Merge pull request #1514 from Hellblazer/release/v7.35.0

release: conexus 7.35.0

Author: Hellblazer

.claude-plugin/marketplace.json

@@ -11,21 +11,21 @@
         "source": "git-subdir",
         "url": "https://github.com/Hellblazer/nexus.git",
         "path": "conexus",
-        "ref": "v7.34.1"
+        "ref": "v7.35.0"
       },
       "description": "Self-hosted three-tier knowledge management with 13 specialized agents, plan-centric retrieval via nx_answer, semantic search, and RDR decision tracking for Claude Code.",
-      "version": "7.34.1"
+      "version": "7.35.0"
     },
     {
       "name": "sn",
       "source": {
         "source": "git-subdir",
         "url": "https://github.com/Hellblazer/nexus.git",
         "path": "sn",
-        "ref": "v7.34.1"
+        "ref": "v7.35.0"
       },
       "description": "Injects Serena and Context7 MCP tool usage guidance into subagents via SubagentStart hook.",
-      "version": "7.34.1"
+      "version": "7.35.0"
     }
   ]
 }

CHANGELOG.md

@@ -6,6 +6,29 @@ Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [7.35.0] - 2026-09-07
+
+Paired with engine-service-v0.1.107 (`REQUIRED_ENGINE_VERSION` 0.1.107,
+one changeset over a v0.1.106 store).
+
+### Added
+
+- Anonymous daily install ping (nexus-h5olw). Once every 24 hours the MCP
+  server sends six fields to the managed service so active installs can be
+  counted across local and cloud mode: a random install id kept in
+  `~/.config/nexus/install_id`, the conexus version, the install mode, OS,
+  CPU architecture, and Python major.minor. Nothing else. Daemon thread,
+  2 s timeout, every failure swallowed. Opt-out, default on:
+  `nx telemetry off` (writes `telemetry.enabled: false`) or
+  `NX_NO_TELEMETRY=1`; `nx telemetry status` shows the setting, the
+  install id, and the last ping. README § Telemetry states exactly what is
+  sent.
+- Engine: `POST /v1/install-ping`, unauthenticated, outside the `/v1/*`
+  auth block; `nexus.install_pings` (telemetry-014, global, no RLS); rate
+  limiting keyed by a trusted-proxy count (`NX_INSTALL_PING_TRUSTED_PROXIES`,
+  default 0 = socket peer; the managed edge runs 1). The active-install
+  read is an operator query on the conexus side; there is no `nx` verb.
+
 ## [7.34.1] - 2026-09-07
 
 Client-only patch. Engine unchanged at engine-service-v0.1.106

README.md

@@ -91,6 +91,23 @@ After `/plugin update`, run both steps so the CLI matches the plugin.
 Installs that never left ChromaDB (5.x, or 6.x never migrated) take a
 different path: [Getting Started § Upgrading from a pre-PG install](docs/getting-started.md#upgrading-from-a-pre-pg-install).
 
+### Telemetry
+
+Once a day the MCP server sends one anonymous ping to the managed service so
+the project can count active installs. It carries exactly six fields: a random
+install id (a UUID minted on first use, stored in `~/.config/nexus/install_id`),
+the conexus version, the install mode (`local` or `cloud`), OS, CPU
+architecture, and Python major.minor. No hostname, no paths, no collection
+names, no content. It runs on a background thread with a two second timeout
+and never blocks or retries. Turn it off with either:
+
+```bash
+nx telemetry off            # writes telemetry.enabled: false to config.yml
+export NX_NO_TELEMETRY=1    # or per environment
+```
+
+`nx telemetry status` shows the current setting and the last ping time.
+
 ### Something broken?
 
 [nexus-recovery-runbook](https://gist.github.com/Hellblazer/08f0a615e3d73e47d8062bce4829b611) is a

conexus/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "conexus",
-  "version": "7.34.1",
+  "version": "7.35.0",
   "description": "Self-hosted three-tier knowledge management with plan-centric retrieval (nx_answer), specialized agents, semantic search, and RDR decision tracking for Claude Code.",
   "author": {
     "name": "Hal Hildebrand",

conexus/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to the conexus plugin are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [7.35.0] - 2026-09-07
+
+Plugin version aligned with conexus 7.35.0. No plugin-side changes.
+
 ## [7.34.1] - 2026-09-07
 
 - `rdr-gate` command and skill: a Layer 0 re-gate survivor sweep driven by

conexus/PENDING_RELEASE.md

@@ -29,6 +29,6 @@ mechanize, it matters enough to ship.
 ---
 
 
-## Awaiting the next release or plugin cut (pinned: v7.34.1)
+## Awaiting the next release or plugin cut (pinned: v7.35.0)
 
 (none)

docs/cli-reference.md

@@ -108,6 +108,7 @@ Every `nx index repo` run also writes a per-repo log file at `~/.config/nexus/lo
 - **`nx store import`'s `[embed]` heartbeat** (nexus-s71lr) — the import is one call with no per-record progress at all (worse than the per-file loops: not even a start/end line per record). Same mechanism, armed for the whole call: `  [embed] importing <file> still running (Xs elapsed)` every 5 s, always on.
 - **`nx store put`'s `[embed]` heartbeat** (nexus-s71lr pass 3) — a single document is still ONE embed call, and a large document's embed can run a minute+ with zero progress signal. Same mechanism, armed for the whole `db.put()` call: `  [embed] storing <title> still running (Xs elapsed)` every 5 s, always on.
 - **`GET /v1/status`** (nexus-s71lr, engine-side) — additive endpoint serving live embed-activity counters (`embedding_mode`, `local_embed_activity` for the local bge path, and — pass 3 — `embedder_activity`, a map keyed by model token covering the cloud-mode Voyage/CCE embedders too, so a cloud install is no longer always `null`). `nx doctor` (also `--check-engine-activity` standalone) polls it and renders one "Engine activity: …" line, falling back to the busiest tracked embedder when `local_embed_activity` is null.
+- **`POST /v1/install-ping`** (nexus-h5olw, engine-side) — additive unauthenticated route recording the client's anonymous daily install ping into the global, RLS-free `nexus.install_pings` table (telemetry-014). 202 on accept; 400 on any malformed or over-long field; 429 with `Retry-After` past the mint-route rate limits (per remote address, then per install id). Active installs = distinct `install_id` in the trailing 28 days. See `nx telemetry status`.
 
