chore(release): bump version to 1.5.23 (XS)

[EtanHey]

Ships the P0 backup work. The installed keg cannot run it today.

Measured 2026-09-13 in the keg's own interpreter (/opt/homebrew/Cellar/brainlayer/1.5.22): jsonl_backup.py has 0 occurrences of _HashingReader / archive_id / md5Checksum; import brainlayer.backup_retention_invariant → ModuleNotFoundError. v1.5.22 = 6be4dacd (2026-09-08 20:53) and every P0 PR merged after it — scripts/release_tag_contains.py v1.5.22 815 820 824 → FAIL 3/3. So re-enabling com.brainlayer.jsonl-backup against 1.5.22 would exercise the pre-invariant code and log green. This release is the prerequisite for turning backups back on.

v1.5.23 will carry (v1.5.22..main, merges)

• 4b1e62a feat(backup): add verified opt-in iCloud leg #821 from EtanHey/wt/p2-icloud-leg
• e735ae2 Merge remote-tracking branch 'origin/main' into wt/p2-icloud-leg
• fab0d54 fix(backup): report upload only after verification #826 from EtanHey/wt/jsonl-status-truth
• a958bfe Merge remote-tracking branch 'origin/main' into wt/p2-icloud-leg
• 78c1d74 test(backup): harden survivor-copy retention guard #822 from EtanHey/wt/laneb-retention-guard
• 0cb037e Merge remote-tracking branch 'origin/main' into wt/p2-icloud-leg
• 48ab460 Merge branch 'main' into wt/laneb-retention-guard
• 5bb7b5b fix(backup): prove natural-state transcript bytes #819 from EtanHey/wt/p3-natural-state
• cee6fe3 Merge remote-tracking branch 'origin/main' into wt/p2-icloud-leg
• 286024f test(backup): make survivor-copy retention invariant structural #824 from EtanHey/wt/laneb-retention-guard-core
• b4cfe1c feat(backup): escalate after multiple missed backup nights #823 from EtanHey/wt/laneb-multinight-alert
• 9e482db Merge remote-tracking branch 'origin/main' into wt/p2-icloud-leg
• f66b88a Merge branch 'main' into wt/laneb-multinight-alert
• 3b6bff4 Merge branch 'main' into wt/laneb-retention-guard-core
• 0443e60 fix(backup): detect missing daily attempts #820 from EtanHey/wt/p818-root-cause
• dbba956 Merge origin/main into wt/p2-icloud-leg
• 0f90627 fix(backup): never treat a file as covered without a surviving archive object (S) #815 from EtanHey/wt/p0-retention
• c4a991a Merge remote-tracking branch 'origin/main' into wt/p0-retention
• 105dd47 test: isolate stale-index embedding baseline #816 from EtanHey/wt/bun-embedding-hygiene

Plus direct commits on main in that range (git log v1.5.22..origin/main = 73 commits). The release receipt will include the release_tag_contains.py v1.5.23 815 816 819 820 821 822 823 824 826 table after the tag exists — this body deliberately does not claim containment before the gate can measure it.

Cask lag — deliberate

Casks/brainbar.rb in the tap is 1.5.21; a BrainBar.zip exists on the v1.5.22 GitHub release and this tag will build a 1.5.23 one. The cask bump is a separate tap PR after the tag; BRAINLAYER_VERSION_CHECK_CASK_LAG_REASON was set for the version check. The keg install + release-verify-signatures.sh + --assert-module brainlayer.backup_retention_invariant gate happens before any service restart.

Test plan

• scripts/brainlayer-version-check.sh with tap root: four sites agree at 1.5.23; only the expected pre-tag "latest tag is v1.5.22" remains
• scoped pre-push gate passed on push

Bot policy

• AGENTS.md → @codex review; lead-routed Claude pair review; no Bugbot/Greptile.

@codex review — four version sites, no behavior.

— brainlayerClaude (lead) · claude-code/opus-5

---

Note

Low Risk
Version-metadata-only change with no behavioral edits in the diff; remaining risk is ordinary release/tag coordination, not code logic.

Overview
Bumps BrainLayer / BrainBar from 1.5.22 to 1.5.23 so packaging, MCP metadata, and the macOS app bundle report the same release.

