feat: DrAgnes dermatology AI + Common Crawl WET pipeline + brain enhancements

.gitignore

@@ -40,8 +40,9 @@ index.d.ts
 
 # Environment variables and secrets
 .env
-.env.local
-.env.*.local
+**/.env
+**/.env.local
+**/.env.*.local
 *.key
 *.pem
 credentials.json

CLAUDE.md

@@ -182,6 +182,62 @@ npx @claude-flow/cli@latest doctor --fix
 - CLI tools handle coordination via Bash: swarm init, memory, hooks, routing
 - NEVER use CLI tools as a substitute for Task tool agents
 
+## pi.ruv.io Brain Integration
+
+The shared brain at `pi.ruv.io` stores collective knowledge (1,500+ memories, 350K+ graph edges). Use it during development.
+
+### When to Use the Brain
+- **Before implementing**: Search for existing patterns — `brain_search("authentication pattern")`
+- **After implementing**: Share learnings — `brain_share({ category: "solution", title: "...", content: "..." })`
+- **When debugging**: Check if similar issues were solved — `brain_search("WASM panic fix")`
+
+### Brain MCP Tools (via pi-brain SSE)
+```
+brain_status  — check health (memories, edges, clusters)
+brain_search  — semantic search across shared knowledge
+brain_share   — contribute a learning (auto PII-stripped + witness chain)
+brain_list    — list recent memories by category
+brain_drift   — check knowledge drift
+brain_partition — get MinCut clusters (use compact=true, can be slow)
+```
+
+### Key Brain Rules
+- NEVER share raw API keys, credentials, or PHI to the brain
+- ALWAYS use category: `architecture | pattern | solution | convention | security | performance | tooling | debug`
+- ALWAYS include relevant tags (max 10, max 30 chars each)
+- Brain has differential privacy (ε=1.0) — embeddings are noised
+- If MCP tools return 404, the SSE session is stale — restart dev server
+
+### Brain REST API (when MCP is unavailable)
+```bash
+# Status (no auth)
+curl https://pi.ruv.io/v1/status
+
+# Search (needs auth header)
+curl -H "Authorization: Bearer $KEY" "https://pi.ruv.io/v1/memories/search?q=query&limit=5"
+
+# List
+curl -H "Authorization: Bearer $KEY" "https://pi.ruv.io/v1/memories/list?limit=10"
+```
+
+### Google Cloud Deployment
+- Service: `ruvbrain` in `us-central1` (session affinity enabled)
+- Secrets: `gcloud secrets versions access latest --secret=SECRET_NAME`
+- Available secrets: `ANTHROPIC_API_KEY`, `GOOGLE_AI_API_KEY`, `huggingface-token`, `OPENROUTER_API_KEY`
+- 7 Cloud Scheduler optimization jobs running (train, drift, transfer, graph, attractor, cleanup, full)
+
+## Project Structure Quick Reference
+
+| Directory | Contents |
+|-----------|----------|
+| `crates/` | Rust crates (ruvector-cnn, mcp-brain-server, sparsifier, mincut, solver, etc.) |
+| `npm/packages/` | NPM packages (@ruvector/cnn, rvf, pi-brain, etc.) |
+| `ui/ruvocal/` | RuVocal chat UI (SvelteKit) — do NOT add app-specific code here |
+| `examples/` | Standalone example apps (e.g., `examples/dragnes/`) |
+| `docs/adr/` | Architecture Decision Records (ADR-001 through ADR-118) |
+| `docs/research/` | Research documents (per-project subdirectories) |
+| `scripts/` | Utility and deployment scripts |
+
 ## Support
 
 - Documentation: https://github.com/ruvnet/claude-flow

crates/mcp-brain-server/cloud/deploy-all.sh

@@ -22,7 +22,13 @@ gcloud builds submit \
   --project="$PROJECT_ID" .
 
