v0.3.0b9

mind-nerve v0.3.0b9

The final Python-series beta: vetted external skill acquisition, the per-prompt routing hook, the installer verify verb, and the complete pure-MIND port of the front-end tree.

Highlights

• mind-nerve acquire — find skills/agents/MCP servers in curated external sources (Anthropic's skills repo, the official MCP servers repo, the MCP registry API, GitHub search), vet them with a deterministic fail-closed static scanner, and install the clean ones into the hub with per-file SHA-256 manifests and a live daemon reindex. Fetches land in a capped quarantine first; a FAIL verdict never reaches the hub. Threat model: docs/acquisition.md.
• Per-prompt routing hook + installer subsystem — a 1,300+ skill hub becomes reachable for ~2k tokens of announce instead of ~95k, across the 20-CLI installer matrix. Ranked route table with absolute SKILL.md paths injected per prompt; atomic symlink-flip projection.
• Installer verify + --mcp-launcher venv|uvx — per-client verification of every wired surface (config, hooks, env pins, fail-open probe, MCP entry/command, daemon socket), legacy mcp-facade dead entries FAIL, runtime-dir pin when a populated local route table exists.
• Pure-MIND migration: core surface COMPLETE — the entire .mind tree now compiles AND executes under mindc 0.10.2: 17/17 kernel-tree modules in project mode plus all 13 previously-dormant front-end files (sha256, q16_16, lib, top_k, tokenizer, chain_log, runtime_ffi, clock, evidence, encoder_kernels, model, loader, inference) — 267 executing tests wired as exact-count gate legs, plus a native-ELF end-to-end harness byte-verified against CPython hashlib. The fail-closed tests/mindc_gate.sh gates all of it (manifest completeness, compile, 0-tests-run traps, exact counts). See audits/2026-08-10-ci-mirror-audit.md and ROADMAP.md.
• Hook hardening — malformed catalog rows can no longer kill a prompt's entire routing (ENAMETOOLONG crash fixed, regression-tested); SessionStart banner throttled to once per 12 h; acquired agents route via daemon-provided kind/source_path.

Security — three independent pre-release audits, all findings fixed

grok, claude (fable), and codex each audited the full changeset; all returned BLOCK. 24 distinct findings fixed with red-first regression tests, including:

• directory-symlink exfiltration into the hub (reproduced by all three auditors) — now fail-closed at vet, links preserved at install
• skipped-dir (dist/, node_modules/, …) payloads installing unscanned via tarball/git-clone fetch paths
• NUL-byte scan bypasses (prefix and mid-buffer) and Windows drive-qualified tar members
• --register-mcp executing unvetted registry artifacts (now local, path-checked entry points only)
• shell-pipe dropper variants (| python, eval $(curl …), bash <(…), …), 3+-line prompt-injection splits, extension-vs-magic-bytes archive dispatch, archive/clone DoS caps, credential redaction in manifests and errors, mode-preserving atomic config writes

Verification

• 611 pytest (python + integration) + 41 bit-identity + corpus determinism check — green
• 366 vitest + tsc --noEmit clean (installer/hook, incl. ENAMETOOLONG, banner-throttle, and all audit regressions driven against the real hook subprocess)
• tests/mindc_gate.sh: 16 legs PASS on mindc 0.10.2 (17/17 project-mode modules, LUT smoke, 13 front-end files with exact-count tests, native e2e harness)
• ruff 0.16.2 check + format clean; wheel builds; twine check PASSED

Notes

• PyTorch reference path unchanged; native Q16.16 encoder remains bundled in the wheel.
• This is the final Python-series beta: the pure-MIND line ships as binary releases (see ROADMAP.md "Pure-MIND Self-Hosting Migration").
• Full details: CHANGELOG.md [0.3.0b9]. Upgrade: pip install -U mind-nerve; weights auto-download on first use.

v0.3.0-beta.9 — cross-platform universal router + federated route-table merge

Maintained pure-Python release (py3-none-any wheel — Linux/macOS/Windows identical install).

