* feat(v2.0.9): Autopilot — backend event-subscriber routes 6 live events into cognitive hooks
The single architectural change that flips 14 dormant cognitive primitives
into active ones. Before this commit, Vestige's 20-event WebSocket bus had
zero backend subscribers — every emitted event flowed to the dashboard
animation layer and terminated. Cognitive modules with fully-built trigger
methods (synaptic_tagging.trigger_prp, predictive_memory.record_*,
activation_network.activate, prospective_memory.check_triggers, the 6h
auto-consolidation dreamer path) were never actually called from the bus.
New module `crates/vestige-mcp/src/autopilot.rs` spawns two tokio tasks at
startup:
1. Event subscriber — consumes the broadcast::Receiver, routes:
- MemoryCreated → synaptic_tagging.trigger_prp(CrossReference)
+ predictive_memory.record_memory_access(id, preview, tags)
- SearchPerformed → predictive_memory.record_query(q, [])
+ record_memory_access on top 10 result_ids
- MemoryPromoted → activation_network.activate(id, 0.3) spread
- MemorySuppressed → emit Rac1CascadeSwept (was declared-never-emitted)
- ImportanceScored (composite > 0.85 AND memory_id present)
→ storage.promote_memory + re-emit MemoryPromoted
- Heartbeat (memory_count > 700, 6h cooldown)
→ spawned find_duplicates sweep (rate-limited)
The loop holds the CognitiveEngine mutex only per-handler, never across
an await, so MCP tool dispatch is never starved.
2. Prospective poller — 60s tokio::interval calls
prospective_memory.check_triggers(Context { timestamp: now, .. }).
Matched intentions are logged at info! level today; v2.5 "Autonomic"
upgrades this to MCP sampling/createMessage for agent-side notifications.
ImportanceScored event gained optional `memory_id: Option<String>` field
(#[serde(default)], backward-compatible) so auto-promote has the id to
target. Both existing emit sites (server.rs tool dispatch, dashboard
handlers::score_importance) pass None because they score arbitrary content,
not stored memories — matches current semantics.
docs/VESTIGE_STATE_AND_PLAN.md §15 POST-v2.0.8 ADDENDUM records the full
three-agent audit that produced this architecture (2026-SOTA research,
active-vs-passive module audit, competitor landscape), the v2.0.9/v2.5/v2.6
ship order, and the one-line thesis: "the bottleneck was one missing
event-subscriber task; wiring it flips Vestige from memory library to
cognitive agent that acts on the host LLM."
Verified:
- cargo check --workspace clean
- cargo clippy --workspace -- -D warnings clean (let-chain on Rust 1.91+)
- cargo test -p vestige-mcp --lib 356/356 passing, 0 failed
* fix(autopilot): supervisor + dedup race + opt-out env var
Three blockers from the 5-agent v2.0.9 audit, all in autopilot.rs.
1. Supervisor loops around both tokio tasks (event subscriber + prospective
poller). Previously, if a cognitive hook panicked on a single bad memory,
the spawned task died permanently and silently — every future event lost.
Now the outer supervisor catches JoinError::is_panic(), logs the panic
with full error detail, sleeps 5s, and respawns the inner task. Turns
a permanent silent failure into a transient hiccup.
2. DedupSweepState struct replaces the bare Option<Instant> timestamp. It
tracks the in-flight JoinHandle so the next Heartbeat skips spawning a
second sweep while the first is still running. Previously, the cooldown
timestamp was set BEFORE spawning the async sweep, which allowed two
concurrent find_duplicates scans on 100k+ memory DBs where the sweep
could exceed the 6h cooldown window. is_running() drops finished handles
so a long-dead sweep doesn't block the next legitimate tick.
3. VESTIGE_AUTOPILOT_ENABLED=0 opt-out. v2.0.8 users updating in place
can preserve the passive-library contract by setting the env var to
any of {0, false, no, off}. Any other value (unset, 1, true, etc.)
enables the default v2.0.9 Autopilot behavior. spawn() early-returns
with an info! log before any task is spawned.
Audit breakdown:
- Agent 1 (internals): NO-GO → fixed (1, 2)
- Agent 2 (backward compat): NO-GO → fixed (3)
- Agent 3 (orphan cleanup): GO clean
- Agent 4 (runtime safety): GO clean
- Agent 5 (release prep): GO, procedural note logged
Verification:
- cargo check -p vestige-mcp: clean
- cargo test -p vestige-mcp --lib: 373 passed, 0 failed
- cargo clippy -p vestige-mcp --lib --bins -- -D warnings: clean
* chore(release): v2.0.9 "Autopilot"
Bump workspace + vestige-core + vestige-mcp + apps/dashboard to 2.0.9.
CHANGELOG [2.0.9] entry + README hero banner rewrite to "Autopilot".
Scope (two commits on top of v2.0.8):
- 0e9b260: 3,091 LOC orphan-code cleanup
- fe7a68c: Autopilot backend event-subscriber
- HEAD (this branch): supervisor + dedup race + opt-out env var hardening
Pure backend release — tool count unchanged (24), schema unchanged,
JSON-RPC shape unchanged, CLI flags unchanged. Only visible behavior
change is the Autopilot task running in the background, which is
VESTIGE_AUTOPILOT_ENABLED=0-gated.
Test gate: 1,223 passing / 0 failed (workspace, no-fail-fast).
Clippy: clean on vestige-mcp lib + bins with -D warnings.
Audit: 5 parallel agents (internals, backward compat, orphan cleanup,
runtime safety, release prep) — all GO after hardening commit.
Nine tool modules in crates/vestige-mcp/src/tools/ had zero callers after
the v2.0.x unification work shipped *_unified + maintenance::* replacements.
They'd been #[allow(dead_code)]-papered over and forgotten. Verified each
module independently: grep for tools::<name>::, string dispatch in server.rs,
cross-crate usage — all nine returned zero external callers.
Removed modules (all superseded):
checkpoint (364 LOC) — no callers anywhere
codebase (298) — superseded by codebase_unified
consolidate (36) — superseded by maintenance::execute_consolidate
ingest (456) — superseded by smart_ingest
intentions (1,093) — superseded by intention_unified
knowledge (106) — no callers anywhere
recall (403) — superseded by search_unified
search (184) — superseded by search_unified
stats (132) — superseded by maintenance::execute_system_status
Also removed:
- EmotionCategory::base_arousal (10 LOC, zero callers)
Kept (still string-dispatched from server.rs):
- context, feedback, memory_states, review, tagging
Doc fixes (ghost env vars that were documented but zero Rust source reads):
- docs/CONFIGURATION.md — dropped VESTIGE_DATA_DIR, VESTIGE_LOG_LEVEL rows
(neither is read anywhere; --data-dir CLI flag + RUST_LOG are the real
mechanisms). Added the full real env-var table.
- packages/vestige-mcp-npm/README.md — same two ghost rows dropped
- docs/VESTIGE_STATE_AND_PLAN.md:399 — dropped VESTIGE_DATA_DIR row
- docs/VESTIGE_STATE_AND_PLAN.md:709 — typo VESTIGE_API_KEY
-> VESTIGE_AUTH_TOKEN (matches shipping convention), "open if unset"
-> "auto-generated if unset" to match actual behavior
Verified post-cleanup:
- cargo check --workspace clean
- cargo clippy --workspace -D warnings clean
- cargo test --workspace 1,223 passing / 0 failed
- cargo build --release -p vestige-mcp clean
Net: -3,091 LOC (14 files), zero behavior change, zero regressions.
* docs: anti-hedging banner + master state-and-plan + UI roadmap
Project-level CLAUDE.md line 1 is now the anti-hedging banner referencing
the global rule at /Users/entity002/CLAUDE.md. When Sam commits to an
execution path (content cadence, shipping velocity, outreach, launch),
forecasts compute as if the commitment is already met — no discounting by
execution probability.
VESTIGE_STATE_AND_PLAN.md (1135 lines, 14 parts): single-page reference
any AI agent can read to plan the next phase without re-reading the repo.
Covers current state of every crate, the 24 MCP tools, the 19 WebSocket
event types, the 8 IDE integrations, and v2.1 through v3.0 roadmap.
UI_ROADMAP_v2.1_v2.2.md: compiled UI-gap analysis from 4 parallel research
agents (April 19). 10 critical UI gaps + 2026 bleeding-edge patterns +
unclaimed territory (menu bar widget, voice-first, AR/VR, time-scrubber).
* feat(v2.2-pulse): InsightToast + multi-process STORAGE docs
Two independent ship items landing together on the v2.2 branch ahead of
the Tuesday launch — a new UI surface that makes Vestige's cognitive
events visible in real time, and honest documentation of the multi-process
safety story that underpins the Stigmergic Swarm narrative.
**InsightToast** (apps/dashboard/src/lib/components/InsightToast.svelte,
apps/dashboard/src/lib/stores/toast.ts):
The dashboard already had a working WebSocket event stream on
ws://localhost:3927/ws that broadcast every cognitive event (dream
completions, consolidation sweeps, memory promotions/demotions, active-
forgetting suppression and Rac1 cascades, bridge discoveries). None of
that was surfaced to a user looking at anything other than the raw feed
view. InsightToast subscribes to the existing eventFeed derived store,
filters the spammy lifecycle events (Heartbeat, SearchPerformed,
RetentionDecayed, ActivationSpread, ImportanceScored, MemoryCreated),
and translates the narrative events into ephemeral toasts with a
bioluminescent colored accent matching EVENT_TYPE_COLORS.
