OCBrain v1.1.0 — Verifiable context from a fresh brain

OCBrain v1.1.0 — Verifiable context from a fresh brain

v1.1.0 makes a clean installation easier to prove, keeps hosted delivery
explicit, and strengthens the stable ocbrain.context.v1 contract without
adding a background service or hosted dependency.

Fresh-brain onboarding

• The tracked examples/hosted-context-demo manifest contains four public,
  synthetic OCBrain facts for a real context -> source acceptance turn.
• curated-apply verifies every named source hash before writing evidence,
  proposal, and approval events. It prevalidates the complete manifest and
  rolls the entire apply back if any fact fails.
• A manifest containing hosted_ok facts is refused atomically unless the
  operator supplies --allow-hosted-egress. Confidential and secret facts
  cannot use that policy.
• OpenClaw remains optional. Python 3.11+, Git, and one compatible local stdio
  MCP client are sufficient on macOS or Linux; WSL remains expected but is not
  part of the dated release-acceptance proof.

Retrieval and delivery

• Retrieval can combine FTS5 lexical matches with an optional local Ollama
  vector sidecar using reciprocal-rank fusion.
• The sidecar is derived and replaceable. Missing, stale, incompatible, or
  unavailable vectors fall back to deterministic lexical retrieval.
• Hosted-model delivery is selected by the MCP server, not by tool arguments.
  It excludes local_only, prohibited, confidential, and secret objects before
  ranking or packet construction.
• Coverage now reports mutually exclusive current-serving inventory counts for
  scope exclusions, delivery exclusions, and eligible objects without listing
  excluded hosted IDs or content. These exact, query-independent counts do
  disclose the cardinality of each category.
• Context packets are bounded to 32 KB, with bounded excerpts and source
  handles. Hosted source expansion uses ocbrain:// URIs rather than local
  filesystem paths.
• Explicit cross-scope retrieval now issues verifiable source handles under the
  same opt-in gate; source expansion still requires context matching the
  source's own scope.

Golden contract and public project hygiene

The public synthetic golden dataset drives real MCP brain.context and
brain.source calls across positive, negative, scope-isolation, cross-scope,
hosted-delivery, contradiction, source-hash, and wrong-scope-denial cases. CI
runs this focused contract before the complete test suite. It is explicitly a
test fixture, not harvested user data or training input.

This release also adds the contribution and security policies, pull-request
and issue templates, code ownership, public CI, a clone-to-first-smoke guide,
and clearer storage guidance. The SQLite core is owner-restricted but remains
plaintext at rest; use host or full-disk encryption when the threat model
requires encryption.

Unchanged authority boundaries

The core remains on demand and dependency-free at runtime. It starts no
scheduler, timer, watchdog, hosted judge, trainer, or background loop. Agent
ingest records evidence but cannot directly promote serving beliefs. Durable
authority remains the append-only event chain, explicit scope and provenance,
human decisions, retrieval receipts, source handles, feedback, and closeouts.

OCBrain v1.0.1

OCBrain v1.0.1 — Hardened shared context

v1.0.1 keeps the v1 event-authoritative architecture and eight-tool runtime
surface, while hardening the boundaries that matter when the evidence lake and
client fleet grow.

Portable evidence, explicit authority

export-bundle creates a fresh owner-only JSON file from an explicit evidence
allowlist. Scope and egress policy are enforced before publication, secrets are
redacted, approval-gated evidence requires --approve-egress, and every export
records an audit receipt. local_only and prohibited evidence cannot leave.

import-bundle is validation-only unless --apply is supplied. It validates a
strict envelope and canonical payload hash before opening SQLite, ignores
sender ids as authority, derives local content ids, writes one transaction, and
forces imported evidence to confidential plus local_only. It never imports
beliefs, retrievals, closeouts, schedules, training state, or operations state.

Import and secret safety

• JSON, escaped JSON, assignments, namespaced environment keys, camelCase
  credential keys, private keys, and common provider tokens are redacted before
  truncation.
• Credential-shaped files are denied, hidden descendants are skipped during
  broad sweeps, and symlinks cannot escape a selected directory or disguise a
  hidden target.
• History head/tail windows are produced by a streaming redactor, so a large
  transcript is not reread into memory in full.

