisfies contains("proposal_id:")) and asserts exact membership, then checks the request $ref, the component’s existence, and the 409 vocabulary.

Writing that pin surfaced a second defect, in a guard I did not know was load-bearing. My first openapi.yaml edit put a blank line inside the advance path’s folded description. test_openapi_covers_routes scans path keys with a line scanner that treats a blank line as the end of the paths: block — so my blank line silently truncated the scan and the guard reported five routes missing, including three model-registry routes I never touched. The YAML was valid; the scanner was the fragile thing. The fix was to follow the file’s existing convention (no blank lines inside a path block) rather than to weaken the guard, and it is recorded here because the trap is still armed for the next person who adds prose to a spec path.

The typed artifact is a reused shape, not an invention. DeliveryArtifact projects onto the shipped brain_consensus_core::Artifact { id, content, hash }, whose hash is the same sha256(content) the shipped brain_executor_core::artifact_hash computes. delivery_typed_artifact_is_a_shipped_type pins that the two agree byte for byte — a cross-crate consistency pin, because if they ever diverged the digest in the audit and the digest an approver sees would be different digests of the same bytes.

The engine cores, filled. Both crates gained a //! header and #![forbid(unsafe_code)]; neither had either, so they were unsafe-free by accident of a few hundred lines rather than by gate. Four real defects closed:

1. apply_steering was a silent no-op — it discarded its kind argument (let _ = kind;), returned Ok(agg.clone()), and could never Err, while carrying no todo!/unimplemented!/FIXME marker. Its existing test passed identically with the stub and with a real implementation. All six SteeringKind values are reserved vocabulary with no defined semantics against a two-field Aggregate, and no caller needs a mutation — so the function is now an explicitly declared no-op with an infallible signature. A Result it could never fail made “no mutation needed” indistinguishable from “refused”; removing it means a future round that needs real steering must change the signature deliberately, which is the point.
2. The critic ceiling tripped one verdict late. The design owner states “5 → pause”; the code compared > 5 against a bare inline literal, so the sixth non-okay verdict paused the run. The ceiling is now a named CRITIC_CEILING const and the comparison is >=, so the fifth pauses. This is a behaviour change in a pure core with no callers; it is disclosed here rather than buried, and the governing text was followed.
3. "replayExempt" was an accepted QA key with no ExecutorQa field. With no deny_unknown_fields, a nested executorQa.replayExempt validated and was then silently dropped, leaving the gate’s own replay_exempt false — a caller could believe it was exempt while the gate still refused. It is now refused outright. (It failed closed, so this was a false promise, not a bypass.) Listed keys must be fields that exist.
4. stage_writer dropped artifacts silently. It paired artifacts with kinds through zip, which stops at the shorter of the two: three artifacts and two kinds produced two files and an index that looked complete. It now refuses a mismatched count by name, and returns a Result so the refusal is loud rather than an empty return.

Two pins that were vacuous, and the red-proofs that caught them. Both new source-scanning pins first shipped matching their own test bodies: the forbid(unsafe_code) scan passed on a crate with no attribute at all, because rewriting the attribute to allow also rewrote the string literal inside the assertion. The engine_sdk scan searched only the text after the scaffolds line, which had already removed the very crate names it was checking — so re-classifying a consumed engine as a Scaffold passed green. Both are now scoped to the production region / the bullet including its continuation. Neither would have been caught without deliberately breaking the thing and re-running.

The harness inertness law was NOT reversed — verified, not assumed. The plan recorded that routing the delivery loop through the decision harness would reverse a machine-pinned law, and that the doc comment must not be quietly edited. On measurement the law is documentation only: no test anywhere asserts it, and harness/mod.rs is not in the repository’s include_str! self-inspection inventory. But this release also does not route through the harness — the phase pass calls the two engine cores directly, exactly as the existing code already reads PIPELINE_VERSION from the harness module. Nothing outside the harness reads the harness’s decision_* kind constants, so the declaration is still true and the doc was left alone. The design owner’s “harness consumption” clause is therefore deferred, with the reason.

docs/engine-sdk.md was rot in four places, and is now machine-checked. The file had no machine reader anywhere in the repository. brain-care-core (80 lines, 1 test) was listed Filled beside legal-rules-db (1217 lines, 11 tests) listed as a Scaffold — the smallest “Filled” crate is a fifteenth the size of the largest “Scaffold” one — brain-engine-sdk — the file’s own subject, 13,452 lines and 192 tests — was not listed at all; and brain-delivery-core was described as “ungated: no callers yet”, which the previous release made false by wiring it. The new engine_sdk_crate_map_is_accurate pin deliberately does not compare line counts — size is a bad proxy, and those two numbers are exactly why. It checks the two things that were actually false: every named crate exists on disk and the SDK is listed, and a crate the server actually calls is not classified as a Scaffold.

A compliance pin that landed green — which is the finding. The execution plan for this round asserted a “100%-verifiable defect”: that the repo carried pre-Omnibus EU AI Act dates and that Regulation (EU) 2026/1744 was absent from the compliance reference set. Measured, both were already fixed by v1.28.88 “Clocktruth”: the amending regulation is cited in five live locations and every Annex III statement already reads 2 December 2027. The plan had conflated the Art 50(2) legacy-marking grace end (2026-12-02, real and correctly stamped) with the Annex III start. The genuine gap was narrower — the deployer horizons live in docs and were pinned nowhere in code, since reg_watch holds the Art 50 and general-application clocks and its own comment says the deployer horizons are “tracked in docs, not in code”. So the new ai_act_deployer_horizons_are_stamped_from_the_amending_instrument pin landed green on arrival, which is the correct outcome for a correct document and is itself the evidence that there was no defect to fix. It is a docs-truth pin: it freezes the two horizons and the instrument so the prose cannot drift silently. No conformity, certification, or risk-classification claim is made anywhere, and whether this system is an “AI system”, whether it is high-risk, whether Annex III §8 reaches a review-queue engine, whether Art 50(2) applies, the provider/deployer role, and Art 25(4) written agreements remain operator and counsel determinations.

Supply chain. Two new path dependencies. Diffed against the committed lockfile, the root Cargo.lock gained exactly two [[package]] entries and zero third-party packages — every dependency the two crates name (brain-engine-sdk, hex, serde, serde_json, sha2) was already locked. crates/Cargo.lock did not move (both crates were already workspace members), and neither did the other six lockfiles or shell/pnpm-lock.yaml. One unlocked resolve, --locked everywhere after. All eight cargo audits exit 0; the advisory warnings in the six non-root lockfiles are pre-existing unmaintained and yanked notices in trees this release does not touch, and the root lockfile — the only one that moved — reports zero advisories.

Tests. RED-first with recorded RED text and exit codes, and every guard red-proofed by deliberately breaking the thing it guards. Nineteen new tests (8 in the delivery core, 8 across the two engine crates, 3 in docs_truth), plus three existing executor-core tests reused rather than re-authored — the plan’s own list duplicated quality_gate_requires_live_surface_evidence, big_scope_mandates_delegation and the nested unknown-keys test, and the plan was right that the top-level unknown-key path was the genuinely uncovered one. CRATE_TEST_FLOOR needs no bump: 1,568 pinned against 2,115 measured, so the round’s growth is absorbed.

Two counts this record originally got wrong, corrected here. The delivery.rs suite went 12 → 20, not “15 → 22” — the earlier figure counted neither the pre-change total nor the delta correctly. And the pin count was understated as “twelve (7 kernel, 2 crate, 2 docs-truth)”, whose own breakdown did not sum to twelve. The three figures a reader is most likely to re-derive mean different things and are stated with their units: 2,115 is a static #[test] needle over src + tests (what CRATE_TEST_FLOOR measures, and it excludes #[tokio::test]), 1,927 is the lib target under default features, and 2,318 is the badges.sh total across every lane — that last one is what the README badge carries.

Ceilings, stated honestly. The ddl_* narrative row carries the digest, the ids, and the gate flag — never the artifact body, which is the proposal’s job. There is deliberately no ddl_artifact_refused kind: a gate refusal is raised before the transaction writes anything, so it leaves no residue to narrate, and a kind nothing can emit is the same validated-but-dropped vocabulary this release removed from the executor core. model_ref stays None: writing one would pre-empt the digest-pinned model-citation law the attestation round pins. Budgets are still stored and still unenforced, and blast_radius is still referenced by no code line. The forbid(unsafe_code) attribute now makes the two engine cores stricter than the four that already carried deny, which is deliberate and disclosed rather than made uniform in a wider diff than this round’s scope. A client’s artifact body is screened but its quality_gate JSON is not — the gate is parsed as structured data by the engine’s own validator, never rendered.

A ceiling on the test run itself. The suite is green with TMPDIR=/tmp, and one pre-existing sandbox test fails under a default TMPDIR on this host (workflow::sandbox::tests::realized_paths_law_pinned_against_symlinked_temp) because the agent sandbox’s TMPDIR is already a resolved path and the test cannot create its symlink alias. That is an environment property, not a code defect, and it is not introduced here — but it means “0 failed” is TMPDIR-conditional and nothing in the battery pins that. Recorded rather than quietly worked around.

[1.29.1] — 2026-09-26 — “Delivery persistence”: the loop gets a storage plane

Internal release. Prepared and tagged locally; not pushed, and deliberately without the CI-green gate. scripts/release.sh blocks until CI is green on the exact commit being tagged and then pushes the tag; CI is billing-blocked on this repository, so it can never go green and the script can never be satisfied. The gate was bypassed by explicit operator decision, not skipped by accident — see “The CI gate was not run” below. Nothing here claims the release passed CI. The full local battery did pass: 2314 tests, clippy -D warnings on four shapes, fmt on two targets, lipstyk-gate with zero diagnostics, and brain-migrate-rehearse all green.

Why a patch line and not a minor one. The duplication-debt ledger (src/dup_guard.rs) requires a new minor line to be earned by burning real duplication debt — DEBT_LEDGER holds rows for 1.28 (15) and 1.29 (14) only, and debt_ledger_reflects_reality_and_burns_down_per_line refuses a build whose line has no strictly-smaller row. This release adds no debt, so opening 1.30 would fail that guard unless an unrelated TODO(unify) pair were unified first. The house precedent settles it: patch lines carry additive work — 1.28.62 shipped the revoked_principals table and a schema stamp, 1.28.77 shipped the erasure line, 1.28.84 shipped the SSE revocation kill and required webhook signing — while minor lines are the earned boundary releases (1.29.0 “GDL boundary” is the one that burned 15 → 14). The delivery line’s rounds are incremental additive work on top of that boundary, so 1.29.1 is the semantically honest line. Recorded here because the version number is a real decision, not a formality.

Covers the twelve commits since v1.29.0, counting this release’s own documentation-truth fix. (The count is self-referential: a note that says “eleven” becomes false the moment the commit carrying it lands, which is the same class of defect this line corrects below.)

Release notes

Improvements

• The delivery loop is persistent and has a run lifecycle. Two new tables land at schema 1.32.15 — delivery_traces (the per-run trace index over phases and gate dispositions) and delivery_budgets (the per-run budget head) — and four new writes under /workflow/delivery/ open a run, advance it one phase, answer its pending question, and evaluate its phase gate. The delivery loop rides the existing run engine with kind='delivery': no second engine, no workflow_runs or workflow_steps migration, and no change to the closed run-status set or the four normative routing keys.
• A phase pass is one transaction. The step row, the revision CAS, the trace row, and a fail-closed audit row commit together or not at all — a pass can never land without its evidence. A lost CAS refuses the whole pass rather than overwriting the winner.
• The gate is a disposition, not a mutation. POST …/gates evaluates the phase machine purely and offline, records its verdict, and moves nothing: deny wins, an illegal move is a refusal, and a tier that may not promote is told to ask — the human’s advance route is the disposal.
• A new model-registry view in the console. A bounded listing, a single-row read, and proposals-only editing for declared model identities. Artifact and config digests are visible; artifact bytes never are. The listing carries the additional DPO role gate, and the view offers proposals rather than direct mutation — the same propose/dispose shape the rest of the system uses.
• The delivery loop is ratified as the fourth top-level loop, and its pure decision core ships. crates/brain-delivery-core carries the closed autonomy-tier vocabulary, the forward-only phase machine, the deny-wins promotion gate, the attestation predicate, the budget ledger, the replay comparator, and the release-status machine. It is pure and total — no clock, no store, no network, no provider — so it decides without a running host. It has no callers of its own: this release’s fourth entry above is the first consumer.

Bug fixes

• An interrupted end-to-end run no longer poisons the next one. The E2E entrypoint now self-heals its state instead of inheriting a half-finished previous run. Previously a run interrupted mid-flight could leave state that made the following run fail for a reason unrelated to the code under test.

Engineering record

• Two new tables, house style. delivery_traces (content-addressed trc_<32 hex> id over the row’s facts and its ordinal in the run, closed CHECK vocabularies on stage/phase/status/tier, the (run_id) and (run_id, created_at) replay indexes) and delivery_budgets (composite (run_id, kind) PK). Both land in one execute_batch with their indexes; no FK, no down-migration, additive CREATE TABLE IF NOT EXISTS only. Refs, digests, and closed labels only — no raw query, evidence text, model bytes, rules bytes, or secrets.
• Budget honesty binds the table. Rows are STORED and nothing enforces them: no route, ceiling, or decision path consults a budget, and blast_radius — admitted by the kind CHECK because the governing spec names it — is referenced by no code line at all, which a non-vacuous source scan pins over the production region of both new files. Turning enforcement on is a later round’s turn.
• The design owner’s §7 non-goal is stale and is superseded here. §7 reads “no new trace table” — written to stop exactly this table. ADDENDUM 2 §2 decides that delivery_traces lands in this round with the 1.32.15 stamp, its own schema, first writer, indexes, and a replay-read contract; §1.6 was rewritten to say so and ADDENDUM 1 item 3 carries an inline supersession marker, but §7 itself was never corrected. Under the spec’s own precedence the addendum wins. Recorded here so the clause is not re-litigated mid-implementation; correcting the spec is the document owner’s act, not this round’s.
• The autonomy-tier vocabulary has two spellings, and the boundary absorbs the difference. The governing spec spells the closed set kebab-case (observe | propose | bounded-auto | delegated); the pure crate spells its own variants snake_case (bounded_auto). The spec is the sole governing source and the crate is an implementation artifact of a shipped round, so the stored column and the wire use the spec’s spelling and a closed, total, four-arm bijection at the core boundary carries the translation — not a normalization pass, not a nearest-match guess. Both directions are pinned.
• law_version stays empty, on purpose. A delivery run has no jurisdiction, and the column is a per-jurisdiction concept written only at case intake and read only by an advisory report that documents the empty stamp as “advisory unavailable”, never a refusal, never a block“. The delivery loop’s real law identity rides policy_digest + pipeline_version, both of which the trace row does write. Piping the engine version into the law column would fabricate a law_version_mismatch against the legal DB head on every run.
• A new root dependency edge, and the lockfile moves. This round takes its first dependency on crates/brain-delivery-core, so the root Cargo.lock gains exactly one [[package]] entry (509 → 510) and zero third-party entries — the crate depends only on serde, serde_json, and sha2, all already locked. One resolve without --locked, its entire diff inspected before anything else ran, --locked for every command after. crates/Cargo.lock gains nothing.
• Four writes, zero reads. The read routes the spec names but never assigns (GET /runs, /runs/{id}, /steps, /trace) are unassigned in the governing spec; they are recorded as an open gap rather than quietly built or quietly dropped. The /outcomes?window= read route is likewise recorded, not struck — its table was withdrawn but the route was never reconciled.
• Authz ordering is the run’s domain, and that is the contract rather than a slip. The three id-scoped writes resolve the run’s domain before any gate — the domain is unknowable without the run, and authorizing against anything else checks the wrong domain. So an absent run is the probe-blind 404, exactly as on every other run-resolved route, and the 403-on-role proof is a seeded behavioural test that opens a real run first: a gate proven only against an absent row is a gate proven about nothing.
• Four red-proofs, each run rather than assumed. Making the audit best-effort makes the atomicity test pass a phase pass with no evidence; a production reference to blast_radius trips the source scan; a one-sided schema edit turns the lockstep stamp guard red. All three were observed RED, then restored.
• The CI gate was not run, and this release therefore carries no CI evidence. The repository’s release helper blocks until CI is green on the exact tagged commit and then pushes the tag. CI is billing-blocked here and cannot report green, so the helper is unsatisfiable by construction and was not invoked; the tag was created locally and not pushed. Everything asserted above was verified from local command output: 2314 tests passing across 15 suites, clippy -D warnings clean on four shapes, fmt clean on two targets, lipstyk-gate with zero diagnostics on changed lines, cargo machete clean, all eight cargo audit runs at exit 0, env-truth and badges self-checks clean, and brain-migrate-rehearse reporting ALL CHECKS PASSED against a temporary database. The live database and the running service were never touched.
• Floors re-measured, never inherited. 196 coverage rows / 180 authz rows / 234 router sites / 2105 crate tests against floors of 167 / 152 / 199 / 1568 — no floor bump required, the slack was 24–31 rows.
• Honest ceilings. No read surface, so the stored answer prose has no reader yet (bounded to 2000 chars, never copied into a trace row, and not on any emit path). No session-log append on the phase pass — the reuse of the append-only narrative log belongs with the round that adds a consumer to drive it, and the idle check would have nothing to assert. pending_question is never set by any route in this release, so the answer route is only exercisable by a caller that writes run state directly. This release makes no compliance, conformity, certification, or risk-classification claim; the 1.32.15–1.32.18 stamps are internal engineering versions, not regulatory filings.
• Also in this release, not user-facing: the models table’s Tailwind classes were canonicalized to v4 forms (presentation only, no behavior change), and the D0 architecture record was written into docs/architecture.md (the delivery loop’s placement as the fourth top-level loop, with the extended law sentence a model proposes; only the gate disposes — including delivery). docs/architecture.md then had its delivery-loop paragraph corrected from “no callers” to the first-persistence state — the server now consumes the pure core and persists what it decides — while keeping the honest qualifier that persistent is not complete: what is stored is neither enforced nor read back, and the replay-verify surface, authority bindings and connectors, the release and promotion surface, and any derived read model remain unbuilt. That commit also put the pending_question gap on the record. The pure core’s two structural ceilings also stand and are not incidental: it does not sign and does not verify signatures, so an unsigned or foreign-signer case is a refusal the host must make and never a degraded mark from the core; and autonomy only narrows, so promote reads the tier and never the recorded trace mode.
• Documentation-truth correction, recorded rather than silently amended. The first draft of this section said “covers the nine commits since v1.29.0” when the true count was ten, and eleven once the architecture paragraph landed. A release note that miscounts its own contents is a docs-truth defect, and this repository pins guards against exactly that class — so the count is corrected here and the correction is disclosed in the commit that carries it, rather than folded in invisibly.
• Predecessor: v1.29.0 “GDL boundary and launch integrity”.

[1.29.0] — 2026-09-25 — “GDL boundary, governed decisions, and model identity”

This release closes the GDL provider boundary and launch-integrity work accumulated since 1.28.92, alongside the governed model identity, decision-run, and evaluation-record surfaces. The GDL launch request is intentionally breaking; its migration is called out first.

Release notes

Improvements

• GDL launch migration (breaking request contract). POST /workflow/cases/{id}/gdl accepts the bounded {ticket} body only. Callers that send base_url, model, secret_file, or timeout/response fields receive 400 gdl_request_migrated; configure the server-owned BRAIN_GDL_PROVIDER_BASE_URL, BRAIN_GDL_PROVIDER_MODEL, BRAIN_GDL_PROVIDER_SECRET_FILE, and BRAIN_GDL_PROVIDER_SECRET_ROOT profile instead. Readiness reports gdl_provider: disabled|configured|invalid; partial or invalid configuration refuses bootstrap.
• GDL launch integrity. Provider failures after admission become a durable, non-retryable gdl_provider_failed terminal: the first launch returns HTTP 503 and a later launch against that run returns HTTP 409 without replaying provider work. The 25-second total request/body deadline bounds slow-drip responses, and receiver cancellation drops the in-flight HTTP future.
• Governed model identity and decision-run surfaces. Digest-pinned model registration, inspection, listing, human-gated lifecycle, and the role-authorized decision-run execute/read/replay/listing routes are available with bounded, audited responses. Exploratory output can propose but cannot promote.
• Evaluation records. Bounded, digest-pinned, explicitly non-authoritative evaluation records can be created and read through the DPO/Admin-gated route family without treating an operator judgment as an authoritative label or registry transition.

Security fixes

• GDL provider and secret boundary. JWT callers need domain Write plus the supported workflow role before profile, secret, DNS, or provider work. The new least-privilege workflow-operator role is grantable through the public role contract; agent, role-less JWTs, and unknown roles remain denied. Provider endpoints require HTTPS and safe URL shapes, retain address screening and DNS pinning, and refuse redirects.
• Provider-failure settlement. Typed exchange/invocation/checkpoint/audit/claim-release handling prevents an admitted GDL exchange or invocation from remaining unfinished. Provider bodies, bearer values, secret paths, and secret-bearing URLs are not persisted or logged.
• Model identity and evaluation integrity. Registry lifecycle proposals bind the exact current row and digest; evaluation records bind their target and manifest digests. Missing or unavailable evidence is not fabricated, and no evaluation or registry surface autonomously changes lifecycle status.

Engineering record

• R34 is commit 6e458bb; R35 is commit 23cc116. This release commit is separate from both round commits.
• The R34/R35 OpenAPI and generated shell changes are retained; the static API contract stamp is 1.23.0. Existing schema-stamp continuity labels (1.32.13 and 1.32.14) are not moved or renamed by the release commit.
• The release prep makes the C2 cancellation test deterministic and retires the two pre-existing lipstyk match findings; it does not change product behavior. No new dependency, lockfile, migration, package, plugin, OpenClaw, Tauri, or client source change is part of this release.
• The release is an engineering and version event only; it makes no legal, compliance, conformity, certification, or risk-elimination claim.

[1.28.92] — 2026-09-22 — “Ledger”: the loop closes diagnostically, and the record layers land

The governed loop’s 1.32.x line is stamped through 1.32.7 “Diagnostic Closure”, and two preregistered record layers ship on top of it: the after-action disagreement corpus (Reflect/learn) and the StewardOS account record layer — the deliberately-not-a-CRM. The System-One decide modules land as a pure, ungated Phase 0 port with zero behavior change. The exec path gains a real OS boundary. Fifty-four commits, six prereg-first rounds (R16–R21), every round with a hash-pinned prereg written before its first edit and an evidence file written after — and the classifier consume is deliberately ABSENT: the 1.32.8 System-One lane stamps only when that lane ships, and the lane stays opener-gated on the operator labeling round. Zero new runtime dependency edges across the whole batch; Cargo.lock byte-untouched in every round that promised it.

Release notes

Security fixes

• The exec path gets an OS boundary. The loop’s command execution now runs behind a typed sandbox seam with policy-outranks-backend selection: deny-default sandbox-exec profiles on macOS, a target-gated Landlock enforcement path on Linux, fail-closed everywhere — an unavailable backend refuses the command rather than faking it, and the handle laws pin cancellation and reaping mid-run. Every execution the loop mediates inherits this boundary; nothing opts out.
• Agents cannot mint loop obligations or account rows. The handoff decision, back-referral return, pipeline stage change, and account archive all enforce the machine-refusal law at the surface AND in the core: a decision reference is REQUIRED (400 decision_ref_required / decision_ref_invalid), screened and bounded, and the role gates refuse the agent class before any row is written. The account link/pipeline rows are agent-denied end to end; the classifier never advances a stage.
• The exfiltration surfaces carry the DPO dual gate. The two bulk-read surfaces added this release — the disagreement-corpus export and the account listing — both require the Admin scope AND the DPO role, land a global audit row per call (principal, filter, row count), and answer bounded pages only. Corpus exports de-identify at the seam through a synthetic scope-less reader (unconditional PII masking — no caller’s clearance can bypass it), and rows carry their frozen train/holdout partition so a bleed is checkable.
• Probe-blind 404s everywhere new. Every run- and account-scoped route added since 1.28.91 answers an absent id with the same 404 an unauthorized caller gets — an absent account and a non-account id are the SAME answer, so the surface never reveals whether an id exists as some other kind of row.
• CI now scans every tracked lockfile with the real advisory database. The rustsec/audit-check action is replaced by the cargo-audit binary (scanning root, client, and tools lockfiles on every push); the CodeQL traced-build ENOSPC failure is fixed; the tools lockfiles carry the RUSTSEC-2026-0285 rustls 0.23.45 bump. The conformance pack gains the two-door rule: an explicit GDL_R10_PACK_DIR is a fail-closed operator request, while the pack’s plain absence on CI is a NAMED skip — never a silent pass.
• The memory-safety floor is enforced on production builds, and the loop’s untrusted-input parsers (model-generated JSON artifacts) are reachable through total fuzz seams — every seam returns plain data or a named refusal, never a panic, for any input.

Improvements

• The loop closes diagnostically — 1.32.7 “Diagnostic Closure”. The full closure chain: the SLA clock arms at triage on a typed row (pinned P-class table); the unconditional human escape is honored at every phase boundary with exact replay; escalations land exactly one pre-filled I-PASS offer draft (HITL-gated); justified_handoff_rate rolls up from recorded soft-handoff rows with unjustified revisits denied-and-audited; the continuity report section renders deterministic, recorded-rows-only. The triage duty applies ESI/MTS acuity with the red-flag forcing function (monotonic escalate-first lock, fail-closed must-miss catalog); NO case resolves without a law-clean closure artifact at the single resolution seam; the back-referral contract arms atomically with the handoff and its overdue HITL sweep never auto-resolves an obligation.
• The operator decision surfaces. Two new authenticated routes — POST /workflow/runs/{id}/handoff/decision and POST /workflow/runs/{id}/back-referral/return — put the human decision in the wire: a decision-required transition never moves without the operator’s reference, the report’s B3 refusals surface named with the missing list, and the board’s overdue sweep fires on the production read so a past-deadline contract never reads as merely open.
• The disagreement corpus (Reflect/learn). After-action reflection records capture inside the closing transaction — atomic with closure, strictly after the outcome is sealed, and PROVEN retrospective-only: the same case driven twice is byte-identical with capture on versus off (modulo per-run ids). Hard-negative disagreement rows derive ONLY from audited gate rows, never agent free text. The DPO exports the labeled corpus, bounded and audited, with a frozen train/holdout split stable across exports.
• The account record layer — the deliberately-not-a-CRM. Accounts are workflow rows of kind account (no new table, no migration): a screened, bounded record (name, owner label, status, server clock — identifiers only, never request bodies); request→account links and a decision_ref- gated pipeline timeline (closed ratified vocabulary: lead → qualified → proposal → closed_won | closed_lost) as additive audited session-log rows; six routes total with the per-account history served as a pure decision join. Schema-driven wizard packs (support-ticket, tele-health, capture pre-screen) ship as kernel-validatable DATA on the decide builders — branch-on-answer in the pack schema, answers typed choice/score/noul only, anything ambiguous ABSTAINS, and the assembled case lands through the existing webhook seam. The renderer stays GUI-owned.
• The System-One decide modules land as pure Phase 0 — script/language detection, the routing precedence chain, the typed question sequences with the hard 20-option ceiling, entropy/ECE calibration in integer units, and the triage/email/guard preset schemas: 134 spawn-free tests, zero behavior change, no model, no Python, no runtime fetch. The inference wiring stays gated on the 1.32.8 lane.
• The curated legal-rules DB and the law-version stamp. A read-only, Admin+DPO-gated GET /legal/rules?since= diffs the curated law vocabulary reproducibly; every intake stamps its law_version; the run report renders the recorded rows advisory-only — it informs a human, it never blocks.
• The compaction pipeline is a measured experiment with failure drills (probes, degradation latches, replay caps), and the fuzz corpus replay tests walk committed seeds for every parser added since the last release.

Bug fixes

• The CETS 225 (CoE Framework Convention on AI) entry-into-force stamp is corrected to 2025-09-01 — the CoE’s own treaty text carries the Article 30 mechanism; the in-tree 2025-11-01 date was wrong. Fixed together: code, compliance doc, derived pin.
• The linux_ci outside-write probe targeted a GRANTED scope — the probe now exercises the denial path it claimed to test.
• The no-SQL-in-handlers law is restored over the decision surface: the return handler’s inline read moved to a core reader owned by the module that owns the row shape, and the SQL-bearing tests moved to the integration tree — the sanitized gate caught it, the law was right, and nothing was weakened.
• The conformance fixture re-sync puts the plain case-run lane back at 6 passed / 0 failed / 1 ignored (the gold pack re-synced and re-pinned).

Engineering record

• The round discipline. R12–R21, each round preregistered before its first edit and evidenced after: the plans and evidence live in the operator spine (EXECUTION_PLAN_R1[2-9,20,21]*, R19_CLOSEOUT_AND_SYSTEM1_ PHASE0_EVIDENCE, R20_REFLECT_CORPUS_EVIDENCE, R21_EVIDENCE_stewardos_accounts, and the pinned preregs — e.g. the R21 prereg 8ab2906e… pinned before any kernel byte, with one dated pre-data addendum). R20 and R21 each landed as exactly ONE kernel commit.
• Validation at the release tag. The four sanitized gate scripts (regenerated each round from the persisted 219-name skip list, asserted byte-identical) stand at 1948 / 1972 / 1976 / 1955 — every round’s growth exactly its preregistered spawn-free count (1.32.7: +24; R19: +149; R20: +20; R21: +35). spire inventory: router routes 216, crate tests 2,007, coverage rows 180, authz rows 164 — each delta exactly the round’s declared surface. SDK 184/188, brain-fuzz 4 (kernel-free), legal-rules-db 11, workspace battery 22 sections / 230 tests. fmt, both clippy variants (-D warnings), the no-SQL-in-handlers pin, the every-route authz source scan, the openapi coverage pin, the reverse guard, the comment-hygiene law, dup_guard, env-truth (zero new knobs), FIFO control, and cargo-audit — all green at the tag. The SBOM is regenerated for this version (sbom/brain-server-1.28.92.cdx.json).
• The gates caught real bugs and were never weakened: dup_guard refused two same-name helpers across rounds (both renamed on the new round’s own lines); the sanitized gate caught the handler SQL (F3 above) and the comment-hygiene law caught a plan-id label; a lipstyk pass fixed every changed-line finding. Each catch is recorded in the round evidence with the fix.
• Honest ceilings, named. The classifier consume is NOT built — the 1.32.8 System-One lane stamps only when it ships, gated on the operator κ-labeling round; the decide modules are pure, ungated, and wired to nothing. The wizard renderer and interaction telemetry are GUI-owned (SvelteTauri shell plan) and absent here. The corpus capture is retrospective-only by construction. Landlock is target-gated to Linux; macOS enforcement rides sandbox-exec. The run report is advisory and never blocks a case. Retrieval-quality and compliance claims elsewhere in this file keep their own scopes; nothing in this section is a benchmark, model-performance, or compliance claim.
• Dependency posture: zero new runtime dependency edges across the entire batch (every round’s Cargo.lock byte-untouched by declaration and verified; the decide modules are std + serde + serde_json only). The tools-lockfile rustls bump is the one advisory-driven change, and it rides the release-time workspaces only.

[1.28.91] — 2026-09-15 — “Notary”: the off-host witness and the physical shred

Two operator-held evidence verbs close standing disclosed ceilings, and the release carries the prior CodeQL hygiene fix, a rustls RUSTSEC bump the release gate caught, and the seventh-pass register remainder closed (the register now has zero open rows). No routes, no schema, no wire change — the x-api-version stamp is untouched (CLI-only surface).

Release notes

Security fixes

• brain anchor — the off-host tamper witness. The seventh-pass live drill demonstrated that business-row tamper behind the audit chain passes every in-tree verifier (/ump/audit/verify censuses evidence rows; /verify checks claims against CURRENT bytes). The anchor closes the detection gap the honest way this architecture allows: a deterministic state fingerprint (chain head + knowledge content census
  • row counts) the operator records OFF-HOST and later recomputes with --verify. Detection, not prevention — periodic, not continuous; the host can forge everything on it, never the copy in your pocket.
• brain shred — the physical residue drop. Logical DSAR purge left purged bytes in freelist/WAL page images (the certificate’s disclosed posture). The shred rewrites the file — secure_delete=ON with readback asserted, wal_checkpoint(TRUNCATE), VACUUM, a second TRUNCATE checkpoint, integrity_check — and evidences the act with one hash-chained forget row. Freelist reads back zero. Filesystem copies, <db>.bak snapshots, standby chunks, and SSD wear-leveling remain the printed operator-level ceiling.
• CodeQL #74 cleared (rode main ahead of this release): the bounded-cache pin’s assert message no longer formats a cache-derived value — a tainted receiver’s .len() reaching the panic/log sink reads as cleartext logging.
• rustls 0.23.43 → 0.23.45 across ALL THREE Rust workspaces (root, client, steward-harness) — RUSTSEC-2026-0285 (published 2026-09-14: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries; patched ≥0.23.45). CI’s advisory scan caught it on the first push of this release and the release gate refused the tag until fixed — the fail-closed bridge working as designed. Practical exposure here is low (outbound HTTPS egress only; the handshake transcript remains authenticated), but the bump is SemVer-compatible and inert to the egress-pin suite (34/34 webhook+egress family green on the bumped lockfile).
• The env-truth gate learns the code shape — scripts/env-truth.sh’s implemented() was a bare substring match, so a comment, doc-string, log line, or fixture string naming a BRAIN_* knob counted as “implemented” (demonstrated red-first: a knob whose only in-scope occurrence was a comment passed the old gate). Now the name must sit on an env::var/var_os/set_var/remove_var read line; the three runtime-derived/external-consumer stragglers ride an explicit printed PINNED_CALLSITES inventory (the secrets-ladder resolve("case_status") derive ×2, and BRAIN_SERVER_AUTH_TOKEN = openclaw-host substitution), and BRAIN_MODEL_PROFILE is a declared non-knob (the docs say so themselves). --selfcheck builds clean + hostile fixture trees — the hostile one is the red proof kept permanent. All 84 scoped names measured and resolved honestly.

Improvements

• New CLI reference section “Evidence & physical erasure”; verify joins the value-flag vocabulary.
• CRATE_TEST_FLOOR 1,455 → 1,462 (seven new pins, all red-first-shaped: the tamper fixture must be greppable pre-shred and detectable post-anchor before the asserts mean anything).

Bug fixes

• None.

Engineering record

• Two new lib modules, CLI-only consumers (the standby precedent): src/anchor.rs (fingerprint — fail-closed on any unreadable census input; no DB writes by design) and src/shred.rs (the rewrite — every step asserted, an unevidenced shred is an error, never a warning).
• Pins: anchor_detects_business_row_tamper (the R7-08 closure — the chain stays green while the census names the tamper), anchor_detects_chain_truncation, anchor_is_deterministic_across_reopen, anchor_ignores_page_layout_vacuum (shred/anchor compose: a VACUUM never trips the anchor), anchor_line_round_trips_and_refuses_garbage, shred_removes_deleted_row_residue (marker greppable pre-shred — the fixture’s teeth — then absent from main AND wal post-shred), shred_writes_forget_evidence_and_keeps_chain_verifiable.
• Register dispositions riding this release (docs-only): the fork update-chain accepted risk FINAL (no upstream PRs; compensating controls procedural — THREAT_MODEL §5b row added); the aarch64 CI-execution gap CLOSED as not-applicable (no Jetson/fleet deployment exists; reopen trigger = first aarch64 fleet deploy); S7-05 (above) and L7-07 re-verified 2026-09-15 (Singapore MGF for Agentic AI 2026-01-22 voluntary; CoE CETS 225 in force 2025-11-01; US AI Diffusion rescinded 2025-05-13 — all unchanged-risk at component level). The seventh-pass register is fully dispositioned.
• Ceilings, honestly: the anchor’s cadence is operator-chosen (detection latency = that cadence); proposals/workflow/dsar rows are censused by COUNT, not content (bulk-tamper canaries); the shred is SQL-layer only; VACUUM needs free disk ~ DB size; the shred’s own forget row moves the chain head (re-anchor after shredding — printed by the verb).

[1.28.90] — 2026-09-14 — “Refresh”: the service bump — nine Dependabot PRs applied and verified

A maintenance release with ZERO code changes: the nine open Dependabot dependency PRs (#31–#39) are applied on main in one verified pass and shipped together instead of nine sequential merge-rebase-CI cycles. All three Rust lockfiles move; the only manifest change is the dirs major bump. No wire change, no route change, no schema, no behavior change of any kind — the full gate proves the bumps are inert.

Release notes

Security fixes

• github/codeql-action (init + analyze) moves from the 4.37.9 pin (cdf488f5…) to v4.38.0 (b96794f0…) — the static analyzer that scans this repo stays current (PRs #38, #39).
• reqwest 0.13.4 → 0.13.5 across ALL THREE Rust workspaces (root, client, tools/steward-harness; PRs #36, #34, #32) — the shared egress client (the DNS-rebind-pin seam, v1.28.69) rides the patch current; the insert-only pin suite (pinned_client_survives_dns_rebind family) and the private-address refusal table pass unchanged.

Improvements

• dirs 6.0.0 → 7.0.0 (the release’s one manifest change; the only consumer API in-tree is dirs::home_dir(), unchanged across the major — hf-hub keeps its own dirs 6.0.0 in the lock, per the PR’s resolution) (PR #31).
• fastembed 6.0.2 → 6.0.3 with tokenizers 0.22.2 → 0.23.2 transitively — the static embedder tier compiles and the eval floor holds (PR #37).
• uuid 1.26.0 → 1.26.1 (PR #33); zerocopy 0.8.56 → 0.8.57 (PR #35).
• reqwest 0.13.5 pulls base64 0.23.1 into the client and steward-harness closures (0.22.1 stays for the dependents that need it) — lockfile shape per the PRs.

Bug fixes

• None.

Engineering record

• Why one commit, not nine merges: each Dependabot branch rewrites the same lockfiles from the same base, so sequential merges would conflict-and-rebase nine times and trigger nine CI matrix runs to verify one lockfile state. The union of the nine diffs is applied atomically (manifest dirs bump + cargo update -p per package, --precise 6.0.3 pinning fastembed to the PR’s target rather than the newer 6.1.0 the resolver prefers), then verified once. The working diff was checked package-by-package against each PR’s lockfile delta — identical resolutions, including the two-version coexistence shapes (dirs 6+7 in root, reqwest 0.12+0.13 everywhere, base64 0.22+0.23 in client/steward-harness).
• Verification (the full CI-dry-run battery, run sequentially — the first parallel attempt tripped the known load-race class once, passed clean in isolation and in the sequential reruns): compile check; cargo fmt --check; clippy -D warnings on bench / default / otel / engine-crates / steward-harness / client (incl. the desktop feature); full cargo test --features bench (exit 0 through doc-tests); default-features full run 1,591 passed / 0 failed across 15 binaries; otel full run 1,595 passed / 0 failed; client suite 241 passed + wasm build + desktop check; steward-harness + engine-crates suites green. lipstyk: nothing to lint — the release touches no Rust under src/client/plugin (Cargo.toml, three lockfiles, codeql.yml, docs only).
• Ceilings (honest): aarch64 remains untested-by-CI (the standing known issue — local macOS arm64 gate is the arm evidence); the SBOM component count moves with the closure (dirs+1, tokenizers±, base64 additions) and is regenerated in-commit; no benchmark re-run — the bumps are a patch/minor refresh and the embedder eval floor tests cover the fastembed/tokenizers move.

[1.28.89] — 2026-09-14 — “Bounded”: seventh-pass closures, release 4 of 4

Closes the satellites/supply-chain band and the one fork regression from the seventh-pass security audit (register rows in AUDIT.md; finding IDs in the Engineering record below). Theme: bounded and truthful — the unbounded cache wearing an LRU label, the deprecated parser in the dependency closure, the CI gate that existed only as a procedure, and the manifest/lock mismatch the mirror-sync created. Zero wire change; zero route change; no schema.

Release notes

Security fixes

• The Signal edge tool’s recipient cache (documented as an LRU) was in fact two plain hash maps with no size limit and no eviction — a slow memory leak on a long-lived daemon. It is now bounded at 4,096 entries with oldest-quarter eviction (the same law the replay cache has used since v1.28.73), and its documentation now says what the structure actually is.
• The deprecated, archived YAML parser (serde_yaml 0.9.34+deprecated, RUSTSEC-2024-0320 class) is out of the dependency closure of both lockfiles. The only consumer was a dormant manifest loader with zero callers anywhere in the workspace; the loader is removed rather than re-implemented (hand-rolling a YAML parser for dead code would trade one hazard for another).
• The release pipeline now enforces the green-CI gate in the workflow itself: before anything publishes, the workflow queries the CI run for the exact tagged commit and refuses to publish if it is red OR absent. Previously the check lived only in the tagging helper script, so a raw git tag && git push bypassed it. Workflow permissions dropped to read-only with write access scoped to the single job that publishes the release.
• The OpenClaw memory plugin (v0.6.10) closes two discipline drifts: one error-log site now passes error text through the same sanitizer as its sibling sites, and a regex written with raw control characters moves to escaped form so the file is readable as text by security grep tooling.
• The deployed extension’s package manifest is re-pinned to the typebox version the workspace actually runs (1.3.27) — a mirror-sync had silently reverted it to 1.3.26, misstating what ships and breaking frozen-lockfile installs. The repair is mechanical: the sync script now patches declared fork-side fields from the workspace’s own catalog and fails closed if the manifest and lockfile ever disagree again. pnpm install --frozen-lockfile passes; the lockfile itself needed no changes.

Improvements

• None.

Bug fixes

• None.

Engineering record

• M1 (S7-06) — the bounded cache. tools/signal-gateway/src/cache.rs: RECIPIENT_CACHE_CAP = 4096 (the replay-cache convention) + an insertion-order VecDeque; at the cap the oldest quarter drains from BOTH legs together (phone→uuid and uuid→phone are 1:1 by construction). TTL stays lazy on the forward leg only, as before. The “LRU” label is gone: the structure is insertion-ordered with cap+quarter-evict, and the doc comment says so. signal_gateway_cache_is_bounded RED→GREEN (red: “cache grew to 4608 entries — unbounded”). Ceilings (honest): the LIVE twin — signal/worker.rs:31’s RecipientCache, the map the API and worker insert paths actually hit — is also unbounded and was LEFT AS-IS: signal-gateway is a standalone crate the operator does not deploy, and per the operator call 2026-09-14 no CI lane was added for it (the pin runs locally only). Bounding the live twin is a five-line follow-up for whoever next ships the crate.
• M2 (S7-07) — serde_yaml out, by deletion. The harness-kernel feature’s only serde_yaml consumer was loader.rs (the declarative plugin-mount manifest parser): ZERO callers across the workspace and zero doc references (the cordis.yml in docs/mcp.md is the MCP client config, unrelated). The ponytail ladder call is DROP — a hand-rolled YAML-subset parser for dead code would be a new parsing hazard, not a fix. serde (derive) had no other user in the feature either, so harness-kernel = ["dep:serde_json"] now; serde_json stays (workflow_state.rs). serde_yaml + unsafe-libyaml are out of Cargo.lock, crates/Cargo.lock, AND tools/steward-harness/Cargo.lock (the third lock surfaced at release time — steward-harness path-depends on the SDK with the kernel feature; found dirty at the final gate, diff verified to be exactly this closure shrink). SDK semver note: the crate’s own doc calls a public-item removal a breaking release; the crate is publish = false, workspace-only, and no in-tree engine consumes the loader — removal recorded here instead of a version ceremony.
• M3 (S7-08/S7-09) — plugin uniformity, 0.6.10. team-bridge.ts:451’s catch now wraps String(err) in sanitizeForBlock (the sibling discipline at the card-ensure and pause catches); the C0/DEL-collapse regex moves to escaped \u0000-\u001F\u007F form (format.ts’s style) — the file no longer classifies as binary and grep-based guards see it. Shipped as plugin 0.6.10 (CHANGELOG entry in plugin/CHANGELOG.md); the fork receives it via the M5 sync — zero hand edits to openclaw code.
• M4 (S7-10/S7-11) — the gate in the system. release.yml: a pre-publish step in the release job queries the ci.yml run conclusion for the tagged SHA (gh api .../actions/runs?head_sha=) — wait windows mirror release.sh (≤10 min registration, ≤60 min completion); red OR absent ⇒ refuse publish with a ::error::. Workflow-level permissions: contents: write → contents: read; the release job carries the only contents: write; docs-deploy keeps its existing scoped block; the four build jobs are read-only now. The normal release.sh path already waited for green before tagging, so the step finds a completed run instantly there; it exists for the git tag && git push --tags bypass.
• M5 (K7-03) — the sync script is the fork’s writer. scripts/sync-plugin.sh gains: (1) the fork-field patch table — after rsync, declared fork-side fields are rewritten from the fork’s own truth (typebox specifier ← the pnpm-workspace catalog), line-targeted so the rest of the manifest stays byte-identical; (2) the manifest==lockfile post-check, fail-closed on absent/mismatch (RED demonstrated live pre-fix: manifest 1.3.26 vs lock 1.3.27; GREEN post-patch); (3) package.json joins the declared-exception list with the delta verified typebox-lines-only. Re-run sync: the manifest mechanically returned to 1.3.27 and the lockfile is BYTE-UNTOUCHED (it already recorded 1.3.27 — the manifest moved to meet it, stronger than the plan’s “regenerate the lockfile”). Fork acceptance: pnpm install --frozen-lockfile passes (the K7-03 acceptance test), fork vitest 71/71, fork tsc clean; fork commit 58767515d46 = sync outputs only (package.json, team-bridge.ts, plugin CHANGELOG).
• Pins: signal_gateway_cache_is_bounded (RED→GREEN); extension_manifest_matches_lock_specifier lives in the sync script as the post-check — NOT a cargo test, so it does not ride the crate floor (per plan §4, said so here). Floor walk: 1,455 needle-visible #[test], UNCHANGED — the cache pin rides tools/signal-gateway (a standalone crate outside the floor needle’s server src/+tests/ walk), and the manifest pin is bash. No floor movement to claim.
• Remaining open (correcting the plan’s §7 claim): S7-05 (env-truth.sh implemented() bare-substring match) was NOT in this release’s scope and stays open — the last actionable seventh-pass LOW; it rides the next hygiene line or L8. S7-12 was a verified-good confirmation (no action). P7-01 stays the accepted wasm-seam-day ceiling; L7-07 carries to L8; K7-01/02/04 remain accepted risk (operator call 2026-09-13).
• No schema; no routes; openapi.yaml untouched; x-api-version moves with the crate version stamp (informational; the wire contract delta this release: none). Proof commits: 905bb47 (M1), a0e7ab0 (M2), e5b3376 (M3), b711ebc (M4), 4fd9069 (M5 script); fork 58767515d46.

[Unreleased] — docs-truth correction (v1.28.87 plan, no code)

Correction note (append-only; history not rewritten): the v1.28.79 headline carried a “zero” verdict on the gap ledger. That overstated: the release body itself lists 4 residuals with Loop-line owners, and the fourth-pass audit qualifies P4-01 the same way. The headline now reads “gap ledger balanced (4 known residuals with owners)”. “Balanced” means no UNOWNED gaps — not “drift-impossible”. Residual table:

grep -rn "gap ledger zer[o]" CHANGELOG.md docs/ must return zero hits; scripts/env-truth.sh and scripts/badges.sh --selfcheck are the standing docs-as-tests gates (see docs/release-checklist.md).

