OCBrain v1.0.1

OCBrain v1.0.1 — Hardened shared context

v1.0.1 keeps the v1 event-authoritative architecture and eight-tool runtime
surface, while hardening the boundaries that matter when the evidence lake and
client fleet grow.

Portable evidence, explicit authority

export-bundle creates a fresh owner-only JSON file from an explicit evidence
allowlist. Scope and egress policy are enforced before publication, secrets are
redacted, approval-gated evidence requires --approve-egress, and every export
records an audit receipt. local_only and prohibited evidence cannot leave.

import-bundle is validation-only unless --apply is supplied. It validates a
strict envelope and canonical payload hash before opening SQLite, ignores
sender ids as authority, derives local content ids, writes one transaction, and
forces imported evidence to confidential plus local_only. It never imports
beliefs, retrievals, closeouts, schedules, training state, or operations state.

Import and secret safety

• JSON, escaped JSON, assignments, namespaced environment keys, camelCase
  credential keys, private keys, and common provider tokens are redacted before
  truncation.
• Credential-shaped files are denied, hidden descendants are skipped during
  broad sweeps, and symlinks cannot escape a selected directory or disguise a
  hidden target.
• History head/tail windows are produced by a streaming redactor, so a large
  transcript is not reread into memory in full.

Lifecycle, scope, and storage safety

• A late approval cannot resurrect a belief that was tombstoned, retracted, or
  corrected after its proposal; full projection rebuilds preserve the same
  constraints.
• Client confidentiality and local_only egress survive more specific
  task/session/repository scope resolution.
• Database initialization drops only exact retired OCBrain table shapes, never
  unrelated application tables with generic names.
• Local pointer and configuration files must be owner-only; doctor and runtime
  checks fail visibly when permissions are too broad.

MCP process safety

Malformed frames and invalid parameter shapes receive protocol-correct errors;
malformed notifications remain response-free. A launcher started through the
active-core pointer rechecks that pointer for every request and exits on drift,
preventing an already-open client from silently writing a database that is no
longer active. Explicit OCBRAIN_DB launches remain intentionally pinned.

Acceptance gate

The release gate requires the complete test suite, Ruff, bytecode compilation,
tracked-tree public-safety scanning, fresh builds of all three distributions,
clean-environment package and bundle round trips, and new Codex, Claude Code,
and OpenClaw acceptance turns against the same activated database. Hosted
judgment and training remain disabled; the named-human audit is still required
before any pilot training.

The source and artifact gate passed on 2026-07-13: 676 tests, Ruff, bytecode
compilation, public-safety scanning, six fresh distributions, Python 3.12 clean
installation, package isolation, an installed eight-tool MCP probe, and a
two-database evidence-bundle round trip all passed.