Merge pull request #1510 from Hellblazer/release/v7.33.0

release: conexus 7.33.0

Author: Hellblazer

.claude-plugin/marketplace.json

@@ -11,21 +11,21 @@
         "source": "git-subdir",
         "url": "https://github.com/Hellblazer/nexus.git",
         "path": "conexus",
-        "ref": "v7.32.0"
+        "ref": "v7.33.0"
       },
       "description": "Self-hosted three-tier knowledge management with 13 specialized agents, plan-centric retrieval via nx_answer, semantic search, and RDR decision tracking for Claude Code.",
-      "version": "7.32.0"
+      "version": "7.33.0"
     },
     {
       "name": "sn",
       "source": {
         "source": "git-subdir",
         "url": "https://github.com/Hellblazer/nexus.git",
         "path": "sn",
-        "ref": "v7.32.0"
+        "ref": "v7.33.0"
       },
       "description": "Injects Serena and Context7 MCP tool usage guidance into subagents via SubagentStart hook.",
-      "version": "7.32.0"
+      "version": "7.33.0"
     }
   ]
 }

.claude/skills/release/SKILL.md

@@ -99,6 +99,7 @@ away.
 ### 1. Run unit + integration suite
 
 ```bash
+tests/e2e/release-battery.sh         # nexus-mfage: every E2E gate below (and 1b, 6, 6b, 6c) in ONE parallel run — artifacts built once, per-leg logs, verdict table, exit 1 on any red; the unit suite still runs SERIAL to it
 uv run pytest                        # unit suite (no API keys)
 tests/e2e/local-service-gate.sh      # integration incl. the local-service functional gate
 tests/e2e/migration-rehearsal/run.sh --package-upgrade   # ONE-engine convergence MVV (nexus-cfgo9)

.github/workflows/local-service-gate-nightly.yml

@@ -247,6 +247,13 @@ jobs:
         # shape — @pytest.mark.integration, self-provisioning against the
         # shared engine substrate, zero other CI wiring — so it joins the
         # same allowlist rather than inventing a second gate.
+        env:
+          # nexus-a2qhz: these files self-provision against the engine
+          # substrate and write to it; the production-write guard refuses a
+          # dev-checkout write without a reason-bearing opt-in (31 setup
+          # errors on the 2026-09-06 run, the first after the guard landed).
+          # Never production: the endpoint is the run's own throwaway engine.
+          NX_ALLOW_PROD_WRITE: "nightly ungated-integration step: self-provisioned throwaway engine substrate on the CI runner (nexus-a2qhz)"
         run: |
           set -euo pipefail
           uv run pytest \

.github/workflows/scheduled-failure-watch.yml

@@ -162,4 +162,14 @@ jobs:
         # --paired-deploy's `gh release view` publication check. This leg
         # only needs outbound HTTPS to the public managed endpoint plus the
         # `contents: read` permission above for actions/checkout.
-        run: uv run python scripts/check_engine_release_floor.py
+        #
+        # --no-record-deploy: since nexus-nx3l5 the bare post-tag verify
+        # refuses (exit 3) unless it records the deployed-engine-version
+        # tracker or is told why it cannot. This runner holds no conexus
+        # checkout, so there is no STEP-6 report here to record from; the
+        # release box records the tracker. Without the opt-out this job
+        # was red every day from 2026-08-30 while every substantive check
+        # (pin current, cloud current, source current) passed.
+        run: >-
+          uv run python scripts/check_engine_release_floor.py
+          --no-record-deploy "GitHub runner: no conexus checkout holds the STEP-6 gate reports; the release box records the tracker"

AGENTS.md

@@ -18,7 +18,7 @@ uv run pytest -m integration             # E2E (requires .env from .env.example)
 uv sync && scripts/reinstall-tool.sh && nx --version    # after edits
 ```
 