[1.28.88] — 2026-09-14 — “Clocktruth”: seventh-pass closures, release 3 of 4

Closes the claims-lane and regulatory-lane findings from the seventh-pass security audit (register rows in AUDIT.md; finding IDs in the Engineering record below). Theme: clocks, labels, and guards at law — the one legally-wrong clock in the repo, the guard that couldn’t see two subdirectories, and the docs rows that outlived their debunkings. Zero wire change; zero route change; no schema.

Release notes

Security fixes

• The CRA reporting runbook’s final-report clock was legally wrong for one of its two triggers: it carried “no later than one month after the 72 h notification” for BOTH. The regulation splits the triggers: a final report for an actively exploited VULNERABILITY is due no later than 14 days after a corrective or mitigating measure is available (the clock anchors on the fix, not the notification); one month after the incident notification binds the severe-INCIDENT trigger only. The runbook now carries both clocks with their trigger labels, the CSIRT framing matches the regulation (one submission via the single reporting platform reaches the CSIRT designated as coordinator for the manufacturer’s main establishment + ENISA simultaneously — not “the deployment’s member state”), and a new reg_watch pin anchors the 14-day wording so the runbook cannot silently regress to the one-clock form. Citations re-verified 2026-09-14 against the EUR-Lex full text and the Commission’s CRA reporting page.
• The regulatory calendar’s article citations moved to final-OJ numbering: the CRA two-trigger schedules sit at Art 14(1)–(2)/(3)–(4) with the severe-incident definition at 14(5), and the reporting obligations apply from 11 September 2026 per Art 71(2) (the pre-OJ cites named 14(1)/(4)/(6) and Art 69(2)). The AI Act 2026-12-02 marking horizon now cites the amending regulation itself — Regulation (EU) 2026/1744 (OJ L 24.7.2026; the pre-1.28.88 comment cited Commission guidelines as the legal basis) — and stamps the Annex III (2027-12-02) / Annex I (2028-08-02) deployer horizons from the same instrument.
• The transport-free layer guard (production code under src/service/ must never name HTTP/pool types) walked only the TOP LEVEL of the service tree — the four files under src/service/dsar/ and src/service/lifecycle/ were invisible to it. It reuses the recursive walker the no-SQL guard already had, and a new pin counts the subdirectory files it must see. Red-proof: a planted violation in lifecycle/ passed the old guard and fails the new one (the plant never landed).
• Security-docs staleness re-stamped: the revocation rows in the threat model and risk register described a “≤60s negative cache” that does not exist (revocation is a per-request registry lookup since v1.28.85 — zero staleness; the residual is registry unavailability, which fails closed). The threat model + security policy stamps moved to this release and both files now carry a self-declaring stamp policy. The verify-JSON row is scoped honestly: verification is the consumer’s out-of-band act; the server-side pin enforcement lives at parcels import only.
• The committed SBOM moves from CycloneDX specVersion 1.3 to 1.5 — the highest the generator supports (cargo-cyclonedx 0.5.9 emits 1.3/1.4/1.5 only; it reads no config file, so the pin lives in scripts/sbom.sh as a CLI flag). 1.6/1.7 are a one-line bump when the upstream tool ships them. Scope disclosure unchanged (runtime closure, 375 components).
• A new crypto-inventory census closes the rot direction the inventory’s hardcoded name-list could not: a NEWLY shipped crypto-family dependency (anything matching the sha/hmac/aes/rsa/dsa/ed25519/ecdsa/argon/blake/ … family names) now fails CI until it is mapped to a docs/crypto-inventory.md row in the same change.

Improvements

• The CRA drill script’s emitted template and timing report carry both final-report clocks with their article cites (the drill’s vulnerability scenario previously printed the one-month clock); the incident trigger’s deadline stays computed, the vulnerability trigger’s is carried as a fix-anchored formula (the fix date is unknowable at awareness time).
• The US state map gains the missing 2026-09-10 California package (SB 1119 “Adam’s Law” companion-chatbot child safety + companions) and a companion-chatbot family row (GA SB 540, OR SB 1546 — the family is now multi-state); the federal TAKE IT DOWN row’s two dates are un-inverted (criminal §2 from enactment 2025-05-19; FTC §3 enforcement live 2026-05-19); status refreshed to 2026-09-14. NIST AI RMF carries a mid-revision footnote (input window closes 2026-09-16).

Bug fixes

• The screen’s typoglycemia tier docstrings named an example the mechanism mathematically cannot match (“systme” changes the last character vs “system”; the tier requires equal first AND last characters). Examples corrected to same-first/last scrambles (“sysetm”) and the boundary is now pinned by a negative assertion. No behavior change — docstring + test fixture level only.

Engineering record

• M1 (L7-01) — the clock split. Runbook: the Final report section now states both triggers with their anchors (vuln: 14 days after the corrective/mitigating measure is available, Art 14(2)(c); incident: one month after the incident notification, Art 14(4)(c); severe definition 14(5)); the “three clocks run from awareness” preamble is corrected (the final report’s clock does not); the channel table names the single reporting platform → coordinator CSIRT (main establishment, Art 14(1)/ 14(7) fallback chain) + ENISA simultaneously; the downstream-deployers row notes that fix availability also starts the 14-day clock. reg_watch.rs: CRA doc comment carries the final-OJ structure + Art 71(2) + the re-verification date; the AI Act horizon cites Regulation (EU) 2026/1744 (adopted 8 Jul 2026, OJ L 24.7.2026, in force 27 Jul 2026; EP approval 16 Jun / Council 29 Jun) with recital 38 (four-month transitional period) and recital 40 (Annex III → 2027-12-02, Annex I → 2028-08-02) — the plan’s fallback citation (“EP approval + watch row”) was NOT needed: the OJ number confirmed. Drill script: template + timing report carry both clocks (DUE_FINAL split into the incident date and the fix-anchored vulnerability formula).
• M2 (R7-09) — the recursive walk. collect_service_rs_files extracted and made recursive (the no_sql_in_handlers_enforced idiom); the guard’s production-region split and message unchanged. transport_free_guard_walks_recursively counts subdirectory files ≥ 4 (the plan’s draft said “≥ 5”; the walk-measured truth is 4 — dsar/sweep.rs + lifecycle/{decay,fetch,purge}.rs — the floor is set to the tree’s truth, unforwardable padding declined). Red-proofs: (1) against the old top-level collector the coverage pin FAILED at 0 subdirectory files; (2) with the fix, a planted use axum:: in lifecycle/ FAILED the guard naming the file (plant never landed); (3) the census direction was red-proofed the same way with a planted p256 dependency (below).
• M3 — the docs-truth batch. T7-02: the tamper-evidence scope sentence (chain + UMP evidence rows; business rows behind the chain = the host-compromise ceiling) in the threat model’s §4 item 2b. T7-03: three THREAT_MODEL rows + risk-register R-14 re-stamped to per-request/zero- staleness (R-06 carried the same dead “≤60s” cell — fixed in the same stroke); residual reworded to registry-unavailability-fails-closed. T7-04: chose the census over the comment-softening (~15-line budget; the census is the class-closing direction): crypto_inventory_census_maps_ every_crypto_crate — a closed 8-row crate→inventory mapping (every row must still be a real dependency AND still inventoried) + a crypto-family heuristic over [dependencies] (a matching unmapped crate fails with a ship-the-row-in-the-same-change message). Red-proof: planted p256 → FAIL naming the crate; removed → green. T7-05: THREAT_MODEL + SECURITY stamps moved to this release; both files gained the standing “stamp moves in the same commit as the claim it covers” policy line. T7-06: the verify-JSON row gains the out-of-band-act scope sentence (the zero-production-call-sites finding). R7-10: docstring fix per the plan’s default (the tier is an additive tripwire; widening changes verdicts and needs its own evaluation — not done): “systme” → “sysetm” at both docstrings, the test fixture aligned, and a negative assertion pins the first/last-char boundary. R7-11: scope disclosure at both sites (the THREAT_MODEL standing-ceilings bullet + the chunker’s byte-split arm comment); the tag-aware split was NOT taken (it changes chunk shapes and needs its own evaluation). L7-02/L7-03/L7-06: map rows as in the Release notes; the COMPLIANCE AI Act row also gained the 2026/1744 recital-40 deployer horizons (the docs half of L7-04).
• M4 (L7-05) — the SBOM spec, honestly. The plan’s target (spec 1.7) is unreachable with the current toolchain: cargo-cyclonedx 0.5.9 is the latest published crate, its --spec-version tops at 1.5, and (found during execution) it reads NO config file — env/CLI only (verified in its source; the .cargo/cyclonedx.toml route the plan guessed does not exist). Shipped: --spec-version 1.5 pinned in scripts/sbom.sh with the ceiling comment; sbom/brain-server-1.28.88.cdx.json regenerated (specVersion 1.5, 375 components — the runtime-closure scope disclosure is unchanged); the tool upgrade path is a one-flag bump. No consumer of the specVersion string exists in the repo (grepped) — nothing else moved.
• Pins: reg_watch_runbook_clock_anchor (RED→GREEN: failed on the missing 14-day clock, green on the split runbook) + transport_free_guard_walks_recursively (RED→GREEN: 0 subdirectory files → ≥4) + crypto_inventory_census_maps_every_crypto_crate (green on arrival, red-proofed by plant). typoglycemia_scramble_caught extended with the boundary assertion. Floor walk: 1,455 needle-visible #[test] (1,452 → 1,455; the three new pins all ride plain #[test]).
• Citations re-verified at execution date (2026-09-14): CRA Art 14 paragraph structure + clocks (EUR-Lex full text + the Commission reporting page + the Art 14 mirror); Art 71(2) application date; Regulation (EU) 2026/1744 OJ number + recitals 38/40; TIDA §2/§3 dates; SB 1119 (signed 2026-09-10), GA SB 540 (eff 2027-07-01), OR SB 1546 (signed 2026-03-31), CycloneDX current-spec status. The runbook’s “verified YYYY-MM-DD” line and the reg_watch doc comments carry the fresh date.
• No schema; no routes; openapi.yaml untouched; x-api-version unchanged (no wire contract move — it stamps from the crate version at compile time, which moved as part of the release itself). Ceilings (honest): SBOM spec 1.5 is the tool ceiling (1.6/1.7 await upstream); transport_free_guard scans text, not AST (cfg(test)-region exemption is a split heuristic, unchanged); the census’s family heuristic can be evaded by an innocuously-named crypto crate (closed names fail, stealth names are the supply-chain lane’s problem, not the inventory’s); the US map’s SB 1119 operative dates are marked verify-with-counsel (the bill’s effective-date section was not re-verified against primary text this pass).

[1.28.87] — 2026-09-14 — “Ownerstamp”: seventh-pass closures, release 2 of 4

Closes the four LOW/INFO surface findings from the seventh-pass security audit (register rows in AUDIT.md; finding IDs in the Engineering record below). Theme: the seams’ last mile — the DSAR root semantics question, the one roster that attested a seam it lacked, the admin-evidence surfaces the unconditional read-seam law hadn’t reached, and the site-table guard hardened to read code, not prose.

Release notes

Security fixes

• DSAR roots now cover operator-authored ingests. Every content write carries an owner stamp: the acting principal’s sub, or the fixed loopback label when no principal resolved (opaque-token superuser). The locate query keys on knowledge.owner, so a purge/export for the operator subject now finds the operator’s own ingests (live drill: the seventh-pass probe that found 0 roots now finds the row). Write-side only — historical rows keep their NULL owner and stay stamp-blind by declaration (dated; no migration, no OR-arm sweep: a legacy arm would mis-attribute every NULL-owner row in multi-principal trees). Residual disclosed: suggest_feedback keeps the principal-sub-or-NULL shape (the sweep’s feedback arm is unchanged).
• The /ops/crew roster and the /ops/skills feed emit their stored strings through the read seam: principal/current_case_ref were already invisible-stripped at the roster core; roles, skills, and the Watchbill site now ride sanitize_read too. The skills view’s “same posture as the roster view” comment is true now.
• Admin-evidence surfaces ride the seam: breach list/detail (narrative, event bodies, noted_by), transfer TIA/DPA pre-fills, role + profile descriptions, and the /audit listing (the actor sub is the row’s one non-hash string) pass a deep string-leaf composition of sanitize_read at the emission boundary. No digest impact — none of these fields bind review_digest. Idempotent on clean content.
• The read-seam wiring guard reads code, not prose: the site table’s handler_body extractor comment-strips sources (string-aware: line, block, and doc comments; "…" strings with escapes; the '"' char literal; r#"…"# raw strings) before the substring assert, closing the comment-naming-the-symbol false pass. The same-commit site-table row is now a release-checklist standing rule.

Bug fixes

• None. (The roster gap was attestation drift on two of five fields — the fix widens an existing strip, it changes no valid output.)

Improvements

• None user-visible. The hardening is byte-identical on clean content (the seam’s fast path).

Engineering record

• M1 (F7-02) — stamp decision: (a) stamping, not documentation. The product-honest default per the plan: owner becomes a total attribution ledger. One helper (content_owner_stamp, beside principal_to_owner) + the fixed LOOPBACK_OPERATOR_OWNER label; five write edges swapped (/add, /ingest, /ingest/markdown, structured /ingest, the approve promotion insert — proposal creation stamps the candidate the approver later promotes). Deliberately NOT swapped: store_procedure’s owner feeds the audit actor only (procedure rows carry no owner column — schema-level gap beyond this release’s no-schema scope), and the QA-scoping owner on /ingest/proposal keeps its declared legacy default (proposals are not DSAR-locate targets). UMP owner uses are redaction decisions — stamping there would have let a principal-less request claim rows.
• M2 (F7-05) — the strip lands at the handler emission map (both crew views), the roster core’s narrower invisible pass stays as defense in depth. Red-first proof: the first pin attempt planted only principal/current_case_ref and PASSED (the core already strips them) — the shipped pin plants hostile roles_json, a principal_skills skill, and a hostile site shift so the guard has teeth against the actual gap.
• M3 (F7-06) — one sweep, one helper (sanitize_value_strings in handlers/mod.rs), nine emission sites. The deep pass shapes string VALUES only; keys are server-defined. Static TIA prompt text verified seam-clean (no markdown-ref/tag constructs) before shipping.
• M4 (F7-07) — handler_body returns an owned, comment-stripped body; every consuming guard (authz-gate coverage, screen routing, read-seam table, audit-order) inherits the hardening. Red-proof pin covers the comment false-pass, the honest call site, and the raw-string/char-literal lexing hazards. The extractor’s residual ceiling (heuristic lexer, not a parser) is stated in its own doc comment.
• Pins: dsar_roots_cover_operator_ingests_or_documented (RED→GREEN), crew_roster_strings_pass_the_seam (RED→GREEN), admin_evidence_surfaces_pass_the_seam (RED→GREEN), handler_body_ignores_comments_naming_the_symbol, content_owner_stamp_always_attributes. Site table +12 rows (both crew views; the helper; four breach/transfer pairs… breach list+detail, TIA+DPA, roles list+get, profiles list+get, /audit) — every row verified against real sources through the hardened extractor. Floor walk: 1,452 needle-visible #[test] (1,450 → 1,452; the three surface pins ride #[tokio::test], which the spire needle does not count — same walk-measured-truth rule as .86).
• Live drill (fresh DB, test port, opaque mode): the F7-02 probe (markdown ingest → /dsar export for loopback → the operator’s own row in the bundle) + planted-invisible checks on the roster and breach surfaces; live DB hash-verified untouched.
• No schema; no routes; openapi.yaml untouched; x-api-version unchanged (no wire contract move — the hardening is content-level at existing surfaces). Ceilings (honest): historical rows stay stamp-blind; suggest_feedback owner shape unchanged; procedure rows carry no owner column at all (schema-level, beyond the no-schema scope); the site table remains a regression lock, not a detector (the checklist rule is process, not code).

[1.28.86] — 2026-09-13 — “Attrbane”: seventh-pass closures, release 1 of 4

Covers every commit from tag v1.28.85 (884ee17) to this release — git log v1.28.85..v1.28.86 reproduces the range, and every bullet below names its proof commit. The seventh-pass audit’s first remediation release: the read seam’s attribute tier, the graph family on the seam with a decline-and-count write edge, in-tx evidence for every caller-content write, and the plugin’s dormant defenses wired (0.6.9). Digest invalidation (expected, disclosed): stored rows whose text contains a newly-stripped attribute move their review_digest — outstanding approvals for such rows fail closed with 409 at approve time and must be re-reviewed (observed live in the release drill: 409 on the pre-upgrade digest, 200 after re-approval). Additive wire only (edges_skipped); no schema; no routes; no new dependencies.

Release notes

Security fixes

• Event-handler attributes and dangerous URL schemes no longer survive the read seam (proof 713748a). Event-handler attributes (onclick, onpointerover, …) and dangerous URI schemes (javascript:/vbscript:/data:, including mixed-case, entity-encoded, and whitespace-split forms) on SURVIVING elements no longer pass sanitize_read verbatim — the drill demonstrated all five classes riding raw on v1.28.85 recall output. The tier is scheme-hostile, not attribute-hostile: benign http(s) hrefs and prose angle brackets survive byte-identically, a dropped attribute never synthesizes prose, and the weld family’s pinned behavior is unchanged.
• The graph surfaces are no longer a raw read seam, and a hostile heading can no longer become graph structure (proof 0d797ba). /graph/entity, /graph/relations, /graph/traverse, and /graph/relationships/{id}/history emitted stored entity names and relation types raw; markdown ingest made those names attacker-writable (a ## <img src=x onerror=…> heading became a graph entity). Every emitted string field now passes the read seam, and the markdown write edge DECLINES non-conforming names: the ingest stays 200, the skipped edges are counted in the response’s new edges_skipped field (plus one audit note), and no entity row is created. The structured path 400s on an entity_type outside [a-z0-9_-] (explicit API contract; values are lowercased first, so existing “Person”-style types become “person”).
• Every caller-content write carries its evidence row, inside the write’s own transaction (proof 48fef68). POST /procedure stored caller content with no audit row; structured /ingest audited only graph edges; /add and /ingest/markdown recorded their audit AFTER the commit (the crash window the audit-per-write law closed). All three holes closed: a procedure audit kind on the hash chain, a row audit beside the edge audits, and both legacy recordings moved inside their transactions.
• The plugin’s dormant defenses are wired (plugin 0.6.9; proof 15a7c99 + e2cc810, fork 5b64e7a). The hostile-element mirror (exported since 0.6.8, never called) is now invoked inside sanitizeForBlock at the server-canonical position; the raw proposal rows, graph-traverse paths, decision-evaluate rule text, and label fields no longer bypass the per-field boundary (the capture-trigger sourcePrompt is dropped from proposal details entirely — counts, not bodies).
• The plugin-sync guard passes on its own live pair and still fails real drift (proof 8830209). sync-plugin.sh’s post-sync check is now the declared-exception form (a named exception with a verified reason), and the sanctioned format.test.ts delta was eliminated canonical-side by adopting the fork’s import order — the check passes on the live pair and still fails real drift.

Bug fixes

• None.

Improvements

• Markdown ingest responses carry edges_skipped so declined graph edges are visible to callers (proof 0d797ba).
• Docs truth: THREAT_MODEL’s hostile-markup row and architecture.md’s read-seam sentence state the attribute tier, and the seventh-pass register’s closed findings are recorded in AUDIT.md (proof 5145f4b).

Engineering record

• Range: 10 commits on main (713748a M1 attribute tier, 0d797ba M2 graph seam, 48fef68 M3 audit law, 15a7c99/7bcbecb/8830209/e2cc810 M4 plugin wiring incl. the sync-script-mandated oxfmt pass and the S7-04 delta elimination, this commit M5) + fork commit 5b64e7a (sync 0.6.9, vitest 71/71, tsc clean, byte-parity verified). M4 is 4 commits, not 1: the sync script refuses to ride an uncommitted format pass, and the typebox-class import-order alignment eliminated the declared delta.
• Red-first pins (all failed against their pre-fix trees): the drill canary family survived sanitize_read verbatim; the hostile heading emitted raw through /graph/traverse; the procedure write carried zero audit rows; the source-order lock proved both legacy handlers recorded after tx.commit(); the plugin img canary survived sanitizeForBlock verbatim; the tools-lane pin rode the raw proposal row against the 0.6.8 fork.
• In-tx rollback proof: a trigger poison on the second step’s edge insert aborts the procedure tx and the audit row rolls back WITH the chunks (procedure_writes_carry_in_tx_audit’s twin, in-suite — a live server tx cannot be poisoned externally, disclosed honestly).
• Live drill (fresh DB /tmp/brain-attrbane/brain.db, port 18766, Twokeys token file, copies-only; live DB hash verified unchanged): canary rows raw on the 1.28.85 binary → attribute-free on 1.28.86; pre-M1 approval → 409 conflict → re-review 200; hostile-heading ingest 200 edges_skipped:2, zero hostile entity rows, traverse clean; procedure write → procedure audit row on the chain; /ump/audit/verify ok:true (6/6 signed).
• Gates: full cargo test --features bench,migrate green per milestone; clippy -D warnings bench + fmt clean; plugin vitest 62/62; floor walked at this commit: 1,450 crate #[test] pins (1,448 + 2; the plan’s +6 are real but four ride #[tokio::test], which the spire needle does not count — CRATE_TEST_FLOOR set to the walk-measured 1,450).
• Ceilings (honest): the plugin mirror is the ELEMENT backstop — the attribute tier remains the server seam’s job (recall hits arrive pre-sanitized; the mirror covers fields the server does not own); style="url(javascript:)" and CSS-class vectors stay out of scope (style is a stripped element on every other path; inline style attributes on surviving elements are the documented bare-URL-class ceiling); the entity_type lowercasing changes stored values on the structured path (disclosed above); DSAR purge of digest-moved proposals is unnecessary (proposals re-review, they do not re-bind old bytes).

[1.28.85] — 2026-09-13 — “SixthPass”: sixth-pass closures

Covers the sixth-pass audit’s two findings, closed red-first — git log v1.28.84..v1.28.85 reproduces the range, and every bullet below names its proof commit. No schema; no routes; no wire change; no new dependencies.

Release notes

Security fixes

• Forget erasure audit rows carry the Forget kind (proof 2a40aa4). The chunk-forget path wrote its in-tx evidence row as kind ingest, so kind-filtered audit consumers missed erasures. Both rows (the erasure itself and the per-proposal scrub row) now write kind forget. Historical ingest-kind forget rows keep their meaning; new rows are labeled what they are.
• The deployed fork extension carries the hostile-element mirror (proof ace4f986 in the openclaw fork). The server’s 26-element strip, the MathML fallbacks, and the fixture lane were missing from the fork extension (last sync 0.6.0). Synced to plugin 0.6.7; byte-parity verified, 70 extension tests green, typecheck clean.

Bug fixes

• None.

Improvements

• Stale forward-plan files marked superseded: their contents had already shipped inside earlier releases without consuming those numbers, and the release queue now names the real head (proof cf380eb).

Engineering record

• Range: sixth-pass audit on v1.28.84 found 2 findings (G6-01 MED, G6-02 LOW); both closed red-first (forget-kind pins failed pre-fix, green post-fix; fork diff empty post-sync). Commits: 2a40aa4 (Forget kind), ace4f986 (fork sync, fork repo), 023e89a (oxfmt churn from the sync pass).
• Live drill (fresh DB, test port, Twokeys): 26-element strips held incl. opaque math/style; revoke-unknown returns 200 known:false + warning (A5-01 availability-first holds); kill-switch 401 live; forget response carries retained_proposal_copies + scrubbed_count; webhook-without-secret refuses boot; live DB untouched.
• Ceilings: full cargo test gate per the T5-01 law; client rendering leg code-shape only; webhook-gate bind ordering flagged INFO (verify config gate precedes listen).

[1.28.84] — 2026-09-13 — “Quarterly”: security fix release

Covers every commit from tag v1.28.83 (9f1180e) to this release — git log v1.28.83..v1.28.84 reproduces the range, and every bullet below names its proof commit. The fifth-pass audit’s remediation track, plus the docs-truth pass. No schema; no routes; the /ready probe response changes shape (text/plain → JSON object, openapi updated in-commit — load-balancer probes reading the body must read status instead of the raw text); x-api-version unchanged.

Release notes

Security fixes

• Revoked principals can no longer hold a live SSE stream (proof 60c344c). Both SSE endpoints ran their authorization check once at subscribe time — a principal revoked mid-stream kept receiving events until the connection dropped. A single guarded pump loop (sse_reauth) re-consults the revocation registry every BRAIN_SSE_REAUTH_SECS (default 30; fail-closed on parse), kills the stream with a {revoked:true} frame, and the reconnect gets 403. Setting =0 restores the old admission-only behavior, pinned. The default is ON — operators who need the old cadence must opt out loudly.
• Alert/DSAR webhooks are signed by default (proof 60c344c). When a webhook sink is configured, the server now signs every send (HMAC-SHA256 over the raw body, constant-time compare on the receiver side) and REFUSES BOOT with a URL but no secret — an unsigned exfil channel can no longer be configured by omission. =0 disables loudly and the posture is surfaced at /ready; the DSAR/Art-19 path has no opt-out. Receivers verify against the existing audit-key convention.
• The read seam strips the complete hostile-element set (proof 2567d84). The element strip grew from the .72 set to 26 elements — math and style now opaque-strip (tag AND inner content; a demonstrated math inner-content leak was the red-first proof), with details, body, button, select, marquee, dialog, animate, picture, noscript added plus 30 MathML child fallbacks. Storage stays verbatim; review_digest moves only for rows that carried the newly-stripped markup (re-review required at approve, same digest-invalidation discipline as the .76 fixed-point change).
• Embedder saturation is measured, not guessed (proof 935d215, design track). The static embedder path gains a std-only saturation gauge (SatGauge/SatGuard; contention measured 8×50ms) so the serialized-inference cost class that pinned all screened writes in .76 is now visible in-process instead of discovered under load.

Improvements

• Newer-schema databases refuse to open (proof 935d215). The boot gate now refuses to open a database written by a NEWER schema (was: undefined behavior on unknown columns), with a migrate-rehearse parity check (55 tables) proving the refusal matches the rehearsal path.
• Honest-by-construction docs gates (proof 89a6233, docs/scripts only — zero code paths). The README UMP badge derives from the CI conformance gate (loud degrade to “self-attested” when the gate is absent); the tests badge carries a count disclaimer with the log hash; the gap ledger reads “balanced (4 known residuals with owners)” — balanced, not zero, per the append-only correction note; and scripts/env-truth.sh stands as the docs-vs-code env-var gate. The release checklist gains the SBOM scope disclosure per CISA-2026 (runtime closure, NOT the whole dev+build tree — 375 vs 520 packages at .83), the 8-route intentional OpenAPI exclusion table, and the 7-route well-known wiring table.
• Error taxonomy as a test (proof 935d215). A 25-row error taxonomy with operator-safe Display impls is pinned by tests/error_taxonomy.rs — error strings an operator sees can no longer leak internals by drift; tests/singularity_pins.rs adds 7 pins over the singular invariants (revocation-cache statelessness — the “60s staleness” claim debunked, zero staleness by construction — included).

Engineering record

• Range: 5 remediation commits, v1.28.83..v1.28.84 (7d63f32, 2567d84, 60c344c, 935d215, 89a6233), plus the release-line commits: the release prep (4e20302 — version bump, SBOM artifact, README badges, and the gate repairs it carried: the env-mutation test helpers route through the existing set_or_remove_env after lipstyk flagged four verbose-match matches on the webhook/SSE lane, and the client vendored arrays were rustfmt’d) and the CI client-gate fix (strip_hostile_elements + the two vendored tables carry the house allow(dead_code) reservation — the mirror’s non-test caller is the wasm read seam, still pending; CI clippy -D warnings caught the dead code the local client-gate skip let through — the v1.28.31 lesson again). Red-first discipline held: the hostile-element and SSE-kill/signing tests failed pre-fix and green post-fix (14/14 on the signing lane).
• CodeQL hard-coded-key alert #73 cleared (proof 7d63f32). The wrong-secret leg of the bridge signature constant-time pin used a literal test key; the same generated-key fix as the Vigil set (testkeys::unit_hmac_key) replaces it. Test-only — no shipped behavior change.
• The four fixture lanes for the hostile-element set (server scan vs plugin/fixtures/hostile-elements.json, plugin vitest 61/61, client vendored strip, fork host fixture) close the R-01 drift class: no tree can widen or narrow its strip alone.
• Validation: full cargo test green at the release commit; clippy -D warnings clean (bench/migrate, default, otel); fmt clean; engine-crates + steward-harness green; badges --selfcheck clean. CRATE_TEST_FLOOR 1,418 → 1,448 (walk-measured).
• Ceilings (honest): the SSE re-auth interval is polling, not push-reactive — a revocation lands within BRAIN_SSE_REAUTH_SECS, not instantly; =0 is a supported posture, not a hidden default. Webhook signing covers the two env sinks; the hostcall HTTP path keeps its allowlist (loopback mediation, unchanged since .69). The saturation gauge observes the static embedder; the neural backends’ serialization remains mutex-observed only. The /ready shape change is the release’s only wire-visible delta and is additive JSON — but consumers scraping the plain-text body must migrate.

[1.28.83] — 2026-09-12 — “Recall”: security fix release

Covers every commit from tag v1.28.82 (1fa1b77) to this release — git log v1.28.82..v1.28.83 reproduces the range, and every bullet below names its proof commit. Nine audit-round commits landed after the v1.28.82 tag and were never tagged, so they ship here alongside the six follow-up fix commits; the openclaw-fork companion ships in that repo. No schema; no routes; wire additive only; x-api-version unchanged.

Release notes

Security fixes

• Revocation never refuses (proof 777676f, supersedes untagged aacee4d). POST /ops/agents/revoke always writes: revoking an identity the deployment has never seen returns 200 with known:false plus a warning naming agent@loopback, instead of reporting blind success or refusing. The earlier 400 refusal for unknown names never reached a tag and is replaced here; net user-visible behavior is warn-not-refuse from the start, and allow_unknown is accepted-and-ignored for wire compatibility. Verified by revoking an unseen identity, re-revoking it (second call reports known:true, proving the write landed), and confirming the loopback agent revokes cleanly.
• Revoke input discipline + wedge surfacing (proof 777676f + 5ab0f3f). Length and whitespace checks run before the identity lookup — padded names get a loud 400 principal_malformed rather than a silent trim onto an identity the operator did not type. The response carries wedged_delegations: active runs the revoked principal still owes results on stay active with an uncompletable delegation, so the operator gets their ids to cancel by hand instead of discovering the wedge.
• Erasure discloses retained decision-record copies (proof b36a603, committed after the v1.28.82 tag, first tagged here). A promoted chunk’s content survived verbatim in its approval decision record while DELETE /memory/{id} answered bare {"deleted":true}. The response now names retained_proposal_copies, and ?scrub_proposals=1 replaces retained content with a dated marker (one audit row per proposal, in the same transaction).
• Single-chunk erasure is evidenced, residue-free, and bounded (proof 52b9060, extends b36a603). The erasure writes its own audit row in the same transaction (every other mutation already did); chunk-keyed suggestion-feedback residue is deleted with the chunk, as the subject-purge path already does (relationship orphans and read-trace retention stay, documented as deliberate); the retained-copy disclosure is capped at 500 rows with a retained_truncated flag (correlation is exact bytes — documented at the seam), and scrubbed_count reports rows actually scrubbed.
• Read-seam source labels on both by-id paths (proof 518c9fd + 9324d88). 518c9fd (committed after the v1.28.82 tag, first tagged here) pins the /get/{id} source label against hostile markup with prose preserved. 9324d88 converges /multi-get onto the same shape: the batch projection carries the ingest-kind label and each row emits it through the same sanitization; created_at stays by-id-only.
• Fail-closed injection thresholds (proof bc326df). Misconfigured BRAIN_INJECTION_THRESHOLD_HIGH/LOW values now refuse startup instead of silently falling back to compiled defaults (an inverted high/low pair refuses too) — matching every other environment-gated setting.
• Segment-exact content-security-policy seat (proof bc326df). Only /, /app, and paths under /app/ receive the WebAssembly-friendly policy; lookalike paths such as /apple now get the strict API policy. Covered by near-miss probes.
• Secret-parent directories are owner-only (proof bc326df). install-service.sh restricts the token, audit-key, and classifier parent directories to mode 0700 (their files were already 0600).
• Invisible-character handling pinned across all four code trees (proof 5e7d503, committed after the v1.28.82 tag, first tagged here) + plugin 0.6.6/0.6.7 (proof d63ddcb). One shared fixture (plugin/fixtures/invisible-classes.json) with a lane per tree — server (exhaustive over all scalar values), plugin, client, and fork host (which documents its deliberate superset) — so no tree can drift silently. The plugin releases carry the fixture (test/fixture only, no runtime change) and align the typebox dependency four-way at 1.3.26.
• Openclaw fork companion: turn-prepare context sanitized (proof 60fb64b6aea in the openclaw fork). Turn-prepare and heartbeat contributions joined the model prompt without sanitization on either runner path; they now pass through the same joined-accumulator sanitization as prompt-build contributions. Covered by a five-case regression suite that fails with the fix reverted. The host invisible-character set documents its canonical-subset contract.

Improvements

• US state-law map current (proof c4a6254, verified against primary sources 2026-09-12). New federal TAKE IT DOWN row (48-hour removal duty); new Colorado chatbot-safety and Illinois frontier-AI rows with corrected dates; Connecticut/Florida/Washington precision fixes; a federal-floor note in the deepfake section. Adds the erasure-path directive to docs/compliance.md: subject-wide purge for erasure demands, ?scrub_proposals=1 for single chunks, bare single-delete preserves the decision record by default.

• EU AI Act application clock (proof 947c531, committed after the v1.28.82 tag, first tagged here). The regulatory watch now tracks both the general application date (2026-08-02) and the legacy-system grace end, with the dual-date statement in docs/compliance.md — the grace row alone could read as duties starting in December.

• Lock-poisoning coverage is behavioral end to end (proof 9324d88). The middleware 500 path is now exercised over a genuinely poisoned token store, registry-lock propagation is exercised in-module, and agent-origin labeling is exercised through the real recall-hit builder (moved there from a test that passed with the labeling deleted). The remaining cross-gate checklist asserts the stable operator-visible denial vocabulary.

• Handler SQL guard covers tab/newline forms and states its scope (proof bc326df). The statement counter matches keywords with identifier boundaries on both sides (no false fire on identifiers such as kind_update or method calls such as .insert(; UTF-8 boundary-safe), and its documentation now states plainly that it is a regression lock for trusted committers, not an anti-concatenation boundary.

• Documentation scope corrections (proof 0c3539d + 69e0d68, committed after the v1.28.82 tag, first tagged here). The read-seam checklist comment states its regression-lock scope, and the threat-model exit-gate matrix notes that unchecked columns are future major lines while the current line gates per release.

• Release-checklist gate law (proof c4a6254). The checklist now states that only the full cargo test invocation counts as green — sliced runs (--lib, single binaries, name filters) are diagnostic only. A prior closure record had listed sliced runs as green while one test binary was red. Bug fixes

• Drain remainder bookkeeping simplified with identical behavior (proof 5ab0f3f — recount + loud remainder row preserved).

• Transfer-register audit writes warn loudly on drop instead of discarding silently (proof 5ab0f3f — best-effort kept, silence not).

Engineering record

Red-first pins per fix (revoke-advisory + malformed, forget evidence/bound/count, thresholds, multi-get source, builder-driven origin, middleware-500, registry-poison, CSP near-miss, needle tab/LF/left-boundary). Full gate: complete suite green (1,537 tests); clippy bench/default/otel clean; fmt + lipstyk clean; engine-crates + steward-harness green; badges selfcheck clean; fork vitest lanes green. CRATE_TEST_FLOOR 1,381 → 1,418 (walk-measured — the floor sat stale through .78–.82; this catches up honest). ponytail: this release does NOT add per-principal quotas, does NOT gate MCP tool first use, does NOT build the taint lattice, and does NOT touch any upstream-tracked fork file.

[1.28.82] — 2026-09-12 — “Vigil”: the deep-round fix release

Four parallel audit lanes (server auth/seams; storage/crypto/egress/ workflow; fork-vs-upstream diff; docs reverse-truth) over v1.28.81 found 19 findings — every code-closeable one is fixed here, the rest are disclosed ceilings with owners. Full disposition table in docs/AUDIT.md §2026-09-11 deep round. No schema; no routes; wire behavior only tightens.

Release notes

Security fixes

• Cross-tenant channel drain/ack closed (HIGH). The bridge HMAC authenticates kind+tenant together, but the drain/ack queries dropped the tenant — a same-kind foreign tenant’s bridge could see, consume, and ack another tenant’s channel/out envelopes and handover pings. Every predicate now scopes by the authenticated pair.
• Read-seam gaps closed. /get/{id} sanitizes the stored source label (the /quarantine sibling posture); /procedure/{id}/steps passes root + step title/content through the seam; the trace replay strips every string value. All three sites joined the machine seam table.
• traverse: scopes are exact-kind. A traverse scope can no longer satisfy Read gates (the documented intent, now enforced); read/write/ admin still satisfy Traverse.
• Revocation drain actually pages. Cancels run INSIDE the paging loop — the old shape re-read the identical first 200 rows and capped distinct victims at 200.
• DSAR subject_exact arms can match. Exact mode now matches the subject as a whole JSON string value (traces, dry-run counts); object equality never matched a row.
• Plaintext temps locked down. write_atomic + restore-verify snapshots are 0600 at creation; the standby promote workdir is 0700 with its WAL chunk 0600 — decrypted store bytes are never world-readable in shared dirs.
• Legal-hold re-application is honest. Insert outcomes are counted; a shortfall logs error! naming the id instead of claiming success.
• Provenance marks reject unknown fields. Extra keys inside a provenance object fail closed as Tampered — unbound data can no longer ride a verified mark.
• Model-manifest pinning refuses symlinks (the reader followed them out of the pinned tree).
• Egress table gains RFC 8215 local-use NAT64 64:ff9b:1::/48 (edge-pinned beside its well-known twin).
• Channel-bridge egress hardened. The bridge client never follows redirects, and the Graph download_url (a response-body URL) is validated (https only, no IP literals, no local names) before the bearer-attached fetch.
• Input bounds. source is capped at 64 bytes on both write seams; /auth/revoke caps jti/iss (128/256).
• CodeQL: all 26 open alerts cleared — every literal HMAC secret in test fixtures replaced with generated key material (testkeys helper; xorshift over a numeric seed, no literal key bytes reach a crypto sink). House precedent honored: fixed in code, zero dismissals.

Improvements

• The fork’s MCP catalog pins gained a PRODUCTION ack path (BRAIN_MCP_PINS_ACK=1 for one run — see the openclaw-fork changelog); the plugin (0.6.5) refuses multi-line BRAIN_TOKEN env values.
• The /app public seat matches the exact segment; the hostcalls dormancy pin walks src/ recursively (the docs claim is now true at every depth).
• Docs truth: THREAT_MODEL §5 names the /export verbatim + OTLP ceilings; the architecture law names its one seam exception; the deployment runbook carries the loopback-posture checklist (BRAIN_REQUIRE_AUTH=1, adopted live on the reference deployment).

Bug fixes

• None beyond the above (every item here is also a behavior fix).

Engineering record

Validation at the release commit: lib 1,202 passed / 1 ignored; main_suite 196; all 13 test binaries green under bench; default + otel clippy/test lanes clean; channel-bridge 39/39; signal-gateway green; fork suites green (pins 11/11, plugin 187/187); cargo audit exit 0; merge-tree vs upstream CLEAN (zero upstream-tracked fork files touched). Disclosed ceilings (owners in THREAT_MODEL §5b): OTLP exporter outside the validated client (operator-configured endpoint); fork pin coverage asymmetric until the U3 upstream PR (spec filed); upstream-owned qs/hono/joi advisory overrides (spec filed). ponytail: this release does NOT implement the OTLP guarded exporter, does NOT gate MCP tool first use, does NOT build the taint lattice, and does NOT add per-principal quotas.

[1.28.81] — 2026-09-11 — “AgBOM”: the live agent bill of materials

GET /ops/agents/bom (Read on global) emits the dynamic half of the agent bill of materials in CycloneDX 1.6 shape — regenerated per request, never a build snapshot: the server service, the embedder and classifier models, the knowledge-store domains, and the enforcement posture (authn, write posture, quorum, injection policy), with the static SBOM artifact named. MCP tool inventory stays fork-side (catalog pins); the calling agent’s own tools and models are out of this process by construction. No schema; x-api-version unchanged.

Release notes

Improvements

• Live AgBOM endpoint for procurement and runtime auditors: one call inventories models, stores, and posture with bom-ref URNs and a timestamp.

Bug fixes

• None.

Engineering record

Red-first matrix coverage (literal-200 anchor plus CycloneDX shape test); route-coverage and authz guard tables extended in-commit; openapi.yaml carries the new path. Full suite green; clippy bench/default/otel clean; fmt clean.

[1.28.80] — 2026-09-11 — “Lockdown”: transport, approval, and visibility hardening

Authenticated plugin transport never follows redirects; the prompt merge seam sanitizes system-prompt input; multi-block tool results ride a single inseparable envelope; catalog-pin acknowledgments are signed; total-grant scopes and unauthenticated boot are fail-closed admissions; approvals can require two distinct principals; recall, health, and verify responses surface the posture that was previously implicit. No schema; wire additive only (included_global, authn, allow_policy_bypasses, verify authentication, plus GET /ops/agents/bom — the live AgBOM inventory in CycloneDX 1.6 shape); x-api-version unchanged. Also ships docs/US_STATE_MAP.md: a date-verified (2026-09-11) operator runbook mapping TX/CA/CO/UT/IL/NYC/CT/FL/WA duties to live component evidence, with a live-now vs scheduled status snapshot — the US counterpart to the CRA reporting runbook.

Release notes

Security fixes

• Authenticated transport never follows redirects. The plugin HTTP client sends redirect: "manual" and refuses any 3xx before the bearer credential can ride it to another origin. The pre-send origin pin and the response re-pin remain as second layers.
• Prompt merge seam sanitizes system-prompt input. Plugin-supplied system prompts pass the same invisible-character strip and forged-marker neutralization as every other context segment at the single merge seam.
• Single-block envelope for multi-block tool results. All instruction-capable text from tool results is joined into one enveloped block — prefix, payload, and suffix can no longer be separated by a downstream concatenation or truncation. Every text block passes the full sanitizer (invisible characters, forged boundary markers, model special tokens); text blocks are bounded at 8,000 characters; oversize images are withheld as labeled placeholders.
• Signed catalog-pin acknowledgments. Pin files carry a detached Ed25519 signature over their exact bytes (trust-on-first-use keypair beside the pins, private key 0600). Forged, hand-edited, or unsigned legacy pin files fail verification and rebuild loudly — every tool re-notifies until re-acknowledged, never silently.
• Total-grant scopes require explicit admission. A scope wildcarding both team and domain (*/*) grants nothing unless BRAIN_ALLOW_WILDCARD_GRANT=1 is set (fail-closed parse; loud boot warning when admitted). Wildcards over a named domain keep their prior meaning.
• Unauthenticated boot requires explicit admission. BRAIN_REQUIRE_AUTH=1 refuses to start when no token resolves (fail-closed parse). Without it, a token-less boot logs a loud warning stating the single-user-loopback posture it implies.
• Optional two-principal approval quorum. BRAIN_APPROVAL_QUORUM=2 requires two distinct principals before a proposal promotes: the first approval records a hash-chained audit row and returns pending_second; a repeat approval by the same principal is refused with quorum_same_principal. Default remains single approval; the publish/remedy decision branches keep their own semantics.

Improvements

• /recall responses carry included_global, always present, so mixing of the global corpus into a domain-routed query is visible to every consumer.
• /health/db carries an authn object (enabled, required) and an allow_policy_bypasses tripwire counting ingests that bypassed screening under INJECTION_POLICY=allow.
• Provenance verify output carries authentication (operator-pinned vs self-asserted (no operator key)), so keyless deployments are visibly self-asserted instead of implicitly trusted.
• DSAR sweep coverage is pinned by an inventory test seeding every subject table (runs, outbox including channel/* rows, channel threads, case-status refs, steps, findings, contradictions, handover offers, case notes, delegations) and asserting zero survivors.
• Threat model current through v1.28.80, including the stated ceilings: pin-ack keys are trust-on-first-use rather than operator-bound, quorum defaults to single approval, domain scoping remains labeling rather than storage isolation (BRAIN_MULTI_DB is the isolation answer), and plugin-side DNS resolution between pin check and request remains a documented limitation for non-loopback deployments.
• Compliance mapping adds the Microsoft AI Red Team Taxonomy v2 one-line map and the LLM Top 10 2026 LLM09 (Vector/Embedding Weaknesses) row; both are control maps, not conformance claims.

Bug fixes

• None.

Engineering record

Red-first regression tests accompany every item above (manual-redirect refusal, system-prompt sanitization, multi-block neutralization, forged-pin rebuild, wildcard refusal, quorum defer/refuse, tripwire counter, sweep inventory). Full suite green (1,189 library tests; all 13 test binaries including the authorization-matrix and parcel-signer fixtures, which opt into the wildcard admission); clippy clean across bench/default feature sets; rustfmt clean; lipstyk diff-strict clean; fork suites green (envelope, pins, prompt hygiene, transport). No database migration; no route changes; OpenAPI extended additively for the four new response fields. CRATE_TEST_FLOOR unchanged at 1,381 (all additions sit above it).

[1.28.79] — 2026-09-10 — “Parity”: third-pass close-out, gap ledger balanced (4 known residuals with owners)

Closes the fork-vs-upstream third-pass audit and every honest gap the final audit named. Fork-only files get code fixes; upstream-tracked files get upstream-PR specs + disclosures only — no hunk in this release touches upstream code. No schema; existing data untouched. Plugin 0.6.4.

Release notes

Security fixes

• Token files refuse multiple tokens. A token file holding more than one line now refuses startup naming the agent-token line, instead of transmitting the whole file — including any operator secret — as one credential.
• Redirects re-pinned to the server origin. Responses landing off the pinned origin are refused, closing bearer leakage through cross-origin redirects.
• Team workflow mirrors honor chat-type gates. Group and channel turns barred from recall no longer reach the workflow mirror; the gate prefers the gateway’s classified type and denies when unclassifiable.
• Proxy-header gates hardened. Forwarded-header pairs without a configured trust basis are denied; legitimate multi-hop proxy chains no longer trip strict mode; brain recall fences are neutralized at the prompt-merge seam like every other marker.
• Re-embedding skips quarantined rows. The reindex and profile-switch paths re-embedded every row, resurrecting vectors the ingest gate removed. Both now share one candidate query that excludes quarantined rows; the legacy add path gates its vector insert the same way.
• KCS drafts carry the screen verdict. Draft inserts hardcoded a clean flag without screening. The verdict is now recorded as advisory provenance (the approving human’s decision stays final), mirroring the promote path.

Improvements

• Origin checks share one transport helper; pre-existing lint warns in the team bridge cleared.
• Upstream proposals (specs, no fork code): multi-block tool-result sanitization, prompt-hook input sanitization, default pin path, and replay-prefix hardening ship as file:line-anchored PR specs; disclosures recorded in the threat model until merged.

