Merge pull request #1386 from Hellblazer/release/v6.4.0

release: conexus 6.4.0

Author: Hellblazer

.beads/interactions.jsonl

@@ -1213,3 +1213,17 @@
 {"id":"int-804f2ba56c4fb2bcda536efc6a7b7730","kind":"field_change","created_at":"2026-07-07T17:24:50.708631Z","actor":"Hellblazer","issue_id":"nexus-1kise","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Duplicate of nexus-441p5 (same finding filed independently from both instances today, 2026-07-07). Fix is in flight on 441p5: fast path gets its own try; on failure WARN (404 => engine-upgrade hint) and fall back to the paginated sweep; empty cache only when BOTH paths fail. Test test_build_falls_back_to_paginated_when_get_all_metadata_fails rewritten to assert the documented contract (it previously locked in the empty-cache regression)."}}
 {"id":"int-0869ac9bfb3b71e4562f7654a37936cb","kind":"field_change","created_at":"2026-07-07T17:33:10.179401Z","actor":"Hellblazer","issue_id":"nexus-441p5","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Fixed on develop 32d3d6cf. build_staleness_cache now genuinely falls back to the paginated sweep on any fast-path exception (404 from pre-v0.1.30 engines gets an engine-upgrade hint; row-cap/transient failures warn + fall back); empty-cache degrade only when both paths fail; NEW loud warning for the silently-empty-fallback shape (service-mode HttpVectorClient.get swallows errors to empty pages — review HIGH). 47/47 tests incl. 3 new; both stacked reviewers clear (code-review-expert APPROVE; substantive-critic HIGH addressed in-arc). Follow-up nexus-qci5b filed for the .get() swallow-convention divergence. Dup nexus-1kise closed. NOTE for the work box: this fix reaches it via the next PyPI release; interim workaround there = upgrade the local engine to >=v0.1.30 (kills the 404 at the source)."}}
 {"id":"int-880353a3ab2793a96be1a7d1f84e5409","kind":"field_change","created_at":"2026-07-07T20:55:17.800957Z","actor":"Hellblazer","issue_id":"nexus-n2ls1","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Fixed end-to-end, live in production. Root cause: TOCTOU race on the unlocked existing-topics guard (two concurrent persist_discovered both count 0, both insert, loser 23505 -> typed 409) — NOT version skew (handler byte-identical v0.1.14..develop) and NOT plain re-discovery (guard skips that). Engine fix (03eb2ba2, shipped engine-service-v0.1.32): per-(tenant,collection) pg_advisory_xact_lock + SET LOCAL lock_timeout=5s in persist_discovered/rebuild/split; ON CONFLICT DO NOTHING belt + existing-id reuse on discover AND rebuild root inserts. Client fix: persist_discovered_topics treats a 23505-scoped 409 as benign skip (pre-fix engines); non-23505/non-409 propagate. v0.1.32 deployed to api.conexus-nexus.com + STEP-6 GREEN first attempt (conexus-confirmed [20412]: /version 0.1.32 through the edge, voyage parity ~4e-7, recall@20 13/13, latencies in bound; rollback 0.1.31 on file). Stacked reviews clean (reviewer: approve; critic HIGH + 2 Medium all addressed in-arc). Full mvn 1180/1180; two red suite runs en route were kill-orphaned-testcontainer environment noise (clean-env run green). NOTE: bead was claimed by the work instance (hal.hildebrand) which filed it; fix executed on this instance at Hal's direction."}}
+{"id":"int-f59afa4f66403f0368e2c7ffcee0319b","kind":"field_change","created_at":"2026-07-07T23:14:09.566678Z","actor":"Hellblazer","issue_id":"nexus-id750","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Fixed on develop c83b35b9 (ships 6.3.8). resolve_default_local_leg() in migration/detection.py: product path (NX_LOCAL_CHROMA_PATH -> XDG -> ~/.local/share/nexus/chroma) wins when present, legacy <config>/chroma secondary probe. Deep chokepoint open_local_read_client(None) resolves it too (critique CRITICAL: detection-only fix would have provisioned then crashed the ETL on Path(None) — empirically A/B'd: pre-fix bare-journey MVV FAILED with NoneType at leg=local, post-fix PASSED). Same default fixed in nx storage migrate vectors (critique HIGH). Harness: rehearse_guided.sh seeds the product default + invokes BARE (the four-release mask). Tests: resolver matrix + None-chokepoint + CLI gates."}}