Highlights since v0.3.0-beta.2

• Cross-platform router: Windows + macOS + Linux universal install; pure-Python fallback when the native encoder isn't present (CI smoke green on all three).
• Federation: deterministic federated route-table merge + scan-repo bundle.
• Trust roots: first-party trust roots exempt from the discovery license gate; public-license-in-frontmatter wins over body markers.
• MCP: model warm-up moved off-thread so the MCP initialize handshake isn't blocked.
• Windows: ASCII-safe CLI help + UTF-8 stdout — --help no longer crashes on cp1252.
• Quality: type-annotation hardening; mypy/bandit/ruff clean across mind_nerve + tools.

Install: pip install mind-nerve

mind-nerve 0.3.0-beta.2 — flock-guarded ensure()

Bumps mind-nerve to 0.3.0-beta.2.

Fixed

• Concurrent ensure() daemon-spawn race. Parallel CLI invocations during the daemon's ~5 s weight-load window each saw an unresponsive socket from their fast-path probe and spawned their own mind-nerve-routed. A real bot-thrash incident left 9 zombie daemons (~1.3 GB each) under a single user systemd cgroup. ensure() now serialises the spawn decision under a sibling mind-nerve.sock.lock flock + holds the lock while waiting for the socket to bind. Net effect: at most one daemon spawn per WAIT_SECONDS (20 s) window, regardless of caller concurrency.

Tests

• New tests/python/test_ensure_concurrency.py — 6 regressions covering lock path layout, single-call sanity, fast-path skip, 16-thread race (asserts spawn_count == 1), 4-thread fail-open under permanently-broken daemon, and no-daemon-binary short-circuit.

Surface

No public API changes vs 0.3.0-beta.1. Same wheel layout, same model_hash. Install with pip install mind-nerve==0.3.0b2.

v0.3.0-beta.1 — public mind_train surface (bring-up trainer)

v0.3.0-beta.1 — public mind_train surface (bring-up trainer)

Opens the v0.3 line per the locked ship plan. The trainer that
produced the Phase 1 checkpoints is now a first-class Python module
with a typed contract.

New module: mind_nerve.mind_train

from pathlib import Path
from mind_nerve.mind_train import TrainConfig, train

result = train(TrainConfig(
    catalog_path=Path("corpus.tsv"),
    output_dir=Path("./run"),
    epochs=3,
    backend="python",      # 'native' lands with mindc 0.3.0
    smoke_test=False,
))
print(result.model_hash, result.metrics)

Frozen TrainConfig + TrainResult dataclasses, deterministic
checkpoint hashing (SHA-256 over the sorted file tree, paths bound
in), backend dispatch.

New CLI: mind-nerve train

mind-nerve train \
  --catalog corpus.tsv \
  --out ./run \
  --backend python \
  --epochs 3 \
  --smoke-test   # 500 pairs / 1 epoch / ~1 min to validate the pipeline

Backend resolution

• python (default) — PyTorch + sentence-transformers MNR-loss
  recipe ported from catalog-builder/train_phase1.py. Works today;
  this is the bring-up backend.
• native — Raises NotImplementedError until the mindc 0.3.0
  --emit-shared cdylib + Q16.16 native kernel land. Foundation
  already shipped in mindc 0.2.11 (--emit-shared flag).

When the native backend ships, the Python backend stays available
behind the same switch — for reproducibility and cross-backend
bit-identity comparison.

Tests

tests/integration/test_mind_train_contract.py covers 9 invariants:
frozen dataclasses, malformed-row tolerance in the parser,
deterministic seeded split, checkpoint hash determinism + path-binding,
backend resolution errors, JSON-safe config, fast-fail on missing
catalog. Full suite: 195 passed.