Engineering record

Red-first tests per fix (multiline refuse, redirect re-pin, chat-type gate, header pins, fence split, candidate exclusion, draft-verdict binding). Full gate: lib + main-suite green, clippy -D warnings clean, openapi/authz pins green, plugin vitest via parity sync (fork tree restored pristine), lipstyk zero-findings (pre-push enforced), comment hygiene gate green.

Disclosures (accepted, not gaps). Missing-Origin pre-pass is architecture (non-browser clients authenticate post-handshake). KCS publish-flow review stays human-gated by design. DNS-rebind of the pinned host, first-use tool flagging, shim tenancy, and the writable pins file remain residuals with Loop-line owners. The cited second-pass audit file is absent from the repo; premises were re-verified against live source.

[1.28.78] — 2026-09-10 — “Unconditional”: quarantine everywhere, docs-true delivery

Quarantine is unconditional on every retrieval and ingest leg, and channel delivery is now truly at-least-once. No schema changes; existing data untouched. Fork lanes deferred by operator policy.

Release notes

Security fixes

• Legacy search honors quarantine. Restored images without the vector index previously surfaced quarantined content as trustworthy; it is now filtered like every other leg.
• Quarantined content gets no vector embedding. Inserts previously landed in the vector index before the quarantine gate, so a batch of plants could crowd a target memory out of recall (denial). Quarantined rows now store without a vector, and reads over-fetch to cover embeddings written by older versions. Re-approval restores recall.
• Deduplication is domain-scoped. Identical content in two domains now stores twice; previously the second tenant received the first tenant’s record id (existence oracle). Existing rows untouched.
• Standby promotion pins the operator identity. The promotion rehearsal now refuses followers shipped by a foreign key — naming both identities — unless an explicit override names the expected signer.
• Handover-ping delivery is bridge-scoped. One bridge’s drain could consume every bridge’s pings. Undelivered pings now stay pending for the owning bridge.
• Lineage + at-least-once on the workflow seam. Events naming a parent from another run are refused; outbound channel messages stay pending until the bridge acknowledges them — a silent bridge redelivers, never loses. Bridges deduplicate on the event id.

Improvements

• Deletion certificates additionally disclose retained audit-chain rows and log files.
• Unsigned deletion-notification webhooks log a loud warning at send time.
• A configured-but-unreadable token file now refuses startup instead of falling back to weaker credentials.
• The client maps server errors to actionable hints (authentication, rate-limit, validation).

Engineering record

Red-first tests per fix (legacy quarantine ×2, no-vector-on-quarantine, domain dedup + cross-domain negative, foreign/operator signer, bridge scoping, foreign parent + redrill + foreign-ack). Full gate: 1180 lib + 195 main-suite green, clippy -D warnings clean, openapi pin green, plugin vitest 42/42 via the parity sync, lipstyk diff-watchdog clean after two self-findings (verbose match, empty catch).

Disclosures (accepted ceilings, not gaps). INJECTION_POLICY=allow stays a loud, health-echoed operator posture. Refresh-reuse burns the (iss, sub) family per the OWASP pattern (multi-device sessions re-authenticate together). DNS-rebind of the plugin’s pinned host and never-seen MCP-tool flagging remain fork-side residuals. The second-pass docs/SECOND_PASS_AUDIT_20260909.md file cited by the plan is absent from the repo — premises were re-verified against live source instead. Fork lanes (sanitizer joins) deferred per operator policy.

[1.28.77] — 2026-09-09 — “Erasure”: store, recall, and erase

Mantra 1 finished — store, recall, erase — plus the storage-lane fail-closed debts the second pass left planned: erasure completeness (SP-S5 session arm), DSAR pattern fencing (SP-W8), the by-id flagged marker (SP-S3b), the export cap (SP-S9), restore-before-overwrite (SP-C1), and the valet crank wedge (SP-W1) + brief read seam (SP-W12). Plan: IMPLEMENTATION_PLAN_v1.28.77_Erasure.md (M1–M7). Schema: additive one column, schema_version → 1.28.77.

Release notes

Security fixes

• Certified purges now delete the subject’s suggestion feedback EVERYWHERE (SP-S5 — MED, the release’s core): suggest_feedback rows the subject left on chunks the purge never touches survived every certified purge, because the row’s only subject links were a client-owned session label and a tenant column that is default on single-token deployments. Feedback rows now capture the JWT principal (suggest_feedback.owner, additive + nullable, schema 1.28.77), and the DSAR sweep’s feedback arm matches tenant_id = subject OR owner = subject in one statement. Session ids are deliberately NOT a match key (client-owned labels are not principal evidence). The deletion certificate names the arm explicitly (suggest_feedback_rows).
• DSAR subject patterns match literally (SP-W8): subject patterns flowed into LIKE %subject% unescaped — a DSAR for a_b% over-matched axb, and an erasure over-match is OVER-DELETION. Every DSAR/sweep subject-LIKE site (workflow runs, case notes, shift rosters, recall traces, proposals — erase and export-bundle sides symmetric) now builds through the shared escaped builder (the kcs.rs fence) with ESCAPE '\'.
• Restore verifies BEFORE the live DB is overwritten (SP-C1 — MED): the chainless/chain-verify refusals used to fire AFTER write_atomic had already replaced the live file — a refused restore left the unattested image in place. Both checks now run on the decrypted snapshot (a throwaway materialization, cleaned up on every path) BEFORE the overwrite; the live DB is byte-untouched when an image refuses, and the failed attempt is evidenced on the LIVE chain. Every restore-refusal error names the actual preserved snapshot path (…/brain.db.bak) — never a <db>.bak placeholder (wire-invisible: error strings + logs).
• Valet brief what passes the read seam (SP-W12): the one unsanitized text field in the handler now routes through sanitize_stored with the same posture as its siblings — pinned byte-for-byte with a hostile fixture.

Improvements

• By-id reads carry the flagged marker (SP-S3b): GET /get/{id} and /multi-get return quarantined rows with flagged: true — the same vocabulary recall emits — so a consumer keying on by-id no longer sees quarantined content as clean-looking. Additive; no filtering change (by-id is an operator/review surface; the marker is the truth, the operator decides).
• The GDPR export is capped (SP-S9): export_bundle stream-builds with a running byte counter and refuses past the ceiling with the named 507 export_too_large (carrying the byte count + the chunked DSAR pointer) BEFORE the rest of the DB is materialized. Default 1 GiB; BRAIN_EXPORT_MAX_BYTES overrides, fail-closed parse (junk and 0 refuse at BOOT).
• The valet crank drains or says why (SP-W1): a full backlog used to wedge forever (due() truncates at 100, the handler refused at ≥100). The capped batch now FIRES and the response reports remaining (additive); a non-zero remainder is audited; repeated cranks drain. NO auto-loop — the operator re-runs the crank (mantra 2).

Bug fixes

• None beyond the above (every item here is also a behavior fix).

Engineering record

• M1 (SP-S5, red→green): migration adds suggest_feedback.owner (pragma-guarded ADD COLUMN, the ump_outcome pattern) + the schema_version stamp → 1.28.77 (SCHEMA_VERSION_V1_28_77); contract test extended (version + column probe). record_feedback gains the owner param; both call sites (/suggest/feedback, /ump/feedback) capture the JWT sub; no principal → NULL (those rows stay reachable only through the tenant + chunk arms — the disclosed ceiling). The sweep’s feedback arm is one statement (tenant_id = ?1 OR owner = ?1) so the two arms can’t disagree; the count rides dependent_rows (the .76 discipline) AND the new named feedback_rows counter that the certificate census carries (suggest_feedback_rows, both cert builders wired — multi-pool + per-client). Red demonstrated: the owner-matched row on an untouched chunk survived run_pool purge; the .76 purge_removes_suggest_feedback_for_purged_chunk pin is untouched.
• M2 (SP-W8, red→green): kcs.rs’s inline escape chain promoted to kcs::like_contains_pattern (the shared fence); adopted by all 8 production subject-LIKE sites: sweep’s workflow_runs + case_notes + shifts roster, dsar’s recall_traces + proposals + both dry-run workflow_runs counts + the export bundle’s case_notes arm (erase and disclose stay symmetric). subject_exact branches stay exact. dsar_pattern_fencing_percent_underscore red at 2 matched runs (unfenced _ swallowed axb), green at exactly 1.
• M3 (SP-S3b, red→green): ChunkRecord carries flagged on both projections (by-id + batch); both handlers emit it; openapi Chunk schema gains the additive field. Tests pin per-row flags on a mixed batch.
• M4 (SP-S9, test+impl — new API, compile-red): export_bundle(conn, max_bytes) measures every row (serde_json::to_vec once per row, the exact serialized size) with a saturating running counter; over cap → GateError::ExportTooLarge { built, cap } (review.rs; Display carries the numbers) → handler maps to 507 export_too_large naming the chunked DSAR path. config::export_max_bytes (default DEFAULT_EXPORT_MAX_BYTES = 1 GiB) + validate_export_max_bytes at boot beside the write posture. Tests: refuse-past-cap, under-cap streams (incl. finite non-default cap), fail-closed parse.
• M5 (SP-C1, red→green): the posture checks split into verify_chain_posture (the two refusals over an open connection) + verify_snapshot_chain_posture (snapshot materialized to a unique drop-guarded sibling file beside the target, checked pre-overwrite; refusal errors append the ACTUAL .bak path — or honestly say none existed). Classification + disclosures move inline post-overwrite; the chainless-admitted short-circuit posture (NoPostPin, no classification) is byte-identical; verify_restored_chain_and_pin survives as the test-facing path variant. Red demonstrated: the live marker was GONE after a refused restore (replaced by the poisoned image); the old refusal carried the literal <db>.bak. restore_verifies_snapshot_before_overwrite also pins the failure- evidence row landing on the LIVE chain (2 rows + 1 failed-restore row). All 29 backup tests + 7 standby tests green.
• M6 (SP-W1, red→green): the wedge reproduced verbatim in red (“due backlog at cap 100 — drain before adding more”). Green: the refusal deleted; core::due_count (same scan + arbiter as due, counted without the batch truncation, bounded by MAX_DUE_SCAN) reports the additive remaining field; non-zero remainder audited via record_tenant (the actor label rides the closure). Crank cost: one extra bounded scan per crank. openapi gains the additive field.
• M7 (SP-W12, red→green): the brief’s what routes through sanitize_stored(&what, false, &None) — the exact sibling posture; valet_brief_what_passes_read_seam pins byte-for-byte equality with sanitize_read on a markdown-ref + U+200B + <script> fixture.
• Pins added (12): feedback_owner_captured_from_principal, dsar_sweep_counts_feedback_arm, purge_removes_suggest_feedback_for_session, dsar_pattern_fencing_percent_underscore, get_returns_flagged_marker_for_quarantined_row, multi_get_flags_each_row_individually, export_refuses_past_cap, export_under_cap_streams_fine, export_max_bytes_parses_fail_closed, restore_verifies_snapshot_before_overwrite, restore_failure_error_names_bak, valet_brief_what_passes_read_seam (+2 handler pins for the crank: valet_crank_fires_capped_batch_and_reports_remainder, valet_backlog_drains_over_repeated_cranks). CRATE_TEST_FLOOR 1,372 → 1,381 (walk-measured).
• Erasure-completeness disclosure: purges/DSARs certified after this release delete strictly more (the owner arm is new reach); DSAR subjects containing literal %/_ change matching behavior — correctly (literal). Openapi additive only (Chunk.flagged, valet/due.remaining, cert suggest_feedback_rows); x-api-version UNCHANGED.
• Gates: full bench suite green; clippy bench/default/otel clean; fmt + lipstyk clean; boots green on a COPY of the live DB (purge + restore rehearsed there).
• ponytail: what this release does NOT do: no standby self-asserted verification fixes (SP-C2/C3, v1.28.78), no legacy-search/KNN quarantine fixes (SP-S2/S3/S6, v1.28.78), no key-rotate ceremony (SP-C4/C6, v1.28.79), no dry-run feedback census in the footprint preview (the cert census is the certified truth), no export streaming format change (the cap + the chunked-DSAR pointer is the whole fix), no session-boundary detection, no new deps.

[1.28.76] — 2026-09-09 — “Selfheal”: the second-pass audit’s fix release

The fix release for the 2026-09-09 second-pass audit (docs/SECOND_PASS_AUDIT_20260909.md): six parallel deep-audit lanes over the same surfaces at HEAD, plus storage/SQL and compute-bounds lanes the first pass under-covered, plus a docs-truth sweep. 30 fresh findings; the 5 HIGH-class and 7 MEDIUM close here, the rest are planned (v1.28.77 “Erasure”, v1.28.78 “Unconditional”, v1.28.79 “Ceremony”). Theme: nothing stripped may reassemble, and no gate has a side door.

Release notes

Security fixes

• The read-seam strips can no longer be welded back into live markup (SP-R1, SP-R2 — HIGH): a single pass healed hostile constructs out of surrounding prose — <scr<script>ipt> re-emitted as a live <script>alert(1) after the hostile-element strip, and [![a](inner) c](outer-url) re-emitted as a live auto-fetch ![a c](outer-url) image after the markdown-ref strip (the EchoLeak class the strip exists to kill). Both strips now run to a bounded fixed point (each pass only deletes; overflow fails closed by dropping the construct-trigger bytes), pinned by hostile_element_strip_does_not_heal_nested_tag (incl. the 65-level overflow construction) and strip_markdown_refs_does_not_heal_nested_construct.
• The ONNX injection scorer is budgeted (SP-S1 — HIGH): scoring ran every sentence of a field through the process-wide ONNX session with no cap, and all screened writes serialize behind that mutex — a 1 MiB ingest of short sentences pinned every screened write, and the review queue amplified it per listing. Fields now score at most the first 64 sentences of their first 16,000 chars; the tripwire can only degrade toward Clean beyond the budget — the HITL gate is unaffected. Pin score_field_is_budgeted.
• A valet run’s what can no longer be rewritten past the screen (SP-W4 — HIGH; completes the X-W4 closure): the fence held at run-open only, while PUT /workflow/runs/{id}/state rewrote the label unscreened — and the label rides the alert bus to Signal relays at fire time. Valet-kind runs now vet through the same fence at the CAS seam (400 valet_what_refused + a Denied audit row). Pin put_state_refuses_unscreened_valet_what.
• The principal kill-switch now reaches /auth/refresh (SP-A1 — MED): the route is public, so the middleware’s identity check never ran there and a revoked identity’s refresh chain kept rotating behind the revocation. Refused with the middleware’s own 401 identity_revoked code. Pin refresh_refuses_revoked_identity.
• The kill-switch now reaches the channel console (SP-A4 — MED): a mapped, role-holding actor whose principal is revoked could still list and decide on bridge HMAC alone; the bridge signature proves the message, not the actor’s standing. Refused (actor_revoked) before the capability check. Pin console_actor_revoked_refused.
• Private valet/due labels no longer stream unfiltered on the live SSE feed (SP-A7 — MED): the reconnect-replay path gated both workflow and valet/due kinds with opt-in + per-domain Read, but the live stream gated only workflow — an unfiltered Read-on-global subscriber received every private reminder label across all domains. Both kinds share the gate now. Pin valet_due_requires_optin_and_domain_authz.
• Egress validation covers the IPv6 embed families (SP-E1 — MED): IPv4-mapped IPv6 (::ffff:169.254.169.254 passed as “public v6” while the kernel routes to the embedded link-local v4), NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32, and discard-only 100::/64 are denied; mapped PUBLIC v4 stays admitted (pinned complement). Edge- literal pins extend private_ranges_refused_table.
• BRAIN_MCP_SCOPE=read now denies ump.feedback (SP-M1 — LOW): the suggest-feedback upsert is a durable write that steers ranking and KCS evidence, not a read; gated at dispatch and annotated x-brain-scope: read-denied with the other four write verbs.
• Embedder input is budgeted (8,000 chars at every backend boundary; stored text stays verbatim, vectors stay consistent across call sites).
• Suggestion-feedback rows are erased with their chunk (SP-S5, first arm): a certified purge no longer leaves feedback queryable by chunk id; the DSAR sweep adds the tenant arm. The session-join question stays open for v1.28.77 “Erasure”.

Bug fixes

• repo-brief.sh crashed at HEAD (grep exit-1 on zero route sites in the thin main.rs under set -e); it now counts router registrations and runs clean — the one-shot briefing tool works again.
• Corrected false in-code claims: review_digest binds the READ-CANONICAL form, not stored bytes (any sanitize_read widening moves digests of affected rows — fail-closed 409s at approve, disclosed per release); the hostile-element set honestly documents its fetch/embed scope (on*= handlers and script-scheme hrefs on other elements remain the stated ceiling; the KB surface ships default-src 'none').

Improvements

• Docs truth (the user-facing half): THREAT_MODEL.md gained §5b — the v1.28.63–.75 control table + kept ceilings (was frozen at v1.28.68); SECURITY.md’s history gained the 13 missing releases (was stopped at v1.28.17); the OWASP agentic matrix is re-stamped (ASI05 now states the dormant, machine-pinned exec seam); docs/AI_LITERACY.md, docs/openclaw-integration.md (plugin 0.6.0 + origin labels), and the plugin changelog (the missing [0.6.0] row) are current.
• The second-pass audit itself: docs/SECOND_PASS_AUDIT_20260909.md — 30 findings across both trees, closure verification of the 09-06 ledger, and the tightly-scoped v1.28.77–.79 remediation plan.

Engineering record

• The .75 correction, stated plainly: exec_spawn_carries_kill_on_drop asserted a source string whose only occurrence was the assertion itself — it could never fail — and the exec spawn is std::process::Command, which has no kill_on_drop API. The real mechanism at that seam is the deadline block (kill + wait + join, then refuse). The pin is rewritten honest and behavioral (exec_deadline_kills_child: a 30 s sleep budgeted at 250 ms must return the deadline refusal within 5 s — a missing kill would block wait() for the child’s full runtime and fail the bound), and the deadline is injectable (exec_effect_for). AGENTS.md’s .75 row overstates; this section is the correction of record.
• Digest-invalidation disclosure: the fixpoint strips widen sanitize_read output exactly for rows whose stored text welds nested constructs — those rows’ review_digest moves, so outstanding approvals fail closed with 409 at approve time and must be re-reviewed. Same direction Scrim’s strip addition took (there unnoticed; the corpus was markup-free). Fail-closed by design; disclosed per the corrected gate.rs discipline note.
• The no-SQL-in-handlers guard caught three violations from this very fix pass (the handler kind-read moved to state::run_kind; test fixtures moved onto the production cores role::upsert, apply_user_map_change, revoke_principal) — the law polices its authors.
• Pins added (10): strip_markdown_refs_does_not_heal_nested_construct, hostile_element_strip_does_not_heal_nested_tag, line_markers_anchor_on_every_break_class (the screen’s line class is the renderer’s — lone \r, VT, FF, NEL, U+2028/9 anchor too), score_field_is_budgeted, embed_input_is_budgeted, exec_deadline_kills_child, valet_due_requires_optin_and_domain_authz, refresh_refuses_revoked_identity, console_actor_revoked_refused, put_state_refuses_unscreened_valet_what, purge_removes_suggest_feedback_for_purged_chunk (11 counting the egress table extensions inside private_ranges_refused_table). CRATE_ TEST_FLOOR 1,363 → 1,372.
• Gates: full bench suite green; clippy bench/default/otel clean; fmt + lipstyk clean; openapi.yaml/route tables/x-api-version diff-empty (no wire change — every surface here is behavioral or docs).
• ponytail: what this release does NOT do: no restore/standby posture changes (v1.28.77), no KNN/dedup/legacy-search quarantine fixes (v1.28.78), no key-rotate ceremony or token-demotion changes (v1.28.79), no fork-side commits for SP-F2/F3/F4/F6 (they ride the next fork sync), no classifier-default change (still opt-in), no lattice, no policy engine, no new deps.

[1.28.75] — 2026-09-08 — “Preflight”: the program’s exit gate

The last REGISTER LINE release (X-W7, X-A4b, X-C5, X-C6, X-C8 — audit 2026-09-06 §4.1–4.3/§8), docs-heavy by design: the last release of a line certifies. This release is the gate: the 1.32.x Loop line may open — with its inherited preconditions (hardened dormant exec mediation + the dormancy pin to delete on wiring, review-by-default installs, pinned signers, origin labels). The program close-out — all 55 findings × disposition, the four-leg exit-gate drill, per-release deltas, and the surviving ceilings — is in docs/AUDIT.md. Plan: IMPLEMENTATION_PLAN_v1.28.75_Preflight.md.

Release notes

Security fixes

• The dormant exec mediation is hardened — and its dormancy is now a declared, machine-checked state (X-W7): argv0 admission canonicalizes the resolved binary and refuses divergence from the allowlist prefix (the symlink-masquerade door the “refuse rather than canonicalize” posture left open); the danger screen is renamed in docs what it is — the TRIPWIRE (the allowlist is the admit gate) — and gains the pipe-to-shell family (| sh, | bash, | zsh, base64 -d); kill_on_drop is pinned at the exec spawn seam. The new dormancy pin (hostcalls_mediation_stays_unwired_until_loop_line) asserts ZERO production call sites — when the Loop line wires the mediation, it DELETES this pin and inherits the hardened ground; a silent partial wiring fails here first.
• Review posture at install (X-A4b): install-service.sh writes BRAIN_WRITE_POSTURE=review for installs whose plist carries NO explicit posture yet — an operator-set value (including a deliberate open opt-out) is NEVER stomped by a re-run (the old unconditional remove+insert did exactly that on every update). The completion message names the resolved posture, what review means, and the opt-out. The compiled default stays open — unattended upgrades must not break; the installer is the posture authority.
• The honest ceilings become docs truth (X-C5, X-C6): THREAT_MODEL.md now states verbatim-honest that (a) the audit chain’s HMAC key + head pin share the host with the DB — the chain detects SQL/application-level tampering, NOT host compromise; and (b) the live DB + .bak snapshots are PLAINTEXT on the primary (the encryption law covers the follower only). SECURITY.md carries both in the reporter scope — a reporter demonstrating “.bak extraction on a stolen disk” knows it is a known ceiling, not a bounty shape.
• SBOM freshness is gated (X-C8): badges.sh --selfcheck (already run in CI) now REFUSES when sbom/brain-server-<version>.cdx.json is absent from the COMMITTED tree — the human step (generate + commit) is unforgoable; no CI bot commits.

Engineering record

• Migration note (installer): existing plists are untouched — if your plist already carries a posture, re-running the installer keeps it and says so. New installs (and plists that never named a posture) get review.
• Program close-out: docs/AUDIT.md carries the findings ledger × disposition (55 findings; the plan’s “41” undercounted — all are dispositioned: 46 fixed across v1.28.63–.75, 5 accepted ceilings/with-disclosure, 2 forward to their own lines, plus the .64 identity batch), the four-leg exit-gate drill transcript, and per-release test deltas.
• Exit-gate drill (the four headline exploits re-run — all fail closed): (1) channel/out forge via the events route → REFUSED (reserved-topic pins); (2) steering launder via the same seam → REFUSED; (3) revoked principal on a non-mesh route → DENIED (kill- switch pins); (4) poisoned-memory canary (tag-encoded instruction + forged markers + image URL) → screened/fenced/stripped (the Meridian division-of-labor pin + fence welding pins). Transcripts in docs/AUDIT.md.
• CI caught what macOS could not (merged-usr): the first CI run on the release commit went RED on Ubuntu — /bin is a symlink to /usr/bin there, so canonicalizing only the argv0 turned every honest textual allowlist entry (/bin/ls) into a refusal; two exec tests failed and release.sh REFUSED the tag on the red matrix (the fail-closed gate working as designed). The fix (this release’s final commit) canonicalizes the ALLOWLIST ENTRY too: canonical(entry) == canonical(argv0) admits binaries through symlinked directories, prefix entries compare against the resolved directory, and non-existent entries keep the textual fallback. New pins: the alias-directory admission and its sibling-refusal mirror.
• Validation: full bench suite 1,458 passed / 7 ignored; clippy clean ×3 feature sets; fmt clean; lipstyk clean; CRATE_TEST_FLOOR 1,358 → 1,363; badges.sh --selfcheck green WITH the new SBOM gate; bash -n on the installer (shellcheck not installed locally — noted ceiling); released as tag v1.28.75 only after the fixed tree was CI-green.
• ponytail (plan non-goals): the mediation is NOT wired (no consumer exists; wiring without the Loop line’s policy design would be speculative authority); no sandboxing/namespace isolation; no primary-disk encryption (FileVault is on; encrypting .bak breaks the restore-on-bare-metal path); no CI-committed artifacts.

[1.28.74] — 2026-09-08 — “Origin”: taint labels survive the whole trip

The fifth REGISTER LINE release (X-S2 at proportionate grade, X-F3 — audit 2026-09-06 §4.8/§4.9). THREE TREES: brain-server (capture stamps origin + telemetry posture), the plugin (labels + the exclude posture), the openclaw fork (replay marking). ONE boolean-grade label end to end — no lattice, no policy engine (CaMeL/FIDES stay reference models). Plan: IMPLEMENTATION_PLAN_v1.28.74_Origin.md.

Release notes

Security fixes

• Capture stamps origin (brain): POST /ingest and POST /ingest/proposal accept origin_context: "owner"|"channel" (absent = owner, byte-compat; anything else is a 400 — closed vocabulary). A channel capture stores the row with origin channel-capture; under the review posture the proposal’s SOURCE is stamped channel-capture so the review queue renders the badge and the operator SEES “captured from channel traffic” at approve time; approval promotes the label onto the knowledge row.
• The plugin renders + gates on origin (plugin 0.6.0): recall hit lines prefix [memory | channel-capture] INSIDE the fence for non-owner origins (owner hits untagged — no noise); the new untrustedOrigins: "label"|"exclude" config (default label) drops channel-captured hits from AUTO-INJECT entirely under exclude; the memory_recall TOOL path always labels (tools return what was asked). autoCapture sends origin_context: "channel" whenever the turn’s chat type is group/channel — the fact already existed client-side in the gating layer.
• Replay marking (openclaw fork): the inbound boundary recognizes the [memory | …] prefix on QUOTED/REPLAYED text and marks it [quoted memory · origin: … — untrusted replay, not fresh prose] — a channel-forwarded memory line can no longer masquerade as fresh owner prose (the mirror of the <active_memory_plugin> handling). The fork reads NO brain store and learns NO schema — one textual convention at its own boundary.
• Telemetry is untrusted infrastructure (X-F3): span attribute values derived from request text now pass the ANSI/C1 strip + unconditional PII redaction before export (domain labels at the recall + gate spans); query_hash is untouched; resource attributes (host/version) are static and unrouted. The OTLP export path logs the posture line at startup: “telemetry attributes are sanitized; treat any collector as untrusted infrastructure”.

Engineering record

• Capstone line proof: the end-to-end trip is exercised per tree — capture (server test: the row lands channel-capture, default unchanged, unknown vocabulary 400s), the badge (proposal source pinned), labeling/exclusion (plugin vitest: prefix inside the fence, owner untagged, exclude filters, tool path always labels), replay (fork vitest: quoted prefix marks as untrusted replay, fresh text unaffected, idempotent). The live group-chat drill (poison a chat → proposal badge → approve → labeled recall) is recorded as the program’s .75 exit-gate canary leg.
• Non-goals (ponytail, honest): no taint propagation THROUGH the model (output classification is LLM-work the mantra forbids); no per-recipient labels (the label is capture-time truth, not audience-aware); no openclaw-side enforcement beyond the exclude config; the FIDES/CaMeL lattice stays a reference model, not a dependency.
• Validation: brain bench suite 1,453 passed / 7 ignored (otel 1,474; default 1,470); clippy clean ×3; lipstyk clean; plugin vitest 57 green (4 new); fork strip-inbound-meta suite 60 green (4 new); CRATE_TEST_FLOOR 1,356 → 1,358. openapi additive (both request fields); x-api-version unchanged; no schema migration (origin value extension only).
• The synthetic tsconfig base used to run the plugin vitest suite in this repo (tsconfig.package-boundary.base.json, committed — it was previously implicit in the fork workspace and made the plugin suite unrunnable from a brain-server checkout) is now real; content is the minimal strict compiler config.

[1.28.73] — 2026-09-08 — “Keyring”: key + evidence lifecycle

The fourth REGISTER LINE release (X-C4, X-C3, X-W8 — audit 2026-09-06 §4.3/§4.1). Theme: the operator signing key becomes deterministic and rotatable with a one-deep overlap window, restore stops certifying chain-less images silently, and the two bounded-memory trade-offs get explicit eviction instead of flood-clear. Schema: ONE additive column (agent_cards.signing_epoch) — version 1.28.73, contract test extended. Plan: IMPLEMENTATION_PLAN_v1.28.73_Keyring.md.

Release notes

Bug fixes

• The UMP revocation-replay cache no longer clears ALL pins at the 4096 cap: a flood now evicts only the OLDEST quarter (insertion-order truncate), so recent capability pins survive and the documented trade-off shrinks to “the oldest quarter of the window”.
• The revocation drain no longer silently abandons runs past the first 200: it pages (max 10 × 200) and, when the budget is exhausted, writes a loud drain_incomplete row on the hash-chained audit trail naming the remainder.

Security fixes

• The operator signing key is DETERMINISTIC (X-C4): the fixed filename operator.ed25519 inside the key dir replaces the first-file readdir scan (which nondeterministically picked whichever seed the filesystem listed first — rotation invalidated EVERY card at once). Existing installs migrate transparently: the first admissible seed is renamed once, logged. A wrong-size or leaked seed at the fixed name is now a LOUD refusal — the historical silent degrade to L2 hash-only integrity dies.
• brain key rotate — the operator rotation verb: current key → operator.ed25519.prev (atomic rename), new 0600 seed written, generation bumped, hash-chained audit row. Cards signed by the old key keep verifying through the ONE-deep overlap window; a second rotate deliberately refuses while .prev exists (a third generation would orphan the middle one — pinned). NO scheduling, NO background anything.
• Cards carry signing_epoch (additive column): verify_card picks the key deterministically — current generation → current key, previous generation → .prev, legacy NULL rows try both (old binaries’ behavior plus the window, byte-compat).
• Restore tells the truth about chain-less images (X-C3): a backup image with NO audit_events table REFUSES with chainless_image_refused unless the CLI passes --allow-chainless (the flag restores with a loud disclosure — no chain exists to carry the row, and that absence IS the finding). Legacy-epoch (unkeyed SHA-256) chains restore marked legacy_unkeyed_chain: forgeable: true on the completion line + a disclosure evidence row naming --re-audit as the re-anchor. Head-pin rollback stays disclosed-not-refused (the legitimate restore-from-older recovery use).

Engineering record

• Rotation ceremony mapping (honest): the plan’s key_rotation lineage event maps onto the audit chain itself (the register IS the audit chain — no parallel event store for an identity-scoped act; the Advocate precedent). The outbox lineage machinery is run-scoped; rotation is not.
• Schema: agent_cards.signing_epoch INTEGER (additive, NULL for legacy rows), version stamp 1.28.62 → 1.28.73, contract test extended same-commit; boots green on a COPY of the fixture corpus (the standby roundtrip proptest exercises the new restore path).
• Drills (all test-level, on copies + scratch key dirs): rotate → old card verifies via .prev, new card signs with the current key (rotate_keeps_old_card_verifying_via_prev); a no-audit-events image → restore refuses (chainless_backup_refused_without_flag); the legacy image restores with the forgeable mark + evidence row (legacy_chain_marked_forgeable_until_reanchor); a second rotate → first-generation cards die (third_generation_kills_first); the transparent rename rehearsed (legacy_first_file_migrates_transparently).
• Validation: full bench suite 1,450 passed / 7 ignored (default 1,467; otel 1,469); clippy clean ×3 feature sets; fmt clean; lipstyk clean; CRATE_TEST_FLOOR 1,345 → 1,356 (needle re-measured).
• ponytail (plan non-goals): no HSM/KMS (the threat model is a laptop + disk; 0600 + deterministic + one-deep overlap is the proportionate ceremony); no automatic rotation scheduling (no background workers); no multi-party signing; same-disk key ceiling stands until v3.7-class work.
• Migration note: none required for correct installs — the fixed filename adopts in place on first boot; operators with MULTIPLE seeds in the key dir get the first admissible one (documented nondeterminism, now resolved once and logged).

[1.28.72] — 2026-09-08 — “Scrim”: every emitted surface is shaped

The third REGISTER LINE release (X-R3, X-W6, X-L4, X-E5 — audit 2026-09-06). Theme: the read seam strips hostile HTML element names, the write-on-read GET gets a gate, the SSE denial becomes an HTTP status, and the KB library escapes its operator args like it escapes everything else. One visible output-bytes change, one wire-visible status change — both ledgered. No schema. Plan: IMPLEMENTATION_PLAN_v1.28.72_Scrim.md.

Release notes

Bug fixes

• The KB site generator escapes operator-configured values (base_url, config locales) in every generated surface — hreflang alternates, the sitemap loc/alternates, the no-translation branch’s locale — so a malformed config renders inert text instead of injecting markup. The library now enforces the CLI’s locale contract (non-empty, ≤ 12 chars, ASCII alphanumeric + hyphen); invalid locales generate no files.

Security fixes

• The read seam strips hostile element names (X-R3): a closed, case-insensitive, attribute-greedy set — script/img/iframe/svg/object/embed/link/meta/form/input/video/audio/ source/track/base — applied AFTER the markdown-ref strip (so hybrid forms meet the tag stripper too). Prose angle-brackets survive (“x < y”, “<3”, “ac” are pinned). Storage stays verbatim: digest-bearing surfaces are untouched. Bare URLs in prose remain the documented linkified-but-inert ceiling — no URL rewriting.
• GET suggestions stops writing unguarded (X-W6): the KCS evidence side-effect (abstention + SIR rows) now requires Write on the run’s domain AND the workflow role capability. Read-only principals get the suggestions body unchanged with the additive evidence_recorded: false. The endpoint is NOT split or moved — the KCS double loop’s capture is intact for writers.
• A denied /events subscriber gets HTTP 403 (X-L4) instead of a 200-then-error-event: monitors see the denial, connection errors surface, and the poll fallback keys on the failure. The error-EVENT mechanism remains for mid-stream failures (a different failure class — the boundary is commented at the handler). The client events driver already handled non-200 statuses (verified: ApiError::Status path) — no client change was required.

Engineering record

• Bytes-change ledger (honest): stored markup now disappears from read seams — recalled/queried/exported text that carried <img ...>-class tags returns stripped. Stored digests do NOT move: review_digest binds the STORED form (order load-bearing PII → invisible → markdown refs → elements; the element strip is read-seam only), and the KB determinism corpus re-ran green.
• Status-change ledger: /events denial 401/403 replaces the legacy 200+SSE-error shape; the authz matrix moved /events out of SSE_SOFT (/ump/subscribe keeps the in-band denial). openapi documents both wire deltas additively; x-api-version unchanged.
• Fast-path integrity: the borrow-preserving sanitize_read_cow fast path now also requires a <-free row — an element-carrying row can never take the borrowed (unstripped) branch (pinned).
• Drill: the <img src=x onerror=alert(1)> plant shape stored in content reads back EMPTY through sanitize_read (pinned), and the svg+onload variant carries no element text while prose survives.
• Validation: full bench suite 1,439 passed / 7 ignored; clippy clean; fmt clean; CRATE_TEST_FLOOR 1,336 → 1,345 (needle re-measured). New pins: the element strip table, prose-survival, svg/onload, markdown regression, the cow fast-path guard, the suggestions read/write split, the SSE status denial + stream-open, and the three KB escaping/validation pins.
• ponytail (plan non-goals): no full HTML parser (closed name-set only); no bare-URL handling (ceiling stands); sanitize_public’s no-bypass posture untouched.

[1.28.71] — 2026-09-08 — “Pores”: the screen sees what the model sees

The second REGISTER LINE release (X-R4, X-R6, X-R7 — audit 2026-09-06 §4.4). Theme: the layer-1 injection screen stops running on raw bytes while the classifier sees the stripped form; the vocabulary stops being 13 English phrases; the layer-2 classifier turns itself on when its model is present; and the log/bridge seams adopt the canonical strips. Screen verdicts shift at the margin — QUARANTINE-WARD only. No schema; no routes; x-api-version unchanged. Plan: IMPLEMENTATION_PLAN_v1.28.71_Pores.md.

Release notes

Bug fixes

• The log seam no longer lets ANSI/C1 escape sequences through to log values: request-derived values logged by the memory routes route through the shared control-char strip, so a crafted ESC[... payload cannot script the operator’s terminal via the launchd/journald stream (line-forging stayed closed; the escape-class gap is now closed too).
• Slack/Teams message previews strip the canonical invisible-Unicode class and dereference markdown image/link refs at the bridge edge before the 4000-char clamp — previews previously rode the control-char scrub only. The kernel screen stays authoritative server-side; this is defense-in-depth at the rendering boundary.

Security fixes

• The injection screen runs on the stripped form — the same normalization the layer-2 classifier input gets. A bidi-split structural marker (sys\u202Etem:) or zero-width-split role heading can no longer dodge the blocklist leg while the classifier sees it clean. Verdicts can only move Clean→Quarantine/Reject from this change, never the reverse.
• The blocklist stops being 13 English phrases: translation families (Spanish, German, French, Dutch, Filipino) cover the same six instruction-override intents; a typoglycemia tier catches scrambled-middle evasions (“ignroe all prevoius systme instructions”) via the OWASP cheat sheet’s minimal anagram match (first+last equal, sorted middle equal, length ≥ 4); and a bounded encoding tier decodes base64/hex runs (≥ 24 chars, first 8 runs, ≤ 4 KiB per decode) and re-scans the decoded text against the same detector.
• The layer-2 classifier auto-loads when its model artifact is present (feature-gated builds): BRAIN_INJECTION_CLASSIFIER=off opts out, on/unset probes the default artifact location (~/.config/brain-server/models/injection-classifier/), an explicit path keeps working — and a non-existent explicit path now REFUSES the boot (fail-closed; a typo must not silently disable layer 2). /health/db echoes the tri-state injection_classifier: on|off|absent. The poison posture is unchanged (a dead classifier scores fail-open 0.0 — layer 2 never eats ingest).

Improvements

• install-service.sh scaffolds the classifier artifact directory and surfaces the layer-2 posture at install time (artifact fetching stays an operator step; the model manifest pins integrity).

Engineering record

• Verdict-shift disclosure (honest): the four breadth additions move verdicts QUARANTINE-WARD at the margin — the bidi-wrapped phrase that motivated the stripped-form change now quarantines (was Clean), and translated/scrambled/encoded instruction phrasings quarantine where they previously sailed through. The clean-corpus pins (clean_text_verdicts_unchanged_table, no_false_positive_drift_on_clean_corpus) guard the reverse: no corpus entry flipped clean-ward, and no benign prose in the fixture corpora drifted quarantine-ward (a punctuation-adjacent and a long-standing “system prompt” corpus entry were corrected during development — the matcher behavior was right both times).
• The screen is a tripwire, not a boundary — standing honesty note. The OWASP Best-of-N finding (power-law scaling; 89% success on GPT-4o at sufficient attempts) is now cited in the module doc verbatim: static filters SLOW attackers, they never stop them. The boundary is the pairing — flagged/untrusted segregation, the unforgeable fence, and the HITL approval gate. The dual-LLM/guardrail-model pattern remains considered-and-rejected (the house LLM-screening ban).
• Matcher ceiling (deliberate): the anagram tier stops at first+last/sorted-middle equality — Levenshtein/Damerau distance matching needs a string-metric crate, deliberately not taken. Exact keywords alone never trip the anagram tier (bare “system”/“ignore” are ordinary prose). The token-run matcher stays punctuation-adjacent blind (a comma fused to a phrase’s last word dodges it) — same as the English list pre-Pores. The encoding tier is bounded (8 runs, 4 KiB, single decode level, no recursion — encoding_scan_bounded pins the cap including the honest “run #9 is not decoded” direction).
• Bridge parity method: the bridge crate’s strip is a byte-for-byte port of the kernel scanner semantics (first-]/first-) link scan) over the synced plugin format.ts invisible class set — the parity property is pinned bridge-side (kernel_screen_still_authoritative). The bridge crate suite runs in the crates CI job; its test floor holds.
• M4 delta: sanitize_log_value now maps \r to removal (was: a space) — one space narrower, still line-forge-proof; \n→space and tab-survival are pinned to the pre-existing behavior.
• Validation: full bench suite 1,426 passed / 7 ignored (default-features 1,443; otel 1,445); clippy clean; fmt clean; the channel-bridge crate suite green (39 tests); CRATE_TEST_FLOOR 1,318 → 1,336 (needle re-measured: +18 bare-#[test] pins — the Pores family + the drill pin). Drill: the bidi-wrapped “ignore previous instructions” class now quarantines (pinned, bidi_wrapped_phrase_now_quarantines), and the Meridian canary memory keeps its screen verdict Clean (pinned, meridian_canary_screen_verdict_unchanged) — it was designed to slip the screen and is caught at the read seam instead.
• ponytail (plan non-goals): no LLM-based screening; no classifier-as-gate (advisory tier only); no embedding-similarity blocklist; no string-metric dependency; the installer does not fetch model artifacts (scaffold + guidance only — fetching stays an operator step).
• OpenAPI/schema: untouched. x-api-version: unchanged. New deps: none (base64/hex were already in the tree).

[1.28.70] — 2026-09-08 — “Twokeys”: the opaque-mode operator/agent split — the REGISTER LINE opens

The first REGISTER LINE release (X-A4a carried F-W1 + X-A5 — audit 2026-09-06 §4.2). Theme: the installer’s two-token convention — operator on line 1, agent on line 2, which the plugin has read deliberately all along — becomes a TYPED principal server-side, and the observability family stops narrating every tenant to every reader. One additive env (AGENT_TOKEN_FILE), one re-shaped response (/health/db), one scoped label set (/metrics). No schema; no routes; x-api-version unchanged. Plan: IMPLEMENTATION_PLAN_v1.28.70_Twokeys.md.

Release notes

Bug fixes

• None. (The cross-tenant telemetry tightening (X-A5) is a security fix and lives below.)

Security fixes

• The agent token becomes a principal (X-A4a, carried F-W1 — open since 2026-08-23). In an opaque-token deployment, line 2 of the token file (or the new AGENT_TOKEN_FILE, same 0600 secret-file law, same constant-time compare) now authenticates as a SCOPED principal — PrincipalKind::AgentLoopback, sub agent@loopback — instead of another superuser bearer. The scope set is write:*/global (write implies read down; the shared pool only) and the role set is the ship-with agent preset (can read/write/reject — recall, search, suggest, ingest→proposal, UMP remember→proposal under the review posture, reject own drafts). NOTHING is granted agent-specifically: the EXISTING authz matrix binds the principal everywhere — no Admin, no purge, no domains, no revoke, no dsar, no DPO boards, and no workflow-engine capability. Blackout’s kill-switch applies BY PRINCIPAL NAME: POST /ops/agents/revoke for agent@loopback and the next agent bearer dies 401 identity_revoked at the middleware. Agent 403s are audited at that boundary (agent_forbidden rows) so the denials are evidence, not silence. A leaked (group/world-readable) or empty AGENT_TOKEN_FILE refuses the boot.
• The observability family stops narrating every tenant (X-A5). The full /health/db body (model, OTLP endpoint, DPO contact, durability posture, per-domain WAL, sizes) is operator telemetry and now requires an Admin credential on global; a Read credential receives the reduced probe {status, version, db_ok} — the public /health content plus the pool-liveness bit; a credential with neither Read nor Admin is 403 (openapi documents the new shape). /metrics per-domain gauge labels (brain_pool_in_use, brain_pool_idle, brain_wal_pages_pending) render the domain NAME only for principals whose scope grants Read there — the same can_read_domain predicate the read paths use; out-of-scope domains collapse into one SUMMED domain="other" series per gauge (counts visible, names hidden — no duplicate series). Global gauges are unchanged.

Improvements

• Boot logs the auth posture, post-tracing-init: auth: operator token + agent token (scoped) or auth: single token (LEGACY SUPERUSER — second line recommended).
• AUTH_TOKEN env content keeps today’s all-operator semantics byte-identically — the line contract lives in the token FILE only.
• Read-only dashboards that scraped the full /health/db body add the admin credential (see the migration note below).

Engineering record

• F-W1 closure disclosure (carried since 2026-08-23), stated honestly: the static-superuser gap is now ENFORCED CLOSED for two-token setups — the second token is scoped by the server, not by installer convention. Single-token deployments keep the documented legacy superuser posture byte-identically (pinned by single_token_legacy_posture_unchanged + operator_token_behavior_byte_identical): the file format is additive, the boot warn is the nudge, and there is no forced migration. The audit’s compounding concern — the still-unpurged openclaw-side token leak — remains an ops item (AGENTS.md Known Issues); rotating to a two-line file neutralizes the exposed bearer’s authority even before that purge lands.
• Migration note (Read-only dashboards): /health/db full bodies need the admin credential; Read credentials get the reduced probe. Scrapers keying on per-domain metric LABELS need a scope matching the domain (or they see other).
• Migration note (single-token operators): nothing changes on the wire; add an agent line (or AGENT_TOKEN_FILE) when you want the plugin’s token scoped.
• Role-table ceiling (honest): the workflow engine capability is not grantable to ANY ship-with role (role::validate restricts can to CAN_ACTIONS, which does not name it), so the agent principal cannot reach the workflow-engine surfaces (runs/state/events/rewind, valet, handover offers, calibration, scoreboard). Engine seams stay operator-side — revisit when the 1.32.x Loop line needs an agent-reachable workflow vocabulary. The agent preset’s reject capability DOES pass the proposal-reject route (rejecting own drafts is the designed act); the kcs publish-retract branch carries only the Write scope and likewise passes.
• ponytail (plan non-goals): no per-agent identities (one agent@ loopback principal; fine-grained agent tokens wait for a real second consumer); no JWT-mode changes; no metrics authz redesign; SPIFFE stays v3.7.
• Validation: all plan tests green — agent_token_authenticates_as_ scoped_principal, agent_principal_denied_admin_routes (the purge/domains/revoke/dsar sample + the agent_forbidden audit row), agent_principal_can_propose_not_promote (202 pending → approve 403), operator_token_behavior_byte_identical (status AND body equal with and without line 2), single_token_legacy_posture_unchanged, revoked_agent_principal_denied_everywhere, agent_token_file_modes_ enforced, auth_token_sets_second_line_is_agent, auth_token_sets_env_tokens_stay_all_operator, auth_token_sets_agent_file_overrides — plus the authz-matrix class extension authz_matrix_agent_loopback_class (every AUTHZ_GATES row × the agent class, role-gated rows tabulated from the handler sources) and the M2 set health_db_admin_full_read_reduced, public_health_unchanged, admin_sees_domain_labels, tenant_reader_sees_other_not_domain_names (pure pin over scoped_domain_label — shim-mode /metrics can only enumerate global, which every /metrics reader is gated to read, so the cross-tenant collapse is witnessed at the rule itself). Full suite 1,414 passed / 6 ignored at the release commit; clippy bench/default/otel clean; fmt + lipstyk clean; CI dry-run set green; CRATE_TEST_FLOOR 1,313 → 1,318 (needle re-measured: +5 bare-#[test] pins; the ten tokio agent pins ride outside the needle).
• openapi additive: /health/db description + the reduced Read shape + the 403 response. No other wire change; x-api-version unchanged; schema untouched.
• DRILL 2026-09-08 on a COPY of the live DB (release build v1.28.70, test port 8766, two-line token file 0600, BRAIN_WRITE_POSTURE=review): (1) agent bearer → POST /purge → 403 {"error":{"code":"forbidden", "message":"no scope grants Admin on global/global", …}} and the drill DB holds EXACTLY ONE audit_events row with status='denied' and detail_hash = sha256("agent_forbidden") — the denial is evidence; (2) agent bearer → POST /ingest → 202 {"proposal_id":1310, "status":"pending"} — the write landed as a pending proposal, promotable only by an approver; (3) operator bearer → POST /ops/agents/revoke {"principal":"agent@loopback"} → 200 {"revoked":true,"runs_drained:0}, the NEXT agent request dies 401 {"code":"identity_revoked"} at the middleware while the operator bearer still passes /stats 200 — Blackout’s kill-switch binds the agent by name, class-blind; (4) shapes: the operator’s /health/db is the full body (17 top-level keys, model + compliance/DPO present) while the agent’s is the reduced probe {"db_ok":true,"status":"ok","version":"1.28.70"} — and the agent’s /metrics scrape renders the shared pool named (brain_pool_in_use{ domain="global"} — in scope) with no foreign names to hide. Boot posture lines witnessed in both postures: auth: operator token + agent token (scoped) on the two-line file and auth: single token (LEGACY SUPERUSER — second line recommended) on a one-line file. Drill sequencing note (honest): the first pass ran the shape leg AFTER the revocation leg and the agent correctly 401’d — revocation is persistent, so the shapes were re-witnessed on a fresh boot of the same copy with the revocation row cleared.