Design notes:
- Rate-limited ConnectionDiscovered at 1.5s intervals (dreams emit many).
- Max 4 visible toasts, auto-dismiss at 4.5-7s depending on event weight.
- Click or Enter/Space to dismiss early.
- Bottom-right on desktop, top-banner on mobile.
- Reduced-motion honored via prefers-reduced-motion.
- Zero new websocket subscriptions — everything piggybacks on the
existing derived store.
Also added a "Preview Pulse" button to Settings -> Cognitive Operations
that fires a synthetic sequence of four toasts (DreamCompleted,
ConnectionDiscovered, MemorySuppressed, ConsolidationCompleted) so
the animation is demoable without waiting for real cognitive activity.
**Multi-Process Safety section in docs/STORAGE.md**:
Grounds the Stigmergic Swarm story with concrete tables of what the
current WAL + 5s busy_timeout configuration actually supports vs what
remains experimental. Key honest points:
- Shared --data-dir + ONE vestige-mcp + N clients is the shipping
pattern for multi-agent coordination.
- Two vestige-mcp processes writing the same file is experimental —
documented with the lsof + pkill recovery path.
- Roadmap lists the three items that would promote it to "supported":
advisory file lock, retry-with-jitter on SQLITE_BUSY, and a
concurrent-writer load test.
Build + typecheck:
- npm run check: 0 errors, 0 warnings across 583 files
- npm run build: clean static build, adapter-static succeeds
* feat(v2.3-terrarium): Memory Birth Ritual + event pipeline fix
v2.3 "Terrarium" headline feature. When a MemoryCreated event arrives, a
glowing orb materialises in the cosmic center (camera-relative z=-40),
gestates for ~800ms growing from a tiny spark into a full orb, then arcs
along a dynamic quadratic Bezier curve to the live position of the real
node, and on arrival hands off to the existing RainbowBurst + Shockwave +
RippleWave cascade. The target position is re-resolved every frame so
the force simulation can move the destination during flight without the
orb losing its mark.
**New primitive — EffectManager.createBirthOrb()** (effects.ts):
Accepts a camera, a color, a live target-position getter, and an
arrival callback. Owns a sprite pair (outer halo + inner bright core),
both depthTest:false with renderOrder 999/1000 so the orb is always
visible through the starfield and the graph.
- Gestation phase: easeOutCubic growth + sinusoidal pulse, halo tints
from neutral to event color as the ritual charges.
- Flight phase: QuadraticBezierCurve3 with control point at midpoint
raised on Y by 30 + 15% of orb-to-target distance (shooting-star
arc). Sampled with easeInOutQuad. Orb shrinks ~35% approaching target.
- Arrival: fires onArrive callback once, then fades out over 8 frames
while expanding slightly (energy dispersal).
- Caller's onArrive triggers the burst cascade at arrivePos (NOT the
original spawnPos — the force sim may have moved the target during
the ritual, so we re-read nodeManager.positions on arrival).
- Dispose path integrated with existing EffectManager.dispose().
**Event pipeline fix — Graph3D.processEvents()**:
Previously tracked `processedEventCount` assuming APPEND order, but
websocket.ts PREPENDS new events (index 0) and caps the array at
MAX_EVENTS. Result: only the first MemoryCreated event after page
load fired correctly; subsequent ones reprocessed the oldest entry.
Fixed to walk from index 0 until hitting the last-processed event
by reference identity — correct regardless of array direction or
eviction pressure. Events are then processed oldest-first so causes
precede effects. Found while wiring the v2.3 demo button; would have
manifested as "first orb only" in production.
**Demo trigger** (Settings -> Birth Ritual Preview):
Button that calls websocket.injectEvent() with a synthetic
MemoryCreated event, cycling through node types (fact / concept /
pattern / decision / person / place) to showcase the type-color
mapping. Downstream consumers can't distinguish synthetic from real,
so this drives the full ritual end-to-end. Intended for demo clip
recording for the Wednesday launch.
**Test coverage:**
- events.test.ts now tests the v2.3 birth ritual path: spawns 2+
sprites in the scene immediately, and fires the full arrival
cascade after driving the effects.update() loop past the ritual
duration.
- three-mock.ts extended with Vector3.addVectors, Vector3.applyQuaternion,
Color.multiplyScalar, Quaternion, QuadraticBezierCurve3, Texture,
and Object3D.quaternion/renderOrder so production code runs unaltered
in tests.
Build + typecheck:
- npm run check: 0 errors, 0 warnings across 583 files
- npm test: 251/251 pass (net +0 from v2.2)
- npm run build: clean adapter-static output
The Sanhedrin Shatter (anti-birth ritual for hallucination veto) needs
server-side event plumbing and is deferred. Ship this as the Wednesday
visual mic-drop.
* fix(v2.3): 5 FATAL bugs + 4 god-tier upgrades from post-ship audit
Post-ship audit surfaced 6 FATALs and 4 upgrades. Shipping 5 of the 6 +
all 4 upgrades. FATAL 4 (VRAM hemorrhage from un-pooled label canvases
in createTextSprite) is pre-existing, not from this session, and scoped
separately for a proper texture-pool refactor.
**FATAL 1 — Toast Silent Lobotomy** (stores/toast.ts)
Subscriber tracked events[0] only. When Svelte batched multiple events
in one update tick (swarm firing DreamCompleted + ConnectionDiscovered
within the same millisecond), every event but the newest got silently
dropped. Fixed to walk from index 0 until hitting lastSeen — same
pattern as Graph3D.processEvents. Processes oldest-first to preserve
narrative order.
**FATAL 2 — Premature Birth** (graph/nodes.ts + graph/events.ts)
Orb flight is 138 frames; materialization was 30 frames. Node popped
fully grown ~100 frames before orb arrived — cheap UI glitch instead
of a biological birth. Added `addNode(..., { isBirthRitual: true })`
option that reserves the physics slot but hides mesh/glow/label and
skips the materializing queue. New `igniteNode(id)` flips visibility
and enqueues materialization. events.ts onArrive now calls igniteNode
at the exact docking moment, so the elastic spring-up peaks on impact.
**FATAL 3 — 120Hz ProMotion Time-Bomb** (components/Graph3D.svelte)
All physics + effect counters are frame-based. On a 120Hz display every
ritual ran at 2x speed. Added a `lastTime`-based governor in animate()
that early-returns if dt < 16ms, clamping effective rate to ~60fps.
`- (dt % 16)` carry avoids long-term drift. Zero API changes; tonight's
fast fix until physics is rewritten to use dt.
**FATAL 5 — Bezier GC Panic** (graph/effects.ts birth-orb update)
Flight phase allocated a new Vector3 (control point) and a new
QuadraticBezierCurve3 every frame per orb. With 3 orbs in flight that's
360 objects/sec for the GC to collect. Rewrote as inline algebraic
evaluation — zero allocations per frame, identical curve.
**FATAL 6 — Phantom Shockwave** (graph/events.ts)
A 166ms setTimeout fired the 2nd shockwave. If the user navigated
away during that window the scene was disposed, the timer still
fired, and .add() on a dead scene threw unhandled rejection. Dropped
the setTimeout entirely; both shockwaves fire immediately in onArrive
with different scales/colors for the same layered-crash feel.
**UPGRADE 1 — Sanhedrin Shatter** (graph/effects.ts birth-orb update)
If getTargetPos() returns undefined AFTER gestation (target node was
deleted mid-ritual — Stop hook sniping a hallucination), the orb
turns blood-red, triggers a violent implosion in place, and skips
the arrival cascade. Cognitive immune system made visible.
**UPGRADE 2 — Newton's Cradle** (graph/events.ts onArrive)
On docking the target mesh's scale gets bumped 1.8×, so the elastic
materialization + force-sim springs physically recoil instead of the
orb landing silently. The graph flinches when an idea is born into it.
**UPGRADE 3 — Hover Panic** (stores/toast.ts + InsightToast.svelte)
Paused dwell timer on mouseenter/focus, resume on mouseleave/blur.
Stored remaining ms at pause so resume schedules a correctly-sized
timer. CSS pairs via `animation-play-state: paused` on the progress
bar. A toast the user is reading no longer dismisses mid-sentence.
**UPGRADE 4 — Event Horizon Guard** (components/Graph3D.svelte)
If >MAX_EVENTS (200) events arrive in one tick, lastProcessedEvent
falls off the end of the array and the walk consumes ALL 200 entries
as "fresh" — GPU meltdown from 200 simultaneous births. Detect the
overflow and drop the batch with a console.warn, advancing the
high-water mark so next frame is normal.
Build + test:
- npm run check: 0 errors, 0 warnings
- npm test: 251/251 pass
- npm run build: clean static build
* test(v2.3): full e2e + integration coverage for Pulse + Birth Ritual
Post-ship verification pass — five parallel write-agents produced 229 new
tests across vitest units, vitest integration, and Playwright browser e2e.
Net suite: 361 vitest pass (up from 251, +110) and 9/9 Playwright pass on
back-to-back runs.
