v7.80.0

Pairs with engine-service-v0.1.160 (REQUIRED_ENGINE_VERSION unchanged). Eight nexus MCP tools load eagerly and the rest through Claude Code's tool search, which makes a session's first request 41% smaller. On Windows, files nx and the plugin hooks read or write as text are UTF-8, output from the programs they run is decoded correctly, and subagents and new sessions get the Knowledge Map. The Windows install guide covers WDAC (App Control for Business).

Changed

• Eight nexus MCP tools load eagerly in Claude Code and the other 36 are found through tool search (nexus-fbtyl). nx-mcp marks search, query, memory_get, memory_put, memory_search, scratch, store_get and store_put with _meta["anthropic/alwaysLoad"]: true in tools/list (ALWAYS_LOAD_TOOLS in nexus.mcp.core), and conexus/.mcp.json no longer sets alwaysLoad on nexus. A server-level alwaysLoad: false would override the per-tool flags and defer everything, so the key is removed. Measured on Claude Code 2.1.300 (T2 nexus/nexus-tools-eager-vs-deferred-ab-2026-10-14): the same tool choice and success as all-eager with a 41% smaller first request; all-deferred lost the memory tasks. scripts/mcp_wire_snapshot.py now records each tool's _meta.

Fixed

• Subagents and new sessions get the Knowledge Map on Windows, and wherever NEXUS_CONFIG_DIR is set (nexus-3fme8). The SubagentStart and SessionStart hooks read the map that nx context refresh writes as UTF-8 with the locale encoding, cp1252 on Windows, so a label with a non-ASCII character dropped the whole map without a word. Both also looked under ~/.config/nexus while the map is written under NEXUS_CONFIG_DIR when that is set. The plugin's version-lockstep and endpoint scripts, nx's plugin lockstep and the RDR hook's .nexus.yml read now read their files as UTF-8 too.
• Every file nx and the plugin scripts read or write as text is UTF-8 on Windows too (nexus-ox0c0). 154 calls across src/nexus and the sn plugin's hook scripts named no encoding, so on Windows they used the ANSI code page (cp1252 on an English install): config and .nexus.yml files, receipts, markers, the logon task definition and the log files. A non-ASCII character, such as one in a user's home path, was written in cp1252 or raised on read. They now name UTF-8, which changes nothing on macOS and Linux. A new lint test (tests/test_text_io_encoding_lint.py) fails on any new text-mode call without an encoding.
• What nx reads from the programs it runs is decoded by the program that wrote it, not by the Windows ANSI code page (nexus-ikoqj). 22 subprocess calls in src/nexus and the plugin hook scripts asked for text with no encoding, and the shared run_bounded helper did the same for about 65 more callers, so on an English Windows install the output of git, uv, nx and bd was read as cp1252: a non-ASCII path or message came out garbled or raised. run_bounded now takes encoding and errors and defaults to UTF-8, which is what those programs write. The calls to schtasks, a native Windows tool, read its output with the locale's encoding and replacement, since forcing UTF-8 there would garble it. The one bare Python child whose output can hold a name (the console-script lookup) is started with PYTHONIOENCODING=utf-8 and read as UTF-8. Nothing changes on macOS and Linux. A new lint test (tests/test_subprocess_text_encoding_lint.py) fails on any new text-mode subprocess call without an encoding, and on a **kwargs unpack it cannot read.

Developer workflow

• A subagent may run one ssh command to the chas test host whose git runs in chas's own clone (nexus-yc7fs). The conexus subagent git-write guard exempts ssh chas-test '<git write>' when it is a single ssh to a chas alias, uses only plain literal characters outside single quotes, limits its options to -n -q -t -T and four -o Key=value settings, and names no onward hop. Use ssh -n in place of </dev/null.

Documentation

• docs/windows-install.md covers WDAC (App Control for Business) (nexus-f9bgu.53). With Microsoft's DefaultWindows_Enforced policy and ten path rules for the install's folders under the user's profile, a standard account installs from the guide and the Phase 5 gate passes 5 of 5 on Windows 11 Enterprise with nothing signed. The section lists the rules and the policy options, and what was not measured.