Add project attention contract + assess_attention (schema v20)

[spaceshipmike]

Implements docs/setlist-project-attention-brief.md — Setlist becomes the canonical source for project priority and expected attention, computing an attention-nourishment signal separate from registry health.

Data model & migration

• Schema v20: five nullable columns on projects — priority_tier (critical/important/normal/someday), attention_mode (active/maintenance/waiting/paused), attention_cadence_days (positive int), next_review_at (ISO), priority_reason. Added via ensureColumns (structural no-op migration step); existing projects migrate with an unconfigured contract and surface as not_configured, never a false warning. Validation (enums, positive integer, ISO timestamp) lives at the write boundary in Registry.updateCore.

Attention formula (deterministic, tested)

attention debt = days since meaningful touch ÷ cadence × priority weight

weights critical 2.0 / important 1.5 / normal 1.0 / someday 0.5; due_soon above a 0.75 ratio, undernourished past 1.0. Cadence decides overdue; priority decides ordering.

Meaningful touch (conservative, source-visible): git commit in a registered path, substantive retained memory (decision/outcome/correction/learning/pattern — not observation), or material registry update (updated_at). The interactions log is deliberately not a source; passive reads, health checks, briefs, and exports never count. Attention-contract writes do not bump updated_at (see MODEL_DECISIONS D-016) so configuring a neglected project can't mask its neglect.

Intentional quiet: waiting/paused → suppressed while next_review_at is future (or unset), → due_for_review once it arrives. Archived/inactive projects excluded from portfolio results.

Changed contracts

• MCP: new assess_attention (name → single assessment; no name → portfolio ordered by debt) — 63 tools; update_project accepts the five contract fields (null clears); portfolio_brief gains a bounded attention section (≤5 undernourished/due-soon, ≤5 due-for-review, gap names, per-state summary).
• Core library: AttentionAssessor, contract on ProjectRecord/get_project/ProjectBrief.project.attention; capability introspection updated.
• Offline export: setlist-project-context.v2 — snapshot carries contract + assessment agreeing with live results at export time; manifest entries carry attention_state/attention_debt/priority_tier; INDEX.md leads with an "Attention concerns" section. Manifest-last atomic write order preserved. Existing launchd schedule unchanged (no new daemon).
• Desktop: contract editable in the project edit form (unset selects/empty inputs clear to NULL).
• assess_health untouched — existing consumers keep current semantics.

How Hermes reads/writes

Read: assess_attention (live), portfolio_brief.attention (session start), or the v2 export when offline. Write back natural-language corrections via update_project (e.g. "pause until September" → attention_mode: waiting, next_review_at). No scheduling/notification logic lives in Setlist.

Acceptance scenarios

All 11 brief scenarios covered in packages/core/tests/attention.test.ts, context-export.test.ts (export agreement), and cross-query.test.ts (bounded brief section).

Validation

• npm test — 57 files, 1062 passed
• npm run typecheck — clean (main/preload/renderer)
• npm run build — clean
• npm run verify:mcp-abi — OK

🤖 Generated with Claude Code

https://claude.ai/code/session_01Rcn8wbbJG5NELgFEskFdhi

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Found six blocking correctness/security issues and one contract-documentation issue. Runtime validation was environment-limited: the sandbox prevented build output, and dependencies/Vitest were unavailable.

Findings (7)