**toast.test.ts (NEW, 661 lines, 42 tests)**
Silent-lobotomy batch walk proven (multi-event tick processes ALL, not
just newest, oldest-first ordering preserved). Hover-panic pause/resume
with remaining-ms math. All 9 event type translations asserted, all 11
noise types asserted silent. ConnectionDiscovered 1500ms throttle.
MAX_VISIBLE=4 eviction. clear() tears down all timers. fireDemoSequence
staggers 4 toasts at 800ms intervals. vi.useFakeTimers + vi.mock of
eventFeed; vi.resetModules in beforeEach for module-singleton isolation.
**websocket.test.ts (NEW, 247 lines, 30 tests)**
injectEvent adds to front, respects MAX_EVENTS=200 with FIFO eviction,
triggers eventFeed emissions. All 6 derived stores (isConnected,
heartbeat, memoryCount, avgRetention, suppressedCount, uptimeSeconds)
verified — defaults, post-heartbeat values, clearEvents preserves
lastHeartbeat. 13 formatUptime boundary cases (0/59/60/3599/3600/
86399/86400 seconds + negative / NaN / ±Infinity).
**effects.test.ts (EXTENDED, +501 lines, +21 tests, 51 total)**
createBirthOrb full lifecycle — sprite count (halo + core), cosmic
center via camera.quaternion, gestation phase (position lock, opacity
rise, scale easing, color tint), flight Bezier arc above linear
midpoint at t=0.5, dynamic mid-flight target redirect. onArrive fires
exactly once at frame 139. Post-arrival fade + disposal cleans scene
children. Sanhedrin Shatter: target goes undefined mid-flight →
onArrive NEVER called, implosion spawned, halo blood-red, eventual
cleanup. dispose() cleans active orbs. Multiple simultaneous orbs.
Custom gestation/flight frame opts honored. Zero-alloc invariant
smoke test (6 orbs × 150 frames, no leaks).
**nodes.test.ts (EXTENDED, +197 lines, +10 tests, 42 total)**
addNode({isBirthRitual:true}) hides mesh/glow/label immediately,
stamps birthRitualPending sentinel with correct totalFrames +
targetScale, does NOT enqueue materialization. igniteNode flips
visibility + enqueues materialization. Idempotent — second call
no-op. Non-ritual nodes unaffected. Unknown id is safe no-op.
Position stored in positions map while invisible (force sim still
sees it). removeNode + late igniteNode is safe.
**events.test.ts (EXTENDED, +268 lines, +7 tests, 55 total)**
MemoryCreated → mesh hidden immediately, 2 birth-orb sprites added,
ZERO RingGeometry meshes and ZERO Points particles at spawn. Full
ritual drive → onArrive fires, node visible + materializing, sentinel
cleared. Newton's Cradle: target mesh scale exactly 0.001 * 1.8 right
after arrival. Dual shockwave: exactly 2 Ring meshes added. Re-read
live position on arrival — force-sim motion during ritual → burst
lands at the NEW position. Sanhedrin abort path → rainbow burst,
shockwave, ripple wave are NEVER called (vi.spyOn).
**three-mock.ts (EXTENDED)**
Added Color.setRGB — production Three.js has it, the Sanhedrin-
Shatter path in effects.ts uses it. Two write-agents independently
monkey-patched the mock inline; consolidated as a 5-line mock
addition so tests stay clean.
**e2e/pulse-toast.spec.ts (NEW, 235 lines, 6 Playwright tests)**
Navigate /dashboard/settings → click Preview Pulse → assert first
toast appears within 500ms → assert >= 2 toasts visible at peak.
Click-to-dismiss removes clicked toast (matched by aria-label).
Hover survives >8s past the 5.5s dwell. Keyboard Enter dismisses
focused toast. CSS animation-play-state:paused on .toast-progress-
fill while hovered, running on mouseleave. Screenshots attached to
HTML report. Zero backend dependency (fireDemoSequence is purely
client-side).
**e2e/birth-ritual.spec.ts (NEW, 199 lines, 3 Playwright tests)**
Canvas mounts on /dashboard/graph (gracefully test.fixme if MCP
backend absent). Settings button injection + SPA route to /graph
→ screenshot timeline at t=0/500/1200/2000/2400/3000ms attached
to HTML report. pageerror + console-error listeners catch any
crash (would re-surface FATAL 6 if reintroduced). Three back-to-
back births — no errors, canvas still dispatches clicks.
Run commands:
cd apps/dashboard && npm test # 361/361 pass, ~600ms
cd apps/dashboard && npx playwright test # 9/9 pass, ~25s
Typecheck: 0 errors, 0 warnings. Build: clean adapter-static.
* fix(graph): default /api/graph to newest-memory center, add sort param
memory_timeline PR #37 exposed the same class of bug in the graph
endpoint: the dashboard Graph page (and the /api/graph endpoint it
hits) defaulted to centering on the most-connected memory, ran BFS at
depth 3, and capped the subgraph at 150 nodes. On a mature corpus this
clustered the visualization around a historical hotspot and hid freshly
ingested memories that hadn't accumulated edges yet. User-visible
symptom: TimeSlider on /graph showing "Feb 21 → Mar 1 2026" when the
database actually contains memories through today (Apr 20).
**Backend (`crates/vestige-mcp/src/dashboard/handlers.rs`):**
- `GraphParams` gains `sort: Option<String>` (accepted: "recent" |
"connected", unknown falls back to "recent").
- New internal `GraphSort` enum + case-insensitive `parse()`.
- Extracted `default_center_id(storage, sort)` so handler logic and
tests share the same branching. Recent path picks `get_all_nodes(1,
0)` (ORDER BY created_at DESC). Connected path picks
`get_most_connected_memory`, degrading gracefully to recent if the
DB has no edges yet.
- Default behaviour flipped from "connected" to "recent" — matches
user expectation of "show me my recent stuff".
**Dashboard (`apps/dashboard`):**
- `api.graph()` accepts `sort?: 'recent' | 'connected'` with JSDoc
explaining the rationale.
- `/graph/+page.svelte` passes `sort: 'recent'` when no query or
center_id is active. Query / center_id paths unchanged — they
already carry their own centering intent.
**Tests:** 6 new unit tests in `handlers::tests`:
- `graph_sort_parse_defaults_to_recent` (None, empty, garbage,
"recent", "Recent", "RECENT")
- `graph_sort_parse_accepts_connected_case_insensitive`
- `default_center_id_recent_returns_newest_node` — ingest 3 nodes,
assert newest is picked
- `default_center_id_connected_prefers_hub_over_newest` — wire a hub
node with 3 spokes, then ingest a newer "lonely" node; assert the
hub wins in Connected mode even though it's older
- `default_center_id_connected_falls_back_to_recent_when_no_edges`
— fresh DB with no connections still returns newest, not 404
- `default_center_id_returns_not_found_on_empty_db` — both modes
return 404 cleanly on empty storage
Build + test:
- cargo test -p vestige-mcp --lib handlers:: → 6/6 pass
- cargo test --workspace --lib → 830/830 pass, 0 failed
- cargo clippy -p vestige-core -p vestige-mcp --lib -- -D warnings →
clean
- npm run check → 0 errors, 0 warnings
- npm test → 361/361 pass
Binary already installed at ~/.local/bin/vestige-mcp (copied from
cargo build --release -p vestige-mcp). New Claude Desktop / Code
sessions will pick it up automatically when they respawn their MCP
subprocess. The dashboard HTTP server on port 3927 needs a manual
relaunch from a terminal with the usual pattern:
nohup bash -c 'tail -f /dev/null | \
VESTIGE_DASHBOARD_ENABLED=true ~/.local/bin/vestige-mcp' \
> /tmp/vestige-mcp.log 2>&1 & disown
* feat(v2.4): UI expansion — 8 new surfaces exposing the cognitive engine
Sam asked: "Build EVERY SINGLE MISSING UI PIECE." 10 parallel agents shipped
10 new viewports over the existing Rust backend, then 11 audit agents
line-by-line reviewed each one, extracted pure-logic helpers, fixed ~30
bugs, and shipped 549 new unit tests. Everything wired through the layout
with single-key shortcuts and a live theme toggle.
**Eight new routes**
- `/reasoning` — Reasoning Theater: Cmd+K ask palette → animated 8-stage
deep_reference pipeline + FSRS-trust-scored evidence cards +
contradiction arcs rendered as live SVG between evidence nodes
- `/duplicates` — threshold-driven cluster detector with winner selection,
Merge/Review/Dismiss actions, debounced slider
- `/dreams` — Dream Cinema: trigger dream + scrubbable 5-stage replay
(Replay → Cross-reference → Strengthen → Prune → Transfer) + insight
cards with novelty glow
- `/schedule` — FSRS Review Calendar: 6×7 grid with urgency color
bands (overdue/today/week/future), retention sparkline, expand-day list
- `/importance` — 4-channel radar (Novelty/Arousal/Reward/Attention) with
composite score + top-important list
- `/activation` — live spreading-activation view: search → SVG concentric
rings with decay animation + live-mode event feed
- `/contradictions` — 2D cosmic constellation of conflicting memories,
arcs colored by severity, tooltips with previews
- `/patterns` — cross-project pattern transfer heatmap with category
filters, top-transferred sidebar
**Three layout additions**
- `AmbientAwarenessStrip` — slim top band with retention vitals, at-risk
count, active intentions, recent dream, activity sparkline, dreaming
indicator, Sanhedrin-watch flash. Pure `$derived` over existing stores.
