Return one token-capped request boundary for plan/read/edit/build/test/commit. It never captures prompt or thinking, never stores a user profile, and treats cwd, repository and manifest alone as unknown. Explicit mode wins; only a non-empty staged tree is an automatic code signal.

Fail-closed local actor/project check. Remote requests are denied as a tenant/auth coverage gap.

Read-only check of the opt-in staged-tree gate. No configured gate means no enforcement; a local hook is not a security boundary.

Register one bounded, tree-hash-bound result from an available manifest evidence tool. No raw code, prompt, transcript, database write or durable receipt is accepted.

Queue one client-neutral completed-edit event. Returns only bounded ephemeral WORKING impact; no prompt, summary, raw code, database write, or receipt.

Append one signed local acknowledgement for the current staged tree. The acknowledgement binds actor, base commit, staged/untracked digest and reason; edit it again and it becomes invalid. Reason must be non-secret.

After a verified commit, store one compact change receipt and compute the complete transitive chain of statically proven Python import consumers. Returns consumer layers only up to max_distance; deeper layers remain available for lazy loading. Import edges prove dependency, not runtime data flow. Non-Python changes are reported as uncovered and require a project-specific registered analyzer.

Idempotently adopt or initialize a Git project for Brainlehr. Creates a compact .brainlehr.json capsule from Git facts and declared entry points, plus one project knowledge root; it never copies raw source code. Existing project-scoped knowledge is adopted, not duplicated. Explicit tool references distinguish available commands from planned capabilities.

Idempotently attach a local Git project through project_ensure and record a revision-bound lifecycle witness. It never copies source or deletes project knowledge, receipts, capsule history, or files.

Detach only the active local project association. Knowledge, sources, receipts, capsule history and project files remain unchanged.

Load task context progressively and token-efficiently. First call depth=summary: it returns at most five project-scoped summaries, eight bounded Git code hits, relevant project tool references, and the mandatory next-choice contract. Use depth=relations or depth=full only with up to three node IDs selected from that same summary result. Never recursively loads a branch and never stores raw source automatically.

Setzt einen temporären technischen Sitzungscheckpoint ohne Freitext, Recall oder Modellaufruf.

Liest einen Checkpoint und gibt optional eine deterministische Chatwechsel-Empfehlung.

Recommend reuse, refresh-delta or a fresh agent from compact technical checkpoint state. It never stores or reads prompts, responses, hidden thinking or transcripts, and never spawns an agent.

Löscht den temporären Checkpoint einer beendeten Sitzung idempotent.

Redeem a one-time invitation PIN and receive your own credential. The PIN is issued by a human who is allowed to naturalise (ausweis.einladen); redeeming it is therefore the proof that a human handed it over. The secret is returned exactly once and is never logged. This is the only tool callable without a credential -- whoever is signing in does not have one yet.

Browse children of a knowledge tree node. Returns titles+summaries only (token-efficient). Use '/' for root.

Read full content of a knowledge node (by ID or path), plus title+summary of its direct children (one level, not recursive) -- a branch node's own content is usually empty, the substance lives in its children. Use browse/search first to find the right node.

Full-text search across knowledge. Returns summaries (not full content) for token efficiency. Searches Arbeitsbestand only by default; set nachschlagewerk=True to include reference material (germanquad/nasa-llis).

