release: WikiBrain v0.1.8

.github/workflows/ci.yml

@@ -23,6 +23,11 @@ jobs:
           python-version: ${{ matrix.python-version }}
           cache: pip
 
+      - name: Install native ACL tooling
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes acl
+
       - name: Install WikiBrain
         run: |
           python -m pip install --upgrade pip
@@ -41,14 +46,57 @@ jobs:
           python -m compileall -q src tests scripts
           python -m pip check
 
+  release-gates:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.13"
+          cache: pip
+
+      - name: Install release gate tools
+        run: python -m pip install "uv==0.9.21" "ruff==0.15.22" "twine==6.2.0"
+
+      - name: Run lint and locked source checks
+        run: |
+          ruff check src tests benchmarks scripts
+          uv lock --check
+          python -m compileall -q src tests benchmarks scripts
+          python scripts/render_benchmark_chart.py --check
+          python scripts/render_retrieval_quality_chart.py --check
+
+      - name: Build and inspect release artifacts
+        run: |
+          uv build
+          twine check dist/*
+
+      - name: Install and smoke-test the wheel
+        run: |
+          python -m venv /tmp/wikibrain-wheel
+          /tmp/wikibrain-wheel/bin/python -m pip install dist/*.whl
+          /tmp/wikibrain-wheel/bin/brainctl --version
+          /tmp/wikibrain-wheel/bin/python -I -c 'from wikibrain.version_policy import _fetch_remote_policy; assert _fetch_remote_policy(child_code="import sys;sys.stdout.buffer.write(b\"{}\")") == b"{}"'
+
+      - name: Install and smoke-test the source distribution
+        run: |
+          python -m venv /tmp/wikibrain-sdist
+          /tmp/wikibrain-sdist/bin/python -m pip install dist/*.tar.gz
+          /tmp/wikibrain-sdist/bin/brainctl --version
+
   windows:
     runs-on: windows-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
-          python-version: "3.13"
+          python-version: ${{ matrix.python-version }}
           cache: pip
 
       - name: Install WikiBrain
@@ -66,6 +114,7 @@ jobs:
           python -m unittest tests.test_real_wikimap -v
 
       - name: Test the native Windows installer
+        if: matrix.python-version == '3.13'
         shell: pwsh
         run: |
           ./scripts/install-windows.ps1 `
@@ -74,6 +123,7 @@ jobs:
             -SkipPythonInstall
 
       - name: Verify native Windows hooks
+        if: matrix.python-version == '3.13'
         shell: pwsh
         run: |
           $pipxBin = (
@@ -135,3 +185,52 @@ jobs:
         run: |
           python -m compileall -q src tests scripts
           python -m pip check
+
+  macos:
+    runs-on: macos-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install WikiBrain
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install .
+
+      - name: Run unit and contract tests
+        run: python -m unittest discover -s tests -v
+
+      - name: Run the real Wikimap contract
+        env:
+          WIKIMAP_BIN: wikimap
+        run: python -m unittest tests.test_real_wikimap -v
+
+      - name: Check bytecode and dependencies
+        run: |
+          python -m compileall -q src tests scripts
+          python -m pip check
+
+  release-ready:
+    if: always()
+    needs: [test, windows, macos, release-gates]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every release gate
+        env:
+          TEST_RESULT: ${{ needs.test.result }}
+          WINDOWS_RESULT: ${{ needs.windows.result }}
+          MACOS_RESULT: ${{ needs.macos.result }}
+          RELEASE_GATES_RESULT: ${{ needs.release-gates.result }}
+        run: |
+          test "$TEST_RESULT" = success
+          test "$WINDOWS_RESULT" = success
+          test "$MACOS_RESULT" = success
+          test "$RELEASE_GATES_RESULT" = success

CHANGELOG.md

@@ -6,6 +6,26 @@ The project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.1.8] - 2026-07-23
+
+### Security
+
+- Bound official release-policy retrieval by a monotonic 2.0-second request budget
+  plus a 0.5-second native cleanup reserve in a directly managed subprocess. The
+  worker also has a self-deadline, and timeout cleanup verifies OS-native
+  releases descriptors/handles only after OS-confirmed process death, and redirects are
+  rejected before urllib can contact any target while retaining the socket timeout and
+  response-size cap.
+- Validate cached policy files before reading them: POSIX caches must be non-symlink
+  regular files owned by the current user, free of extended ACLs, and not group/other
+  writable; Windows opens the cache with a non-following kernel handle and validates
+  the same handle's regular-file/reparse state, final configured-home containment,
+  owner SID, and DACL.
+- Reject policy timestamps before the schema-v1 epoch or more than five minutes in
+  the future, and reject rollback below the last accepted `updated_at`. Cache schema
+  v2 preserves that rollback floor across negative-cache entries and system-clock
+  regressions while reading and migrating existing schema-v1 caches.
+
 ## [0.1.7] - 2026-07-22
 