• [P1] packages/core/src/context-export.ts:137 — Project names are interpolated directly into output paths. Registry registration and rename accept names containing / or .., so a project such as ../../Areas/reference/foo makes an export overwrite .json/.md files outside the managed directory. Encode names into safe basenames or verify every resolved destination remains under projects/.
• [P2] packages/core/src/registry.ts:828 — Core identity fields are committed at line 818 before the new attention fields are validated. A combined update such as {description: 'new', attention_cadence_days: 0} throws an error but leaves the description changed, so callers receive a failed-save response after a partial write. Validate first and execute the complete update transactionally.
• [P2] packages/cli/src/index.ts:496 — The new value-taking flags use positional getFlag, contrary to the trusted CLI surface contract. For example, context install --dir --yes treats --yes as the directory and also as confirmation, creating an export and installing a job for the wrong path; --interval 60junk is accepted by parseInt. Use the strict shared parser and reject missing, flag-shaped, duplicate, and partially numeric values.
• [P2] packages/core/src/context-export.ts:324 — The offline portfolio index selects attention concerns without requiring status === 'active'. Because exports assess every project individually and AttentionAssessor suppresses only archived, configured idea, draft, paused, or complete projects can appear as undernourished/due concerns even though live portfolio attention excludes inactive projects. This can produce false offline alerts.
• [P2] packages/cli/src/index.ts:469 — The normal setlist update CLI wrapper was not extended for any of the new attention-contract fields. Core, MCP, and the app can configure canonical priority, but CLI users cannot, violating the trusted core-to-every-wrapper ripple contract and the feature brief's CLI update-surface requirement.
• [P2] packages/core/src/registry.ts:860 — new Date(value) checks only JavaScript parseability, not the promised ISO-8601 contract. It accepts locale-dependent strings such as July 13, 2026, numeric strings such as 0, and normalizes impossible dates such as 2026-02-30 to March 2. Those values can silently resurface waiting projects at the wrong time; validate an explicit ISO date/timestamp grammar and calendar validity.
• [P3] INVARIANTS.md:33 — The authoritative schema invariant still states SCHEMA_VERSION = 19 and describes v19 as current, while this PR bumps the implementation to v20. Update the invariant register with the v20 columns and migration meaning so future migration work is not guided by stale ground truth.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Three blocking correctness issues remain. The review was source-based; typecheck could not run because the read-only workspace prevented TypeScript from writing build artifacts.

Findings (3)

• [P2] packages/core/src/registry.ts:63 — The timestamp validator accepts values JavaScript cannot parse, including leap-second timestamps such as 2026-09-01T09:30:60Z and invalid offsets such as +24:00 or +02:60. AttentionAssessor then receives NaN when comparing the review date, so a waiting/paused project remains suppressed forever instead of becoming due for review. Validate offset ranges and reject any accepted value whose normalized timestamp is not finite.
• [P2] packages/core/src/registry.ts:895 — The new transaction commits core and attention fields before validating or applying area and parent_project, which are handled afterward. The desktop form submits these together, so an invalid area, nonexistent parent, or parent cycle returns a save error after priority/cadence and other edits have already persisted. The user is told the save failed while the project was silently partially modified. Prevalidate and commit every field in the combined update atomically.
• [P2] packages/core/src/context-export.ts:169 — projectContextBasename does not guarantee unique output names. For example, unsafe project foo/bar maps to foo-bar-cc5d46bd, which can also be a valid literal project name; names differing only by case also collide on the default case-insensitive macOS filesystem. The exporter then overwrites one project's files and writes a manifest whose two entries point to the same matching-generation snapshot, so readers cannot detect the corruption. Use a collision-proof mapping for every name or detect duplicate resolved basenames before writing.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Four blocking correctness issues remain. The new attention feature is broadly wired, but payload bounds, CLI discovery, calendar-date handling, and scheduler replacement safety are broken. Tests could not be rerun because this checkout lacks dependencies and network access was unavailable.

Findings (4)

• [P2] packages/core/src/cross-query.ts:403 — portfolio_brief returns every unconfigured project instead of applying PORTFOLIO_BRIEF_ATTENTION_LIMIT. Existing projects all migrate unconfigured, so this likely-largest list is unbounded, contradicting the required payload-safe contract and the MCP description promising at most five entries per attention list.
• [P2] packages/cli/src/commands.ts:94 — The authoritative update command definition still describes only the old identity fields and omits all five attention flags from its usage. Both top-level CLI help and self-registered capability inputs derive from this entry, making the new CLI attention-update surface undiscoverable and breaking cross-surface introspection.
• [P2] packages/core/src/attention.ts:267 — Bare dates emitted by the desktop <input type="date"> are parsed as UTC midnight. In America/New_York, selecting 2026-09-01 therefore changes to due_for_review at 8 PM on August 31. Date-only contracts need an explicit local-calendar interpretation or must require a timezone-bearing timestamp.
• [P2] packages/cli/src/context-export-schedule.ts:102 — Schedule replacement writes the new plist and unloads the existing job before attempting launchctl bootstrap, but a bootstrap failure performs no rollback. This can leave a previously working export schedule stopped, with the replacement plist installed and the backup path never returned or reported; restore and reload the prior plist on failure.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

The attention model is internally coherent, but the default export path breaks the end-to-end offline fallback contract. Focused runtime tests could not run because this isolated worktree has no dependencies; the dependency-free CLI introspection tests passed.