[1.28.69] — 2026-09-08 — “Deadbolt”: the egress and process boundary — the SEAM LINE closes

The last SEAM LINE release (X-E3, X-M4, X-M5, X-M6 — audit 2026-09-06 §4.7/§4.5). Theme: the two doors left open by .63–.68 — program-driven EGRESS (the shared webhook client could reach any private network its URL named, DNS rebinding included) and the PROCESS boundary (the console crank resolved its harness through PATH, could outlive its timeout, and the pending listing role-checked nothing). One boot-time refusal for private-IP sinks (explicit opt-out env), one spawn-site hardening, one 403. No schema change; no route changes; no openapi change; x-api-version unchanged. Plan: IMPLEMENTATION_PLAN_v1.28.69_Deadbolt.md.

Release notes

Bug fixes

• None. (The orphaned-crank-child fix (X-M5) is a process-hygiene security fix and lives below.)

Security fixes

• SSRF/IP-validation on the shared egress client (X-E3, carried F-E5). The two env webhook sinks (BRAIN_ALERT_WEBHOOK_URL, BRAIN_DSAR_WEBHOOK_URL) now resolve → validate → PIN at boot, per the OWASP SSRF Prevention Cheat Sheet’s bypass-proof form: EVERY resolved address (A + AAAA) must be globally routable per the IANA IPv4/IPv6 special-purpose registries (0/8, 10/8, 100.64/10 CGNAT — Tailscale lives there, 127/8, 169.254/16 + cloud metadata, 172.16/12, 192.0.0/24, 192.0.2/24, 192.168/16, 198.18/15, 198.51.100/24, 203.0.113/24, 240/4, 255.255.255.255; ::, ::1, fc00::/7, fe80::/10, ff00::/8, 2001:db8::/32), parsed as real IpAddrs — string encodings (hex/octal/dword) are canonicalized by the URL parser before the table ever sees them. The metadata hostnames metadata.amazonaws.com / metadata.google.internal refuse before resolution. The pinned client forces every send to the validated address set (reqwest resolve_to_addrs; TLS SNI preserved) — DNS rebinding is closed for the process lifetime. Redirect refusal was the first layer and stays.
• The crank’s binary, absolutely (X-M4). resolve_harness_bin no longer scans PATH: a writable PATH entry in the service context can never again become arbitrary code execution as the service user. Resolution is the absolute BRAIN_STEWARD_BIN override (a RELATIVE value refuses with the requirement named — no silent exe-dir fallback for an override that cannot be honored) or the binary installed beside the kernel. The brain workflow crank CLI keeps its own PATH resolution (the operator’s own trusted context — documented ceiling).
• The crank’s child dies with its budget (X-M5). The harness spawn carries kill_on_drop(true): the 60 s timeout now reaps the child instead of orphaning it past its window. The 30 s hostcall exec path was audited in the same commit — its deadline loop already killed explicitly; the one early-return that could orphan (a failed try_wait) now kills + reaps before returning.
• The console pending listing role-checks (X-M6). POST /webhooks/channel/{kind}/console with action: "pending" (proposal bodies + digests) now requires the mapped actor’s read capability through the same channel_user_map + role-store machinery every other console action uses (empty grants nothing). decide, due, crank unchanged.
• Hostcall egress pinned (X-E3, hostcall half). The mediated HTTP path keeps its operator allowlist (the trust anchor; loopback stays a legal target) but now resolves each allowlisted host ONCE and pins the per-host client for the process lifetime — rebinding closed there too. The client cache is insert-only and bounded structurally by the allowlist (membership is re-checked before any insertion).

Improvements

• BRAIN_EGRESS_ALLOW_PRIVATE=1 is the ONE egress opt-out (fail-closed parse: any other value refuses the boot — the BRAIN_WRITE_POSTURE pattern). It admits a private/metadata sink LOUDLY (boot warn names the host) and the sink stays DNS-pinned.
• A sink whose host does not resolve at boot no longer kills the boot (the sink may be unused): it warns and fails closed lazily on first send with the named egress_unresolved label.

Engineering record

• Migration note (private-sink operators): a webhook sink aimed at a LAN/loopback address now REFUSES THE BOOT (the WRITE_POSTURE pattern: a private sink is a misconfiguration, never a runtime surprise). If the target genuinely lives on your private network, set BRAIN_EGRESS_ALLOW_PRIVATE=1 — the admission is a loud warn and the sink stays pinned. One release of grace: the env can pre-neutralize the refusal without a revert.
• Migration note (steward-bin PATH users): deployments relying on PATH lookup for steward-harness must set BRAIN_STEWARD_BIN to an ABSOLUTE path or install the binary beside brain-server. A relative BRAIN_STEWARD_BIN now refuses the crank with the requirement named.
• Validation: all plan tests green — private_ranges_refused_table (the full registry table as data: every deny range gets literal-IP cases, class labels asserted), metadata_ip_refused, boot_refuses_private_sink_without_opt_out, opt_out_boots_with_warn_and_pins, pinned_client_survives_dns_rebind (pin to an RFC 6761 .invalid name — the system resolver can never answer it, so a delivered request rides the pin; a re-pin attempt loses structurally and the shadow listener sees zero connections), hostcall_host_cache_bounded_by_allowlist, unresolved_sink_fails_closed; relative_steward_bin_refuses, path_lookup_never_consulted, exe_dir_fallback_still_works; crank_timeout_kills_child (scaled 300 ms window + pid-canary kill -0 reap poll), crank_success_path_unchanged; pending_requires_read_role, unroled_actor_pending_refused, decide_path_unchanged. Full suite 1,399 passed / 7 ignored at the release commit; clippy bench/default/otel clean; fmt + lipstyk clean; CI dry-run set green.
• DRILL 2026-09-08 on a COPY of the live DB (release build v1.28.69, test port 8801, bridge config in an isolated config dir, mapped actor UDRILL holding read+write+approve; a quiet fresh-migrated DB for the crank legs — the live copy’s queued-alert backlog tried the sink on every boot, which is the lazy seam working, but noisy): (1) BRAIN_ALERT_WEBHOOK_URL=http://169.254.169.254/latest/meta-data → error: fatal egress config: BRAIN_ALERT_WEBHOOK_URL sink host is not globally routable: egress_private_refused: '169.254.169.254' address 169.254.169.254 is not globally routable (link-local/cloud-metadata 169.254/16) — process exits; (2) http://localhost:9999/hook with BRAIN_EGRESS_ALLOW_PRIVATE=1 → boots AND logs egress: PRIVATE sink address admitted by BRAIN_EGRESS_ALLOW_PRIVATE=1 followed by egress pin: BRAIN_ALERT_WEBHOOK_URL sink host 'localhost' pinned to [127.0.0.1:9999, [::1]:9999] (rebinding closed; a host move needs a restart); (3) a signed console crank at a BRAIN_STEWARD_BIN sleep-harness stub (90 s sleep vs the 60 s budget) → the recorded stub pid is GONE from the process table after the response — and the drill found the reaper firing EARLY: the router’s 30 s TimeoutLayer (408) drops the handler future first, and kill_on_drop reaps on THAT drop too — the child now dies on every abandonment path (previously it survived all of them); (4) a shadowing steward-harness planted in a PATH dir (server PATH pointed at it) → 500 steward-harness binary not found beside the kernel, the planted binary’s canary file NEVER appears, audit row workflow/denied.
• Drill-found placement bug, fixed in-commit: the boot egress check first sat BEFORE tracing init — the refusal printed (anyhow) but every pin/admission log line went nowhere. Moved after injection_policy_boot_warning(); the drill transcript above is from the corrected placement.
• reqwest 0.13.4’s ClientBuilder::resolve_to_addrs is the documented pin seam (per-client DNS override; hyper-util applies the override at resolution and keeps the URL host for TLS SNI — verified against the vendored source; URL-explicit ports always win over the pinned addr’s).
• ponytail: non-goals held — no custom DNS resolver trait / hickory integration (system resolver + pin is enough for two static sinks + a bounded allowlist), no egress proxy architecture, no URL allowlist for the alert/DSAR sinks themselves (they ARE the operator’s allowlist; the guard closes the range class), no changes to enqueue_out/drain semantics (Wardline owns that seam), no eviction machinery for the hostcall client cache (the bound is structural).
• Ceilings (honest): pins live for the process lifetime — a sink host moving to a NEW address needs a restart (documented in the boot log line); the public-only table does NOT apply to the hostcall path (the allowlist is operator trust, and loopback mediation is a pinned feature — the pin closes rebinding, not operator intent); the CLI’s brain workflow crank keeps PATH resolution by design (operator context, not the service context); lazy re-resolution happens at most once per host (boot + first send), so a rebinder’s window is a single resolution; the IANA table is the plan’s enumerate-deny form (the bypass-proof complement — “must be globally routable” — is exactly what the table encodes for unicast space); the console crank’s effective wall-clock is min(30 s router TimeoutLayer, 60 s crank window) — pre-existing layering, and BOTH paths now reap the child.
• Migration note (test suites): any test that points BRAIN_ALERT_WEBHOOK_URL / BRAIN_DSAR_WEBHOOK_URL at a loopback listener must now set BRAIN_EGRESS_ALLOW_PRIVATE=1 for the send — the in-repo Art-19 drill test does exactly that (with the comment naming the posture).
• CRATE_TEST_FLOOR raised 1,303 → 1,313 (the spire needle re-measured at the release commit: ten plain-test additions — six egress pins, the hostcall cache pin, three harness pins; the tokio crank pins and the three main_suite console pins ride the run counts, not this needle).

[1.28.68] — 2026-09-07 — “Shutter”: image + beacon egress closed upstream — the two carried EchoLeak-class seats finally shut

The docs half of a two-tree release. The code half lives in the openclaw fork and closes the two UI egress seats carried open since the 2026-08-23 audit (F-E1/F-E2): document-mode remote images and the favicon auto-fetch beacon, both default-ON since before the fork line began, are now default-OFF and host-allowlisted — plus a 64 KiB decoded budget on data: image URIs (X-E4). brain-server’s half is the server-side version stamp: THREAT_MODEL gains the “Exfiltration surfaces” section (§5) and SECURITY.md names the image/beacon class explicitly in reporter guidance. No code, no openapi, no schema in this tree — docs only, by design. Built in parallel from a v1.28.63 cut in the brain-server-68 worktree, rebased onto the post-.67 main (ship order .64 → .65 → .66 → .67 → .68 held). Plan: IMPLEMENTATION_PLAN_v1.28.68_Shutter.md.

Release notes

Security fixes

• Document-mode remote images default OFF (openclaw, X-E1/F-E1). A poisoned memory rendering ![](https://attacker.example/x.png) in a recovered full message now renders the labeled not-loaded fallback and fetches NOTHING. Opt-in requires BOTH the render flag AND the operator’s gateway.controlUi.remoteImageHosts allowlist (exact hosts; subdomains never implied; empty list = fail-safe for all hosts).
• Favicon auto-fetch default OFF (openclaw, X-E2/F-E2). The authenticated same-origin favicon proxy 404s unless the operator sets gateway.controlUi.automaticallyFetchFavicons: true AND lists the host — one setting, two consumers (UI images + server route, the server re-verifying as defense-in-depth). Unlisted hosts render a new letter tile: no src, no fetch, first letter of the hostname.
• data: image URIs bounded (openclaw, X-E4): only payloads ≤ 64 KiB decoded render; larger ones degrade to the fallback. No fetch involved — the budget caps render-time covert channels and pathological payloads.
• SSRF guard regression-pinned under the new ON posture: the loopback/metadata/private-host refusal now runs with the adversarial host deliberately ALLOWLISTED — the guard, byte/time caps, fixed-HTTPS favicon path, and strict media validation all still enforce when fetching is enabled.
• THREAT_MODEL.md §5 “Exfiltration surfaces”: the closed seats (server-side strip_markdown_refs from Cordon, the two default flips, the data-URI budget) + the standing ceilings stated honestly — bare URLs in prose remain linkified-but-inert (the documented gate.rs ceiling, still open by design), and operator allowlists are trust, not safety.

Improvements

• SECURITY.md reporter guidance names the image/beacon exfil class explicitly, so the next reporter who finds a new auto-fetch seat knows it is in scope (EchoLeak / CVE-2025-32711 namesakes).

Engineering record

• Operator migration (both flips are visible): deployments that want the old look set gateway.controlUi.automaticallyFetchFavicons: true and curate gateway.controlUi.remoteImageHosts (exact hostnames, e.g. ["docs.example.com"]). The empty list is the fail-safe posture; the fork’s config UI exposes both keys with labels/help.
• End-to-end line proof (fork e2e, remote-images.e2e.test.ts): a recovered assistant message carrying ![](https://attacker.example/x.png) plus a bare https://attacker.example/canary URL renders in document mode with zero network requests to the attacker host, the labeled fallback span visible, and the bare URL present as an inert link. Screenshot pair captured via the UI-proof harness (doc-render-untrusted-host- fetches-nothing.png / doc-render-allowlisted-host-loads.png, committed in the fork’s .artifacts/shutter-proof/).
• Validation: 9/9 new+updated fork UI e2e tests green (remote-images ×4, favicon-allowlist ×3, link-favicons ×2); markdown component family 265/265; icon-route suite 66/66; control-ui bootstrap 160/160; config reload 455/455; schema regressions 48/48; oxlint + oxfmt clean on all changed fork files; this tree: full gate at the release commit. The agents’ file markdown preview follows the same rule (fallback) — one gate, no per-surface bypass.
• ponytail: non-goals held — no proxy-side URL rewriting for images (an egress component behind a product whose law is no egress), no per-conversation image toggles (the operator sets the posture, not the document), no blocked-image analytics (telemetry-is-untrusted cuts both ways).
• Ceilings (honest): bare URLs in prose are inert links, not removed — opening that is the gate.rs ceiling; allowlists express operator trust and cannot make a vouched host safe; the data-URI budget caps render-size channels only.

[1.28.67] — 2026-09-07 — “Pin”: MCP catalog fingerprints, verb scoping, signer pinning, hash-only visibility

One breaking wire change (parcel expected_signer becomes required — the migration note is the point: name your counterparty), one env seam (BRAIN_MCP_SCOPE), one additive unsigned counter (/ump/audit/verify integrity), and one fork feature (MCP catalog pins). Fixes the 2026-09-06 audit’s X-M1, X-M3 (HIGH), X-C1 (HIGH), X-C2. Theme: identity is pinned — tool catalogs stop being re-trusted sight-unseen every run, the MCP binary’s destructive verbs become scopeable, and signatures verify against pinned signers instead of self-asserted ones. Honest disclosure: attribution was self-asserted until .67 — provenance marks verified only that SOMETHING signed the bytes, never WHO; a third-party key’s mark verified identically to the operator’s own. .67 closes that wherever an operator key exists.

Release notes

Bug fixes

• None.

Improvements

• The mcp binary accepts BRAIN_MCP_SCOPE=read: the four write verbs (brain_ingest, ump.remember, ump.revise, ump.forget) refuse at dispatch with tool_out_of_scope, and tools/list annotates them "x-brain-scope": "read-denied" so recall-only hosts can render or hide them. Default full is byte-identical compat; an unknown value refuses to start (fail-closed parse, WRITE_POSTURE pattern); the scope logs at startup.
• /ump/audit/verify responses carry the additive integrity census {verified, signed, hash_only} — the UMP record population under the current serve posture — plus note: "hash_only_records_present" when the operator key exists and hash-only records were seen. Visibility, not gating: serve behavior is unchanged.

Security fixes

• MCP catalog pins (openclaw fork): tool definitions are fingerprinted (sha256 over name + description + canonicalized schema) and diffed against operator-acknowledged pins every run; a rug pull — a server mutating a description between approval and use — now SURFACES (notification with old→new fingerprint prefix; drifted tools carry pendingAck). Surfacing, not gating (no ack UX yet); pin-file corruption rebuilds loudly.
• Parcels import requires expected_signer (400 signer_required when missing) and, with a local operator key, refuses an expected_signer aliasing THIS operator’s did on a foreign-produced parcel (409 signer_alias) — nobody imports parcels “from us” that we did not produce.
• Provenance verify accepts the operator pin: a cryptographically valid mark minted by any OTHER key fails with foreign_signer (visible, never a bare false). Without a configured key the L2 posture is byte-unchanged, and the verify-result JSON always surfaces signed_by so self-assertion is visible.

Breaking changes (migration)

• POST /parcels/import: expected_signer is REQUIRED. Clients that imported without naming a counterparty now get 400 signer_required. The migration is one line — name your counterparty: pass the did:key of the publisher you expect in expected_signer. Reverting restores the default-empty signer and REOPENS X-C1.

Engineering record

• M2 (X-M1, brain): McpScope fail-closed parse; dispatch-time scope gate BEFORE any network seam; the gate reads a boot-once OnceLock (the stdio single-parent model makes process-lifetime scope correct); startup logs mcp: scope=<s>. Pins: unknown_scope_refuses_boot, read_scope_refuses_write_tools, read_scope_serves_read_tools, full_scope_unchanged (no annotation key on the default wire), tools_list_annotates_denied_tools. Verified live: BRAIN_MCP_SCOPE=bogus exits 1 with the hex-escaped value; read boots and logs the scope. ponytail: per-tool allowlists are YAGNI — two scopes match the two real consumers; BRAIN_MCP_SCOPE is the only env seam this line adds.
• M3.1 (X-C1, brain): the alias gate runs handler-side BEFORE the tx (it is request policy, not storage); the serde default stays ONLY so the refusal speaks the named 400 (a serde-level required-field rejection would be an anonymous 422). A parcel genuinely produced by the local did passes the gate and verifies on its own signature (the export → import roundtrip is legitimate). Pins: parcel_import_requires_signer (wire, through the composed app), signer_alias_refused (+ the self-parcel control).
• M3.2 (X-C1, brain): verify_artifact_detailed(value, pinned_did) — Ok | ForeignSigner{signed_by} | Unsigned | Tampered | Malformed; the pin check runs LAST so tampering reports Tampered even under a pin (the pin never masks it). verify_artifact_json is the additive verify-result JSON (ok, mark, signed_by, pinned, reason). The four emission-adjacent verify sites (remedy draft, ADR packet, campaign packet, KB manifest — the v1.28.62 shapes, all inside provenance_marks_present_on_all_four_classes) now ALSO verify through the pinned variant against the operator did. Pins: foreign_signer_mark_fails_pinned_verify (the forge-drill shape: mark minted under a throwaway key, pinned verify refuses), no_operator_key_mark_verification_unchanged, signer_did_surfaced_in_verify_json. DRILL 2026-09-07: transcript at /tmp/forge_drill.txt (throwaway seed [9u8;32] mints; operator seed [7u8;32] pins; ForeignSigner{signed_by: did:key:z6Mk…} — copies only, the live key dir untouched).
• M4 (X-C2, brain): the census emits every hash-bearing row the way the §5.3 read seam does and verifies it — verified = what serve would release, signed = carrying a signature under the current serve posture (present iff the operator key resolved). The note fires ONLY for the transitional combination (key exists AND hash-only seen). Serve behavior unchanged — visibility, not gating. The fixture lives in service::ump_ops::tests (the INSERT is storage; the zero-SQL guard is absolute, test residue included — it caught the first placement in development, exactly as designed). Pins: hash_only_counts_surface_in_verify, all_signed_shows_zero_hash_only, key_absent_all_hash_only.
• M1 (X-M3, openclaw fork): agent-bundle-mcp-catalog-pins.ts — per-tool sha256(name + \0 + description + \0 + stableStringify(schema)), per-server digest over name-ordered fingerprints; pins file mcp-catalog-pins.json beside the agent bundle (agentDir discipline, 0644, not a secret); colliding display renames feed the ORIGINAL server-side name into the fingerprint. materializeBundleMcpToolsForRun reconciles per run (openclaw materializes per RUN — per-run re-hash IS the per-execution cadence; OWASP MCP cheat sheet §2/§7 mapping). Drift notifies; the model-visible description renders UNCHANGED (the operator sees drift, not the agent). Acknowledgment is an explicit operator touch; corruption reads as empty (loud rebuild — every tool re-notifies; it can never silence drift). Rug-pull demo GREEN (scripts/rug-pull-demo.mts, transcript 2026-09-07). Residuals: tool shadowing stays a MODEL-level residual (mitigated by Truthglass args-visibility + this drift surface, not closed); mcp-scan named as third-party operator tooling in docs/mcp.md, NOT a dependency.
• Gates: full suite green (1,373 passed / 7 ignored across binaries); clippy bench/default/otel clean; fmt clean; lipstyk diff-strict green; CI dry-run set green; openclaw fork suite green (agents-core shard + full local suite), rug-pull demo green. CRATE_TEST_FLOOR 1,267 → 1,278 (the eleven in-crate pins above; the two parcels wire tests ride tests/, which the floor also walks).
• Ceilings (honest): drift is surfaced, not gated — first use of an un-acked tool is NOT blocked (ponytail: the ack UX does not exist; .73’s key-rotation machinery owns the follow-on). The MCP scope is process-lifetime (correct for stdio’s single parent; an HTTP mode serving multiple clients with different scopes would need per-request scope — not built). The alias gate requires the local key: keyless operators get signer_mismatch instead of signer_alias (the L2 posture unchanged). The census is serve-posture, not at-rest forensics: signatures mint at serve time, so signed == verified whenever the key resolves; the note is dead code today by design (it lights the day a per-record at-rest signature path lands). The fork’s committed pnpm lockfile disagrees with its own typebox catalog (upstream drift predating this line) — pnpm install reconciles it and the npm package-lock guard flags the churn; the committed lockfile was left untouched.

[1.28.66] — 2026-09-07 — “Truthglass”: the approver sees the truth

Theme: action descriptions carry the action’s arguments, destructive CLI verbs prompt consistently, restore names its target, and truncation accounting is honest. Fixes the 2026-09-06 audit’s Lies-in-the-Loop findings X-L1 (HIGH — plugin approvals launder descriptions), X-L2 (truncation shaping), X-L3 (CLI dsar no-prompt purge), X-L5 (restore interlocks). Trees: openclaw fork (M1, M2) + brain CLI (M3, M4). M2 initially rode behind Meridian’s fork half (it re-cuts the same content Meridian wraps in markers) and shipped the moment that half landed on fork main. Parallel-base disclosure: this branch was cut from v1.28.63, built in parallel with Blackout (.64) and Meridian (.65), and rebased onto the v1.28.65 main (floor/version/changelog reconciled in the rebase).

Release notes

Security fixes

• Plugin approvals now carry the tool-call arguments (openclaw fork). Both approval transports (embedded broker + gateway) include args: the EFFECTIVE arguments (base merged with approval overrides — what will actually run) serialized as display JSON, redacted with the same tools-mode redaction persistence applies, capped at 2000 chars with a visible […truncated N chars] marker. The gateway sanitizes + re-caps at its boundary (the same discipline as detail); the protocol schema (TypeBox, closed object) gates the field, and the generated Swift/Kotlin models are regenerated in-commit. The plugin’s title/description stay — the operator sees the prose claim AND the raw act. OWASP MCP Security Cheat Sheet §4 (“display full tool call parameters — not just a summary name”) is now true at this surface.
• Tool-result truncation keeps head AND tail, with exact counts (openclaw fork). The keyword-gated “important tail” heuristic is gone — the last 400 chars ride UNCONDITIONALLY (caveats and disclaimers live at the end of real output; guessing which tails matter is the laundering shape), the middle elision marker states the exact elided count ([... N chars elided between head and tail ...]), and the aggregate elision marker is count-first ([tool result elided: N chars elided; ...]) so a crushed budget costs the rerun guidance before the count. The 16k cap and budget discipline are untouched. The audit’s shaping scenario is the fixture: 100k result, injection at char 500, disclaimer at 99k — the disclaimer survives, the injection stays visible (visibility, not removal, is the contract).

Changed — breaking for scripted use (CLI):

• brain client dsar requires an explicit --action. The old silent purge default — an irreversible multi-domain erasure on a bare invocation — is gone. Omission and unknown values error naming the choices (purge | export | both; both is purge-shaped and prompts too). Without --yes, purge/both print the subject digest (sha256:<12-hex> of the raw subject), the resolved domain, and the irreversibility line, then prompt [y/N] exactly like source-delete. Migration: scripted purge adds --action purge --yes. Export and --dry-run stay prompt-free.
• brain restore always prompts unless --yes. --force now skips ONLY the liveness probe, never the human gate; the prompt prints the resolved ABSOLUTE target path, its on-disk size, and the audit chain head the overwrite destroys (read-only, best-effort). When the probe is skipped-or-negative its blind spot is disclosed on stderr. Migration: scripted restore adds --yes. The .bak safety snapshot is unchanged.

Improvements

• resolve_passphrase refuses group/world-readable passphrase files (mode 0600, mirroring the token rotator) — the passphrase unlocks every backup image.

Engineering record

• M3/M4 land in src/bin/brain.rs: DSAR_ACTIONS closed vocab + dsar_action_from_flags (omission/unknown both error with the choice list), dsar_needs_confirmation (purge|both, --yes seam, dry-run exempt), subject_digest (SHA-256 12-hex prefix of the raw subject — the server still acts on the raw subject), dsar_domains_for_client (live GET /clients/{name} resolve; fail-loud — a purge prompt that cannot name its blast radius refuses), restore_needs_confirmation (force carried in the signature so the pin asserts –force ≠ –yes), restore_target_summary + read_target_chain_head (read-only connection; audit::read_head_pin display), and check_secret_file_mode extracted from the rotator and shared with resolve_passphrase.
• M1 lands in the fork across five files: the TypeBox schema field (closed object — unknown fields are REJECTED, so the schema IS the registration), PluginApprovalRequestPayload.args + the exported truncatePluginApprovalArgs (code-point-safe, exact-count marker), buildApprovalArgs in the approval transport (computed ONCE; both surfaces see the identical truth; unserializable params render as "<unserializable arguments>" — silent omission is the laundering shape), and the gateway pass-through (sanitize once at the boundary like detail, then cap). Protocol models regenerated (protocol:gen, :gen:swift, :gen:kotlin); protocol:check:swift green.
• 9 new CLI tests (red-first): action-required shape, unknown-action choices, purge/both prompt matrix, --yes seam, prompt content (digest + domain count + IRREVERSIBLE), pinned sha256 vector, restore prompts-even-with-force, --yes seam, target summary (resolved absolute path + size + chain head, pinned via a seeded schema_meta pin row), wide passphrase refused. 5 new fork approval tests: payload-includes-args (embedded broker, end-to-end with resolve), redaction parity with persistence, visible truncation with exact counts, embedded/gateway parity, exec-transport unchanged. Fork truncation suite: the four M2 pins (head+tail unconditional, exact-count arithmetic — marker count equals original minus kept head minus kept tail, compact-suffix shape drift pin, the audit’s shaping-scenario fixture) + the two legacy strategy tests rewritten to the unconditional contract + the surrogate code-point test re-pinned (the old byte-exact expectation described the head-only output; the new invariants: both ends ride, marker counted, no U+FFFD, emoji never split). CRATE_TEST_FLOOR 1,267 → 1,276 on the original branch; 1,281 → 1,290 at the rebase onto v1.28.65 main (Blackout’s 1,281 + the 9).
• M2 implementation notes: the tail reservation is bounded to half the budget minus the marker’s widest form (the marker at text.length is the exact upper bound — the count only shrinks toward it), so a tight budget shrinks the tail instead of falling back to head-only; a bounded fit loop (≤4 rounds, each strictly shrinking the head) absorbs marker digit-width drift so the baked count stays exact within the budget. The aggregate marker is count-first: under a crushed budget the marker is sliced from the tail, costing the rerun guidance before the count. A notice larger than the result it replaces is a net increase and the budget loop skips it — elision notices ride only when they actually save budget.
• Scripted drills: the OLD brain client dsar <name> <subject> → --action is required: choose one of purge | export | both … (exit 1, before any network touch); purge without --yes against a dead server → client resolve error (no request fired — the prompt runs pre-POST).
• Gates: brain full suite + clippy -D warnings + fmt clean; fork agents/gateway/unit-support lanes green, the FULL embedded-agent lane green after M2 (1,771 tests / 85 files), full lint green after a clean reinstall (the worktree’s first --frozen-lockfile install silently failed on committed drift — extensions/brain-server typebox 1.3.15-lock vs 1.3.18-manifest; repaired with a 2-line lockfile sync riding the fork commit), Swift drift check green.
• Honest ceilings: the manual approval-surface screenshot (fork DoD) is still pending a human run — the payload contract is what’s machine-verified. The TUI/card renderer displays args as a plain field; a dedicated monospace block is a cosmetic follow-up. Under a crushed aggregate budget the elision marker is still sliced (count-first, so the count outlives the guidance, but a ~25-char budget cannot fit any honest notice) — the protected-entry notice floor is the real path’s guard. The compact recovery suffix and default truncation notice already carried counts; they are pinned unchanged by source drift locks rather than behavioral tests. No server route, schema, or wire change (openapi.yaml untouched; x-api-version unchanged).

[1.28.65] — 2026-09-07 — “Meridian”: content hygiene across the model seam — three trees, four doors

Nothing enters model context unstripped and unlabeled, regardless of which door it used. The smallest structural layer at each of the four doors the 2026-09-06 audit found open: X-R1 (/suggest untrusted label), X-R5 (plugin strip-set drift), X-S1 (HIGH — openclaw plugin seam unfenced/ unstripped), X-M2 (HIGH — openclaw MCP results verbatim). Ships across three trees the same day: brain-server (M1), plugin/ (M2), the openclaw fork (M3, M4 — their changelog cross-references this release). Ordering note (final): v1.28.64 “Blackout” ran in PARALLEL on the same day per operator call and SHIPPED FIRST — its release commit (ff7a8d9) rode the same main push as the two Meridian fix commits (0b66d3b, 03819bf), so keep-a-changelog order has §[1.28.65] above §[1.28.64]: the fixes landed on main before Blackout’s version bump, and that is the honest history. The SEAM LINE numbers follow the audit’s plan table, not commit sequence. The line’s first live end-to-end proof ran 2026-09-07: docs/MERIDIAN_PROOF_20260907.md (transcript retained).

Release notes

Security fixes

• /suggest joins the untrusted contract (X-R1). Every hit now carries untrusted: true — recall/search parity. Suggested content is data, never instructions. Additive JSON field; openapi.yaml schema entry added additively; docs/api.md one-liner. Content itself already passed sanitize_read — the label was the whole fix.
• The openclaw host merge seam strips and neutralizes (X-S1, fork). Every plugin-supplied prompt-context segment is invisible-Unicode-stripped and host-marker-neutralized at mergeBeforePromptBuild — the ONE convergence point both the embedded and CLI runners ride. Forged ⟦openclaw:ctx⟧ markers and forged <active_memory_plugin> fence tags are ZWSP-split (visually identical, mechanically unmatchable); the brain plugin’s own UNTRUSTED_BEGIN/END fence survives byte-identical (pinned).
• MCP tool results ride the external-content idiom (X-M2, fork). Text blocks are invisible-stripped; the joined result is wrapped ONCE (never per block) in the same wrapExternalContent envelope web_fetch uses, with the new MCP Tool Result source label — the untrustedMcpOutput flag finally renders as prompt framing instead of a non-rendering metadata detail.
• Plugin strip set synced to the Rust canonical set (X-R5, plugin). sanitizeForBlock gains the members the old set lacked (U+061C, U+E0100–E01EF, U+FE00–FE0F, U+180E, U+115F/U+1160, U+FFF9–FFFB, and the U+2060–2063/U+00AD/U+034F legacy members), exported as INVISIBLE_CLASSES; plugin 0.5.0 → 0.5.1. Behavior change is invisible-class-only prompt bytes.

Improvements

• The openclaw host’s stripInvisibleUnicode widened to the Rust canonical set (adds bidi isolates U+2066–2069, ALM U+061C, variation selectors, legacy members) — the same drift class X-R5 flagged, closed host-side.
• wrapExternalContent refactored onto an exported createExternalContentEnvelopeSegments (byte-identical output) so the multi-block MCP envelope shares the exact marker/metadata family.

Engineering record

• M1 (brain): SuggestionHit gains pub untrusted: bool (plan-verbatim doc comment), serialized true at the single construction site (handlers/suggest.rs:213 region). Pins: suggest_hits_carry_untrusted_true (wire shape serializes) + suggest_label_parity_with_recall_and_search (the three-surface source pin: recall.rs ≥5 sites, search/mod.rs, suggest.rs each carry the declaration + the untrusted: true label). CRATE_TEST_FLOOR 1,267 → 1,269.
• M2 (plugin): the parity fixture plugin_invisible_set_matches_rust_canonical (one probe char per Rust-set class + survivor vectors) is THE DRIFT PIN — either side changing without the other fails CI. 53 plugin tests green.
• M3 (fork): new src/plugins/context-hygiene.ts — sanitizePluginContext applied to the JOINED accumulator per merge pass (strip runs FIRST, so the sanitizer is idempotent and a plugin-supplied pre-split marker re-forms and re-splits). The built-in active-memory plugin’s own emitted tags are split too — deliberate and uniform (no per-plugin logic): the model reads the rendered text identically while no literal tag can re-form from plugin-supplied text. Eight tests incl. the pre-split re-neutralization and the brain-fence-survives pins.
• M4 (fork): projectMcpCallToolResult (the single top-level assembly both MCP consumers share) wraps real content exactly once; the host-authored empty placeholder stays unwrapped. Materialize fixtures updated to unwrap the envelope before asserting (their projection intent unchanged); the envelope itself is pinned by mcp-content.wrap.test.ts.
• Gates: brain full suite green (cargo test –features bench), clippy -D warnings clean, fmt clean; plugin vitest 53/53; fork typecheck + lint + targeted vitest shards green (plugins/infra/security/materialize/code-mode/ new suites). Two disclosures from the shared release window: (1) the pre-push lipstyk gate blocked on plugin/src/format.ts comment density (66%) — resolved by a comment-only condensation (4e6c477), zero behavior change; (2) the connector-stub spawn test (live-server integration, the known pre-existing race disclosed in §[1.28.64]’s ceilings) fired once under the parallel sessions’ load — the live server stalled 12.6s and the stub’s 15s timeout tripped; passed on rerun, no code touched.
• Live proof (2026-09-07): docs/MERIDIAN_PROOF_20260907.md — a memory carrying the U+E0000 tag block + forged host markers, ingested into a TEST server (fresh DB, test port, copies-only discipline), recalled through the real plugin + host merge + CLI composition: all three forgeries absent from the composed prompt, brain fence byte-identical. GREEN.
• Ceilings (honest): X-R2/X-R3 stand — HTTP JSON is unfenced by design (consumers fence); Meridian makes the two REAL consumers’ hosts structural. HTML strip is .72’s call. No taint lattice / per-plugin origin classification (X-S2 → .74 Origin); the allowPromptInjection=false opt-out remains the stronger kill switch and no stripContext escape hatch was added. MCP schema pinning is .67; truncation shaping is .66 — a result wrapped BEFORE truncation can lose its end marker in model view until Truthglass ships head+tail honesty. No server-side fence envelope on HTTP JSON. The fork’s pnpm-lock.yaml typebox bump present in the working tree predates this line and is NOT part of these commits.
• Wire: openapi.yaml additive only; x-api-version UNCHANGED; schema untouched; no new deps in any tree.

[1.28.64] — 2026-09-07 — “Blackout”: revocation and surface identity, completed

The kill-switch becomes authN-wide for real, the denylist outlives the tokens it denies, and the server’s public surface and guard tables become single-sourced and two-directional. Closes the identity/authority findings X-A1 (HIGH), X-A2, X-A3a, X-A6, X-A7, X-A8, X-A9 from the 2026-09-06 audit. No schema change; no new deps; wire additive only.

Release notes

Security fixes

• The principal kill-switch now runs at the authentication layer (X-A1). Before this release, a revoked agent holding a still-valid JWT or capability token kept recall/ingest/proposal/outbox access on every non-mesh route — handlers/mesh.rs claimed “revocation is identity-wide” but the claim was mesh-only (cards, delegation dispatch, result submission). That scope disclosure is now honest: after a revocation, ANY bearer naming the revoked identity is refused 401 identity_revoked on EVERY route, after the credential verifies and BEFORE authorization runs (the identity is dead, not unauthorized for the route). The denial is byte-identical for every revoked principal — a straight keyed read of the bearer’s own identity, no provisioning lookup, so no existence oracle is added (probe-blind, same doctrine as the mesh check) — and the denial is audited path-only (never the token). Capability tokens deny through their issuer principal (the iss is the capability’s identity anchor) in BOTH auth middlewares; a revocation committed mid-flight denies the NEXT request with the same bearer (decision-time, no liveness cache). Documented scope: opaque-loopback bearers have no principal id to revoke (the static-token world predates identities; the operator/agent split is the Twokeys line).
• Logout/revoke denylist rows live exactly as long as the token they deny (X-A2). Rows were written expires_at = now + 15 min regardless of the token’s real exp — for a longer-lived external-IdP token the row was purged while the token still verified: a silent revocation lapse. The row’s TTL is now the verified token exp (injected by the JWT middleware beside the principal), clamped to 24h so a hostile or clock-wrong IdP value cannot pin rows to the bounded table forever. Server-minted 15-minute tokens behave byte-identically (the clamp never bites).
• Per-kid algorithm pinning (X-A3a). A key record’s declared alg is compared strictly against the JOSE header’s alg BEFORE any signature work; a mismatch refuses 401 alg_mismatch_for_kid. The family slack is closed (an RS256-recorded kid no longer verifies an RS384 token signed with the same key — the header’s alg is attacker-chosen, the record’s is not). Every load-path record declares its alg (auto-detected from the PEM key shape), so no re-import is needed; the None escape hatch keeps the whitelist-only behavior for a future undeclared record (additive).

Improvements

• ONE public-path list (X-A6). The two auth middlewares carried duplicate matches! blocks asserted equal by nothing (and already disagreeing with the coverage table). Both now consume a single route_guards::PUBLIC_PATHS + is_public_path decision living beside the tables it feeds; /.well-known/security.txt joined both guard tables (the one row gap), marked public (the middleware exemption, spelled as data).
• The guard tables verify BOTH directions (X-A7, X-A8). A new reverse-direction guard walks every (method, path) the composed router registers and demands each appears in OPENAPI_ROUTES and — unless public or explicitly allowlisted — in AUTHZ_GATES. The forward-only check had let 17 registered paths sit outside both tables. Fixed by ADDING rows (the handler gates were verified correct at the finding’s audit — table debt, not gate debt): /workflow/scoreboard (Admin), /workflow/calibration/sign (Admin), /workflow/plugins/mount (Write), /stats (Read — a legacy 200-shell route whose real gate was invisible to the tables). The declared allowlist (8 SPA-seat routes, 5 feature-gated compliance-pack routes, 2 middleware-presentation carve-outs) is anti-rot-checked: an exemption whose route disappears fails the scan. The scan is also METHOD-keyed now — the old last-insert-wins map scanned only one method’s handler on shared paths; every method’s handler must carry its gate. Both counter-self-pins red-proof the guard (a planted missing row fails; a planted gate-less POST on a shared path fails).
• INJECTION_POLICY=allow is never silent (X-A9). The one env var that disables a security control entirely had no boot validation and no warning. allow (a real trusted-local-sources posture — refuse-at-boot deliberately NOT taken) now warns once at boot naming the env var and the consequence, and /health/db’s hardening block echoes the resolved policy (quarantine|reject|allow) so every health scrape shows the screen’s state. Additive JSON field; Read gate unchanged.

Engineering record

• M1 (authN kill-switch): the check sits inside the JWT middleware’s existing spawn_blocking verify block (after the jti denylist read, one more indexed SELECT — the same workflow::mesh::is_revoked the mesh surfaces consult, so cost is the proven dispatch-path cost) and in a shared ensure_cap_principal_alive helper on the capability pass-through of BOTH middlewares. Store failure denies (fail-closed, the jti-check posture). The opaque middleware’s state grew from a bare TokenStore to OpaqueAuthState {tokens, pool, db_path} — the pool is what makes the capability seam reachable in opaque mode (the live deployment posture). handlers/mesh.rs’s identity-wide claim is now code-true; the CHANGELOG above discloses the pre-.64 mesh-only scope. Pins: revoked_jwt_principal_gets_401_on_every_route (route-class spread), revocation_checked_before_authorize (401-before-403 ordering), revoked_capability_token_denied (real operator key, real route), unrevoked_principal_unaffected, revoked_denial_is_probe_blind (carded-vs-rowless revoked principals, byte-identical bodies), kill_switch_survives_dispatch_race, plus the law-9 matrix extension authz_matrix_revoked_principal_row_per_class (six JWT classes die at the middleware; the opaque class pinned unaffected — no principal id).
• M2 (denylist TTL): pure denylist_expires_at(exp, now) with the Option::None escape keeping the operator-revoke default; the verified exp rides request extensions as AccessTokenExp (Copy newtype). Pins: logout_row_outlives_long_lived_idp_token, denylist_row_capped_at_24h, server_minted_logout_unchanged.
• M3 (kid pinning): VerifyingKey.pinned_alg (Some at every load-path constructor + the jwt test factory), the strict compare after kid lookup, AuthError::AlgMismatchForKid → alg_mismatch_for_kid wired through the handler status map. Pins: rsa_kid_rejects_different_rs_variant, unpinned_kid_keeps_family_behavior.
• M4/M5 (surface identity): the scan helpers live in tests/main_suite.rs (strip_cfg_test_regions — a string/comment-aware brace stripper so middleware test modules’ /private stubs never pollute the wire scans; collect_registrations; the pure reverse_guard_failures). authz_gates_cover_every_non_public_route was rebuilt on the method-keyed scan (rows marked public skip the authorize-literal demand). spire floors raised in-commit: guard tables 163 → 167 / 147 → 152 rows, CRATE_TEST_FLOOR 1,269 → 1,281.
• M6 (injection-policy visibility): config::injection_policy_boot_warning called once from the bootstrap (a counting-subscriber pin proves exactly-once for allow and never for quarantine/reject); config::injection_policy_echo feeds the /health/db hardening block; the health-body key pin extended.
• Live drill 2026-09-07 (COPY of the live 51.6 MB db — the live DB was never touched): release binary, JWT mode, spare port 18799, RSA kid on disk. Pre-revocation: operator (admin:*/*) and victim (read:*/*) both pass (200). POST /ops/agents/revoke {principal: agent:drill-victim} → 200 {revoked: true, runs_drained: 0}. The victim’s NEXT request with the SAME bearer → 401 identity_revoked (body {"code":"identity_revoked","error":"unauthorized"}); a second route (/recall) denies identically. The operator stays 200. /audit/verify → {"domains":{"global":true},"ok":true}. The drill DB’s audit chain carries the revocation row (actor user:drill-operator, status ok) and two denied rows keyed path-only (target = /stats, /recall hashes; identical detail hash — the path-only, token-never law) chained into the live-format hash chain. /health/db echoed injection_policy: "quarantine" (default posture).
• Wire: openapi.yaml additive (the IdentityRevoked 401 response component, the injection_policy health field, the bearerAuth scheme note); api.md gained the revocation paragraph + security.txt row; route tables gained the four rows above; x-api-version moves with the Cargo version (the wire contract moved additively); schema untouched.
• Honest ceilings / deviations: the connector-stub spawn test (a documented live-server integration test) raced ONCE during the gate — the live server stalled 12.6s under the parallel Meridian line’s load and the stub’s 15s read timeout fired; it passed on rerun and is pre-existing test-infra (the AGENTS.md known-flaky class), untouched. Hot-reload key rotation stays register (X-A3b — restart-rotation documented); /metrics label scoping stays with Twokeys (X-A5); no background revocation worker (decision-time checks only, the house mantra); no per-route revocation granularity (identity-wide IS the contract); legacy jti-less capability tokens stay expiry-only for replay (documented ceiling, the identity check does not depend on jti).

[1.28.63] — 2026-09-06 — “Wardline”: reserved vocabulary at the workflow input seam — the SEAM LINE opens

One milestone, one law made true in code: kernel-only outbox topics can no longer be forged through the agent-facing events route. The honest disclosure first: between v1.28.43 (when the events route shipped) and this release, the three-gate channel law was CODE-FALSE at the outbox seam — POST /workflow/runs/{id}/events could mint channel/out, channel/ping, steering, and workflow/valet* rows with none of the gates those topics promise, and the drains trusted the table. Found in the 2026-09-06 security audit (§4.1 X-W1…X-W5); verified live against a DB copy before the fix (the forged envelope was delivered by the real HMAC bridge drain), and verified dead the same way after.

Release notes

Security fixes

• Reserved outbox topics (channel/*, steering, workflow/valet*) are kernel-only. The single gate lives in enqueue_child (the shared function, not a per-caller check) behind RESERVED_OUTBOX_TOPICS — one pub const in workflow::outbox — with a pub(crate)-constructor KernelOrigin token held by exactly four kernel writers (enqueue_out, enqueue_ping, the steering inbox write, the valet crank). The events route now refuses reserved topics with 400 topic_reserved + a denied audit row on the workflow chain (outbox_reserved_refused topic=…) — error paths deny loudly, never a silent drop.
• The run-status vocabulary is closed. PUT /workflow/runs/{id}/state accepts only active | cancelled | closed | completed | fired | resolved (frozen from the observed writers/readers: open_run, the revocation drain, the valet crank, the workload acceptance; kcs capture, scoreboard, relay’s run guard). Unknown values refuse 400 unknown_status + audit row. CAS semantics untouched.
• The valet label fence is function-held. The injection screen moved INTO stamp_state (and the new open-path vet): a valet/% run opened over HTTP with a screen-Reject or Quarantine label refuses 400 screen_rejected; a state that is not a readable valet envelope refuses 400 valet_state_invalid. Both screen verdicts refuse — an operator-channel label has no quarantine destination.
• The alert bus authenticates the valet/due kind. A workflow/valet* row publishes under the trusted valet/due kind only when its idempotency key carries the crank’s valet- prefix (no new provenance column — the prefix IS the kernel signature today); anything else publishes as the generic workflow kind.

