chore(release): bump version to 1.5.18 (XS)

[EtanHey]

Carries #799 (N1 — explicit brain_recall stats fallback) to an artifact. #799 merged at 4b11aca9 and is served nowhere: it edits brain-bar/Sources/BrainBar/MCPRouter.swift, and BrainBar on both Macs is 1.5.17 / 39cc7e6b, cut before #799 merged. A Swift change can never ride a brew formula bump.

Version sites

All six: pyproject.toml, src/brainlayer/__init__.py, server.json (root + packages[0]), brain-bar/bundle/Info.plist (short, bundle, release).

The cask is deliberately NOT bumped here — and this is not a declared lag

The v* tag builds the BrainBar app artifact (brainbar-release.yml triggers on the same tag as the PyPI publish — a fact I got wrong on #798 and corrected there). The cask bump is held as a separate step because it is the only one that drops /tmp/brainbar.sock and forces /mcp reconnect across every seat. Tagging costs no seat a restart; installing does. Under current fleet load those two are being run apart, so this PR does the free half.

Deploy receipt requirement for this release (D1)

Must carry a loaded-process-version row per Mac, not just the installed keg. After 1.5.17 the M1's drain/hotlane-brainbar and the M4's enrichment kept 1.5.16 mapped in memory because only two launchd labels were kickstarted. brainlayer --version reports the keg and cannot see this; lsof mappings can. docs.local/deploy/verify-1.5.17.sh now kickstarts all five labels and fails the gate on any process not on the target version.

Review

Per Claude conservation mode: Codex pair-reviewer + bots, no Claude reviewer — this is a version bump, not a core path (daemon/engine/transport/STT).

@codex review — two things worth real scrutiny rather than a rubber stamp:

1. Site completeness. Six sites. A miss means package and bundle disagree, and publish.yml's tag/version equality check is the only net.
2. Is the no-cask-bump framing honest? I want it read as a deliberate deferral of a disruptive step, not as a claim that BrainBar is unchanged — the opposite of the mistake I made on chore(release): bump version to 1.5.17 (XS) #798.

— brainlayerClaude-694272b8 (brainlayer lead)

🤖 Generated with Claude Code

---

Note

Low Risk
Mechanical version-string changes only; no application, auth, or data-path logic is modified in the diff.

Overview
Release-only bump from 1.5.17 to 1.5.18 so the tagged PyPI/MCP artifact and BrainBar bundle metadata align before deploy; it does not ship new runtime logic in this diff.

The same version string is updated in all six release sites: pyproject.toml, src/brainlayer/__init__.py (__version__), server.json (root and PyPI package entry), and brain-bar/bundle/Info.plist (CFBundleVersion, CFBundleShortVersionString, BrainLayerReleaseVersion). Per the PR notes, the Homebrew cask is intentionally left unchanged here so tagging/publish can happen without forcing BrainBar reinstalls and MCP reconnects; that step is expected separately.

^{Reviewed by Cursor Bugbot for commit 1016072. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bump version to 1.5.18 across bundle, package, and server metadata

Updates all version fields from 1.5.17 to 1.5.18 in Info.plist, pyproject.toml, server.json, and init.py. This is a release-prep change with no runtime behavior changes.

^{Macroscope summarized 1016072.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ac56e0ff-e6bb-4304-af53-19de034f7ff0)

[coderabbitai]

Warning

Review limit reached

Next included review available in 41 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 432134e4-fa6d-4347-85b8-c768dce5edd4

📥 Commits

Reviewing files that changed from the base of the PR and between 4b11aca and 1016072.

📒 Files selected for processing (4)

• brain-bar/bundle/Info.plist
• pyproject.toml
• server.json
• src/brainlayer/__init__.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T11:36:22.176663Z	1016072	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 4b11aca...1016072 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Python		Sep 7, 2026 11:33a.m.	Review ↗
Swift		Sep 7, 2026 11:33a.m.	Review ↗
JavaScript		Sep 7, 2026 11:33a.m.	Review ↗
Shell		Sep 7, 2026 11:33a.m.	Review ↗
Secrets		Sep 7, 2026 11:33a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 1016072109

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

BrainLayer ratchet

Every Value below was measured by this run. A row this machine cannot measure says n/a — <reason> instead of a number; baselines in Notes name their own machine, method and date and were not measured here.

