3ngram 1.1.0

3ngram v1.1.0

Feature and hardening release of 3ngram: persistent, typed memory for AI agents.
It adds Client ID Metadata Document (CIMD) OAuth, a single stateless MCP handler
spanning legacy and current protocol clients, and a defense-in-depth pass over
tenant isolation.

Tenant-isolation hardening

• FORCE ROW LEVEL SECURITY is now set on the tenant-data tables, so isolation
  no longer depends on the runtime never connecting as a table owner.
• A runtime, fail-closed guard verifies at readiness (GET /ready) that the
  connected role cannot bypass RLS and that FORCE is in effect; a misprovisioned
  database is held out of rotation instead of serving cross-tenant reads.
• Every memory-domain read and scope mutation now also carries an explicit
  caller-bound user_id predicate as a second layer alongside RLS. Result sets
  are unchanged while RLS is in force.
• audit_log is brought under row-level security, and the runtime role's
  NOBYPASSRLS attribute is re-asserted on every provisioning run.

OAuth and MCP

• OAuth Client ID Metadata Document (CIMD) resolution with SSRF-safe fetching
  and bounded HTTP caching.
• A single stateless MCP SDK v2 handler serves both legacy and 2026-07-28
  clients from one code path.
• Cache and pre-parser header observability for the MCP surface.

Release artifacts

• @3ngram/server@1.1.0, @3ngram/worker@1.1.0, @3ngram/sdk@1.1.0, and
  3ngram@1.1.0 on npm
• @3ngram/core@0.6.0, @3ngram/db@0.6.0, @3ngram/schema@0.5.0, and
  @3ngram/config@0.2.2 on npm
• ghcr.io/b3dmar/3ngram:1.1.0 for Linux amd64 and arm64
• BuildKit SBOM plus provenance and GitHub-signed SLSA attestations

The hosted 3ngram dashboard and cloud-operations code are proprietary and are
not included in this repository. The MCP server, REST API, SDK, CLI, and memory
engine do not depend on that dashboard.

Immutable container reference

ghcr.io/b3dmar/3ngram@sha256:270ceeedc9e2bf50b4d4f565c8258d4c9198d9f2293713c1209d60d81071ea36