 # Step 2: Deploy to Cloud Run
+# IMPORTANT: Use --update-env-vars (NOT --set-env-vars) to preserve existing env vars
+# like FIRESTORE_URL, GEMINI_API_KEY, and feature flags that were set manually.
 echo "--- Step 2: Deploying to Cloud Run ---"
+
+# Fetch secrets from Google Secrets Manager
+GEMINI_KEY=$(gcloud secrets versions access latest --secret=GOOGLE_AI_API_KEY --project="$PROJECT_ID" 2>/dev/null || echo "")
+
 gcloud run deploy ruvbrain \
   --image="gcr.io/${PROJECT_ID}/ruvbrain:latest" \
   --region="$REGION" \
@@ -34,7 +40,31 @@ gcloud run deploy ruvbrain \
   --max-instances=10 \
   --timeout=300 \
   --concurrency=80 \
-  --set-env-vars="RUST_LOG=info,GWT_ENABLED=true,TEMPORAL_ENABLED=true,META_LEARNING_ENABLED=true,SONA_ENABLED=true" \
+  --session-affinity \
+  --update-env-vars="\
+RUST_LOG=info,\
+FIRESTORE_URL=https://firestore.googleapis.com/v1/projects/${PROJECT_ID}/databases/(default)/documents,\
+GEMINI_API_KEY=${GEMINI_KEY},\
+GEMINI_MODEL=gemini-2.5-flash,\
+GEMINI_GROUNDING=true,\
+GWT_ENABLED=true,\
+TEMPORAL_ENABLED=true,\
+META_LEARNING_ENABLED=true,\
+SONA_ENABLED=true,\
+MIDSTREAM_ATTRACTOR=true,\
+MIDSTREAM_SOLVER=true,\
+MIDSTREAM_STRANGE_LOOP=true,\
+MIDSTREAM_SCHEDULER=true,\
+COGNITIVE_HOPFIELD=true,\
+COGNITIVE_HDC=true,\
+COGNITIVE_DENTATE=true,\
+SPARSIFIER_ENABLED=true,\
+GRAPH_AUTO_REBUILD=true,\
+QUANTIZATION_ENABLED=true,\
+LORA_FEDERATION=true,\
+DOMAIN_EXPANSION=true,\
+RVF_PII_STRIP=true,\
+RVF_DP_ENABLED=true" \
   --allow-unauthenticated
 
 # Step 3: Setup Pub/Sub

crates/mcp-brain-server/src/optimizer.rs

@@ -42,7 +42,7 @@ impl Default for OptimizerConfig {
     fn default() -> Self {
         Self {
             api_base: "https://generativelanguage.googleapis.com/v1beta/models".to_string(),
-            model_id: "gemini-2.5-flash-preview-05-20".to_string(),
+            model_id: std::env::var("GEMINI_MODEL").unwrap_or_else(|_| "gemini-2.5-flash".to_string()),
             max_tokens: 2048,
             temperature: 0.3,
             interval_secs: 3600, // 1 hour
@@ -292,7 +292,11 @@ impl GeminiOptimizer {
         )
     }
 
-    /// Call Gemini API
+    /// Call Gemini API with Google Search grounding.
+    ///
+    /// When `GEMINI_GROUNDING=true` (default), enables Google Search grounding
+    /// so Gemini verifies its outputs against live web sources. Grounding metadata
+    /// (source URLs, confidence) is logged for auditability.
     async fn call_gemini(&self, api_key: &str, prompt: &str) -> Result<String, String> {
         let url = format!(
             "{}/{}:generateContent?key={}",
@@ -301,7 +305,10 @@ impl GeminiOptimizer {
             api_key
         );
 
-        let body = serde_json::json!({
+        let grounding_enabled = std::env::var("GEMINI_GROUNDING")
+            .unwrap_or_else(|_| "true".to_string()) == "true";
+
+        let mut body = serde_json::json!({
             "contents": [{
                 "role": "user",
                 "parts": [{"text": prompt}]
@@ -312,6 +319,13 @@ impl GeminiOptimizer {
             }
         });
 
+        // Add Google Search grounding tool
+        if grounding_enabled {
+            body["tools"] = serde_json::json!([{
+                "google_search": {}
+            }]);
+        }
+
         let response = self.http
             .post(&url)
             .header("content-type", "application/json")
@@ -329,6 +343,32 @@ impl GeminiOptimizer {
         let json: serde_json::Value = response.json().await
             .map_err(|e| format!("JSON parse error: {}", e))?;
 
+        // Log grounding metadata if present (source URLs, support scores)
+        if let Some(candidate) = json.get("candidates").and_then(|c| c.get(0)) {
+            if let Some(grounding) = candidate.get("groundingMetadata") {
+                let sources = grounding.get("groundingChunks")
+                    .and_then(|c| c.as_array())
+                    .map(|a| a.len())
+                    .unwrap_or(0);
+                let support = grounding.get("groundingSupports")
+                    .and_then(|s| s.as_array())
+                    .map(|a| a.len())
+                    .unwrap_or(0);
+                let query = grounding.get("webSearchQueries")
+                    .and_then(|q| q.as_array())
+                    .and_then(|a| a.first())
+                    .and_then(|q| q.as_str())
+                    .unwrap_or("none");
+                tracing::info!(
+                    sources = sources,
+                    supports = support,
+                    query = query,
+                    "[optimizer] Grounding: {} sources, {} supports, query='{}'",
+                    sources, support, query
+                );
+            }
+        }
+
         // Extract text from response
         json.get("candidates")
             .and_then(|c| c.get(0))

crates/mcp-brain-server/src/types.rs

@@ -1262,6 +1262,7 @@ impl Default for PipelineState {
 /// Request to inject a single item into the pipeline.
 #[derive(Debug, Deserialize)]
 pub struct InjectRequest {
+    #[serde(default)]
     pub source: String,
     pub title: String,
     pub content: String,