Roadmap

• v0.3.0 — Native backend swap (gated on mindc 0.3.0 cdylib emit).
• v0.9.0-rc.1 — Switch flip wave (per-head drop masks, L2-cosine,
  RMSNorm, ALiBi) — each behind a model_hash bump using the new
  train() entry.
• v1.0.0 — Native cdylib inference path, cross-arch bit-identity,
  Tier-1 multilingual coverage cleared, Phase 3 functional.

What mind-train does NOT yet do (deferred)

• Multilingual corpus orchestration (Tier-1 12 languages) — runs in
  the multilingual workstream against this TrainConfig surface.
• Resume-from-checkpoint — single-pass for now.
• Multi-host distributed training — single-process bring-up.

v0.2.0 — Tier 3 attestation cross-binding (public Python surface)

v0.2.0 — Tier 3 attestation cross-binding (public Python surface)

Closes Phase 2 Tier 3 of the locked ship plan
(docs/plans/FINAL_SHIP_PLAN_2026_05_17.md). The MindLLM
cross-binding handshake is now a first-class Python surface —
external integrators (mind-mem, MindLLM, third-party verifiers)
can produce and verify BindingRecords without re-implementing
the Ed25519 + SHA-256 plumbing.

New module: mind_nerve.attestation

from mind_nerve.attestation import (
    binding_message, sign_binding, verify_binding,
    application_verify_binding,           # adds ZeroField guard
    serialize_binding_record, deserialize_binding_record,
    BindingRecord, manifest_export_bytes, neuron_hash_hex,
    MAGIC, VERSION, RECORD_SIZE,          # wire-format constants
)

Mirrors integrations/mindllm_attestation.mind exactly:

• Wire format: 200 bytes — magic MNBA, version 1, embedded
  mind_nerve_hash (32B) + mindllm_hash (32B) + nonce (32B) +
  signature (64B) + signer_pubkey (32B).
• Cryptography: Ed25519 per RFC 8032 over
  SHA-256(mind_nerve_hash ‖ mindllm_hash ‖ nonce).
• application_verify_binding(...) returns one of:
  "ok" | "ZeroField" | "SignatureInvalid".

New CLI: mind-nerve attest

# Produce a BindingRecord
mind-nerve attest sign \
  --mind-nerve-hash $(sha256sum-of-manifest-aggregate) \
  --mindllm-hash    $(sha256sum-of-mindllm-aggregate) \
  --nonce           $(openssl rand -hex 32) \
  --private-key-hex $ED25519_SK_HEX

# Verify it (optionally pin a trust anchor)
mind-nerve attest verify \
  --record-hex $RECORD_HEX \
  --pubkey-hex $EXPECTED_PUBKEY_HEX

Exit 0 on result == "ok", non-zero otherwise.

Tests

tests/integration/test_mindllm_handshake.py now imports the
public module — the Python surface IS the contract. 3 new
invariants on top of the existing 13: serialize→deserialize
round-trip, magic mismatch raises, short buffer raises. Full
suite: 186 passed.

Deferred to next ship

• Russian intent ≥ 90% top-5 verification — compute-bound
  training run (1–2 day GPU pod). Trainer code + corpus are
  staged; the gate flips once the eval pass lands.
• Native MIND inference / cross-arch bit-identity / p95 ≤ 30 ms
  on CPU + ARM — gated on mindc 0.3.0 cdylib emit. Foundation
  shipped in mindc 0.2.11 (--emit-shared), full path in 0.3.0.

Forward roadmap

• v0.3.0-beta.1 — Native-MIND training pipeline (mind-train),
  first locally-reproducible reference checkpoint.
• v0.9.0-rc.1 — Switch flip wave: per-head drop masks, L2-cosine,
  RMSNorm, ALiBi behind individual model_hash bumps.
• v1.0.0 — Native cdylib inference path, cross-arch bit-identity
  gate passes, Phase 3 stubs (federation, skill marketplace,
  mind-mem v4 cognitive kernel) flip to functional.

v0.2.0-beta.1 — Tier 2 catalog-builder v2 (freq_scale + stride)

v0.2.0-beta.1 — Tier 2 catalog-builder v2

First release on the v0.2 line. The catalog-builder now emits two new
optional columns, both consumed (or forward-compatibly ignored) by the
runtime at load time. Absent files leave the v1 scoring path unchanged.