- `ThemeToggle` — dark/light/auto cycle with matchMedia listener,
localStorage persistence, SSR-safe, reduced-motion-aware. Rendered in
sidebar footer next to the connection dot.
- `MemoryAuditTrail` — per-memory Sources panel integrated as a
Content/Audit tab into the existing /memories expansion.
**Pure-logic helper modules extracted (for testability + reuse)**
reasoning-helpers, duplicates-helpers, dream-helpers, schedule-helpers,
audit-trail-helpers, awareness-helpers, contradiction-helpers,
activation-helpers, patterns-helpers, importance-helpers.
**Bugs fixed during audit (not exhaustive)**
- Trust-color inconsistency between EvidenceCard and the page confidence
ring (0.75 boundary split emerald vs amber)
- `new Date('garbage').toLocaleDateString()` returned literal "Invalid Date"
in 3 components — all now return em-dash or raw string
- NaN propagation in `Math.max(0, Math.min(1, NaN))` across clamps
- Off-by-one PRNG in audit-trail seeded mock (seed === UINT32_MAX yielded
rand() === 1.0 → index out of bounds)
- Duplicates dismissals keyed by array index broke on re-fetch; now keyed
by sorted cluster member IDs with stale-dismissal pruning
- Empty-cluster crash in DuplicateCluster.pickWinner
- Undefined tags crash in DuplicateCluster.safeTags
- Debounce timer leak in threshold slider (missing onDestroy cleanup)
- Schedule day-vs-hour granularity mismatch between calendar cell and
sidebar list ("today" in one, "in 1d" in the other)
- Schedule 500-memory hard cap silently truncated; bumped to 2000 + banner
- Schedule DST boundary bug in daysBetween (wall-clock math vs
startOfDay-normalized)
- Dream stage clamp now handles NaN/Infinity/floats
- Dream double-click debounce via `if (dreaming) return`
- Theme setTheme runtime validation; initTheme idempotence (listener +
style-element dedup on repeat calls)
- ContradictionArcs node radius unclamped (trust < 0 or > 1 rendered
invalid sizes); tooltip position clamp (could push off-canvas)
- ContradictionArcs $state closure capture (width/height weren't reactive
in the derived layout block)
- Activation route was MISSING from the repo — audit agent created it
with identity-based event filtering and proper RAF cleanup
- Layout: ThemeToggle was imported but never rendered — now in sidebar
footer; sidebar overflow-y-auto added for the 16-entry nav
**Tests — 549 new, 910 total passing (0 failures)**
ReasoningChain 42 | EvidenceCard 50
DuplicateCluster 64 | DreamStageReplay 19
DreamInsightCard 43 | FSRSCalendar 32
MemoryAuditTrail 45 | AmbientAwareness 60
theme (store) 31 | ContradictionArcs 43
ActivationNetwork 54 | PatternTransfer 31
ImportanceRadar 35 | + existing 361 tests still green
**Gates passed**
- `npm run check`: 0 errors, 0 warnings across 623 files
- `npm test`: 910/910 passing, 22 test files
- `npm run build`: clean adapter-static output
**Layout wiring**
- Nav array expanded 8 → 16 entries (existing 8 + 8 new routes)
- Single-key shortcuts added: R/A/D/C/P/U/X/N (no conflicts with
existing G/M/T/F/E/I/S/,)
- Cmd+K palette search works across all 16
- Mobile nav = top 5 (Graph, Reasoning, Memories, Timeline, Feed)
- AmbientAwarenessStrip mounted as first child of <main>
- ThemeToggle rendered in sidebar footer (was imported-but-unmounted)
- Theme initTheme() + teardown wired into onMount cleanup chain
Net branch delta: 47 files changed, +13,756 insertions, -6 deletions
* chore(release): v2.0.8 "Pulse"
Bundled release: Reasoning Theater wired to the 8-stage deep_reference
cognitive pipeline, Pulse InsightToast, Memory Birth Ritual (v2.3
Terrarium), 7 new dashboard surfaces (/duplicates, /dreams, /schedule,
/importance, /activation, /contradictions, /patterns), 3D graph
brightness system with auto distance-compensation + user slider, and
contradiction-detection + primary-selection hardening in the
cross_reference tool. Intel Mac (x86_64-apple-darwin) also flows through
to the release matrix from PR #43.
Added:
- POST /api/deep_reference — HTTP surface for the 8-stage pipeline
- DeepReferenceCompleted WebSocket event (primary + supporting +
contradicting memory IDs for downstream graph animation)
- /reasoning route, full UI + Cmd+K Ask palette
- 7 new dashboard surfaces exposing the cognitive engine
- Graph brightness slider + localStorage persistence + distance-based
emissive compensation so nodes don't disappear into fog at zoom-out
Fixed:
- Contradiction-detection false positives: adjacent-domain memories no
longer flagged as conflicts (NEGATION_PAIRS wildcards removed,
shared-words floor 2 → 4, topic-sim floor 0.15 → 0.55, STAGE 5
overlap floor 0.15 → 0.4)
- Primary-memory selection: unified composite 0.5 × relevance + 0.2 ×
trust + 0.3 × term_presence with hard topic-term filter, closing the
class of bug where off-topic high-trust memories won queries about
specific subjects
- Graph default-load fallback from sort=recent to sort=connected when
the newest memory is isolated, both backend and client
Changed:
- Reasoning page information hierarchy: chain renders first as hero,
confidence meter + Primary Source citation footer below
- Cargo feature split: embeddings code-only + ort-download | ort-dynamic
backends; defaults preserve identical behavior for existing consumers
- CI release-build now gates PRs too so multi-platform regressions
surface pre-merge
* fix: restore Intel Mac build via ort-dynamic + system libonnxruntime
Microsoft is discontinuing x86_64 macOS ONNX Runtime prebuilts after
v1.23.0, so ort-sys 2.0.0-rc.11 can't ship an Intel Mac binary and never
will. Previous Intel Mac attempts kept dying in the ort-sys build script
with "does not provide prebuilt binaries for the target x86_64-apple-darwin
with feature set (no features)." Issue #41 was the latest casualty.
Fix: route Intel Mac through the ort-dynamic feature path (runtime dlopen
against a system libonnxruntime installed via Homebrew). This sidesteps
ort-sys prebuilts entirely and works today.
Changes:
- crates/vestige-core/Cargo.toml: split `embeddings` into code-only vs
backend-choice. The embeddings feature now just pulls fastembed + hf-hub
+ image-models and activates the 27 #[cfg(feature = "embeddings")] gates
throughout the crate. New `ort-download` feature carries the
download-binaries-native-tls backend (the historical default). Existing
`ort-dynamic` feature now transitively enables `embeddings`, so the
cfg gates stay active when users swap backends.
Default feature set expands `["embeddings", ...]` -> `["embeddings",
"ort-download", ...]` so existing consumers see identical behavior.
- crates/vestige-mcp/Cargo.toml: mirrors the split. Adds `ort-download`
feature that chains to vestige-core/ort-download, keeps `ort-dynamic`
that chains to vestige-core/ort-dynamic. Both transitively pull
`embeddings`. Default adds `ort-download` so `cargo install vestige-mcp`
still picks the prebuilt-ort backend like before.
- .github/workflows/ci.yml: re-adds x86_64-apple-darwin to the
release-build matrix with `--no-default-features --features
ort-dynamic,vector-search`. Adds a `brew install onnxruntime` step that
sets ORT_DYLIB_PATH from `brew --prefix onnxruntime`.
- .github/workflows/release.yml: re-adds x86_64-apple-darwin to the
release matrix with the same flags + brew install step. The Intel Mac
tarball now also bundles docs/INSTALL-INTEL-MAC.md so binary consumers
get the `brew install onnxruntime` + ORT_DYLIB_PATH prereq out of the
box.
- docs/INSTALL-INTEL-MAC.md: new install guide covering the Homebrew
prereq, binary install, source build, troubleshooting, and the v2.1
ort-candle migration plan.
- README.md: replaces the "Intel Mac and Windows build from source only"
paragraph with the prebuilt Intel Mac install (brew + curl + env var)
and a link to the full guide. Platform table updated: Intel Mac back
on the "prebuilt" list.
Verified locally on aarch64-apple-darwin:
- `cargo check --release -p vestige-mcp` -> clean (default features)
- `cargo check --release -p vestige-mcp --no-default-features
--features ort-dynamic,vector-search` -> clean
Runtime path on Intel Mac (verified on CI):
brew install onnxruntime
export ORT_DYLIB_PATH=$(brew --prefix onnxruntime)/lib/libonnxruntime.dylib
vestige-mcp --version
Fixes#41. Long-term plan (v2.1): migrate to ort-candle pure-Rust backend
so no system ONNX Runtime dep is needed on any platform.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(ci): drop unused brew install + ORT_DYLIB_PATH from CI steps
Build is a cross-compile (macos-latest runner is Apple Silicon targeting
x86_64-apple-darwin) and ort-load-dynamic doesn't link libonnxruntime at
build time — only at runtime via dlopen. So the brew install step and
ORT_DYLIB_PATH export were ceremony without payload. Removed to cut CI
time. Runtime setup remains documented in docs/INSTALL-INTEL-MAC.md for
end users installing the tarball on their own Intel Mac.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* ci: run release-build on PRs too — catch Intel Mac regressions pre-merge
Previously release-build was gated behind `github.ref == 'refs/heads/main'`,
so the Intel Mac, aarch64-apple-darwin, and Linux release targets were only
validated AFTER merge to main. If someone broke the Intel Mac cross-compile
by touching feature flags or Cargo dependencies, we'd only find out when
the release tag was cut and the job exploded on main. Extending the guard
to also fire on pull_request means regressions surface in the PR status
check instead of on a release branch.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
sanitize_fts5_query wraps queries in quotes, producing FTS5 phrase search
where the words must be adjacent. So "quantum physics" against a doc
containing "quantum entanglement superposition physics" returned no FTS
hit; semantic search hid the issue whenever embeddings were enabled.