Version strings are updated in pyproject.toml, src/brainlayer/__init__.py, server.json (server + PyPI package entry), and brain-bar/bundle/Info.plist (CFBundleVersion, CFBundleShortVersionString, BrainLayerReleaseVersion). No runtime or backup logic changes appear in this diff—it is the release cut that tags the already-merged work (including P0 JSONL backup / retention invariants) so the keg and services can run code newer than 1.5.22.

^{Reviewed by Cursor Bugbot for commit f46c1b1. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bump version to 1.5.23 across packaging and manifest files

Updates the project version from 1.5.22 to 1.5.23 in all metadata locations. This includes the Python packaging metadata, macOS app bundle info, server manifest, and the runtime __version__ constant.

^{Macroscope summarized f46c1b1.}

Summary by CodeRabbit

• Chores
  • Updated the application and package version to 1.5.23 across release metadata.
  • This release is now identified consistently as version 1.5.23.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_0254ba1f-4360-4de7-b797-874c563a7e89)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7431ade2-9552-4e78-830c-cbd4a70065dc

📥 Commits

Reviewing files that changed from the base of the PR and between 4b1e62a and f46c1b1.

📒 Files selected for processing (4)

• brain-bar/bundle/Info.plist
• pyproject.toml
• server.json
• src/brainlayer/__init__.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: signature parity (macOS keg)
• GitHub Check: swift (macos-15)
• GitHub Check: test (3.11)
• GitHub Check: test (3.12)
• GitHub Check: test (3.13)

🔇 Additional comments (4)

brain-bar/bundle/Info.plist (1)

12-12: LGTM!

Also applies to: 14-14, 16-16

pyproject.toml (1)

3-3: LGTM!

server.json (1)

6-6: LGTM!

Also applies to: 17-17

src/brainlayer/__init__.py (1)

5-5: LGTM!

---

📝 Walkthrough

Walkthrough

The change updates application and package version metadata from 1.5.22 to 1.5.23 across the bundle, project configuration, server metadata, and package runtime.

Changes

Release version alignment

Layer / File(s)	Summary
Update release version metadata brain-bar/bundle/Info.plist, pyproject.toml, server.json, src/brainlayer/__init__.py	All tracked application and package version values change from 1.5.22 to 1.5.23.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to f46c1

The release version metadata is consistently updated and the reported validation checks passed, so no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the release version bump to 1.5.23, which is the primary change in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch wt/release-1.5.23

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the version trail
Each number hops to 1.5.23
Bundle and package marks align
Server records follow in line
The release is ready to leap}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-13T18:16:45.238381Z	f46c1b1	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: f46c1b1293

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

BrainLayer ratchet

Every Value below was measured by this run. A row this machine cannot measure says n/a — <reason> instead of a number; baselines in Notes name their own machine, method and date and were not measured here.