Findings (2)

• [P2] packages/core/src/context-export.ts:24 — The default export directory is ~/.local/share/project-registry/project-context, but the canonical context hub says every harness must use ~/Areas/reference/System/project-context/ when live Setlist is unavailable. Both no-argument export and the launchd schedule therefore refresh a directory that downstream assistants do not read, leaving the documented fallback absent or stale unless the operator always supplies a special --dir. Make the canonical fallback directory the default and align the documentation and tests.
• [P3] packages/cli/src/index.ts:539 — The command advertises and accepts --json for setlist context, but only the export branch honors it. status, install, and uninstall silently emit human prose even when --json is supplied, so automation following the introspected usage receives output it cannot parse. Either return structured JSON for those branches or reject the flag and narrow the advertised usage.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Four blocking correctness and safety issues remain. Diff hygiene passed, but runtime tests and typechecks could not be rerun because this review worktree has no installed dependencies.

Findings (4)

• [P2] packages/core/src/attention.ts:309 — The overdue calculation floors elapsed time to whole days before dividing by cadence. A one-day project touched 47 hours ago is still classified as nourished because 47 hours becomes 1 day and the ratio remains 1; every cadence can therefore miss a genuinely overdue project for almost 24 hours.
• [P2] packages/mcp/src/server.ts:324 — update_project is not atomic when attention/core fields are combined with paths. updateCore commits first, then setProjectPaths validates and writes separately; an invalid path such as "relative/path" makes the tool return an error after the priority, mode, or description has already been saved.
• [P2] packages/cli/src/context-export-schedule.ts:152 — Uninstall treats every launchctl bootout failure as “already unloaded,” then removes the plist and reports success. A permission or launchd failure can therefore leave the job running while status reports not_installed because the plist is gone, so scheduled writes continue without a managed file to retry against.
• [P2] packages/core/src/context-export.ts:140 — The export containment check is only lexical and does not reject or resolve symlinks. If the managed projects directory is replaced with a symlink, mkdirSync and atomicWrite follow it, while assertWithinDirectory still sees an apparently in-directory path; an export can consequently overwrite JSON/Markdown files outside the selected target.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Two blocking correctness issues remain. Automated tests could not run because dependencies are absent and the review workspace is read-only.

Findings (2)

• [P2] packages/core/src/attention.ts:350 — The assessor treats every projects.updated_at change as a meaningful touch, but writers bump this timestamp even when nothing actually changes. For example, an attention-contract update that echoes the existing status, an identical paths replacement, or an ignored producer-owned field write resets updated_at and makes a neglected project appear nourished. Only genuine persisted changes should advance the meaningful-touch signal.
• [P2] packages/cli/src/context-export-schedule.ts:152 — Uninstall catches every launchctl bootout failure as if the job were already unloaded, then deletes the plist and reports uninstalled. If bootout fails for a real operational or permission error, the loaded job remains active and continues exporting until logout or reboot despite the reported success. Distinguish the expected not-loaded case or verify the service is gone before removing the plist.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Two blocking correctness defects can hide neglected projects or publish internally inconsistent offline context. The authoritative surface map also omits the new export and scheduler contracts.

Findings (3)

• [P2] packages/core/src/fields.ts:52 — SQLite reports an upsert as changed even when the owning producer writes the exact same value. Registry.updateFields therefore bumps projects.updated_at, which the attention assessor treats as meaningful activity. Periodic reconciliation can make an untouched project appear nourished for another full cadence. Only count writes whose serialized value actually changes.
• [P2] packages/core/src/context-export.ts:125 — Each project brief and its attention assessment are read separately, without a shared database snapshot. A concurrent app, CLI, or MCP update between those reads can produce one exported file whose brief and attention result describe different project states—for example, an active contract paired with a paused assessment. Building files before writing them does not make the source reads consistent; the generation must derive its database state from one transaction or immutable snapshot.
• [P3] SURFACES.md:10 — The authoritative ripple map was not updated for the new persistent project-context export format or launchd scheduler. It therefore does not record that project-brief and attention changes must remain synchronized with exported JSON/Markdown, the manifest, CLI scheduling, and installation behavior, making future cross-surface regressions likely.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

The attention model is broadly wired across all required surfaces, but a no-op enrichment call can falsely mark a neglected project as recently nourished.

