v0.32.0 — Minor release: a read-only MCP mode for letting another person's agent search a vault it must never change.

Minor release: a read-only MCP mode for letting another person's agent search a vault it must never change.

Added

• memstem mcp --read-only (also mcp.read_only: true in config.yaml) serves only the read tools: memstem_upsert is not registered, the index is opened mode=ro + query_only (no migration, no vec-table or signature writes, no write lock, so it is safe beside a running daemon), and the server writes nothing — no query log, no Jev shadow ledger, no rerank cache. memstem_get also refuses paths into underscore-prefixed vault directories in this mode. For letting another person's agent search a vault it must never change, e.g. over an SSH forced command. A missing index, an index below the current schema, or a vec-dimension mismatch is reported instead of being migrated or rebuilt. See docs/mcp-api.md.