 **Voyage per-project rate limit (nexus-cy9u7):** the engine embeds server-side on write, so a bulk `nx index` run's real "embed pressure" is its T3 vector-write and catalog manifest-write request rate. Voyage's RPM budget (4000 RPM for `voyage-context-3`) is per PROJECT, not per process or per worker — every concurrent worker thread AND every concurrent `nx index` session sharing that Voyage project draws from the SAME budget. Every write path now routes through a shared process-wide "rate brake" — `HttpVectorClient.upsert_chunks` (the one choke point every T3 write call site funnels through: the ChunkBatcher's combined-write flush, the per-file prose/code fallback, and PDF indexing, which never uses the batcher), the catalog manifest write, and the migration-ETL leg. The first worker to see ANY retryable transient failure — a 429, 502, 503, or 504, or a retryable transport error (connect refused, read timeout, ...), not only a narrow 429/503-with-`Retry-After` signal — pauses EVERY writer in this process until the same shared deadline, instead of each worker backing off independently and re-firing the limit the moment its own backoff elapses (the 2026-08-15 incident, conexus-ddh0/nexus-99r7y: the engine was retrying Voyage internally and the edge's own timeout surfaced to the client as a 502/504 with no `Retry-After` at all — a signal the narrower pre-fix scope would have missed entirely). The pause is floored at the server's `Retry-After` when one is supplied, otherwise an escalating default (2s, doubling per consecutive process-wide trip, capped at 60s); it resumes at the base delay once a write succeeds. `nexus-99r7y` (engine fail-fast with an explicit 429 + `Retry-After` instead of a bare edge timeout) sharpens this signal but is **not required** for the brake to engage — the escalating-default path covers every retryable failure shape either way.
 
@@ -3792,6 +3793,29 @@ a loud `model_family_drift` warning).
 
 ---
 
+## nx telemetry status / off / on
+
+```
+nx telemetry status
+nx telemetry off
+nx telemetry on
+```
+
+The anonymous daily install ping (nexus-h5olw): once every 24 hours the
+MCP server POSTs six fields to the managed service's unauthenticated
+`POST /v1/install-ping` route so active installs can be counted across
+local and cloud mode. Fields: `install_id` (random UUID in
+`~/.config/nexus/install_id`), `client_version`, `mode` (`local`/`cloud`,
+the same dispatch `nx init` uses), `os`, `arch`, `python`. Nothing else.
+Daemon thread, 2 s timeout, every failure swallowed at debug level; the
+last successful send is recorded in `~/.config/nexus/install_ping.last`.
+
+Opt-out, default on. `off` writes `telemetry.enabled: false` to
+`config.yml`; `NX_NO_TELEMETRY=1` (any value but `0`) wins over config.
+`NX_INSTALL_PING_URL` overrides the target (tests, private deployments).
+`status` prints the decision, its source, the install id, and the last
+ping time.
+
 ## nx telemetry baseline
 
 ```

mcpb/manifest.json

@@ -3,7 +3,7 @@
   "manifest_version": "0.4",
   "name": "conexus",
   "display_name": "Conexus",
-  "version": "7.34.1",
+  "version": "7.35.0",
   "description": "Three-tier semantic memory + knowledge management for Claude Desktop chat. Persistent code/docs/RDR indexing, plan-centric retrieval via nx_answer, and a Postgres-backed storage substrate that interoperates with the Claude Code plugin and the nx CLI on the same host.",
   "long_description": "Conexus is the Claude Desktop Extension form of Nexus. Same MCP tools and storage tiers as the Claude Code plugin and the nx CLI, packaged as a .mcpb bundle that uv resolves on first install. Persistent state is served by the storage service (Postgres), which `nx init` provisions \u2014 there is no separate daemon to install or talk to. State is shared with any other consumer on the same host (Claude Code plugin, nx CLI, Cowork via SDK bridge).",
   "author": {

mcpb/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "conexus-mcpb"
-version = "7.34.1"
+version = "7.35.0"
 description = "Conexus packaged as Claude Desktop .mcpb (Desktop Extension)"
 requires-python = ">=3.12"
 dependencies = [
@@ -10,7 +10,7 @@ dependencies = [
     # while collections are indexed at 768/1024-dim, so every T3 search hits a
     # dimension mismatch and returns zero results. The .mcpb cannot run the
     # interactive `nx init` embedder choice, so it must pin [local] explicitly.
-    "conexus[local]>=7.34.1",
+    "conexus[local]>=7.35.0",
 ]
 
 [tool.uv]

pyproject.toml

@@ -12,7 +12,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "conexus"
-version = "7.34.1"
+version = "7.35.0"
 description = "Self-hosted semantic search and knowledge management for LLM-driven development"
 readme = { file = "README.md", content-type = "text/markdown" }
 requires-python = ">=3.12,<3.14"