-Unit tests use the in-process `InMemoryVectorClient` (`nexus.db.inmemory_vector_store`) + bundled ONNX MiniLM — no API keys or network; engine-substrate tests self-provision a local service (`ensure_engine`/`mint_test_tenant` in `tests/conftest.py`) or skip. **After any pull/rebase touching `service/`, run `scripts/build-gate-jar.sh`** — the substrate's freshness gate rejects a stale/unstamped jar and the whole suite errors at setup. Test-authoring directives (scenario journeys, lint bucket, contract-suite patterns, parametrize rules) live in [`tests/AGENTS.md`](tests/AGENTS.md).
+Unit tests use the in-process `InMemoryVectorClient` (`nexus.db.inmemory_vector_store`) + bundled ONNX MiniLM — no API keys or network; engine-substrate tests self-provision a local service (`ensure_engine`/`mint_test_tenant` in `tests/conftest.py`) or skip. **After any pull/rebase or edit touching `service/` (a comment in a Java file or a changelog XML counts: the gate is mtime-keyed), run `scripts/build-gate-jar.sh`** — the substrate's freshness gate rejects a stale/unstamped jar and every substrate-backed test errors at setup, lint-marked ones included, so a suite run beside a jar rebuild reports a wall of setup errors that is not a test failure. Never backdate mtimes to get past it; rebuild. Test-authoring directives (scenario journeys, lint bucket, contract-suite patterns, parametrize rules) live in [`tests/AGENTS.md`](tests/AGENTS.md).
 
 ## Architecture at a glance
 
@@ -238,11 +238,15 @@ A green here proves only that no requirement was present in the snapshot the
 releaser took — not that none was missed. The snapshot is one developer's
 clone (see `docs/contributing.md` § Step 0b KNOWN LIMITATION, nexus-2zmfw).
 
-1. **Run the full release test battery.**
+1. **Run the full release test battery.** Step 0 is the pin sweep: `scripts/pins-preflight.sh` (about four minutes: lint bucket, the non-lint pin tests, wire-contract pairing, ruff on src, continuing past failures) so every stale ratchet, ledger, parity pin and reference-rot surfaces in ONE report before the first hour-long gate, instead of one per gate run (2026-09-06: the pattern was "expected fail, bump the pin, rerun for an hour, find the next one"). Then run the whole battery to completion collecting reds; fix once; rerun only the reds.
+   `tests/e2e/release-battery.sh` (nexus-mfage fix B) runs the whole gate group below in ONE invocation: leg 0 builds every artifact once (`tests/e2e/migration-rehearsal/build-artifacts.sh`: wheel, stamped dev jar, linux native candidate, plus a manifest keyed on the working tree's identity) and runs the pin sweep; then every gate runs in one parallel group (`--max-parallel`, default 4), each consuming the artifacts by manifest (`run.sh --artifacts`, `NX_GATE_ARTIFACTS`, `NEXUS_SANDBOX_HOME`), each in its own log with its verdict line captured verbatim and timed; the throughput-baselined shakeout leg runs alone afterwards. Reds never stop it; one table at the end; a leg with no verdict line is MISSING, never passed. Consumers refuse artifacts whose manifest tree identity is not this checkout's, so a dirtied tree rebuilds rather than reusing (nexus-mbeke). The serial commands below remain the per-leg reference and are what the driver runs.
    ```bash
-   uv run pytest                                             # unit suite (no API keys)
