brainiac v0.20.49

Security

• An image that declares too many pixels is refused before it is decoded.
  Pillow only raises at twice its own 89.5 M-pixel warning threshold, so a
  ~100 KB PNG could make ingest hold hundreds of MB. The image handler now
  quarantines such a file as image_too_many_pixels, and PowerPoint picture
  OCR skips it.
• Backups are owner-only from the first byte. The archive is created
  with mode 0600, and an existing one is tightened; the default umask left a
  plaintext copy of the whole vault readable by every local user.
• The unattended update installs exactly the version it verified (A-03).
  The nightly checked the attestation of one version, then ran a bare upgrade
  that installed whatever PyPI served at that moment. Every PyPI channel (uv
  tool, pipx, pip) now pins the verified version. brain update run by hand
  is unchanged.
• The golden check no longer gives Codex the vault folder or a shell
  (public PR #36). Codex calls one fixed host tool that runs the scorer,
  and its answer must equal the host's own measurement.
• Bounded document work. A PDF has a page cap and a 120 s wall-clock
  budget (an over-limit file is quarantined with the limit named, and OCR
  stops between images once the budget is spent). A workbook that declares a
  huge range is read at most 200 columns wide (a 4.8 KB file took 58 s, now
  0.7 s). Capture-inbox drafts are read without following symlinks, and a
  FIFO no longer hangs the remediation read.
• pypdf floor raised to 6.21.4. Accepted risks A-16 (Python 3.10 keeps
  Pillow 12.3.0 and filelock 4.1.0) and A-17 (a sandbox draft keeps the
  classification it declares) are recorded in docs/security-acceptances.md.

Fixed

• A draft whose title contains --- survives staging.
• State files are written atomically through one helper.
• Failures that were swallowed silently are now logged.
• A blank small screenshot is retried once on a high-contrast copy within the
  same time budget; recovered text is flagged for review (public PR #36).
• brain doctor reads the registry on a pipx install and follows a symlinked
  launcher to its install channel (public PR #36).

Added

• BRAIN_UPDATE_ENGINE_ONLY=1 updates the engine only, for a Codex-only host
  (public PR #36).

Changed

• Internal simplification: shared dedup and atomic-write helpers, uncalled
  functions removed, complex functions split. No behaviour change intended.
• CI actions bumped to their current pinned releases (public PRs #37-#41).

brainiac v0.20.48

Fixed

• Text too faint or too small to read is now flagged as hidden (pentest
  VULN-3418). An HTML payload styled color:#ffffdd; font-size:2.7px
  ingested with no flag: the colour test only caught text within 0x10 of its
  ground on every channel, and the size floor was 2pt. Text now also counts
  as hidden below a 1.2:1 contrast ratio with its ground (alpha included),
  and the size floor is 3pt in every lane (HTML, email, Word, PowerPoint). The
  text-level scan applies the same rules to an inline style="", reads either
  quote style, and treats a style it cannot parse as hiding instead of
  raising. Measured on 1,055 real originals: 0 new quarantines, no detection
  lost, new labels in 10 documents.
• The weekly synthesis no longer fails on a note named after a whole
  sentence. On 2026-10-25 the linking lane named 20 notes after sentences of
  up to 208 characters; the id limit is 180, so none could be signed and the
  run failed (rc=75). Before signing, the synthesis now shortens such an id to
  its first words plus 8 hex characters of the old id, rewrites every
  [[old-id]] link to it in the same run's notes, and asks the lane for ids
  of at most 80 characters. The list of notes is split on newlines only, so a
  crafted file name cannot become two entries.
• AGENTS.md rule 2 names the ceiling a Cowork session actually reads at
  (pentest VULN-3419). It described the signed VM clamp without saying it
  binds only brain --role vm; through the host broker a Cowork session
  reads at the broker entry's ceiling, so the agent reported a cap of
  Internal it did not have.
• The monthly retrieval watch measures again, and brain alerts shows it.
  Since August it crashed every month (it gave the comparison the eval/qrels
  folder instead of eval/qrels/qrels.json, and called gate.py without
  --scorecard) and reported each crash as "quality regressed" into hot.md
  only. A crash or an undecidable gate now reads ERROR, never FAIL; the baseline
  rolls forward after each PASS so vault growth cannot make it undecidable; and
  the verdict lands in ~/.brain/retrieval-watch-state.json, which brain alerts reads (FAIL, ERROR, or no run in 35 days) and shows as a banner,
  never an untriaged line.

brainiac v0.20.47

Fixed

• The dependency audit checks the lock again. pip-audit re-resolved
  requirements.lock with pip, which does not see the uv override that lifts
  fastembed's pillow<13 cap, so on 0.20.46 it stopped with
  ResolutionImpossible and audited nothing. It now reads the pinned versions
  as written (--disable-pip), in CI and in make audit.
• The release check accepts a wheel CI built with a newer setuptools. The
  check that compares the PyPI wheel with the local build ignores the
  build-tool version line in WHEEL and that file's row in RECORD. Any
  other difference still stops the release.

brainiac v0.20.46

Security

• The parsers that open attachments carry no known vulnerability. Pillow
  13.0.0 (37 advisories on 12.3.0, one a heap overflow in the FlashPix
  decoder), pypdf 6.21.2 (11 on 6.19.0), filelock 4.2.4 and certifi
  2026.10.23. The pypdf floor in the package metadata is now >=6.21.2, so
  an install moves off the vulnerable release. Pillow 13 needs Python 3.11;
  on Python 3.10 the floor stays at 12.3.0.

