v0.1.1

First installable release. (0.1.0 was published then removed from PyPI — its package metadata carried a personal email; 0.1.1 is functionally identical.)

Byzantine Fault Tolerant consensus middleware that sits between an AI agent and its vector store. Every memory write is validated by three independent nodes, each checking a different property, and stored only if at least 2 of 3 agree — so a poisoned "fact" or injected "instruction" never enters the store to be retrieved later.

How it works

• Node A — semantic: rejects a write that is topically close to an existing memory but reads as a contradiction (quiet fact-overwrite).
• Node B — cryptographic: internal_system writes need a valid Ed25519 signature; anything claiming that source without one is spoofing.
• Node C — temporal: flags content delivered through an indirect vector (email, web page, document, tool output) and scripted write bursts.

Accept needs 2/3; one node rejecting at ≥ 0.85 confidence vetoes the write outright. An accepted-but-flagged memory keeps a lowered confidence score.

Included

• The consensus engine, coordinator, all three nodes, ChromaDB-backed store with full provenance metadata
• MCP server (lagrange-mcp) — write_memory / read_memory, with internal_system blocked at the agent surface
• LagrangeConfig + build_coordinator() — every knob tunable via LAGRANGE_* env vars
• Persistent Ed25519 signing key (survives restarts)
• Two runnable examples, a red-team test suite, scripts/benchmark.py

Performance — consensus overhead is ~0.5 ms (offline hashing embedder) to ~1 ms (sentence-transformers) p50; write latency is embedding + ChromaDB, which you pay regardless.

Install

pip install "lagrange-memory[all]"

Known limitations (documented, not hidden)

• A plausible policy planted through a trusted direct_chat write — no spoofed source, no indirect vector, no contradicted fact — is not caught. This is MINJA's real threat shape; see test_KNOWN_LIMITATION_*.
• The contradiction / instruction detectors are keyword lists (evadable by paraphrase).
• The coordinator is a single point of failure; 2/3 compromised nodes defeat consensus.

Apache-2.0. Feedback and issues welcome — this is alpha.