What this ships

gbrain enrich --thin develops stub (thin) people/company pages at scale by consolidating what the brain already knows about an entity into one cited page — no web lookups. gbrain's own model tooling only sees brain-internal context (search / get_page / facts / backlinks), so enrich does brain-internal grounded synthesis: deterministically retrieve everything scattered about an entity (meetings, other pages, deals, facts, raw notes), then one grounded gateway.chat call per page writes a real dossier with [Source: slug] citations. When the brain knows too little, it skips instead of fabricating. Web research stays the agent-driven enrich SKILL's job.

gbrain enrich --thin --dry-run --json                       # preview + cost estimate, no spend
gbrain enrich --thin --limit 3 --max-usd 0.50 --model anthropic:claude-haiku-4-5

Resumable (--resume), budget-capped (--max-usd; best-effort under --workers>1, pin --workers 1 for a hard ceiling), source-scoped (--source), backgroundable (--background). Enriched pages stamp enriched_at/enriched_by so a recency guard skips them next run. Opt-in autopilot phase enrich_thin (default OFF) trickles a few pages/source/cycle with per-source + brain-wide cost/walltime caps.

Commits (whole branch vs master)

• feat(engine) — listEnrichCandidates source-aware candidate selection (pg + pglite parity): thin-filter + per-page source-correct inbound count + enriched_at recency guard + whitelisted ORDER BY + LIMIT, lightweight projection (no bodies).
• feat(enrich) — gbrain enrich --thin core: runEnrichCore/enrichOne, retrieve→ground→synthesize→put_page write-through, op-checkpoint resume, BudgetTracker cap, per-page advisory lock, CLI + thin-client refuse + Minion handler. Includes the codex-review fixes (below).
• feat(cycle) — opt-in enrich_thin autopilot phase with enforced per-source cost cap.
• merge origin/master (0.42.2.0) — resolved 4 conflicts; cycle phase count is now 22 (both enrich_thin and skillopt landed; both sides had independently claimed 21).
• chore — VERSION/CHANGELOG/CLAUDE.md/llms → 0.42.6.0.

Codex review (implementation) — FAIL→addressed

A fresh /codex review of the implementation (the prior codex pass was plan-stage only) found 4 P1 + 2 P2, all verified against the code. Folded in:

• P1 injection escape — sanitizeContext neutralizes the <context>…</context> data-envelope delimiters so an untrusted retrieved note can't close the envelope and inject instructions (mirrors the existing </trajectory> convention).
• P1 background idempotency — multi-source --background key now carries the run fingerprint (backgroundIdempotencyKey); a re-run with different --model/--limit/--force enqueues new work instead of returning a stale completed job.
• P1 budget honesty — budget_exhausted is flagged post-hoc when tracker.totalSpent > cap even if the gateway swallowed the final-call throw (new read-only BudgetTracker.cap getter; no gateway.ts change).
• P2 checkpoint flush — body() flushes the checkpoint on BudgetExhausted before it propagates, so resume doesn't re-charge completed pages.
• P2 per-source cap — cycle phase enforces min(per-source, brain-wide remaining) instead of leaving the per-source cap parsed-but-ignored.
• Accepted (D5): in-flight gateway.chat isn't cancelled on budget abort (documented best-effort overshoot ~1 call/worker; a true fix needs a shared runSlidingPool API change). Code comment added.

Verification

• bun run typecheck clean; bun run verify 29/29.
• Full unit suite green except 7 pre-existing env-coupled tests (assert keyless-fallback behavior; all 4 files pass 34/34 in a clean keyless env = CI-equivalent; none touch the enrich diff).
• enrich e2e enrich-pglite 15/15 × 3 runs (the prior flaky budget test now carries the repo-standard 30s timeout); listEnrichCandidates pg↔pglite parity confirmed on real Postgres.

Reviews: ENG cleared (plan), CODEX FAIL absorbed (5 fixes + 1 accepted). All fixtures use placeholder names.

🤖 Generated with Claude Code