Findings (1)

• [P2] packages/core/src/registry.ts:1535 — enrichProject unconditionally rewrites the profile columns and sets updated_at = datetime('now'), even when no fields were supplied or unioning the supplied values produces exactly the existing profile. Because assess_attention treats projects.updated_at as a meaningful touch, a valid MCP call such as enrich_project({name}), or periodic reconciliation of unchanged enrichment data, makes an undernourished project appear nourished. Compare the merged values before updating and only advance updated_at when stored profile data genuinely changes.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

One blocking correctness issue remains in the central attention signal. Static review covered all 38 changed files and authoritative contracts; test execution was unavailable because this isolated checkout lacks dependencies.

Findings (1)

• [P2] packages/core/src/attention.ts:356 — Every projects.updated_at value is treated as a meaningful touch, but existing public writers still advance it for semantic no-ops. For example, setProjectArea and setParentProject update the timestamp when reapplying the current value, setProjectPaths does so for an identical replacement, and enrichProject does so when unioning only existing values. An idempotent reconciliation through any of these surfaces therefore makes a neglected project appear newly nourished, violating D-016’s “material registry update” rule and the PR’s explicit no-op-write contract. Either make all timestamp-writing paths change-aware or record meaningful activity separately.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Three blocking correctness gaps remain in the new attention contract. Focused tests could not run because dependencies are absent and network access failed; git diff validation passed.

Findings (3)

• [P2] packages/core/src/registry.ts:125 — The five new attention fields are structured project columns, but RESERVED_FIELD_NAMES still contains only paths. Consequently, write_fields({priority_tier: "critical"}) reports success while writing an inert project_fields row; assess_attention continues reading projects.priority_tier and returns not_configured. Doctor also uses this set, so it will not detect the dead-letter value. Reserve all five attention field names and direct callers to update_project.
• [P2] packages/core/src/registry.ts:1748 — batchUpdate unconditionally advances updated_at for every matched project, even when every requested value is already stored. For example, batch_update(status_filter="active", status="active") makes every active project appear freshly touched and can turn genuinely undernourished projects into nourished ones. Compare each row before updating and only advance updated_at for material changes.
• [P2] packages/core/src/registry.ts:1246 — setProjectType likewise advances updated_at when reapplying the project's existing project_type_id. Because updated_at is now a meaningful-attention signal, an idempotent reconciliation falsely nourishes the project. Skip the update and timestamp bump when the type is unchanged.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Three blocking correctness problems remain in Git activity detection and the offline export's atomicity guarantees. git diff --check passed, but automated tests could not run because this read-only checkout has no installed dependencies.

Findings (3)

• [P2] packages/core/src/context-export.ts:364 — The Markdown project files and portfolio index omit generation_id. If a new export replaces these files and crashes before replacing manifest.json, readers see human-readable data from the unfinished generation under the old manifest and cannot perform the documented generation check. Add the generation ID to every Markdown/index artifact and require it to match the manifest.
• [P2] packages/core/src/context-export.ts:170 — Concurrent exports can interleave because there is no lock or generation-directory swap. For example, export B can replace all project files and commit manifest B, after which the slower export A commits manifest A; the final manifest then references generation A while the files belong to B, even though both commands reported success. Serialize writers or build each generation in an isolated directory and atomically switch a single pointer.
• [P2] packages/core/src/attention.ts:384 — Git activity is missed for registered folders nested inside a repository or monorepo. latestCommitInPath requires <registered path>/.git, although git -C <path> works from any descendant of a repository. Such projects can therefore be falsely reported as undernourished despite recent commits. Discover the containing worktree with Git and query the latest commit affecting the registered folder, rather than requiring .git directly inside it.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Two P2 correctness issues remain: the export mutex can admit concurrent writers, and attention assessment misses recognized legacy project-memory aliases. Automated tests could not run because dependencies are absent (vitest: command not found); git diff --check passed.

