v1.0.0 - Stability & Trust

Open Second Brain v1.0.0 - Stability & Trust

The first major release turns eleven cycles of accumulated capability into a commitment: the public contracts - the MCP tool surface, the CLI verb tree, configuration keys, the search schema ladder, and every on-disk schema string - are now frozen under an explicit stability policy, and the one breaking change a major version allows is spent deliberately on deleting the 18 hidden alias tools left over from the token-diet consolidation, replaced by tombstones that answer a stale call with the exact replacement tool and view. Around the freeze ship four hardening layers that make the version number an earned label rather than a milestone: cooperative timeouts with clean abort semantics on every long-running pass, a validate-before-apply staged lifecycle for the self-improvement loop, timezone-aware presentation over storage that stays canonical UTC, and self-comparing reports that answer "what changed since last run" deterministically.

What ships

• API freeze + deprecation sweep. The 18 hidden aliases (10 brain views, 8 schema views) are removed; the advertised tool list and the callable surface are now the same 77-tool set. Calling a removed name answers an INVALID_PARAMS tombstone naming the replacement (brain_digest was removed in 1.0.0; call brain_brief with view="digest"), brain_doctor flags stale references in vault notes, root instruction files, and installed skills, and docs/updating.md carries the full migration table. The policy itself lives in docs/stability.md: what is frozen, what counts as breaking per contract class, and what stays deliberately unfrozen.
• Operation safeguard. Every long pass - dream, index, reindex, bridge discovery, communities, the maintenance lane - runs under a cooperative deadline checked at natural iteration boundaries (per file, per embedding batch, per candidate, per sweep, per lane task). Bun runs SQLite synchronously, so the safeguard is honest about what it can do: abort BETWEEN atomic writes, never a fake async cancellation around work that keeps running. Budgets resolve safeguard_timeout_<op>_seconds -> OPEN_SECOND_BRAIN_SAFEGUARD_TIMEOUT -> safeguard_timeout_seconds -> 600s, 0 disables; lane task results classify timed_out and persisted error strings cap at 4096 bytes with an explicit marker.
• Staged dream pipeline. o2b brain dream stage persists the next learning pass as a reviewable, discardable bundle under Brain/dream/staged/<run-id>/ - a manifest (schema o2b.dream-stage.v1), a human-readable REPORT.md, the scanned sources with content hashes, and the planned mutations as data. validate recomputes the clock-normalized plan and reports drift; apply re-validates with the clock it runs with and then executes the one and only promotion engine, so the reviewed plan and the applied plan cannot diverge; discard drops the bundle without a trace. MCP rides the existing brain_dream tool via an action parameter - the 1.0.0 surface adds zero new tools. Stage and apply publish dream_stage records into the Brain/metrics/ dashboard layer.
• Timezone presentation layer. With timezone: configured (env VAULT_TIMEZONE), brief and analytics envelopes gain additive timezone + local_time fields and human output renders the operator's wall clock; storage, frontmatter, log headings, and run ids remain canonical UTC everywhere.
• Dual-output reports. With report_snapshots_enabled, each digest / daily / weekly run persists a machine-diffable snapshot (Brain/reports/<surface>/<date>.json, schema o2b.report-snapshot.v1) and reports a deterministic delta against the previous one - objects diff by key path, object arrays by stable identity, primitive arrays as sets, so array order never fabricates a change - as a delta JSON field and a "Since last run" block.

Process wins

• The advertised surface and the callable surface are the same set: no shadow API survives into 1.0.
• Migration knowledge ships inside the error message, the doctor report, and the docs - a stale client cannot get lost.
• A vault that configures nothing behaves identically to 0.45.0, except calls to the 18 removed aliases - the one documented break.
• Quality record: 4248 tests / 0 fail (552 files), TypeScript clean, lint baseline 111/0, Python 61/61, the OpenClaw bundle gate green, an independent reviewer pass (one determinism bug found and fixed pre-merge), and one CodeRabbit pass with all 13 findings applied - including a path-traversal guard on bundle ids.

Notes

• Breaking change: only the 18 alias removals. Full table: docs/updating.md. Everything else is additive and opt-in.
• The staged dream lifecycle and report snapshots extend the Brain/metrics/ machine-readable layer introduced in v0.45.0 - the contract the upcoming dashboard plugin reads.
• Release image: the new terminal-style overview (animated GIF in this body; static PNG and the SVG source attached as assets).