 ### Added

README.ja.md

@@ -297,7 +297,7 @@ brainctl setup && brainctl doctor
 インストールした場合は次のように更新します。
 
 ```powershell
-pipx install --force "git+https://github.com/hungrytech/wikibrain.git@v0.1.7"
+pipx install --force "git+https://github.com/hungrytech/wikibrain.git@v0.1.8"
 brainctl setup
 brainctl doctor
 ```
@@ -334,7 +334,7 @@ AI が提示した計画と権限要求を確認してから進めてくださ
 ```powershell
 $installer = Join-Path $env:TEMP "install-wikibrain.ps1"
 Invoke-WebRequest `
-  "https://raw.githubusercontent.com/hungrytech/wikibrain/v0.1.7/scripts/install-windows.ps1" `
+  "https://raw.githubusercontent.com/hungrytech/wikibrain/v0.1.8/scripts/install-windows.ps1" `
   -OutFile $installer
 Get-Content $installer
 powershell.exe -NoProfile -ExecutionPolicy Bypass `

README.ko.md

@@ -332,7 +332,7 @@ brainctl setup && brainctl doctor
 갱신합니다.
 
 ```powershell
-pipx install --force "git+https://github.com/hungrytech/wikibrain.git@v0.1.7"
+pipx install --force "git+https://github.com/hungrytech/wikibrain.git@v0.1.8"
 brainctl setup
 brainctl doctor
 ```
@@ -372,7 +372,7 @@ AI가 제시한 계획과 권한 요청을 확인한 뒤 진행하세요. 직접
 ```powershell
 $installer = Join-Path $env:TEMP "install-wikibrain.ps1"
 Invoke-WebRequest `
-  "https://raw.githubusercontent.com/hungrytech/wikibrain/v0.1.7/scripts/install-windows.ps1" `
+  "https://raw.githubusercontent.com/hungrytech/wikibrain/v0.1.8/scripts/install-windows.ps1" `
   -OutFile $installer
 Get-Content $installer
 powershell.exe -NoProfile -ExecutionPolicy Bypass `

README.md

@@ -344,7 +344,7 @@ download and review it as described below. A direct `pipx` installation can be
 upgraded with:
 
 ```powershell
-pipx install --force "git+https://github.com/hungrytech/wikibrain.git@v0.1.7"
+pipx install --force "git+https://github.com/hungrytech/wikibrain.git@v0.1.8"
 brainctl setup
 brainctl doctor
 ```
@@ -384,7 +384,7 @@ manually, open PowerShell, download the versioned installer, review it, then run
 ```powershell
 $installer = Join-Path $env:TEMP "install-wikibrain.ps1"
 Invoke-WebRequest `
-  "https://raw.githubusercontent.com/hungrytech/wikibrain/v0.1.7/scripts/install-windows.ps1" `
+  "https://raw.githubusercontent.com/hungrytech/wikibrain/v0.1.8/scripts/install-windows.ps1" `
   -OutFile $installer
 Get-Content $installer
 powershell.exe -NoProfile -ExecutionPolicy Bypass `

README.zh-CN.md

@@ -311,7 +311,7 @@ brainctl setup && brainctl doctor
 如果是直接通过 `pipx` 安装，请这样升级：
 
 ```powershell
-pipx install --force "git+https://github.com/hungrytech/wikibrain.git@v0.1.7"
+pipx install --force "git+https://github.com/hungrytech/wikibrain.git@v0.1.8"
 brainctl setup
 brainctl doctor
 ```
@@ -346,7 +346,7 @@ Do not bypass Codex hook trust.
 ```powershell
 $installer = Join-Path $env:TEMP "install-wikibrain.ps1"
 Invoke-WebRequest `
-  "https://raw.githubusercontent.com/hungrytech/wikibrain/v0.1.7/scripts/install-windows.ps1" `
+  "https://raw.githubusercontent.com/hungrytech/wikibrain/v0.1.8/scripts/install-windows.ps1" `
   -OutFile $installer
 Get-Content $installer
 powershell.exe -NoProfile -ExecutionPolicy Bypass `

