v1.92.0 - Write-Time Honesty and Egress Consent

Open Second Brain v1.92.0 - Write-Time Honesty and Egress Consent

Open Second Brain v1.92.0 makes the write path and the egress path keep the promises the rest of the system already made. A page could carry its privacy claim only in the informal spelling its author happened to use, a chunk longer than the embedding model's declared input window was cut and indexed as text the page does not contain, a person was reachable only through the exact spelling the vault declares, a count or an amount could land with no date it could come from, a prompt-driven write left the vault indistinguishable from an operator-authored one, and a configured decline of semantic search read exactly as never-configured. Now the informal privacy markers resolve to the reserved remote-deny token at every remote read root with a preview-first verb that makes the claim formal, the fifth page-lint detector asks every count and amount for its date, prompt-driven writes carry a server-stamped content class the shared exports exclude by default while naming every omission, over-window chunks are held out of embedding under a persistent record that releases when its premise moves, people resolve through derived name forms that never displace a declared spelling, and a provider decline is a persisted, fail-closed decision honored before any network call.

What ships

• Informal privacy markers resolve to the reserved remote-deny token at every remote read root. A page saying access: private, confidentiality: secret or sensitivity: confidential was already withheld from a remote caller, but every consumer that reads visibility: directly - a derived page stamped through the strictest-visibility fold, an export filtering on the token, an operator auditing reservations - could not see the claim; search results, vault page lists and the indexed snippet column now answer the same deny the formal key would, and o2b brain privacy-marker-restamp makes the claim formal - dry run by default, --apply to write - unioning the token into visibility: additively and idempotently, re-reading each candidate immediately before its write, refusing by name a page whose frontmatter cannot be rewritten losslessly, never removing a token and never re-embedding. A doctor finding counts the still-unstamped marker pages, and update_note refuses changes to the three marker keys exactly as it refuses changes to the reserved visibility key, so the informal spelling cannot be removed from a page whose reservation depends on it.
• A chunk that cannot fit the embedding model's declared input window is held out of embedding instead of silently truncated. The serving stack used to cut such a chunk to the window, so the index held an embedding of text the page does not contain, with nothing on any surface saying so; a provably over-window chunk is now skipped and recorded under a persistent hold keyed by the model, the window and the chunk signature, released automatically when any of the three changes, excluded from the pending-vectors census so no backfill is recommended for text this configuration cannot embed, and reported in a bounded held_chunks list on o2b search status --json and in a doctor check, so the state is visible without reading the index.
• Person entities resolve through derived name forms, with a declared spelling always outranking a derived one and ambiguity reported instead of guessed. A first-initial-plus-surname form and the word-order variants of a multi-part name join operator-supplied nicknames read from Brain/entities/person-nicknames.json - nothing ships a built-in word list; the forms answer in query expansion and in registry lookups, a match on a declared name or alias outranks a match only a derived form reaches, a derived form that matches more than one person refuses and names the competing ids, write lanes stay exact-only, and a doctor warning names a derived variant that collides with another person's declared name.
• A fifth write-time page-lint detector warns when a count or an amount is written with no date it could come from. The recognized shapes are structural, never natural language - a currency amount by symbol or ISO code, a percentage, a number with a unit from the declared set, a bare thousands-separated count - a page that supplies a date anywhere the quantity could take one stays quiet, the finding carries the matched lexeme and its offset rather than the authored line, and each finding names o2b brain claims as the next command, where the quantity can be placed in time.
• Prompt-driven writes carry a server-stamped content_class: prompt-derived, and every shared export leaves those pages out by default. The stamp lands at creation on the deterministic prompt-driven paths - a note write over MCP, the session import, the in-process report writers - and is derived by the writer rather than accepted from the caller: a caller-supplied value is dropped, an operator-authored CLI write stays unmarked, and no path removes the stamp afterwards; the bank, graph, OKF and knowledge-pack exports exclude class-marked pages by default and name every omission with the page's path and class, --include-prompt-derived carries the pages back in and says so on the run, and the knowledge pack always blocks class-marked pages, naming them in its blocked list.
• A provider decline is a persisted, fail-closed record honored before any network call. search_semantic_enabled=false and embedding_provider=disabled used to reach the same capability verdict as a machine that had never configured semantic search at all; a decline written in the configuration is now a record of its own, an unreadable or unparseable record is a decline rather than consent, the verdict is honored at provider construction before a request is built with the refusal naming the keys that record it and the keys that would re-enable the provider, and o2b doctor --readiness gains a consent probe that reports the decline as a decision and lists provider environment variables by name only.

Process wins

• One source per fact: every What ships claim traces to the 1.92.0 CHANGELOG entry or the merged PR #273 description, and the quality numbers come from the CI run at the merge commit, never estimates.
• Review ran over the full branch diff and closed what it raised with regression tests before merge: the opus OCR round triaged 81 findings into 30 real fixes, 1 stale, 4 recorded follow-ups and 46 declined with verified reasons, a delta round over the fix range came back clean after three reconciliations, and four read-only passes, a codex pass, a security review and a mutation-based test audit ran beside it. The diff exceeds 100 files, so CodeRabbit skips this change set and the OCR delegation round is the compensating review.
• Quality record: 20,395 tests / 0 fail at head 5572997, the exact content this release tags, on the CI-pinned Bun 1.4.0, the architecture censuses green at 391 tests, TypeScript clean, lint at 0 errors, version synced, and all 20 CI checks green.

Notes

• The review's four shipped defect fixes ride the Fixed entries: an OKF bundle now carries its reserved index.md and log.md with the index re-rendered from the filtered manifest, the relational arm reads the indexed visibility column at remote reach, the undated-quantity exclusion scan is order-independent, and a research report page carries the prompt-derived class stamp; the finding that informal markers were erasable over MCP update is closed inside the markers capability.
• The era boundary is documented, never migrated: pages written before this release carry no content-class mark and export exactly as they did, because a stamp applied by a later pass would describe the pass and not the writer.
• The egress consent-stamp primitive that ships beside the decline record declares no destination of its own, adds no egress registry row and leaves every network path in this release unchanged; its kill switch is presence-based (OPEN_SECOND_BRAIN_EGRESS_CONSENT_KILL).
• The version bump to 1.92.0 shipped inside the PR (#273), per the project rule in CLAUDE.md.
• Release image: the canonical terminal style, here as an interaction diagram (animated GIF in this body; static PNG, 2x PNG and the SVG source attached as assets).