GitNexus 1.6.10-electric.8

GitNexus 1.6.10-electric.8

1.6.10-electric.8 is a containment release for the fork-only staged embedding lifecycle. It removes the production requirement to resume arbitrary dirty or unjournaled staged generations and keeps existing healthy indexes available for read-only use.

Fixed

• An unjournaled staged generation is preserved for forensics and refused. GitNexus will not infer that it is safe to resume or promote, even when its metadata appears complete.
• Replacing preserved staged state requires the explicit clean path: gitnexus analyze --staged --drop-embeddings.
• A valid pending promotion journal is recovered as one terminal operation. The result is reported as recovery-only and never as alreadyUpToDate; the current checkout is not claimed analyzed.
• CLI recovery output gives the clean staged retry. Server recovery fails the analyze request closed and requires force=true with dropEmbeddings=true.
• Promotion recovery completes ignore and best-effort context-file bookkeeping before returning.
• --incremental-only --drop-embeddings is rejected before repository storage or ownership-lock mutation.

Safety Boundary

• Canonical indexes are never replaced by an unjournaled staged generation.
• Malformed embedding identity, duplicate identity, orphan references, wrong vector dimensions, dirty checkpoints, unsafe storage, locks, or recovery sidecars remain fail-closed.
• Invalid MCP repository policy remains fail-closed and agent-visible, with no unrestricted fallback.
• Remote Voyage embeddings have no host memory, swap, RSS, or pressure gate. This release does not restart fleet writers.

Known Boundary

• The explicit clean staged path still copies an existing canonical LadybugDB before wiping the isolated copy. The canonical remains safe, but the extra disk/time cost must be removed under #132 before large-repository fleet writers are re-enabled.
• Distribution is GitHub-only. Public npm dist-tags and container registries remain unchanged.
• Publication and installation do not prove fleet completeness or freshness. Fleet onboarding and ordinary refreshes remain separate, paused work.

Release Verification

• Included PR: #180. Tracking: #162, #132, and epic #130.
• Package, lockfile, Claude/Codex plugin manifests, both marketplace manifests, changelog, and this release note agree on 1.6.10-electric.8.
• The exact artifact must first refuse the preserved dirty ClawSweeper generation without changing its hashes, then produce a separate clean isolated generation with zero empty, duplicate, orphaned, non-canonical, or wrong-dimension embeddings.
• The accepted generation must pass the live eight-connection VECTOR pool and two successive non-partial semantic queries before publication or installation.
• Installed proof requires Codex and Claude to resolve the same .8 wrapper. .7 remains available for rollback.

GitNexus 1.6.10-electric.7

GitNexus 1.6.10-electric.7

1.6.10-electric.7 closes the final source defects found during installed fleet recovery and adds a safe, non-destructive Claude hook refresh path. It does not blanket-reindex healthy repositories.

Added

• gitnexus analyze --repair-vector rebuilds only HNSW after fail-closed storage, sidecar, lock, metadata, and live VECTOR preflight. It preserves all embedding rows, verifies the rebuilt index through the eight-connection production pool, and then reconciles database-derived metadata and registry counts.
• gitnexus setup --hooks-only --coding-agent claude updates only the Claude GitNexus adapter and required helpers, removes only the obsolete GitNexus SessionStart registration, and leaves Claude MCP, skills, and unrelated hooks unchanged.
• gitnexus doctor --integrations --json reports the selected CLI, Codex and Claude MCP consistency, and Claude hook freshness without exposing configuration values or secrets.
• Claude hook execution now has an eight-process machine-global cap in addition to the three-per-repository cap.

Fixed

• Isolated staged embedding resumes validate the physical identity set before mutation, drop HNSW, recreate CodeEmbedding, stream-restore only an exact digest-matched preservation snapshot, regenerate the pending checkpoint window once, and rebuild HNSW. Empty, non-canonical, duplicate, orphaned, or wrong-dimension rows fail closed; the canonical in-place embedding table is never recreated by this path.
• Embedding and node writers validate complete batches before writing, and node COPY failures no longer retry with permissive row dropping.
• LadybugDB buffer-pool sizing is bounded, index replacement invalidates stale MCP read pools, and pool rollover waits for checked-out queries.
• Readable repositories with zero embeddings report not-indexed rather than a false vector failure.

