Audrey 1.3.0

Audrey now knows the difference between looking and doing. It stays silent while an agent explores and speaks up only when the agent is about to repeat something that actually broke.

What changed

• Read-only shell commands skip Guard. grep, git status, cat, ls, sed -n, npm view, docker ps and their kind never reach the preflight, their non-zero exits are no longer recorded as failures, and the PreToolUse hook for them drops from about 1.0 s to about 0.25 s on the maintainer's machine. In one long-running store, 1,238 of 1,498 episodes had been this kind of noise.
• Failures match by what they ran. A remembered failure surfaces when the proposed command shares a verb signature with it (npm run deploy against npm run deploy), not because two strings look alike to an embedding. Autopilot's failure records are never filed as "uncertain" context again.
• Guard says what it means. Each warning carries its type, severity, and the remembered text instead of a count and a list of ids. audrey demo --scenario repeated-failure shows the whole sequence, silence included, with no API key.
• The classifier fails closed and was attacked before release. Five independent adversarial passes ran its "read-only" verdicts against real tools and found thirteen ways to hide a write inside a harmless-looking command. Every one is closed and is a test case, and the fifth pass found none left. Two limits remain by design and are documented in the README.
• Existing stores are cleaned once. Stale probe-failure rows are soft-retired on first open (166 in the maintainer's store); audrey purge removes them when you choose.
• The index invariant that could lock a strict session out is fixed. Soft-forgetting a memory used to make the store report itself unhealthy, and strict Guard blocks every action on that report. The vector index now mirrors live rows only, a leftover vector only recommends a re-embed, and the maintenance sweep clears leftovers.

Also in this release: the security review fixes (schema v16 privacy taint for derived knowledge, purge cascade, sanitized post-encode, canonical containment checks, admin gating for memory_promote), a redactor that no longer treats POSIX temp paths and CI checkouts as secrets, and export snapshots that leave per-store housekeeping keys behind.

Upgrading

npm install -g audrey@1.3.0 (or pip install --upgrade audrey-memory). The store migrates itself on first open; nothing to run. If a strict session ever reports the memory index unhealthy, audrey reembed is the remedy, and this release should make that a rare sight.

Verification

• 1,566 tests pass; typecheck, lint, format, and the scale benchmark gate pass.
• CI green on Node 20, Node 22, Windows, Docker, and the Python SDK.