[Deicyde]

Hold until the release being built now is promoted. site/ops/brain-nightly.sh is release-affecting. If this merges before that promotion, main changes a release-affecting path after that release's authority commit, and the promoter will refuse it. Merge after the promotion, or build the release after this merges.

Problem

brain-nightly.sh builds the Brain from its working tree. Its uncommitted-source check (section 4) names code only. It never looks at the reducer's curated inputs: bot/state/*.json, catalog/data/*, brain/data/*, all curated_git_input in brain/authority/reducer-inputs-v1.json. So two kinds of local state were frozen into a release whose Git authority lacked those bytes:

• a local edit on the nightly host, such as python3 bot/brain_queue.py, which bot/README.md documents;
• an ignored file the reducer reads: bot/state/pool_candidates.json is gitignored, and brain/build_cells.py reads it when present.

Change

• A curated-input check in section 4, right after the uncommitted-source check.
  • It reads the inventory's curated_git_input paths and runs git status --ignored=matching --untracked-files=all --porcelain on them. It reports tracked inputs that differ from HEAD ( M, D, staged) and ignored or untracked ones that exist (!!, ??).
  • If any are found, the release aborts with curated reducer inputs differ from HEAD; the Git authority would be false and the paths.
  • An invalid inventory or a failed git status aborts with its own message, the same way the source check fails closed.
  • --untracked-files=all keeps it working when the host repo sets status.showUntrackedFiles=no.
• The fold's outputs are exempt.
  • brain/fold_proposals.py rewrites these curated inputs on every run: brain/data/{container_links,discovery_proposals,discovery_rejected,ext_anchor_links,fc_links}.jsonl and catalog/data/<key>_links.jsonl (today tauceti_links.jsonl), and it appends to catalog/data/{grounding_overrides,universe_extension}.jsonl.
  • The nightly never commits or reverts those writes, so any check over them, before or after the fold, would block every publish once the fold's output drifts from HEAD.
  • Nothing in the run writes the other ten curated inputs (the five bot/state files, source_registry, rebuild_grounding, decl_renames, community_edges, frontier_suitability_overrides), so checking them at release time also catches edits made during the run.
• The uncommitted-source check no longer names site/ops/brain-canary.py. The nightly hasn't run it since 81c33d4d; the promoter and .github/workflows/brain-canary.yml do.
• POLICY is now wikilean.release-neutral-paths/v2, for the rule changes in Release policy: AGENTS.md and CONTRIBUTING.md are release-neutral #68 (AGENTS.md and CONTRIBUTING.md neutral) and site/ops: the reducer's bot/state inputs are release-affecting #75 (the bot/state inputs release-affecting). The ID isn't persisted: the promoter keeps it in memory and records only neutral_changes.
• site/ops/README.md says what the gate refuses and how to clear it.

Operator notes

• First nightly after merge: a host with a stray bot/state/pool_candidates.json, or uncommitted edits to the checked curated inputs, stops publishing shadow releases until those are committed, reverted or removed. The log lists the paths. The operator checkout ran the laptop poller until 2026-08-23, which wrote pool_candidates.json, so check for it.
• Community harvest: with WIKILEAN_COMMUNITY_HARVEST=1 (default 0), nightly-moderate.sh rewrites brain/data/community_edges.jsonl. That now blocks the next Brain publish until the harvest output is committed.

Not changed, and worth a decision

The fold's own output still reaches the release uncommitted. The release records those bytes (the legacy declared-input root hashes the working tree), but its authority commit doesn't hold them. Hand edits to those seven fold-written files are also not flagged. Whether fold output must be committed before a release is frozen is left open.

Tests (site/ops/test_brain_nightly.py)

• test_changed_curated_inputs_block_the_release_except_fold_outputs extracts the check from the script, runs it under bash against a temporary git repo, and checks that the check sits after the fold and before the abort elif. Cases:
  • a clean tree: publishes;
  • changed non-curated and fold-written files: publishes;
  • an edited tracked input plus a present ignored input: M … and !! …;
  • the same with status.showUntrackedFiles=no;
  • an invalid inventory: fails closed.
• test_curated_check_exempts_exactly_the_fold_outputs pins the exemption list to the curated .jsonl files fold_proposals.py names, plus the <key>_links pattern.
• The cleanliness test asserts the script doesn't name brain-canary.py.
• In site/ops/test_brain_release_authority.py, the canary test becomes test_every_file_the_nightly_names_is_release_affecting.

I didn't run these locally because machine load was above the agreed limit; CI runs them. bash -n passes under bash and /bin/bash 3.2, and the exemption pin was checked by hand against the current files.

This PR's commits sit directly on main (43d3ed74).

[Deicyde]

Recommendation: merge, but only after the release being built now is promoted (brain-nightly.sh is release-affecting). An independent adversarial review of the first head (fb4c3907) found one design flaw and four smaller issues. All are fixed in 17d91e73, and CI is green (run 39082095320: 25 nightly tests, 10 policy tests).