benchmarks/results/retrieval-quality-v1.json

@@ -224,16 +224,16 @@
     }
   ],
   "wikimap_version": "wikimap 1.1.0",
-  "generated_at": "2026-07-22T13:51:50.252069+00:00",
+  "generated_at": "2026-07-22T17:03:28.453686+00:00",
   "environment": {
     "machine": "arm64",
-    "platform": "macOS-26.5.2-arm64-arm-64bit",
-    "python": "3.11.15"
+    "platform": "macOS-26.5.2-arm64-arm-64bit-Mach-O",
+    "python": "3.13.11"
   },
   "provenance": {
     "corpus_sha256": "adc729bcb6a8a8027d11176601046eaeef022bde135c7f225f8e40b78f7a998c",
-    "source_manifest_sha256": "4d5b53dff2bb39a3d6d24624ad3b2bd752307a1a7ae374fa672f8ea9501665b5",
-    "git_commit": "2654792c6c2f85ce297eab4f25617c7b3b86810b",
+    "source_manifest_sha256": "e115feec5e6dafbc7718b6170b4695e96bf622d128d50d52673d1de6b8b5e5a8",
+    "git_commit": "f5bea451e99b1729ad2aa9f6755e7bbfd1ace557",
     "git_dirty": false
   }
 }

benchmarks/results/second-brain-v1.json

@@ -6,8 +6,8 @@
     "handoff_check": "session-start-recent-context"
   },
   "engine": "wikimap 1.1.0",
-  "python": "3.11.15",
-  "platform": "macOS-26.5.2-arm64-arm-64bit",
+  "python": "3.13.11",
+  "platform": "macOS-26.5.2-arm64-arm-64bit-Mach-O",
   "corpus_documents": 8,
   "checks_passed": 8,
   "checks_total": 8,
@@ -20,11 +20,11 @@
     "forbidden_atoms": 4
   },
   "provenance": {
-    "generated_at": "2026-07-22T13:51:40+00:00",
+    "generated_at": "2026-07-22T17:03:25+00:00",
     "corpus_version": "second-brain-corpus-v1",
     "runner_sha256": "666510b248680357cebe9d70d42f07a7d0619522658fbb0810989aec449ec2aa",
-    "source_manifest_sha256": "f9fc90c63885c104a5dd439967a5e2bc91455720364d4957d9a26b542843e4db",
-    "git_commit": "2475e281a5dce0b3320af0e09b3561b7ad02e643",
+    "source_manifest_sha256": "a4f58b6f522e22515ffc20cf75aabd39bc6dcb52759c717fe635dbdce8befcab",
+    "git_commit": "f5bea451e99b1729ad2aa9f6755e7bbfd1ace557",
     "git_dirty": false,
     "reproduction_command": "uv run python -m benchmarks.second_brain --wikimap wikimap --format json --output benchmarks/results/second-brain-v1.json"
   },

packaging/homebrew/README.md

@@ -15,8 +15,8 @@ pinned backend.
    ```bash
      python3 scripts/render_homebrew_formula.py \
        --owner hungrytech \
-       --version 0.1.7 \
-       --source-url https://github.com/hungrytech/wikibrain/archive/refs/tags/v0.1.7.tar.gz \
+       --version 0.1.8 \
+       --source-url https://github.com/hungrytech/wikibrain/archive/refs/tags/v0.1.8.tar.gz \
        --source-sha256 64_HEX_CHARACTERS
    ```
 

plugins/wikibrain/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wikibrain",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Recall and curate a local, cross-agent personal second brain.",
   "author": {
     "name": "Taekmin Lee"

pyproject.toml

@@ -1,20 +1,20 @@
 [build-system]
-requires = ["setuptools>=69"]
+requires = ["setuptools>=77"]
 build-backend = "setuptools.build_meta"
 
 [project]
 name = "wikibrain-agent"
-version = "0.1.7"
+version = "0.1.8"
 description = "Local-first personal memory bridge for Claude Code, Codex, Grok Build, and Wikimap"
 readme = "README.md"
 requires-python = ">=3.11"
-license = { text = "MIT" }
+license = "MIT"
+license-files = ["LICENSE"]
 authors = [{ name = "Taekmin Lee" }]
 keywords = ["second-brain", "wikimap", "claude-code", "codex", "grok-build", "hooks"]
 classifiers = [
   "Development Status :: 3 - Alpha",
   "Environment :: Console",
-  "License :: OSI Approved :: MIT License",
   "Operating System :: MacOS",
   "Operating System :: Microsoft :: Windows",
   "Operating System :: POSIX :: Linux",

release-policy.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "latest_version": "0.1.7",
+  "latest_version": "0.1.8",
   "minimum_supported_version": "0.1.7",
-  "updated_at": "2026-07-22T13:42:48Z"
+  "updated_at": "2026-07-22T14:42:07Z"
 }

scripts/install-windows.ps1

@@ -2,7 +2,7 @@
 
 [CmdletBinding()]
 param(
-    [string]$Version = "0.1.7",
+    [string]$Version = "0.1.8",
     [string]$PackageSource = "",
     [switch]$Initialize,
     [switch]$SkipPythonInstall

src/wikibrain/__init__.py

@@ -1,3 +1,3 @@
 """WikiBrain: a local-first memory bridge for coding agents."""
 
-__version__ = "0.1.7"
+__version__ = "0.1.8"