Findings (2)

• [P2] packages/core/src/context-export.ts:226 — Stale-lock takeover is not atomic, and releasing a lock does not verify ownership. If two exporters observe the same stale lock, both can pass lstat; one can remove and reacquire it, after which the other removes that new lock and also proceeds. A legitimate export lasting over ten minutes has the same problem, and its eventual release can delete a successor's lock. This reopens the concurrent-write path the mutex was added to prevent, allowing project files and manifest.json from different generations to be interleaved. Stale takeover must have one atomic winner, and release must remove only the caller's uniquely identified lock.
• [P2] packages/core/src/attention.ts:367 — The memory touch query matches only the project's current canonical name. The standing memory model deliberately preserves pre-validation rows stored under case variants or display-name identifiers and resolves those aliases on reads; known legacy rows have this shape. A recent substantive memory under such a recognized legacy identifier is therefore ignored here, producing an incorrect last-touch timestamp and potentially a false undernourished result. Resolve memory project identifiers through the canonical project resolver—with its ambiguity rules—or reuse the established alias-union read behavior.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Two blocking correctness issues remain: attention assessments can borrow memories from a different case-variant project, and schema v20 omits constraints explicitly required by the standing model decisions. Focused tests could not run because dependencies are absent and downloading them while executing untrusted PR tests was denied.

Findings (2)

• [P2] packages/core/src/attention.ts:377 — The alias-safety check fails when two projects differ only by case. With projects casey and CASEY, each lower/upper probe finds an exact match to one spelling, so both assessments add LOWER(project_id) = LOWER(?). The subsequent MAX query therefore considers both projects' memories, allowing a recent decision for one project to make the other appear nourished. This contradicts the stated isolation guarantee and can suppress a genuine attention warning.
• [P2] packages/core/src/db.ts:815 — The v19→v20 migration is treated as a structural no-op, but trusted MODEL_DECISIONS.md lines 663–665 explicitly require the next schema-version bump to add revived to memory_versions.change_type and a UNIQUE (source_id, target_id, relationship_type) key to memory_edges. Stamping databases as v20 without either migration leaves revival events mislabeled and the known cross-process duplicate-edge race unenforced, directly violating the standing schema decision.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Two blocking contract defects remain: revival history is mislabeled, and offline exports can falsely report stale digests as fresh. The test suite could not be rerun because dependencies are unavailable in this read-only environment; diff whitespace validation passed.

Findings (3)

• [P2] packages/core/src/memory.ts:192 — Re-retaining an archived memory still writes change_type = 'updated'. This PR adds revived to the v20 schema and public MemoryChangeType, but the actual revival producer never uses it, so history consumers still cannot distinguish a revival from an ordinary edit. Write revived here and add an end-to-end assertion to the existing revive test.
• [P2] packages/core/src/context-export.ts:381 — The export copies brief.digest.stale, which loadProjectDigest() computes from the optional project_fields.spec_version and defaults to false when that field is absent. Normal CLI digest refreshes only write project_digests, so a subsequent source change can still be exported as digest_stale: false. This contradicts D-011's honest-read contract and can mislead offline agents into trusting obsolete context. Reuse the registered-path-based staleness computation used by getProjectDigest, preserving null when freshness is unknowable.
• [P3] packages/core/src/context-export.ts:114 — The export lock is acquired before the export root is checked for being a symlink at line 169. Consequently, a symlinked --dir is followed and mutated before the operation refuses it; it can create an out-of-tree lock or rename and recursively delete a stale same-named lock in the symlink target. Check the root before assertManagedDirectory() and acquireExportLock(), and cover a symlinked root—not only a symlinked projects/ directory.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Two blocking correctness issues can produce false attention and digest signals. The migration also preserves an arbitrary duplicate rather than the documented earliest one.

Findings (3)

• [P2] packages/core/src/attention.ts:394 — Meaningful-memory activity is ordered by created_at, but re-retaining an existing or archived substantive memory updates only its updated_at. A decision revived or reinforced today therefore still looks as old as its original creation and can leave the project falsely undernourished. Use the retention/update timestamp or record a dedicated retention event.
• [P2] packages/core/src/context-export.ts:393 — The snapshot embeds the ProjectBrief unchanged even though its nested brief.digest.stale uses the older, unreliable calculation that defaults to false when no project_fields spec_version exists. The same generated JSON can therefore report top-level digest_stale as true/null while brief.digest.stale says false, allowing an offline reader to trust an obsolete digest. Normalize or replace the nested value with the honest getProjectDigest result.
• [P3] packages/core/src/db.ts:1311 — The v19→v20 deduplication keeps MIN(id), but memory-edge IDs are random UUIDs and do not sort by creation time. The migration therefore retains an arbitrary duplicate—not the documented earliest row—and can discard the earlier row's timestamp or relationship metadata. Select by created_at with a deterministic tiebreaker, or merge the duplicate metadata before deletion.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

The new context-export work is substantial, but one contract regression remains: unknown digest freshness is exposed as fresh/current in the main human-facing surfaces. I also found one non-blocking mismatch between the migration invariant and the implemented deduplication rule. Automated tests could not run because this read-only checkout has no installed Vitest dependencies.