Row	Status	Value (measured by this run)	Method	Notes
commit provenance	🟢 GREEN	measured f46c1b129359 == PR head · checkout 7dd2c411d025	commit graph + live PR head · in-process · runner	Which commit this whole table is about. On a pull_request event the checkout is GitHub's synthetic merge ref, whose sha is not on the PR — #759's table printed 13fa724278bf while that PR's head was 4632f979 — so this row names the PR-head parent instead, the sha a reviewer can actually see. The comparison sha is read live from repos/{owner}/{repo}/pulls/{n} when the table is collected, not taken from the event payload, because the payload cannot know the run has been overtaken. Residual window, stated rather than papered over: a push landing between that read and the comment being posted is not caught here — the run for that push refreshes the table.
baseline attestation	🟢 GREEN	baseline f421d1a7c5e6 matches the main attestation (run 34773198619 · main 4b1e62a56ca4 · 2026-09-13T17:58:58Z)	main attestation artifact via Actions API · in-process · runner	What every comparison is measured AGAINST, and who says so. The baseline fields of tests/fixtures/sprint_gate/corpus.json (queries, latency_baseline_ms, thresholds) are compared to the ratchet-attestation artifact of the latest successful push or (no-input) workflow_dispatch run of ratchet-attest.yml on main, fetched through the Actions API — a PR run cannot write to another run's artifacts. A field that differs is RED unless that main run measured the new value. The calibrated socket collector can license p50/p95; every absent measured path stays locked, so missing collection never passes as permission for a hand edit. Boundary: the comparator is this PR's checkout of ci_ratchet_table.py, diff-reviewable, not tamper-proof.
provenance	🟢 GREEN	stamped 7dd2c411d025 == HEAD, tree clean	wheel stamp · in-process · runner	Sha half of #749 keg-mode provenance: a keg built from this wheel can answer __build_sha__. The helper-age and served-process predicates need a running BrainBar and are measured only by scripts/sprint_gate.py on an installed Mac. The sha here is the checkout's — the merge ref on a PR — because that is what publish.yml stamps at release time; the PR-head sha this table describes is the one in commit provenance above.
fallback replay debt	⚪ n/a	n/a — no fallback queue on this machine: the pending memories live in ~/Gits/*/docs.local/decisions, and docs.local/ is gitignored, so a runner checkout has no copy of them to count	docs.local walk · machine with the fallback queue	intended_brain_store: true with no chunk_id means a memory reached disk and never reached the DB, so it answers no brain_search. Budget: 0. Any pending or unparseable file is a finding, never a band -- 122 of these sat from 2026-06-28 to 2026-09-05 because nothing counted them where a reader would look. Measured by walking the tree, so it is only ever measured on a machine that HAS the tree.
mapped bytes	⚪ n/a	n/a — no BrainBar daemon at /tmp/brainbar.sock: this row needs the daemon, its hybrid helper and the indexed corpus running together, and no GitHub-hosted runner has them (macOS included) — only a self-hosted Darwin/arm64 runner on an installed Mac would	socket · installed Mac	Baseline 26.2 GB — installed Mac, socket, 2026-09-03, after R2 drained 15,070 → 0. Up from 16.8 GB because the drain left more vectors mapped under the same cap: the change is the drain, not a leak. Not measured by this run.
search p50/p95	⚪ n/a	n/a — no BrainBar daemon at /tmp/brainbar.sock: this row needs the daemon, its hybrid helper and the indexed corpus running together, and no GitHub-hosted runner has them (macOS included) — only a self-hosted Darwin/arm64 runner on an installed Mac would	socket · installed Mac	Margin p50: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Margin p95: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Calibrated on MacBook-Pro.local at 2026-09-01T08:42:22Z under active_sprint_load (tests/fixtures/sprint_gate/corpus.json). Not measured by this run.
idle CPU	⚪ n/a	n/a — no BrainBar daemon at /tmp/brainbar.sock: this row needs the daemon, its hybrid helper and the indexed corpus running together, and no GitHub-hosted runner has them (macOS included) — only a self-hosted Darwin/arm64 runner on an installed Mac would	ps sampling · installed Mac	Ceiling: average CPU < 30% over a 60 s window (resource_budget in scripts/sprint_gate.py), ratified and kept as a hard budget. Margin daemon: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Margin helper: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Margin watcher: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Needs the BrainBar daemon, helper and watcher actually running. Not measured by this run.
signature_valid	🟢 GREEN	442 valid / 0 invalid · brainlayer 1.5.22 · macos-15/ARM64 · brew install exited non-zero (outcome: failure); the keg installed and the sweep ran after it	codesign · brew keg · GitHub macOS runner	scripts/release-verify-signatures.sh <keg> codesign-verifies every *.so/*.dylib under libexec/venv. The macOS parity job installs the published tap formula (etanhey/layers/brainlayer), so this row measures the release path — formula, published sdist and Homebrew's relocation — and not this PR's tree. Release-time baseline for the same keg on a different machine: 442 valid / 0 invalid — installed Mac (M4 Max), brew --prefix brainlayer 1.5.11, 2026-09-03.

🟢 GREEN measured, within budget · 🔴 RED measured, out of budget — a finding to clear before merge · ⚪ n/a not measurable on this machine, never guessed.

No RED rows.

Measured on Linux/x86_64 · measured f46c1b129359 · PR head f46c1b129359 · checkout 7dd2c411d025 · run · updated 2026-09-13 18:26:17 UTC