+{"id":"int-39b31389147a38057e6c7c8ce5c419a5","kind":"field_change","created_at":"2026-07-07T23:14:10.758553Z","actor":"Hellblazer","issue_id":"nexus-ltix8","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Fixed on develop c83b35b9 (ships 6.3.8). guided-upgrade's no-op now requires BOTH legs clean: empty Chroma + absent T2 SQLite. T2-present proceeds to provision+migrate (T3 no-ops naturally; _run_migration ships T2 unconditionally). Fully-covered installs (all stores skipped by clean reports + no Chroma) reach a clean 'nothing to do' no-op (critique M3 — the mcp_infra degraded-write backstop leaves memory.db on disk in ordinary service-mode operation, so existence alone must not mean work). Success tail warns on exported NX_STORAGE_BACKEND=sqlite. Sibling path bug: nexus-id750. GH #1381 auto-closes at the 6.3.8 release merge (Fixes footer)."}}
+{"id":"int-76898b7b2022b3ef8749891a16d718cd","kind":"field_change","created_at":"2026-07-07T23:43:29.600417Z","actor":"Hellblazer","issue_id":"nexus-goypg","extra":{"field":"priority","new_value":"1","old_value":"2"}}
+{"id":"int-ab5e125d6a96e6818ee4242f76215d0a","kind":"field_change","created_at":"2026-07-07T23:46:34.879161Z","actor":"Hellblazer","issue_id":"nexus-ddvkj","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Root-caused 2026-07-07 (nexus-f4wcg arc): NOT engine drift — Voyage serves multiple numerically different variants (~4e-5 cosine apart) for the IDENTICAL request across serving replicas. Decisive evidence: the Python SDK alone, called twice back-to-back with the identical batch, returned both variants (shas 3eb01cde/bc712346, cosine 0.999958095525239 — the same 4.2e-5 figure this bead reports). The 'since ~2026-07-03' onset = when Voyage's fleet went heterogeneous, not an engine change. Engine wire body is now byte-locked to the python SDK format anyway (6ddd17b7, VoyageEmbedderBodyTest) and the parity gate uses cosine 1e-3 with structural wire-format verification. Full record: T2 nexus/voyage-standard-endpoint-cross-session-nondeterminism [20402]. Same-day cross-instance duplicate class (3rd today: 1kise, ltix8-vs-id750 near-miss, this)."}}
+{"id":"int-2b4680acf2426885e48c94d89b9c6821","kind":"field_change","created_at":"2026-07-08T00:18:21.187673Z","actor":"Hellblazer","issue_id":"nexus-t8abd","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"conexus ACK received 2026-07-07 ([20416]): the shipped conservative default (data-scoped bearers' /v1/sessions/start defaults to the data ceiling, 400 above it) is ACCEPTED as-is. Their EdgeProxyHandler never calls /v1/sessions/start — the JIT data-token flow uses the mint credential directly as the upstream bearer, so the default is never exercised on their side. No engine change needed. Last open residual of the RDR-005 A1 arc (868dq/x1h07): the arc is now residual-free end to end."}}
+{"id":"int-45a83838df325d61eb32ac33583dac2e","kind":"field_change","created_at":"2026-07-08T00:30:44.6355Z","actor":"Hellblazer","issue_id":"nexus-goypg","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Shipped on develop a5dbe119, no ceremony per scope decision. Proxy server + entry point + mcp.json stanza + 2 test files + 3 package tests deleted; dt_incorporate relocated verbatim as 'nx dt incorporate <uuid>' (4 new tests); nexus.mcp_client.devonthink KEPT (consumer client for dt_link_generator/writeback/enrich). Docs + both changelogs updated incl. the resolve_google_books_metadata -> resolve_book_metadata rename callout (critique MEDIUM). 586 tests green; inverse-grep clean; stacked reviews clear. MINOR bump (6.4.0) rides the next release per the changelog entries."}}
+{"id":"int-67f6e7eb7ad9ab669f6b0541af835a1e","kind":"field_change","created_at":"2026-07-08T00:40:23.213775Z","actor":"Hellblazer","issue_id":"nexus-mk73z","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Groomed 2026-07-08: superseded by RDR-152 (epic nexus-gmiaf) — this was the pre-RDR umbrella for the arch pivot; RDR-152 became the pivot and SHIPPED (6.0.0-era, Postgres+Java engine serving production at api.conexus-nexus.com since 2026-06; RDR-158 carries the SQLite retirement tail). No unique children; everything lives under gmiaf/tdkg1."}}
+{"id":"int-eede390f0049db3cc63bcbf3ea0d1386","kind":"field_change","created_at":"2026-07-08T00:40:55.279802Z","actor":"Hellblazer","issue_id":"nexus-w5v8j","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Groomed 2026-07-08: 9/10 children shipped and closed (868dq/x1h07 scoped tokens + mint arc completed + deployed + conexus-confirmed 2026-07-07 [20399][20412][20416]; 6o0bc artifacts, ehc4q metering headers, i67t3+hm389 onboarding, vwvv5.12 managed endpoint, lcogi two-phase search, 4pz86 RLS-under-PgBouncer all shipped). The epic's purpose (keep cross-repo asks grouped) is fulfilled; sole residual nexus-jioh1 is a P3 OBSERVATION detached to standalone with a revisit trigger on the bead — deliberate, not silent scope reduction."}}
