MemoryGuard v0.7.12

MemoryGuard v0.7.12

MCP discovery and registered capabilities

New MCP clients receive a compact default discovery surface of 11 day-to-day
tools through tools/list. The surface includes capability discovery and the
governed invocation broker. memoryguard_capabilities exposes paginated
metadata for registered MCP operations and reviewed headless GUI operations,
with JSON Schema returned only when include_schema=true is requested for a
selected page. Existing advanced MCP names remain callable by exact name for
installed-client compatibility; they are not added to the default discovery
surface.

memoryguard_invoke routes a discovered MCP or reviewed headless GUI operation
through its existing checks. Mutating targets still require confirmed=true
and a non-empty idempotency_key; the broker forwards those proofs to the
target's permission, scope, and readiness gates. The MCP name remains
io.github.irisxc4/memoryguard.

Bounded read responses

Successful replayable reads are compacted and measured against a 24,000-byte
UTF-8 limit for the complete MCP envelope, including all content blocks and
existing structuredContent. Responses within the limit keep their existing
shape. An eligible oversized read returns a compact receipt with an opaque
response_ref and required identifiers rather than silently truncating its
body. Reads that do not meet replay conditions or exceed the in-memory snapshot
limit return a bounded delivery.status="unavailable" receipt with
action="narrow_query".

The broker-only memoryguard_response_read operation is registered through the
capability catalog and is invoked through memoryguard_invoke; it is not an
additional default tools/list tool. Pages are UTF-8 JSON fragments with a
next_offset. The page limit is 4–4096 bytes, with a 3000-byte default, and an
offset must begin at a UTF-8 character boundary. For one JSON text payload,
fields accepts top-level business field names or object-only JSON Pointers,
such as /data/memory_id. Multi-content and non-JSON results reject field
selection and remain available only as whole-envelope pages.

Private references live only in the MCP process for at most five minutes. The
store keeps at most 16 snapshots, each at most 512,000 bytes. A private
reference is bound to the exact trusted session, principal, scope, and active
binding revision. Every page reruns the original read under current
authorization and compares its digest. Denied, changed, revoked, or expired
references return stable refusal codes; old cached content never bypasses the
current read. Public capability metadata keeps its existing offset pagination.

Writes and memoryguard_context_bootstrap keep their complete receipt and
mandatory-rule contracts and cannot request response pagination. A page read
therefore never reruns a mutation.

Cache-aware local telemetry

Provider-reported cached_input_tokens and cache_write_input_tokens are
stored and aggregated separately as measured_cached_input and
measured_cache_write_input. Cache coverage is reported independently as
complete, partial, or unavailable. A provider-reported zero remains zero;
missing provider data remains unknown (None/unavailable). Deterministic
MemoryGuard conversion units continue to be labeled estimates, and this
release makes no claim of a measured token-reduction rate.

Validation boundary

• Official implementation-tip CI passed all four jobs: Ubuntu full pytest and
  acceptance on Python 3.10 and 3.12, plus Windows runtime lease acceptance on
  Python 3.10 and 3.12.
• Local targeted validation recorded 85 passed for runtime lease, knowledge
  library, and knowledge acceptance checks. Rule-merge acceptance reported
  ACCEPTED/passed: true; lifecycle acceptance reported passed: true,
  total: 200, and categories_passed: true, with empty production defects
  and errors.
• Final publication gates passed: main CI run 34684624860, Repo Hygiene run 34684624766, and the 0.7.12 wheel/sdist both passed twine check plus archive-content verification from commit 4a513a4434310c815cf3bb248321e5cacde52049.