Operational Policy

• Remote Voyage indexing may run for at most two different normalized remotes and index paths. It has no host memory, swap, RSS, free-memory, or pressure gate.
• Local embedding work remains single-job and separately resource-gated.
• Large repositories run alone unless paired with an explicitly small repository.
• Invalid MCP repository policy remains fail-closed and agent-visible; there is no unrestricted fallback.
• Healthy existing indexes are retained. Ordinary onboarding and refresh work runs as a detached queue and does not block interactive use of the released runtime.

Known Boundaries

• Distribution is GitHub-only. Public npm dist-tags and container registries remain unchanged.
• Publication and installation do not prove fleet repair, Claude hook parity, or live MCP retrieval; those remain separate installed-runtime gates.
• Late P2 edge cases in Windows-only optional hook helpers, rc-derived PDG repair conflicts, asynchronous native timeout setup, and concurrent wiki-generation rollover received explicit non-blocking dispositions and are not claimed fixed by this release.

Release Verification

• Included PRs: #172, #173, #174, and #176; sprint epic: #130.
• Package, lockfile, Claude/Codex plugin manifests, both marketplace manifests, changelog, and this release note agree on 1.6.10-electric.7.
• The release gate requires protected exact-head CI, current-head independent review, terminal dispositions for all review threads, immutable copied-artifact acceptance against the preserved ClawSweeper resume and WorldOS generation, the protected Electric Release workflow, verified tarball and SHA256SUMS, and side-by-side installation preserving .6.
• Installed proof requires safe Claude hook refresh, integration doctor consistency, targeted vector repair, live registry doctor, and two successive non-partial semantic queries against OpenClaw and Hermes.

GitNexus 1.6.10-electric.6

GitNexus 1.6.10-electric.6

1.6.10-electric.6 is the narrow follow-up to the installed .5 ClawSweeper acceptance failure. It contains no unrelated source or fleet-policy changes.

Fix

• A staged resume with a persisted HNSW index now drops that staged index before regenerating the interrupted embedding window, then rebuilds HNSW after the bounded delete/reinsert sequence. This prevents LadybugDB from retaining a deleted CodeEmbedding primary key long enough to reject its same-key replacement.
• The operation remains fail-closed when VECTOR cannot be loaded or the staged index cannot be removed. The canonical generation stays readable until normal staged validation and promotion.

Operational Policy

• Remote Voyage indexing has no host memory, swap, RSS, free-memory, or pressure gate.
• Invalid MCP repository policy remains fail-closed and agent-visible; there is no unrestricted fallback.
• Healthy existing indexes are retained. Fleet onboarding and ordinary refreshes remain detached background work.

Known Boundaries

• Distribution is GitHub-only. Public npm dist-tags and container registries remain unchanged.
• Publication and installation do not prove ClawSweeper recovery or MCP retrieval; those remain separate installed-runtime gates.

Release Verification

• Included corrective PR: #168; reopened defect: #162; sprint epic: #130.
• Package, lockfile, Claude/Codex plugin manifests, both marketplace manifests, changelog, and this release note agree on 1.6.10-electric.6.
• The release gate requires protected exact-head CI, current-head independent review, zero unresolved review threads, the protected Electric Release workflow, verified tarball and SHA256SUMS, and side-by-side installation preserving .2 through .5.
• Installed proof must resume the preserved ClawSweeper staged generation, require DB/meta/registry count agreement and live vector-index, then complete two non-partial MCP semantic queries.

GitNexus 1.6.10-electric.5

GitNexus 1.6.10-electric.5

1.6.10-electric.5 is the immutable follow-up patch required by the held ClawSweeper staged generation and the installed fleet doctor. It does not rebuild healthy repositories or change the approved fleet policy.

Fixes

• Pending-window checkpoint rows now carry their exact embedding primary identities into regeneration. The pipeline deletes those known rows immediately before the current batch is recreated, preventing a hidden stale CodeEmbedding.id from causing a duplicate-key failure while preserving the bounded 5,000-node recovery window.
• Registry doctor now reads the stored CodeEmbedding.embedding column type through its already-open non-recovering diagnostic pool and builds the HNSW probe at that database's actual dimension. Missing, malformed, or implausibly large dimensions remain fail-closed with the sanitized unavailable reason.

