What shipped, including what we got wrong.

Restored the original head, circuit lines and cube in the site header, footer, sign-in panel, product preview, favicon and install icons.

Set the home-page and social-preview title to Brainlyy. Other pages retain their page name and Brainlyy title. Versioned icon links refresh cached icons.

Added local source-linked briefs with explicit model selection and consent. Saved findings include exact quotations, source versions and line references. Quote checks remain separate from review of the draft's conclusions.

Added durable stages, bounded checkpoints and request replay. Cancellation closes stalled local inference. Interrupted work cannot publish through an expired lease or replace a result without its required approval.

Added finding nodes and source-version links to the managed network, a citation inspector and Markdown downloads. Repairs use the recorded model. Restores retain the original document, model and citation check in a new revision.

Fixed source permission changes during saved-result reads, unbounded file check reads, and incomplete or mismatched MCP model responses.

Added protocol, recovery, permission and browser regressions. The offline guide and website include the new flow and its limits. Model installation, real inference qualification and general release approval remain open.

Added local pairing and explicit folder review in Connections. A 24-hour owner grant permits source reports, result reading and task cancellation. Pairing and discovery do not approve folders automatically.

Added a separate bounded Work connection, durable worker tasks and stable request keys. Reports survive browser closure. Graceful shutdown requeues interrupted work; an expired attempt cannot replace a newer result.

Added remote Work, portable result downloads, uncertain-submission recovery and denial states that clear cached report content. The account page shows remote-report connectivity separately from dashboard and MCP connectivity.

Fixed the native account-address handoff to its managed service. The release address needs no config edit. Explicit instance settings retain precedence.

Prevented deleted account IDs and orphan gateway credentials from being inherited by new accounts. Existing valid accounts and sessions are preserved.

Added real local browser journeys, boundary tests and canonical remote-report documentation. General remote execution, team roles, live providers and signed distribution remain release requirements. This is private integration work.

Added revision comparison and exact restore review for local source reports. Restore adds a revision, retains history and keeps old sources marked stale. Replayed, expired, changed and superseded proposals cannot replace a result.

Added saved-index graph node search and shortest paths to the Graph screen, HTTP and MCP interfaces. Endpoints are selected explicitly. Search shares the existing graph limits and does not run an external indexer.

Added the managed Work graph with saved source versions, runs, reports, revisions, checks and proposals. Search, filters, a list and a record inspector lead to existing result and repair reviews. Inaccessible evidence and its relationships are hidden; source focus cannot reveal revoked links.

Replaced the Work graph's phase columns with a spatial network. Circular nodes and actual links show connected records. Node size shows connection count, and a legend names each type. Drag, zoom, pan and neighbour focus support exploration while the inspector keeps the full record details.

Fixed local JavaScript content types when Windows file associations override them. Missing static assets return 404. Frozen-build smoke verifies the exact compiled network worker and the existing same-origin security policy.

Fixed graph metadata path lookups, exclusion changes in cached results and cached reads after permission loss. Content digests detect edits that preserve timestamps. Unicode results stay bounded and MCP no longer duplicates graph payloads. Delivery rechecks source access.

Added bounded model catalog discovery. Local model calls inspect metadata and refuse known remote routing before sending a prompt. These checks depend on a trusted runner and do not establish live model compatibility.

Added native Auth0 protocol and account-session handling for qualification. Native credentials are separate from web, gateway, relay and Work authority. Live tenant setup, supported-OS checks and signed distribution remain open.

Bounded Auth0 token, profile and key requests. Redirects and environment proxies are refused. Size, depth, deadline and active-worker limits apply to the shared transport. Maintained JWT key caching and rotation are preserved.

Added managed-graph requirements, an architecture diagram and explicit comparison measures. Audit exclusions are bound to the tested source digest. Competitive superiority and full release readiness remain unproven.

Merged the locally checked foundation and marketing work into the private repositories. Hosted CI is blocked by the account's billing restriction. Website Git deployment remains held. This is not a product release.

Added durable local source reports, cancellation, restart recovery, source freshness, separate repair previews, exact single-use approval and JSON result records. Source-version checks do not independently verify source statements.

Added the React Work view, shared light/dark tokens, result-first layout and optional source/history inspector. Existing supported routes remain available.

Bound claim evidence to exact definitions and source identities. Added bounded graph reads, Unicode-safe MCP responses, document previews and version-checked file chunks through the existing source access boundary.

Replaced custom Auth0 signature handling with maintained JWT verification, issuer-key caching and key-rotation tests. Existing account mappings remain.

Added native supervisor framing and lifecycle checks. Desktop smoke now tests concurrent instance isolation and saved source reports across restart.

Added canonical architecture diagrams, API and release documentation, an offline guide with embedded diagrams and browser/link checks in CI.

The repository remains private. Public installers, live-provider qualification, native PKCE, remote durable work and the full release gates are still pending.

A note could call itself verified. The dashboard decided a note was VERIFIED by checking whether its text contained the word "VERIFIED", and drew a green badge for it. Nothing verified anything, in the one project whose premise is catching claims that carry no check.

