v1.2.1

Fixed

• A grain carrying a subject without a relation or object reached no
  index at all (#23). Structural indexing required all three positions, so
  an Event about a message id or a person was invisible to
  recall(ns, subject, …) — a silent empty result on a filter every surface
  accepts. The same root cause was the serious one: forget_subject and
  subject_report select through those indexes, so the identity's own grain
  survived erasure and went undisclosed in a DSAR, while the erasure
  reported success. Such grains now get a subject-anchored row (relation and
  object NULL, because the grain asserts neither — which also keeps the row
  inert to every relation-bound query). Never written to heads/
  entity_latest: a log entry about a subject has no "current value". Existing
  files are healed on open by a link_index stamp bump; the rebuild replays
  the rows and reconstructs cur from supersession state, so a reindex neither
  duplicates a grain nor resurrects a superseded one. Pinned on both backends
  (subject_without_relation_is_indexed).
• DEFINE QUERY stored bodies that could never RUN (#24). Define-time
  validation skipped parsing entirely whenever the body contained $ — the
  shape most saved queries have — and fell back to a keyword blocklist, so any
  syntax error was stored and first surfaced when a caller ran it, typically an
  unattended agent long after the author had moved on. The body is now parsed
  at DEFINE. Bodies whose parameters sit in positions demanding a literal
  (RECENT $limit) are still accepted: the check re-parses with the parameters
  standing in, so only a body malformed however it is bound is refused
  (CAL-E059). The read-only and destructive guards are unchanged.
• A Skill's instructions could not be reached through any rendered path
  (#25). The field that is the skill was absent from the grain type's
  queryable fields (PROJECT name, instructions → CAL-E060) and no format
  emitted it, leaving raw JSON recall — which defeats budgeted assembly — as
  the only way to read it. instructions and when_to_use are now projectable
  and render at full disclosure.

Added

• WITH progressive_disclosure(summary|headlines|full) now executes
  (#25). It was documented in docs/cal-reference.md but parsed and discarded,
  warning CAL-W004. It is the body axis, orthogonal to metadata: summary
  and headlines clip free-text bodies (40/80 chars, the same ladder budgeted
  template renders already use), and full leaves them whole and adds the
  long-form definition bodies no other tier carries — a Skill's when_to_use
  and instructions, so they reach a budgeted ASSEMBLE instead of being
  injected around it. Omitting the option renders exactly as before, byte for
  byte.
• The CAS blob store reaches the CLI and both bindings (#27):
  areev blob put <FILE>|--stdin prints the cas:// URI (idempotent by
  construction), areev blob get <cas-uri> writes hash-verified bytes to
  stdout, and put_blob/get_blob ship in Python and Node — bytes in, bytes
  out, the one documented exception to the scalars-in/JSON-out convention.
  blob get deliberately does not open the memory: the embedded backend's
  file lock is exclusive, so while a run holds a memory even a reader is
  refused, which put an attachment out of reach of the very --tool-cmd
  subprocess the run spawned to process it. Reading the sidecar needs no lock
  and answers no consistency question — a blob is immutable and its address is
  its checksum, re-verified on read. Encrypted memories still open, since
  decryption needs the derived key. No MCP tool, deliberately: blob bytes would
  have to be base64'd into a tool result and land whole in the model's context.
• Evalset-backed outcome metrics (#29). A recommendation may carry
  metric = "evalset:<EVALSET_HASH>:<field>", resolved by areev loop outcomes
  from the summaries areev eval run journals — passed, failed, total
  and error_rate work against any evalset, and any other field is read from
  the summary the harness wrote. This moves the honesty boundary legitimately
  rather than breaking it: an evalset run is itself an internal, bounded,
  attributable measurement. Two safeguards are load-bearing. A run journaled
  before the apply is never evidence (no run since → not yet measurable,
  and the checkpoint stays due; scoring the baseline against itself would
  report held forever, a fabricated receipt). And MetricSnapshot.higher_is_better
  states the direction, because the built-in metrics are recurrence counts
  where lower is better while an accuracy is the opposite — read the wrong way,
  the Verify gate would propose reverting the rules that worked. The regression
  comparison now lives in one function both the engine and outcome_review
  call. The apply gate (--gating-run) and the outcome edge read those
  summaries through one shared reader, so a rule cannot be admitted on one
  reading of an evalset and judged on another.

