[0.30.0] — 2026-08-01

Changed

• The default door is now the dynamic facade, and estate memory is on by default. With
  nothing configured, tools/list serves six resident tools at ~1,449 tokens —
  proximo_find_tools / proximo_tool_schema / proximo_call / proximo_recall plus the
  audit pair — with everything the box serves still searchable and callable through them.
  The measured reason: the previous default served the full plane catalog (~97k tokens on a
  single-PVE box, ~277k unscoped), 12x over the 8,192-token default context of a stock
  ollama install — dead on connect for a local model, and a silent tax on every other
  client that does not defer schemas. Rollbacks, by name: PROXIMO_TOOLSETS=catalog
  restores the pre-0.30 default (full schemas, auto-scoped to configured planes),
  PROXIMO_TOOLSETS=all the full surface, and PROXIMO_MEMORY=0 opts out of the estate
  map (removing proximo_recall from the facade rather than leaving a call that could only
  fail). The map stays local, derived and rebuildable, beside the audit ledger the install
  already keeps; scoping remains context hygiene, not an authorization control — the token
  ACL is still the boundary. CLI verbs (badge, mint, arm, disarm, reap, hello)
  no longer run registry scoping at all, so their errors are not prefixed with scoping
  noise.

Added

• Search now finds the right tool with NOTHING configured — a vocabulary tier and lexical
  vectors, in the wheel. Keyword search needs the operator's words to appear in a tool's
  text; "how much space is left for backups" shares no surface form with "storage usage —
  disk used and available", so it matched nothing. Two mechanisms, pure stdlib, no
  dependency, no model, no network, no download:
  lexical.VOCABULARY maps operator language onto Proxmox's own terms (memory→mem/ram,
  container→lxc/ct/guest, who/changed→audit/ledger) as curated, auditable data — one
  readable line per mapping, and it is now the single source keyword search draws its
  synonyms from, so the two can never drift. Behind that, hashed char-n-gram TF-IDF vectors
  rank whatever keyword left unanswered, marked "match": "lexical".

  Measured on the real 905-tool catalog: the first search builds the index (259 ms,
  cached per catalog for the process), every search after it is ~7 ms, and the probes
  that used to miss now land (who changed this vm's config → audit_verify,
  space left for backups → the backup tools). Off-domain queries return nothing:
  admission requires a real word in common — a character-n-gram score alone once offered
  pve_node_disk_wipe ("MUTATION: wipe ALL data… NO UNDO") for "recipe for banana bread",
  because "recipe" and "wipe" share the fragment "ipe". Default-on because a search that
  needs configuration to work defeats the purpose; PROXIMO_LEXICAL=off disables the
  lexical tier.

  The two vocabularies are deliberately separate. VOCABULARY (wide, concept-level)
  serves ranking only; KEYWORD_VOCABULARY (narrow, near-exact renames) serves the keyword
  tier. Sharing one table was tried and reverted the same day after measurement: with the
  wide table feeding keyword AND-matching, "show" matched 824 of 905 tools and
  "check cluster health" 187, because concept jumps (health→status) land on words nearly
  every description carries — the OR-blowup lean mode exists to prevent. A blast-radius
  test against the tracked manifest now holds that line.

  Search is now a stack, each tier filling only what the one above left empty and marking
  its rows: keyword (exact) → semantic (opt-in, PROXIMO_EMBED_URL) → lexical
  (in-wheel). An unreachable embedder now degrades to lexical rather than all the way back
  to bare keyword.

• Opt-in vector search over the estate sqlite — PROXIMO_EMBED_URL. Point it at an
  OpenAI-compatible /v1/embeddings server you run (ollama, llama.cpp and vLLM all serve one)
  and two seams gain semantic recall, zero new dependencies (struct-packed float32 in sqlite,
  pure-python dot product): proximo_find_tools keeps its exact-keyword hits FIRST and
  unchanged, and vector matches only fill remaining room, each marked "match": "semantic";