• Fixed, the design flaw:
  • The first version checked curated inputs at the start of the run. fold_proposals.py rewrites seven curated files plus <key>_links.jsonl every night, and the nightly never commits or reverts them. So the next run would have flagged the previous night's fold output and blocked every publish once the fold drifted from HEAD.
  • The check now runs in section 4 and exempts the fold's outputs. A test pins the exemption list to the files fold_proposals.py writes.
• Fixed, smaller:
  • --untracked-files=all, so status.showUntrackedFiles=no can't fail every publish.
  • Separate abort messages for an invalid inventory and a git status failure.
  • fc_links.jsonl added to the body's list of fold writes.
  • The canary-removal SHA updated to 81c33d4d for the current history.
  • The operator note moved into site/ops/README.md.
• Verified by the review:
  • Control flow under set -uo pipefail and /bin/bash 3.2.
  • Git semantics for M, D, staged, ?? and !!.
  • Nothing before the check writes the checked inputs.
  • The existing gate tests are unaffected.
  • _nightly_watched() still parses the right command.
  • POLICY is used only in memory.
  • No conflicts with the other open PRs.
• Still open, as decisions rather than fixes:
  • Fold output: it reaches releases uncommitted, and hand edits to those seven files aren't flagged.
  • Community harvest: with WIKILEAN_COMMUNITY_HARVEST=1, its rewrite of community_edges.jsonl blocks the next publish until committed.

[Deicyde]

Re-review on main (eaa5950b): follow-up needed (docs and one tightening). The gate works; no revert.

Verified:

• Coverage: the check runs on every publish path, after the fold and before the abort chain, and the chain order is right.
• No false aborts: nothing writes the ten checked curated inputs between runs, apart from the two opt-in or manual cases below.
• Exemptions: FOLD_OUTPUTS matches fold_proposals.py's write sites exactly. The pin test's logic recomputed on main's files: exempt == named & curated.
• bash 3.2: the snippet behaves under /bin/bash 3.2.57 with set -uo pipefail (clean tree, exempt changes, staged, unstaged, deleted and ignored files, plus both fail-closed paths).
• No conflict with Security hardening: agent sandbox, fail-closed auth, request caps, static headers, token sealing #84: Security hardening: agent sandbox, fail-closed auth, request caps, static headers, token sealing #84 adds no writers of curated inputs.

Release B: whoever builds or promotes it should read this.

• The planned order broke. Attest the non-Brain public assets for Brain release B #82 set its own merge commit as release B's authority commit and asked for "Security hardening: agent sandbox, fail-closed auth, request caps, static headers, token sealing #84, then Formalization atlas: a read-only data plane for where WikiProject Mathematics is formalized #85, then this PR", with main frozen until P1C. Instead Attest the non-Brain public assets for Brain release B #82 merged first (05:48:43), Security hardening: agent sandbox, fail-closed auth, request caps, static headers, token sealing #84 merged 24 s later, and Nightly: refuse curated inputs changed before the run; policy v2 #83 merged at 06:42. Both Security hardening: agent sandbox, fail-closed auth, request caps, static headers, token sealing #84 and Nightly: refuse curated inputs changed before the run; policy v2 #83 are release-affecting, and Formalization atlas: a read-only data plane for where WikiProject Mathematics is formalized #85 is still open.
• Consequence: a release B built at f5556a61 (Attest the non-Brain public assets for Brain release B #82's merge) or cdc2b1c6 cannot be promoted from current main. It needs a rebuild at eaa5950b or later.
• Attestation mismatch: main's wiki/public-asset-source-attestation.json attests assets/atlas.css and assets/atlas.js "added by PR Formalization atlas: a read-only data plane for where WikiProject Mathematics is formalized #85", but main has no atlas sources. Settle that before freezing a baseline: merge Formalization atlas: a read-only data plane for where WikiProject Mathematics is formalized #85 first, or re-attest without the atlas.

Follow-ups:

• Operator docs: they don't say that two documented actions now block Brain publishes until their output is committed:
  • WIKILEAN_COMMUNITY_HARVEST=1 (site/ops/README.md:77-81, site/ops/nightly.local.env.example:16-20) rewrites community_edges.jsonl;
  • running bot/brain_queue.py in the nightly checkout (bot/README.md:76-77) rewrites brain_queue.json.
• Tightening: fnmatchcase("catalog/data/*_links.jsonl") lets * cross /. It should match only catalog/data/<key>_links.jsonl, and the fold writes just the frontier_sources keys. Harmless today, since tauceti_links.jsonl is the only curated match.

Your call:

• Append-only files: the fold only appends to grounding_overrides.jsonl and universe_extension.jsonl. A "HEAD's bytes are a prefix of the working file" check would still catch hand edits to those two.
• First failure only: when both source and curated inputs are dirty, the log names only the source failure.
• Local commits: "commit" in the abort message can produce a local commit that isn't on main, which the promoter then refuses. The source check has the same issue.