Operational Policy

• Remote Voyage indexing has no host memory, swap, RSS, free-memory, or pressure gate.
• The shared wrapper admits at most two different normalized remotes. A genuinely large repository runs alone.
• Invalid MCP repository policy remains fail-closed and agent-visible; there is no unrestricted fallback.
• Healthy existing indexes are retained. Only named stale, interrupted, onboarding, or identity-migration lanes are changed.

Known Boundaries

• Distribution is GitHub-only. Public npm dist-tags and container registries remain unchanged.
• A published artifact does not prove local installation, ClawSweeper recovery, registry equality, or restarted Codex and Claude behavior; those remain separate installed-runtime gates.

Release Verification

• Included merged PRs: #163 and #165; sprint epic: #130; release tracker: #166.
• Package, lockfile, Claude/Codex plugin manifests, both marketplace manifests, changelog, and this release note agree on 1.6.10-electric.5.
• The release gate requires protected exact-head CI, current-head independent review, zero unresolved review threads, the protected Electric Release workflow, verified tarball and SHA256SUMS, and a side-by-side installation that preserves .2, .3, and .4.
• Installed proof must retry the preserved ClawSweeper staged generation, run the raw and Voyage-aware registry doctors, and complete the remaining fleet and live-agent acceptance gates.

GitNexus 1.6.10-electric.4

GitNexus 1.6.10-electric.4

1.6.10-electric.4 is the post-.3 repair patch for interrupted staged resumes, large Swift repositories, and truthful live vector-index diagnosis. It contains the exact merged fixes required to resume the held fleet safely without rebuilding healthy indexes.

Fixes

• Staged embedding resume records restored row identities and content hashes, then deletes stale restored rows by exact (nodeId, chunkIndex) primary identity before regeneration. Vectors continue to stream in batches of at most 256.
• Registry doctor now probes the production named HNSW index through the real eight-connection read pool. A loaded VECTOR extension without a queryable index reports unavailable with a stable sanitized reason; healthy graph and FTS reporting remains available.
• Swift target-wide definitions and type bindings are stored once and shared by sibling modules instead of being copied into every module. Local-first lookup and SwiftPM target isolation remain unchanged.
• Recovery planning accepts valid legacy metadata whose nested FTS capability is absent and reports that capability as unknown instead of throwing.

Operational Policy

• Remote Voyage indexing has no host memory, swap, RSS, free-memory, or pressure gate.
• The shared wrapper admits at most two different normalized remotes. A genuinely large repository uses the exclusive queue lane and runs alone.
• Invalid MCP repository policy remains fail-closed and agent-visible; this patch does not weaken allowlists or add unrestricted fallback.
• Healthy existing indexes are not blanket-rebuilt. Interrupted or stale repositories receive only their named staged repair or onboarding action.

Known Boundaries

• Distribution is GitHub-only. Public npm dist-tags and container registries remain unchanged.
• Worktree branch-overlay indexing remains out of scope.
• A published artifact does not by itself prove local installation, held-generation recovery, registry cleanup, or restarted Codex and Claude behavior. Those remain separate installed-runtime gates.

Release Verification

• Included merged PRs: #154, #156, #157, and #159; sprint epic: #130; release tracker: #160.
• Package, lockfile, Claude/Codex plugin manifests, both marketplace manifests, changelog, and this release note agree on 1.6.10-electric.4.
• The release gate requires protected exact-head CI, resolved review findings, the protected Electric Release workflow, verified tarball and SHA256SUMS, and a side-by-side installation that preserves 1.6.10-electric.3.
• Installed proof must resume ClawSweeper safely, verify OpenClaw, NeonDiff, and GitNexus repair, run live registry doctor, and complete restarted Codex and Claude semantic queries.

GitNexus 1.6.10-electric.3

GitNexus 1.6.10-electric.3

1.6.10-electric.3 makes semantic search truthful and large-repository indexing safer. It keeps one canonical index readable while staged work proceeds, exposes partial retrieval instead of silently dropping it, and prevents duplicate indexes for the same GitHub remote.