Lifecycle, scope, and storage safety

• A late approval cannot resurrect a belief that was tombstoned, retracted, or
  corrected after its proposal; full projection rebuilds preserve the same
  constraints.
• Client confidentiality and local_only egress survive more specific
  task/session/repository scope resolution.
• Database initialization drops only exact retired OCBrain table shapes, never
  unrelated application tables with generic names.
• Local pointer and configuration files must be owner-only; doctor and runtime
  checks fail visibly when permissions are too broad.

MCP process safety

Malformed frames and invalid parameter shapes receive protocol-correct errors;
malformed notifications remain response-free. A launcher started through the
active-core pointer rechecks that pointer for every request and exits on drift,
preventing an already-open client from silently writing a database that is no
longer active. Explicit OCBRAIN_DB launches remain intentionally pinned.

Acceptance gate

The release gate requires the complete test suite, Ruff, bytecode compilation,
tracked-tree public-safety scanning, fresh builds of all three distributions,
clean-environment package and bundle round trips, and new Codex, Claude Code,
and OpenClaw acceptance turns against the same activated database. Hosted
judgment and training remain disabled; the named-human audit is still required
before any pilot training.

The source and artifact gate passed on 2026-07-13: 676 tests, Ruff, bytecode
compilation, public-safety scanning, six fresh distributions, Python 3.12 clean
installation, package isolation, an installed eight-tool MCP probe, and a
two-database evidence-bundle round trip all passed.

OCBrain v1.0.0 — Shared Context core

OCBrain v1 is the on-demand shared-intelligence bridge for Codex, Claude Code,
OpenClaw, and compatible MCP clients.

Highlights:

• fail-closed hosted judge/embed/teacher authority and retired recurring jobs;
• stable Shared Context packets, bounded hash-verified sources, explicit
  retrieval feedback, and append-only closeout receipts;
• one event-authoritative core with deterministic projections;
• archive-first, fresh-path-only migration that never edits or activates the
  source database;
• optional, physically separate ocbrain-training and ocbrain-ops packages;
• fresh Codex, Claude Code, and OpenClaw release acceptance against the same
  verified core.

Release gate: 632 tests, Ruff, compileall, public-safety scan, clean Python 3.12
installs, wheel inventory checks, non-empty installed migration, SQLite/FK
verification, and real three-client MCP round trips.

Wheel SHA-256:

• ocbrain-1.0.0-py3-none-any.whl — b79d38407a5d0bb15bedcd8e18c9184d09351c8b9be6445d567a7c889e9f9fb5
• ocbrain_training-1.0.0-py3-none-any.whl — 570637a476aa35b02305ff02ca44d9ad1f67fe612feb31c86afa2eca3c2c05fb
• ocbrain_ops-1.0.0-py3-none-any.whl — a63899f30e7240c57d972b88a96260a0e48708ddc1192ecb2239ac9ca03d040d

Training remains blocked until the required named-human audit is complete and
a separate local training opt-in is enabled. This release does not claim PyPI
publication.

ocbrain v0.4.0 — Learning Quality

ocbrain v0.4.0 — Learning Quality

The dataset is the product, retrieval feedback is the flywheel, and an evaluated
personal model is the destination. v0.4.0 makes those statements enforceable
instead of aspirational.

Retrieval now records the query, runtime, session, and complete served-id set.
Explicit feedback remains the preferred signal; a conservative same-session or
exact-id rule can infer an outcome without pretending it was human feedback.
Repo-scoped source retrieval demotes catalog stubs, ranks explanatory sections
instead of orphan headings, redacts returned text, rejects probable injection,
and attaches a source hash. The private, byte-frozen 100-case benchmark covers
Codex, ChatGPT, Claude Code, and OpenClaw, including negative and injection
probes.

The MCP contract is safe across current provider styles: optional inputs are
required-but-nullable, objects reject unknown keys, and explicit nulls are
stripped once at dispatch. An OpenAI-family caller can now say “unused” instead
of inventing a plausible repo, scope, flag, or limit.

The corpus has a real weights-versus-memory boundary. Every row is classified
as train_voice, train_judgment, train_skill, retrieval_only, or
exclude; unverified persona authors and injection-flagged rows cannot cross
the training boundary. dataset-pack-select creates a deterministic bounded
candidate pool, local grading targets only that pool, and
dataset-pack-finalize keeps a deterministic passing pack. Pilot preparation
refuses to train unless 100% of the final pack has a local grade and the
passing pack contains at least 1,000 skill, 300 authentic voice, and 200
judgment examples. One hundred separately graded voice rows supply the expanded
evaluation without consuming the training minimum. The original twenty
evaluations remain a byte-for-byte sentinel, and the expanded protocol supports
blind base/tuned/Jonathan/frontier comparison.