Row	Status	Value (measured by this run)	Method	Notes
commit provenance	🟢 GREEN	measured 1016072109a5 == PR head · checkout fe4d483022df	commit graph + live PR head · in-process · runner	Which commit this whole table is about. On a pull_request event the checkout is GitHub's synthetic merge ref, whose sha is not on the PR — #759's table printed 13fa724278bf while that PR's head was 4632f979 — so this row names the PR-head parent instead, the sha a reviewer can actually see. The comparison sha is read live from repos/{owner}/{repo}/pulls/{n} when the table is collected, not taken from the event payload, because the payload cannot know the run has been overtaken. Residual window, stated rather than papered over: a push landing between that read and the comment being posted is not caught here — the run for that push refreshes the table.
baseline attestation	🟢 GREEN	baseline f421d1a7c5e6 matches the main attestation (run 34113627239 · main 4b11aca9b482 · 2026-09-07T10:51:48Z)	main attestation artifact via Actions API · in-process · runner	What every comparison is measured AGAINST, and who says so. The baseline fields of tests/fixtures/sprint_gate/corpus.json (queries, latency_baseline_ms, thresholds) are compared to the ratchet-attestation artifact of the latest successful push or (no-input) workflow_dispatch run of ratchet-attest.yml on main, fetched through the Actions API — a PR run cannot write to another run's artifacts. A field that differs is RED unless that main run measured the new value; today no runner-side collector measures any baseline field, so today the baseline cannot move by PR at all, and this row says so instead of a hand edit passing. Boundary: the comparator is this PR's checkout of ci_ratchet_table.py, diff-reviewable, not tamper-proof.
provenance	🟢 GREEN	stamped fe4d483022df == HEAD, tree clean	wheel stamp · in-process · runner	Sha half of #749 keg-mode provenance: a keg built from this wheel can answer __build_sha__. The helper-age and served-process predicates need a running BrainBar and are measured only by scripts/sprint_gate.py on an installed Mac. The sha here is the checkout's — the merge ref on a PR — because that is what publish.yml stamps at release time; the PR-head sha this table describes is the one in commit provenance above.
fallback replay debt	⚪ n/a	n/a — no fallback queue on this machine: the pending memories live in ~/Gits/*/docs.local/decisions, and docs.local/ is gitignored, so a runner checkout has no copy of them to count	docs.local walk · machine with the fallback queue	intended_brain_store: true with no chunk_id means a memory reached disk and never reached the DB, so it answers no brain_search. Budget: 0. Any pending or unparseable file is a finding, never a band -- 122 of these sat from 2026-06-28 to 2026-09-05 because nothing counted them where a reader would look. Measured by walking the tree, so it is only ever measured on a machine that HAS the tree.
mapped bytes	⚪ n/a	n/a — no BrainBar daemon at /tmp/brainbar.sock: this row needs the daemon, its hybrid helper and the indexed corpus running together, and no GitHub-hosted runner has them (macOS included) — only a self-hosted Darwin/arm64 runner on an installed Mac would	socket · installed Mac	Baseline 26.2 GB — installed Mac, socket, 2026-09-03, after R2 drained 15,070 → 0. Up from 16.8 GB because the drain left more vectors mapped under the same cap: the change is the drain, not a leak. Not measured by this run.
search p50/p95	⚪ n/a	n/a — no BrainBar daemon at /tmp/brainbar.sock: this row needs the daemon, its hybrid helper and the indexed corpus running together, and no GitHub-hosted runner has them (macOS included) — only a self-hosted Darwin/arm64 runner on an installed Mac would	socket · installed Mac	Margin p50: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Margin p95: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Calibrated on MacBook-Pro.local at 2026-09-01T08:42:22Z under active_sprint_load (tests/fixtures/sprint_gate/corpus.json). Not measured by this run.
idle CPU	⚪ n/a	n/a — no BrainBar daemon at /tmp/brainbar.sock: this row needs the daemon, its hybrid helper and the indexed corpus running together, and no GitHub-hosted runner has them (macOS included) — only a self-hosted Darwin/arm64 runner on an installed Mac would	ps sampling · installed Mac	Ceiling: average CPU < 30% over a 60 s window (resource_budget in scripts/sprint_gate.py), ratified and kept as a hard budget. Margin daemon: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Margin helper: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Margin watcher: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Needs the BrainBar daemon, helper and watcher actually running. Not measured by this run.
signature_valid	🟢 GREEN	442 valid / 0 invalid · brainlayer 1.5.17 · macos-15/ARM64 · brew install exited non-zero (outcome: failure); the keg installed and the sweep ran after it	codesign · brew keg · GitHub macOS runner	scripts/release-verify-signatures.sh <keg> codesign-verifies every *.so/*.dylib under libexec/venv. The macOS parity job installs the published tap formula (etanhey/layers/brainlayer), so this row measures the release path — formula, published sdist and Homebrew's relocation — and not this PR's tree. Release-time baseline for the same keg on a different machine: 442 valid / 0 invalid — installed Mac (M4 Max), brew --prefix brainlayer 1.5.11, 2026-09-03.

🟢 GREEN measured, within budget · 🔴 RED measured, out of budget — a finding to clear before merge · ⚪ n/a not measurable on this machine, never guessed.

No RED rows.

Measured on Linux/x86_64 · measured 1016072109a5 · PR head 1016072109a5 · checkout fe4d483022df · run · updated 2026-09-07 11:41:06 UTC