[renezander030]

Release 0.8.0: retire wrong facts precisely, keep the review queue readable whatever a fact contains, and make the MCP server's read-only contract explicit.

Added

• kg retire GROUP --edge UUID [--edge UUID] --reason "..." files one reviewable item that retires the named facts. Once approved, kg-workspace drain --apply marks exactly those edges invalid as of --valid-at (or the drain time), with no replacement fact and no model call. If one named edge is not found in the group, nothing is retired and the item stays approved. The edge list is part of the approved digest.
• kg duplicates --facts reports current facts repeated between the same two entities, oldest copy first, so the extra copies can be retired.
• Every MCP tool is annotated read-only, non-destructive, idempotent and closed-world, so clients can run them without asking.
• search_nodes, search_memory_facts and get_episodes report the groups they searched, so an empty result can be told apart from a wrong scope.

Changed

• An MCP tool call with an argument the tool does not declare is refused, naming the argument and the accepted ones. It used to be ignored, so a misspelled group_id read the default groups.
• With reranker.provider: openai and no reranker.model, the reranker uses gpt-4.1-mini. graphiti-core's default, gpt-4.1-nano, is retired on 2026-10-23.
• kg doctor checks the workspace named by KG_WORKSPACE_DIR when it is set, the same directory the queue and ledgers use.

Fixed

• A fact containing U+2028, U+2029 or U+0085 no longer makes the review queue unreadable. Such a proposal used to break every later propose, pending, approve and drain, and the same characters in an ingest ledger entry hid it from resume.
• kg-workspace list, rejected, approve and reject report an unreadable queue as a JSON error with exit 1 instead of a traceback.

Verification

• uv run ruff check .: pass.
• uv run pytest: 196 passed (23 new). The tests for the line-separator fix, the kg-workspace errors, the MCP annotations, unknown-argument refusal and scope report, the reranker default and the doctor workspace fail on main and pass here.
• release_audit.py --allow-remote --identity-base origin/main: pass.
• Container MCP smoke (docker build + scripts/mcp_smoke.py): pass, get_status answers ok.
• End to end on a real Ladybug file through the installed CLIs and an MCP stdio session: a proposal with U+2028 leaves the queue readable; kg duplicates --facts finds a repeated fact; kg retire → kg-workspace approve → drain --apply retires the extra copy with no model call; kg edge shows its invalid_at; kg ask --keyword suppresses it; the six tools are read-only; a misspelled group_id is refused by name; get_episodes reports its groups. 8/8.
• --help for every entry point and subcommand and all six MCP tool schemas are unchanged except for the additions above.
• Not run: a model-backed drain of a new fact (no model server); the retire path needs no model.

Reviewing

• Base: main at a98f7b6. Version 0.8.0 in pyproject.toml, server.json and uv.lock; the Unreleased CHANGELOG section becomes 0.8.0.
• Read by module: workspace.py (retire_facts, the shared filing helpers, _planned, the retire branch of drain), ingest.py (retire_edges, the ledger reader), server.py (StrictFastMCP, READ_ONLY, the groups field), then cli.py, duplicates.py, runtime.py, doctor.py.
• Untouched: ingestion and extraction, retrieval and ranking, export/restore, the per-group Ladybug layout, the bearer-token scope.
• No other PR is open.