SOTA-track #4 — Frequency-adaptive route scaling

• precompute_routes(emit_freq_scale=True, ...) writes
  route_table_freq_scale.npy: one float32 per route equal to
  max(1/sqrt(freq), 0.5) under Laplace smoothing
  (freq = raw_count + 1).
• The runtime multiplies each L2-normalized embedding row by this
  scale at load — zero runtime cost. Rare routes recover headroom
  from the long tail of common ones; the 0.5 floor caps the
  de-emphasis of very common routes.

SOTA-track #3 — Entropy → stride threshold table

• precompute_routes(emit_stride_thresholds=True) writes
  stride_thresholds.json with breakpoints
  {<0.4 → 256, <0.7 → 192, else → 96} (default 192).
• Consumed by the native-MIND windowed encoder once mindc 0.3.0 cdylib
  emit lands. The Phase-1 sentence-transformers path ignores the file;
  the emit is forward-compatible bookkeeping.

CLI additions

mind-nerve precompute-routes \
  --cooccurrence path/to/cooc.jsonl \
  --emit-freq-scale \
  --emit-stride-thresholds

--cooccurrence already implies both new emits (and the prior emit
from beta.2); the explicit flags exist for runs without a
co-occurrence log so installers can ship a v2-ready runtime by
default.

Tests

tests/integration/test_route_freq_scale.py exercises 7 invariants
(absent file, present file multiplies rows, shape mismatch raises,
near-zero scale suppresses route, unit-scale fallback, 0.5 floor for
common routes, stride table well-formedness). Full suite: 183 passed.

Forward roadmap

• v0.2.0 — Tier 3 attestation cross-binding + verified Russian-intent
  top-5 ≥ 90% (PARTIAL items closed).
• v0.3.0-beta.1 — Native-MIND training pipeline (mind-train), first
  locally-reproducible reference checkpoint.
• v1.0.0 — Native cdylib inference path (gated on mindc 0.3.0
  cdylib emit), cross-arch bit-identity, p95 ≤ 30 ms on CPU + ARM.

0.1.0-alpha.13 — CUDA OOM falls back to CPU instead of crashing

Targeted hotfix on top of 0.1.0a12. Surfaced by a live install on a machine with another GPU-resident model.

Fixed

• route() no longer crashes on CUDA OOM. sentence-transformers' default device pick is CUDA when a GPU is visible. If the GPU is already full (e.g. a local LLM in Ollama owns the VRAM), SentenceTransformer raised torch.AcceleratorError: CUDA error: out of memory and the whole call failed before the first prompt could even be encoded.
• _Runtime.__init__ now catches GPU-init failures broadly (matches out of memory, cuda, cudaerror, no cuda in the exception message), prints a one-line stderr notice, and retries the model load with device='cpu'.

Added

• MIND_NERVE_DEVICE env var — set to cpu to force CPU unconditionally even when a GPU is visible. Useful for hosts sharing the GPU with other tenants.

Behavior on this machine after the fix

$ mind-nerve route 'deploy the staging build to production' --top-k 5
mind-nerve: GPU init failed (AcceleratorError), falling back to CPU
{ "query": ..., "routes": [
    { "name": "deploy",                 "score": 0.7157 },
    { "name": "Deploy to Render",       "score": 0.6703 },
    { "name": "build-and-deployment-rules", "score": 0.6569 },
    ...
] }

PyPI: https://pypi.org/project/mind-nerve/0.1.0a13/

0.1.0-beta.2 — catalog-v2 runtime readiness (route_prior)

Catalog-v2 runtime-side consumption (SOTA-track #1). The runtime now loads route_table_prior.npy when present and adds it to the dot-product score before top-k selection — Bayesian combination of likelihood and frequency prior. Absent file leaves the scoring path unchanged, so v1 catalogs continue to work without modification.