Add a new knowledge node to the tree. Specify parent_path to place it in the hierarchy. parent_path must already exist (or be '/'); an unknown parent_path is rejected with suggested nearby paths unless neuer_ast=True explicitly opens a new branch. source is required and rejected if empty -- e.g. "erzeugt aus /pfad/datei.md (Stand 2026-08-05T23:40:00+02:00)". norm_entscheidung is REQUIRED: 'keine_norm' (plain fact, no rank), 'norm_befristet' (norm with an end date) or 'norm_unbefristet' (norm without one). Omitting it, or combining it inconsistently with norm_rang/gilt_ab/gilt_bis, is rejected -- there is no default, because a silent default would recreate the exact ambiguity this field exists to remove (was a fact really decided to be non-normative, or did nobody look?). norm_rang/gilt_ab/gilt_bis stay optional inputs, but 'norm_befristet'/'norm_unbefristet' require norm_rang and gilt_ab to end up set (either given directly, or deterministically derived from source for directive/ADR imports -- ADR-034); 'norm_befristet' additionally requires gilt_bis, 'norm_unbefristet' requires gilt_bis stay unset. gilt_ab/gilt_bis must be ISO-8601 date or timestamp; gilt_bis before gilt_ab is rejected. Example -- raw material "Sozialtarif-Zuschlag entfaellt zum 01.03.2027 vollstaendig, loest die Uebergangsregelung von 2022 ab." -> {"parent_path": "/wissensnetz-pflegeverbund", "title": "Sozialtarif-Zuschlag entfaellt 01.03.2027", "summary": "Sozialtarif-Zuschlag entfaellt zum 01.03.2027, loest Regelung von 2022 ab.", "norm_rang": 2, "gilt_ab": "2027-03-01", "norm_entscheidung": "norm_unbefristet", "norm_entschieden_grund": "Uebergangsregelung 2022 laeuft aus, Nachfolgeregel greift direkt", "source": "erzeugt aus Rohmaterial (Beispiel)"}. norm_entschieden_grund is REQUIRED whenever norm_entscheidung is given (like grund on knowledge_zurueckziehen) -- a free-text reason for the decision. Who decided (norm_entschieden_von) is resolved automatically from your caller identity, not a separate input. When a rank-1/2 directive is the source, betreiber_weisung carries the exact quote and records the operator as decision-maker. anlass records what triggered this entry: 'selbst' (you wrote it unprompted) or 'betreiber' (an explicit human instruction, e.g. "merk dir das") are SELF-REPORTED -- only as reliable as the caller. 'hook' (the enforcing Stop-hook made you call this) and 'skript' (batch/migration/harvest run, no conversation) are objective in principle, but note the Stop-hook itself never calls this tool -- it only forces you to run /learn, which then calls this normally, so 'hook' is still self-reported by that skill, not verified by the server. Default 'unbekannt' if omitted. An unknown value is rejected with the allowed list, nothing is written. If up to 3 active nodes look content-similar (checked BEFORE writing), the response includes similar_node_hint -- a hint only, never auto-merged, no rejection either.

Update an existing knowledge node (title, summary, content, tags, and/or the Normschicht fields norm_rang/gilt_ab/gilt_bis/norm_entscheidung -- see knowledge_add for their meaning). Only given fields change; norm_entscheidung is optional here (unlike knowledge_add) and only needed when the change would otherwise contradict the node's existing decision (e.g. giving a norm_unbefristet norm a gilt_bis) -- if given, norm_entschieden_grund is then REQUIRED too. When a rank-1/2 directive is the source, betreiber_weisung carries the exact quote and records the operator as decision-maker.

Decide, for ONE entry, who may see it: 'offen' (may leave the house), 'intern' (default -- stays here) or 'gesperrt'. Works for a lesson or a node; the id decides which, and an id found in both tables is rejected as ambiguous rather than guessed. Takes exactly ONE id -- a comma-separated list or a wildcard is refused, not split up: every entry is decided individually or stays 'intern' (migrate_freigabe.py). Unlike a norm decision this is NOT binding -- the way back from 'offen' to 'intern' is explicitly allowed. Logged in access_log like any other decision.

Withdraw a node: clears content and summary (no backup -- the text is gone), keeps title and path, keeps the row (with grund/timestamp/actor) so nothing vanishes without a trace. The node then drops out of knowledge_search and the recall hook. Reversible via knowledge_freigeben (which restores visibility only, not the emptied text) -- unlike the permanent, human-only endgueltig_entfernen.py, which this tool cannot reach. grund is required; empty grund is rejected, nothing changed.

Undo a knowledge_zurueckziehen: the node reappears in knowledge_search/recall. Restores nothing -- content/summary stay empty as they were left by the withdrawal, this only flips visibility back.

