feat: Post-write verification gate for brain files (brain_verify)

[adolfousier]

Problem

Brain file safety rules (in AGENTS.md, SOUL.md, etc.) can be accidentally removed during trims, and contradictory rules can be introduced without detection. The existing brain_verify.sh + brain_verify.toml at ~/.opencrabs/safety/ work but are optional — the agent chooses whether to run them. Behavioral enforcement (rules in brain files saying "verify before claiming") has been violated multiple times.

Solution

Wire verification mechanically into write_opencrabs_file.rs — the Rust tool that writes all brain files. After every successful write to a protected brain file, the new content is checked against brain_verify.toml rules. If required rules are missing or contradictions are detected, the write is rolled back from the .bak backup.

The model cannot hallucinate past a Result::Err.

Changes

New file: src/brain/tools/brain_verify.rs

• Loads ~/.opencrabs/safety/brain_verify.toml (OnceLock cache, same pattern as bash.rs)
• Parses [[required]] (file + pattern + why) and [[contradictions]] (pattern_a + pattern_b + message)
• Pattern matching: ordered-part matching on .* separators, case-insensitive. No regex crate needed.
• verify_brain_file(file_name, content) -> VerifyResult — returns violations
• verify_all_brain_files(brain_dir) -> VerifyResult — batch verification
• 8 unit tests covering: simple substring, ordered parts, case-insensitive, (?i) prefix, missing patterns, wildcards

Modified: src/brain/tools/write_opencrabs_file.rs

• Added verify_or_rollback() helper: runs verification, restores backup on failure
• All three write paths (overwrite, append, replace) now verify after write
• Only runs on protected brain files (SOUL.md, AGENTS.md, etc.)
• Backup path captured from backup_before_write() for rollback

Modified: src/brain/tools/mod.rs

• Added pub mod brain_verify;

Safety

• Zero impact on non-protected files (commands.toml, memory logs, etc.)
• TOML parse errors log warning and skip verification (never blocks on missing config)
• Rollback uses the existing .bak backup created before every write
• No new dependencies (uses toml already in Cargo.toml, dirs already available)

Ownership Rules (from Adolfo)

• Plan mode is Alexey's contribution — changes need issue filed and review
• Source code changes must be on a separate branch, tested before merge
• Only owners can execute slash commands
• Never change source code without owner review and approval

Branch

feat/brain-verify-gate — isolated from main.

Testing

cargo test brain_verify
cargo clippy --all-features

All existing write_opencrabs_file tests should still pass since the verification only adds a post-write check, does not change write behavior.

[adolfousier]

Feature implemented and merged. The feat/brain-verify-gate branch (d06b6836, 10d39848, 7ba99e3a) was merged into main. The contradiction detection bug (#855) was fixed in 7247c7ca by scoping pattern matching per-entry instead of whole-file. brain_verify.rs is now live with TOML-driven post-write verification, hot reload, and per-entry contradiction scoping. 5,713 tests passing.