Fixed

• The hidden-text scan reads a PDF in full again on pypdf 6.21. pypdf
  moved its internal font class, the scan failed to load it, and every PDF
  read incomplete. It now loads the class from either place.
• Two writers at once no longer share one temp file. 24 atomic writes
  used a fixed <name>.tmp before the rename; each now uses a unique name.
• A pipe in the drop zone can no longer stop an ingest. The ingest reader
  opens files without waiting, as the other safe-file readers already did.

brainiac v0.20.45

Changed

• Model work is capped machine-wide, so parallel searches no longer exhaust
  memory. At most two processes load or run a model at once
  ($BRAIN_MODEL_SLOTS, default 2); a queued search waits before its rerank
  budget starts, so it never loses its rerank. Ten brain search processes
  at once had taken a 24 GB Mac to a forced reset; the same replay now peaks
  at 5.7 GB in total. The reranker also scores in batches of 4
  ($BRAIN_RERANK_BATCH), so a long-lived process such as the MCP server
  keeps 4.6 GB after 20 searches instead of 12 GB. Scores are unchanged.
• The embedder and the reranker use 4 threads by default, not every core.
  Measured on a 12-core Mac: the same wall time at about 40% of the CPU.
  $BRAIN_EMBED_THREADS and $BRAIN_RERANK_THREADS still override.

Fixed

• brain update no longer times out on a slow engine install. Every
  install channel (uv, pipx, pip --user, venv wheel, editable) ran under the
  120-second bound meant for claude plugin calls. The 0.20.44 venv install
  took 6m39s, so the update stopped before it re-staged any workspace. The
  install now gets 30 minutes, the same bound as the workspace sync.

brainiac v0.20.44

Added

• A type-error ratchet in CI. The quality-ratchet workflow now runs
  Astral's ty (pinned at 0.0.89) through tools/check_types.py. Today's
  diagnostics are recorded per file and rule in .type-exceptions; any new
  one fails the job, and a fall asks for a re-record. The export re-records
  the baseline on the public tree, so the public CI judges the files it has.
  No existing type error is fixed in this release.

brainiac v0.20.43

Security

• mcp 1.30.0 or later (CVE-2026-59951). mcp 1.29.1 never reclaims
  Streamable HTTP stateful sessions, so memory grows without bound. The
  [mcp] extra's floor and the audited lockfile now require 1.30.0.
  brain-mcp runs over stdio and never started Streamable HTTP, so no
  install was exposed; a fresh install already resolved to 1.30.0.

Fixed

• The Claude Desktop doctor row counts servers, not wrappers. Desktop
  runs each brain-mcp server under a helper whose command line names the
  same path, so 8 servers read "16 of 16 running process(es)". The helper is
  skipped and the row counts server(s).
• Plugins from a local-folder marketplace no longer read stale. Claude
  Code reads a project or local copy straight from the marketplace folder,
  and claude plugin update never rewrites that copy's record. The doctor
  read the old cache path from the record, so every plugin read stale after
  a release with nothing left to update. Such copies now carry the folder's
  version.
• The pre-compact hook keeps one checkpoint marker in the handoff. It
  appended a marker on every compaction and never removed the old ones; one
  handoff held 19 markers and no state.
• brain update no longer crashes on a plugin copy for a deleted project.
  Claude Code keeps a project-scope plugin entry after its project folder is
  gone. The doctor counted that copy as stale, and brain update then ran
  claude plugin update from the missing folder and stopped with
  FileNotFoundError before it re-staged anything. Such a copy is now
  ignored, and the doctor row says how many it ignored.

brainiac v0.20.42

Changed

• brain doctor says whether Claude Desktop runs the current Brainiac.
  A new row compares each running brain-mcp server with the engine install
  time: servers started before an update still serve the old code, and the
  row says to quit and reopen Claude Desktop. The Cowork plugin-store rows
  now compare the installed skill TEXT with the bundles staged for the
  current version, so a plugin that Cowork's lagging marketplace labels with
  an older version reads current when its text matches, and a real
  difference names the skills and the steps. brainiac-manager missing from
  Cowork is reported as optional. The release's last step prints only the
  Desktop steps these rows ask for.