Bug fixes

• None reported.

Improvements

• openapi.yaml documents the two new 400 shapes and the status enum; docs/api.md notes the reserved-topic and closed-status contracts. No route additions (route-coverage / route-authz tables unchanged); no schema change; x-api-version unchanged.

Behavior-change ledger (previously-accepted requests that now refuse — documented, not silent)

Engineering record

• Live drill, DB copies only (the live DB was never touched; copies destroyed after). BEFORE (v1.28.62 binary, ad4ede8): forged channel/out → row landed → the real HMAC drain (POST /webhooks/channel/signal/drain) delivered the forged envelope to the bridge; forged channel/ping → claimed+delivered; steering with injection text → landed in the inbox read; status="zzz_arbitrary" → written to the run row; forged workflow/valet-due → drained and published by the trusted alert worker within one 2 s tick. AFTER (this release): all four forgery shapes → 400 topic_reserved; arbitrary status → 400 unknown_status; injected valet label → 400 screen_rejected; five denied audit rows on the workflow chain; the drain returns an empty batch (nothing forged exists to deliver); /ump/audit/verify ok; positive controls (workflow/log enqueue, clean CLI-shaped valet open) still 200.
• Pins (11 new; CRATE_TEST_FLOOR 1,256 → 1,267): reserved_vocabulary_ semantics, enqueue_child_refuses_reserved_topics, kernel_writers_still_mint_reserved_rows, kernel_steering_still_enqueues, reserved_refusal_converts_to_loud_sql_error, kernel_enqueue_out_still_lands_channel_rows, forged_valet_due_publishes_as_generic_not_valet_kind, stamp_state_screens_like_ingest, valet_crank_still_fires_clean_reminders, vet_open_state_holds_the_ fence, and the M4 meta-pin reserved_topics_are_declared_in_one_place (a dup-guard grep: reserved-topic literals in production source fail outside the const + the four kernel writers’ files). Handler-level: post_event_cannot_forge_channel_out/ping/steering_topic, reserved_refusal_writes_audit_row (exact-detail digest), put_state_rejects_unknown_status, put_state_accepts_every_observed_status (the freeze — any new status is a deliberate test edit), run_open_with_injection_what_is_refused.
• Full suite green with --features bench (lib 1,086 + main_suite 171 + the rest; zero failures); clippy -D warnings on default/bench/otel; CI dry-run set green (default-features build, engine-crates, steward-harness, otel); lipstyk diff-strict green; cargo fmt --check clean.
• Ceilings (honest): steering is reserved EXACTLY — a hypothetical steering/x sub-topic is not reserved (no consumer exists; extend the const only with a kernel writer that owns the gate). KernelOrigin is a pub(crate) review-and-grep-enforced marker, not a memory-safety boundary — a crate-internal caller COULD mint one, visibly. The alert-bus kind authentication trusts the idempotency-key prefix; a real provenance column stays a non-goal until a second kernel valet writer needs distinguishing. The closed status vocabulary freezes the observed set — a legitimately new status requires the const extension in the same commit as its writer/reader.

[1.28.62] — 2026-09-06 — “Attestation”: provenance marks, the principal kill-switch, the crypto inventory — the Enterprise Line closes

The Enterprise Line’s finale. Three verified gaps close — Art 50(2)-style provenance on engine-generated artifacts, agent credential lifecycle (ASI03/07), and the cryptographic inventory/agility seam — plus the approval-fatigue signal becomes DPO-visible on the scoreboard. Additive only: no breaking wire change, no new crypto primitive, no C2PA claim.

Release notes

Security fixes

• The principal kill-switch (ASI03/07). A compromised or offboarded agent principal can now be revoked in one call (POST /ops/agents/revoke, Admin on global). Every card use, delegation dispatch, and result submission re-checks the new revoked_principals table BEFORE signature verification and refuses 403 principal_revoked — including re-signed cards (revocation outlives re-provisioning). In the same transaction, every ACTIVE run where the principal owns in-flight delegation work drains through the existing run-cancel path, and the revoke plus every drain land on the hash-chained audit chain. Revocation is fail-closed and probe-blind: a revoked principal’s card lookup refuses before any signature work.
• Provenance marks on every engine-generated text artifact (Art 50(2) posture). Complaint remedy drafts, ADR packets, outreach export packets, and KB build manifests now carry a machine-readable {"provenance": {"mark": "AIGEN", "generator": "brain-server/<version>", "generated_at", "signed_by", "sig"}} object, Ed25519-signed over a canonical wrapper that binds the artifact body to the mark claim — flip the mark OR one body byte and verification refuses. Human-authored artifacts mark HUMAN with the actor principal. Without an operator key the mark is present but visibly unsigned (never silently unmarked). Honest scope: text artifacts riding existing envelopes — NOT C2PA, no media signing.

Improvements

• Approval-fatigue telemetry on the scoreboard (ASI09). The console’s rubber-stamp detector arithmetic now runs server-side: GET /workflow/scoreboard (DPO/admin, role gate unchanged) carries review_independence_risk (0|1), approval_uniformity_ratio (integer ten-thousandths), and review_decisions_window — over the same window and sample cap the client fetch uses, pinned verdict-identical to the client detector by scoreboard_uniformity_matches_client_math. docs/metrics.md and metrics/metrics.json gained the three entries in the same commit (the parity meta-test enforces the twins).
• Cryptographic inventory + algorithm-agility seams (docs/crypto-inventory.md, NCCoE SP 1800-38B shape): every shipped algorithm (Ed25519, HMAC-SHA256, SHA-256, BLAKE3, the RS256/ES/EdDSA JWT family, AES-256-GCM, Argon2id) with its real call sites, what it protects, its harvest-now-decrypt-later verdict, and its swap path. The two agility seams are documented against the real code: the JWT ML-DSA landing procedure (the auth/jwt.rs::ALLOWED_ALGS whitelist is the one gate) and the UMP did:key multicodec version-prefix rule. No PQC is deployed — the classical-signature ceiling is printed, owned.
• The kill-switch runbook + executed drill (docs/runbooks.md): the four-step procedure with its dated 2026-09-06 record — executed against a copy of the live DB: agent revocation → cards list 403, dispatch 403; owner revocation → runs_drained:1, run cancelled via the existing CAS path, delegation/revoked lineage event observed, /audit/verify ok.
• Nightly fuzz schedule: the committed brain-fuzz corpus replays every night in CI (plus a compile check of the libFuzzer targets); corpus replay stays in the per-push CI too. The schedule’s compile check caught and fixed a latent libfuzzer-feature warning under -D warnings.
• SOC 2 trust kit refreshed: docs/trust/proof-map.md carries the Attestation evidence rows (provenance, kill-switch, crypto inventory, uniformity telemetry, calendar-as-code watches).

Engineering record

• M1 provenance (src/provenance.rs): one attach, one verify. The signature reuses the parcels/standby convention (ump_integrity::sign_manifest_bytes), but the signed message is a canonical wrapper binding body to CLAIM — {artifact, claim: mark / generator / generated_at / actor} — because the naive body-only design let a flipped mark verify (caught by the tamper pin in development). Sealing rides the REAL emission shapes: the remedy-response assembly and the two post-read-seam seal fns in handlers/workflow.rs, and the KB writer (kb::sealed_manifest_json inside write_artifact — the pure manifest_json digest rule is byte-unchanged, the seal adds one field). Pins: provenance_marks_present_on_all_four_classes (drives the real producer fns end-to-end), tampered_provenance_fails_verify (flipped sig, flipped mark, tampered body × every class), unsigned-degradation, HUMAN-actor, round-trip. reg_watch ai_act_art50_marking_watch flipped WATCH → ai_act_art50_marking_deliverable: the 2026-12-02 horizon stays stamped; the pin asserts the module, the four wiring points, and the meta-tests exist. openapi response schemas carry the additive provenance property (x-api-version UNCHANGED); api.md rows in-step.
• M2 kill-switch: additive migration revoked_principals (schema stamp → 1.28.62, SCHEMA_VERSION_V1_28_62 in storage_layout). Enforcement points: verify_card (pre-signature, pre-lookup), request_delegation (revoked dispatcher refuses before any write; revoked target via verify_card), submit_result (decision-time re-check). The drain: the revocation upsert + hash-chained auth audit row + a bounded sweep of active runs owning in-flight delegations, cancelled via workflow::state::cas_update (the EXISTING path PUT /workflow/runs/{id}/state serves) with per-run audit rows and delegation/revoked lineage events; CAS-stale races skip (the decision-time re-checks still refuse). Routes: POST /ops/agents/revoke (Admin on global — identity-wide, not domain-scoped) + GET /ops/agents/revocations (Read); openapi + both guard tables + api.md in the same commit. Pins: revoked_principal_cards_fail_closed, revoked_owner_no_new_dispatch; the authz matrix gained the route’s body template. reg_watch::revocation_drill_recorded green.
• M3 uniformity: workflow::scoreboard::approval_uniformity — the verdict expression is the client’s f64 form verbatim (same divide, same compare; the exactly-0.9 boundary resolves identically); the ratio is the house integer ten-thousandths. The data fn mirrors the client’s fetch (trailing 7 days on created_at, latest 200 per status, decided-only). Scoreboard visibility NOT widened (inherits the existing DPO/admin pair). Dictionary twins (docs/metrics.md ASI09 section + metrics.json, full attribution) landed in the same commit — the meta-test reds otherwise.
• M4 crypto inventory: see the Improvements row; reg_watch pqc_inventory_seam_watch flipped WATCH → pqc_inventory_seam_deliverable (horizon 2030-12-31 stamped; the pin asserts the SP 1800-38B anchors, all seven algorithm families, and that both seams still name their real files). The watch module’s clock machinery (Hinnant civil-date conversion) keeps a self-test pin for the next WATCH-form deadline.
• Live proof (COPY of the live 50.6 MB db, drill token, spare port): kill-switch drill as recorded in docs/runbooks.md; the ADR packet and the KB build manifest carried valid signed AIGEN marks (digests unmoved); 21 digest-bound approvals through the real approve verb flipped the scoreboard from risk 0 / ratio 0 / 0 decisions to risk 1 / ratio 10000 / 21. The M1 tamper refusal is pinned by tests (the live capture shows the sealed artifacts).
• Validation: full suite 1,256 #[test] (CRATE_TEST_FLOOR 1,244 → 1,256); clippy -D warnings clean on default/bench/otel; engine crates + steward-harness green; lipstyk diff-strict clean; openapi coverage + authz-matrix + docs-truth guards green. main.rs untouched (net delta 0); wire/schema additive only.
• Ceilings (honest): provenance marks are TEXT-artifact marking, not C2PA/media signing; unsigned marks verify-fail by design (an operator without an operator key ships visibly unsealed artifacts); the kill-switch gates the mesh decision paths, not the JWT layer (that is auth/revocation.rs, separate machinery); the drain covers runs the principal OWNS in-flight work on, not historical participation; no PQC primitive is deployed — JWT ML-DSA waits on the IdP, UMP signatures land via the did:key multicodec prefix; the uniformity detector is a heuristic (a reviewer-baseline cohort tooling remains v2.x); the drill binary was built pre-version-bump (stamped 1.28.61 — the drill record notes it).

[1.28.61] — 2026-09-06 — “Standby”: the warm-standby core; the seven open CodeQL alerts closed

Two lines land together. The warm-standby core (ship cycle, signed follower manifests, rehearsed promote-check) rides the standby-m1 commits; this section’s scope is the security half — the full CodeQL triage and closure of every open GitHub code-scanning alert, three families across six sink sites.

Release notes

Security fixes

• Path injection (×3 alerts, high) — the DB-size probes no longer touch the filesystem at all. The three capacity surfaces (guard_capacity, the shared measure_capacity, the /health/db detail probe) measured the database by statting a state-derived path (fs::metadata(&state.db_path)); they now read the size through the open SQLite connection (PRAGMA page_count × page_size), so no request- or config-derived path expression remains on the surface (the same fix landed on the handlers-side twin whose alert had been dismissed earlier). Additionally, a .. component in BRAIN_DATA_ROOT now fails layout resolution and in BRAIN_DB_PATH falls back to the layout default instead of being honored verbatim — a hostile storage-env knob can no longer move the database outside the stated tree (every derived path — legacy DB, domain DBs, backups, registry — inherits the refusal).
• Log injection (×1 alert, medium) — request-derived values are scrubbed before they reach a log line. The markdown-ingest handler’s post-commit failure logs now pass the payload-supplied domain through sanitize_log_value (control characters → space/removed); a crafted newline in a request could otherwise forge entries in the journald/launchd log stream. The stored value is unchanged — the scrub is logging-only.
• Cleartext logging (×3 alerts, high) — the DSAR deletion certificate is no longer interpolated into test assertion failure messages. The certificate carries personal-data handling detail; failing asserts now reference the fixture row ids instead. Assertion behavior is unchanged.

Improvements

• The warm standby, end to end (brain standby start|status|promote-check): the shipper cycles a PASSIVE checkpoint, the encrypted base (the backup v3 writer), and the WAL chunk — every byte at rest on the follower is AES-256-GCM sealed, manifests are Ed25519-signed and verified with recomputed artifact hashes, and status fails closed on any tamper or torn cycle. promote-check is the rehearsed drill: the shipped restore path into a temp dir, PRAGMA integrity_check, measured RTO and computed RPO (interval + checkpoint lag) on the exit code. The shipper is an operator-run process (launchd/systemd snippets in deployment.md) — never a server thread. Full narrative + the dated drill record in the engineering record below.
• The CLI reference law: cli_reference_covers_subcommands parses the SUBCOMMANDS table and fails when any command lacks a cli-reference.md row — it closed four pre-existing gaps (brain parcel, wfm-import, valet, ropa had shipped with no reference rows) and now guards every future command.

Bug fixes

• None.

Engineering record — the CodeQL security triage

All seven open alerts were raised by the security-extended suite against commit 1d313e3 (the Loom feature commit). Triaged and closed in the same release:

• Path injection (rust/path-injection, CWE-22): the analyzer’s flows do NOT originate in the storage env vars — the SARIF code flows run from the axum handler State extraction (route registration → handler body → the state parameter entering the guard) into the three flagged fs::metadata(&state.db_path) size probes (guard_capacity, the shared measure_capacity, and the /health/db detail stat). Two-part closure: (1) the sink is ELIMINATED — the DB size is now measured through the open connection (PRAGMA page_count × page_size, the new capacity::db_size_bytes), so no path argument exists on the capacity surfaces at all; measure_capacity lost its &Path parameter and the /health/db + /metrics handlers no longer clone state.db_path. The handlers-side twin got the same fix (its alert had been operator-dismissed earlier — same shape). (2) The env reads in storage_layout gained fail-closed traversal refusal anyway (a .. component in BRAIN_DATA_ROOT/BRAIN_DB_PATH now falls back to the layout default — real hardening against a hostile env knob, independent of the analyzer): resolve_root returns StorageLayoutError::InvalidRoot for a traversal-carrying data root (the same shape as the existing non-absolute refusal), and legacy_db moved onto a pure env-independent core (legacy_db_from) so the fallback is unit-pinned without process-env mutation. Behavior change, deliberate: a BRAIN_DB_PATH like /data/../evil/brain.db now resolves to the layout default instead of being honored.
• Log injection (rust/log-injection, CWE-117): the flagged sink is the centroid-refresh failure eprintln! in the markdown ingest handler; the source is the payload-supplied domain (the sibling document_id log is server-generated and untouched). sanitize_log_value (in server/router/memory.rs) strips the line-forging characters at the log seam; the DB write above it keeps the bound, unscrubbed value.
• Cleartext logging (rust/cleartext-logging, CWE-532): the DSAR certificate variable is sensitive by name heuristic; the three flagged sites were assert!/assert_eq! failure messages in the legal-hold/DSAR integration test interpolating it wholesale. Messages now carry the fixture ids (held_id/free_id); the asserted predicates are byte-identical.

Pins: resolve_root_rejects_traversal_data_root, resolve_root_refuses_traversal_db_path_and_falls_back, legacy_db_from_refuses_traversal_values (the refusal matrix incl. the trimmed-value back-compat case), db_size_bytes_measures_through_the_open_connection (the path-free measurement contract), and sanitize_log_value_strips_line_forging_characters. The code fixes rode the standby-m1 commit (41c67c9) for landing; this entry is their record.

Ceilings (honest): the traversal guard is lexical — it refuses .. components but does not canonicalize symlinks, and the storage env vars remain operator-controlled knobs; the page-count measurement equals the main DB file’s size (WAL excluded from both shapes), so the envelope’s db_mib input shifts only by page-alignment; the log scrub is applied at the flagged seam, not swept across every log site (the unflagged sites log server-generated identifiers or numerics); the analyzer’s alert closure is verified on the post-push re-scan.

Engineering record — the warm standby

M1 in five commits. The shared signing primitive came first: ump_integrity::sign_manifest_bytes (Ed25519 over the lowercase-hex SHA-256 STRING of the bytes — the parcels convention), with parcels refactored onto it and pinned byte-identical by parcel_signature_bytes_unchanged, which recomputes the pre-extraction formula inline with raw dalek calls (Ed25519 is deterministic; equal inputs, equal signatures). Then the core (src/standby.rs): ship_cycle — PASSIVE checkpoint → base.v3 via the SHIPPED backup v3 writer (Argon2id/AES-256-GCM, no new crypto) → wal/NNNN.frame-chunk copied AFTER the base, because the writer’s snapshot step TRUNCATEs the WAL and an earlier-copied chunk would replay pre-base frames over the newer restore (the load-bearing order, commented at the site) → the manifest signed and written LAST so artifacts are always whole; chunks ride backup::encrypt_v3_blob (the same v3 envelope) so NO unencrypted byte sits at rest on the follower. verify_follower verifies the signature over the exact manifest bytes and recomputes every artifact hash — any mismatch is Err (fail closed). promote_check reuses the shipped restore path, decrypts the chunk into the restored db’s WAL (SQLite recovery folds it in on open; sqlite-vec is registered process-wide first — the real corpus carries vec0 tables), runs PRAGMA integrity_check, and times restore/open/verify. RPO is the pinned arithmetic promote_check_rpo_math: interval + measured checkpoint lag — the follower-side twin of the v1.28.58 brain_wal_pages_pending gauge, which is the primary-side view of the same pending work.

CLI surface through THE SUBCOMMANDS table (help cannot drift from dispatch): start (interval floor 5s — two Argon2id derivations per cycle; resumes the cycle counter from the verified manifest else the highest chunk, resume_cycle-pinned; stops after 3 consecutive failed cycles), status (the integrity self-check IS the command — tamper exits 1), promote-check --from (PASS/FAIL gates the exit code). New spire pin cli_reference_covers_subcommands (≥40-name anti-vacuous floor).

The drill, executed (2026-09-06, against a COPY of the live 48.8 MB db — online-backup API, live server kept serving; release build; real operator key): 3 cycles @10s, lag 425/406/414 ms, rpo_max 10.4s; a 301-row burst carried visibly (base 48,824,639 → 48,910,655 B); status integrity OK; promote-check RTO 0.55s (restore 0.37s / open+integrity 0.18s), RPO 10.4s, PASS; promoted fidelity 9,091 rows (8,790 + 301) with the row committed after the last cycle honestly ABSENT (inside the RPO window); one flipped byte in the shipped chunk failed status closed (exit 1) and a byte-restore healed it. The record lives in docs/runbooks.md, watched by the reg_watch pin standby_drill_recorded (green only when the dated record with measured timings exists — the CRA-drill precedent).

The .bak mechanism proved itself in anger (disclosed): during development rehearsal, a brain restore --force was mis-aimed at the LIVE db (restore’s target is BRAIN_DB_PATH/default, not its positional). The port guard was bypassed, but restore’s automatic pre-restore safety snapshot preserved the full memory; the server was stopped, the snapshot swapped back, and the service re-verified healthy (integrity ok, full row counts). The promote procedure in the runbook now encodes the lesson — target named explicitly via BRAIN_DB_PATH, and --force against a live server is the one step that must never be routine.

Ceilings (honest): RPO is BOUNDED, not zero — at most interval + checkpoint lag after the last chunk can be lost, plus a sub-second race (a commit that lands, gets fully checkpointed, and has its WAL reset inside the cycle’s copy window self-heals in the next cycle’s base but is lost if the primary dies inside that window and you promote the stale cycle). Warm, not hot: promote is manual and rehearsed; nothing fails over by itself. Single-region; client reconnect is manual. Chunk history accumulates (≈ wal_size × cycles of disk). A torn interrupted cycle fails status closed until the next cycle lands. The interval floor exists because each cycle runs two Argon2id derivations. main.rs untouched (net delta 0); wire/schema unchanged; CRATE_TEST_FLOOR 1,228 → 1,244.

[1.28.60] — 2026-09-06 — “Loom”: CPU parallelism as an opt-in, determinism-proven tier

The Enterprise Line’s third milestone. Batch ingest embed + the near-dup scan’s preprocessing were serial CPU work inside spawn_blocking; on desktop-class targets with the CPU-bound neural profile that leaves real throughput unclaimed, while the Jetson memory doctrine forbids spending cores at all. Loom adds rayon behind THREE gates (the loom cargo feature compiled, the capacity target != jetson, and BRAIN_LOOM=1 with a fail-closed parse — unknown values refuse boot, the WRITE_POSTURE/durability pattern), a pool capped at min(cores-1, 4) so ingest never starves the tokio blocking pool, and EXACTLY two fan-out sites enumerated in the plan file so a third cannot arrive without an amendment. Every fan-out is an ordered per-item map — no cross-chunk reduction exists, pinned — so results are byte-identical to serial in both feature states. No routes, no schema movement, no default-behavior change of any kind (default build: zero new dependencies, rayon is optional and uncompiled).

Release notes

Bug fixes

None.

Improvements

• Opt-in CPU parallelism (BRAIN_LOOM=1, feature loom): the batch ingest embed stage (UMP ?format=ump / ump-md multi-record batches) and the consolidate near-dup scan’s pure-CPU preprocessing (dequantize + serialize; the KNN loop stays serial on the shared &Connection by design) fan out across a capped rayon pool when ALL THREE gates hold. Default: off in every dimension — the serial path is byte-identical to v1.28.59’s. /health/db echoes the boot decision (loom: active (N threads) | off:no-feature / off:jetson / off:env).
• Determinism, proven at three levels: unit pins (loom_preserves_fused_ranks over a frozen gold corpus through the real cosine/eval paths, loom_batch_order_invariant as a proptest over shuffled batches, jetson_never_looms, loom_thread_cap_respected, fail-closed parse) AND live byte-equality — the stored vector index hashes identically across loom/serial postures after both proof bursts — AND eval floors identical to three decimals in both postures (r@5 0.976, r@10 0.991, mrr 0.956).

Engineering record

• M1: src/loom.rs — decide/resolve (pure resolution core, unit-pinned over the full matrix; the parse refuses before any other gate so a typo never slides), cap_from (min(cores-1, 4), floored 1), install/pool (once-only boot install; failed build degrades to serial, the safe direction), fan_out (the one ordered seam) + fan_out_with_pool (the test seam). AppState carries the resolved LoomState; bootstrap resolves beside durability and installs the pool.
• M2 site 1 (81249ea): the multi-record ingest loop pre-computes every lowered record’s embedding in ONE spawn_blocking via loom::fan_out when active; ingest_one gains precomputed_embedding: Option<Vec<f32>> (None = today’s encode exactly — the degradation direction on any miss is serial, never blocked). Store order, dedup, audit untouched.
• M2 site 2 (68687e3): find_near_duplicates collects raw int8 blobs, then fans the dequantize + little-endian serialize pass out; row order == ORDER BY k.id preserved by the ordered collect. The KNN loop stays serial: rusqlite Connection is !Sync and the plan sanctions no pool restructure.
• Proof: docs/LOOM_PROOF_20260906.md + BENCHMARKS §v1.28.60 — echo in all four states, live boot refusal, byte-identical vec index (sha256) across postures after both bursts (9 291 / 9 371 vectors), wall-clock + RSS deltas. Honest finding: the static potion tier is too cheap for the fan-out to pay (neutral-to-slightly-negative); the value case is the neural enterprise profile, unmeasured here. CRATE_TEST_FLOOR 1,221 → 1,228 (the seven loom pins). main.rs untouched (net delta 0).
• Gates: clippy + tests green in BOTH feature states (default tree and --features loom); eval floor after each fan-out commit; CI dry-run set green (default clippy/test, engine-crates, steward-harness, otel); lipstyk diff-strict.
• Ceilings (honest): the ratchet’s speed story is determinism-first — the static profile gains nothing (opt-in by design, so nobody pays); Jetson hardware unmeasured (no ARM runner — standing CI gap); run order in the proof pairs not randomized; the neural-tier win is asserted from per-item cost shape, not measured; site 2’s live run is via the shared byte-identity check, not a dedicated scan benchmark.

[1.28.59] — 2026-09-05 — “Headroom”: the write-path policy made explicit, pinned, and machine-guarded

Documentation-first release wearing a test harness. The write path was correct (BEGIN IMMEDIATE via WorkflowTx since the lane’s founding) but its POLICY was implicit: the pragma set lived in a one-line inline closure, durability was whatever SQLite’s compile defaults turned out to be, and lock critical sections were documented only in prose. Headroom makes all three explicit — per-capacity-target envelope fields with defaults equal to the measured pre-change behavior (behavior-neutral by construction, pinned), a fail-closed env override pair, per-connection application where it actually takes effect, a boot-time echo, lock-bounds comments on every production Mutex/RwLock site, acquire-wait telemetry, and the write-discipline ratchet. No route changes, no schema movement; main.rs untouched (net delta 0, the thin binary stands); x-api-version moves with the release stamp only.

Release notes

Bug fixes

• --features rerank-tier builds again: server::bootstrap named search::rerank::warmup() without the search module in scope (pre- existing break — the feature is not in any CI job, which is why it went unnoticed). One-line path fix; no behavior change on any default build.

Improvements

• Durability policy as configuration (BRAIN_SYNCHRONOUS, BRAIN_WAL_AUTOCHECKPOINT): per-connection SQLite pragmas on the MAIN pool are now envelope fields (synchronous_mode, wal_autocheckpoint_pages) applied at EVERY pooled connection’s init beside busy_timeout — previously only busy_timeout was per-connection and synchronous silently reset to the compile default (FULL) on every reconnect while NORMAL from the migration connection never propagated. Defaults equal the measured pre-change behavior; normal (the WAL-mode tuning posture) and any page threshold 1..=65536 are one env var away; unknown values refuse boot (the BRAIN_WRITE_POSTURE pattern). The applied policy is echoed by /health/db under durability.
• Lock-wait telemetry: 15 request-path lock holders (token store, rate limiter, replay cache, revocation cache, audit chain keys, domain registry, embed/rerank/screen models, the workflow lane, …) now record acquire-wait into a fixed integer bucket histogram — only on the CONTENDED path (try_lock fast path costs zero clock reads). Two new /metrics gauges, brain_lock_wait_micros_p50 / p95, derive bucket-quantiles at scrape. First live readings: ≤10 µs at desktop load — headroom demonstrated, not assumed.
• Write-discipline ratchet (tests/write_discipline.rs): the deferred- transaction inventory (38 sites across 21 files) is frozen as per-file ceilings with a file:line-list failure on growth; the IMMEDIATE discipline (20 sites) is floored. New read-modify-write transitions must route through WorkflowTx::begin or edit the baseline deliberately.
• Lock-bounds audit: every production Mutex/RwLock site (19 fields) carries a bounds comment — what the critical section may touch, its poison posture, and whether the holder is request-path. The two deliberate exceptions (domain-registry cold open, the single-flight lane) are named as such.

Security fixes

• None (no behavior change on any default target; the envelope-defaults pin enforces).

Engineering record

Milestones (per IMPLEMENTATION_PLAN_v1.28.59_Headroom.md + execution prompt):

• M1 — write_paths_are_immediate: the plan claimed “the allowlist is empty on arrival — write discipline already routes through tx.rs”. The claim did not survive re-verification (the prompt’s own stale-cite rule): production transaction construction is a REAL, established pattern here — handlers construct transactions but delegate every statement to service cores (the no-SQL gate counts statements, not BEGINs), plus sanctioned seams (the lane, the audit settle, revocation rotation). Shipped instead: the Plumb debt-lock pattern as a ratchet — DEFERRED inventory frozen at 38 sites / 21 files (down-only, unlisted-file hits fail, below-baseline progress prints deltas), IMMEDIATE inventory floored at 20 sites (up- only), cfg(test) stripped via the house split idiom, positive controls on workflow/tx.rs, a fence pinning the whole-file-test exclusion (src/search/tests.rs), and a RED-PROOF: a planted conn.transaction() in production config.rs failed the gate with the exact file:line before reverting green. Documented ceiling: code hidden behind a MID-FILE test block escapes the split idiom (the house convention of trailing test regions is the fence — same as the transport-free gate).
• M2 — durability + checkpoint policy: CapacityEnvelope gains synchronous_mode: SynchronousMode (Full|Normal) + wal_autocheckpoint_pages: u32; capacity::Durability carries the resolved pair and builds the pragma batch (busy_timeout=5000; synchronous=…; wal_autocheckpoint=…). Defaults are the MEASURED pre-Headroom behavior (empirically verified, not assumed: a fresh pooled connection to the WAL DB reported synchronous=2 (FULL) and wal_autocheckpoint=1000 — the compile defaults, because the migration connection’s NORMAL never covered the pool). Pins: envelope_defaults_equal_current_behavior (exhaustive over targets), pool_init_pragmas_read_back (temp-file DB through the production apply path — FULL/1000 default AND NORMAL/256 override), pragma_batch_keeps_busy_timeout, unknown_synchronous_value_refuses (via the resolver pin), wal_autocheckpoint_resolves_and_bounds (0 = autocheckpoint-off refused; 1..=65536 accepted). The inline pool-init closure moved to a named fn (main_pool_connection_init) — the Spire law’s shrink applied to the boot file. journal_mode stays migration-owned (persistent; deliberately not duplicated).
• M3 — lock bounds + contention completion: bounds comments on all 19 production lock fields (2 found beyond the plan’s list: ump_integrity::ReplayCache, connector::GitHubAppProvider — the latter comment-only, off the request path). 15 request-path holders rewire their acquisitions through concurrency::{mutex_guard_recovered, mutex_guard_measured, rwlock_read_recovered, rwlock_read_measured, rwlock_write_measured} — each site’s poison posture preserved verbatim (fail-closed limiter/registry/token-store, fail-open tracker/cache, recover-and-continue lane/decision-key). Histogram: 11 fixed µs edges (LOCK_WAIT_BUCKET_EDGES_US, 12 buckets) in concurrency.rs; LockWaitHistogram::quantile_edge_us is the deterministic scrape read. Named pins: rate_limiter_decision_is_pure_under_lock (identical decision vectors across fresh limiters through cap-hit eviction and budget exhaustion), token_rotation_swap_is_single_assignment (4 reader threads × 200 real file-mtime rotations through reload_if_changed_from:

  1 000 hot reads, >50 swaps, ZERO torn observations), lock_helpers_record_only_on_contention (fast path records NOTHING; contended acquire records), poison_flavors_keep_their_contracts.

• M4 — live proof (docs/HEADROOM_PROOF_20260905.md, summary table in BENCHMARKS.md §v1.28.59): COPY instance, identical-corpus paired runs. WAL trajectory flat 0 in both cells (2000-doc burst; the 6000-doc burst showed the one mechanistic delta: a transient 34-page peak under full/1000 vs flat 0 under 256). p95 24.52 → 24.19 ms (noise — searches never fsync). Durability echo verified in both postures. Lock-wait gauges’ first live readings ≤10 µs. Machine: M1 Pro/16 GB/arm64.
• Docs parity (same-commit law): configuration.md rows for both env vars; docs/metrics.md rows for brain_lock_wait_micros_p50/p95 + the /health/db durability.* keys; docs/api.md /health/db row; BENCHMARKS.md dated subsection.

Spire ledger: CRATE_TEST_FLOOR 1,207 → 1,221 (the new pins, re-measured by the same substring method). main.rs untouched. Wire: no route changes; /health/db additive JSON keys + /metrics additive series only; x-api-version moves with the release stamp.

Validation: full suite cargo test --features bench 1,275 passed / 0 failed / 1 ignored (plus the write-discipline trio and feature-gated modules under neural-embed,rerank-tier,injection-classifier); the full clippy/fmt/CI-dry-run gate ran at close (see AGENTS.md).

Ceilings (honest): the M1 ratchet is not the plan’s zero-allowlist — the plan’s verification was empirically wrong and the ratchet is the honest deposit (the burn is follow-up work); the split idiom’s mid-file blind spot is shared with every house gate; lock-wait coverage is request-path holders only (the mcp binary, the connector token cache, and the /health/db-scrape locks are comment-only, with reasons); quantiles are bucket edges, not interpolated percentiles (the dictionary says so); Jetson durability envelope unmeasured (no ARM runner); the 6000-doc WAL transient is one sample.

See docs/HEADROOM_PROOF_20260905.md for the raw captures.

[1.28.58] — 2026-09-05 — “Throughput”: concurrent truth, visible contention, the calendar as code — the Enterprise Line opens

Two deadlines make the milestone non-slottable: CRA Art 14 reporting goes live 2026-09-11 (24 h/72 h/final to ENISA + CSIRT), and every later Enterprise claim (“measured service levels”) would be unfounded while the bench is single-client and contention is invisible. The release ships the calendar-as-code mechanism, the concurrent measurement, the visibility, and the runbook — nothing behavioral changes on any request path: no new routes, none removed, no schema movement, x-api-version untouched, and main.rs untouched entirely (net delta 0; the thin binary stands).

Release notes

Bug fixes

• None.

Improvements

• The calendar becomes executable (src/reg_watch.rs, cfg(test), the docs_truth idiom — Enterprise law 13): each pinned regulation deadline carries its source URL and a date-shaped assertion. reg_watch_cra_pin _is_green asserts the CRA reporting runbook exists with its three clock anchors — landed RED (no runbook) and flipped GREEN the same release, proving the mechanism catches lateness; the deadline constant is load-bearing (the runbook’s stamped date is derived from it — a constant re-mapped without the doc fails the pin). AI Act Art 50 marking (2026-12-02) and the PQC inventory seam (2030-12-31) ride in watch form (today < DATE); the day a date passes without its deliverable, CI goes red on the pin, not in the operator’s inbox.
• The bench learns concurrency (BENCH_CLIENTS, default 1 — the sequential run is byte-compatible): N clients fan out over the SAME seeded per-scale search mix (BENCH_SEED printed; no RNG crate — the mix stays a deterministic formula), samples merge per scale into pooled p50/p95/p99/max + non-2xx/transport failure counts + per-client skew (printed, not hidden). Ingest stays single-client at every value — the corpus build is untouched. BENCH_ASSERT_P95_MS is an envelope-free ship gate; BENCH_ENVELOPE gains a per-target concurrent p95 ceiling (search_p95_ms_ceiling): desktop 60 ms, measured from three live 8-client runs (22.28/22.86/23.07 ms — worst
  • ~2.5× margin, docs/THROUGHPUT_PROOF_20260905.md); jetson 150 ms marked unmeasured (no ARM runner). The merge is pinned deterministic (bench_clients_merge_is_deterministic).
• Contention becomes visible (src/concurrency.rs): process-local counters (the audit-static precedent) surfaced on /metrics and /health/db, wired ONLY at existing error arms — zero added cost on success paths. brain_pool_timeouts_total counts r2d2 checkout failures at the handler error seam (HandlerError::db_down, the shared pool.get().map_err arm — 92 call sites collapsed onto it, wire-identical) and the workflow lane’s checkout arm; brain_busy_errors_total counts SQLITE_BUSY-family errors at the governed-write BEGIN sites (WorkflowTx::begin + the lane’s BEGIN IMMEDIATE); brain_pool_in_use{domain}/brain_pool_idle {domain} come from r2d2::State snapshots at scrape; brain_wal_pages_pending{domain} is refreshed ONLY by /health/db (the PASSIVE-checkpoint PRAGMA runs there and nowhere else — admin cold path). /health/db JSON gains additive concurrency.* keys. A proptest pins counter monotonicity under Relaxed ordering (2 cases).
• The metrics dictionary gains its ops twin — every /metrics series (the ten brain_* names) now has a docs/metrics.md dictionary row, pinned by the new metrics_series_have_dictionary_rows meta-test (the scoreboard parity discipline applied to telemetry); docs/api.md’s /health/db row and openapi.yaml (additive-only) updated in the same change.
• The CRA reporting runbook + timed drill (docs/cra-reporting -runbook.md, scripts/cra-report-drill.sh): trigger taxonomy, the three clocks with their templates, the ENISA + CSIRT channel table with a deploy-time operator blank, the artifact checklist (SBOM, affected-version matrix, containment statement, signed release, audit posture), and the operator-role call (honest: these are one operator’s hats). The drill fabricates an exploited-vuln notice, fills the 24 h template, stamps every step, and prints a timing report; the baseline is archived in docs/THROUGHPUT_PROOF_20260905.md.
• CI gains the concurrent-truth gate (bench-concurrency, desktop x86 runner only): boots a release-built scratch instance and drives it with BENCH_CLIENTS=8 BENCH_SEARCHES=200 BENCH_ASSERT_P95_MS=10000 (generous by design — the gate fails on catastrophic contention serialization, not runner noise; retry-once documented), then asserts the scrape surface survived. Jetson floors stay local-measured — the known no-ARM-runner gap, printed honestly.

Security fixes

• None. (Visibility + rehearsal ARE the posture work: contention that cannot be seen cannot be capacity-planned, and a reporting clock that has never been rehearsed will be missed.)

Engineering record

• Drift adaptations (the prompt’s cites predate the Capstone flip; adapted in the same change, as instructed): the /metrics handler is src/server/router/core.rs::metrics (was main.rs ~2092); the r2d2 pool builder is src/server/bootstrap.rs (was main.rs ~5393); resolve_domain_pool lives in src/handlers/mod.rs and resolves REGISTRIES, not connections — its error arms are domain-resolution errors, so the checkout-timeout counter wires at the actual checkout arms (the 92-site HandlerError::db_down seam + the lane), which is where r2d2 timeouts observably surface.
• Counters are process-local by design (single-process truth; multi-site aggregation remains Parcels federation). brain_busy_errors_total and brain_db_busy_total are deliberately distinct series: write-path BEGIN-site busy vs audit-tx settle busy.
• Honest ceilings: the CI concurrency floor is x86-desktop only; jetson floors are constants pending a device run. The WAL gauge on /metrics is a cached snapshot (fresh only as recent as the last /health/db scrape) — the PRAGMA must not run per request. Some checkout-error sites outside the shared handler seam (the /add AddResponse arms, anyhow-context sites in search/domain-router internals) do not bump brain_pool_timeouts_total — wiring them would have meant touching arms the milestone freezes; the seam covers the dominant handler surface.
• Live proof (copy instance, docs/THROUGHPUT_PROOF_20260905.md): 3× measured runs (1600/1600 ops, 0 failures, p95 22.28–23.07 ms); same- seed structural diff identical; /metrics before/during/after a 6 400-search burst shows brain_pool_in_use 0 → 5 → 0 with counters flat at 0; CRA drill baseline archived.
• Gates: full suite per surface (lib 1031+ / main_suite 163+ / authz matrix / metrics / eval / bench + reg_watch + concurrency pins); clippy -D warnings on all surfaces incl. otel; fmt clean; spire gates green (main.rs untouched, net delta 0); CRATE_TEST_FLOOR raised with the new pins.

[1.28.57] — 2026-09-05 — “Capstone”: the enforcing flip + the audit — the Spire Line closes

The Spire Line’s fin. No behavior change of any kind: no new routes, no removed routes, no wire edits (openapi.yaml diff-empty vs v1.28.56), no schema movement (1.28.45 stands). Capstone makes the line’s end state IMPOSSIBLE TO UNDO QUIETLY: main.rs is a ≤ 300-line wiring file (the whole 12k-line test region moved verbatim to tests/main_suite.rs), two grep gates born hard enforce the router law and the protocol-free bootstrap, the dead ceilings retire, and the whole line’s measured before/after lands in docs/AUDIT.md.

Release notes

Bug fixes

• None. (Nothing behavioral moved — by design; the release’s whole point is proving exactly that with a wire-diff-empty gate.)

Improvements

• main.rs 12,471 → 124 lines (wiring only: bootstrap → compose → serve, with a header comment pointing at the router law). The whole cfg(test) region — 12,294 lines, 109 plain + 60 tokio test fns — moved VERBATIM to tests/main_suite.rs: identical verdicts (163 passed + 6 ignored), nothing deleted; the only edits are the include_str! anchors (now CARGO_MANIFEST_DIR-absolute) and the root use-block that traveled with the region so use super::* resolves exactly as before.
• The grep gates join the family (src/spire_inventory.rs), hard errors from birth, each RED-PROOFED against a planted violation before its green commit and self-pinned inline forever (the Cornerstone lesson — a scanner that cannot fire guards nothing): route_registrations_live_only_under_router — a route registration anywhere under src/ outside src/server/router/** (production, test, or comment residue) fails CI, with ONE fenced carve-out: src/bin/mcp.rs, a separate binary’s single-endpoint /mcp protocol edge, pinned at EXACTLY one site; and bootstrap_stays_protocol_free — no axum types in src/server/bootstrap.rs (word-boundary needles so a comment’s “takes an axum type” or “RequestBodyLimitLayer” never fires; the type names do).
• The ledger’s final posture — ceilings retire where violations are structurally impossible (the Cornerstone precedent), floors survive: MAIN_RS_LINES_CEIL → MAIN_RS_LINES_MAX ≤ 300 (the pin IS the ceiling); the test region retired via a region-ABSENCE pin; MAIN_RS _TEST_FLOOR retired per its own relocation convention (its 109 pins moved this release); ROUTE_CALL_SITES retired early (main.rs routes pinned to 0); TOTAL_SRC_TEST_FLOOR → CRATE_TEST_FLOOR over src/ + tests/ (re-measured 1,196 at the move; 1,198 at close — the gates added two); ROUTER_SITES_FLOOR 199 and guard-table rows 161/145 survive.
• src/route_guards.rs re-homed to src/server/router/route_guards.rs beside the registrations it tables (decl moves; content unchanged — 100% rename). spire_inventory.rs stays beside main.rs — its subject.
• The Spire Line close-out report appended to docs/AUDIT.md (per the Foundation pattern): the measured before/after (main.rs 19,906 → 124; region 13,342 → absent; main.rs route sites 234 → 0; router sites 199 floored; crate pins 1,178 → 1,198), the module map (what moved where across all four milestones), and the enforcement map (which gate guards which law).

Security fixes

• None. (The enforcement ADDITION is the security story: the router law and the protocol-free bootstrap are now machine-checked, so the end state cannot be undone quietly — every scanner red-proofed and self-pinned.)

Engineering record

Order of landing (four commits, gate + proof per commit):

1. THE EVACUATION — the test mass moves out; main.rs 124 lines; the ledger’s posture edited in the same commit (the Scaffold law). The new pin bit during development exactly as designed: it caught the main.rs header comment’s own route-needle literal and a one-off floor miscount (the needle counts doc-comment literals too — the substring lock, measured identically every time) before the commit.
2. THE GATES — born hard, red-proof shown before the green commit: a planted route-registration comment in src/config.rs turned the route gate red naming the file; a planted axum-type comment in bootstrap.rs turned the protocol gate red ([axum::, Router]); both plants reverted. En route the route gate flagged its OWN doc comment carrying the needle literal — rewritten; the gate polices even its documentation.
3. THE RE-HOME — route_guards beside the families; consumers re-pathed (spire_inventory, tests/authz_matrix.rs, tests/main_suite.rs).
4. THE RECORD — docs/AUDIT.md Spire close-out, this changelog, the version bump, badges from the real build.

Ledger (spire), Vaulting → Capstone: main.rs 12,471 → 124; region 12,294 → absent (absence-pinned); main.rs route sites 35 → 0 (pinned); router sites 199 (floor held); crate #[test] 1,185 (src needle) → 1,198 (src + tests needle; floor 1,196 never decreases); guard rows 161 / 145 held.

Validation: full suite 1,265 passed / 7 ignored (–features bench) at the tip, green at every commit; clippy -D warnings (bench) clean; fmt clean; lipstyk diff-strict green vs the v1.28.56 tip; CI dry-run green (default lint+test, engine-crates, steward-harness, otel lint + test); wire artifacts byte-identical (openapi.yaml diff-empty; route-coverage + route-authz verdicts identical; x-api-version moves with the release stamp only); live smoke on the COPY instance green (/health, /audit/verify ok, the 413 + 408 paths, one ingest → recall round-trip).

Ceilings (honest): src/bin/mcp.rs keeps its own router (a separate binary’s protocol edge, fenced at exactly one site — folding it under the families would be a behavior-adjacent refactor the line’s standing rule forbids); tests/main_suite.rs is one ~12k-line file (the mass moved as ONE verbatim block; splitting is churn without a subject); the ≤ 300 pin is a pin, not a proof of minimalism — the route gate is the tooth. The Spire Line is CLOSED; the Enterprise Line (.58+) inherits a thin binary, a pinned router, and contention gauges.

Predecessor: [1.28.56] — “Vaulting”: the lib flip.

[1.28.56] — 2026-09-04 — “Vaulting”: the lib flip — bootstrap + router decomposition

Third milestone of the Spire Line. No behavior change of any kind: no new routes, no removed routes, no wire edits, no schema movement. Vaulting splits the monolith into the thin-bin seam: the server module tree moved into the library behind a single named surface (pub mod server { boot strap, router }), the boot region became a protocol-free bootstrap(), the inline router chain became six family builders, and main.rs collapsed to wiring (main + serve + graceful shutdown) over its test region.

Release notes

Bug fixes

• None.

Improvements

• None (refactor-only release; the wire is byte-identical to 1.28.55).

Security fixes

• None. The authz posture is UNCHANGED and now continuously verified: the new law-9 matrix drives every AUTHZ_GATES row through the composed router in seven principal classes (none/read/write/admin/cross-tenant/ role-held/role-denied) plus an opaque-mode superuser block, asserting 401/403 per cell, with literal-200 anchors on the empty-safe list reads.