Highlights

• Every prewarmed LadybugDB read connection loads FTS and VECTOR before the pool is published. Query responses now say which keyword and semantic paths actually ran.
• Large analysis uses bounded pages, embedding batches, checkpoints, and a promotion journal so interrupted work can resume without replacing the readable index early.
• Invalid MCP repository policy remains fully fail-closed but visible to stdio agents, and new read-only doctors diagnose policy, registry, extension, count, and WAL/shadow state.
• GitHub SSH and HTTPS spellings normalize to one repository identity, and duplicate top-level registration is refused before storage is created.

Changes

• Query results add retrieval metadata for keyword mode, semantic mode, embedding count, exact-scan limit, and a stable reason when semantic contribution is unavailable.
• Staged analysis preserves at most the pending checkpoint window plus real changes, handles SIGTERM through the bounded checkpoint path, and promotes through explicit journal states.
• Staged embedding snapshots coalesce repeated (nodeId, chunkIndex) identities on write and restore legacy duplicate rows once, while still validating every physical row and buffering at most 256 vectors. Rows in the bounded pending checkpoint window are regenerated directly instead of entering an unsafe restore-delete-create cycle against the live VECTOR index.
• gitnexus doctor --mcp-config --json reuses the production policy resolver without binding MCP or opening an index.
• gitnexus doctor --registry --json reports normalized-remote and alias collisions, metadata/database count drift, WAL/shadow state, and live eight-connection extension capability. Paths remain redacted unless explicitly requested locally.
• Voyage requests for voyage-code-3 now send the provider-native output_dimension field for 2,048-dimensional embeddings.

Fixes

• Repositories above the 20,000-row exact-scan limit no longer lose semantic contribution silently when one pooled connection lacks VECTOR.
• Successful zero-result HNSW queries remain distinct from VECTOR query failures.
• Malformed or ambiguous stdio allowlists initialize only in blocked mode: repository operations return a sanitized configuration error, with no partial allowlist acceptance and no unrestricted fallback. HTTP remains fail-fast.
• Concurrent attempts to index the same normalized GitHub remote produce one canonical winner and one stable collision error instead of duplicate registry rows.
• Voyage-compatible embedding calls no longer fail because an OpenAI-specific dimension field was sent to the Voyage API.
• Non-Git and --skip-git staged indexes stamp the current schema identity, so a valid embedding checkpoint resumes instead of being misclassified as pre-versioning metadata.
• Interrupted staged resumes no longer fail with a duplicate CodeEmbedding primary key when a preserved legacy snapshot contains repeated identities or rows owned by the pending regeneration window.

Known Boundaries

• Distribution is GitHub-only. Public npm dist-tags and container registries remain unchanged.
• The exact-scan limit remains 20,000; this release fixes indexed retrieval rather than raising the fallback cap.
• Voyage work runs exactly one repository at a time and has no host memory, swap, RSS, free-memory, or pressure gate. Optional resource JSONL is telemetry only. Remote HTTP/Voyage generation also defaults to no automatic node-count cap; the 50,000-node automatic cap is local-model-only, while explicit operator caps remain valid. Local embedding backends require a separate explicit resource policy.
• A published release proves the exact artifact and release workflow. Side-by-side local installation, registry repair, fleet embedding refresh, and live Codex/Claude behavior are separate post-release gates.
• Worktree branch-overlay indexing remains out of scope.

Release Verification

• Capability PRs: #129, #138, #139, #140, #142, #144, #146, #148, and #150; sprint epic: #130; release gate: #137.
• Package, lockfile, Claude/Codex plugin manifests, both marketplace manifests, changelog, and this release note agree on 1.6.10-electric.3.
• Required proof includes protected exact-head CI, pooled VECTOR integration, staged interruption/recovery tests, canonical identity and doctor suites, sequential large-repository Voyage soaks, and the protected Electric Release workflow.
• The protected workflow publishes electric/v1.6.10-electric.3 with one proved tarball plus SHA256SUMS; rollback retains 1.6.10-electric.2.