Explain a broken audit-chain link (access_log.ketten_hash) caused by a sanctioned rewrite of an already-logged row -- e.g. a migration that corrected a field after the fact. Rejects with an error if access_log_id has no break (gespeichert==erwartet) or does not exist -- an explanation for a healthy row would itself be a fabrication. Never changes the stored ketten_hash; the break stays visible, this only records who/when/why next to it. Optional anker="rfc3161"/"gegenzeichnung" builds an external anchor for the explanation via ankerverfahren.py (dry by default, no network without an explicit anker_kwargs override) -- when set, the current anchor backlog (ankerverfahren.rueckstand) is reported back as anker_rueckstand, since that backlog only ever changes at this moment.

Create one explicit evidenced knowledge edge between existing node IDs/paths. Never infers links from tags or text; validates endpoints, scope, type, confidence, and duplicate edges.

List only explicit knowledge edges, optionally incident to one node and filtered by relation type/scope. This is the canonical link-read path.

Update evidence/provenance/weight/type of one explicit edge by relation ID; endpoints stay stable.

Remove exactly one explicit edge by relation ID. Nodes are never deleted.

Eine ANNAHME festhalten, solange sie noch als Annahme erkennbar ist -- nicht erst, wenn sie sich als falsch herausgestellt hat. Zwei Pflichtangaben, und sie sind der ganze Zweck: 'belegrang' (gemessen|fremdbericht|plausibel|geraten) sagt, WIE GUT der Beleg ist, 'kosten_wenn_falsch' sagt, WAS EIN IRRTUM KOSTET. belegrang='gemessen' ohne nicht leeren 'beleg' wird abgelehnt -- eine Messung ohne Protokoll ist keine. Der Eintrag beginnt immer auf status='offen'; bestaetigt/widerlegt geht nur ueber annahme_entscheiden.

Eine Annahme bestaetigen oder widerlegen. Beleg und Pruefer sind Pflicht -- ohne beides ist 'bestaetigt' nur eine Meinung mit Zeitstempel, und die Datenbank lehnt es ab. Den Pruefzeitpunkt setzt der Server, nicht der Aufrufer. Bei status='widerlegt' gehoert nach Moeglichkeit 'tatsaechliche_kosten' dazu: erst der Vergleich mit kosten_wenn_falsch zeigt, ob die Einschaetzung damals taugte.

Offene Annahmen auflisten, schlechtest belegt und aeltest zuerst -- das ist die Reihenfolge, in der sie schaden: was am laengsten unwidersprochen weitergetragen wurde, ist am tiefsten in spaeteren Entscheidungen verbaut.

Record a lesson learned. Pass same_as= when this is a repeat of an already-recorded lesson: increments that lesson's occurrences, appends this description to it as a dated, capped repetition note, and creates no new row (unknown same_as id is an error, never a silent new entry). Escalates to rule at 3+ occurrences. Without same_as: increments occurrences only on an exact duplicate (same type + byte-identical description); otherwise creates a new lesson and, if an active lesson of the same type looks similar, returns it as similar_lesson_hint (a hint only — never auto-merged; re-record with same_as to merge). anlass records what triggered this entry: 'selbst' (you wrote it unprompted) or 'betreiber' (an explicit human instruction, e.g. "merk dir das") are SELF-REPORTED -- only as reliable as the caller. 'hook' and 'skript' are objective in principle, but note the enforcing Stop-hook never calls this tool itself -- it only forces you to run /learn, which then calls this normally, so 'hook' is still self-reported by that skill, not verified by the server. Default 'unbekannt' if omitted; an unknown value is rejected with the allowed list, nothing is written (applies even on a duplicate/same_as bump, where the existing row's anlass is left untouched anyway). SET beinahefehler=true FOR A NEAR MISS: something you caught and corrected BEFORE it did damage -- a wrong number you almost reported as evidence, a command you almost ran on the wrong file, a claim you almost made without checking. Record it in the same flow, do not wait for the end of the session: this class is the cheapest to learn from and the one that goes unrecorded, because a correction in the same breath feels like a work step, not a mistake. It is counted, not judged -- what gets counted is the error class and what caught it, never who made it. bemerkt_woran is then MANDATORY (what caught it); without it nothing is written.

Correct or delete a recorded lesson. Only given fields are changed; unmangles field-tag corruption in the same way lesson_record does. Use delete:true to remove a bad entry.