Engineering record

Scope landed, in order (one commit per move family):

1. Middleware stack + auth middlewares staged into server/router/{mod, auth}.rs (C1a).
2. app(state) composition lifted out of main_inner; the middleware inputs (token store, JWT state, CORS) moved onto AppState so the composition is a pure function of state; the three middleware oneshot suites moved into server/router/auth.rs with their subjects (C1b).
3. server/bootstrap.rs receives the whole boot region — argv guard, fail-closed checks (auth misconfig, write posture, model pinning), OTLP init, sqlite-vec registration, audit chain key, pool + offline modes, pre-migration backup, model load, migration, legacy cutover, PRF report, connection/RSS watchdogs, token rotation watcher, integrity scheduler, pool health probe, rate limiter, CORS build, JWT/JWS wiring incl. the UMP key-dir scan + revocation purge, JwtMiddlewareState, AppState construction + the four alert watchers + multi-db seed, webhook drain worker, bind resolution + loopback-bind guard + unsigned-egress warnings. boot.rs folds in whole (ct_eq, argv, worker threads, bind predicates — pins travel). main_inner is now the serve loop only (C2).
4. app(state) moves to server/router/mod.rs; the six family builders land — core (17 routes), memory (56 + the 3-route deprecated legacy fragment + the 1 GiB import_router), ump (12), compliance (10 + the 5-route feature-gated pack), workflow (82), auth (9). mod.rs keeps the middleware fns, CSP consts, and the merge/layer order; the Deprecation route_layer’s application set is preserved exactly (core ∪ legacy fragment — the original chain’s set, byte-for-byte). main.rs retains ZERO production .route( registrations (C3).
5. THE LIB FLIP: lib.rs declares the whole server tree with pub mod server as the only named surface; main.rs consumes it via brain_server::server::...; the law-9 matrix moved to tests/authz_matrix.rs driving brain_server::server::router::app from outside the crate — the lib seam earns its keep (C4/C5).
6. Law-13 gauges: brain_db_busy_total (SQLITE_BUSY surfaced at the audit seam) on /metrics, db_busy_hits in the /health hardening block, beside the existing pool-saturation gauges. Honest ceiling: busy-HANDLER invocation counts require replacing the 5s busy_timeout — a concurrency change law 13 freezes; observe failures, not waits.

Law-9 net (the milestone’s safety story): the matrix went green on the pre-split monolith and ran unchanged through every family commit. Pre-gate vocabularies the census surfaced and codified: soft-deny 200 shapes (/add /search /ingest/memory /v1/embeddings /reindex /audit /audit/verify), SSE in-band denial (/events /ump/subscribe), pre-gate 404s (workflow run-bound rows, kcs approve/publish), pre-gate 400 (/workflow/plugins/mount), and the layout-conditional /consolidate/propose (Read in multi-db, Admin in shim).

Ledger (spire), Buttress → Vaulting: MAIN_RS_LINES 18,291 → 12,470; TEST_REGION 12,302 → 12,294; main.rs route sites 234 → 35 (test stubs only; production registrations: 199 under src/server/router/**, floored); MAIN_RS_TEST floor 109 held (moved suites were tokio tests); ROUTER_SITES_FLOOR 199 gained (≥6 family files asserted). Wire artifacts: openapi.yaml byte-identical to v1.28.55; x-api-version moves only with this release stamp.

Validation: full suite 1,022 bin + 163 lib + 208/37/19/6/8/4/3/1 passed / 6 ignored, identical at every gate; clippy -D warnings (bench + otel + default) clean; fmt clean; lipstyk diff-strict exit 0; CI dry-run green (default, crates, steward-harness, otel); live smoke on a DB copy: /health, /audit/verify ok, 413 + 408 paths, and one 2 MiB import round-trip proving the 1 GiB dial survived the split.

Ceilings (honest): main.rs keeps its 12k-line test region (the non-router-bound mass moves at Capstone with the docs_truth/dup_guard decls); busy-HANDLER hit counts are unobservable without changing frozen concurrency semantics (gauges observe busy FAILURES at the audit seam instead); /consolidate/propose remains layout-conditional (Read in multi-db, Admin in shim) exactly as authored.

[1.28.55] — 2026-09-03 — “Buttress”: the helpers come home — the pre-main library code promoted with its pins

Second milestone of the Spire Line. No behavior change of any kind: no new routes, no removed routes, no wire edits, no schema movement. Buttress promotes the axum-free half of the pre-main region into four bin-private modules — every fn relocated with its own unit pins in the same commit, the structural ledger lowered in that same commit, every move by exact-text relocation so nothing but paths changed.

Release notes

Bug fixes

• None. (Nothing behavioral moved — the release’s gate is proving that: wire artifacts diff-empty, full suite byte-count identical at 1,031 bin tests passed / 6 ignored per commit.)

Improvements

• src/http_limit.rs (new): the HTTP-edge load-control family — the per-IP RateLimiter (with the bounded-bucket eviction), the ConnectionTracker + RAII TrackerEntry, the connection and RSS watchdogs, and process_rss_mib — promoted from main.rs with all nine of its unit pins (tracker ×3 + Drop/panic + timeout-slot, limiter ×3, RSS ×1).
• src/screen.rs gains the layer-1 blocklist: contains_suspicious_pattern moved beside is_invisible (which the matcher calls), with its seven pins including the S2-44/F-61 normalization pin. Same-crate callers (search core, channel annex, handlers) repoint to crate::screen::contains_suspicious_pattern.
• src/screen.rs gains the quarantine read-seam pair: flag_if_quarantined (the Quarantine verdict’s persistence) and suppress_flagged_evidence (the verdict’s read-seam enforcement) with the snippet pin. Service-layer callers (procedure, recall, ingest) repoint to crate::screen::*.
• src/graph_read.rs (new): the signature-clean graph read helpers — clamp_graph_limit, traverse_row_mapper, build_explanation_paths — with the two explanation-path pins. The AppError-typed graph SQL fns (entity_relations, relations_for) deliberately STAY in main.rs: their signatures carry the IntoResponse error type, which fails the Buttress selection rule (moves iff the signature is already free of transport types); they ride with Vaulting’s graph family.
• src/boot.rs (new, staged): the boot guards — argv gate, BRAIN_WORKER_THREADS resolution, the loopback-bind fail-closed predicates + guard, and the constant-time ct_eq — with the ct_eq and bind pins. Deliberately NOT src/server/**: that tree is born at Vaulting with the lib flip, and staging there early would defeat its design.
• The frozen structural ledger (spire_inventory) tracks every move: MAIN_RS_LINES 19,282 → 18,291, TEST_REGION_LINES 12,712 → 12,302, MAIN_RS_TEST_FLOOR 129 → 109 across the five move commits; the never-decreases crate-test floor re-measured 1,178 → 1,185 and the guard-table floors 151/141 → 161/145 at the Buttress open so the guards stay tight.

Security fixes

• None. (No security-relevant behavior changed; the loopback-bind guard, the blocklist, the quarantine flag, and the read-seam suppression all moved verbatim, pins proving identical behavior.)

Engineering record

• Five move commits, one family each, ledger lowered in the same commit as every move: a1480e7 http_limit (fn family + 9 pins), 5a19760 blocklist → screen (fn + 7 pins), 19d3de8 fence kin → screen (2 fns + snippet pin), 1f26978 graph_read (3 fns + 2 pins), c9ae723 boot (6 fns + 2 pins). Wrap commit: this one.
• The ledger bit twice exactly as designed: once when the first commit moved 8 #[test]-needle pins plus one #[tokio::test] (the needle count is 121, not 120 — the floor edit says 121), and once when a botched insertion+range-delete consumed the screen_folds pin before commit (crate total dipped 1,185 → 1,184; repaired pin-by-pin, then committed). Both failures were the design working.
• Executor ceilings (honest): (1) the ingest write core (write_markdown_ingest, link_vault_source, parse_memory_content) did NOT move — the two write fns return Result<_, AppError>, and AppError implements IntoResponse (transport-shaped), so the family fails the selection rule and rides with Vaulting’s memory family; the three source-scan pins stay pointed at main.rs, where their subjects still live, and their verdicts are unchanged. (2) html_escape + parse_annotations stayed: their consumers are the axum ingest handlers, which the prompt’s scope gate excludes. (3) measure_capacity stayed (the prompt’s default; its caller wiring — /health + the ingest 507 paths — is router substance). (4) the router-level pins (rate_limit_buckets_per_socket_addr…, ingest_timeout… is moved, rate_limit_layer_is_outside_auth_layers, graph_reads_scope_filtered, graph_skips_flagged_edges, ingest_quarantines_flagged_instead_of_rejecting) stay with their router/DB subjects or their test_db() fixture, per the stays list.
• TrackerEntry::count is now #[cfg(test)] (it was already test-only); the router-level budget pin reads the new RateLimiter::WINDOW_BUDGET_PROBE const instead of the private max_requests field. No signature changes otherwise.
• Validation per commit: fmt, clippy -D warnings (bench), affected suites + full bin suite (1,031 passed / 6 ignored — identical every commit), spire green with exact measured values. Wrap: full CI dry-run (default-features lint+test, crates, steward-harness, otel), lipstyk diff-strict, badges selfcheck, wire artifacts diff-empty (openapi.yaml, route-coverage, route-authz, x-api-version), live smoke on the rebuilt binary (/health + /audit/verify ok).

[1.28.54] — 2026-09-03 — “Scaffold”: the Spire Line opens — measure, freeze, evacuate what needs no router — 2026-09-03 — “Scaffold”: the Spire Line opens — measure, freeze, evacuate what needs no router

First milestone of the Spire Line (the monolith dismantling). No behavior change of any kind: no new routes, no removed routes, no wire edits, no schema movement (schema stays at 1.28.53). Scaffold ships the measuring stick and the contract: a machine-enforced structural ledger over main.rs, the buried route guard tables promoted to named data, and the test mass that pins module-owned pure functions relocated to live beside its subjects.

Release notes

Bug fixes

• None. (Nothing behavioral moved — by design; the release’s whole point is proving exactly that with a wire-diff-empty gate.)

Improvements

• src/spire_inventory.rs (cfg(test)): the frozen structural ledger — ceilings MAIN_RS_LINES ≤ 19_282, TEST_REGION_LINES ≤ 12_712, ROUTE_CALL_SITES ≤ 234; floors MAIN_RS_TEST ≥ 129, crate-wide #[test] ≥ 1,178, guard-table rows ≥ 151 / ≥ 141. Ceilings only move DOWN, and only in the same commit as the extraction that earned the shrink. Shipped red-then-green: the guard’s first commit asserted deliberately tight wrong ceilings and failed loudly on all three.
• The route-coverage table (151 paths) + route-authz table (141 gates) are now named data in src/route_guards.rs instead of arrays buried at line ~12k of main.rs; the guard tests consume the consts with identical verdicts, and their row counts are floored in the ledger.
• Ten pure-unit test families relocated verbatim to their subjects’ own modules (handlers ×6, config, temporal, trace, eval) — pin travels with the thing it pins. main.rs: 19,906 → 19,282 lines; the test region 13,342 → 12,712.

Security fixes

• None. (The authz source-scan and coverage pins are byte-identical in verdict; the tables they read gained floors so a row can only be dropped in the same commit as the wire change that earns it.)

Engineering record

Commit sequence (each commit gate: fmt + clippy -D warnings + affected suites; full bin suite re-run per commit):

1. test(spire) — the inventory guard, born red; roadmap numbers re-measured to session-start truth (19,906 lines / region from L6,565 / 234 route sites / 139 pins) per the executor stop-rule.
2. test(spire) — green: ceilings set to measured truth (19,909 / 13,342 / 234; the +3 ledger decl lines honestly included).
3. refactor(spire) — guard tables → src/route_guards.rs as data; ceilings 19,467 / 12,897; docs_truth’s test-file-skip preserved by declaring the module from main.rs (a #[cfg(test)] pub mod inside handlers/mod.rs would have skipped it from the comment guard).
4. refactor(spire) — the handlers-family pins (authorize ×3, audit_scope ×2, typed-edge) relocate into handlers/mod.rs.
5. refactor(spire) — config/temporal/trace/eval pins relocate.
6. fix(spire) — CORRECTION: commit 4’s line-numbered seds ran after an earlier edit had shifted the file, so five originals (authz ×3, audit_scope ×2, typed-edge) survived in main.rs alongside their relocated copies — different modules, so the compiler never fired, and the suite double-ran five pins (1,319 “passed” included 5 ghosts). Caught by reconciling the pin arithmetic (139 − 10 relocations ≠ 134 measured); the stale copies are removed, main.rs floor honestly 129, totals 1,314 passed / 7 ignored. Lesson encoded in the line’s prompts: relocate by exact-text match, never by line number.
7. docs + version (this commit).

Landed truth: main.rs 19,906 → 19,282 lines; test region 13,342 → 12,712; route sites frozen at 234 (Vaulting owns every route move).

Deliberately NOT moved (ceilings say so): the route chain (234 .route( sites — Vaulting/M3 owns every route move); the screen family (its subject contains_suspicious_pattern is still main.rs-owned — the pin travels when Buttress/M2 promotes the fn); bind predicates, tracker, rate-limiter, explanation-paths, snippet-suppression (all main.rs-owned subjects); every test_db()-driven suite (DB/router-integration mass, ~900 lines — they move with the handler families or to tests/ at the lib flip).

Floors are load-bearing proof: the ledger fired once in development — relocating the handlers family without lowering MAIN_RS_TEST_FLOOR in the same commit failed exactly as designed (“a pin left main.rs without its spire_inventory edit”) — the red-then-green discipline works in both directions.

Validation: full suite cargo test --features bench green per commit (1,314 passed / 7 ignored at tip: bin 1,031 + lib 208 + CLI/bins 63 + integration 12), clippy -D warnings clean on the bench surface, cargo fmt --check clean, scripts/lipstyk-gate.sh diff-strict green, openapi.yaml + route-coverage + route-authz wire artifacts diff-empty, x-api-version untouched, /health smoke green on the rebuilt binary. Ceilings (honest): route-call-site ceiling frozen at 234 (routes move in Vaulting, not Scaffold — “strictly below” applies to the line/region ceilings); no chunker/capacity pure pins existed in main.rs to relocate (their homes already own them); the v1.28.35-era roadmap numbers were stale and were re-measured in the opening commit.

[1.28.53] — 2026-09-03 — “Triage”: proposals gain a domain — the review queue is domain-scoped FOR REAL

The gap discovered during “Parcels” (v1.28.30): the proposals table predates domains and had NO domain/title columns — parcel imports landed as GLOBAL pending proposals, distinguishable only by their parcel:{domain}:{signer} source label, and a receiving site’s reviewers saw foreign autocaptures mixed with imported parcels in one undifferentiated queue. Triage makes the label REAL: every proposal row carries its residency domain, the queue reads scope by it, the by-id verbs re-authorize against the ROW’s label before any decision CAS, and parcels stamp the TARGET domain. The piggyback rule is paid in the same change: the review surface’s storage story is extracted out of service::gate into a named service::review core. First feature release after the Foundation Line; schema moves 1.28.45 → 1.28.53 (additive only).

Release notes

Bug fixes

• Imported parcels are reviewable per-site. A parcel import now stamps every proposal with the TARGET domain, so a receiving site’s reviewer sees the imported rows (and only them, via ?domain=) instead of every site’s mixed queue.
• A cross-domain reviewer can no longer decide a foreign-domain proposal. Approve, reject, and edit re-check the ROW’s domain against the caller INSIDE the decision transaction, BEFORE the CAS — a proposal stamped for another domain is a loud 403 with the row untouched, never a silent promotion by a caller its domain never answered for.

Improvements

• Schema 1.28.53 (additive, idempotent): proposals.domain TEXT NOT NULL DEFAULT 'global' + nullable proposals.title + the idx_proposals_status_domain index. Existing rows keep 'global' forever — provenance beats guessing. The schema-contract test gains the missing expected_proposals_cols block.
• GET /proposals?domain=<label> scopes the queue to one domain; the read gate checks the REQUESTED domain (fail-closed 403 for a foreign one; loopback/opaque unchanged). Every queue row now carries its domain and optional title (the autocapture source title, the parcel row title); POST /ingest/proposal accepts the optional bounded+screened title.
• Parcels dedup narrows: the pending-scan filters to the target domain PLUS one global pass, so a foreign domain’s outstanding reviews never swallow this domain’s rows while pre-Triage global pendings still dedup.
• Crew skills proposals stamp the change’s target domain — the review queue scopes them to the domain whose roster they edit.
• service::review (NEW): the proposals aggregate’s complete storage story — the page read (status + since + the domain clamp + the cap), the creation insert, the decision CASes (approve / reject / translate / TTL), the edit path, the conflict pre-check, and the deadline/SLA derivation — extracted from service::gate, which keeps the KCS/promotion/export machinery. Pinned by review_core_has_no_http_types.

Security fixes

• The row-domain re-auth above is the release’s hardening: by-id review verbs (approve/reject/edit) now authorize twice — the queue posture at the route, and the row’s own residency label before the CAS.

Engineering record

• The plan-to-reality mapping (deviations, declared): the plan’s “gate.rs ~4 sites” was written before Cornerstone drained the handlers — the insert sites now live in service::gate::insert_proposal (ONE definition, which this release extends with domain+title); the plan’s list_proposals_page is the review core’s pending_page (the Cornerstone name kept); the plan’s sql_inventory_baseline gate.rs-row check is SUPERSEDED — the enforcing flip deleted the baseline machinery, and no_sql_in_handlers_enforced (still green) holds handler SQL at ZERO, so the extraction is a service-core split (gate → review), not a handler drain. The piggyback rule’s intent — the review surface’s core named in the same change that scopes it — is honored.
• Write-site inventory: production INSERT INTO proposals sites WITHOUT an explicit stamp ride the column’s 'global' default by design (outreach, complaints, KCS, channel user-map/template, webhook drafts, CRM merge-suggestions — all global acts with id/kind-scoped reads). Explicit stamps: the review core (create_proposal’s authorized domain), parcels (target domain), crew skills (change domain).
• Tests (+5 named pins): proposal_rows_carry_their_domain_and_clamp_to _caller_scopes (service::review), approve_reauths_row_domain_before_the _cas (main.rs, handler-level: 403 + row untouched, then the same caller with the grant approves), parcel_import_proposals_scope_to_the_target _domain + pending_dedup_narrows_to_domain_without_losing_global_rows (workflow::parcels), review_core_has_no_http_types (service::pins). Moved-with-pins: the three service::gate queue-read pins ride the extraction verbatim (call sites adapted to the new domain parameter).
• Wire artifacts: openapi.yaml — /proposals gains the domain query param + description; /ingest/proposal gains title (maxLength 500); the ProposalView component schema is now DEFINED (the two $refs were dangling since the view shipped — fixed opportunistically with the domain/title fields added); /ops/workload’s gate_backlog description no longer claims “proposals carry no domain column” (the attribution stays lineage-only). docs/api.md updated; the Parcels ceiling “no per-domain review queue yet” is LIFTED. No new routes; the route-coverage and route-authz guard tables are unchanged by construction.
• Gates: fmt clean; clippy --all-targets --features bench -D warnings green; full suite +N passed / 7 ignored (delta below); CI dry-run set green (default-features clippy/test, engine-crates, steward-harness, otel). Live smoke on a DB COPY: see below.
• Ceilings (honest): pre-Triage rows read 'global' forever (no heuristic re-attribution). Cross-domain reviewers with wildcard scopes see everything they could before — nothing narrows superuser visibility. The by-id verbs keep the queue’s global gate, so a domain-scoped approver needs the global grant PLUS the row-domain grant (the row re-auth can only deny, never widen; relaxing the route gate is a follow-up). Approval promotion still stamps knowledge global — the proposal’s domain does not yet flow into the promoted chunk (the parcel comment that claimed it did was aspirational; now corrected). /clients/{name}/proposals stays owner-scoped only (no domain narrowing). The export bundle’s proposal projection keeps its legacy column list (no domain/title). The workload view’s attribution stays lineage-only. Gold-set sync does NOT ride parcels (unchanged from the plan).

Predecessor: [1.28.52] — “Cornerstone”: the fin, the Foundation Line complete and machine-enforced.

[1.28.52] — 2026-09-03 — “Cornerstone”: THE FIN — the Foundation Line complete and machine-enforced

The line’s last milestone, with one declared amendment: v1.28.51 shipped with gate.rs (78 statements, the HITL proposal engine) still holding SQL, so the milestone opened with the AGENTS.md-prescribed Masonry-class extraction of the final vein — a new service::gate core, six surfaces, six commits, full gate + baseline-row-lowered per commit (78 → 68 → 66 → 59 → 57 → 21 → 0) — and then flipped the guard to ENFORCING. Handler-side SQL is now ZERO across the tree, and any regression — production, test fixture, or even a comment naming a statement opener — fails CI. No features, no routes, no schema (1.28.45 untouched).

Release notes

Bug fixes

• None. (No behavior change ships in this release: the extraction moves statements verbatim with their error messages, and the flip deletes already-satisfied machinery.)

Improvements

• service::gate (NEW) owns the HITL review queue’s complete storage story: the review-queue page read (status filter + since window + the LIMIT ceiling) with the deadline/SLA derivation and the supervisor owner filter; the creation insert (the proposal_pending audit riding the same call) and the subject-anchor conflict pre-check; the TTL-expire write with wall-clock entering as an argument; the pending-fence read ONE-DEFINED across approve/reject/edit (was three copies); the reject CAS and the content read (was two copies inside reject); the edit-path row read and re-score CAS; and the approve family — the pending-row read, the decision CAS ONE-DEFINED across six branches, the article-state CAS typed (KcsStateError::SlugTaken) so public_slug_taken keeps its frozen 409, the translation CAS with its verbatim datetime('now') quirk pinned and filed, the KCS draft insert, the vec shadow ONE-DEFINED across both promote paths, the idempotent case-article link, the supersession link-follow, and the generic promote insert. The export read moved as export_bundle (count pre-flight + the four datasets in stored/legacy JSON forms); the handler keeps the 413 ceiling, redaction, the provenance summary, and the UMP projections.
• THE ENFORCING FLIP. The per-file baseline table, the floor pin, and the allowlist machinery are DELETED — nothing is left to compare against. no_sql_in_handlers_enforced walks src/handlers/ recursively and fails on ANY counted statement; a ≥30-file sanity refuses the vacuous pass, and sql_statement_counter_still_fires proves the counter still detects all four openers (a guard that cannot fire is decoration).
• service_layer_free_of_http_types — the transport-free grep takes its line-plan name (born a hard error at Plumb; there was never a warning phase). Both guards ride CI via the test jobs (default + bench).
• The architecture law is now public documentation: docs/architecture.md states the two layer rules, carries the request-flow mermaid diagram through the seam, and the seam table (what crosses down: connections, injected time, validated values; what crosses up: domain types, typed errors, in-tx audit rows; what never crosses: pools, state, statuses, wire shapes). AGENTS.md’s Architecture Law points there as the law’s public statement.
• The Foundation Line close-out report is appended to docs/AUDIT.md: pin counts (service-tree pins 0 → 89 across the line; suite 1268 → 1308), the v1.28.50 eval-floor history, the per-phase smoke matrix, and the wire
  • schema identity proof — routes bit-identical (147), the authz gate table md5-identical (201 rows), schema_meta untouched at 1.28.45, and ONE declared openapi exception (the /ingest/proposal maxLength 2000 → 10000 shipped in Confluence b8cb52c with its same-commit contract edit; that release’s diff-empty claim was true for routes, false for this bound).

Security fixes

• None. The review wire (digest binding, sanitize_read, PII masking), the approve-role gate, and the public_slug_taken 409 all preserved verbatim and pinned through the move.

Engineering record

• The amendment (declared): the executor prompt assumed an empty allowlist; the prerequisite check printed 78 / 78, Δ 0 and STOPPED. The operator chose the extraction-first path; the flip then proceeded exactly as written. The extraction honored the line discipline — one surface per commit, full gate per commit, baseline row lowered in the same commit.
• Gates: fmt clean; clippy --all-targets --features bench -D warnings green at HEAD and at every one of the eight commits; full suite 1308 passed / 7 ignored; enforcing guard + self-pin + renamed layer pin green; lipstyk diff-strict vs v1.28.45 CLEAN (one warn fixed: the since-window two-arm match simplified); mdbook build green.
• Live smoke on a DB COPY (release binary v1.28.52): gate propose → digest-bound approve → chunk (817), recall hit, suggest + accept feedback, UMP memory record (content-addressed URN, blake3 integrity, ed25519 signature), Art.30 register read, export bundle (8791 knowledge rows, provenance v2), forget → tombstone (erased id 404s at the UMP read), workflow run open (run_id 1), kcs worklist read, webhook HMAC posture (missing signature → 401), /audit/verify ok at start and finish, /health + /version green (1.28.52).
• Schema untouched at 1.28.45. openapi.yaml byte-identical to v1.28.51.
• The six open dependabot bumps are WRAPPED into this release (operator call: keep the line at 1.28.52, land them here): argon2 0.5.3 → 0.6.0 (password-hash 0.6.1 + a new phc crate ride along; the KDF surface — Argon2::new/Params/hash_password_into — unchanged, the full 24-test backup suite green on the PR branch before wrapping), uuid 1.25.0 → 1.26.0, fastembed 6.0.1 → 6.0.2 (neural-embed/rerank-tier check clean); actions/cache v4 → v6.1.0 (SHA-pinned, 6 sites across ci/docs/release) and codeql-action init+analyze → 4.37.9 (2 sites). Gates re-run green on the combined tree: clippy -D warnings (default + bench), 1308 passed / 7 ignored, engine-crates 157 passed. PRs #20–#25 closed as wrapped.
• Ceilings (honest): the translation CAS’s decided_at = datetime('now') (a SQL-side clock, inconsistent with every other branch’s bound parameter) is preserved VERBATIM — a pin or fix is filed, not smuggled into the move. The maxLength parity pin for the Confluence bound is a follow-up. The compliance-pack TEST RUN owed from Confluence remains owed — deferred again at push time by operator call (clippy green; the one-time full rebuild is the cost).

Predecessor: [1.28.51] — “Confluence”: the long tail, sixteen files to zero.

[1.28.51] — 2026-09-02 — “Confluence”: the long tail, sixteen files to zero

The Foundation Line’s long-tail milestone: every handler file EXCEPT gate.rs drained to ZERO embedded SQL — the inventory’s debt floor moved 241 → 78, with the one straggler (gate.rs, the HITL proposal engine — 50 production + 28 test occurrences, the surface Masonry’s release scoped and only nicked) honestly carried as THE ceiling of this milestone. Sixteen files drained across 15 extraction commits + one lint fix, one commit per file in the roadmap’s order, full gate per commit, the baseline row lowered in the same commit as each move.

Release notes

Bug fixes

• The compliance-pack’s own test suite is compilable again. The pack’s evidence pins (oversight_links_a_signed_decision_record, tampered_signature_fails_verification, the RoPA upsert pin) could never have run: their fixture created the 7-column oversight_evidence while the write targets 9 columns (the moved pin now carries the full schema), and the pack’s suites live in the binary’s test target where the decision test seam (cfg(test) in the lib crate) is invisible — the seam is now cfg(any(test, feature = "compliance-pack")). The pack’s clippy build is green; the flagged TEST RUN remains pending (see ceilings).
• A latent dead read removed. DELETE /sources/{id} fetched the source URI into a discarded binding “for the tombstone audit” — the post-commit audit logs the id only and never carried it. The read is gone; behavior is byte-identical.
• A false “Pinned by test” claim reworded. SIGNAL_MAX_PER_HOUR’s comment asserted a pin that did not exist; the comment now states the truth (a crash-valve the relay backs off on), and the flood bounds read as service counts with the comparisons at the call site.

Improvements

• Every long-tail surface now has a named core owning its complete storage story, each taking &Connection/&Transaction — never a pool, state, or a transport type — with typed errors whose Display carries the exact pre-move message: service::procedure (the store tx: root → per-chunk quarantine flags → ordered steps → next_step edges skipped for a quarantined root; the step-chain/meta/decision reads; the best-effort vec-shadow writes), service::ump_ops (the urn lookup, the bi-temporal supersession read, the raw relations read, the soft-forget block — flag + hash-only tombstone + in-tx audit — and the §3.7 consent-denial audit helper, moved WITH its pin), service::forget (the single-chunk erasure: document_id + digest capture, the explicit vec0 delete, the tombstone ONLY when a row actually deleted), service::suggest (the last-wins feedback upsert with its fail-open existence fence — retyped off HandlerError — and the grouped outcome counts), service::compliance (the best-effort oversight write, the six evidence counts with unwrap_or(-1) per table, the legacy-JSON RoPA read, the RoPA upsert with in-tx audit), service::art30 (the register’s data reads with all three error postures preserved verbatim: fail-the-request categories, best-effort connector/DSAR sections, fail-open lifecycle counts), service::webhook_ingest (the kb-feedback flood/finding/hot-count story, the Signal flood bound, the draft-approve read + the digest-gated pending→approved UPDATE), and workflow-side homes for the engine projections (workflow::state run-row reads + open_run, workflow::outbox steering inbox + lineage reads, workflow::scoreboard — NEW: the runs page, the fail-closed hash-linkage reconstruction, the aftersales cohort, score_units_now
  • the whole scoreboard test module — workflow::kcs’s article lifecycle, workflow::valet’s brief projections, workflow::relay’s handover reads, workflow::crew‘s presence touch + skills proposal, workflow::channels’ user-map proposal + the shared seen-window flood count), plus role::defined_count, capacity::knowledge_docs (fail-open), legal_hold::first_missing_id (the all-or-nothing fence), and service::recall::chunk_for_verify (the domain-bound verify read).
• The e2e fence pins went home. The twelve borrowed-fixture pins in handlers/clients.rs (hold fences over forget / sources / ump / observe / holds / transfers + the auditor dual gate) moved onto service::register’s test module, which already carried the identical fixtures from Terrace; the valet brief tests moved onto workflow::valet’s test module. Call paths unchanged, every assertion unchanged.

Security fixes None. (Every fence moves WITH its code: the legal-hold fences in-tx, the screen→flag→store order and its body-scan pin, the verify-before-serve UMP orchestration, the digest-gated approve’s status predicate, the domain-label predicates, the wildcard-injection fence inside reuse_candidates, the CAS sequences and their audit rows — all pinned through every move.)

Engineering record

• Inventory: 241 → 78. Drained to zero: workflow.rs 23, workflow_lineage.rs 11, procedure.rs 13, ump_ops.rs 11, kcs.rs 8, forget.rs 5, suggest.rs 6, compliance.rs 13, webhooks.rs 14, valet.rs 6, relay.rs 4, govern.rs 6, breaches/channel/ channel_webhook/crew/mod/sources/verify 7 (one each), holds.rs 2, the comment residues in ingest/shifts/auth/profiles/roles (8), and clients.rs’s 26 test seeds. The floor pin now asserts 78 with the single remaining row ("gate.rs", 78); per-file deltas printed at every step.
• The straggler (honest): gate.rs — 78 occurrences, 50 in production code. It is the HITL proposal engine: the ~950-line approve arm with per-kind storage appliers (knowledge + vec rows, case_articles, the kcs publish/retract flips), propose/list/decide/ edit/decay/purge/export, the review-posture verb the Herald channel seams reuse byte-identically, and 28 test occurrences. It is Masonry-class work — the roadmap’s own law (“a fully-moved smaller scope beats a rushed full scope”) says it is its own milestone, NOT a half-day tail item. The v1.28.52 enforcing flip is therefore BLOCKED on a gate.rs extraction milestone first (or an explicit amendment extending this one). well_known.rs was verified 0-SQL (the roadmap listed it; the guard’s unlisted-file rule already pins it at implicit zero — the drained-file template).
• CAS discipline untouched. open/state/events/answer/rewind ride workflow::state::cas_update exactly as before; the read_state_and_revision core is shared by the bare-connection state view (audited read, row-only-if-present audit), the answer CAS, and the rewind CAS (any read failure → Gone); the accept-time ownership transfer reads its CAS inputs inside the SAME Immediate tx as the offer move. The put_run_state 200-body revision quirk the recon flagged is preserved verbatim and filed for a follow-up pin.
• Digest/HITL orders pinned through every move. The Signal draft-approve’s digest check and mismatch audit stay in the handler orchestration verbatim — including the pre-existing ceiling that the mismatch Denied audit rides the Immediate tx that then rolls back (evidence of the refusal is lost today; NOT fixed mid-move — filed as the audit-adjacency follow-up, alongside forget’s no-audit-row tombstone-only posture and the webhook arms’ audit-after-commit writes). The kcs approve/publish prechecks, the kcs_state_invalid vocabulary, the probe-blind 404 families (“no chunk with id {id}”, “no procedure with id {id}”, “no memory with id {id}”, “workflow run not found”) are byte-identical.
• Body-scan + authz + read-seam guards passed unchanged: the screen-sites pin still holds screen::screen( inside procedure’s create (verdicts are wire-shaped at the handler; the core receives the flags); the owner-INSERT and ump sanitize seams hold; stored_text_fields_pass_the_read_seam scans unchanged handler bodies; authz_gates_cover_every_non_public_route still scans every gate in every handler body. Relations/verify/suggest read shaping (sanitize) stayed handler-side; services return STORED forms — one intended split: ump_ops::relations_for_chunk now maps raw service triples through the same sanitize, wire shape identical.
• Dup-guard + transport-free greps green: no duplicated helper names (the ump row-meta read reuses service::procedure:: row_access_meta — one definition; the signal run-domain lookup reuses workflow::state::run_domain_of; the steering write was ALREADY shared and moved once, both callers repointing); the new service modules carry no transport types or version-citing comments.
• Pins 1024 → 1036 (+12 net): the scoreboard tests moved with their fns (9), the consent-denial audit pin moved with its helper (+1 live repointed assertion at the handler), the oversight + tamper pins moved onto the full evidence schema (+2 schema-true fixtures), the RoPA in-tx-audit + 404 pin new (+1), the valet brief tests moved (2), and the twelve borrowed fence pins moved wholesale. Total count never decreased; full suite 1306 → 1316 passed / 7 ignored at the release build.
• Gates: fmt clean; clippy --all-targets -D warnings green on bench, default, otel, and compliance-pack (clippy only — see ceilings); full suite --features bench 1316 passed / 7 ignored; CI dry-run green (engine-crates tests + clippy + fmt, steward-harness tests + clippy, default-features test –all-targets with RUSTFLAGS=-D warnings); lipstyk diff-strict clean vs v1.28.50 after one finding fixed (record_feedback borrows the tenant); openapi.yaml diff-empty (zero route changes); schema untouched at 1.28.45; inventory guard prints 78 / 78, Δ 0.
• Live smoke on a DB COPY (release binary, per Confluence’s gate): procedure evaluate, UMP ops read (get-memory, integrity-verified), kcs worklist, DELETE /memory/{id} forget (tombstone carries the digest), suggest + feedback, the Art.30 register read, the webhook HMAC path (missing signature → 401, bad signature → 401), and /audit/verify ok throughout. (The skipped compliance-pack TEST RUN and the smoke transcript are the two items the release engineer confirms at push time; see ceilings.)
• Ceilings (honest): The allowlist does NOT reach EMPTY — the milestone’s stated headline is missed by one file. gate.rs (78) is the single remaining allowlist row; the enforcing flip of v1.28.52 cannot ship until that extraction lands. The compliance-pack TEST RUN (clippy green, run deferred — three interrupted attempts; one-time full rebuild cost) must be executed before push; the pack’s clippy build is green. The forget aggregate still writes no audit_events row (the tombstone is the evidence — the erasure-family convergence follow-up). The Signal digest-mismatch Denied audit still rolls back with its tx (evidence of the refusal is lost — the audit-adjacency follow-up). put_run_state’s 200 body still carries cas_update’s run-id-as-revision quirk (nothing consumes it; pinned-fix follow-up). The two known-flaky backup tests (backup_manifest_integrity, backup_produces_decryptable_archive) raced twice during the session — root cause is the console-seam test setting BRAIN_CONNECTOR_CONFIG_DIR without the module env-lock while backup tests read it in-process (pre-existing, test-infra only, untouched; rerun-when-seen).

Predecessor: [1.28.50] — “Aqueduct”: the retrieval surfaces, two cores.

[1.28.50] — 2026-08-28 — “Aqueduct”: the retrieval surfaces, two cores

The Foundation Line’s fifth vein and the performance-sensitive heart: the retrieval surfaces converged onto the service layer — src/service/recall.rs (cross-domain fusion, the per-domain filter law, the per-domain read shaping, and the read-event write story) and src/service/ingest.rs (the screen → flag → store pipeline as ONE aggregate). This release is EVAL-GATED PER COMMIT: the recall floor gate ran after each extraction commit against the CI-style 25-doc scratch corpus, and the metrics came back byte-identical on both commits — behavior preservation, not retrieval-quality improvement.

Release notes

Bug fixes

• The audit-retention prune can no longer be silently stranded from the read event. The pre-move read-event write ran record-then-prune-then-DSAR inside one inline handler closure with no early return between them — the move pins that exact order (read_event_failure_returns_none_and_still_prunes): a failed audit row write returns None AND the prunes still run, so a future ? refactor cannot silently couple retention to the write’s success. Behavior is unchanged; the invariant is now machine-checked.

Improvements

• The recall core (service/recall.rs): the cross-domain Reciprocal Rank Fusion merge (rrf_merge_domains, moved verbatim — rank-based fusion across per-domain lists whose raw scores are not comparable), the per-domain filter law (domain_filters — multi-db drops the in-DB domain predicate so the pool-is-domain rule never double-restricts; shim mode keeps it scoped to the searched label; a bound profile’s retention map REPLACES the server-wide map rather than merging — all pinned), the per-domain post-search read shaping (finish_domain_results — snippet window, best-effort evidence enrichment, flagged-evidence suppression LAST so enrichment cannot re-attach what the review posture strips), and the read-event write story (record_recall_read_event — the hash-chained audit row, its replayable trace artifact, the every-registered-domain-chain retention prune, and the DSAR-ledger piggyback on ONE connection in the legacy order, best-effort by contract).
• The ingest core (service/ingest.rs): the structured write path as one aggregate — the screen stage (screen_structured: the two-layer injection screen + the scrape-posture fence; the fence holds of the FUNCTION), the friendly-retention conversion (ttl_days_to_expires, clock injected — the row-wins invariant pinned exactly), the bound-profile write defaults (apply_profile_ingest: strict-posture masking at the write boundary, default access-scope fill, the kinds vocabulary fence as a typed variant), and the store transaction (store_record: the strict-posture re-check UNDER the write lock, the xxh3-64 content-hash dedup, the computed §6.2 ump_id, the knowledge + vec0 inserts, the fail-closed quarantine flag, the graph edges with their in-transaction supersession audits, and the exact delta counts). The wire vocabulary is rendered 1:1 from the typed errors — every variant carries its pre-move message.
• A local eval-gate runner (scripts/aqueduct-eval.sh) mirroring the CI recall-eval job exactly: a scratch instance seeded with the frozen 25-doc corpus, then brain eval --floor r5=0.85 --floor r10=0.85 --floor mrr=0.85 against it — the reproducible per-commit gate the phase’s law requires.

Security fixes None. (The screen → flag → store fences and the every-domain authz read-gate move with their code; no posture changed.)

Engineering record

• The pool schedule stays transport. The hybrid search’s three concurrent legs (vec0 + FTS5 + graph-PPR) each take their own pooled connection per domain; the acquisition schedule is the perf contract this line must not disturb, so the handler’s spawn_blocking keeps it verbatim and hands the core decisions, results, and borrowed connections. The recall core takes connections and domain types — never a pool, the registry, or a transport type.
• Row-domain predicates run exactly as they did — inside the retriever SQL (search::vec0_knn/fts_search/graph_ppr, untouched); what moved into the service is the DECISION that feeds them (domain_filters), pinned for both modes plus the retention-map replacement.
• The read seam is unchanged: results_to_hits stays at the handler’s emission boundary; the service returns STORED forms. The seam-wiring meta-test (stored_text_fields_pass_the_read_seam) needed no additions — the extraction created no new emission site.
• Body-scan pins repointed, not rewritten: the owner-INSERT guard and the screen-sites guard now scan service/ingest.rs (store_record, screen_structured) — the INSERT literal and the screen call moved WITH the code they evidence.
• Pins 1013 → 1024 (+11): the recall module went 20 → 24 (rrf ×2 + the trace-hash pin moved verbatim; domain_filters, finish_domain_results, and two read-event pins new), the ingest module 6 → 11 (ttl + profile ×2 moved with their aggregate; kind_vocabulary repointed to the typed fence; screen, in-tx audit, dedup, quarantine-no-edges, and the strict-posture race pins new), and two handler-free pins added (recall_core_is_handler_free, ingest_core_is_handler_free — fn-pointer coercions + production token walks; the recall coercion covers the generic connection-guard via a test-local Deref<Target = Connection> type).
• Inventory: ingest.rs 22 → 3 (every store-tx statement out; the residue is comment substrings the substring lock deliberately counts) and the stale govern.rs row caught up at 18 → 6 (the Plumb-era retention move’s row was never lowered — Terrace shipped with the guard printing −12 progress); debt floor 272 → 241, same commit as the move. recall.rs stays 0/unlisted (no SQL before or after).
• Gates: fmt clean; clippy --all-targets -D warnings green on bench, default, and otel; full suite --features bench 1301 passed / 6 ignored (main-binary 1024 vs 1013, +11); CI dry-run (engine-crates tests + clippy, steward-harness) green; lipstyk diff-strict clean vs v1.28.49; openapi.yaml diff-empty (zero route changes); schema untouched at 1.28.45.
• Eval gate (per extraction commit, CI-style 25-doc scratch corpus, release build): pre-move baseline r5=0.976 / r10=0.991 / mrr=0.956; after the recall commit r5=0.976 / r10=0.991 / mrr=0.956; after the ingest commit r5=0.976 / r10=0.991 / mrr=0.956 — byte-identical means and per-query ranks on all 106 judged queries; floors (0.85) green at every gate. The floor gate targets the FROZEN 25-doc corpus (fresh scratch instance, exactly as CI runs it); a live-server run against a drifted corpus is not a comparable baseline (judged indices only align on the seeded set).
• Live smoke on a DB COPY (multi-db, release binary): recall end-to-end with all three legs (vector + FTS + graph) on a multi-domain copy, ?trace=true → /recall/{id}/trace replay round-trip, include_flagged review posture, ingest screened (benign store) and quarantined (scrape without lawful basis → stored + flagged + no graph edges) paths, content-hash dedup (second identical ingest → "status":"duplicate" with the first row’s id), and /audit/verify ok on every chain throughout.
• Ceilings (honest): LongMemEval parity stays PENDING — this line makes NO retrieval-quality claim, only behavior preservation (the eval gate proves the frozen-set metrics did not move; it does not claim external-engine parity). The read-event write remains a separate best-effort post-search blocking task (availability-first: the recall’s 8 s timeout must not absorb retention-prune cost; the consolidation is one service fn on one connection, not a merge into the search task). The evidence-enrichment connection is still a fresh best-effort pooled get per domain (byte-identical posture). The graph-leg SearchFilters boundary pins and the PRF occurrence-schema pins stayed attached to search/graph_ppr.rs and the search tests respectively — they pin the retriever engines, which did not move; the suite proves them byte-identical post-move. The trace-detail JSON shaping stays at the handler (it maps the wire HitSource labels; the service owns the WRITE, not the response shaping). RecallRequest/IngestRequest and their bounds validation stay handler-side (wire-shaped 400s; the Terrace kind-vocabulary ceiling extends to the confidence/entities/ relations fences).

Predecessor: [1.28.49] — “Terrace”: the register surfaces, two cores.

[1.28.49] — 2026-08-28 — “Terrace”: the register surfaces, two cores

The Foundation Line’s fourth vein: the BPO register surfaces — the clients register (CRUD, DPA terms, per-client hold/DSAR/coach/QA/ termination delegation seams, auditor row filters) and the isolation- domain administration (create/delete/vacuum/export/import census + the relabel transaction) — converged onto src/service/register.rs and src/service/domains_admin.rs. The pre-service src/clients.rs domain module folds into the register core (its HandlerError leaks become the typed RegisterError), the handler files shrink to protocol adapters, and the domain registry (the pool authority) never crosses the service boundary — proven at the type level.

Release notes

Bug fixes None.

Improvements

• The register core (service/register.rs): the clients rows (insert with canonical-lowercase storage, the WORM-lite archive flip, list/by_name reads), the Art-28 DPA-terms round-trip (blank/ oversize fenced by MAX_DPA_FIELD — the fence now holds of the FUNCTION, re-asserted in set_dpa_terms), and the registration fences (validate_new_client/validate_dpa_terms) as typed variants the handler renders onto the byte-identical wire vocabulary. The per-client DELEGATION seams move with it: require_active_client (the by-name resolve + archived refusal every per-client route shares — 404 unknown / 409 archived before any domain-pool work), coach_note (the QA-note write + its audit row INSIDE the caller’s tx — pre-move the update and the audit rode two separate autocommit transactions, a crash window the audit-per-write law closes; pinned by coach_audits_inside_the_tx + its rollback twin), and termination_clause (the contract-end purge-or-return around the shared purge/DSAR primitives, held ids DEFERRED and reported).
• The auditor row filter moves into the core (list_for_domain_grants): a client-auditor’s grant list scopes the emitted rows in the service — row-scoping is a service duty, not call-site discipline. The handler’s gate (403 on an empty grant set, the per-domain authorize) stays in front, byte-identical.
• The domain-admin core (service/domains_admin.rs): the shim-mode census (DISTINCT domain labels + counts, unwrap_or(0) posture kept verbatim), the per-file census + emptiness probe behind create/warm, the domain erasure (legal-hold preflight → multi-db audit-segment export → the FK-ordered sweeps → the domain_deleted evidence row INSIDE the caller’s tx — pre-move that audit rode after the commit with a let _ =, the exact certified-silence form the error-propagation sweep forbids; the erasure and its evidence now commit or roll back together, pinned by domain_delete_rolls_back_with_its_audit), vacuum, export_snapshot (through the shared backup::vacuum_into escaper — the quote-escaping and symlink-containment pins stay attached to that primitive verbatim; domain_export_routes_through_shared_ vacuum_escaper pins that this module keeps calling it, never a hand-rolled literal), and the relabel transaction (moved VERBATIM with its own single-tx atomicity unit and its provenance guarantees).
• handlers/domains.rs 64 → 0 SQL, handlers/clients.rs 44 → 26 (every register statement out; the 26 residue are other surfaces’ hold-fence/transfer/remanence pins that fixture on the register — see Ceilings). The frozen debt floor drops 354 → 272 in the same commit that moved the SQL. src/clients.rs is GONE — its storage fns, its tests, and its handler seams live in the register core.

Security fixes

• register_services_receive_no_registry: the compile-time + source proof that the pool authority cannot leak into the register family — every core storage fn coerces to a plain fn pointer taking a connection or transaction FIRST (a future signature that takes the registry, a pool handle, or server state stops compiling), and the production source of both modules never names the registry/transport/handler types.
• Auditor isolation re-asserted at the new boundary: client_auditor_sees_only_their_domain, client_auditor_with_no_granted_domain_sees_nothing, and the hold-per-client isolation pins moved with their aggregate and stay green; list_for_domain_grants_scopes_rows_in_the_core adds the core-level negative (a grant list scopes rows even if a future caller forgets the gate).
• The domain-delete hold preflight is structural: the preflight runs inside the erasure fn on the ids collected in the same tx (the pre-move shape), rendering the identical shared 409 legal_hold_active envelope with reasons; domain_delete_refuses_while_holds_active moved with the aggregate and stays green.