+   tests/e2e/release-battery.sh                              # the whole battery, parallel, ~30 min on this box
+   scripts/pins-preflight.sh                                 # step 0: every cheap pin at once
+   uv run pytest -n auto && uv run pytest -m lint            # unit suite and the lint bucket (two runs)
    tests/e2e/local-service-gate.sh                           # integration incl. the local-service functional gate
    tests/e2e/migration-rehearsal/run.sh --package-upgrade    # ONE-engine convergence MVV (nexus-cfgo9)
+   tests/e2e/migration-rehearsal/run.sh --candidate-migration # REQUIRED when the tree carries a changeset: --package-upgrade and fresh-install-mvv both converge to the PINNED engine, so only this leg walks the tree's own changesets over a populated existing store (nexus-z0ylb)
    ```
    All must pass. Bare `uv run pytest -m integration` is not enough on its own — the local-service round-trip family self-provisions inside `local-service-gate.sh` and otherwise skip-gates silently on an absent service (the 74/516 ambient-degradation class the gate was built to end). Integration is excluded from CI — this battery is your last line of defense before tag-push.
 1b. **Run the fresh-install MVV.** `./tests/e2e/fresh-install-mvv.sh` (nexus-nolqs). The VIRGIN-journey gate — every other E2E gate tests the upgrade axis from a populated install. The unit suite then pinned the SQLite opt-out backend (since retired at RDR-158), which is how the 2026-07-21 fresh-box defect class (f1itv/e9ru2/kmo9h/r5f3c/9xfx5) shipped unseen; today the suite pins the engine substrate instead, and the MVV still covers the virgin journey no unit test walks. Builds the wheel under test, then on a scrubbed-env virgin HOME: local init (engine + portable PG + bge-768), ladder converged at init, store put + index md with ENGINE-CATALOG registration asserted (not just T3 chunks), semantic search returns both, doctor with zero ✗ and warnings checked against the allowlist, and — leg 9 of 10 (nexus-utpuw.19) — a generation install on that same virgin HOME. That last leg is the only fresh-journey coverage of the `<tools>/gen-<stamp>` + shim path, and the only proof the built WHEEL actually ships `nexus/_install/*.sh`: every other test of `packaged_install_dir()` runs against an editable checkout, where that path exists because the repo does. Must end `FRESH-INSTALL MVV PASSED — ... (LOCAL WHEEL, release-battery layer)`. **This is the pre-tag LOCAL WHEEL layer only** — it resolves dependencies from this checkout's `uv.lock`/wheel metadata, not PyPI, so it cannot reproduce a defect that lives in dependency RESOLUTION (nexus-l2ku5: `mcp>=1.0` unbounded resolved `mcp` 2.0.0 fresh from PyPI on a `uv tool install`, killing both MCP servers for 4 days while every gate — this one included — ran pinned to the dev venv and saw nothing). `./tests/e2e/fresh-install-mvv.sh --published [X.Y.Z]` (nexus-796zn) installs the PUBLISHED artifact via `uv tool install conexus[==X.Y.Z]` in the identical scrubbed sandbox (never touches the live `~/.local/share/uv`/`~/.local/bin`) and is the POST-publish SHAKEDOWN layer (T2 `nexus/shakedown-playbook` §2 S1) — there is nothing on PyPI yet to install at pre-tag time, so it does not belong in this numbered step; run it after a tag publishes.

