v1.98.0 - Installed Rules and a Gated Improvement Loop

Open Second Brain v1.98.0 - Installed Rules and a Gated Improvement Loop

Open Second Brain v1.98.0 is the agent-presence and self-improvement release: the vault now states its usage in the very files the installed agents read, and its skills improve only under evidence. Until now, the brain-usage block existed as text an operator had to place by hand in whichever file each host reads, dream lessons had no operator-gated exit into those same files, and a skill rewrite proposal faced no benchmark between a suggestion and an overwrite. Now o2b install --target <host> --apply writes the brain-usage managed block into the vault-root agent-instruction file each host reads through a shared writer that preserves every byte outside the block and records what it owns; operator-approved lessons land in a sibling managed block with every approval pinned to the approved text's content hash; and a skill is rewritten only after a candidate beats the incumbent on scored dev tasks with full coverage and survives the one held-out check, the accept staying an operator step on the command line while the incumbent's bytes ride a content-restoring rollback journal. And ChatGPT desktop is named where its operators look for it: it reads the shared Codex config, so one install serves both hosts.

What ships

• The installer writes the brain-usage block into the agent rules files. o2b install --target <host> --apply for a host that reads an agent-instruction file now also writes the canonical write-gate managed block at the vault root - AGENTS.md for codex, cursor, opencode and aider, GEMINI.md for gemini-cli - mapped through the one host-precedence table, while copilot-cli, grok, kiro, pi and generic install no instruction step and the plan says so with a named skip. Every byte goes through the shared rules-block writer, never a direct write: operator content outside the block is preserved byte-for-byte, the first write takes an exclusive-create backup, a re-apply is a byte no-op, and a hand-edited block refuses user-modified-block with exit 4 unless --force. The apply is bound to the approved preview and refuses preview-drift when anything the consent was shown has moved, and the instruction write rides the same consent verdict as the adapter's config writes - one prompt above both. Ownership lands in the vault's instruction-block lock - per file, the block id, the begin marker and the applied time - and that lock is what o2b uninstall --target <name> --apply reads to remove exactly the recorded pair; an absent pair is a named skip and the entry is cleared either way.
• Operator-approved lesson promotion into the lessons block. o2b brain lessons candidates | approve <pref-id> | deny <pref-id> | refresh-blocks turns the dream pass's lessons into content the installed agents actually see, behind the operator's hand. A lesson qualifies only under the full conjunction - preference-derived, the preference confirmed, high confidence, preferred tier in the current digest, an explicitly enabled promotion scope, and a fresh approval - and the approval ledger pins the content hash of the text the operator approved, so the operator approves text and not an id, and a preference whose text has moved since drops from the block until it is approved again. Every non-member carries exactly one named blocked reason, an operator denial dominating, and the block body is a deterministic render - no timestamp, ordered tier, then scope, then id - where every rendered lesson is provably one line that cannot forge a managed-block marker. approve writes through the same shared rules-block writer on its consent ladder into the named target files, and refresh-blocks re-renders existing blocks dry-run by default and never creates one. The approval ledger is machine state in the derived store, deliberately outside Brain/, so an agent cannot read its own approval state as a note surface; the doctor's fail-soft, read-only readiness check grades each managed lessons block against the same derivation a refresh would render - absent, current, drifted, stale-lessons - every finding names the verb that heals it, and the brain status snapshot carries the approval counts report-only, with machine paths staying out of MCP output.
• Benchmark-gated skill rewrites: a skill is rewritten only under evidence. A per-skill task set lives vault-side at Brain/skill-benchmarks/<skill>/tasks.json with its frozen receipt, o2b brain skill-proposals rewrite-plan <skill> verifies the set against the receipt and prints it with the dev envelopes, the calling agent executes and submits the transcripts, and rewrite-score grades them. Open Second Brain never calls a model - the envelopes are needs-llm-step payloads, dev members only until the single held-out check - and the scorer validates the submitted shape and grades structural predicates only, refusing a submission that carries a self-reported success field, so nothing the agent claims about its own work can move the metric. Every transcript is bound to the candidate body it was produced against - each envelope carries the candidate's sha-256, and a transcript whose binding is missing or stale is refused by name. Selection is the preregistered three arms, and coverage is part of the preregistration: a short arm answers not_enough_evidence, the honest outcome either way, and the held-out gate runs once, on the full held-out membership only, on the candidate that earned promotion - a miss downgrades it, and a refusal writes nothing. The winning candidate stages as a scored_rewrite proposal whose acceptance is the operator's step: MCP never accepts one, the CLI accept requires --yes and re-verifies the live receipt and the scored contract at accept time, and the incumbent's bytes are captured to a prior-content copy before the overwrite, so the journal's rollback restores content and not just existence. A read-only MCP status tool mirrors one skill's lane - ids and rates only, never task or transcript text - and an optional judge command stays advisory, never moving the metric the gate decides on.
• ChatGPT desktop is named as a reader of the shared Codex config. ChatGPT desktop registers no MCP servers of its own; it reads the $CODEX_HOME/config.toml file the codex target writes, so one o2b install --target codex --apply serves both hosts and one uninstall undoes it for both. The codex adapter's detect note names ChatGPT desktop on the CLI-absent lane - the lane where an operator with only the desktop app would otherwise have no surface telling them this target is theirs - and the README and plugin host tables and the codex install guide gain the section. There is deliberately no ChatGPT install target id: a second target for one config file would claim bytes the codex target owns and report them as drift.
• Docs. docs/cli-reference.md gains the o2b brain lessons family and the rewrite-plan / rewrite-score forms, states the instruction-block step on the install and uninstall rows and the lessons-block doctor checks on the doctor row; docs/mcp.md documents the read-only rewrite status tool; docs/observability.md names the lessons log events and the rewrite-eval metric; install/codex.md gains the ChatGPT desktop section; docs/cross-project-pointer.md names the installer as the managed way to keep the block written; the README host tables name ChatGPT desktop.

Process wins

• One source per fact: every What ships claim traces to the 1.98.0 CHANGELOG entry or the merged PR #286 description, and the quality numbers come from the PR's own verification section, never estimates.
• Review ran over the whole branch against its merge base with main: 5 verified findings fixed in conventional commits with regression tests where behavior changed, 15 declined with recorded reasons; a focused security review closed with no branch-introduced open findings and is summarized here in neutral terms only.
• Quality record: 21,805 tests / 0 fail (24 skipped, windows-only) across 1,758 test files at the final review-fix head, formatter clean, TypeScript clean, lint at 0 errors, version 1.98.0 stamped across all manifests, and the openclaw bundle rebuilt with the CI-pinned Bun and re-verified byte-identical on the second build.

Notes

• The held-out check is one-shot by design: a refusal writes nothing, because a hold would record a verdict the check never earned and would leak which held-out tasks fail; a staged rewrite is a proposal, never a write, until the operator accepts it on the command line.
• The gemini-cli mapping to GEMINI.md is name-implied only - the open question the precedence table's docblock already carries - and a file with no brain-usage block at all stays graded skipped by the readiness probe, not failed.
• The version bump to 1.98.0 shipped inside the PR (#286), per the project rule in CLAUDE.md.
• Release image: the canonical terminal style, here as an interaction diagram (animated GIF in this body; static PNG, 2x PNG and the SVG source attached as assets).