Query lessons learned. Filter by type, project, or status. Optional 'query' searches description/root_cause/prevention by keyword and meaning (hybrid).

Read-only: list every knowledge node and lesson written by one session (actor/session columns, Auftrag 2026-08-06) -- the evaluation path for isolating one writer's entries, e.g. before a human decides whether to knowledge_zurueckziehen them. Never withdraws or deletes anything itself.

Read-only: list every knowledge node and lesson written by one model (actor/session/model columns, Auftrag 2026-08-06 Nachtrag) -- isolates one model's entries to judge its quality by outcome (how often later pulled/corrected/withdrawn). Never withdraws or deletes anything itself.

Overview statistics of the knowledge database (node counts, lesson counts, access patterns, anlass distribution). anlass_by fields split nodes_by_anlass/lessons_by_anlass into selbst/betreiber (self-reported, only as reliable as the caller) vs. hook/skript (objective) vs. unbekannt (default / entries older than the field) -- do not treat the four as equally trustworthy when reading this.

What brainlehr currently is -- every number measured at call time, never maintained: tables and triggers from sqlite_master, tools from this registry, dependencies from requirements.txt. Call this instead of relying on documentation or memory when asked what brainlehr is or can do. Added 2026-08-20 after a foreign client described brainlehr from memory: every principle right, every number wrong and all in the same direction -- a snapshot of an older, smaller system. Principles age slowly, numbers fast. What this does NOT say: whether the contents are correct. It counts what is there; whether an entry still holds is recorded on the entry itself (validity, rank, release).

Computed (never stored) earned-trust value in [0.05, 0.95], 0.5 = no signal yet -- distinct from norm_rang (explained by a human/consilium, decides which rule wins) and from confidence (a decay clock since last confirmation). Weighs deliberate reads (strongest, nodes only), recall-log session-deduplicated injections (weak, both kinds), independent re-occurrence (weak, lessons only), and rejected write attempts (weak negative, nodes only -- the equivalent path for lessons never fires, see docstring) through a saturating tanh -- diminishing returns prevent repetition alone from inflating the score. Returns the raw input counts and an 'exists' flag alongside the score so the number is never opaque and a typo isn't indistinguishable from the neutral default.

Waehlt off, light oder strong fuer eine Bewertung, Rangfolge oder Entscheidung.

Prueft evidenzbelegte Vergleichslaeufe auf Stabilitaet und Reihenfolgeeffekte.

Erststart-Assistent (BDW-P11). Ohne Argumente aufgerufen liefert er nur die LAGE und vier Fragen -- Profil (einzelplatz/unternehmen), Sprache des eigenen Materials, Erreichbarkeit des Einbettungsdienstes und welche Kataloge mitsollen -- und aendert nichts. Gegen einen LEEREN Bestand darf er mit Antworten sofort durchlaufen; auf einem GEWACHSENEN oder bereits eingerichteten Bestand aendert er ohne confirmed=true NICHTS und sagt das. Kataloge werden als Gattung 'nachschlagewerk' eingelesen und verduennen die eigene Trefferquote deshalb nicht.

Holt einen der von einrichtung_starten vorgeschlagenen Kataloge (bsi, nasa-llis, wcag) in ein lokales Verzeichnis -- Netzzugriff nur hier, nie ueber einrichtung_starten selbst. Bei quelle.art='keine' wird nichts geraten: das Ergebnis traegt geholt=false und den Grund.

Background cleanup agent (Hermes curator.py comparison) that ACTS, not just reports like knowledge_lint.py -- but only within the safe boundary: knowledge_zurueckziehen() (reversible visibility toggle), never endgueltig_entfernen.py (human-only, no MCP tool). Evaluates all knowledge_lint categories; 15 are report-only with a stated reason each (see _KURATOR_KATEGORIEN_OHNE_HANDLUNG), only injection_suspects at sicherheit='hart' acts, and only for kind='node' (lessons have no withdraw mechanism, only a real DELETE, so they are reported, never touched). Default is a dry run (scharf=False): nothing is written, every potential action is returned with ausgefuehrt=false. scharf=True is the explicit switch to actually withdraw matches, each with a stated grund in the audit row.