Findings (2)

• [P2] packages/core/src/project-brief.ts:16 — This changes digest freshness to the required tri-state, but downstream surfaces were not updated. packages/cli/src/index.ts:149 maps null to fresh; packages/app/src/renderer/components/tabs/OverviewTab.tsx:194 maps it to current and does not show a warning; and packages/app/src/renderer/lib/api.ts:408 plus packages/core/src/models.ts:245 still declare the value as a plain boolean. Whenever freshness cannot be determined—for example, when the project path is missing—the CLI and desktop therefore claim the digest is current. This reverses the honest-read behavior required by D-011. Preserve null through the public types and display it as unknown or unverified.
• [P3] INVARIANTS.md:33 — The migration invariant still says duplicate memory edges are resolved by keeping MIN(id), but the changed migration keeps the earliest created_at row with id only as a tie-breaker at packages/core/src/db.ts:1312. The implemented rule may be correct, but the authoritative contract now disagrees with database behavior and could cause a later verifier or migration to restore the wrong rule.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Two blocking correctness issues remain in digest freshness reporting and launchd schedule removal.

Findings (2)

• [P2] packages/core/src/registry.ts:2905 — Project briefs pass the stored project_fields.spec_version as a caller override, bypassing the new path-based tri-state freshness check. A pathless project can therefore report stale: false, and a changed filesystem can still appear fresh when that stored field matches the digest. This contradicts ProjectBriefDigest’s null-when-unverifiable contract and makes context exports disagree with getProjectDigest().
• [P2] packages/cli/src/context-export-schedule.ts:147 — Uninstall returns not_installed immediately when the plist file is absent without checking launchd. A bootstrapped LaunchAgent remains loaded if its plist is manually deleted, so this path falsely reports success while the exporter continues running; contextExportScheduleStatus() has the same blind spot. Query and boot out the service label even when the plist is missing.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

Two blocking gaps can silently provide incomplete or misleading attention data. Automated tests and type-checking could not run because this checkout lacks the required vitest and TypeScript dependencies.

Findings (2)

• [P2] packages/core/src/attention.ts:267 — Waiting, paused, and unconfigured projects return before latestMeaningfulTouch is called, so their last_meaningful_touch and days_since_meaningful_touch are always null even when commits, retained memories, or project updates exist. This violates the new assessment contract, and the offline export consequently reports “none recorded” for real activity. Compute the latest touch before these state-specific branches and include it in their results.
• [P2] packages/core/src/registry.ts:314 — The new reserved-name protection is enforced only by updateFields. The public register and registerExistingWorkspace paths pass opts.fields directly to writeFields, so fields such as priority_tier or attention_mode are accepted as inert extended fields while assess_attention still reports the project as not configured. Apply the reserved-field validation to every writeFields entry point, or add structured attention options to registration.

[spaceshipmike]

🤖 Codex review — REQUEST_CHANGES

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

A failed registration can leave a partially created project in the registry. Independent tests could not run because this checkout has no installed Vitest dependency.

Findings (1)

• [P2] packages/core/src/registry.ts:337 — Reserved-field validation happens after the project and its paths have already been inserted using autocommit statements. Registering with fields such as attention_mode or paths therefore throws but leaves the project behind; retrying then fails as a duplicate. Validate opts.fields before any writes or make the complete registration sequence transactional.

[spaceshipmike]

🤖 Codex review — APPROVE

Local Codex review (gpt-5.5) of this PR's changes against origin/main.

No blocking correctness, security, migration, or invariant violations found. The implementation is consistent across the main runtime surfaces, and git diff --check passes. The full test suite could not be rerun because this isolated checkout lacks Vitest dependencies. One non-blocking desktop type-contract omission remains.

Findings (1)

• [P3] packages/app/src/renderer/lib/api.ts:372 — The renderer's ProjectBrief.project type was not updated with the required attention object added to the core ProjectBrief. The runtime returns the field, but desktop consumers cannot access brief.project.attention without contradicting their declared API type. Add the required AttentionContract field so the renderer wrapper mirrors the core projection.