Fix derived label retries, weekly floors and read budgets

.github/workflows/tests.yml

@@ -2304,6 +2304,12 @@ jobs:
           --health-retries 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Paired read-budget baseline (main at the round-two handoff)
+        if: matrix.integration_check == 'Integration tests (Postgres + pgvector, role separation)'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: 48873b038013f4cf548099fcc4610a150972eedd
+          path: .read-budget-baseline
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
@@ -2329,13 +2335,20 @@ jobs:
         env:
           DATABASE_URL: postgresql://alicebot_app:ci@localhost:5432/alicebot
           DATABASE_ADMIN_URL: postgresql://alicebot_admin:ci@localhost:5432/alicebot
+          ALICE_READ_MAIN_CHECKOUT: ${{ github.workspace }}/.read-budget-baseline
         # --timeout=180 names one test that runs that long. The cancelled
         # jobs were slow database setup, not a gap near 180s, so that flag
         # would not have fired. --session-timeout=1500 is checked between
         # tests, stops the run, and prints --durations before the 30 minute
         # job cancel.
         run: ALICE_LEGACY_SURFACES=1 ./.venv/bin/python -m pytest tests/integration -q -p no:cacheprovider --durations=20 --timeout=180 --session-timeout=1500
 
+      - name: SQLite varied-parent read budgets against the same baseline
+        if: matrix.integration_check == 'Integration tests (Postgres + pgvector, role separation)'
+        env:
+          ALICE_READ_MAIN_CHECKOUT: ${{ github.workspace }}/.read-budget-baseline
+        run: ./.venv/bin/python -m pytest tests/performance/test_label_round2_read_budget.py -q --timeout=180 --session-timeout=240
+
       - name: Default-surface core round-trip
         if: matrix.integration_check == 'Default surface integration smoke (Postgres)'
         env:

CHANGELOG.md

@@ -2,14 +2,21 @@
 
 ## Unreleased
 
+- Unreleased (on main, not in v0.20.0): October 6 round-two corrections recover a per-user open-loop digest on both stores after a project reassignment or stale duplicate extraction, and weekly candidates record the report inputs before insert so their stored floor matches the weekly artifact in the same transaction. Read-time labels reuse verified dependency signatures within one request; original rows are counted in SQL, and the derived partition still receives the kernel guard. PostgreSQL event filtering uses an indexed guarded UUID comparison. SQLite filters definitely hidden direct parents before its event limit, then applies the full effective-label guard. The legacy review list also rechecks saved quotes on original or imported candidates against the current source fence. CI compares unique-metadata, varied-parent and repaired fixtures against pinned main 48873b03. No migration is required.
+
+- The web package pins `sharp` to 0.35.5, including the patched librsvg binaries, for GHSA-wq5f-xc86-pv6w. Earlier pins below 0.35.5 fail the production dependency audit.
+
+- Unreleased (on main, not in v0.20.0): on SQLite, `sources delete`, `sources prune --superseded` and `import-markdown --supersede` blank an open loop that names the source in any spelling the saved-quote reader names, including capitals, no hyphens, braces, `urn:uuid:`, a list and JSON text. The lookup, the preview and the reader that withholds those ids use the same spellings, including JSON escapes. Repeated keys and quote subtrees follow the limits in the draft security note. Lookup and removal both decode JSON text under source and memory references and inside trace fields. Admitted references and surrounding values stay, and the owner receives live references unchanged. One pass over the user's loops answers for every source of the command. v0.20.0 blanked only the id as stored or `source:<id>`, so any other spelling kept the loop's text. No migration is required.
+- Unreleased (on main, not in v0.20.0): the October 6 derived-label correction normalizes server UUIDs, carries bound scheduler identity, withholds encoded references and handles malformed marker shapes. Plain reviews share the label lock; label-changing reviews retain the bounded retryable refusal. Read labels and distinct parents are cached within one request. Context-pack rows dropped by effective admission are absent from the later stage's excluded counts and warnings. The search golden was regenerated through its recorder. Source GET and the legacy review list now apply the full caller fence. Graph edge explanations remain outside that ceiling, and the doctor label counts are new in this set, as disclosed in the draft security note. The sources_first golden token estimates each rise by 5 because derived inserts persist empty project_scope and project_floor. SQLite retirement deliberately follows the saved-quote reader for repeated keys and quote subtrees; an older raw scan blanked some such rows that it now retains.
 - Unreleased (on main, not in v0.20.0): the derived-row pages state the three-part label, who reads an unverified row, and that the five operator screens apply the caller's sensitivity ceiling. The v0.20.0 notes omitted both limits. No migration is required.
 - Unreleased (on main, not in v0.20.0): PostgreSQL migration `20261005_0096` raises a stored derived row to the labels of its inputs, and SQLite does the same on the next open and before a restore is published. The open pass can leave a vault open with its completion key unstamped after a failed repair; explicit repair and restore refuse the whole change on failure. `alicebot vnext labels` and `alice-memory labels` check and repair the same rows, including rows added after an earlier repair. The doctors print how many derived rows are below their inputs or unverified, as a warning, and report failed checks as unavailable. v0.20.0 left the stored label where it was written. Migration `20261005_0096` must run before serving requests as the NOSUPERUSER NOBYPASSRLS table owner.
 - Unreleased (on main, not in v0.20.0): recall, context packs, resume, recent decisions, the session brief, the review queue, open-loop lists, and the workspace, dashboard, context tree, and dogfooding lists drop a loaded row whose effective label is outside the request. The artifact list, the source trace, the project list, the dashboard project row, and the belief state route apply the caller's sensitivity ceiling, including titles, ids, and counts. Resume, recent decisions, the session brief, audit, and explain apply the target row's current effective label, so an excluded key does not learn of a label change. The producer input readers also drop an input whose effective label is outside the request before it appears in report text. v0.20.0 returned rows by their stored labels and could copy a public row with confidential inputs into a new report. No migration is required.
 - Unreleased (on main, not in v0.20.0): an exact read of a derived artifact, a write that cites a derived memory, explain, memory review, redaction, and an open-loop update use the labels of that row's inputs. v0.20.0 used the label stored on the row, so a public copy of a confidential input could be read. A row whose inputs cannot be checked is refused to a locked key. The owner and an unbound admin still read the stored row. No migration is required.
 - Unreleased (on main, not in v0.20.0): a locked key's consolidation, roll-up, staleness sweep and open-loop review keep only inputs whose scope and floor are both inside the binding. The overlap check stays, and the exact test runs after it. Consolidation and roll-ups compare the group scope (scope united with floor), so a card stored with an empty scope and a floor of two projects is still found and can be accepted. The operator artifact list, given a project, matches that floor as well as the scope. Each new report and aggregate records `derived_from` for the rows it used. A project view that also asks for global rows keeps a row with no Alice project id only when every Alice project id in its floor is in that view. v0.20.0 selected by overlap of the scope alone and wrote no `derived_from`. No migration is required.
 - Unreleased (on main, not in v0.20.0): a memory copied from another row is stored at least as strict as that row. v0.20.0 kept the label the copy was given at insert, so a later reader could see a health or confidential input through a copy stored as `unknown` and `public`. The insert now re-reads the inputs inside the write and raises the domain, the sensitivity, and the project floor. A later metadata write cannot drop the marker that makes the row derived, or put back an older project scope or project floor. Raising a source or a memory walks the rows derived from it and raises those too. A candidate open loop and a generated artifact take the same insert floor. Replacing a SQLite source with a stricter one raises the memories that cite it before they are retired. Moving a source to another project previews how many derived rows a project-bound key would lose and requires `confirm_label_hide` when that count is nonzero. The owner or an unbound admin recovers fresh candidates through `POST /v0/vnext/sources/{source_id}/regenerate`, then reruns the normal report generation route; existing provenance is kept. A relabel that cannot finish answers 409 with a named cause, and one that waits more than 3 seconds for the label lock answers 503 with `Retry-After: 2` and nothing changed. No migration is required.