v1.2.0 — Namespace prefix scoping

Added

• Namespace prefix scoping ("org.*") — one convention on every read
  surface (CAL WHERE namespace / namespace IN (…), the MCP namespace
  argument, areev recall --ns, ASSEMBLE sources, both bindings): a
  namespace value ending in * selects the base namespace plus its
  descendants through the separator you wrote ("org.*" = org,
  org.sales, org.sales.emea — never organization, never org:x).
  Malformed patterns (org*, bare *, mid-string *) refuse with
  VAL-E001 instead of silently matching nothing. Backed by a
  count-maintained namespace registry (ns_reg, self-healed on open for
  older files) and a namespace-set recall path through all three hybrid
  legs; the single-exact-namespace hot path is untouched. Scopes widen
  reads only: * is now reserved in namespace names (writes refuse it;
  replication of pre-existing files still imports), and destruction,
  grants, policy, and point reads keep taking exact namespaces. Under a
  bound principal a prefix expansion fails closed — every covered
  namespace must be granted, and the refusal names the pattern, never a
  discovered namespace.

Fixed

• WHERE namespace IN (…) now queries every member of the set (union,
  deduped, newest-first across the set); previously only the first member
  was consulted and the rest were silently dropped (#19). A
  namespace_override-pinned session now also clears caller-supplied IN
  sets, closing the corresponding pin-escape.

v1.1.0 — Anonymization: prompt-safe pseudonymization

Added

• Anonymization: prompt-safe pseudonymization (areev anonymize,
  cookbook recipe 16). Declare one anon:<ns> policy — a file-truth that
  replicates write-if-absent and fails reads closed when unreadable — and
  every model-facing read (recall/search/CAL/MCP/graph reads) returns typed
  placeholders ([PERSON_1]) instead of identities:
  • Detection is layered: built-in Tier-0 (structural known-identity
    propagation, regex + Luhn/mod-97 validators, secrets, keyword cues,
    dictionaries), a pluggable NER command seam (--anonymize-cmd), and a
    grounded LLM detector (--anonymize-llm-cmd) — a policy demanding an
    uninstalled detector fails closed. Actions: pseudonym, mask,
    redact, generalize:month|year|decade, allow.
  • The round trip: mappings stay in process custody
    (anon_mappings(), rehydrate_text(); payloads carry an anonymized
    report with mapping ids only). PseudonymizingBackend wraps any
    LlmBackend so extraction requests leave pseudonymized and responses
    return rehydrated.
  • Ingress mode + memory scope (encrypted memories): value-derived
    tokens transform before the content address commits; FORGET SUBJECT/REPORT SUBJECT recompute the stored pseudonym from the real
    identity, so pseudonymized-at-rest never means erasure-proof.
  • The sealed vault (vault: rows under an HKDF subkey of the page
    key; never replicated; erased with the subject; TTL-swept): tokens
    continue across processes, and areev anonymize reveal /
    reveal_tokens() is admin-gated and Tier-2 audited by fingerprint.
  • Surfaces: CLI verb family + --anonymize-egress host floor, Python and
    Node methods in lockstep, the console's Anonymization card + per-grain
    "Model view" (GET /api/anon/preview, POST /api/anon/config),
    /api/config observability, conformance cases on both backends
    (Postgres: egress/audit work; value-derived features refuse loudly —
    no page cipher there).
  • Explicit text APIs ship too: scan_text / anonymize_text /
    rehydrate_text and the store-free areev anonymize scan.
  • Honest scope, by design: this is pseudonymization of the egress
    channel, not anonymity — see docs/security-model.md and
    ARCHITECTURE.md §10 for the threat model and named decision.
• min_reader_version stamping on anonymization policies so older
  builds warn loudly at open; anon: joins the replicable meta prefixes,
  vault: is reserved and never replicates.