Add sanitize_fts5_terms that splits into space-separated terms (FTS5
implicit AND, any order, any position), and use it in:
- keyword_search_with_scores (hybrid-search FTS leg) so multi-word
queries return docs containing all words regardless of adjacency
- a new SqliteMemoryStore::search_terms inherent method for callers
that want individual-term matching without the full hybrid pipeline
sanitize_fts5_query stays in place; KeywordSearcher still uses it
(phrase semantics preserved where they were wanted).
memory_timeline ran node_type and tags as Rust-side `retain` after
`query_time_range`, which applied `LIMIT` in SQL before the retain
saw anything. Against a corpus where one tag or type dominates, a
sparse match could be crowded out of the limit window — the tool
reported "no matches" when matches existed.
Fix: thread `node_type: Option<&str>` and `tags: Option<&[String]>`
through `query_time_range` and apply both as `WHERE` predicates so
`LIMIT` kicks in after filtering. Tag matching uses `tags LIKE '%"tag"%'` —
the quoted pattern pins to exact tags and rejects substring false
positives (e.g. `alpha` no longer matches `alphabet`).
Regression tests in `tools/timeline.rs`:
- test_timeline_node_type_filter_sparse: 10 `fact` + 2 `concept`,
`limit=5`, query `concept` — asserts 2 rows; fails on pre-fix code.
- test_timeline_tag_filter_sparse: 10 rows tagged `common` + 2 tagged
`rare`, `limit=5`, query `rare` — asserts 2 rows; same shape for tags.
- test_timeline_tag_filter_exact_match: one `alpha` row + one
`alphabet` row, query `alpha` — asserts exactly 1 row.
Dashboard caller updated to pass `None, None` for the new filter
params. 19/19 timeline tests pass; 1295/1295 workspace tests pass;
clippy clean on vestige-core and vestige-mcp.
Ported from the Unforgettable/Anamnesis fork.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Labels previously rendered as near-white text (#e2e8f0) on a transparent
canvas. UnrealBloomPass (threshold 0.2) amplified every bright pixel
into a huge white halo that made labels unreadable at normal camera
distances — reported by Sam 2026-04-19 with a screenshot of the LoRA
training label blown out into a luminous blob.
New design:
- Dark rounded pill (rgba(10,16,28,0.82)) sits below the text and
hugs its measured width. That keeps the pill background well below
bloom threshold so the halo can't spread past the label footprint.
- Text dimmed to mid-luminance slate (#94a3b8). Still legible at the
standard camera distance but dim enough that bloom only adds a soft
glow instead of a blast.
- Font trimmed to 22px / weight 600 (was bold 28px); sprite scale
tightened from 12×1.5 to 9×1.2 so labels don't visually out-compete
the node spheres they annotate.
- Hairline slate stroke (18% alpha) on the pill for definition when
the camera gets close.
The canvas mock in the vitest setup grew beginPath / closePath /
moveTo / lineTo / quadraticCurveTo / arc / fill / stroke / strokeText
stubs so createTextSprite can exercise the full rounded-rect path in
unit tests without a real DOM. All 251 tests stay green.
80 new vitest cases exhaustively exercising the v2.0.8 colour-mode
additions, taking total dashboard coverage to 251 tests.
Pure-function correctness:
- getMemoryState: 12 retention boundaries including exact thresholds,
NaN, ±Infinity, negative, and >1 values + determinism across 10k
random samples.
- getNodeColor: per-node-type mapping in type mode (all 8 types),
per-bucket mapping in state mode, unknown-type fallback, and the
invariants that type mode ignores retention + state mode ignores type.
- MEMORY_STATE_COLORS: valid 6-digit hex, all four buckets distinct,
zero overlap with NODE_TYPE_COLORS.
- MEMORY_STATE_DESCRIPTIONS: threshold parentheticals match getMemoryState
bucket boundaries (70 / 40 / 10), all four lines distinct.
NodeManager state machine:
- default mode 'type', field writable pre-createNodes.
- setColorMode is idempotent (early return verified via copy() spy counts).
- setColorMode calls color.copy + emissive.copy + glow.color.copy exactly
once per node per transition, never replaces mesh / glow / material
references, preserves userData.{nodeId,type,retention}.
- rapid 5× type <-> state toggle preserves all three maps.
- addNode during state mode inherits the mode; subsequent switch to
type correctly retints the live-added node.
- suppressed-node interaction: setColorMode updates color + emissive but
never touches opacity or emissiveIntensity (v2.0.5 SIF channel stays
isolated from v2.0.8 colour channel).
- defensive paths: missing glow, missing userData.retention, missing
userData.type — all degrade to sane defaults without throwing.
Also refreshes the embedded dashboard build so the Rust binary picks up
the new SvelteKit chunks with the memory-state-colors feature baked in.
CI runs on stable Rust which advanced from 1.93 to 1.95, introducing
two newly-enforced lints under -D warnings:
- clippy::unnecessary_sort_by (12 sites) — rewrite sort_by closures
that only call .cmp on Copy keys as sort_by_key, using std::cmp::Reverse
for the descending ones.
- clippy::collapsible_match (1 site) — merge the MemoryState::Dormant
inner if into a match guard. The equivalent rewrite for the Ping/Pong
arm in websocket.rs is blocked by a move of non-Copy Bytes across the
match-guard boundary, so that one site gets an explicit #[allow].
Files touched:
- crates/vestige-core/src/advanced/{chains,compression,cross_project,reconsolidation}.rs
- crates/vestige-core/src/codebase/{git,relationships}.rs
- crates/vestige-core/src/neuroscience/{importance_signals,memory_states,predictive_retrieval}.rs
- crates/vestige-mcp/src/tools/{changelog,cross_reference}.rs
- crates/vestige-mcp/src/dashboard/websocket.rs
Verified: cargo clippy --workspace -- -D warnings green on rustc 1.95.0;
cargo test --workspace unchanged (1292 tests green).
Closes Agent 1's audit gap #4: FSRS memory state (Active / Dormant /
Silent / Unavailable) was computed server-side per query but never
rendered in the 3D graph. Spheres always tinted by node type.
The new colour mode adds a second channel that users can toggle
between at runtime — Type (default, existing behaviour) and State
(new). The toggle is a radio-pair pill in the graph page's top-right
control bar next to the node-count selector + Dream button.
Buckets + palette:
- Active ≥ 70% emerald #10b981 easily retrievable
- Dormant 40-70% amber #f59e0b retrievable with effort
- Silent 10-40% violet #8b5cf6 difficult, needs cues
- Unavail. < 10% slate #6b7280 needs reinforcement
Thresholds match `execute_system_status` at the backend so the graph
colour bands line up exactly with what the Stats page reports in its
stateDistribution block. Using retention as the proxy for the full
accessibility formula (retention × 0.5 + retrieval × 0.3 + storage ×
0.2) is an approximation — retention is the dominant 0.5 weight and
it is the only FSRS channel the current GraphNode DTO carries. Swap
to the full formula in a future release if the DTO grows.
Implementation:
- `apps/dashboard/src/lib/graph/nodes.ts` — new `MemoryState` type,
`getMemoryState(retention)`, `MEMORY_STATE_COLORS`,
`MEMORY_STATE_DESCRIPTIONS`, `ColorMode`, `getNodeColor(node, mode)`.
- `NodeManager.colorMode` field (default `'type'`). `createNodeMeshes`
now calls `getNodeColor(node, this.colorMode)` so newly-added nodes
during the session follow the toggled mode.
- New `NodeManager.setColorMode(mode)` mutates every live mesh's
material + glow sprite colour in place. Idempotent; cheap. Does NOT
touch opacity/emissive-intensity so the v2.0.5 suppression dimming
layer keeps working unchanged.
- New `MemoryStateLegend.svelte` floating overlay in the bottom-right
when state mode is active (hidden in type mode so the legend doesn't
compete with the node-type palette).
- `Graph3D.svelte` accepts a new `colorMode` prop (default `'type'`)
and runs a `$effect` that calls `setColorMode` on every toggle.
- Dashboard rebuild picks up the new component + wiring.
Tests: 171 vitest, svelte-check 581 files / 0 errors. No backend
changes; this is pure dashboard code.
The Heartbeat event has shipped since v2.0.5 carrying uptime_secs,
memory_count, avg_retention, suppressed_count. Three of the four were
already wired into the sidebar footer (memory count, retention,
forgetting indicator). uptime_secs was the one field that fired every
30 seconds into a silent void.