The status is now computed by an evaluator and never by the note. A claim declares named evidence; the names resolve only to checks in config, because a note is untrusted input. Three states: VERIFIED (every check passed, recently), UNVERIFIED (checkable, and something failed or expired), and ASSERTED (not machine-checkable, which is legitimate, and where most notes live). A status: field in frontmatter is ignored and flagged as self-certification.

This demotes most existing notes, which is the correct outcome. The badges were wrong.

brainlyy verify: re-check every claim, record what was observed to an append-only log, and report how long the longest-lived false claim read VERIFIED before a run caught it. --strict exits 1 for CI.

docs/claims.md.

A dashboard. brainlyy ui serves a local web UI: tier and capabilities, note search, a vault browser where provenance is the primary visual dimension, and a code-graph view. Light and dark, phone-first. Vanilla HTML/CSS/JS served by the same Python process: no Node, no bundler, no build step. Fonts are bundled rather than fetched, so it renders identically with no internet.

A sign-in page. brainlyy passphrase sets a local passphrase; the dashboard signs in at /login. scrypt (n=2¹⁵) with a random salt and the parameters stored beside the hash so they can be raised later; the passphrase itself is never written. Sessions are signed rather than stored, and the signature is verified before the payload reaches a JSON parser. Five failures locks an address out for fifteen minutes. No third-party identity provider, no account, and it works offline. For a team, put an OIDC reverse proxy in front instead, which docs/security.md explains.

Security headers on every response: nosniff, no-referrer, X-Frame-Options: DENY, and a CSP with no unsafe-inline. The pre-paint theme script is allowed by a sha256 computed from the exact bytes served, so the hash cannot drift from the file.

Browser sessions. /?k=<token> is exchanged for an HttpOnly, SameSite=Strict cookie and redirected, so the token leaves the URL bar. Neither cookie ever authenticates /mcp, because the browser attaches them automatically, so anything they open is open to any page the browser is on, and the tools must never be in that set.

ui.bind (loopback by default, mesh to opt in) and ui.remote_writes (off by default), judged on the address the connection arrived on.

A JSON API: /api/status, /api/search, /api/notes, /api/notes/{path}, /api/agents, /api/graph.

Write actions, loopback-gated. POST /api/agent/run, /api/rate and /api/post are proxied to the loopback write server with its own token, so everything past that hop is enforced exactly as it is for a local caller. The UI decides only whether to forward, judged on the address the connection arrived on. Every refusal is distinguishable on purpose: 401 no credential, 403 wrong door, 400 bad body, 503 write server not running, 502 it refused. /api/status.writes_enabled is computed by the same function that gates the endpoints, so the dashboard cannot render a control the server would refuse.

A code-graph explorer. Canvas rendering with the layout settled across animation frames so the page never blocks, pan and zoom, a floating toolbar, counted communities and kind: / repo: / path: filter chips. Totals are always exact while only the 450 most-connected nodes are drawn. A dashboard that reported the size of its own sample would be lying in the most plausible way. Symbols are namespaced per repository, because two repos that both define main are two symbols, and merging them would invent call edges that do not exist.

brainlyy docs --build renders docs/*.md into one self-contained page in the same design system, with the fonts inlined. The markdown ships in the wheel, so it works on a machine that has never seen the repository.

LICENSE, MIT, matching what pyproject.toml and the README already claimed. The repository was not actually licensed before this.

Continuous integration: the property suite runs on push across Linux, macOS and Windows on Python 3.10 to 3.13, plus a clean-machine brainlyy init.

Documentation set: quickstart, concepts, install, CLI reference, security, glossary and FAQ.

CONTRIBUTING.md.

Config discovery preferred the working directory over an explicitly set BRAINLYY_HOME, so cd silently changed which instance answered: standing in a directory that happened to hold an unrelated config.yaml loaded it, and the tool then reported confidently about the wrong vault. An explicitly named instance now wins. Found by running the property suite from an installed package, where the instance directory is also the working directory.

Installable package. brainlyy init / doctor / serve / search.

Two MCP servers: a read server bound to a mesh address, and a write server that exits at startup if configured to bind anything but loopback.

Capability detection with tiers 0 to 4. Nothing is required; each dependency found turns on more.

Tier 0 note search: lexical ranking over a markdown vault, no vector store.

Knowledge and agent (SOUL) templates, rendered by init.

A property suite of 66 assertions covering bind addresses, the loopback guard, allowlist refusals, and that no deployment-specific value travels with the package. It ships inside the wheel, so an installed instance verifies itself with the same assertions.

register() resolved claude with shutil.which() and then invoked the bare name. On Windows those are different lookups, because CreateProcess appends .exe, so it verified one executable and ran another.

_detect_mesh_ip() tested startswith("100."), which matches public address space, and excluded the CGNAT base address by string prefix rather than by range.

_fill() silently passed through a config key that matched no template line, handing the user the example's placeholder values as their own answers.