 - Unreleased (on main, not in v0.20.0): the label of a derived row (its domain, its sensitivity, and the projects it requires) is now decided by one pure function. v0.20.0 kept the label a derived row was given when it was made. This pure kernel is shared by the later write, read and repair paths; it does not rewrite stored rows on its own. A locked key is refused when a caller passes a project floor that is not inside the key's binding. No migration is required.
-- Unreleased (on main, not in v0.20.0): on SQLite, `sources delete`, `sources prune --superseded` and `import-markdown --supersede` now scrub an open loop that names the source only in its metadata: the id, or `source:<id>`, as the text under `source_id`, `source_ids`, `source_ref`, `source_refs`, `source_references` or `selected_source_ids` at any depth. That is the rule the open-loop lookup of a source already used. They blanked only loops whose `source_id` column held the id, so a loop with an empty column kept its title, description and metadata, and they reached a new export. The delete preview now counts the same loops as the receipt. The rule reads the id only as stored or as `source:<id>`: a loop that names the source in any spelling other than those two keeps its text, although the memory rule reads several other spellings. No migration is required.
+- Unreleased (on main, not in v0.20.0): a daily brief that discovers an open loop writes `project_id` only when the single project is a UUID, and keeps a free-form name in `metadata_json.project_scope`. v0.20.0 wrote that name into the UUID column, so a brief with a TODO line and a project such as `Alice` failed on Postgres. No migration is required.
+- Unreleased (on main, not in v0.20.0): on SQLite, `sources delete`, `sources prune --superseded` and `import-markdown --supersede` now scrub an open loop that names the source only in its metadata: the id, or `source:<id>`, as the text under `source_id`, `source_ids`, `source_ref`, `source_refs`, `source_references` or `selected_source_ids` at any depth. That is the rule the open-loop lookup of a source already used. They blanked only loops whose `source_id` column held the id, so a loop with an empty column kept its title, description and metadata, and they reached a new export. The delete preview now counts the same loops as the receipt. Correction (2026-10-05): those other spellings are blanked too, by the same reader the saved-quote fence uses. No migration is required.
 - Unreleased (on main, not in v0.20.0): the SQLite derived-label repair now updates and records each row under the id it is stored with (SQLite keeps capitals, missing hyphens, braces and `urn:uuid:` as written) and matches rows by the normalised id only to read the graph. If two stored spellings of one id exist, each is compared with the label its own recorded inputs give it, so neither is left at its old label while the other is relabelled, and neither is lowered. An update that changes no row stops the repair with `DerivedDomainRepairError` before any event or the completion stamp is written, on open and on restore; migration `20261004_0095` refuses the same way. Before, a derived memory stored under such an id kept its label while its relabel event and the stamp were written, and the pair survived export and import. A PostgreSQL uuid column was not affected. Correction (2026-10-05): the v3 pass raises such a row on the next open, including a vault the earlier repair already stamped. No migration is required.
 - Unreleased (on main, not in v0.20.0): v0.20.0 could store a consolidation report with a sensitivity below the memories it prints. The report took its sensitivity from the near-duplicate clusters only, so a run whose proposals were roll-up cards had no cluster to take it from and was stored as `unknown`. A key whose ceiling is below those memories (a `trusted_local_agent` key for confidential ones, a `read_only_agent` key for private ones) could then read the card topic and the member ids through `GET /v0/vnext/artifacts/{id}`. The report now takes its domain and its sensitivity over every row it names: the cluster members, the members of every proposed roll-up group, the members of the groups that a skip line names by key (`topic:...`, `entity:...`, `semantic:cluster-<id>`), the pending, accepted, expired or held roll-up cards it names by id, and the sources that the `source_refs` of its cluster members name, which the report still prints. The open-loop review is labelled over the sources whose ids it prints as well as over its loops. The run digest of both reports covers those sources, so a source that was reclassified makes a new report instead of returning the earlier one. The first run after the upgrade over loops that link a source, or over cluster members that cite one, makes one new report, and a run that names no source keeps the digest it had. A report whose inputs are all unrestricted is now stored with the label of those inputs, `internal` where it was `unknown`, and every permission profile reads the two the same way. Correction (2026-10-05): a report stored by v0.20.0 does not keep a sensitivity below its inputs, because migration `20261005_0096` and the SQLite v3 pass repair sensitivity. The other report producers (daily brief, weekly synthesis, connection and contradiction reports, project updates, staleness reports) were checked and already label over every row they print. Memories and sources are counted apart when the label is taken, because an id is unique only within its own table: a source that shares a memory's id can no longer replace that memory's label. No migration is required.
 - Unreleased (on main, not in v0.20.0): v0.20.0 `alice-memory export` copied the vault into a private folder in the temporary directory and removed it only on a normal exit or an exception, so a SIGKILL or a power loss left a plaintext copy of the vault there until the system cleaned the directory. `sources list`, the `sources delete` and `sources prune` previews and `import-markdown --dry-run` on main use the same kind of folder, and `alice-memory import` in v0.20.0 does the same for a copy of the file it imports. Each folder now holds a small marker that names the process that made it (its PID and start time), and every command that makes one first removes the folders of processes that are gone, or whose PID now belongs to a process that started at a different time. The sweep only touches a real directory (never a symlink) directly under the temporary directory, with one of the three snapshot name prefixes, owned by the current user, mode 0700, holding a valid marker. It leaves everything else alone, keeps a folder whenever it cannot tell whether the process is running, and never fails the command. The `import-markdown --dry-run` copy of the vault and of `sleep_proposals.jsonl` is now created with mode 0600. No migration is required.