Added:
- `uptimeSeconds` derived store + `formatUptime(secs)` helper in
websocket.ts. The helper picks the two most significant units so the
sidebar stays tight: "3d 4h" instead of "3d 4h 22m 17s", "18m 43s"
for shorter runs, "47s" on a fresh boot.
- New line in the sidebar status footer between retention and the
ForgettingIndicator: "up 3d 4h" with a hover tooltip ("MCP server
uptime") for discoverability. Hidden at sub-lg breakpoints to match
the existing responsive pattern of the surrounding text.
Zero backend work — the data was already on the wire. This is pure
UI gap closure: four of four Heartbeat fields now visible.
svelte-check clean (580 files, 0 errors).
Fixes the biggest UI gap flagged by the v2.0.7 audit: the `suppress`
tool has shipped since v2.0.5 with full graph event handlers
(MemorySuppressed, MemoryUnsuppressed, Rac1CascadeSwept) and violet
implosion animations — but zero trigger from anywhere except the MCP
layer. Dashboard users literally could not forget a memory without
dropping to raw MCP calls.
Backend (Axum):
- `POST /api/memories/{id}/suppress` optionally accepts `{"reason": "..."}`
and returns the full response payload (suppression_count, prior_count,
retrieval_penalty, reversible_until, estimated_cascade_neighbors,
labile_window_hours). Emits `MemorySuppressed` so the 3D graph plays
the compounding violet implosion per the v2.0.6 event handlers.
- `POST /api/memories/{id}/unsuppress` reverses within the 24h labile
window. Returns `stillSuppressed: bool` so the UI can distinguish a
full reversal from a compounded-down state. Emits `MemoryUnsuppressed`
for the rainbow burst reversal animation.
Frontend:
- `api.memories.suppress(id, reason?)` and `api.memories.unsuppress(id)`
wired through `apps/dashboard/src/lib/stores/api.ts`.
- Two new TypeScript response types (`SuppressResult`, `UnsuppressResult`)
in `lib/types/index.ts` mirroring the backend JSON shapes.
- Memories page gets a third action button alongside Promote / Demote /
Delete: violet "Suppress" with a hover-tooltip explaining "Top-down
inhibition (Anderson 2025). Compounds. Reversible for 24h." The button
ships `reason: "dashboard trigger"` so the audit log carries source
attribution.
Tests: 425 mcp + 366 core all pass, svelte-check 580 files 0 errors.
Same reconciliation as the prior commit — three files missed the first
pass because of a Read-before-Edit harness constraint. Bumps CONTRIBUTING
module table and both Windsurf + Xcode integration guides to the
asserted-in-server.rs tool count of 24.
Ground truth pulled fresh:
- Tools: 24 (asserted at server.rs:1508)
- Cognitive modules: 29 (count of `pub <name>:` fields in cognitive.rs)
- Rust tests: 1,292 passing workspace-wide (366 core + 425 mcp + 497
e2e + 4 doctests)
Drift fixed:
- README.md had three instances of "30 cognitive modules" (should be
29) and one "1,284 tests" (should be 1,292). Updated the headline
badge, the ASCII architecture diagram, the Technical Details table,
and the footer byline.
- CONTRIBUTING.md had "23 tools" — bumped to 24.
- docs/integrations/windsurf.md + docs/integrations/xcode.md both
said "23 tools" — bumped to 24.
Left alone (historical, dated to earlier versions):
- CHANGELOG.md per-version entries cite the numbers that were true at
release time. Rewriting those would falsify history.
- docs/launch/*.md launch materials are marketing artifacts from the
v2.0 push and reference v2.0-era counts (21 tools, 734 tests, etc.).
They are not live documentation and re-dating them would be worse
than leaving them as historical snapshots.
The Intel Mac job failed the v2.0.5 AND v2.0.6 release workflows because
ort-sys 2.0.0-rc.11 (pinned by fastembed 5.13.2) does not ship Intel Mac
prebuilts. ci.yml already dropped the target weeks ago; release.yml is
now in sync.
README documents the build-from-source path for Intel Mac users and
v2.0.6 also removed the Intel Mac download link from the install block,
so no user-facing promise regresses. When ort-sys ships Intel Mac
prebuilts again, restore the matrix entry.
The export format match at the write-out site was `_ => unreachable!()`,
supposedly safe because the early-return gate at the top of the function
rejects anything that isn't "json" or "jsonl". That gate works today,
but `unreachable!()` converts any future gate-vs-match drift (case
sensitivity bug, refactor, new format branch added above but not below)
into a user-visible panic through the MCP dispatcher instead of a clean
error response.
Replace with a typed `Err(format!("unsupported export format: {:?}",
other))` so the defence lives at both layers. Same runtime behaviour
for every valid input; strictly safer for any invalid input that would
have slipped through a future refactor.
Both functions have been `#[allow(dead_code)]` since v1.7 with in-file
comments explicitly routing users to `execute_system_status` instead.
Zero callers anywhere in crates/ (the grep hits on execute_stats in
memory_states.rs, tagging.rs, stats.rs are same-named but different-
module functions — distinct call paths, distinct purposes).
Deleted:
- `health_check_schema` (dead schema helper)
- `stats_schema` (dead schema helper)
- `execute_health_check` (71 LOC)
- `execute_stats` (179 LOC including the FSRS preview + state
transition + compression group + cognitive health sub-sections that
`execute_system_status` already reproduces)
Also removed now-orphaned imports: `MemoryLifecycle`, `MemoryState`,
`MemoryForCompression`. `FSRSScheduler`, `CognitiveEngine`,
`tokio::sync::Mutex` remain because other functions still use them.
Net: ~-250 LOC, zero behavior change, existing system_status tests
(6/6) pass, workspace builds clean.
The pre-merge audit flagged that 4 of the 5 branch commits shipped
with zero assertions exercising the new code paths — existing tests
would have passed if the fixes were reverted to their broken state.
Close that gap with 7 new tests, each touching one specific
behavior:
migrations.rs (2 tests, crates/vestige-core)
- test_apply_migrations_advances_to_v11_and_drops_dead_tables:
end-to-end runs the whole V1..V11 chain on an in-memory DB and
asserts schema_version=11, knowledge_edges absent,
compressed_memories absent.
- test_v11_is_idempotent_on_replay: rewinds schema_version to 10
after a successful apply and re-runs apply_migrations to prove
`DROP TABLE IF EXISTS` tolerates the already-dropped state.
Guards against a future refactor accidentally using `DROP TABLE`
without the guard.
predict.rs (1 test)
- test_predict_degraded_false_on_happy_path: asserts the new
`predict_degraded` JSON field is present and `false` on a fresh
cognitive engine.
changelog.rs (2 tests)
- test_changelog_malformed_start_returns_error: asserts a bad
`start` value produces a helpful `Invalid start ... ISO-8601`
error instead of panicking or silently dropping the filter.
- test_changelog_filter_field_echoes_start: asserts the response
`filter.start` field echoes the applied bound so callers can
confirm their window was honored.
intention_unified.rs (3 tests)
- test_check_includes_snoozed_when_flag_set: creates an intention,
snoozes it, calls check with include_snoozed=true, asserts it
appears in either triggered or pending.
- test_check_excludes_snoozed_by_default: same setup, default
flag, asserts the snoozed intention does NOT appear — locks in
the pre-v2.0.7 behavior for every non-opt-in caller.
- test_check_item_exposes_status_field: asserts every item in the
check response carries the new `status` field.
All tests pass. vestige-core moves 366 -> 368, vestige-mcp moves
419 -> 425. Zero regressions under default or qwen3-embed features.
Clippy still clean on both crates.
Two fixes surfaced by the pre-merge audit of chore/v2.0.7-clean:
1. Security MEDIUM (audit M2): `graph/+page.svelte` was rendering
`e.message` verbatim into the DOM. A backend error that carried a
filesystem path (e.g. a wrapped rusqlite error with the DB path in
the message) would leak that path to any browser viewer. SvelteKit
auto-escapes the interpolation so raw XSS is blocked, but the info-
disclosure is real. Now we strip `/path/to/file.{sqlite,rs,db,toml,
lock}` patterns and cap the rendered string at 200 chars before it
hits the DOM. The regex used to gate the empty-state branch still
runs against the raw message so detection accuracy isn't affected.
2. Correctness nit (audit PATH D): `execute_check` in
`intention_unified.rs` was dropping `intention.status` and
`intention.snoozed_until` from the response JSON. When
`include_snoozed=true` surfaces both active and snoozed intentions
in the same list, callers cannot distinguish an active-triggered
intention from a snoozed-overdue one. Expose both fields so the
consumer (dashboard, CLI, Claude Code) can render them
appropriately.
Neither change affects the default code path under
`include_snoozed=false`; regression risk is zero.
server.rs:212 was documenting v2.0.4's state (23 tools) but the
handle_tools_list test two functions below asserts 24 tools since
v2.0.5 (when `suppress` landed). Align the comment with the assertion
and point at the assertion as the source of truth so future tool
additions can't introduce comment drift without also tripping a test
failure.
Both parameters were advertised in the MCP tool schemas since v1.7+ but
were silently ignored at runtime — a schema-contract violation. Any
caller that set them got unfiltered results with no error or warning,
which is the worst possible failure mode for a public tool surface.
changelog.rs
- Parse `start` / `end` as ISO-8601/RFC-3339 timestamps; return an
explicit error on malformed input (previously: silent drop).
