chore: rebump to v0.33.2.1

Per user direction: ship as v0.33.2.1 instead of v0.33.3.1.
0.33.2.x is unclaimed in the queue (PR #934 holds 0.33.3.0).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to GBrain will be documented in this file.
 
+## [0.33.2.1] - 2026-05-14
+
+**Doc-only: name the fork-PR escape hatch so AI-authored PRs don't drop their CI secrets.**
+
+PRs from `garrytan-agents` (the AI-authored PR account) live in a fork. GitHub's `pull_request` event doesn't ship base-repo secrets to forks by default, so any CI job that needs `ANTHROPIC_API_KEY` or `OPENAI_API_KEY` quietly fails with empty-env auth errors regardless of what's set on the base repo. CLAUDE.md now documents the move-branch-to-base-repo workflow as the narrow-scope alternative to adding the account as a collaborator (which would broaden secret distribution to every PR from that account) or flipping the repo-wide fork-secret toggle (which would broaden it to every fork PR).
+
+### Itemized changes
+
+- `CLAUDE.md` gets a new `## Checking out PRs from garrytan-agents` section between "Community PR wave process" and "Skill routing". Four-step recipe: `gh pr checkout <N>` → `git push origin HEAD:<branch>` → `gh pr close <N>` → `gh pr create --base master --head <branch>`, preserving the original title and body verbatim. Closes the friction Garry hit landing #962 / Voyage 2048-dim fixup PRs from the agent account.
+- `llms-full.txt` regenerated by `bun run build:llms` so the committed doc bundle matches the live CLAUDE.md. Pinned by `test/build-llms.test.ts` in CI shard 1.
+
 ## [0.33.1.1] - 2026-05-13
 
 **Voyage 2048-dim brains finally produce 2048-dim vectors. Fail-loud on every Voyage misconfiguration.**

CLAUDE.md

@@ -1520,6 +1520,36 @@ Never merge external PRs directly into master. Instead, use the "fix wave" workf
 - Never auto-merge PRs that remove YC references or "neutralize" the founder perspective.
 - Preserve contributor attribution in commit messages.
 
+## Checking out PRs from garrytan-agents
+
+`garrytan-agents` is the AI-authored PR account and is NOT a collaborator on
+this repo. Its PRs live in a fork, so GitHub Actions triggered by
+`pull_request` events on those PRs do not receive base-repo secrets. Any CI
+job that needs `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, or similar will fail
+with empty-env auth errors, regardless of what's set on the base repo. This
+is a GitHub security default, not a config bug.
+
+When the user says "check out <PR link>" and the PR is from `garrytan-agents`
+(or any other non-collaborator fork), move the branch into the base repo
+before running CI:
+
+1. `gh pr checkout <N>` — pull down the fork's branch. Note the PR number and
+   head branch name (`gh pr view <N> --json headRefName --jq .headRefName`).
+2. `git push origin HEAD:<branch-name>` — push the same branch to the base
+   repo (origin points at `garrytan/gbrain`, not the fork). This is the move
+   that gives CI access to secrets.
+3. `gh pr close <N> --comment "moving to base-repo branch for secret access"`
+   — close the fork PR so the queue stays clean.
+4. `gh pr create --base master --head <branch-name>` — open the replacement
+   PR from the base-repo branch. **Preserve the original PR's title and body
+   verbatim** (`gh pr view <N> --json title,body`); contributor attribution
+   moves to a `Co-Authored-By:` trailer if needed.
+
+Why this over alternatives: adding `garrytan-agents` as a collaborator, or
+flipping the repo-wide "send secrets to fork PRs" toggle, both broaden
+secret distribution to every fork PR from that account or any fork. Moving
+the branch keeps secret scope tight to just the one PR being shipped.
+
 ## Skill routing
 
 When the user's request matches an available skill, ALWAYS invoke it using the Skill

VERSION

@@ -1 +1 @@
-0.33.1.1
+0.33.2.1

llms-full.txt

@@ -1628,6 +1628,36 @@ Never merge external PRs directly into master. Instead, use the "fix wave" workf
 - Never auto-merge PRs that remove YC references or "neutralize" the founder perspective.
 - Preserve contributor attribution in commit messages.
 
+## Checking out PRs from garrytan-agents
+
+`garrytan-agents` is the AI-authored PR account and is NOT a collaborator on
+this repo. Its PRs live in a fork, so GitHub Actions triggered by
+`pull_request` events on those PRs do not receive base-repo secrets. Any CI
+job that needs `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, or similar will fail
+with empty-env auth errors, regardless of what's set on the base repo. This
+is a GitHub security default, not a config bug.
+
+When the user says "check out <PR link>" and the PR is from `garrytan-agents`
+(or any other non-collaborator fork), move the branch into the base repo
+before running CI:
+
+1. `gh pr checkout <N>` — pull down the fork's branch. Note the PR number and
+   head branch name (`gh pr view <N> --json headRefName --jq .headRefName`).
+2. `git push origin HEAD:<branch-name>` — push the same branch to the base
+   repo (origin points at `garrytan/gbrain`, not the fork). This is the move
+   that gives CI access to secrets.
+3. `gh pr close <N> --comment "moving to base-repo branch for secret access"`
+   — close the fork PR so the queue stays clean.
+4. `gh pr create --base master --head <branch-name>` — open the replacement
+   PR from the base-repo branch. **Preserve the original PR's title and body
+   verbatim** (`gh pr view <N> --json title,body`); contributor attribution
+   moves to a `Co-Authored-By:` trailer if needed.
+
+Why this over alternatives: adding `garrytan-agents` as a collaborator, or
+flipping the repo-wide "send secrets to fork PRs" toggle, both broaden
+secret distribution to every fork PR from that account or any fork. Moving
+the branch keeps secret scope tight to just the one PR being shipped.
+
 ## Skill routing
 
 When the user's request matches an available skill, ALWAYS invoke it using the Skill

package.json

@@ -1,6 +1,6 @@
 {
   "name": "gbrain",
-  "version": "0.33.1.1",
+  "version": "0.33.2.1",
   "description": "Postgres-native personal knowledge brain with hybrid RAG search",
   "type": "module",
   "main": "src/core/index.ts",