v0.6.3 — PyPI discoverability metadata

No functional change. This release exists because PyPI metadata is immutable per version: the packaging fields added in 6b9dec5 could not reach anyone without a version carrying them.

What was missing

The PyPI page declared no classifiers at all, so the package appeared in none of PyPI's faceted searches — License, Topic and Intended Audience are driven by classifiers, not by the license field. There was also no route from the package page to the issue tracker: project.urls carried only Homepage and Repository.

Changes

• classifiers — 10 entries. Python versions list what CI exercises (3.10, 3.12) plus 3.11 between them; requires-python still admits any 3.10+ interpreter.
• project.urls — added Issues, Changelog (→ Releases; this repository keeps no CHANGELOG.md) and Documentation.
• Issue templates — bug report and feature request as issue forms. The bug form asks for EMBEDDING_PROVIDER and the affected surface, the two facts that decide where to look first. Vulnerabilities are routed to GitHub Security Advisories, whose private reporting was enabled in the same pass.
• README — links both templates, and the two LICENSE links are now absolute. The README renders on the PyPI page, where relative links resolve against pypi.org and 404.

Compatibility

Metadata and documentation only. No code, no dependency, no schema change. cloto-connector.json deliberately stays at 0.6.2 — nothing here affects the hub-mediated path, and bumping it would require regenerating the magic seal for no user-visible gain.

Verification

Test suite green (54 passed) before the bump, per the verify-then-bump discipline. Metadata confirmed live on PyPI after publish: 10 classifiers and all five project URLs present, description_content_type: text/markdown.

Full changelog: v0.6.2...v0.6.3

v0.6.2 — inbound bearer authentication

Security release. CEmbedding previously had no inbound authentication of any kind: both HTTP surfaces served every request that reached them. Deployments exposed through a tunnel or reverse proxy should upgrade and configure a token.

Inbound bearer authentication

Set CEMBEDDING_AUTH_TOKEN and every request must carry Authorization: Bearer <token>. Missing headers, wrong schemes and wrong tokens are all rejected with 401, compared with hmac.compare_digest. Both surfaces are covered:

• the REST endpoints (/embed, /index, /search, /remove, /purge)
• the Streamable HTTP MCP transport, which binds 0.0.0.0:8403 by default

The REST surface binds loopback and is covered anyway. A loopback bind is not evidence that requests are local — a tunnel or reverse proxy forwards to loopback, and treating the bind address as a security boundary is exactly how a sibling server in this project ran publicly reachable and unauthenticated for 13 days. The warning logged when no token is configured says so explicitly.

Compatibility

Additive. With no token configured the server behaves exactly as 0.6.1 and logs a warning. Set CEMBEDDING_REQUIRE_AUTH=true to turn that warning into a startup error instead. Requiring a token stays opt-in in this release; a later release will make it the default.

Notes for operators

Installing 0.6.2 does not close anything on its own — the token has to be configured on the deployment. Clients must be updated to send the header before the server starts requiring it, or embedding calls will fail; note that consumers which fall back to local search on HTTP errors will degrade silently rather than fail loudly.

Verification

40 new regression tests (54 total) drive the real middleware at the ASGI and aiohttp layers. Mutation-proved: reintroducing a header-gated credential check on either surface, or rewording the warning to claim loopback safety, fails the suite.

Full changelog: v0.6.1...v0.6.2

v0.6.1 — pad-to-longest ONNX batching (~90x short-query encode)

Fixed

All three local ONNX providers (jina-v5-nano, bge-m3, MiniLM) padded every batch to a fixed ONNX_MAX_SEQ_LEN (default 2048), so every forward pass cost the full max length regardless of input size. Batches are now padded to their longest sequence:

metric	0.6.0	0.6.1
short query encode p50	~617 ms	~7 ms (~90x)
batch document encode	~0.5 docs/s	~460 docs/s

Embeddings are unchanged — pooling honors the attention mask, so pad rows never contribute (parity verified to cosine 1.0, max element diff 3.7e-7). Truncation caps are unchanged.

Measured end-to-end through CPersona do_recall (real HTTP encode): recall p50 at 10k memories = 51 ms (local scan) / 30 ms (remote matrix search), versus a ~620 ms floor before the fix.

Adds tests/test_onnx_padding.py regression tests (they need the model assets on disk and self-skip in CI).

PR: #7

v0.6.0 — matrix-resident /search

/search now runs one matmul over a per-namespace resident matrix instead of a per-item Python loop, with fully vectorized threshold + top-K selection: ~21x at 237k x 384 (131 ms → 6.1 ms/query, numpy/Accelerate; first query pays a one-time ~66 ms matrix build). Results are order-identical to the loop it replaces.

Changes

• Matrix cache per namespace (grouped by dimension), invalidated by index/remove/purge, rebuilt lazily on first search
• New EMBEDDING_SEARCH_BACKEND env: numpy (default) or mlx — Apple-GPU resident matrix converted once at cache-build time, numpy fallback when mlx is absent
• New scripts/backfill_embedding_index.py: migrates an existing cpersona DB's embedding blobs into the index (no re-embedding, read-only source, --expect-dim guard) — required before flipping a deployment to CPERSONA_VECTOR_SEARCH_MODE=remote
• Adds the test suite the repo lacked since extraction (12 tests) and GitHub Actions CI (ruff + pytest on 3.10/3.12)
• PyPI publishing now via OIDC Trusted Publishing (publish.yml); ClotoHub connector manifest (cloto-connector.json, id cembedding)

Install

uvx --from "cembedding[onnx]" cembedding

Verified: 12/12 tests, CI green (3.10/3.12), PyPI 0.6.0 published via OIDC with attestations.

🤖 Generated with Claude Code

v0.5.0 — PyPI packaging release

First standalone release after extraction from clotohub-servers servers/embedding (0.4.0).

• Restructured the flat layout into the cembedding/ package with console scripts (cembedding, cembedding-download-model) and a vendored mcp_common snapshot.
• Published to PyPI as cembedding on 2026-06-28.
• Server functionality is identical to the monorepo 0.4.0 it was extracted from — the version bump covers the packaging change only.

This release was tagged retroactively on 2026-07-09: the PyPI upload predated the git tag, which was caught during a version-lineage audit. From v0.6.0 onward, tag + GitHub Release + PyPI publish ship together.

🤖 Generated with Claude Code