- In system-wide mode, over-fetch 4× limit when a time window is set,
then apply an inclusive [start, end] filter in Rust before the
sort+truncate. SQL-level filtering is a v2.1+ optimisation.
- Response JSON gains a `filter` field echoing the applied bounds so
callers can confirm the window was honored.
- Per-memory mode still ignores the window (semantically meaningless
when scoped to one memory's transition history).
intention_unified.rs
- `execute_check`: when `include_snoozed=true`, fold snoozed
intentions back into the check pool so their time/context triggers
can wake them when a matching condition appears. Previously
snoozed intentions were invisible to check regardless of the arg.
- Deduplicates defensively via a HashSet on intention.id in case
storage ever returns overlap.
Tests: 9 changelog + 37 intention_unified tests continue to pass.
Full vestige-mcp lib suite 419 passing, 0 failures.
All four PredictiveMemory calls (predict_needed_memories, get_proactive_suggestions,
get_top_interests, prediction_accuracy) return Result, and all four were being
swallowed by `.unwrap_or_default()` / `.unwrap_or(0.0)` — every lock-poisoning or
internal error produced a response indistinguishable from a genuine cold-start
"I have no predictions yet." Callers (dashboard, Claude Code, Cursor) had no way
to tell "the system is broken" from "there genuinely isn't anything to predict."
Now each call uses `unwrap_or_else` to (a) `tracing::warn!` the error with its
source channel for observability, (b) flip a local `degraded` flag. The JSON
response gains a new `predict_degraded: bool` field. Empty + degraded=false =
cold start (expected). Empty + degraded=true = something went wrong, check logs.
6 existing predict tests pass (return shape unchanged on success path).
Before this, any exception from `api.graph()` — network down, dashboard
disabled server-side, 500, 404 — surfaced as "No memories yet. Start
using Vestige to populate your graph." Indistinguishable from a clean
first-run install. Users couldn't tell whether Vestige was empty or
actually broken.
The fix checks both the error message shape (looks for 404 / not found
/ empty / "no memor" patterns) AND the last known graph node count.
Only when both say "empty" do we keep the onboarding message; anything
else surfaces the real error under "Failed to load graph: ..." so
debugging doesn't require guessing.
Both tables were added speculatively in V4 and never received a single
INSERT or SELECT in the codebase. `knowledge_edges` has an elaborate
bi-temporal schema (valid_from, valid_until, confidence) and was marked
DEPRECATED in the same V4 migration that created it — the real edge
table is `memory_connections` (V3). `compressed_memories` was a tiered-
compression feature (compression_ratio, semantic_fidelity, model_used)
but `advanced/compression.rs` operates entirely in-memory and never
touches it.
Both tables are verified single-file references (only migrations.rs).
A grep across crates/ shows zero row reads or writes. Safe to drop
without behaviour change; frees schema space for future migrations.
Three changes, all aimed at new-user experience:
1. v2.0.6 "Composer" section up top — explicitly names the three user-
happiness wins: six live graph reactions (was one), intentions page
priority + trigger rendering fix, and the opt-in
`VESTIGE_SYSTEM_PROMPT_MODE=full` composition mandate (default stays
minimal so nothing gets imposed on users' system prompts).
2. v2.0.5 "Intentional Amnesia" block strengthened — clarifies the
distinction between passive Ebbinghaus decay, Anderson 1994
retrieval-induced forgetting, and v2.0.5's top-down active
suppression (Anderson 2025 + Cervantes-Sandoval 2020). Adds a
"Forgetting" row to the RAG-vs-Vestige comparison table.
3. Install section honesty on Intel Mac + Windows — the pre-built
binary download links 404 on those targets because of upstream
toolchain gaps (`ort-sys` lacks Intel Mac prebuilts in the
2.0.0-rc.11 release pinned by fastembed 5.13.2; `usearch 2.24.0`
hit a Windows MSVC compile break tracked as usearch#746). Replaced
the dead links with a `cargo build --release -p vestige-mcp`
snippet that works today.
The MCP `instructions` field is injected into every connecting client's
system prompt on Initialize — Claude Code, Cursor, Zed, Windsurf, and
anyone else running Vestige. That reach demands a default that serves
every user, not the project maintainer's personal workflow.
Default ("minimal", 3 sentences) tells the client how to use Vestige
and how to respond to explicit feedback signals. It is safe for every
audience: competitive coders, hobbyists saving recipes, Rails devs
saving bug fixes, enterprise deployments under system-prompt review.
The full composition mandate — Composing / Never-composed /
Recommendation shape + FSRS-trust blocking phrase + origin case study
— is load-bearing for decision-adjacent work but misfires on trivial
retrievals ("what's my favorite color"). Opt in on your own machine
with `VESTIGE_SYSTEM_PROMPT_MODE=full`; four hundred strangers do not
inherit one maintainer's trauma scar on every session.
Extracted into build_instructions() so the branch is a single env-var
check on Initialize, not a compile-time switch. main.rs --help output
advertises the new variable alongside VESTIGE_DASHBOARD_ENABLED.
Before this commit, six live WebSocket events fired against a silent 3D
graph. v2.0.5 shipped the `suppress` tool but the graph did not react to
MemorySuppressed, MemoryUnsuppressed, or Rac1CascadeSwept. Three more
core events — Connected, ConsolidationStarted, ImportanceScored — have
been silent on the graph since v2.0.0 despite appearing in the live
feed, which made the dashboard feel broken during real cognitive work.
Handlers added, all driven by the existing EffectManager:
- MemorySuppressed: violet implosion + compounding pulse scaled by
suppression_count (Anderson 2025 SIF visualised).
- MemoryUnsuppressed: rainbow burst + green pulse to mark reversal
within the 24h labile window.
- Rac1CascadeSwept: violet wave across a random neighbour sample
(event carries counts, not IDs, until v2.1).
- Connected: gentle cyan ripple from the first node on WS handshake.
- ConsolidationStarted: subtle amber pulses across a 20-node sample
while FSRS-6 decay runs (colour matches feed entry).
- ImportanceScored: magenta pulse on the scored node with intensity
proportional to composite_score (novelty/arousal/reward/attention).
IntentionItem.priority was typed as string but the API returns the
numeric FSRS-style scale (1=low, 2=normal, 3=high, 4=critical), so the
dashboard always rendered 'normal priority' regardless of the real
value. trigger_value was also a plain string but the API actually
returns trigger_data as a JSON-encoded payload (e.g. {"type":"time",
"at":"..."}), so the UI surfaced raw JSON or empty strings for every
non-manual trigger.
Swap to numeric priority + PRIORITY_LABELS map and add a
summarizeTrigger() helper that parses trigger_data and picks the most
human-readable field (condition / topic / formatted at / in_minutes /
codebase/filePattern) before truncating for display.
Extends PR #26 (snake_case in_minutes / file_pattern on TriggerSpec)
end-to-end to the UI layer.
Two unrelated upstream issues were stopping two of our four release targets.
Root-caused and fixed both so v2.0.5 ships on 100% of supported platforms.
Windows MSVC (new regression in v2.0.5):
`usearch 2.24.0` introduced a `memory_mapping_allocator_gt` template
that references the POSIX `MAP_FAILED` macro from <sys/mman.h>, which
doesn't exist on MSVC. Confirmed upstream as unum-cloud/usearch#746
(open). The bump from 2.23.0 happened during the v2.0.5 Cargo.lock
refresh. Pinned `usearch = "=2.23.0"` in crates/vestige-core/Cargo.toml
with a comment linking the upstream issue. Unpin when the fix lands.
Intel Mac (latent bug exposed by the ci workaround):
Root cause was feature-propagation, not the release workflow.
crates/vestige-mcp/Cargo.toml hardcoded
`features = ["bundled-sqlite", "embeddings", "vector-search"]` on its
vestige-core dep, which forcibly enabled vestige-core's embeddings
feature regardless of whether vestige-mcp's own `embeddings` feature
flag was set. With `--no-default-features` at the top level (the old
Intel Mac ci workaround), vestige-mcp's feature flags turned off but
vestige-core's embeddings stayed on through the hardcoded list. That
pulled in fastembed -> ort-sys, but without any of the flags that
select ort-sys' backend binaries, so the ort-sys build script failed
with "does not provide prebuilt binaries for the target
x86_64-apple-darwin with feature set (no features)".
Fix:
- Drop `embeddings` and `vector-search` from the hardcoded features
list in crates/vestige-mcp/Cargo.toml. Leave only `bundled-sqlite`
as an always-on base feature. The existing
`embeddings = ["vestige-core/embeddings"]` /
`vector-search = ["vestige-core/vector-search"]` flag declarations
now actually gate those features as intended.
- Bump the vestige-core dep version ref 2.0.4 -> 2.0.5 (was stale).
- Drop `cargo_flags: "--no-default-features"` from the Intel Mac
target in .github/workflows/release.yml. The original reason for
that workaround was sidestepping the same ort-sys issue, but with
the feature-propagation bug fixed, Intel Mac now builds with full
default features the same way aarch64-darwin does on the same
macos-14 runner.