The prepared training command remains deliberately unexecuted until a human
audits a deterministic stratified 10% of the final three-class pack. Local
grading decides eligibility; it does not manufacture human approval.

The local judge gate uses a separate human label file with named provenance.
Its rubric now preserves the operator's preference for compact editable answers,
requires a useful reason where it matters, rewards quantified uncertainty
without fake precision, and rejects fictional claims whose assumptions are not
made explicit. Human labels and the 90% gate are immutable inputs; the grader is
fixed when it disagrees.

Reliability is tighter too. Dataset miners prepare rows without owning SQLite's
single-writer slot, then commit ordered batches of at most 50 operations or two
seconds. Lock failures and hosted-judge timeouts retry only inside the existing
stage deadline. Stallcheck pages partial/failed/stale runs and judge failure
streaks, and an optional daily pager canary tests the notification path. A
quarantined row can now be released only by an explicitly human actor.

docs/CONTRACT.md is canonical: routine knowledge compilation is autonomous;
ocbrain never executes agent work; and human authority is required for scope
widening, quarantine release, destructive action, and unapproved external
egress.

Dated verification snapshot

On 2026-07-10, the unchanged frozen 100-case retrieval file reached 100/100
top-five relevance on the default local brain. A 1.9 GB online
verification copy also reached 100/100 top-five relevance and 99/100 overall;
the sole miss was one cold query at 1.695 seconds against a 1.5-second latency
budget, not relevance, citation, or scope. Citation and privacy-scope checks
were 100% in both runs.

The dated post-migration instrumented cohort has 21 outcomes for 22 interactive
retrievals (95.5% coverage), above the 70% flywheel gate. This deliberately
excludes background excerpt rendering and does not relabel legacy served rows
to make the historical percentage look better.

The dated copy classified 53,809 rows: 5,477 train_skill, 1,162
train_voice, 935 train_judgment, 5,238 retrieval_only, and 40,997
exclude. Those are raw boundary counts, not a claim that the pilot-v3 pack is
already good enough to train. The deterministic candidate pool contains 2,000
skill, 700 voice, and 400 judgment rows. Voice and judgment are oversampled so
the unchanged local threshold can still produce an exact final training pack
of 1,000 skill, 300 voice, and 200 judgment rows plus 100 separately held-out
voice evaluations; local grading and that corpus gate remain mechanically
visible.

The final live pack cleared that gate exactly: 1,000 skill, 300 voice, and 200
judgment rows, all locally graded and all at or above 0.8. Pilot v3 was prepared
with 100 held-out evaluations, while the original 20-case sentinel remained
byte-for-byte identical. Its manifest still records training_started=false;
the stratified 10% human audit is the next authorization gate.

The local blind judge passed the unchanged eight human labels 8/8 with
gemma4:31b at the fixed 90% gate. The final source suite passed 524 tests.

No corpus text, runtime path, credential, identity id, human response, private
benchmark case, prompt, reference, rating, database, local config, model weight,
or adapter is part of this release.

ocbrain v0.3.3

ocbrain v0.3.3

This patch is a live-data and watchdog durability release. It fixes defects
found by auditing the production scheduler, 1.9 GB SQLite ledger, append-only
event chain, FTS index, dataset factory, and stall pager together.

The tripwire scanner previously kept only an updated_at watermark while
ordering by (updated_at, id). A batch boundary could therefore skip remaining
rows that shared the last timestamp. It now persists the complete composite
cursor and advances only after a row's predicates finish. The hard-correction
predicate also stopped deserializing the full event log once per knowledge row;
an indexed JSON target lookup preserves the same decision. A live clean
1,000-row page fell from 301.2534 seconds to 0.0351 seconds, and the historical
backlog was drained to the current eligible head.

New FTS parents now insert directly instead of first scanning the unindexed
FTS doc_id column for a row that cannot exist. Existing parents still delete
and replace their exact index row. The live repair removed 5,202 parentless
legacy index rows and left zero FTS orphans.