GitNexus 1.6.10-electric.2

GitNexus 1.6.10-electric.2

1.6.10-electric.2 is a focused Electric Sheep maintenance release for more
reliable MCP discovery and reproducible native packaging. It is distributed as
a GitHub Release tarball with a SHA-256 checksum and does not publish to npm or
a container registry.

Highlights

• MCP context resources now see fresh repository metadata after analysis by a
  separate process; restarting the MCP server is no longer required.
• Tool schemas avoid root combinators rejected by strict providers while
  keeping the existing property and alias surface intact.
• LadybugDB is pinned exactly to 0.18.1, and one release tarball is proved in
  clean Linux, macOS, and Windows installations before publication.

Changes

• Allowed context-resource requests read current meta.json data and fall back
  to cached registry metadata when the file is absent or corrupt.
• impact and api_impact selector requirements are enforced by runtime
  normalization before repository resolution, including canonical, alias,
  agreeing, conflicting, grouped, read-only, allowlisted, stdio, and HTTP paths.
• Release recovery requires the three original platform package proofs, and
  the shared verifier is reused by normal CI and protected release jobs.

Fixes

• Denied repositories cannot trigger metadata reads through the context
  resource path.
• Strict MCP providers no longer reject advertised tools because of top-level
  anyOf, oneOf, or allOf schemas.
• Package proof now fails closed on checksum or package drift, native-load
  failure, broken launcher targets, hung CLI probes, vendor build debris, and
  links in the five shipped native grammar directories.

Known Boundaries

• This patch builds on the existing Electric 1.6.10-electric.1 lineage and
  does not claim convergence with a nonexistent upstream stable v1.6.10 tag.
• Distribution is GitHub-only. Public npm dist-tags and container registries
  remain unchanged.
• Publication does not analyze a repository, mutate an index, build
  embeddings, restart OpenClaw, or change a running OpenClaw process. Existing
  processes adopt the new local default only after a later natural or
  separately approved restart.
• Cross-platform package proof covers supported GitHub runners; it does not
  establish customer runtime or indexing-quality behavior.

Release Verification

• Capability PRs: #122, #123, and #124; tracker: #117; release gate: #121.
• Package, lockfile, Claude/Codex plugin manifests, both marketplaces, and this
  release note agree on 1.6.10-electric.2.
• Required proof includes focused resource/schema/package tests, complete
  current-head CI, protected publication approval, and one-tarball native-load
  verification on Linux, macOS, and Windows.
• Post-release verification downloads both assets, checks SHA256SUMS, installs
  beside 1.6.10-electric.1, smokes the isolated CLI and MCP tools/list, and
  retains .1 as the rollback target.

Evidence: gitnexus-electric2-release-gate/v1 under the Electric Sheep sprint
packet for 2026-07-14.

GitNexus 1.6.10-electric.1

GitNexus 1.6.10-electric.1

1.6.10-electric.1 is the first long-term Electric Sheep GitHub-only release
from the reconciled GitNexus fork. It packages the proven internal source
candidate as an installable tarball with a SHA-256 checksum, without publishing
to npm or a container registry.

Highlights

• Static, configuration, and document-heavy repositories keep searchable
  embeddings through a text-bearing File-node fallback.
• Large incremental updates have subprocess coverage for adds, edits, renames,
  deletes, FTS, vectors, embeddings, escalation, interruption, and resume.
• MCP operators can bound output, use compatible parameter aliases, restrict
  repositories, and run a fail-closed read-only surface.
• Interrupted analysis gains a strict no-force incremental contract and a
  read-only recovery plan before any unsafe rebuild.
• HTTP embeddings use bounded retry and resume behavior, while optional
  reranking remains isolated behind a provider interface.

Changes

• Non-loopback eval-server binding now requires bearer authentication.
• VECTOR diagnostics cover extension loading, existing indexes, and exact-scan
  fallback behavior.
• Repository traversal, graph lookup, community projection, and Rust/PHP import
  resolution are deterministic across input order.
• Release governance is manual-only, exact-head, protected by
  internal-release, and limited to a GitHub Release tarball plus
  SHA256SUMS.