Added

• Optional route_table_prior.npy column. Loaded as per-route log-prior and added to scores before top-k.
• Shape mismatch raises `RuntimeError` at load time rather than producing wrong results.
• 4 integration tests (`tests/integration/test_route_prior.py`): absent file, present file, shape mismatch, prior changes top-1 result.

Pairs with

• The catalog-builder side that already emits the v2 wire format (`catalog-builder/format/cat_v2.py`, magic `MNC2` + `PRIR` tail) with `freq_adaptive_scale` applied per-route.

Note

The publicly shipped HF Phase-1 weights remain catalog-v1. The runtime is now forward-compatible with v2; the v2 weights arrive in v0.2.0-beta.1 together with the documented model_hash bump and the Russian intent run.

0.1.0-beta.1 — first beta: Tier 1 + Tier 2 + Tier 3

First beta. Closes Tier 1 + Tier 2 + Tier 3 of the locked Phase 2 + Phase 3 ship plan (docs/plans/FINAL_SHIP_PLAN_2026_05_17.md). The remaining v1.0.0 blockers are external (mindc 0.3.0 cdylib emit, mind-mem v4 cognitive kernel, ARM CI runner) and remain deferred.

Tier 1 — installer matrix expansion

• Native Gemini CLI extension installer (--with-gemini).
• Vibe MCP installer (--with-vibe).
• Claw-family installers: --with-codeclaw, --with-cursorclaw, --with-graviton, --with-tirex, --with-claudeclaw.

Tier 1 — evidence-chain hardening

• Verifier now rejects envelopes with zero request_hash (closes SOTA-track #2: input-fingerprinted attestation).

Tier 2 — adaptive window stride

• Content-fingerprinted stride replaces the hard-coded stride=192 (closes SOTA-track #3). Calibrated thresholds in tools/calibrate_stride.py.

Tier 3 — Phase 3 scaffolds

• Skill-marketplace adapter (design + stub interface).
• Federated cross-host routing (typed-port design + stub).
• mind-mem v4 cognitive-kernel binding spec (route-history as memory class).

Tier 3 — attestation cross-binding

• Per-tensor weight manifest (TensorManifestEntry, TensorManifest, manifest_export()).
• MindLLM cross-binding handshake spec — SHA-256 binding message + Ed25519 signature, 200-byte packed BindingRecord wire format with magic MNBA.
• Spec is fully self-contained: external verifiers can implement it without any STARGA-internal toolchain.

Compatibility

• Version bump 0.1.0a13 → 0.1.0b1.
• New runtime dep: cryptography>=41.0 (Ed25519 operations).

Deferred (gated)

• 18-backend cross-arch bit-identity — needs mindc 0.3.0 cdylib emit.
• Native MIND inference replacing PyTorch — needs mindc 0.3.0.
• p95 ≤ 30 ms on 4-core CPU + ARM — needs mindc 0.3.0 + ARM CI runner.
• Russian intent classification ≥ 90% top-5 — compute-bound training run.
• Native mind-train pipeline — standalone bring-up shippable; deep work continues in v0.3.0.
• Per-head learned drop masks (SOTA-track #5) — depends on mind-train.

See CHANGELOG.md for the full diff.

0.1.0-alpha.8 — neutral layout labels + public-first docs

Tiny hotfix on top of 0.1.0a7.

Changed

• Installer layout-detection labels are now neutral (symlinked_catalog, shared_catalog_dir) — the install logic is unchanged.
• README + installer docstrings lead with the typical Claude Code install case (~/.claude/skills is renamed to ~/.claude/skills.full), with the shared-catalog pattern described as one optional alternative.

PyPI: https://pypi.org/project/mind-nerve/0.1.0a8/