Changed

• One rendering stack. Per-grain
  rendering now has a single implementation — areev_cal::render — shared
  by CAL's FORMAT arms and areev-context, with byte parity pinned by a
  cross-surface golden. Output changes that follow:
  • FORMAT sml emits semantic per-type elements
    (<fact confidence="0.95" date="2026-01-13">john prefers window seat</fact>) instead of generic <grain type=…> field dumps; event
    elements carry the speaker as role="…".
  • FORMAT markdown gains dedicated arms for state / workflow / reasoning /
    consensus / consent / recommendation grains (topology and labels instead
    of a raw field-pair dump); fact/event/tool lines are byte-identical to
    before.
  • recall --render (markdown/json/toon/plain) converges on the CAL
    shapes: markdown carries the documented - bullet and the
    confidence-below-1.0 rule, json is the {hash, grain_type, fields}
    envelope, toon rows come from the registry columns.
  • FORMAT toon's state rows read the OMS §8.3 context key (previously
    context_data, which never matched — rows always fell back to
    state,state).
  • One chars/4 token estimator (render::estimate_tokens) serves
    ASSEMBLE … BUDGET and the areev-context allocators, so a budget means
    the same thing on every path.
• Progressive disclosure is real. The context allocators emit
  Full→Summary→Omit (70%/95% thresholds); budgeted FORMAT TEMPLATE renders
  pick their disclosure tier from tokens-per-grain, so ELEMENT_SUMMARY
  fires under pressure and ELEMENT_OMIT accounts for dropped grains —
  behavior the reference already promised. JSON and TOON stay whole-entry
  (a prose summary inside a structured dump would corrupt it).
• The registry replicates. Bundles/segments carry saved queries,
  templates and retention policies in a v2 MGB2 meta segment (emitted only
  when the file has registry rows — registry-free bundles stay MGB1 and
  readable by older builds; older builds refuse an MGB2 bundle loudly).
  Import merges latest-wins on updated_at; last_run_at never replicates
  and survives locally; retention rows apply only when locally absent; a
  point-in-time restore skips the segment. New conformance cases cover both
  backends; ImportStats gains meta_applied/meta_skipped.

Removed

• The six whole-result builtin templates (triples, progressive,
  llm_system_prompt, llm_chat, weekly_standup, toon) — unused, and
  toon/triples shadowed the same-named FORMAT arms with different
  output. Builtins are now exactly the three §10.1 sectioned presets
  (structured/readable/compact), and a builtin can never take a
  FORMAT arm name. FORMAT TEMPLATE toon now returns TemplateNotFound
  — use FORMAT toon.
• The never-wired CalExecutorConfig::max_cal_queries/max_cal_templates
  caps (no host set them, and their Some(-1) = unlimited convention was
  implemented backwards). The registry-level limits (100 queries/namespace,
  50 templates, body-size caps) remain the enforcement.
• Dead areev-context dependency declarations in areev-py, areev-js,
  and areev-server.

Docs

• Saved queries and templates are now discoverable where agents look:
  the cal-for-llms.md grammar card gains a SAVED block, the MCP reference
  documents the DESCRIBE QUERIES → RUN pattern under areev_cal, and
  cookbook recipe 15 walks the ship-assembly-logic-in-the-file pattern
  (the Hermes provider's override). llms.txt's MCP tool count corrected
  (14 → 23); docs/facts/context-assembly.md re-verified.

Areev 1.0.2

Fixed

• verify on canceled runs, at every cancel phase. Replay fed
  CancelSeen at a superstep's open whenever the coming checkpoint
  carried the cancel — a phase the live driver only produces when the
  marker predates the run, so a cancel landing during the first
  superstep (before any checkpoint) failed verify on slow machines.
  Replay now places the cancel by the journal's own evidence: with the
  wave's resolutions when the closing checkpoint shows they ran, or by
  rewinding the boundary and feeding it first when the journal shows
  the live driver canceled before dispatching. A new phase-sweep test
  exercises every placement on every machine.
• Windows --tool-cmd quoting. The 1.0.1 cmd /C fix still routed
  the command through Command::arg, whose MSVC quoting cmd.exe does
  not parse; the command string now goes through raw_arg.
• RUSTSEC-2025-0134. Replaced the unmaintained rustls-pemfile
  with rustls-pki-types' PEM support (already in the tree via
  rustls); the tls feature's surface is unchanged.