Fixes

• Node deletion and Cypher CLI failures surface non-zero outcomes instead of
  false success.
• FTS deletion, durable sidecars, dirty markers, and ParsedFile generations are
  covered by bounded recovery behavior.
• Release-state retries verify the encoded Electric tag, exact commit, and
  resumable draft before mutation.
• Dependency, Gitleaks, terminal-output, canary-manifest, and container-base
  hardening from the reconciliation program are included.

Known Boundaries

• Provenance is upstream v1.6.10-rc.19 at
  d43c479ac58c18d397958f48a99465d6c3110b1d, reconciled through fork PR #98.
  This version does not imply that an upstream stable v1.6.10 tag existed.
• Distribution is a GitHub Release only. Public npm dist-tags and container
  registries are outside this release and must remain unchanged.
• Publishing the artifact does not install it into OpenClaw or evaOS, mutate a
  live GitNexus index, rebuild embeddings, or change runtime configuration.
• The earlier full OpenClaw corpus run remains non-blocking diagnostic evidence;
  release confidence uses the bounded disposable canaries and cross-platform CI
  recorded in PR #98.

Release Verification

• Release PR: package, lockfile, Claude/Codex plugin manifests, and both
  marketplaces agree on 1.6.10-electric.1.
• Required CI: build, typecheck, unit/integration coverage, platform-sensitive
  macOS/Linux/Windows tests, package-install smoke, security checks, and review.
• Protected workflow: pack dry-run, build, isolated tarball install,
  gitnexus --version, CLI/MCP help, SHA-256 generation, asset verification,
  and publish-last draft promotion.
• Post-release: download both assets, verify SHA256SUMS, reinstall in a fresh
  prefix, and confirm npm/container/runtime/index/embedding state is unchanged.

Tracking: #98, #109, #110, #111.

GitNexus v1.6.7-electric.2

GitNexus v1.6.7-electric.2

Internal Electric Sheep reliability release. This release remains based on upstream v1.6.7 and selectively ports operational hardening from later upstream work without adopting the upstream v1.6.8-rc.* feature stream.

Included

• Atomic registry writes and transient registry I/O protection.
• Vendored tree-sitter grammar loading from stable absolute vendor paths.
• Large-repo parse-worker clone-safety hardening.
• Hook, DB-lock probe, orphan/process guard, and hook command-resolution hardening.
• Local embedding dependency resolution compatibility for strict package-manager layouts.
• Install reliability hardening: local ONNX embedding runtime packages are optional so basic CLI/MCP installs do not fail on native ONNX postinstall network/download failures.
• Existing Electric Sheep MCP/Voyage behavior remains preserved: read-only MCP mode, repo allowlists, maxTokens, rerank, Voyage HTTP embeddings/rerank, vector diagnostics, and --skip-ai-context.

Not Included

• No upstream v1.6.8-rc.* broad adoption.
• No HTTP MCP daemon/topology change.
• No multi-branch indexing, trace tool, CFG/PDG/taint stack, or broad dependency churn.
• No npm publish, Docker publish, registry cleanup, reindexing, embedding rollout, MCP allowlist mutation, branch deletion, or worktree deletion.

Validation

• PR #26 green and merged: reliability port stack.
• PR #27 green and merged: packaged-install reliability follow-up.
• Final main at 1943b303020e8db52075cc2cd54ee6b910698cad passed Gitleaks, Scorecard, Trivy, CodeQL, and Release Candidate.
• Local canonical runtime rebuilt from /Volumes/LEXAR/repos/GitNexus/gitnexus; gitnexus --version reports 1.6.7-electric.2.
• npm gitnexus dist-tags were intentionally not changed.

GitNexus v1.6.7-electric.1

GitNexus v1.6.7-electric.1

Internal Electric Sheep source release for GitNexus.

This release records electricsheephq/GitNexus as upstream v1.6.7 plus Electric Sheep MCP, Voyage, vector diagnostics, release workflow, and runtime hardening patches.

Tag policy:

• Source tag: electric/v1.6.7-electric.1
• Upstream base: v1.6.7
• Package version: 1.6.7-electric.1
• npm publish: not included
• Docker publish: not included

Use this release to track internal fork progress and reproduce the exact source state used by Codex agents. Public artifact publishing remains gated by the repository's normal release workflows and secrets.