chore: closure-tracker quick wins (R3-P-06 + insights filter DSL + v0.8.0)

[HugoSkylight]

Summary

Three small bundled fixes from the closure-tracker tail. All single-file, low-risk.

Changes

1. fix(insights): filter DSL repair — cross-tenant leak

src/opencortex/insights/collector.py:49-55 used the wrong filter shape: conditions/op="=" instead of the canonical conds/op="must". The Qdrant adapter's filter translator silently treated the whole expression as a no-op, so traces_for_period() returned ALL traces in the collection regardless of tenant/user. Every insights generation path read cross-tenant data.

Fixed to match SessionRecordsRepository._build_session_filter reference shape:

{"op": "and", "conds": [
    {"op": "must", "field": "tenant_id", "conds": [tenant_id]},
    {"op": "must", "field": "user_id", "conds": [user_id]},
]}

This bug was tracked in memory notes for a while but never landed. Severity: cross-tenant data leak.

2. perf(orchestrator): R3-P-06 stale-filter short-circuit

_sync_anchor_projection_records paid 2 stale-filter scans on every defer_derive initial leaf write — both prefixes were guaranteed to be empty (the leaf is brand new) but we scanned anyway. Added a guard:

if not all_new_records and not abstract_json:
    return

The not abstract_json clause keeps the cleanup path on legitimate update flows where abstract_json is present but happens to contribute no anchors/fact_points.

Closes closure tracker R3-P-06.

3. chore: bump version 0.7.0 → 0.8.0

pyproject.toml + src/opencortex/__init__.py both updated. The cone retrieval commit was labeled v0.8.0 in memory notes but neither version file got bumped. After PRs #7-#11 (server-side patterns + adapter helper + perf cluster + correctness fixes + cleanup bundle), a minor bump is warranted.

Verification

Suite	Result
tests.test_context_manager	✅
tests.test_benchmark_ingest_lifecycle / test_benchmark_ingest_service / test_benchmark_ingest_response_model / test_session_records_repository	✅
tests.test_locomo_bench / test_beam_bench / test_conversation_mapping / test_conversation_merge	✅
tests.test_http_server / test_e2e_phase1 / test_write_dedup	✅

Total: 277 tests, only pre-existing test_update_regenerates_fact_points_after_content_change failure remains.

Closure tracker

After this PR + PR #11 (medium tier cleanup) + PR #10 (R3-RC-02/R2-14):

• Highest leverage tier: ✅ done (PR refactor(context): server-side design patterns — Service + Repository + DTO (plan 005) #7 + refactor(benchmarks): extract shared conversation_mapping helper (§25 Phase 7) #8)
• Medium tier: ✅ all 7 items closed
• What remains: long-term residuals (architectural ADRs needed) + cosmetic P3 polish

Test plan

• uv run python3 -m unittest discover -s tests — all green except known pre-existing failure
• Spot-check __version__ import: python -c "import opencortex; print(opencortex.__version__)" returns 0.8.0
• If insights subsystem is used: trigger an insights generation and verify only the expected tenant's traces appear

🤖 Generated with Claude Code