+{"id":"int-bf9f4ed604f5742d43d99c57cb7d14a3","kind":"field_change","created_at":"2026-07-08T00:40:57.842473Z","actor":"Hellblazer","issue_id":"nexus-bwct4","extra":{"field":"status","new_value":"deferred","old_value":"open"}}
+{"id":"int-78a1cb78954d643de5c761fb493fb01b","kind":"field_change","created_at":"2026-07-08T00:41:48.2779Z","actor":"Hellblazer","issue_id":"nexus-9mzkd","extra":{"field":"priority","new_value":"3","old_value":"2"}}
+{"id":"int-b82bd9caab07914d3bdc3d78a1e7f2d3","kind":"field_change","created_at":"2026-07-08T00:50:14.226767Z","actor":"Hellblazer","issue_id":"nexus-mzvwa.7","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Soak review EXECUTED 2026-07-08 over the full 48-day window (14,419 events). Findings: T2 nexus/rdr-121-p4-soak-findings.md [20418]. Rules healthy: git_add_all 38 denies/~0 true escapes (KEEP); grep 1,436 denies, no confirmed matcher FP in sample (KEEP, no refinement); phase_review fail-closed working (18 real gate catches; 38 deliberate operator escapes, reasons un-auditable due to frag truncation). HEADLINE: the escape-rate telemetry itself shipped broken — escape logged pre-match in both broad rules produced identical 6,130 phantom counts and made as-recorded esc% (99.4%/81%) meaningless; recomputed by hand for this review. Two refinement beads filed under the epic (escape-ordering fix P2; telemetry hygiene P3). Catalogue = 3 rules < 5 threshold: no follow-on architecture RDR. A4 verdict: no wholesale silencing (true escape rates ~0% for redirects; phase_review's overrides qualitatively legitimate, re-evaluate after reason-logging lands)."}}
+{"id":"int-da059ced04cb2489f1a3e6b727674e7c","kind":"field_change","created_at":"2026-07-08T01:06:40.646021Z","actor":"Hellblazer","issue_id":"nexus-mzvwa.8","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Fixed on develop 6a461ba6. git_add_all rule reordered scan-then-escape: an escape event now means 'would have been denied, operator overrode' — the 6,130-phantom-escape class (any annotated Bash command logging escape on an unmatched rule) is dead. TDD: phantom-escape regression (failed pre-fix) + true-escape preservation, 17/17. Installed marketplace copy + all 12 cache copies patched in place (a69bea88 precedent) so telemetry is clean immediately, not at 6.4.0. grep rule moot (unregistered since a69bea88); phase_review already correct. Remaining telemetry work: nexus-mzvwa.9."}}
+{"id":"int-8ffd92da330ce08958e5c67950db84bd","kind":"field_change","created_at":"2026-07-08T01:21:51.169808Z","actor":"Hellblazer","issue_id":"nexus-myk4e","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"SHIPPED + CI-GREEN end to end. Workflow .github/workflows/guided-upgrade-mvv.yml registered on main (PR #1384, merged after a wall-clock flake rerun — flake filed nexus-77fqp); develop carries the bge build-ARG plumbing (1decccd3). Dispatch shakeout run 28910150293 completed SUCCESS on the ubuntu runner: full chain proven in CI — uv sync, wheel build, GraalVM -Ob native build in docker, rehearsal image with the SELF-HOSTED bge asset fetch (no HuggingFace dependency), and the BARE default-path guided journey (the nexus-id750 harness leg that caught both GH #1381 criticals). Cadence per CI-cost directives: weekly Mon 10:41 UTC + workflow_dispatch + develop-push path-gated on migration inputs; no secrets; concurrency-cancelled; success-marker grep + log artifact. Also validated locally end-to-end with the CI asset URLs before wiring. The release-N+1 hard gate (RDR-002 ez5.14/15 escalation) now exists: RDR-155 P4b's myk4e precondition is SATISFIED (P4b itself remains DO-NOT-START pending Hal's explicit go + the 6.3.8 adoption window per the gate comments on 7bomn/19svb)."}}
+{"id":"int-1b79c70b256310d43f4c7278ed3075ae","kind":"field_change","created_at":"2026-07-08T01:53:44.693105Z","actor":"Hellblazer","issue_id":"nexus-yv5m4","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Fixed on develop bed75396. _acquire_pg_bundle_step downloads+verifies (sha256+Sigstore) nexus-pg-<platform>.txz from the pinned tag when host preflight raises PgBinaryNotFoundError/PgVectorNotInstalledError; wired into _provision_postgres_step before provision(). 10 regression tests (tests/test_init_pg_bundle_acquire.py). Stacked review: critic clean (test gap added), code-review High fixed (unguarded extraction). Workaround posted GH #1381 for 6.3.8 users: nx daemon service install-binary engine-service-v0.1.32. CI-exercise of this path = nexus-5qefg."}}