ROADMAP.md

@@ -35,6 +35,10 @@ OpenCode is an opt-in `alice-memory install` host, and from `v0.19.0` Codex is
 one too. The Claude Code plugin directory ships in `v0.19.0`. Host coverage is
 done, and the skill pack revisions are in design. Next is search quality: the
 next release is planned as a search-quality release, ahead of new features.
+Unreleased (on main, not in v0.20.0): a daily brief that discovers an open loop
+writes `open_loops.project_id` only when that single project is a UUID. A
+free-form name stays in `metadata_json.project_scope`. In v0.20.0 the name was
+written into the UUID column and the brief failed on Postgres.
 
 Of the former roadmap list, benchmark replication, multi-session synthesis
 measurement, reference integrations, SQLite vector scale, and the enterprise

apps/api/src/alicebot_api/cli/automation.py

@@ -18,7 +18,7 @@
 
 
 def _connection_finder_request_from_args(args: argparse.Namespace) -> ConnectionFinderRequest:
-    return ConnectionFinderRequest(
+    return ConnectionFinderRequest(agent_identity=None,
         query=getattr(args, "query", "") or "",
         domains=tuple(args.domain),
         projects=tuple(getattr(args, "project", ())),
@@ -48,7 +48,7 @@ def _run_vnext_graph_neighborhood(ctx: CLIContext, args: argparse.Namespace) ->
 
 
 def _contradiction_finder_request_from_args(args: argparse.Namespace) -> ContradictionFinderRequest:
-    return ContradictionFinderRequest(
+    return ContradictionFinderRequest(agent_identity=None,
         query=getattr(args, "query", "") or "",
         domains=tuple(args.domain),
         projects=tuple(getattr(args, "project", ())),
@@ -84,7 +84,7 @@ def _run_vnext_belief_state(ctx: CLIContext, args: argparse.Namespace) -> str:
 
 
 def _project_automation_request_from_args(args: argparse.Namespace) -> ProjectAutomationRequest:
-    return ProjectAutomationRequest(
+    return ProjectAutomationRequest(agent_identity=None,
         domains=tuple(args.domain),
         sensitivity_allowed=_vnext_sensitivity_allowed(args),
         project_id=getattr(args, "project_id", None),

apps/api/src/alicebot_api/cli/capture.py

@@ -705,7 +705,7 @@ def _run_vnext_demo_load(ctx: CLIContext, args: argparse.Namespace) -> str:
             created_open_loop_ids.append(str(loop["id"]))
 
         daily = VNextBrainService(store).generate_daily_brief(
-            BrainArtifactRequest(
+            BrainArtifactRequest(agent_identity=None,
                 domains=("project",),
                 sensitivity_allowed=("public", "internal", "private", "unknown"),
                 generated_for="2026-05-12",
@@ -730,7 +730,7 @@ def _run_vnext_demo_load(ctx: CLIContext, args: argparse.Namespace) -> str:
         )
         if project_id is not None:
             project_update = VNextProjectService(store).generate_project_update_candidate(
-                ProjectAutomationRequest(
+                ProjectAutomationRequest(agent_identity=None,
                     domains=("project",),
                     sensitivity_allowed=("public", "internal", "private", "unknown"),
                     project_id=project_id,

apps/api/src/alicebot_api/cli/context.py

@@ -63,7 +63,7 @@ def _run_vnext_context_tree(ctx: CLIContext, args: argparse.Namespace) -> str:
 
 
 def _brain_artifact_request_from_args(args: argparse.Namespace) -> BrainArtifactRequest:
-    return BrainArtifactRequest(
+    return BrainArtifactRequest(agent_identity=None,
         domains=tuple(args.domain),
         projects=tuple(getattr(args, "project", ())),
         sensitivity_allowed=_vnext_sensitivity_allowed(args),