Verification:
- `cargo tree -p vestige-mcp --no-default-features -i fastembed`
-> "did not match any packages" (fastembed truly absent now)
- `cargo tree -p vestige-mcp --no-default-features -i ort-sys` -> same
- `cargo build --release -p vestige-mcp` -> clean, 1m 21s, usearch 2.23.0
Same v2.0.5 tag. Rust source code identical to 8178beb. Re-triggering
the release workflow via workflow_dispatch will rebuild all four
platforms and upload to the existing v2.0.5 release page.
First AI memory system to model forgetting as a neuroscience-grounded
PROCESS rather than passive decay. Adds the `suppress` MCP tool (#24),
Rac1 cascade worker, migration V10, and dashboard forgetting indicators.
Based on:
- Anderson, Hanslmayr & Quaegebeur (2025), Nat Rev Neurosci — right
lateral PFC as the domain-general inhibitory controller; SIF
compounds with each stopping attempt.
- Cervantes-Sandoval et al. (2020), Front Cell Neurosci PMC7477079 —
Rac1 GTPase as the active synaptic destabilization mechanism.
What's new:
* `suppress` MCP tool — each call compounds `suppression_count` and
subtracts a `0.15 × count` penalty (saturating at 80%) from
retrieval scores during hybrid search. Distinct from delete
(removes) and demote (one-shot).
* Rac1 cascade worker — background sweep piggybacks the 6h
consolidation loop, walks `memory_connections` edges from
recently-suppressed seeds, applies attenuated FSRS decay to
co-activated neighbors. You don't just forget Jake — you fade
the café, the roommate, the birthday.
* 24h labile window — reversible via `suppress({id, reverse: true})`
within 24 hours. Matches Nader reconsolidation semantics.
* Migration V10 — additive-only (`suppression_count`, `suppressed_at`
+ partial indices). All v2.0.x DBs upgrade seamlessly on first launch.
* Dashboard: `ForgettingIndicator.svelte` pulses when suppressions
are active. 3D graph nodes dim to 20% opacity when suppressed.
New WebSocket events: `MemorySuppressed`, `MemoryUnsuppressed`,
`Rac1CascadeSwept`. Heartbeat carries `suppressed_count`.
* Search pipeline: SIF penalty inserted into the accessibility stage
so it stacks on top of passive FSRS decay.
* Tool count bumped 23 → 24. Cognitive modules 29 → 30.
Memories persist — they are INHIBITED, not erased. `memory.get(id)`
returns full content through any number of suppressions. The 24h
labile window is a grace period for regret.
Also fixes issue #31 (dashboard graph view buggy) as a companion UI
bug discovered during the v2.0.5 audit cycle:
* Root cause: node glow `SpriteMaterial` had no `map`, so
`THREE.Sprite` rendered as a solid-coloured 1×1 plane. Additive
blending + `UnrealBloomPass(0.8, 0.4, 0.85)` amplified the square
edges into hard-edged glowing cubes.
* Fix: shared 128×128 radial-gradient `CanvasTexture` singleton used
as the sprite map. Retuned bloom to `(0.55, 0.6, 0.2)`. Halved fog
density (0.008 → 0.0035). Edges bumped from dark navy `0x4a4a7a`
to brand violet `0x8b5cf6` with higher opacity. Added explicit
`scene.background` and a 2000-point starfield for depth.
* 21 regression tests added in `ui-fixes.test.ts` locking every
invariant in (shared texture singleton, depthWrite:false, scale
×6, bloom magic numbers via source regex, starfield presence).
Tests: 1,284 Rust (+47) + 171 Vitest (+21) = 1,455 total, 0 failed
Clippy: clean across all targets, zero warnings
Release binary: 22.6MB, `cargo build --release -p vestige-mcp` green
Versions: workspace aligned at 2.0.5 across all 6 crates/packages
Closes#31
CI failed on macOS + Ubuntu with clippy::collapsible_if on the
else-if branch of the exclude_types filter. Collapse the inner
`if` into the `let Some && ...` guard. Semantics preserved — the
includes branch is left as-is to keep include/exclude mutually
exclusive behavior.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Exact keyword matches (e.g. unique proper nouns like "Valladares") were
buried by semantic scoring in hybrid search. With a small limit, the
exact match could be missing entirely from results.
Adds a dedicated Stage 0 keyword-only pass (keyword_weight=1.0,
semantic_weight=0.0) before the main hybrid search. Results with strong
keyword scores (>= 0.8) are collected and merged into the hybrid results
via dedup. In the reranker stage, these keyword-priority results bypass
the cross-encoder entirely and receive a 2x score boost to survive
downstream pipeline stages (temporal, FSRS, utility, competition).
Bug inherited from Vestige 2.0.1.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Type filtering (include_types/exclude_types) was applied post-fetch after
the database LIMIT, which could return zero results when all top-N
results were of the filtered type. This pushes type filters into the SQL
WHERE clause in keyword_search_with_scores() so they apply before the
limit. Semantic results still get post-fetch filtering as a safety net
since the vector index cannot filter by type.
Also adds hybrid_search_filtered() as the new primary method, with the
original hybrid_search() delegating to it with no filters for backward
compatibility. The MCP search tool now exposes include_types and
exclude_types parameters.
Includes 5 new test cases covering include, exclude, precedence,
empty results, and backward compatibility.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Dashboard now disabled by default to reduce memory footprint
- Enable with VESTIGE_DASHBOARD_ENABLED=true
- Update --help text to document new env var
The Stage 8 `recommended` selector and the evidence sort both rank by
FSRS-6 trust only, discarding the `combined_score` signal that the
upstream hybrid_search + cross-encoder reranker just computed. Confidence
is then derived from `recommended.trust + evidence_count`, neither of
which moves with the query — so any query against the same corpus
returns the same primary memory and the same confidence score.
Empirical reproduction (15 deep_reference probes against an 11-memory
corpus, 9 with a unique correct answer + 6 with no relevant memories):
- Distinct primary memories returned : 1 / 15
- Confidence values returned : 1 distinct (0.82 for all)
- Ground-truth accuracy on specific queries : 1 / 9 (11.1%)
The single hit is coincidental: the always-returned memory happened to
be the correct answer for one query. Random guessing across the 11-memory
corpus would be ~9% baseline, so the tool is performing at random.
Fix
---
Replace trust-only ranking at three sites with a 50/50 composite of
combined_score (query relevance) and FSRS-6 trust:
let composite = |s: &ScoredMemory| s.combined_score as f64 * 0.5 + s.trust * 0.5;
Used in:
- cross_reference.rs:573 — `recommended` max_by
- cross_reference.rs:589 — `non_superseded` evidence sort_by
- cross_reference.rs:622 — `base_confidence` formula
The 50/50 weighting is a design choice — see PR body for the knob to
tweak if a different blend is preferred. The pre-existing updated_at
tiebreaker is preserved.
Tests
-----
Two regression tests, both verified to FAIL on `main` and PASS with the
fix via negative control (temporarily set the composite weights to
1.0 trust + 0.0 relevance and confirmed both tests fail again):
- test_recommended_uses_query_relevance_not_just_trust
Two-memory corpus, ingested in order so the off-topic memory wins
the trust tiebreaker. Query targets the on-topic memory. The fix
ensures `recommended` is the on-topic one.
- test_confidence_varies_with_query_relevance
Single-memory corpus. Identical execute() calls with a relevant
query and an irrelevant query. The fix ensures the relevant
query produces higher confidence.
Full crate suite: 410 / 410 passing (was 408 + 2 new).
Out of scope
------------
While running the live MCP probes I observed two further inconsistencies
in `cross_reference.rs` that I cannot reproduce in cargo test (the
synthetic test environment with mock embeddings does not trigger the
required combined_score > 0.2 floor condition):
- The `effective_sim` floor at line 551 fabricates contradictions
between memories with no real topical overlap when one contains a
CORRECTION_SIGNALS keyword.
- The Stage 5 `contradictions` field (strict) and the Stage 7
`pair_relations` feeding the reasoning text (loose, post-floor)
disagree, producing responses where `reasoning` claims N
contradictions while `contradictions` is empty and `status` is
"resolved".
I have empirical data for both from live MCP usage but no reproducible
cargo test, so they are intentionally not addressed in this PR. Happy to
file them as a separate issue with the raw probe data if useful.
Collapsed nested if statements into single conditions using
let-chains (if a && let Ok(b) = ...). Fixes CI clippy failures
on both macOS and Ubuntu.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The public JSON schema in schema() declares `in_minutes` and `file_pattern`
in snake_case, but TriggerSpec uses `#[serde(rename_all = "camelCase")]`
which makes serde expect `inMinutes` / `filePattern`. Snake_case inputs are
silently dropped to None, so time-based intentions with `in_minutes` never
fire (triggerAt becomes null) and file_pattern-only context intentions
never match.
Added `#[serde(alias = ...)]` so both naming conventions deserialize
correctly — purely additive, existing camelCase callers unaffected.
Two regression tests added, verified to FAIL without the aliases
(negative control confirmed the snake_case duration test sees
`triggerAt: null` and the file_pattern test sees an empty `triggered`
array). Both pass with the fix. Full crate suite: 408/408 passing.
Related to #25 (Bug #8 was half-fixed — check-side re-derivation works,
but the set-side was still dropping the value before it could be persisted).