.claude-plugin/marketplace.json

@@ -11,21 +11,21 @@
         "source": "git-subdir",
         "url": "https://github.com/Hellblazer/nexus.git",
         "path": "conexus",
-        "ref": "v6.3.8"
+        "ref": "v6.4.0"
       },
       "description": "Self-hosted three-tier knowledge management with 13 specialized agents, plan-centric retrieval via nx_answer, semantic search, and RDR decision tracking for Claude Code.",
-      "version": "6.3.8"
+      "version": "6.4.0"
     },
     {
       "name": "sn",
       "source": {
         "source": "git-subdir",
         "url": "https://github.com/Hellblazer/nexus.git",
         "path": "sn",
-        "ref": "v6.3.8"
+        "ref": "v6.4.0"
       },
       "description": "Injects Serena and Context7 MCP tool usage guidance into subagents via SubagentStart hook.",
-      "version": "6.3.8"
+      "version": "6.4.0"
     }
   ]
 }

CHANGELOG.md

@@ -6,6 +6,16 @@ Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [6.4.0] - 2026-07-07
+
+### Removed
+
+- **`nx-mcp-devonthink` (the RDR-139 Layer A' proxy server).** Every tool it exposed was a curated forward to DEVONthink's own built-in MCP server — connect your MCP client to DEVONthink's server directly (DT 4 Settings). One tool name differs: the proxy's `resolve_google_books_metadata` maps to the official `resolve_book_metadata` (a superset: Google Books first, Open Library fallback). The one nexus-specific capability, the `dt_incorporate` composite (DT-derived `relates` edges + nexus identity stamped back onto the DT record), lives on as the new `nx dt incorporate <uuid>` CLI verb. Plugin surface change: ships as a MINOR version bump.
+
+### Fixed
+
+- **`nx init` / `nx guided-upgrade` now ALWAYS provision from the signed PostgreSQL bundle** (GH #1381, round 3). Previously nothing on the bare path ever downloaded the bundle: provisioning fell back to host-PostgreSQL discovery and dead-ended at brew / build-pgvector-from-source hints (Homebrew's pgvector formula does not target `postgresql@17`), even though every engine release ships a self-contained `nexus-pg-<platform>.txz` with pgvector baked in. The bundle is now downloaded unconditionally through the same verified seam as `nx daemon service install-binary` (sha256 + Sigstore) and selected before provisioning — host PostgreSQL is never probed or silently used, so behavior no longer depends on what happens to be installed. Two exceptions only: an explicit `NEXUS_PG_BIN` override is honoured as-is, and an existing cluster data directory (serving or stopped) is left untouched — an established install keeps whatever PostgreSQL created it. Acquisition failure (offline, no pinned tag) fails loud with the remedy instead of falling back.
+
 ## [6.3.8] - 2026-07-07
 
 ### Fixed