Engineering record

• Pin ledger (count delta ≥ 0): main-binary tests 1010 → 1013 (+3 net: NEW pins register_services_receive_no_registry, domain_delete_rolls_back_with_its_audit, domain_export_routes_through_shared_vacuum_escaper, coach_audits_inside_the_tx (+ its rollback twin inside the same test), list_for_domain_grants_scopes_rows_in_the_core; the src/clients.rs unit pins moved verbatim into the register core’s test region — the duplicate-register/profile_not_found/archive-idempotence/DPA-round- trip/unknown-client-zero assertions assert the typed variants now instead of HandlerError fields); the register route pins (per-client DSAR scope + unknown/archived, hold isolation + unknown/archived, shim single-pool no-deadlock, the R6 termination quartet, coach audit, QA-queue owner filter) moved verbatim with their aggregate; the domain pins (shim-delete preserves global tables — now driving the REAL erasure core instead of hand-replayed SQL, so its expected audit count grows by exactly the one in-tx evidence row — relabel provenance, relabel missing-ids) moved with theirs; the recompute-sweep pin repointed to domain_router.rs, the module of the code it always tested; the hold-fence pins (forget/tombstone digest, source delete/reconcile, ump hard/soft forget, allow-empty, hold-release DPO dual gate) and the transfer-registration atomicity pin stay in handlers/clients.rs — they pin OTHER surfaces and ride with those surfaces’ own extractions.
• FK-children map (the erasure law: documented BEFORE the move) lives in the domains_admin.rs header: evidence_links both arms (NO ACTION — explicit first), relationships (SET NULL — explicit first so entities don’t orphan), the orphan-entities sweep (parents, shared across domains), embeddings (CASCADE, auto), tombstones (soft ref BY DESIGN), vec_knowledge (no FK — explicit), knowledge_fts (trigger-cleaned, never hand-deleted), sources/source_revisions (knowledge is the CHILD; sources’ CASCADE takes revisions), domain_centroids (domain-keyed), the multi-db wholesale-only tables (connector_checkpoints, webhook_seen, webhook_queue), and the case_articles/kcs_translations NO ACTION ceilings (shared with the purge core’s map — a domain carrying either fails LOUDLY, fail-closed).
• Wire artifacts diff-empty: openapi.yaml, the route-coverage array, and the route-authz table are untouched (no route changes). Schema untouched at 1.28.45. Error bodies byte-preserved via the typed maps: client not found (404), client not active (archived) (409), client already exists (409), the registration-fence 400s with their exact messages, profile_not_found, id_not_found ({missing}/{total} ids do not exist), confirm_required (delete AND relabel forms), the shared legal_hold_active envelope with reasons, and internal-error bodies carrying the verbatim pre-move statement-prefixed texts (delete evidence_links failed: , relabel failed: , VACUUM INTO failed: , vacuum failed: , archive domain audit: , commit failed: included). The response JSON shapes (DomainInfo, the register rows, TerminationCertificate, the hold/QA/coach bodies) are field-for-field identical; the core’s census returns a plain DomainRow the adapter maps 1:1.
• Error-conversion notes (the honest diff): the pre-move client resolution ran transfers::list BEFORE the archived refusal in the DSAR seam; the typed require_active_client refusal now precedes the mechanism lookup (a read-order change with no wire effect — the 409 body is identical and the lookup was read-only). The domain_deleted audit row and the termination audit row moved INSIDE their caller’s transactions (byte-identical rows; only the crash-window atomicity changed — the Masonry/Plumb shape), and the audit writer’s own fail-safe posture (drop + /health alert, never forge) is unchanged.
• Gates: fmt clean; clippy --all-targets --features bench -D warnings zero warnings (the fn-pointer signature aliases in the new type-level pin factor the complexity); full suite --features bench green (1295 passed, 6 ignored; main-binary 1013 vs 1010, +3). CI dry-run: lint-test (default features) clippy+tests, engine-crates tests+clippy, steward-harness, otel-gate clippy+tests — all green; lipstyk diff-strict clean (one verbose-match in the moved DPA read collapsed to ok_or_else); client fmt clean (client/ untouched).
• Live smoke on a DB COPY (multi-db mode, release binary): client add → DPA set/read-back → delegate hold on the client’s row → client-scoped DSAR purge: the free row purged (tombstone reason owner:smoke@client), the held row DEFERRED with reasons on the certificate, and the other-domain row completely untouched (zero cross-domain tombstones); /audit/verify ok on every chain at every step. Domain legs: create (201) → vacuum → export → import round-trip (content-identical clone); export with a single quote in TMPDIR — the exact breakout the escaping pin guards — returned 200 with valid SQLite bytes and zero temp residue; domain delete refused 409 legal_hold_active while held (rows + file intact), then after hold release proceeded: FK-ordered sweep, 0600 pre-deletion archive segment (NULL prev_hash serialized, tombstones appended, no domain_deleted inside), the evidence row on the preserved chain, file retained in place. Client end with a purge-policy DPA: chunks purged, register row archived, re-end → 409, unknown client → 404 before any pool work.
• Ceilings (honest): handlers/clients.rs retains 26 test-region statements — the universal legal-hold fence pins (delete/source/ump bypass paths), the transfer-registration atomicity pin, and the DSAR remanence-posture pin fixture on the register but pin OTHER surfaces (forget/sources/ump/holds/transfers/observe); they are neither register pins nor register-security pins, they cannot move to their surfaces’ handler files without regressing those files’ frozen baselines, and they ride with those surfaces’ own Confluence-line extractions — the register surface itself is fully drained (0 production statements, the route inventory 64 → 0 and 44 → 26 measured by the guard’s own counter). Client/DpaTerms keep their legacy serde derives (they ARE the wire/storage forms — the retention exemplar’s ceiling); relabel_chunks keeps its verbatim self-contained tx (the whole relabel is its atomicity unit; it owes no audit row); the shim-mode per-client DSAR sweeps the shared DB by subject (pre-existing shim semantics, pinned and unchanged — the multi-db isolation is the scoped contract); the import path embeds no storage logic, so its magic-header/filesystem/registry duties stay at the handler by the layer law (the surface is converged: zero embedded statements remain to move); the multi-db census keeps the per-file open loop and the fail-soft continue at the handler (filesystem orchestration, not storage); the register/termination handler audits that already sat AFTER their commits (if let Ok(conn) best-effort form) stay handler-side this milestone — closing them is a follow-up, filed, not smuggled into a move.

Predecessor: [1.28.48] — “Masonry”: the lifecycle surface, three cores.

[1.28.48] — 2026-08-28 — “Masonry”: the lifecycle surface, three cores

The Foundation Line’s third vein: the gate handler’s lifecycle families — the /decayed review list, the /purge by-ids/by-owner orchestration, and the by-id/batch read projections (/get/{id}, /multi-get, the shared knowledge-row projection) — converged onto src/service/lifecycle/{decay, purge,fetch}.rs. The gate handler keeps exactly the adapter work and shrinks toward its eventual seam-library remainder; the plan-vs-tree reconciliation (the roadmap priced this milestone at gate.rs 84 while the frozen re-measure is 83, and the /get+/multi-get handler bodies live in the router file, not gate.rs) is recorded in the engineering record, not silently absorbed.

Release notes

Bug fixes None.

Improvements

• The /decayed aggregate moves as ONE unit (service/lifecycle/ decay.rs): the SQL-superset WHERE and the Rust-side expiry arbiter are inseparable — the SQL only narrows the scan, the Rust filter decides every row’s fate — and the pairing travels together, pinned by sql_superset_plus_rust_arbiter_move_together (both halves in the core, neither left behind in the handler, and the route wired through the core). The held-id exclusion (a held id never appears in the decay registry) and the bounded-page clamp (MAX_DECAYED, offset floor) are re-asserted in the core, so every future caller inherits the fence.
• The /purge by-ids/by-owner families move (service/lifecycle/ purge.rs): target resolution (the by-owner sweep runs INSIDE the tx, so the target set is read at the same instant the erasure runs), the legal-hold preflight (the exact shared 409 legal_hold_active envelope), the strict-posture remanence pragmas (secure_delete=ON before, WAL TRUNCATE checkpoint after — both warn-not-lie), and the erasure itself through the shared Quarry primitive. The evidence audit now rides the SAME transaction as the erasure (SAVEPOINT-nested) — pre-move it rode the connection after the commit, a crash window that left a purge permanently unevidenced; the row’s bytes are identical, only the atomicity changed (the Plumb exemplar’s shape; pinned by lifecycle_purge_audits_inside_the_tx). The negative-reach invalidation (the recall_traces deletes — no stale trace may keep “proving” erased content was returned — plus the tombstone row) already rode the same tx inside the primitive; re-asserted by lifecycle_purge_evidence_and_trace_invalidation_ride_the_same_tx.
• The by-id/batch read projections move (service/lifecycle/fetch.rs): /get/{id} and /multi-get row loads are domain-scoped cores returning STORED forms, with the read seam (sanitize_read* on every emitted field), the row’s-own-domain re-authorization, and the composite record gate kept at the handler emission boundary; plus the shared KNOWLEDGE_ROW_COLS/knowledge_row_to_json/load_knowledge_row projection (one source of truth for the export and the /ump/* record paths) out of the gate handler. MAX_MULTI_GET/MAX_PURGE_IDS are re-asserted at the storage boundary (the routes keep their identical wire fences in front).
• gate.rs 83 → 78 (−5 incl. moved test seeds): the proposal family and the export surface remain (a later milestone; Masonry’s scope is the lifecycle surface only). The frozen debt floor drops 359 → 354 in the same commit that moved the SQL. legal_hold::active_hold_ids retyped to rusqlite::Error (the Quarry active_reasons convention — storage helpers return storage errors); handler call sites map with the identical internal-error body.

Security fixes

• Read-seam meta-test coverage for the moved read paths: get_chunk and multi_get join stored_text_fields_pass_the_read_seam’s site table — the response-forming boundary now proves the seam at emission, precisely because the row loads moved below it.

Engineering record

• Scope reconciliation (the plan is law; the tree is the truth): the roadmap priced Masonry against planning-time numbers (gate.rs “84 SQL”, “3,677 lines”, four aggregates “in one file”) and its own header commits to re-measurement at execution (“the scoping estimate was re-measured; the frozen numbers are the ones the counter produces on the frozen tree”). The frozen truth: gate.rs 83, and the get/multi-get handler bodies live in the router file. Masonry therefore moves the four lifecycle aggregates from where they actually live — decay and purge (plus the shared record projection) from handlers/gate.rs, the by-id/batch row loads from main.rs — into the three planned submodules. The proposal family and /export stay in gate.rs (unlisted in the plan’s scope; moving them would have been scope invention). The plan’s “negative-lookup cache invalidation rides the same tx” has no knowledge-side cache in the tree; its true referent is the primitive’s in-tx recall_traces invalidation + tombstone (a stale trace IS the negative-lookup artifact), which is true of the function and now pinned in the lifecycle purge module too. The auth-side RevocationCache negative-lookup cache is unrelated to /purge storage and untouched.
• Pins (count delta ≥ 0): the three /decayed unit pins moved verbatim with their aggregate (page_decayed_respects_limit_and_offset, page_decayed_judges_bound_domains_by_their_profile, decayed_superset_sql_covers_every_rust_expired_row); the route-level WORM-lite pin (legal_hold_freezes_erasure_and_dsar_defers) stays with the router it pins and stays green; the Quarry primitive pins stay green untouched. NEW: lifecycle_module_has_no_http_types (production source across service/lifecycle.rs + every lifecycle/*.rs submodule never names a handler/transport type or a pool handle — and walks the subtree, closing the general grep’s non-recursive blind spot for dsar/sweep.rs too), sql_superset_plus_rust_arbiter_move_together, the lifecycle purge pins (purge_targets_by_owner_resolves_inside_the_tx, purge_targets_preflight_refuses_held_id_with_reasons, lifecycle_purge_audits_inside_the_tx, lifecycle_purge_evidence_and_trace_invalidation_ride_the_same_tx, purge_targets_reasserts_the_max_ids_fence), the fetch pins (load_knowledge_row_projects_every_rendered_column, fetch_projections_are_domain_scoped, chunks_in_domain_reasserts_the_bounds_fence), and decayed_page_reasserts_the_bounds_fence. Pin-count delta: main-binary tests 1003 → 1010 (+7; the 3 moved decay pins + 8 new − 4 net of the seam-site additions riding an existing test — total never decreases).
• Wire artifacts diff-empty: openapi.yaml, the route-coverage array, and the route-authz table are untouched (no route changes; the x-api- version stamp moves only when the wire contract moves, and it did not). Schema untouched at 1.28.45. Error bodies byte-preserved: the typed errors map onto the frozen vocabulary — no matching chunks to purge (404), the shared legal_hold_active envelope with reasons (409), too_many_ids/no_target/ambiguous_target (400), and internal-error bodies carrying the rusqlite text verbatim (commit failed: prefix included).
• Bounds inventory (hardening law #4): MAX_DECAYED clamp + offset floor (route + core, decayed_page_reasserts_the_bounds_fence), MAX_MULTI_GET (route 400 + core fence, chunks_in_domain_reasserts_the_bounds_fence), MAX_PURGE_IDS (route 400 + core fence, purge_targets_reasserts_the_max_ids_fence; the constant moved to config.rs so the service can share it without naming a handler module), and LIMIT 1-shaped single-row loads (load_knowledge_row, chunk_in_domain).
• FK-children map + certified silence: the lifecycle family adds NO delete path — decay/fetch are read-only; the only deletion remains the Quarry primitive’s knowledge hard-delete whose FK-children map (incl. the case_articles/kcs_translations NO ACTION ceilings) is the service/purge.rs module header; the residue rows-affected checks (`if n

  0→ tombstone + count) are unchanged and still pinned there. Both facts are documented in thelifecycle.rs` header.

• Gates: fmt clean; clippy --all-targets --features bench -D warnings zero warnings; full suite --features bench green (1290 passed, 6 ignored; main-binary 1008 vs 1003, +5). CI dry-run: lint-test (default features) clippy+tests, engine-crates tests+clippy, steward-harness, otel-gate clippy+tests — all green; lipstyk diff-strict clean (one verbose-match in the moved decayed handler collapsed, Quarry-fix style); client fmt clean (client/ untouched).
• Live smoke on a DB COPY (two servers, same seeded copy, v1.28.46 vs v1.28.48, opaque + JWT modes): /decayed?limit=500 byte-identical; /decayed pagination (limit=1&offset=0/1) byte-identical; a legal hold hides the held id from /decayed on both; /purge of the held id → 409 legal_hold_active with the reasons byte-identical on both; after release the purge succeeds ({"purged":1}) with tombstone + audit row on both; by-owner purge ({"owner":…}) → {"purged":N} byte-identical on both; /get/{id} + /multi-get byte-identical for loopback (raw PII by loopback-trust design) AND for a non-admin JWT reader (both binaries redact to [redacted:email][redacted:phone] — the PII-flag redaction difference, byte-identical old vs new); /audit/verify {"ok":true} on both at every step. The hold-placement/release dance surfaced a pre-existing 1.28.46 behavior (dual-gate release + the route’s all-or-nothing unknown-id refusal), not a regression; final-state tombstones and the audit chain verified identical.
• Ceilings (honest): the moved rows stay legacy serde_json::Value shapes (byte-for-byte wire pins outrank the domain-type aspiration — same ceiling as the retention exemplar); DecayedQuery/PurgeRequest stay handler-side HTTP types (they ARE the transport contract); gate.rs still carries the proposal family + export surface (a later milestone; the “seam-library remainder” end-state for gate.rs is NOT reached this milestone — Masonry removes the lifecycle families only); the smoke’s 409-provenance divergence (multi-hold accumulation from repeated hold calls against one DB copy) was smoke-harness state, not wire behavior — re-verified byte-identical per-server.

Predecessor: [1.28.47] — “Quarry”: the rights surface, one core.

[1.28.47] — 2026-08-28 — “Quarry”: the rights surface, one core

The Foundation Line’s second vein, and the biggest single-surface retirement of the line: the entire DSAR (GDPR Art 15/17) storage story — locate, export bundle, purge, certificate, and ledger composition — moved out of the observe handler into src/service/dsar.rs. The highest-stakes erasure path now lives behind the same law as the retention exemplar: services own the SQL, handlers are protocol adapters, and a source pin keeps it that way.

Release notes

Bug fixes

• A DSAR purge no longer aborts when the subject’s governed runs carry a delegation or a channel thread. delegations.run_id (Mesh) and channel_threads.case_run_id (Switchboard) are declared NOT NULL foreign keys on workflow_runs with no cascade — but the erasure sweep never cleared either family, so a subject whose runs carried one violated the FK and failed the whole DSAR (loud and fail-closed, but the erasure was unreachable for exactly those subjects; both schema comments already claimed “rows die with their DSAR sweep”). The Quarry move’s FK-children map exposed the gap; both families now die with the run, before the parent row. The failure-path delta is pinned by dsar_sweep_takes_the_run_fk_children_delegations_and_channel_threads.

Improvements

• The rights surface converges onto the service layer: src/service/dsar.rs owns locate, the portable export bundle (Art 15 symmetry with the purge, channel_notes[] included), one pool’s full erasure (run_pool: remanence pragma posture → purge tx with held-id deferral → trace/proposal residue sweeps → workflow sweep → ledger row committed atomically with the purge → best-effort WAL TRUNCATE), the certificate shape, the certificate backfill, the ledger page, the tombstone registry page, the tenant-gated certificate re-fetch, and the stale-ledger prune. src/service/dsar/sweep.rs is the single home for “what erasure reaches” in the governed-workflow tables (folded in from workflow/erasure.rs). src/service/purge.rs takes the shared knowledge-purge primitive (the legal-hold backstop inside the FUNCTION, the tombstone digest, the orphan-entity sweep) out of the gate handler so the DSAR core, /purge, client termination, and ump hard-forget all call the same storage law. The observe handler keeps exactly the adapter work: parse, Admin/role gates, multi-pool ordering (non-global first, global last with the aggregate digest), the Art 19 webhook, and response shaping.
• Observe.rs carries zero embedded SQL — 66 → 0, the first handler file in the line to drain completely. gate.rs 103 → 83 (−20 incl. the moved primitive + its pin). The frozen debt floor drops 445 → 359 in the same commit that moved the SQL.
• The legal-hold read helper returns storage errors (crate::legal_hold::active_reasons → rusqlite::Error), so service cores consume it without a handler type in the way; every handler call site maps it with the identical internal-error body as before.

Security fixes

• The knowledge-purge backstop fence is now structural: moving the primitive into the service layer pins the fence to the FUNCTION (a future caller cannot repeat the ump.forget miss), and a new test (purge_chunk_ids_backstop_refuses_held_id) proves a held id is never purged even when the caller forgets its own preflight — the error carries the hold reasons for the shared 409 legal_hold_active envelope.

Engineering record

• Plan-named pins, all green: every observe.rs pin repointed in the same commit — dsar_dry_run_footprint_counts_and_writes_nothing (the preview writes nothing), cross_domain_dsar_purges_all_pools_and_ledgers_once (multi-pool ordering: non-global first, global last, exactly one ledger row carrying the aggregate digest), the held-id deferral legs (legal_hold_freezes_run_from_dsar_sweep, dsar_sweep_and_legal_hold_revoke_refs, the wire-level legal_hold_freezes_erasure_and_dsar_defers), dsar_export_bundle_builder_matches_live_shape (Art 15 export/purge symmetry incl. channel_notes[]), dsar_purge_erases_proposals_and_orphaned_entities, the tombstone-registry pins (dsar_ledger_stores_hash_not_raw_bundle, purge_deletes_only_old_completed_rows, purge_zero_retention_is_a_noop, ledger_row_is_committed_atomically_with_purge_tx_commit, test_tombstone_backfill_makes_legacy_rows_visible), the Art 19 fail-soft webhook pin (test_observe_art19_webhook_posts_on_purge), and the remanence posture pin (dsar_certificate_states_remanence_posture, in place in clients.rs — the pragma-ATTEMPT rule moved certificate-owned into run_pool and the pin stayed green untouched). All six workflow-sweep pins moved verbatim with their submodule; the full sweep of locate/ledger wire pins (test_observe_dsar_locate_and_purge_semantics, test_ingest_owner_flows_to_dsar_locate, test_dsar_deadline_is_created_at_plus_window, test_dsar_ledger_list_returns_rows_with_deadline_fields) repointed to the core. NEW source assertion: dsar_core_is_handler_free — production source across service/dsar.rs, service/dsar/sweep.rs, and service/purge.rs never names crate::handlers, a handler type, a transport type, or a pool handle. Pin-count delta: main-binary tests 1000 → 1003 (+3 net: the source assertion, the purge backstop pin, and the FK-gap pin; the tombstone-digest pin moved with the primitive, total count never decreases — the move-with-pins law). Full suite: 1279 passed, 7 ignored (1276 → 1279, +3).
• The move was verbatim where the law demands it: statement SQL, sweep order, dry-run arithmetic, and the certificate JSON shape are the handler’s bytes, re-homed. The mechanical adaptations: typed service errors (DsarError/PurgeError with From<rusqlite::Error> preserving messages verbatim; the handler From impls render the exact frozen bodies — internal-error text unchanged, the certificate route’s 404 unchanged, the shared 409 legal_hold_active envelope unchanged), ?-propagation via those From impls replacing per-site map_err noise, the bundle/ledger digest now computed by crate::audit::hash (byte-identical lowercase-hex SHA-256 to the gate-local helper it replaces in the moved code; the known vector pins on both sides prove it), and run_dsar_pool becoming the thin per-pool seam (borrow a connection, call the core — the pool handle never crosses). The two intended deltas are BOTH on failure paths: the FK-gap fix above and nothing else.
• The FK-children map was written BEFORE the move (the erasure lesson, now structural law): knowledge‘s map lives in the purge module header (embeddings CASCADE; relationships SET NULL + explicit; evidence_links/proposals/recall_traces soft refs, explicit; tombstones a soft ref BY DESIGN), workflow_runs’ map in the sweep header (steps/findings/contradictions/outbox/handover_offers/case_notes deleted first; case_status_refs purged or revoked; crm_cases UNLINKED; delegations + channel_threads the closed gap).
• Wire artifacts byte-identical: openapi.yaml diff-empty against origin/main; route-coverage and route-authz tables untouched; schema untouched at 1.28.45 — zero migrations, rollback = git revert of the milestone’s commits, the database unaffected by construction.
• Full gate green: cargo fmt --check; cargo clippy --all-targets --features bench -- -D warnings; cargo test --features bench (1279 passed, 7 ignored); the pre-push dry-run CI suite (default-feature clippy
  • tests, engine-crates, steward-harness, otel gates); lipstyk diff-strict clean; live smoke on a COPY of the production DB (below).
• Live smoke (DB copy, shim mode): seeded an owned root + a derived descendant + an active legal hold on the derived chunk; dry-run preview reported roots 1 / derived 1 / export rows 2 and wrote nothing; the live POST /dsar (action both, jurisdiction eu, mechanism scc-eu-2021) purged the free root only, LISTED the held chunk + reason under held_ids, wrote the ledger row with the bundle digest, and returned the EU rights + deadline; GET /dsar/{id}/certificate → chain_verifies: true; GET /audit/verify → ok: true; the tombstone registry lists the purged root under owner:<subject>.

Honest ceilings

• case_articles.knowledge_id and kcs_translations.knowledge_id are declared FKs with NO ACTION and are NOT cleared by the purge — purging a chunk that carries a case article or a knowledge translation violates the FK and fails the whole tx (pre-existing, loud, fail-closed; unifying those sweeps is a follow-up, deliberately not silently widened here).
• Delegations and channel threads die WITH the run (FK necessity); they are not subject-matched. A delegation or thread referencing the subject on a SURVIVING run (another subject’s run) is not swept by the subject arms — the consent-registry re-hash posture would apply if the product ever wants it; filed as a follow-up, not improvised in a refactor line.
• run_pool owns its per-pool transaction (begin/commit inside the core) so the pragma posture, the purge, the ledger row, and the checkpoint stay one story; multi-pool sequencing stays handler-side. This is the documented shape for per-pool atomic erasure — not a general license for service-side tx ownership, which remains the caller’s for multi-step handler flows (the retention exemplar’s law stands).
• The outbox self-reference caveat: outbox.parent_id is a declared self-FK; a single-statement delete is safe (immediate FKs check at statement end), but a CROSS-run parent link (child on run B pointing at a parent on run A) would fail run A’s sweep loudly — no such link is written today (the lineage writer is run-local).
• Wire shapes stay legacy: ledger rows / tombstone page / certificate view keep their shipped shapes (derived structs + serde_json maps) — the byte-for-byte pins outrank the domain-type aspiration; typing them is a follow-up.
• The baseline counts comments and test seeds (substring lock, not a precision instrument); observe.rs’s zero includes its emptied test module — the pins moved with the code they pin.

[1.28.46] — 2026-08-28 — “Plumb”: the service layer, the debt lock, the first vein

The Foundation Line begins. This release ships ZERO features, ZERO endpoints, ZERO schema changes, ZERO wire changes — by design. Its product is structure: the measuring stick that makes the handler-embedded SQL debt visible and non-regressable, the service-layer contract the whole line converges onto, and the smallest audited surface moved end-to-end to prove both cheaply. From here on, handler SQL can only shrink.

Release notes

Bug fixes

• A POST /retention policy set is now atomic and its evidence audit rides the same transaction. Pre-move, each override upsert autocommitted on its own (a mid-loop failure could persist a PARTIAL policy) and the audit row was written on a second pooled connection AFTER the write had already committed — a crash between them left the override permanently unevidenced. Both writes now live inside ONE transaction: a failure rolls the whole set AND its evidence back together; a success commits them together.

Improvements

• The debt lock: a CI guard (sql_inventory_baseline_freezes_the_debt) freezes the per-file SQL-statement inventory of src/handlers/*.rs — 445 embedded statements across 29 files at freeze time. Any file growing past its frozen count (or SQL appearing in an unlisted file) fails CI; progress below baseline prints the delta as the line’s scoreboard. Slots only shrink.
• The service layer: src/service/ opens as the convergence target with the layer contract as code + docs — services take connections (never pools, server state, or HTTP types), own their aggregate’s complete storage story (SQL, bounds, FK-children map, audit-per-write inside the caller’s transaction), return typed errors that handlers map onto frozen HTTP vocabularies. Enforced by greps pinned as tests, from day one.
• The first extraction: the retention family (policy get/set + the retention-schedule report) moved from the govern handler to src/service/retention.rs. The handler keeps the Admin gate, parsing, and spawn_blocking; the core owns the override upsert, the report queries, and the evidence audit inside ONE transaction. govern.rs: 18 → 6 embedded statements (−12 incl. the tests that moved with the code).

Security fixes

• Audit evidence can no longer be lost between a retention override and its audit row. The evidence write is SAVEPOINT-nested inside the mutation’s transaction (pinned by retention_override_audits_inside_the_tx and its rollback twin), closing the unevidenced-write window on the retention surface.

Engineering record

• Plan-named pins, all green: sql_inventory_baseline_freezes_the_debt (the lock), sql_baseline_total_stays_at_the_frozen_floor (the table itself cannot silently loosen), service_layer_is_transport_free (the layer-violation greps: no transport identifiers under src/service/), retention_override_audits_inside_the_tx + retention_override_rolls_back_with_its_audit (the audit-per-write law, both legs), retention_report_rows_match_legacy_byte_for_byte (fixture captured from the PRE-move handler and asserted green BEFORE the move, then repointed — the run proves the move changed the address, not one byte), retention_set_refuses_out_of_bound_entries (the storage-boundary fence), and retention_report_matches_policy (moved verbatim with its function). Pin-count delta: main-binary tests 993 → 1000 (+7; total count never decreases — the move-with-pins law).
• The baseline was re-measured at execution, as the plan ordered: the roadmap’s scoping estimate (379) was taken with a line-based grep; the frozen counter is case-insensitive, non-overlapping substring occurrences of the four statement openers (SELECT , INSERT , UPDATE , DELETE FROM) per file — 445 across 29 files (gate 103 / observe 66 / domains 64 / clients 44 / workflow 23 / ingest 22 / govern 18 / …). Substring semantics are deliberate: false positives only tighten the lock. The guard refuses stale rows (a deleted handler file must lower the table in the same commit) and fails closed on unlisted files (implicit baseline zero).
• The exemplar move kept the wire frozen: RetentionError::Database carries the rusqlite message verbatim, mapped by the handler to the byte-identical internal-error body; the retention report stays the legacy JSON maps (keys alphabetically ordered, as shipped); the response shapes of GET/POST /retention and GET /retention/report are unchanged. The storage-boundary fence (days ∈ [1, 36500], non-empty kind) mirrors the handler’s exact 400s for future direct callers — unreachable over the wire.
• Wire artifacts byte-identical: openapi.yaml, route-coverage, and route-authz tables untouched (no route changes); schema untouched at 1.28.45 — zero migrations, rollback = git revert of the milestone’s commits, the database unaffected by construction.
• Full gate green: cargo fmt --check; cargo clippy --all-targets --features bench -- -D warnings; cargo test --features bench (1276 passed, 7 ignored); the pre-push dry-run CI suite (default-feature, engine-crates, steward-harness, otel gates); lipstyk diff-strict; live old-vs-new smoke on identical DB copies (below).

Honest ceilings

• The lock stops regrowth but does not force pace — progress between milestones may be zero without failing CI; the enforcing flip (any SQL under src/handlers/ fails) is the line’s LAST milestone, not this one.
• Report rows stay legacy JSON maps (serde_json::Value), not domain structs — the byte-for-byte wire pin outranks the domain-type aspiration; typing them is a follow-up, deliberately NOT part of this move.
• The baseline counts comments and test seeds — it is a substring-regex debt lock, not a precision instrument; the frozen numbers are the law the counter encodes, and only a monotone-downward drift is allowed.
• Kind charset validation stays at the handler (it is handler-typed); the core fence re-asserts bounds + emptiness only. A future non-HTTP caller of set_overrides gets bounds enforcement, not full charset validation.
• The guard watches src/handlers/*.rs only — service cores are the destination the debt drains toward, not a new volume to police.

[1.28.45] — 2026-08-27 — “Herald”: Slack and Microsoft Teams (the operator channels)

The channels enterprises already live in become the console’s ANNEXES: case rooms, Relay handovers, and digest-bound approvals where the people already are. Two adapters, one release — they serve the same buyer moment. The kernel keeps every law it has: the console annex authenticates over the SAME Standard-Webhooks HMAC seam, resolves every actor through a proposal-maintained user map (platform identity is NEVER auto-trusted), and approves through the byte-identical approve verb, so Gateweld’s digest binding now holds TWICE on a channel click — bridge-side against the rendered digest, server-side inside the approve verb.

Release notes

Improvements

• The Slack edge (Socket Mode): tools/channel-bridge gains a slack kind that binds NO listener — the bridge DIALS Slack over the Socket-Mode WebSocket (apps.connections.open → wss, capped-backoff reconnects). message events in mapped channels become screened case notes via the ordinary inbound seam (thread map or [case N]); the sender’s OPAQUE user id rides as actor_ref. Pinned by socket_mode_never_opens_an_inbound_listener (source-text grep + a pure kind→listener predicate).
• Approve-by-button: pending renderable proposals (draft / kcs_* / channel/template / channel/user_map) render as Slack Blocks with the content preview AND the digest shown in the block; Approve/Reject button payloads MUST carry that digest — a missing or mismatched digest is refused bridge-side, logged, and never relayed (slack_button_approval_carries_digest_and_binds). Adaptive Cards do the same on Teams (adaptive_card_submit_returns_digest), Action.Submit returning the digest field.
• The bridge-relayed operator console: ONE new additive route, POST /webhooks/channel/{kind}/console (HMAC self-authenticating like receive/drain). Closed action vocabulary — pending, decide, due, crank. The kernel maps actor_ref through the user map, role-checks against the role store, and then calls the EXISTING console verbs, so a channel approval is CAS-safe, audited, and replay-refused exactly like a browser approval.
• The Slack user map: POST /workflow/channel/user-map FILES a channel/user_map proposal (crew_skills_update-style); approval is the ONLY writer of the new channel_user_map table — no auto-trust path exists (slack_user_map_changes_flow_through_proposals). Platform ids are stored opaque (never display names); roles resolve against the role store at file AND apply time; every change carries its audit row (proposer on the proposal, approver on the apply).
• Relay handover pings: a fresh handover offer enqueues ONE channel/ping outbox row carrying the I-PASS completeness state (refs only). The bridge drain resolves the receiving operator’s mapped platform refs + the case room and pings them in-channel — the machine coaches before the human accepts (relay_handover_pings_receiving_operator_with_completeness_check). Unmapped principals audit loud and consume; the drain never wedges.
• Case rooms manifest natively: the thread map IS the room mapping — Slack channels / Teams conversations thread to their cases through the existing channel_threads map, and drained approved acts deliver back into the room (mapped_channel_messages_become_notes_with_threading).
• Crew presence from channel activity: a mapped operator’s channel messages touch presence with the new closed activity kind channel — activity KINDS only, never content, and only while the domain’s Crew DPO switch is on (writes stop when off; the roster was already hidden).
• Teams via the supported route: Bot Framework activities verified against the Bot Framework JWKS BEFORE any parse, Adaptive Cards for actions, Graph-based channel enumeration for room mapping as a read-only operator-run CLI flag (--list-channels). The deprecated O365-connector path is explicitly NOT implemented (teams_uses_bot_framework_not_deprecated_connectors, doc-grep).

Bug fixes: None.

Security fixes

• Two independent digest-enforcement points on channel approvals (bridge render-cache vs stored-content fingerprint at the approve verb).
• Channel-relayed acts REQUIRE an explicit role grant: an empty role list on a map row grants nothing (the JWT-era vacuous-role back-compat does not extend to platform identities).
• The Teams edge verifies Bot Framework JWTs (issuer + audience pinned, JWKS cached, refetched on unknown kid) before parsing a single byte.
• Bridge least privilege documented at the workspace-app level: channel tokens grant nothing beyond their mapped channels; secrets stay 0600 files; the bridge holds no brain token, ever (self-grep extended).

Behavior-change ledger

Engineering record

• Plan-named pins (+7): socket_mode_never_opens_an_inbound_listener, slack_button_approval_carries_digest_and_binds, slack_user_map_changes_flow_through_proposals, adaptive_card_submit_returns_digest, teams_uses_bot_framework_not_deprecated_connectors (doc-grep), mapped_channel_messages_become_notes_with_threading (bridge + kernel halves), relay_handover_pings_receiving_operator_with_completeness_check — plus kernel-side: console_pending_carries_digest_and_renderable_kinds_only, envelope_actor_ref_is_bounded_and_optional, and the end-to-end console_seam_digest_law_and_actor_role_checks (signed decide relay through the REAL approve machinery: digest-less 400, forged-digest 409, unmapped 403, approve-once CAS, replay 404).
• Server-diff verification (the wiring checklist): the plan expected zero server diff with POST /proposals/{id}/approve?digest= reused directly. VERIFIED NECESSARY TO EXTEND: the bridge holds no brain token (pinned house-wide), and with auth configured the bearer middleware 401s every unauthenticated call to the approve route — a channel click could never reach it. The seam therefore lands as the additive console route above (its own ledger row), which REUSES the approve/reject handler machinery unchanged — the digest-binding path is the same code, not a fork. Zero changes to bearer routes; openapi coverage + guard tables updated in the same commit.
• Schema 1.28.44 → 1.28.45 (additive: channel_user_map); contract-test table list + pragma probe extended in the same commit as the wiring.
• The crank console action runs the same steward-harness binary the CLI drives (resolution: BRAIN_STEWARD_BIN → beside the kernel → PATH), bounded to ≤10 steps and one 60s timeout window, stdout reduced to refs-only.

Honest ceilings

• Approvals relayed over the console seam reuse the generic approve machinery, so a replayed decide returns the console’s 404 “no pending proposal” rather than Caravel’s {moved:false} receipt (which remains specific to channel/template dispatch). The bridge surfaces this as “already decided”.
• Generic /brain approve <id> slash commands can only act on proposals the bridge has RENDERED in this session (the digest comes from the render cache); anything else is refused with guidance to use the proposal card.
• /brain due lists the valet due queue (bounded 25); it does not fire envelopes — the crank remains the explicit act.
• Teams drain delivery uses the standard regional BF host rather than a per-activity serviceUrl (the drain path has no inbound activity to echo); per-activity echo remains the inbound path’s rule.
• Presence from channel activity is an UPSERT bump (channel kind); it carries no case ref, no message content, and no customer refs — by construction, not discipline.
• The Slack user map is tenant-scoped per bridge config; one platform user may map to exactly one principal per bridge (rotation = re-approve add).
• No channel-side accept/decline of handovers: the ping coaches, the decision happens on the console where the full I-PASS packet renders.

[1.28.44] — 2026-08-27 — “Caravel”: WhatsApp for Business, the governed edge

A channel is a GOVERNED EDGE, never a server feature — and WhatsApp is the customer-facing channel with the strongest native governance. Caravel does NOT invent discipline: Meta already enforces it (hub signatures, the 24-hour customer-service window, registered templates, per-number quality tiers), so the adapter mostly MAPS platform law onto kernel law. The edge process owns the public webhook surface (the hub.challenge handshake is answered THERE, never by the kernel); brain-server only ever sees verified envelopes over the same Standard-Webhooks seam Switchboard shipped.

Release notes

Improvements

• The WhatsApp edge (tools/channel-bridge, additive Rust binary, config-off by default — absent config = channel dark): answers the Meta subscription handshake itself; verifies every POST against X-Hub-Signature-256 (raw-body HMAC-SHA256 with the app secret, LENGTH-CHECKED then constant-time compared) BEFORE any parse; projects verified payloads into normalized envelopes; registers mount evidence at boot (channel:whatsapp, config-digest recomputed server-side); drains channel/out on an internal tick crank and delivers to the Cloud API — approved channel/template acts as TEMPLATES, windowed replies as text.
• The 24-hour window binds the kernel gate exactly: free-form approved acts ride the customer’s clock inside the window; OUTSIDE it, only approved channel/template acts WITH standing consent pass — free-form is refused (outside_reply_window_freeform_blocked) even when approved AND consented.
• Template sends are PROPOSALS: new proposal kind channel/template (proposal-only via /ingest/proposal; never promoted to knowledge). Its content is the JSON packet {tenant, conversation_ref, template, body}; approving CASes it approved and dispatches the governed send in ONE tx. Double-approved by construction: Meta’s registry AND ours — ours stricter because it carries the content digest of the drained bytes. Business- initiated contact needs ALL THREE gates every time: template + consent + approved proposal; cold conversations open their own governed care case on dispatch (with the reply window CLOSED until the customer answers). Replay-safe: a decided id returns {moved:false}, never a second send.
• Statuses become lineage events: sent/delivered/read/failed receipts land as ONE case/channel_status outbox event on the thread’s case — hashes and refs on the audit chain, bodies never. Exactly-once by lineage key.
• Quality tiers throttle deterministically: a backoff table maps tier → minimum send interval (green 0s / yellow 30s / orange 300s / red-and- unobserved 3600s). A FRESH state file is the MOST RESTRICTIVE tier until a status webhook upgrades it (fail-closed throttle); downgrades alert the operator via the bus METADATA-ONLY (number alias + old/new tiers — never content, never customer refs).
• Media digests-and-quarantine: attachment SHA-256s (≤8 per envelope) are recorded verbatim ON the landed case note; the BYTES stay quarantined edge-side under the retention dir named by digest — never auto-opened, never proxied through brain-server to a browser (fetching media is an operator-run edge act).

Bug fixes: None.

Security fixes

• Signature hardening per plan: length-checked BEFORE compare plus constant- time fold comparison kills both timing and short-circuit classes; empty/ malformed headers refuse without reaching any MAC work path.
• Edge config/secret/state files all enforce owner-only (0600) fail-closed: wide permissions or upward-traversing secret paths refuse at load.
• Self-grep pin extended: bridge_holds_no_brain_credentials now scans BOTH bridge crates (signal-gateway AND channel-bridge).

Behavior-change ledger

Engineering record

• Plan-named pins (+6 bins / mirrored at the edge): twenty_four_hour_window_blocks_freeform_and_allows_approved_template, template_send_requires_our_proposal_not_just_metas, business_initiated_needs_template_and_consent_and_proposal, delivery_status_becomes_lineage_event, tier_downgrade_throttles_and_alerts, media_digests_recorded_content_quarantined — kernel pins live in the channels test module (the fence holds OF THE FUNCTION: enqueue_out re-reads status+kind from the database inside the tx; nothing caller-declared is trusted), and the edge crate carries hub_signature_verified_constant_time plus its own mirror of the tier table with the downgrade-tightening invariant.
• Schema UNCHANGED at 1.28.44 (additive code only); no routes added — the {kind} wildcard already covers whatsapp data, verified against the openapi coverage tables. Wire doc updates (envelope projections, drained source_payload fields, kind enum) shipped in the same commit across openapi.yaml, docs/api.md, docs/deployment.md.
• Full gate: fmt clean; clippy -D warnings clean on bench/default/otel targets, engine crates, steward-harness AND the new channel-bridge crate; 980 bin (+6) / 207 lib tests green; lipstyk diff-strict clean; CI dry-run matrix green locally.

Honest ceilings

• The public HTTPS listener still terminates TLS at the OPERATOR’s reverse proxy; the edge itself binds loopback only. Certificate management remains a deployment concern, deliberately.
• Quality-tier OBSERVATION accepts the documented account-update envelope shapes ({number_alias|display_phone_number_id}, old/new tiers lowercased); exact Meta taxonomy must be re-verified against the pinned graph_api_version at deploy — invented tiers drop silently rather than lie upstream.
• Template sends are parameterless (named template verbatim); parameterized components ship later. The kernel enqueues WHAT was approved; operators keep parameterless bodies.
• Throttled rows defer tick-to-tick AFTER the kernel has marked the claim batch delivered (at-least-once contract carried over from Switchboard): a crash between defer and next poll surfaces loud logs, not guaranteed redelivery.
• Kernel enqueue_out does not itself pace by tier (pacing lives on the edge where sends actually happen); a mis-deployed edge that skips its state file degrades to loud logging, not silent policy bypass — the three-gate law never depends on tier state.

[1.28.43] — 2026-08-27 — “Switchboard”: the channel bridge framework, Signal first-class

A channel is a GOVERNED EDGE, never a server feature. Switchboard generalizes Valet’s relay into the server seams every future channel shares: inbound bytes are untrusted (sanitize + injection screen BEFORE threading/state), outbound is exactly approved acts or consented alert forwards, thread rows are tenant- scoped by construction, and the audit chain carries hashes never bodies. tools/signal-gateway (Rust, presage-native, libsignal v0.99.0 line, edition 2024, #![forbid(unsafe_code)]) ships as the first-class Signal edge; the degenerate tools/valet-relay stays working unchanged — migration is a config file, not code.

Release notes

Improvements

• Inbound seam: POST /webhooks/channel/{kind} verifies per-bridge Standard-Webhooks HMACs against channel-{kind}-{tenant}.json configs (0600 fail-closed), replay-caps on (bridge, external_id), flood-bounds, then in ONE transaction: channel::screen_content sanitize + blocklist + invisible-strip BEFORE any state → thread resolution via channel_threads → unknown conversations AUTO-OPEN a care/case run under the bridge’s domain → [case N] addressing overrides the map with cross-domain refusals → screened case note + audit rows commit atomically.
• Outbound seam: topic channel/out carries content PRECISELY BECAUSE it is gated — enqueue_out type-enforces Approved (digest-bound proposal, re-verified in-tx) or Alert sources; outside the deterministic reply window (reply_window_allows, inclusive-bound, poison-input fail-closed) requires standing consent from the SHARED consent_registry under purpose switchboard_channel. The SSE/alert drainers exclude the topic by family; delivery is pull-model via POST /webhooks/channel/{kind}/drain, batch marked delivered atomically, senders dedupe on event_id.
• Registration: POST /workflow/plugins/mount gains a tokenless bridge authentication — same Standard-Webhooks signature, and the mount digest is RECOMPUTED SERVER-SIDE from its own copy of the config file (both sides can hash the bytes; neither self-certifies). Bearer path unchanged.
• Consent granularity + windows: the Outreach registry is exercised per-channel (fail-closed read helper); the generic reply-window gate lands channel-blind so WhatsApp’s 24-hour rule binds to it unchanged in Caravel.
• The edge: tools/signal-gateway upgraded to presage main + libsignal v0.99 line internals, edition 2024, latest tokio/axum/reqwest/base64/hmac/ sha2 majors, all OpenClaw-facing surface removed (pure Switchboard edge: link/serve, send/receive/reactions/typing, RPC + SSE). Mount evidence at boot, inbound forwarder, drain crank wired behind an optional brain: config block — absent config = channel dark.

Bug fixes: None.

Security fixes

• Bridge configs are rejected unless owner-only (0600); invalid-domain configs refuse loudly at load instead of silently going dark.
• [case N] cross-domain addressing refuses loudly and audits Denied.

Behavior-change ledger

Engineering record

• Plan-named pins (+10): inbound_envelope_sanitize_and_screens_before_threading, unknown_conversation_opens_case_under_bridge_domain, case_addressing_overrides_thread_map, outbound_requires_approved_act_or_alert_envelope, bridge_registration_records_config_hash_digest, reply_window_gate_is_deterministic, bridge_holds_no_brain_credentials (self-grep over tools/) · plus envelope_parse_is_total_and_bounded, bridge_configs_are_discovered_deterministically_and_fail_closed, thread_rows_are_tenant_scoped_by_predicate.
• Schema 1.28.42 → 1.28.43 (additive: channel_threads); contract-test table list + pragma column probe extended in the same commit as the route wiring (openapi.yaml, docs/api.md, route-coverage, guard tables).
• Full gate: fmt clean; clippy -D warnings --all-targets --features bench clean; 974 bin + 207 client-wasm-adjacent? (final tally preserved by CI) tests green locally across all targets.

Honest ceilings

• libsignal stays on the v0.99.0 pin: whisperfish’s own manifests still tag-pin v0.99.0, and cargo cannot patch newer tags of the SAME git URL onto those deps (same-source rule). Tracking presage branch=main inherits the upstream bump automatically when it happens.
• The signal edge forwards DIRECT conversations only — group threading waits for Caravel/Herald where mapping law per platform is defined.
• Outbound alert-forwards are GATED but no producer enqueues them yet; the only current writers are approved acts through tests/CLI. Wiring alert kinds to channels is deliberately left to operator cron recipes for now.
• Drain is at-least-once with server-side atomic marking; crash between send failure and next poll surfaces LOUD logs but no automatic redelivery of a marked row.
• No read receipts / group listing in the gateway (signal stubs); no attachment upload/download yet.

[1.28.42] — 2026-08-26 — “Valet”: the personal AI assistant, dogfooded

The author becomes the first user: brain-server + openclaw as a Signal- messaged, cron-scheduled, reminder-firing, draft-proposing personal assistant — on the governed kernel, so it is the only assistant in that wave whose memory you can audit, approve, and erase. The crank law survives: no daemon, no scheduler, no Signal client inside brain-server. Cron is the scheduler, tools/valet-relay is the Bridges edge, brain valet due is a request-scoped idempotent crank. Schema ADDITIVE at 1.28.42 (valet_consents table + proposals.lint_json); routes additive: /workflow/valet/{due,brief,consent} + inbound kind signal on /webhooks/{kind}.