CHANGELOG.md

@@ -6,6 +6,74 @@ Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [7.33.0] - 2026-09-06
+
+Paired with engine-service-v0.1.105 (`REQUIRED_ENGINE_VERSION` 0.1.105).
+
+### Changed
+
+- Search fan-out (nexus-d9xt2): `search_cross_corpus` issues one combined
+  `/v1/vectors/search` per embedding-model group instead of one call per
+  collection, with a per-collection candidate floor of `n_results` times
+  the corpus overfetch multiplier, capped at 300 and split into sub-batches
+  above it. A 71-collection `corpus=all` search drops from 13 to 19 s to
+  about 6 s at shipped defaults; `--corpus knowledge` from 6.7 s to under
+  1 s. A collection whose combined call fails with a dimension mismatch is
+  retried alone and then excluded for the process; transient errors are
+  retried per call. The CLI skips the collection-stats round trip for
+  conformant `--corpus` names and existence-checks them via the cheap
+  collections endpoint, keeping the named "no collections match" warning.
+  Known residual: a group that splits can swap near-tied results at ranks
+  7 to 10 (rdr, 9 collections); tracked as nexus-atylb.
+- Local PG provisioning (nexus-cbo4a batch 9): the provisioner ensures the
+  `nexus` schema and two SECURITY DEFINER functions
+  (`nexus.ensure_vector_extensions_relocated()` and its unrelocate
+  companion, EXECUTE granted to `nexus_admin` only) on every provision and
+  daemon start; the engine's `search-path-001` changeset calls the function
+  mid-walk to move `vector` and `pg_trgm` into the `nexus` schema exactly
+  once. Nothing in the client relies on the PostgreSQL session
+  `search_path` any more.
+- Storage-service supervisor (nexus-59bah): every heartbeat tick is timed;
+  a tick slower than 3 s logs `storage_service_heartbeat_slow` and a tick
+  past the lease TTL logs `storage_service_heartbeat_missed_ttl` at ERROR
+  naming the stalled phase, instead of the lease silently lapsing.
+- Engine launch (nexus-9gaj7): every JVM launch line carries
+  `-Duser.timezone=UTC`; the engine also pins and asserts UTC in-process at
+  boot.
+- Doctor `--check-engine-activity` sends the resolved bearer token on
+  `GET /v1/status` (nexus-grzai).
+- RDR-203 P3: `nx_answer` records its run, steps and outcome in one
+  `POST /v1/telemetry/nx_answer_runs/complete` when the engine advertises
+  `nx_answer_run_complete_supported`, falling back to the three legacy
+  writes otherwise; `use_count` on a plan now bumps exactly once per call.
+- `nx doctor` and the T2 telemetry client record the capability census
+  split by orchestrator and subagent scope (nexus-gjv9b PART 3).
+
+### Added
+
+- `nx agents install worktree-developer` (nexus-uympf): generates
+  `~/.claude/agents/worktree-developer.md` from the installed plugins, the
+  sn `examples/worktree-developer.md` frontmatter and activation preamble
+  (private `serena-wt` Serena rooted at the worktree) followed by the
+  conexus `developer` agent body verbatim, with `_shared/` links rewritten to
+  the installed conexus directory. `--check` exits 1 when the file lags the
+  plugins and `nx doctor` warns on the same drift.
+- Release tooling: `scripts/pins-preflight.sh` (every cheap ratchet, ledger,
+  parity and reference-rot check in one pass before any long gate) and
+  `tests/e2e/release-battery.sh` (nexus-mfage: artifacts built once by tree
+  identity, the E2E gates run concurrently with per-leg logs and a verdict
+  table; the gate group measured 25 min wall against 71 min serial).
+
+### Removed
+
+- The JSONL rotation machinery behind `capability_census.jsonl` and
+  `routing_log.jsonl` (nexus-gjv9b PART 3). Both writers moved to engine
+  tables in 7.32.0, so the rotation and tail-dedup had no caller. Existing
+  files, including an already-rotated `.1` generation, stay readable by
+  `nx hook routing-stats` without `--from-store`; nothing writes to them any
+  more.
+- `scripts/collapse_rdr_registrations.py`, never run (nexus-ph718).
+
 ## [7.32.0] - 2026-09-05
 
 ### Removed

conexus/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "conexus",
-  "version": "7.32.0",
+  "version": "7.33.0",
   "description": "Self-hosted three-tier knowledge management with plan-centric retrieval (nx_answer), specialized agents, semantic search, and RDR decision tracking for Claude Code.",
   "author": {
     "name": "Hal Hildebrand",

conexus/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to the conexus plugin are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [7.33.0] - 2026-09-06
+
+- Plugin version aligned with conexus 7.33.0.
+- conexus: `agents/developer.md`'s Beads Integration section no longer tells
+  the agent to close beads or commit the beads file, matching its Completion
+  Protocol (nexus-yhcxi); `worktree-developer` inherits it at the next
+  `nx agents install`.
+- conexus: `hooks/scripts/routing/_lib.py` drops the dead JSONL append and
+  rotation machinery; `log_routing_event` writes only to the engine's
+  `routing_events` table, as it has since 7.32.0 (nexus-gjv9b PART 3).
+
 ## [7.32.0] - 2026-09-05
 
 - Plugin version aligned with conexus 7.32.0.

conexus/PENDING_RELEASE.md

@@ -29,6 +29,6 @@ mechanize, it matters enough to ship.
 ---
 
 
-## Awaiting the next release or plugin cut (pinned: v7.31.0)
-
+## Awaiting the next release or plugin cut (pinned: v7.33.0)
 
+(none)

conexus/agents/developer.md

@@ -154,11 +154,8 @@ You are an expert software developer who adapts to any language and build system
 
 - Check /beads:ready for available work before starting
 - Update bead status when starting: /beads:update <id> --status=in_progress
-- Close beads when complete: /beads:close <id>
-- Create new beads for discovered work: /beads:create
-- Always commit .beads/issues.jsonl with code changes
-
-
+- Record discovered work as a note on the bead you hold, or hand it back; do not file beads for it
+- Do NOT close the bead and do NOT commit `.beads/issues.jsonl`: the caller owns close and commit behind the stacked-review gate (see § Completion Protocol)
 
 ## Completion Hand-Back (the review gate is the caller's standing job, not a per-turn reminder)