Fixed

• Spreadsheet tables no longer carry thousands of empty columns. A
  sheet's used range can run far wider than its data (16,147 columns on one
  real file), and every row carried the blank columns as | | padding: a
  97K-character sheet became a 9 MB note. The shared table renderer for
  xlsx, pptx and docx now drops a column that is blank in every row, as it
  already dropped blank rows. Two real files measured 2,124,686 -> 352,631
  and 1,258,807 -> 27,532 characters with identical non-empty cells. Notes
  ingested before this release keep their padding; new and changed files
  are compact.

brainiac v0.20.41

Added

• An opt-in Codex Sunday synthesis adapter for hosts without Claude CLI.
  Structured proposals are locally validated, sanitized, signed, indexed and
  published; cloud export requires explicit consent and defaults to Internal.
  See docs/operations/codex-synthesis.md for scope and manual launchd setup.
  (Proposed in public PR #35.)

Fixed

• An encrypted Office file is a terminal negative, not an extraction
  error. A rights-protected .docx/.pptx/.xlsx is an OLE container
  holding an EncryptedPackage, not a zip. Ingest now quarantines it as
  office_encrypted once and raises one owner-facing alert, instead of
  reporting an extraction error on every run. The OLE directory walk follows
  the DIFAT chain, so a large encrypted file is also recognised.
• .xlsm workbooks ingest. They go through the .xlsx handler (openpyxl
  never runs macros), the encryption check covers them, and the originals
  resolver accepts them. They used to sit in no_handler_for_extension.
• Two false alerts are gone. The corpus-invariants entry no longer
  changes its key with a live backlog count, so the weekly retro stops filing
  duplicate findings; and the search self-test warms the embedder before it
  times a query, so trend:selftest_ms no longer fires on a cold load.
• Auto-PARA moves are filed before the hourly sync and never re-sign
  changed bytes. The fold plans outside the writer lock, applies inside it,
  and moves a note only when its bytes match what the audit chain signed at
  the old path; anything else stays put and is reported. Invariants no
  longer judge a moved note at its old path.
• The owner interview asks better questions. The "still current?"
  question never asks about, or appends to, a raw/ source; an orphan
  question offers the project note whose title or alias names its topic
  first; and a link option may name any note id up to 255 characters (a
  133-character id refused a whole morning sheet).
• Supersession edge cases. A deferred deliverable anchor consumes its
  .supersedes sidecar, so it cannot declare a supersession for the next
  file of that name; and the MCP broker's unsupersede refuses and names
  brain unsupersede on the host, because relatedness cannot guard an undo.
• The Codex synthesis script runs when launchd starts it, and waits out the
  hourly sync. As proposed it had no __main__ entry point and exited 0
  without working; it also gave up at once on a busy writer lock. It now
  waits up to 15 minutes for the lock.

Security

• pyjwt 2.15.1, urllib3 2.8.0 and pypdf 6.19.0 in both uv.lock and the
  hash-pinned requirements.lock, past the advisories pip-audit reported
  (23 findings in 3 packages on the old lock, 0 on the new one).

brainiac v0.20.40

Fixed

• brain interview asks questions again. The nightly interview asked
  nothing from 2026-09-23 on: the stale-note finder sampled 10 notes and
  found 9 undated ones, which it skips, and the orphan finder spent its
  three-question budget on the first three notes with nowhere to link. Stale
  now samples 60, and orphans count questions and searches separately. A dry
  run on the reference vault asks 3 questions where it asked 0.
• A linked picture no longer quarantines a whole .pptx. python-pptx
  raises ValueError for a picture linked to an external file, and the
  handler caught only AttributeError, so one linked shape quarantined a real
  8-slide deck four nights running. The read now sits inside the per-picture
  guard.
• brain update updates every project copy of a plugin, and a stopped
  update fails the deploy. A plugin installed at project scope has one
  registry entry per project; brain doctor read only the first and
  brain update ran claude plugin update at user scope, which fails when no
  user-scope copy exists. That stop happened before the workspaces were
  re-staged, and the release deploy phase passed anyway because a stopped
  update writes no before/after table (v0.20.39 left both workspaces on
  0.20.38). The doctor now judges every copy and lists the stale ones, the
  update runs once per stale copy from its project folder, and a report with
  no before/after table fails the phase.

Changed

• Documentation overhaul (2026-09-26). README.md is a front door again
  (what, why, one install path per surface, first search, update, where next)
  with absolute links so the PyPI page renders them; docs/README.md maps every
  shipped document by kind (how-to, reference, explanation, walk-through);
  docs/install/README.md is numbered steps per platform, with the explanation
  moved to docs/install/new-owner.md. Fact fixes across the install set:
  CLAUDE.md imports AGENTS-core.md, the maintenance task is named by its
  label, the Chat tab wires through brain connect or the .mcpb, seven links
  to files the public export drops are gone, and CONTRIBUTING.md carries the
  measured test count and a docs-with-the-change rule. The plugin manifests and
  the marketplace carry short, current descriptions plus homepage and
  repository; each plugin folder has a README that lists what it runs, sends
  and fetches; /brainiac-health resolves its script through
  ${CLAUDE_SKILL_DIR} so it works from a plugin install; pyproject.toml
  carries project URLs. Two closed-stacks s07 walk records under
  docs/operations/ (the owner-run protocol and its relayed transcript) no
  longer ship in the public export; the cutover-and-reversal runbook that
  brain doctor cites still does.