Release notes

Improvements

• M1 — scheduler-as-cases: reminders are ordinary governed runs (valet/reminder / valet/digest) whose state carries {what, due_at, repeat, channel} and whose deadline rides the existing sla_deadline convention. brain valet due fires due envelopes (idempotency key valet-{run}-{due_at} — a double cron never double-fires), repeat re-arms a NEW envelope via CAS, and overdue ranks reminders before digests then earliest-deadline-first. scripts/import-content-plan.ts creates one run per planned post from the marketing CSV.
• M2 — the Signal bridge as a governed edge: tools/valet-relay (zero-dep Node) holds ONLY its own 0600 secrets, listens as the server’s alert sink, and forwards exactly valet/due envelopes as Signal messages (metadata-only by construction). Inbound Signal → POST /webhooks/signal (Standard-Webhooks HMAC, replay-capped, flood-bounded): [case N] text becomes screened steering; [draft N] approve <digest> performs the digest-bound approval — Gateweld crosses into Signal. Every inbound byte is injection-screened BEFORE any state change. The relay holds no brain credentials (self-grep pinned).
• M3 — the content pipeline: drafts are kind='draft' proposals whose advisory lint report (valet::style_check, pure, zero-token: em-dash ban, banned phrases from the style memory, filler openers, sentence length, passive heuristic, status-label presence) rides the row; the human outranks the linter — style-memory changes themselves flow through the proposal gate (the style guide is an approved knowledge row, hashed for provenance). brain valet brief composes due/overdue, pending drafts with lint scores, and the trailing-window evening-capture notes (the Engine Diary raw material).
• M4 — personal hygiene: everything lives behind the same token ladder, screens, erasure and provenance law as any tenant. Outreach-lite is a deliberate dogfood-scoped pull-forward of v1.28.35: a one-subject (owner) one-channel (signal) hashed-subject consent registry — no consent, no send (envelopes fire locally but are suppressed, audited and counted). The full v1.28.35 release still ships later.

Behavior-change ledger

Engineering record

• New gate tests (+17): due_fires_once_per_envelope_idempotently, repeat_rearms_new_envelope, overdue_ranks_by_priority_then_deadline, cron_double_invocation_is_safe, no_consent_suppresses_delivery, consent_registry_gates_signal_and_is_single_subject, stamp_state_enforces_bounds (M1) · inbound_signal_becomes_screened_steering, draft_approve_by_message_binds_digest, signal_message_parser_is_total_and_strict, relay_holds_no_brain_credentials, valet_due_envelopes_publish_as_valet_kind (M2) · style_check_flags_em_dash_and_banned_phrases, lint_report_rides_the_draft_proposal, style_memory_changes_flow_through_the_proposal_gate, brief_includes_due_overdue_pending_with_lint_scores, brief_reports_signal_consent_state (M3/M4).
• Schema 1.28.36 → 1.28.42 (additive: valet_consents, proposals.lint_json); migration guarded by pragma column checks.
• post_steering’s inbox write extracted as enqueue_steering_tx (shared by the route and the Signal webhook — no behavior change).

Honest ceilings

• The relay is operator-run and single-user by design (your number in, your commands out); no multi-tenant Signal, no outbound messaging engine — valet/due envelope forwards are the ONLY thing it sends.
• The alert envelope carries the reminder label that was screened at WRITE time; nothing unscreened ever enters the outbox, but the label itself is visible to the relay operator (it is your own reminder text).
• [draft N] edit ... over Signal is NOT wired (approve-only); edit remains a console/CLI act.
• No auto-publish to Substack/LinkedIn anywhere — the assistant prepares, you press the button. Platform APIs are a later, separately-gated milestone.
• The scoreboard personal view and the monthly calibration extension are the thin end (brief + counts); the deterministic integer scoreboard rows land with the full personal-hygiene pass.

[1.28.41] — 2026-08-26 — “Terrain”: the tier guide, tested — and the series exit

G8 of the Conformance Line closed plus the series-exit gate: deployment tiers become tested config (checked-in profiles, a CI tier-smoke matrix, a guide↔profile drift meta-test), and the conformance matrix is re-audited to every row green or explicitly ceiling-marked. Schema UNCHANGED at 1.28.41; no route changes; the CI matrix can be disabled independently of code.

Release notes

Improvements

• The tier guide, tested (G8): docs/deployment.md now documents T1 solo → T2 team → T3 site → T4 global with a per-tier env matrix, sizing guidance (SQLite WAL headroom, when multi-DB), cron cadences (connector sync, backup, KB build, calibration), and the additive upgrade path. Each tier is a checked-in profile — deploy/tiers/t1.env … t4.env — that a new CI tier-smoke matrix job boots end-to-end (health, brain doctor, audit chain verify). A meta-test (guide_and_profiles_never_drift) fails if a profile sets a key the guide never documents, or the guide stops naming a profile.
• Series exit: the CONTACT_CENTER_STANDARDS conformance matrix is re-audited — every G1–G8 row is shipped or ceiling/watch-marked; stale planned-statuses left over from .36–.40 are corrected. series_exit_gate_checklist_green_or_ceiling_marked pins it, and the AUDIT.md register carries the close-out entry. v1.29.x Console inherits with zero doctrine debt.

Engineering record

• New gate tests (+3): tier_profiles_boot_and_pass_smoke (every profile parses against the server’s real key set, validates fail-closed, and boots a fresh file-backed DB through migration green), guide_and_profiles_never_drift (two-way docs↔profiles pin), series_exit_gate_checklist_green_or_ceiling_marked (no 🟡/❌ row may survive in the conformance matrix at series exit).
• PCI boundary row (G9): verified present in THREAT_MODEL §6 (landed by an earlier release); no change this pass.
• Test delta: server +3 gate tests (+2 supporting parse/validation tests).

Honest ceilings

• No installer wizard — config files + docs remain the posture.
• Tier-smoke boots prove config validity on Linux CI, not sizing promises; capacity guidance stays measured-by-the-operator (bench).
• The exit gate reports honestly: it can fail. ISO/AWI 18295-1 revision remains a registered watch item (G10).

[1.28.40] — 2026-08-26 — “Handshake”: the ops interop seam, people made visible

G5+G7 of the Conformance Line closed. The WFM boundary becomes a first-party, versioned contract (wfm/1, additive-only, two-way pinned against its doc) with generic CSV/JSON import adapters; workload visibility completes the people picture with lineage-only per-principal views, a fatigue signal that alerts the scheduling human and never reassigns work, and competence coverage joining the skills registry to the worktype demand queue. Schema unchanged; two additive read-only routes.

Release notes

Improvements

• A stable WFM seam (G5): GET /ops/shifts and GET /ops/skills now stamp every response with schema_version: "wfm/1" under a written additive-only change policy (docs/wfm-seam.md carries the field declaration and change log). A new brain wfm-import <file.csv|file.json> adapter imports shift rows through the server’s own validation + audit and files skill rows as HITL proposals — never direct registry writes. Vendor-specific Verint/NICE connectors remain later work; these generic adapters are the documented 100% any WFM can map to today.
• Workload visibility (G7): GET /ops/workload computes per-principal burden from lineage only — concurrent open envelopes, pending outbound handover burden, accepted transfers-in on open runs, re-ask load, confirm- gate backlog — plus fatigue signals (consecutive-shift and open-load patterns) that surface to the scheduling human. Nothing ever reassigns work automatically: tools make it visible, management manages (ISO 18295-1’s own posture). GET /ops/coverage joins skills tags to the worktype demand queue so gaps read as data (covered: false), not surprises.

Engineering record

• New gate tests (+5): wfm_schema_is_versioned_and_additive_only (the emitted keys of both feeds must match the declaration block in docs/wfm-seam.md exactly, and the declared version must equal the shipped constant — drift fails either direction), wfm_import_round_trips_shifts_and_skills (file-backed DB; CSV/JSON rows round-trip through parse → storage → feed; malformed input refuses loudly with line context), workload_views_compute_from_lineage_only (snapshot of all source tables before/after proves the view writes nothing), fatigue_signal_alerts_never_reassigns (chain arithmetic honors the 8h rest floor; zero audit rows / run mutations while alerting), competence_coverage_joins_skills_to_worktype_queues (demand without supply reads as uncovered).
• New routes ship with openapi.yaml paths, route-coverage and route-authz guard-table entries (/ops/workload, /ops/coverage — Read on the domain, people-shaped aggregates, no case content) and docs/api.md rows in the same commit.
• Shared parser lives in bin_common/wfm_import.rs (the http.rs include pattern): server seam tests and the CLI use ONE grammar implementation — no duplicate parser can drift.
• RoPA register operator door: new brain ropa list / brain ropa add subcommands over /ropa (Admin-gated, audited upsert server-side), plus a reviewed seed draft at docs/examples/ropa-seed.json and populate instructions in docs/compliance.md. The Art 30 register’s remaining gap is pure content — controller identity and lawful bases are facts only an operator can certify; the machinery refuses to fake them.
• Client stylesheet hygiene: end-0/end-1 renamed to the v4-canonical inset-e-0/inset-e-1 (byte-equivalent compiled output); project-local Zed settings pin the Tailwind-aware CSS language server so editors stop flagging valid @theme/@apply at-rules.
• Validation: full gate green (server main bin 942 passed / 6 ignored, +5); clippy -D warnings clean; fmt clean.

Honest ceilings

• Gate-backlog attribution rides only onto principals the domain’s own lineage already surfaced (proposals has no domain column); no cross- tenant inference is attempted.
• Fatigue alerting is view-only: no push channel, no scheduler daemon.
• No forecasting, no adherence monitoring, no automatic queue reassignment.
• Import adapters are generic; vendor-specific connector parsing is later work.

[1.28.39] — 2026-08-26 — “Access”: accessibility as a hard gate, globally

G3+G4 of the Conformance Line closed: the six WCAG 2.2 AA criteria that are new in 2.2 land as release-blocking automated gates over the console, the ACR/VPAT artifact is pinned to the checklist it claims from, and the global half ships — ar as a first-class RTL locale with full-panel mirroring pinned in CI, and en-XA pseudolocalization budgeted at test time via fluent-pseudo (dev-dependency only; no runtime dep). No routes changed, no schema changed — client code, styles, docs, and one test-only dependency.

Release notes

Improvements

• Consistent help everywhere (3.2.6): the shell renders ONE help entry — the “?” button in the top bar — opening the shared shortcut sheet with the same content on every panel.
• Arabic is a real locale (G4): the full UI mirrors under dir="rtl" using logical CSS properties (ms-*/me-*/ps-*/pe-*, drawer docking inline-end), so no duplicate RTL rule set exists and none can drift. The locale switcher documents its negotiation (requested → available → default) honestly: exact-match today, BCP-47 subtag matching is a listed ceiling.
• Pseudolocale safety net: every shipped string is proven to survive ~30% elongation without leaving the layout budget — a real localization that fits the budget cannot truncate the UI.

Bug fixes

• The a11y checklist claimed a *:focus-visible { scroll-margin-top } guard that was not actually in the stylesheet — the rule now exists AND is pinned by test (focus_never_obscured_by_docks).
• The stale “No RTL locale” ceiling line in client/a11y-checklist.md is retired (superseded by this release).

Engineering record

• New gate tests (client suite, +8): focus_never_obscured_by_docks (2.4.11 — stylesheet-audited scroll margins must clear the pinned dock heights), drag_alternatives_exist_for_every_drag (2.5.7 — zero drag interactions ship; any future one must carry a marked click alternative), target_size_floor_24px_enforced_by_classes (2.5.8 — component-class height floors parsed from input.css), help_entry_consistent_across_ panels (3.2.6), no_redundant_entry_in_approval_flow (3.3.7 — the approval dock and shared confirm contain no re-entry inputs), rtl_mirroring_smoke_all_panels (every key resolves as real translated text under ar; untranslated leftovers bounded to technical vocabulary), pseudolocale_elongation_renders_without_truncation (fluent-pseudo transform of every en string stays within 1–2× growth, placeholders intact, shipped en-XA inside the same envelope), acr_remarks_cover_every_non_support (per-paragraph ACR honesty check).
• The release-blocking wcag22-aa-checklist.md gains the new-criterion rows (3.2.6, 3.3.8; 4.1.1 recorded as removed in WCAG 2.2); existing rows now cite their pinning test. docs/trust/acr-vpat.md refreshed to 2026-08-26 with the negotiation ceiling added.
• One dev-dependency added with written justification: fluent-pseudo 0.3 (test-only, pure, wasm-safe — the plan-designated pseudolocale engine; zero runtime surface).
• Validation: full gate green — server main bin 937 passed / 6 ignored (unchanged), client 239 passed (+8), clippy -D warnings clean both trees, lipstyk diff-gate exit 0, wasm budget 4172 KB / 5734 KB, desktop feature compiles.

[1.28.38] — 2026-08-26 — “Lexicon”: the normative metric dictionary

G2 of the Conformance Line closed: docs/metrics.md is now a fully attributed normative dictionary backed by a schema-versioned machine twin, and the metric-versioning discipline is enforced by test rather than convention. No routes changed, no schema changed — additive code and docs only.

Release notes

Improvements

• The metric dictionary is complete and pinned: every emitted metric (scoreboard, KCS, VoC, aftersales, goodwill, complaint set, reask_rate, plus the planned customer_effort_events CES proxy) carries formula · unit · source table.column lineage · window semantics · inclusion/exclusion rules · standard citation · tier availability (all tiers — tiers are config, not forks). FCR follows the SQM repeat-window method (BRAIN_FCR_WINDOW_DAYS, default 7). Benchmarks are reference points, never claims.
• Machine-readable twin: metrics/metrics.json (schema_version 1, scorer_version-stamped) mirrors every dictionary entry in structured form — the same data machines can consume without scraping markdown.

Engineering record

• New meta-tests (src/handlers/workflow.rs, mod scoreboard_tests): every_scoreboard_field_has_a_dictionary_entry (renamed/extended from scoreboard_fields_have_dictionary_entries — now three-way docs ↔ code ↔ JSON parity with full attribute coverage), every_entry_source_table_exists_in_schema (every lineage table.column in the twin is verified against an in-memory run of the real migration — a renamed table or column fails at test time, not in production reads), formula_change_bumps_scorer_version (SCORER_VERSION stamps the gold packs fail-closed, the JSON twin, and the documented one-PR law).
• Predecessor seams reused unchanged: fcr_window_is_configurable_and_ deterministic already shipped green in v1.28.37 and was verified, not rewritten; gold-set fail-closed validation (GoldCase::validate) is the version anchor.
• COMPLIANCE.md §6.7 gains the COPC R8.0 performance-assessment mapping row pointing at the dictionary (closes standards gap G6); docs/CONTACT_CENTER_STANDARDS.md marks G2 shipped and G6 closed.
• Validation: full gate green (cargo fmt --check; cargo clippy --all-targets --features bench -- -D warnings; cargo test --features bench — server main bin 937 passed / 6 ignored (+3: two new meta-tests + the renamed/extended parity pin), lib 206 / 1, brain 19, mcp 37, bench 6, eval 4, metrics 8). No schema change; schema-contract test untouched by design (additive code only). No route changes → no openapi.yaml movement.
• Honest ceilings: customer_effort_events remains a defined-but-unwired proxy (scorer integration next release); gap_rate_units still pins to 0 until the flywheel release; the dictionary covers metrics at sign/read time only — it does not retroactively re-state historical scoreboard responses; benchmarks quoted are citations, never measured claims.

[1.28.37.1] — 2026-08-26 — the debt burn-down ledger

Release notes

Improvements

• Debt burn-down ledger: src/dup_guard.rs now pins one row per release line with the live TODO(unify) exemption count (baseline: 1.28 = 16). Opening a new line with a count that is not strictly smaller fails CI — at least one documented debt must be extracted per line while any remains. The ledger must mirror tree reality; rows never go backwards; when the count hits zero the ledger retires in the same commit.

Bug fixes

None.

Security fixes

None.

Engineering record

• No binary change: test-module gate law only (4 dup_guard tests; decision core pure over 8 synthetic scenarios). Binaries in this release build from the same source as v1.28.37 plus this gate; Cargo.toml stays at 1.28.37 — the .1 tag ships the repo-law commit without colliding with the in-flight 1.28.38 line work.

[1.28.37] — 2026-08-26 — “Advocate”: complaints, the whole ISO 10002 lifecycle

G1 of the Conformance Line closed on the shipped machinery — the Charter complaint class, Goodwill’s remedy matrix, and Keystone’s confirm-gate doctrine were already in place; Advocate completes every stage against the standard’s sequence and wires the missing gates. The register IS the audit chain — no parallel complaint database exists.

Release notes

Improvements

• The complaint channel is always visible: every public case-status page now carries a footer link to how-to-complain.html (ISO 10002 visibility & accessibility of the channel). The page itself is the published complaints policy (knowledge.source='complaint_policy') rendered through the KB’s sanitizer; brain kb build --with-case-status refuses loudly when no policy is published rather than hosting links that lead nowhere.

• Acknowledgment is its own audited step: POST /workflow/runs/{id}/complaint/ack lands the legal received → acknowledged transition with a dedicated audit marker (ISO 10002 posture: within the hour). POST /workflow/complaints/ack-sweep sweeps every active complaint past its ack deadline — exactly one workflow/complaint/ ack_overdue alert per run on the existing alert bus, audited inside the caller’s transaction, idempotent per run, bounded at 500 per sweep.

• Closure requires confirmation: the confirm-gate is now wired into the complaint lifecycle itself — closed refuses loudly unless the lineage carries a customer confirmation or the documented three-attempt exception. Silence never certifies.

• Safety-relevant complaints escalate to the GPSR path: the front-door screen checks hazard vocabulary (“caught fire”, “injur…”, “unsafe”, “started smoking”, “hazard”) BEFORE the complaint keyword, so a safety complaint routes to safety_recall, never the commercial track.

• The monthly complaints report joins the monthly calibration signature: counts by terminal disposition, acknowledgment-SLA attainment, and ADR referrals ride the SAME audited calibration/sign row over a trailing 31-day window — continual improvement with zero new machinery.

• Repo hygiene gates (folded from the parallel gate pass): src/dup_guard.rs flags any top-level helper defined in more than one file of src/, with a categorized allowlist whose entries must carry files + a reason and die when the duplication disappears; scripts/repo-brief.sh is the one-shot agent briefing (<1s: versions, HEAD, dirty paths, guard inventory, stale-marker probe); cargo-machete (pinned 0.9.2) joined the CI lint-test job and its first run removed three unused dependencies (hyper, steward-harness serde, consensus-core serde_json). Blog: docs/blog/14-four-copies-of-sha256-hex.md tells that story.

Bug fixes

None.

Security fixes

None.

Engineering record

• Tests: +7 binary behavior pins — safety_complaint_routes_to_gpsr_path, ack_deadline_alerts_and_audits, complaint_closure_requires_confirm_gate, complaint_register_report_joins_monthly_calibration (+ service leg signed_row_carries_the_complaints_extract), complaint_policy_is_published_and_linked_from_status_pages; full gate green (fmt, clippy -D warnings bench + default features, lipstyk diff- strict exit 0). Schema unchanged — additive code only, no migration, no schema-contract change.
• Routes added WITH contract in the same commit: /workflow/runs/{id}/ complaint/ack (Write on domain + workflow role) and /workflow/complaints/ack-sweep (Write global + workflow role) — openapi, route-coverage table, route-authz table, docs/api.md all updated.
• Honest ceilings left in place: no telephony complaint ingestion beyond Bridges; the ack sweep runs on demand or by operator cron (no internal scheduler); the register extract covers the trailing window at sign time (no historical backfill reports); no ISO certification claim — self- assessed posture only.

[1.28.36] — 2026-08-26 — “Keystone”: the last three Order-of-Care gaps

The layer-map pass left exactly three Order-of-Care steps unassigned; this release closes all three, deterministic and HITL-gated: the public case-status page (G-A — a customer who can see the case doesn’t call about it), the multilingual public KB (G-B — translation is a human act, the tool governs), and the re-ask event (G-C — the effort proxy’s missing input). The public surface stays a static artifact; brain-server remains loopback — no public routes exist and none were added.

Release notes

Improvements

• Public case-status page: POST /workflow/runs/{id}/status-ref ({"action":"mint|rotate|revoke"}, Write on the run’s domain + approve role) manages an unguessable ref — base32(HMAC-SHA256(salt, run:rotation))[..26], salt via the standard 0600 secret-file ladder (BRAIN_CASE_STATUS_KEY_FILE). Mint is idempotent per run; rotation kills the old token; revocation removes the page from the next build AND refuses fresh mints (a revoked page does not resurrect). brain kb build --with-case-status emits status/<ref>.json + .html: one of seven fixed public words (received → in-progress → awaiting-your-reply → awaiting-confirmation → resolved → closed), a promise bucket derived from the SLA class (“expected within 72 hours”) — never raw deadlines, never operator names, zero PII (fixture-pinned). /status/ is excluded from robots.txt, marked noindex, and status refs NEVER appear in the sitemap; every status file lands in kb_manifest.json. The DSAR sweep purges refs of erased runs and revokes (page goes dark, evidence stays) for runs a legal hold defers.
• Multilingual KB: humans translate (POST /kcs/translate files a pending kcs_translate proposal); approval is the ONLY writer of an approved kcs_translations row, pinned to based_revision. When the source article’s revision advances past it, the translation lands on the SAME content-health worklist (GET /kcs/articles?stale=1) — one freshness discipline, no second mechanism. brain kb build --locales en,de,fr,es,nl emits {locale}/{slug}.html pages with hreflang alternates + x-default, per-locale search indexes, sitemap alternates — and a missing translation serves the default content behind a visible “not yet available in this language” note, never a silent fallback.
• The re-ask event: outbox topic case/reask, payload {source: crm_merge|marked|derived, detail_digest, ts} — ids/digests only, exactly-once by key. CRM merges map to it in the Bridges sync (merged_away rows post the event on the TARGET case’s run; unmappable merges refuse loudly); Genesys-class reopens ride the same shape. The operator marks one directly: a reask note kind on the case channel or brain workflow note <run> <text> --reask. The derived heuristic files a case_merge_suggested proposal for OPEN cases sharing an exact hashed subject within BRAIN_REASK_WINDOW_DAYS (default 3 days) — propose, never write; approval is the human CRM merge. The metrics dictionary gains reask_rate; the effort proxy weighs each re-ask ×2.

Engineering record

• Schema 1.28.35 → 1.28.36, additive only: case_status_refs (UNIQUE run_id, UNIQUE ref) + kcs_translations (UNIQUE knowledge_id × locale) + crm_cases.subject_ref column. Schema-contract test extended; boots green on a COPY of the live DB (integrity_check ok, doctor clean).
• Routes: /workflow/runs/{id}/status-ref, /kcs/translate with openapi.yaml, route-coverage guard table, route-authz guard table, docs/api.md in step.
• SDK: workflow_state::public_status (pure fn over the four-key ABI) + PublicStatus vocabulary enum, fixture-pinned; engine-sdk tests 118 (+1).
• Tests: server main bin 926 / 6 ignored (+21 over v1.28.35: the plan-named pins status_ref_is_unguessable_and_rotation_kills_old_ref, public_status_maps_every_decision_state_deterministically, status_json_contains_no_pii_no_deadlines_no_names, revoke_removes_page_from_next_build_and_stays_dead, promise_bucket_comes_from_envelope_class_not_internal_clock, status_pages_are_noindex_and_absent_from_sitemap, dsar_sweep_and_legal_hold_revoke_refs, hreflang_alternates_and_x_default_are_complete, missing_translation_shows_explicit_note_not_silent_fallback, translation_goes_stale_when_source_revision_advances, translate_proposal_never_autopopulates, search_index_is_per_locale, sitemap_alternates_cover_locales_and_never_status_refs, zendesk_and_salesforce_merges_map_to_reask_events, derived_merge_suggests_never_writes, marked_reask_writes_lineage_event_and_counts, reask_note_writes_the_case_reask_event, reask_window_is_env_tunable, metrics_dictionary_has_reask_rate_entry), lib 205 / 1 ignored (+11: kb status-artifact pins incl. revoked_refs_and_missing_runs_never_reach_the_build). fmt + clippy -D warnings clean (default, bench, otel, crates trees); lipstyk diff gate exit 0; default-feature test pass green.
• Zero new dependencies (hmac/sha2 declared; base32 is a pinned 20-line RFC-4648 encoder).
• Honest ceilings: static = build-cadence fresh (the page stamps its build time; no relay-side refresh exists); brain never sends anything (refs, translations, follow-ups ride humans/CRMs); no machine translation anywhere; duplicate detection is exact-hash only (no fuzzy matching); vendor syncs do not yet parse merge events from Zendesk/Salesforce APIs — the mapping ships pure and tested, the vendor field wiring lands with connector hardening; the effort proxy is defined and emitted but still unwired into scorer gold-set families (as documented since Frontdesk).

[1.28.35] — 2026-08-26 — “Outreach”: proactive care, consent-first

ISO 23592’s service-excellence model and the retention economics both demand proactive contact; ePrivacy/TCPA-class consent regimes demand it be governed. This release ships the governed outreach loop: a hashed-subject consent registry written ONLY through approved HITL proposals and DSAR-erasable by construction, campaigns as proposals whose recipients carry per-recipient consent proof (no consent, no inclusion — the gate runs before anything is filed), approved campaigns exporting for CRM-side execution (a send engine is never built here), the Order-of-Care post-close follow-up scheduled by policy interval and consent-gated, and ISO 10004 VoC as lineage-derived data on the scoreboard.

Release notes

Improvements

• The consent registry: one row per (domain, hashed subject × channel × purpose). Subjects live HASHED — raw identifiers never touch the table. Rows are created/updated exclusively through approved outreach_consent proposals; revocation always wins; expiry is inclusive; a future-dated grant is not yet consent. The DSAR sweep erases registry rows by re-hashing the sweep subject.
• Campaigns are proposals: {domain, channel, purpose, template_id, audience[]≤1000} files ONE pending HITL proposal. The deterministic consent gate excludes every recipient without an in-force grant BEFORE filing — each included recipient carries its proof (granted_at/expires_at/ provenance), everyone else appears excluded with the reason visible (absent/revoked/expired). An audience producing zero eligible recipients refuses loudly. Raw audience identifiers are hashed at the door.
• Export, never send: GET /workflow/outreach/campaign/{id} serves the export packet (recipients + proofs + template reference) ONLY for APPROVED campaigns; pending or rejected campaigns export nothing. brain decides and records; the CRM/telco system sends.
• The follow-up event (Order-of-Care): POST /workflow/runs/{id}/outreach/followup schedules the post-close proactive check for a CLOSED complaint run at the policy interval (default 7 days), gated on an in-force care_followup consent — no consent is a loud 400 with nothing filed. Proposal + lineage event (workflow/outreach) + audit land in one transaction.
• VoC per ISO 10004, as data: the scoreboard gains voc_contacts_total, voc_complaints_total, and voc_complaints_per_thousand_contacts_units — derived from lineage counts alone. CSAT/DSAT instruments stay CRM-side (ingested via Bridges when they exist); docs/metrics.md pins the formulas.
• Retention cohorts: the deterministic cohort view (contract-expiry window × complaint history × recorded repeat contact) surfaces each member’s signals AND retention-consent state. Retention stays a human strategy; the tool makes the cohort visible.

Engineering record

• SDK pure/consent.rs owns the deterministic policy once: the closed channel/purpose vocabularies, the fail-closed consent decision (revocation > expiry > absence; future grants deny), and the follow-up interval arithmetic. Pins: no_consent_no_send_is_a_gate_not_warning, channel_purpose_vocabularies_are_closed, followup_scheduled_by_policy_and_consent_gated_interval_arithmetic.
• workflow/outreach.rs is the service core: registry writes ride the caller’s transaction with their audit row (record_tenant, domain-scoped); campaign gating and export legality are SQL-free invariants over the SDK verdicts. Pins: consent_registry_is_dsar_erasable, no_consent_no_send_is_a_gate_not_warning_campaign, campaign_recipients_carry_consent_proof, followup_scheduled_by_policy_and_consent_gated (service leg), retention_cohort_is_deterministic_query, voc_complaint_ratio_derives_from_lineage_counts. Bounds pinned: audience ≤ 1000 entries ≤ 512 chars, template_id ≤ 256 chars, cohort ≤ 200.
• Gate: the outreach_consent branch applies the grant/revoke in the approval transaction (the registry has NO other writer); campaign and follow-up approvals CAS the proposal approved and STOP — they must never reach the generic promote path that would turn a recipient list into a knowledge chunk.
• Erasure: sweep_subject gains the exact-hash arm (consent_rows on the report) so DSAR sweeps take registry rows without ever seeing a raw identifier pattern.
• Routes: POST /workflow/outreach/campaign, GET /workflow/outreach/campaign/{id}, GET /workflow/outreach/consent, POST /workflow/runs/{id}/outreach/followup — openapi.yaml, route-coverage guard, authz-guard table, docs/api.md in the same commit; emitted text passes sanitize_read; OptPrincipal everywhere.
• Scoreboard: three additive VoC fields + parity-test extension; docs/metrics.md normative.
• Install: scripts/install-service.sh builds + installs brain-connector-crm best-effort (the same optional-bin loop as brain-connector-gh) — the Bridges cron recipes no longer require a manual feature build; docs/deployment.md states the real posture.
• Schema additive at 1.28.35: the consent_registry table (UNIQUE domain × subject_hash × channel × purpose); schema-contract test extended (table + column set + version pin).
• Honest ceilings: campaigns accept an explicit audience list — the entitlement-registry-driven audience queries (contract-expiry from the Frontdesk registry, recall-affected serial sets) are read-side helpers that arrive with the operators who maintain those registries; no CRM connector feed ships yet (export is operator-facing JSON); retention consent state is displayed per member but the cohort endpoint does NOT auto-file proposals; VoC response-rate/DSAT-share await actual Bridges ingestion; confirm-gate and effort-proxy remain unwired into run-close flows (predecessor ceiling, unchanged).

[1.28.34] — 2026-08-26 — “Goodwill”: complaints, the full ISO 10002/10003 lifecycle

Charter seeded the complaint class; this release gives it the full lifecycle — the closed state chain as lineage events on the audit chain, the remedy matrix as HITL proposals with deterministic role-tier approval caps that escalate one level over cap, the goodwill ledger aggregated ONLY from audited remedies, the ISO 10003 external-dispute packet targeting the competent NATIONAL ADR body (the EU ODR platform is discontinued — Reg. 2024/3228), code-of-conduct citations on every financial remedy with visible contradiction flags, and the KCS capture priority where complaint clusters outrank incident repeaters. Financial execution still never happens here — every remedy is a decision with an approval trail.

Release notes

Improvements

• The full complaint lifecycle: received → acknowledged → investigated → remedy_proposed → remedy_approved → closed → adr_referred, validated against a CLOSED transition table (skips, reversals and self-transitions deny loudly). Every step is a lineage event (workflow/complaint) audited in the caller’s transaction — the register IS the audit chain.
• The remedy matrix as proposals: repair / replace / refund / goodwill payment / explanation-only. Every proposal cites its legal basis from the closed anchor set (2019/771 art. 13(2), 2011/83 art. 16, goodwill-policy, ISO 10002 clause 9) AND its published code-of-conduct clause (ISO 10001). Nothing financial ever executes here.
• Role-capped approvals that escalate deterministically: each approval level (agent / supervisor / manager / executive) binds up to a fixed per-tier cent cap; one cent over creates an escalation proposal exactly one rung up with the full packet attached — the original stays pending. An approver role that does not resolve on the closed ladder denies loudly.
• Published-promise gate: conduct clauses live in the KB (knowledge.source='code_of_conduct') and carry a machine preamble (coc: excludes=…, coc: max_goodwill_cents=…). A remedy the published promise excludes or funds above its ceiling is FLAGGED on the packet at raised salience — visible to the human, never silently blocked.
• ADR handoff done right for 2026: the dispute packet carries the run’s lifecycle state, audited remedy history, and the competent NATIONAL ADR body from the DPO-maintained registry; every packet states the Reg. 2024/3228 discontinuation basis and that humans file. An unregistered member state denies — the packet never guesses where a consumer files.
• Complaint clusters are the top KCS input: closing a complaint case captures complaint_rca into the same HITL pipeline at cluster-boosted salience (0.9) — strictly above incident repeaters (0.7) and plain capture (0.5), deterministically.
• Goodwill ledger on the scoreboard: trailing-30-day aggregate over APPROVED remedies whose approval audit row verifies; unaudited rows are excluded AND counted — absence is surfaced, never folded away.

Engineering record

• SDK pure/complaint.rs owns the deterministic policy once: RemedyKind (+ legal anchors), the ApprovalLevel ladder + CAP_TABLE (level × tier), approval_decision (one-cent-over escalates one level; negative amounts escalate to the top; explanation-only always passes), the closed lifecycle table, capture_salience, flywheel_for_case (FlywheelProposal::ComplaintRca variant added — additive on a #[non_exhaustive] enum), and ODR_DISCONTINUATION_BASIS. Pins: approval_caps_escalate_deterministically, complaint_lifecycle_is_a_closed_chain, complaint_clusters_outrank_incident_repeaters_in_capture_priority.
• workflow/complaint.rs is the service core: transition / current_state (lineage-backed), propose_remedy (citation validation, conflict computation, salience raise), apply_remedy_approval (cap check, escalation packet, legal-predecessor lifecycle landing), adr_packet, goodwill_ledger (audit-presence matched on target/detail HASHES — audit targets are stored hashed by law). Pins: remedy_citations_include_code_clause_and_legal_basis, approval_caps_escalate_deterministically (service leg), adr_packet_targets_national_body_not_odr, goodwill_ledger_aggregates_only_from_audited_remedies.
• KCS wiring: capture_on_case_close reads the run kind + 30-day complaint window; complaint runs capture complaint_rca at capture_salience-computed salience. Pin: complaint_capture_outranks_repeater_capture. The gate’s approve path handles complaint_remedy (cap branch) and complaint_rca (same promote path as KCS capture kinds).
• Routes: POST /workflow/runs/{id}/complaint/lifecycle, POST /workflow/runs/{id}/complaint/remedy, GET /workflow/runs/{id}/complaint/adr-packet?member_state= — openapi.yaml, route-coverage guard, authz-guard table, docs/api.md in the same commit; input bounds pinned (amount ≤ 1e8 cents, clause id ≤ 128 chars, member_state ≤ 64 + .. refused); KB-sourced text passes sanitize_read.
• Scoreboard: three additive ledger fields + scoreboard_fields_have_dictionary_entries extended; docs/metrics.md is the normative dictionary.
• Schema unchanged at 1.28.30 — the lifecycle rides lineage events, remedies ride proposals, clauses and ADR bodies ride governed knowledge rows.
• CI/release pipeline: tag pushes re-run nothing (the branches-only push filter already excluded tags; tags-ignore: ['v*'] now pins that intent explicitly); release-build + ump-conformance + recall-gate merged into ONE integration job — a single cargo build --release serves the release-profile compile check AND both live gates (UMP :18483, recall eval :18484); mdbook/lipstyk/cross/cargo-cyclonedx install from version-keyed ~/.cargo/bin caches instead of recompiling from source every run; the HF model prefetch deduped into .github/actions/huggingface-prefetch; client-gate folds its two apt rounds into one transaction; docs.yml builds
  • deploys in a single job; stale matrices supersede via concurrency cancel-in-progress. Release path: release.sh now BLOCKS on green CI for the tagged SHA (fail-closed — the tag re-runs no tests, so the main-push run is the only automated bridge between pushed and shipped); release builds are 4 parallel per-target jobs (was 2 sequential-pair jobs — wall-clock is the MAX now, not the sum) with the verify-required-assets gate unchanged; CodeQL skips markdown/docs-only pushes (weekly schedule unaffected), drops a duplicated engine-crates trace, and supersedes stale analyses via concurrency.
• Release notes extractor: bullet continuation lines now travel with their bullet (v1.28.31–.33 published truncated), grouped category headings are separated from the previous bullet, prose/bullets unwrap to one physical line per paragraph, and the intro’s trailing blanks are trimmed; CHANGELOG canonicalized to a single shape and 135 already-published releases repaired in place via gh release edit.

Test delta: server bin +7 (4 service pins/wiring, 1 KCS wiring pin, 3 SDK pure pins counted under the crates workspace), engine-sdk crate 111 → 114.

Honest ceilings: remedy amounts are decision records only — no payment, refund, or replacement execution exists or belongs here. Approval caps are a fixed table compiled into the binary (per-deployment calibration is a future config surface). The ADR registry ships EMPTY by design (DPO-maintained via the ordinary knowledge write path) — packets fail closed until populated. Confirm-gate/effort-proxy remain unwired into run-close flows (v1.28.32 ceiling unchanged); consent-gated outreach stays v1.28.35 scope. The ledger is trailing-30-day, global (no per-domain split yet).

[1.28.33] — 2026-08-26 — “Returns”: aftersales objects with the same evidence law

Returns/RMA/repair/recall get their decision machinery on the Frontdesk substrate: a deterministic disposition ranker whose candidates always cite their legal basis, GPSR recall mode over the entitlement registry’s serial/batch spine (a blast PROPOSAL — never an autonomous send), and the aftersales KPI set on the scoreboard with the metrics dictionary extended to match. Financial execution still never happens here.

Release notes

Improvements

• Deterministic disposition ranking: every return claim ranks four candidates — replace-first / return-for-inspection / returnless refund / deny — from item value × fraud signals (repeat-return rate per subject hash, serial mismatch against the registry, window abuse). Signals inform, the human disposes: nothing auto-executes, and at the hard-signal cap every candidate escalates.
• Every disposition cites its basis: withdrawal (2011/83 art. 16), warranty replacement (2019/771 art. 13(2)), goodwill policy, inspection clause, or the fraud schedule — distinct legal-anchored paths, the decision trail regulators actually want.
• Returnless refunds pair with fraud review: above the composite fraud threshold the no-inspection path carries mandatory review; a serial mismatch kills its rank entirely (the goods’ identity is unproven).
• GPSR recall mode: deterministic traceability query over memory_kind='entitlement' rows by product + serial/batch inside the region stamp (malformed registry rows deny loudly); recall campaigns build as blast proposals carrying Safety Gate reference fields (notification id, member state, hazard class, corrective action) per Reg. 2023/988 — human-triggered, DPO-visible.
• Aftersales KPIs on the scoreboard: return rate, warranty claim rate, FTFR for repair-field work (FCR’s repeat-window method applied to first-visit resolution), refund cycle time median, returnless-refund share, and the fraud-flag rate — formulas defined once in the SDK, mirrored in docs/metrics.md, empty cohorts score 0 honestly.

Engineering record

• brain-aftersales-core gains disposition.rs (closed basis table, FraudSignals.score() clamped arithmetic, FRAUD_REVIEW_THRESHOLD_UNITS, HARD_ESCALATION_UNITS): plan pins disposition_ranking_is_deterministic_and_cites_basis, returnless_refund_requires_fraud_review_over_threshold.
• SDK gains pure/aftersales.rs (AftersalesKind maps the workflow kinds; aftersales_kpis owns all six formulas): pin ftfr_uses_repeat_window_method.
• workflow/recall.rs: traceability_query (capped read, region-stamped, fail-closed parse) + build_recall_campaign (fail-closed Safety Gate refs, refuses an empty affected set): pins serial_batch_query_backs_traceability, recall_campaign_is_a_blast_proposal_with_safety_gate_refs. File-backed integration tests.
• Scoreboard wiring: GET /workflow/scoreboard derives the aftersales cohort in the same spawn-blocking read (kind, timestamps, terminal status, state flags; FTFR reuses the exact FCR window expression) and emits six new fields; openapi.yaml, docs/metrics.md, and the scoreboard_fields_have_dictionary_entries meta-test extended together.
• EntitlementRecord grows an optional batch field (additive parse; schema unchanged at 1.28.30).
• Test deltas: bin 900 / 6 ignored (+2), SDK lib 111 (+1), aftersales-core lib 3 (+2).
• Honest ceilings: dispositions and recall campaigns ship as service-level builders — no HTTP route or proposal-table write path yet; the fraud signals consume inputs no run writer populates yet (returnless/fraud_flagged state flags are reserved vocabulary); consent-gated customer notification stays v1.28.35 scope.

[1.28.32] — 2026-08-26 — “Frontdesk”: one intake for every post-sale worktype

Universality is decided at the front door: the intake classifier grows from six intent classes to thirteen, each mapping to a worktype (= run kind) with its own deterministic policy rows — SLA envelope class, required evidence, and decision gates. The Frontdesk substrate lands for the whole Universal Care Line (Returns / Goodwill / Outreach follow on it).

Release notes

Improvements

• Every post-sale intent has a class: Return, WarrantyClaim, RepairField, CareInquiry, AccountChange, SafetyRecall, and RetentionOutreach join the routing table; safety-recall vocabulary outranks the commercial classes it shares words with, and unknown worktypes deny loudly (the table is closed).
• Worktype policy rows: every worktype carries its SLA envelope class (safety recall is P1-class always; complaints keep their own two-clock ISO 10002 envelope), required evidence tags, and gate waterfall — shared between server and engines via the SDK (stamp_worktype_envelope).
• Crew routing by class: the colleague board per worktype is a deterministic match of HITL-maintained skills tags (worktype_skills) — warranty claims reach colleagues holding both returns AND warranty.
• Confirm-gate: terminal close now has structural discipline available: a case closes on a customer-confirmation lineage event or the documented consent-absent exception (3 logged attempts) — silence never certifies.
• Customer-effort proxy: a deterministic CES proxy computed from lineage shape only (repeats ×2 + channel switches + handovers ×3) — no surveys, no sentiment models.
• Entitlement arithmetic: Directive 2019/771 coverage windows (730-day conformity baseline + member-state limitation extension), the 14-day withdrawal window with its exceptions table (made-to-order/sealed goods remove the right; separate deliveries start the clock at last delivery), and region rules that fail closed against the residency stamp.

Security fixes

• Entitlement region checks fail CLOSED: an unstamped entitlement row is foreign to any stamped site; malformed registry payloads never grant coverage.

Engineering record

• IntentClass extended in workflow/frontdoor.rs with the closed WORKTYPE_TABLE (9 policy rows) + worktype_policy/worktype_skills; SDK policy::Worktype owns the SLA clock table (single owner across the ABI). Tests added: bin 898 / 6 ignored (+7 over v1.28.31: plan-named pins intent_table_routes_every_worktype_deterministically, entitlement_window_computes_771_extension, withdrawal_window_14_days_computes_with_exceptions_table, close_requires_confirmation_or_three_attempt_exception, effort_proxy_computes_from_lineage_only_no_surveys, crew_board_routes_by_worktype_tags, plus memory_kind_round_trips extended to the entitlement kind), lib 194 / 1 unchanged.
• New engine crates in the crates workspace: brain-care-core (care/account dialogs as a thin binding over interview-core’s ambiguity/ draft/repair machinery — zero new concepts, pinned by care_core_reuses_interview_machinery_zero_new_concepts) and brain-aftersales-core (fulfillment waterfall entitlement → window → disposition reusing troubleshoot-core’s gate shape; own evidence vocabulary ProofOfPurchase/DiagnosticBundle/SerialBatch/Photos/ InspectionReport; dispositions are HITL proposals only). Crates suite green: SDK 110 (+1 worktype_sla_table_is_deterministic), two new crate suites (+2).
• memory_kind='entitlement' joins the governed chunk vocabulary (strict-validated at the write boundary; retention default 1825 days); additive data change — schema stays at 1.28.30.
• Honest ceilings: the confirm-gate and effort proxy ship as workflow primitives not yet wired into run-close HTTP flows; the crew board is a service-level function over /ops/skills, no dedicated route yet; entitlement rows are proposal-created knowledge but no dedicated read/query API yet; recall campaigns, disposition proposals, consent registry, and outreach remain v1.28.33–.35 scope.

[1.28.31] — 2026-08-26 — “Charter”: the conformance pack lands

The contact-center conformance pack closes gaps G1–G10 in one release: complaints become a first-class case class (ISO 10002), metrics become a dictionary with data lineage (COPC/KPI canon), accessibility becomes a release-blocking gate with a shipped ACR/VPAT (WCAG 2.2 AA / EN 301 549), global-locale readiness ships (ar RTL + en-XA pseudolocale), the WFM interop boundary completes (GET /ops/skills), and the compliance/deployment docs gain the clause maps, workload ceiling, and T1–T4 tier guide. Self-assessed posture throughout — no certification is claimed.

Release notes

Improvements

• Complaints as a class, not an escalation flavor: the intake classifier gains Complaint; complaints carry their own envelope — acknowledgment within the hour by policy, always tighter than the 72h response clock, P2-minimum priority map; escalation-to-dispute is a documented handover audited as handover/dispute — the complaints register IS the audit chain, zero new tables.
• Metrics dictionary: every scoreboard field now has a normative entry in docs/metrics.md (formula, source lineage, window semantics, industry citation), pinned by a docs↔code parity meta-test. The FCR repeat-attribution window is configurable (BRAIN_FCR_WINDOW_DAYS, default 7) and consumed by the scoreboard derivation when a run records its recurrence age.
• Accessibility as a gate: WCAG 2.2 AA is release-blocking for the client (checklist-driven gate); the Accessibility Conformance Report ships at docs/trust/acr-vpat.md for web + desktop (EN 301 549 clause-11 mapping), honestly listing the known ceilings.
• Global locales: ar (RTL, full parity) and the en-XA pseudolocale join the shipped locale set under the existing key-parity wall; mirroring is pinned by a render-smoke test.
• WFM seam completed: GET /ops/skills joins the shifts feed as the documented interop boundary — centers keep their workforce-management tool; brain keeps governed truth. No forecasting engine was built.
• Docs truth: COPC R8.0 + ISO 18295-1 clause map added to COMPLIANCE.md §6.7 (with the measured-never-enforced workload ceiling); deployment tiers T1–T4 documented in docs/deployment.md; PCI DSS recorded as explicit non-scope in THREAT_MODEL §6; the ISO/AWI 18295-1 revision stays a test-pinned watch item so it cannot land silently.

Security fixes

• None (no trust-boundary changes; the new read route carries the standard per-domain Read gate and bounds).

Bug fixes

• openapi.yaml scoreboard response schema caught up to the wire shape (the five KCS/Beacon fields added in earlier releases were missing from the contract).

Engineering record

• G1: IntentClass::Complaint + stamp_complaint_envelope (COMPLAINT_ACK_SECS/COMPLAINT_RESPONSE_SECS) in the SDK policy module; Envelope gains additive ack_deadline (non-complaint stamps keep one clock); relay::record_dispute_escalation reuses the offer machinery with audit detail handover/dispute. Tests: bin 891 / 6 ignored (+8 over v1.28.30: plan-named pins complaint_class_gets_acknowledgment_sla, complaint_escalation_is_audited_as_dispute, plus SDK complaint_envelope_ack_leads_response), lib 194 / 1 unchanged.
• G2: config::fcr_window_days(); derivation consumes the window via an optional recorded recurrence age; tests fcr_window_is_configurable_and_ deterministic (shared-lock env posture) + scoreboard_fields_have_dictionary_entries (two-way docs↔code parity).
• G3: client a11y test module parses docs/trust/wcag22-aa-checklist.md (PASS/CEILING verdicts only; CEILING must cite the ACR) + acr_lists_known_ceilings_honestly.
• G4: SUPPORTED_LOCALES 5 → 7; dir_for_locale extracted pure (the shell effect consumes it); client suite 232 passed (+3).
• G5: workflow::crew::list_skills (bounded 1000-row ordered read) + handler get_ops_skills (Read on domain, strip-seam on emitted principals); route + openapi + docs/api.md + guard tables in the same change; test wfm_feed_round_trips_shifts_and_skills.
• G10: new src/docs_truth.rs meta-tests pin the ISO watch item, the self-assessed posture wording, and the documented FCR default against code.
• Schema: unchanged at 1.28.30 — zero tables/columns touched this release. fmt + clippy -D warnings clean; live smoke on a DB COPY green (brain doctor clean, /audit/verify ok:true, new route serving).