The stall ledger now distinguishes delivery from deliberate retirement. Four
old findings that were outside the steady-state paging window had remained
new for 300 aggregate sightings; they are now durably retired once. Failed
delivery remains eligible for retry. Autopilot maintenance independently reads
stallcheck's self-heartbeat, unchanged deadman states emit one evidence record,
and malformed deadlines emit an explicit tripwire instead of disappearing.
Autopilot now commits a visible running row and profile deadman before its
first stage, checkpoints both after every stage, and clears the deadline only
at finalization. Stallcheck reads that deadline, making the two scheduled
processes independent witnesses of one another. Dry-run inspection opens the
brain read-only and reports those producer deadmen without writing.

The release build also found that Hatch's default source archive could sweep an
untracked local logs/ directory into the tarball even though git would not
publish it. The build configuration now excludes runtime data, logs, caches,
build output, and the untracked lock file explicitly. The rebuilt source and
wheel inventories contain none of those paths.

Five legacy retrieval-use rows carried old candidate/event ids in a canonical
knowledge foreign-key column. The migration now retains those ids in
task_ref, clears the invalid optional FK, and preserves every retrieval row.
The live database now has zero foreign-key violations. Its valid 306,974-event
hash chain reproduced the 101,641-row belief projection byte-for-byte, allowing
the missing incremental cursor to be repaired at the verified head without a
long writer transaction.

No corpus text, runtime path, credential, identity id, human label, prompt,
reference, rating, database, local config, model weight, or adapter is part of
this release.

Verification

• 494 source tests and Ruff
• changed-file formatting and compileall
• wheel/sdist metadata and tracked-tree public-safety checks
• live SQLite quick_check=ok, event-chain verification, zero FK violations,
  zero FTS orphans, and projection cursor at the event head
• two consecutive live stall passes (retired=4, then new=0)
• independent liveness pass followed by an idempotent zero-change pass
• post-restore launchd light cycle completed ok

ocbrain v0.3.2

ocbrain v0.3.2

This patch closes two acceptance gaps found after v0.3.1: a large reviewed
session could still exceed the two-second writer target, and the local judge
gate treated machine-authored expected winners as if they were human truth.

Post-turn review now uses explicit transactions bounded by 50 mutating units or
two seconds inside each session. It still flushes the session watermark before
the lazy transcript iterator advances. The ledger reports measured wait, total,
and maximum writer-lock time rather than a conservative whole-session estimate.
A separate-connection regression test proves the writer slot becomes available
inside one large session as well as between sessions.

The same audit found that a persona example's redaction, serialization, quality
rules, and dedup lookup still ran after the batch acquired SQLite's writer slot.
A live heavy run exposed the flaw with a 27.457-second maximum and 4,052.699
seconds of cumulative persona writer ownership. Those preparation steps now run
before the transaction, and evidence plus each final example insert commit
before the next candidate is parsed or scored.

Post-fix stress runs used fresh SQLite databases and the release source. Two
hundred large persona examples committed in 201 transactions with a 0.001128s
maximum writer hold and 0.024447s total writer ownership. One 200-tool-turn
review session committed five bounded batches with a 0.000863s maximum and
0.003255s total writer ownership.

Judge calibration now requires a separate label file that exactly covers the
case ids and names the human labeler. Expected winners embedded in case files
are ignored. A new --calibration-only mode stops before blind pairs are read,
and calibration reports retain the judge's explanation for each miss.

The dated private human calibration first reclassified the existing judge as a
failure at 6/8. After the evaluator prompt was aligned to the operator's stated
preferences—truth and privacy before style, concise reasoning, preserved
optionality under noisy evidence, and useful estimates without fake
precision—it passed 7/8 (87.5%). The remaining miss is preserved: the judge
still prefers a longer answer with reasons over the operator's terse answer
that needs one reason added. No blind pair was rerated and the v0.3.0 model
result remains 7 candidate preferences to 13 references.

Runtime documentation was checked against the installed command surfaces for
OpenClaw 2026.6.11, Claude Code 2.1.206, and Codex CLI 0.144.1. OpenClaw matched
the registry version. The guide now distinguishes standalone Claude Code login
from the OpenClaw Anthropic CLI profile import required for OpenClaw-hosted
Claude.

No corpus text, human label, prompt, reference, rating, database, local config,
credential, model weight, or adapter is part of this release. Public artifacts
contain only source, tests, documentation, and aggregate evidence.

