2026.7.17

Adversarial audit hardening

We ran an adversarial audit across the whole codebase — assuming bugs exist, hunting each subsystem separately, then simulating real journeys across module boundaries (the seams that pass every single-module test). It surfaced real pre-beta issues, most invisible to a green test suite; all confirmed ones were reproduced against real production code (and, where possible, a live model) before and after the fix.

Security

• Read-only shares no longer leak your data. A read-scope share link could reach nearly the entire read surface — your decision profile, file list, chat history, conversations, decision audit. The audience gate was an opt-in deny-list on two endpoints; it's now a global default-deny allow-list (a share sees only the intended recall face). Full-scope own devices are unaffected.
• run_command sensitive-path floor hardened. Direct reads of secrets (config.yaml, the console access token, .ssh, cloud creds, browser cookies) were already blocked by the capability layer, but the OS-layer sandbox floors had gaps on macOS/Windows; unified the macOS deny-list to a single source and added a defense-in-depth preflight.

Your data stays yours (the moat)

• Human-confirmed memory is never silently overwritten. The memory system ranked things you fed and confirmed below things it guessed from chat — so a casual guess could quietly overturn a fact you'd committed to, and even something you'd pinned. Now your confirmed/pinned knowledge outranks guesses, and when a genuine conflict arises with something you confirmed, it raises a decision card that shows old-vs-new, tells you when you confirmed the old one, and lets you keep old / adopt new / keep both. Low-confidence guesses can't raise a card (no nagging) and can't be auto-resolved by an earned silence.
• Fixed dead-belief chain invalidation, cross-domain isolation in the invalidation layer, and four untracked token-usage sources.

Reliability & correctness

• Decision replay now shows the actual steps. The "how this decision was built" timeline's execution-step view was always empty in production due to a run-id nesting bug; it now shows the real tool steps.
• Missed scheduled tasks can never auto-run. The catch-up card for a task you missed while away is now hard-excluded from silent auto-execution — it always asks you.
• Honest import UI. Importing a pure-executor or skill-like agent no longer falsely claims "added to your Role Library" — it tells you exactly what landed.
• Sturdier under load. Concurrent chat pushes no longer drop a live connection; the decision audit log and revocation table now survive a crash mid-write.
• Model config no longer silently loses settings. Editing a model kept resetting its reasoning flag, dropping its reasoning styles, and a USD-budget save was wiping token limits — all fixed (absent-means-preserve). OpenAI-compatible endpoints with /v1beta or /openai roots now self-heal.
• Weekly digest is bilingual — its body was hardcoded Chinese; English users now get an English report. And --no-llm mode gets its trace store so the digest actually runs.

Full suite green (4,300+ tests) and five-leg CI passing. The cognition memory-integrity changes were independently adversarially re-verified (real repros + a live model) before shipping.