Areev 1.0.1

Fixed

• areev run wave determinism. The driver fed effect completions to
  the pure scheduler in racy arrival batches, each with its own clock
  reading — scheduler state depended on thread timing (an unjournaled
  decision), so two identical runs could checkpoint differently and
  areev run verify could diverge from a live run under load. The driver
  now drains every dispatch wave fully and feeds one close reading plus
  all resolutions in dispatch order — exactly the cadence verify
  replays. Journal-answered replays join the same wave rather than
  resolving early.
• Windows --tool-cmd. /bin/sh was hardcoded in the host tool
  executor and the eval seam; both now use the platform shell
  (cmd /C on Windows).
• areev-run-core purity gate. Dropped the workspace's only chrono
  use (a created_at fallback in canonical serialization, now
  std::time), so the CI gate that keeps clock/rand/IO out of the pure
  scheduler's dependency tree actually passes.

Areev 1.0.0

The first release under the Areev name — the complete engine formerly
published as DejaDB 1.2.0, plus the governed-agents program (the areev run
runtime, agent-grade capture, the ecosystem adapters, and the enterprise
plane), renamed on every surface.

The memory engine

• Immutable, content-addressed grains in the .mg format — 12 grain
  types, canonical serialization (NFC, sorted keys, omit-defaults), SHA-256
  content addressing. Every edit is a supersession, every removal a
  tombstone or crypto-erasure; nothing ever rewrites a stored blob.
• One memory = one isolation unit — a single file on the embedded Turso
  backend, a schema on the PostgreSQL backend (feature = "postgres",
  advisory-locked writers, pgvector) — the unit of erasure, sync,
  portability, and write parallelism. Files are self-describing: saved
  queries, templates, and index declarations travel with the file.
• Hybrid recall in microseconds — dictionary-encoded triples, an owned
  BM25 inverted index, optional vector recall via a pluggable embedder
  (--embed-cmd), graph/time reads (related, entity-at,
  step-actions), heads/forks with explicit merges, bundles, encrypted
  incremental sync, and CAS blob storage (encrypted under an HKDF-derived
  subkey when the memory is).
• CAL — the Context Assembly Language — lexer/parser/executor,
  ASSEMBLE with facade mounts for cross-memory queries, and budget-aware
  SML/TOON/Markdown/JSON rendering for model-ready context.

Governance

• Authorization in the file (CAL 1.3): grants ride as mg:permits
  Facts; destruction (FORGET <hash>, FORGET SUBJECT, PURGE OLDER THAN) is authorization-gated with mandatory BECAUSE and a Tier-2 audit
  Observation on every execution; REPORT SUBJECT shares one selector with
  erasure so a DSAR discloses exactly what an erasure removes.
• GDPR compliance pack — docs/gdpr.md article→
  capability map, DSAR subject-report on every surface, audit export,
  declarative retention:<ns> policies, and erasure that names its
  subject by fingerprint, never by identity.

Areev Loop — governed self-improvement

• Substrate-agnostic engine: 13 deterministic analyzers, four gates, a
  recommendation lifecycle with pinned evalsets, the DISCOVER→GROUND→VERIFY
  LLM verifier, outcome measurement across horizons, and out-of-box LLM
  backends (OpenAI-compatible / Anthropic / Ollama). Trajectory capture,
  analyze_only replay against the immutable past, and areev corpus
  export with erasure-aware provenance.

areev run — the governed runtime

• A pure sans-IO scheduler (areev-run-core: step(env, state, events) → (commands, state), frozen condition grammar, plan validation, RUN-Ennn
  errors, no clock/rand/IO in its dependency tree — CI-enforced) under a
  journaling driver (areev-run): intent-before-effect journal grains,
  checkpoints, crash-safe resume with same-key redelivery, HITL respond
  with separation of duties, budgets, cancel, and journal-consistent
  verify.

Surfaces

• areev — the CLI (~29 verbs), including migrate importers from
  other memory systems, hub (the areevd sync daemon), ui (the embedded
  web console: memory browser, interactive graph, loop review queue, runs
  tab), and hook claude-code session capture.
• MCP — 23 tools over newline-delimited JSON-RPC 2.0 on stdio,
  protocol rev 2025-06-18.
• Bindings — Python (pip install areev, abi3, sync + async) and
  Node (npm install areev, napi native addon), same facade, scalars in /
  JSON out.
• Adapters — areev-langgraph (checkpointer, store, memory saver) and
  areev-crewai (storage backend, knowledge source, audit listener) on
  PyPI.

Benchmarks

• Reproducible latency, honesty, and LoCoMo-accuracy harnesses in
  crates/areev-bench (RESULTS.md has the numbers), with perf gates
  (bench, voice_loop) run as examples.