Verification

• 482 source tests, Ruff, changed-file formatting, compileall, and package build
• focused human-label provenance and fail-closed calibration tests
• focused within-session and between-session SQLite writer-slot tests
• 200-example persona and 200-tool-turn review writer stress runs
• live SQLite quick_check=ok
• configured MCP entries verified for Codex/ChatGPT, Claude Code, and OpenClaw
• tracked-tree and outgoing-diff public-safety checks

ocbrain v0.3.1

ocbrain v0.3.1

This patch closes the last long transaction found by the v0.3.0 live runtime
probe.

Post-turn review consumes transcript sessions lazily. Before this patch, the
first reviewed session opened a write transaction and the iterator parsed every
later transcript before the runner's stage-level commit. Review now commits each
fully processed session and its watermark together before requesting the next
session. The run ledger reports the batch count plus conservative total and
maximum writer-lock upper bounds.

The same live probe found hosted judge/embedding I/O waiting on TLS after
writing an egress audit but before committing. Each audit now commits before
dispatch, so network latency never owns SQLite's writer slot; verdict/vector
results and run accounting commit once per completed provider batch.

Regression tests prove another SQLite connection can acquire the writer slot
between two lazily yielded sessions and from inside simulated judge/embedding
network calls. The full release keeps the v0.3.0
Apache-2.0 license, frozen second-pilot evidence, privacy boundary, and bounded
dataset/autolabel transactions.

The passive stall watcher follows the same rule: it commits deadman evidence
before optional Telegram paging, then records delivery state afterward.
Persona mining also releases its evidence batch before invoking Git for the next
commit candidate.
FTS attribution now consumes only the autolabel stage's remaining time budget,
so the light profile can stop cleanly and resume on its next watermark-safe run.
Promotion completes expensive scoring and eligibility reads before opening its
bounded update batches. Tripwires commit each fired quarantine before evaluating
the next row.
The heavy harvester commits each history or doctrine file before reading the next.

No corpus text, prompt, reference, rating, database, local config, credential,
or model weight is part of this release.

Verification

• 477 tests, Ruff, compileall, and package build
• review: 39/40 live writer probes succeeded; maximum per-session lock upper
  bound 0.347 seconds across 1,663 committed sessions
• tripwires: 40/40 live writer probes succeeded during a 285.4-second scan
• promotion: 40/40 live writer probes succeeded; maximum measured writer hold
  0.019 seconds, and stage elapsed time fell from 75.35 to 10.56 seconds
• SQLite quick_check=ok; safe checkpoints returned busy=0

ocbrain v0.3.0

ocbrain v0.3.0

This is the first licensed release of ocbrain: one local, source-backed brain
for ChatGPT/Codex, Claude Code, and OpenClaw.

What changed

• The repository is now open source under Apache-2.0, including its explicit
  patent grant. Package and MCP server metadata both report 0.3.0.
• Current Codex, Claude Code, and OpenClaw transcript formats share one scoped
  evidence, knowledge, retrieval, and feedback ledger.
• Light and heavy autopilot profiles maintain that ledger without overlapping.
  Dataset writes commit after 50 mutating units or two seconds; autolabel
  releases SQLite before expensive FTS attribution; both paths report writer
  wait and hold telemetry.
• A large WAL is truncated only after the dataset writer commits. A blocking
  reader is reported as busy and left for a later retry.
• Private persona curation, loopback-only grading, frozen-evaluation reuse, and
  pre-blind judge calibration are part of the local fine-tune workflow.

Honest model result

The second voice pilot reused the first pilot's 20 prompts, references, rubric,
held-out hashes, and blind randomization byte-for-byte. Eleven canonical
first-party examples were added locally; ten cleared the unchanged 0.8 grade
threshold. The candidate improved from 2/20 blind preferences to 7/20, while
the reference won 13/20. Mean candidate scores improved to 3.05 voice fidelity,
3.10 taste alignment, 3.50 naturalness, and 3.10 specificity. This remains a
model-quality failure. The evaluation pipeline worked, and the corpus still has
work to do.

Verification

• 469 tests
• Ruff and compileall
• package build and metadata inspection
• tracked-tree and outgoing-range public-safety scans
• SQLite quick_check=ok
• safe WAL checkpoint from 625,436,632 bytes to 0 after the live writer exited
• frozen evaluation and blind-key hashes matched the first pilot
• local judge calibration passed 7/8 before blind material was opened

No corpus text, prompt, reference, rating, database, local config, credential,
or model weight is part of this release.