ai-memory v0.9.0 — security hardening

ai-memory v0.9.0 · security-hardening

Turns v0.8.0's promises into enforcement.

Agent attestation is now required by default, the mandatory-hook enforce gate is now actually wired live, and 49 fixes land from a 5-lane adversarial code + security review.

📓 Release notes · 🗺️ What's new · 🔑 Attestation setup · 📜 Changelog

---

🚨 Read first — two secure-default flips (breaking)

Everything in v0.9.0 is additive over v0.8.1 except these two. They are secure-by-default breaking changes — review them before upgrading.

Flip	What changes	How to satisfy it
Attestation required (#1751)	An unsigned memory_store (MCP) / POST /api/v1/memories (HTTP) / store (CLI) is now rejected with 403 ATTESTATION_FAILED instead of landing attest_level="claimed".	Sign writes (ai-memory store --sign + ai-memory agents bind-key) or opt out with AI_MEMORY_REQUIRE_AGENT_ATTESTATION=0. → Attestation setup guide
Hook enforcement live (#1885 / #1924)	The enforce gate shipped non-functional at v0.8.0 (empty hook chain silently returned Allow). It is now wired live on both the MCP and HTTP write paths.	Nothing if you don't use [hooks].required_events; otherwise a missing required pre-write hook now fails closed.

The database auto-migrates on first open (schema v70 → v78, all additive). No manual migration step.

---

Executive brief — what v0.9.0 means, for three audiences

👤 Non-technical end users "Your AI's memory now proves who wrote each entry." What it means — Install once; your assistant keeps a durable, private, self-hosted memory that survives restarts, and every entry it saves is now tied to a signed identity, not a name anyone could type. Why it matters — A saved fact or decision can be trusted because it's provably authored; a spoofed or unsigned entry is rejected. The value — Peace of mind with zero new habits; your data never leaves a machine you control. What it is now — A durable, private, cryptographically-attributed memory for your AI, running entirely on your own device.

🏢 C-level decision makers "Attribution you can enforce, not just claim." What it means — The substrate no longer merely can prove who wrote a memory — it requires it. Unsigned writes are rejected by default. Why it matters — The difference between an audit trail an auditor trusts and one full of unverifiable name-strings — with governance verdicts signable by physically-separated Recorder/Judge/Stopper keys. The value — Defensible provenance, reduced insider/compromise risk, no lock-in (self-hosted, SQLite or your PostgreSQL, provider-agnostic), hardened by a 5-lane review — 49 findings, all fixed. What it is now — An enforceable, attested memory & coordination substrate for AI-agent fleets.

🛠️ SME engineers & architects "The guarantees now bind — at every write path." What it means — Attestation-required-by-default on MCP/HTTP/CLI (verified against each agent's bound Ed25519 key); hooks actually wired (#1885/#1924); three-key governance signing (#1826), capability tokens (#1827), identity-lineage succession (#1828). Why it matters — Closes real bypass gaps: fails closed with 403 on unsigned/forged writes. The value — Architect real trust boundaries: separable signing roles, per-write content attestation, fail-closed hooks, opt-in vector search + lineage-DAG (#1005/#1859). What it is now — Schema v78 · 101 MCP tools · 92 HTTP routes · 89 CLI · 28-field Memory · SQLite + PostgreSQL/AGE. Set up attestation →

---

📦 Install

Package managers (recommended — all install the 0.9.0 core):

Platform	Command
Cargo (any host)	cargo install ai-memory
Homebrew (macOS / Linux)	brew install alphaonedev/tap/ai-memory
Docker (GHCR)	docker pull ghcr.io/alphaonedev/ai-memory:0.9.0
Fedora / RHEL / Rocky (COPR)	sudo dnf copr enable alpha-one-ai/ai-memory && sudo dnf install ai-memory
Debian / Ubuntu	download the .deb below → sudo dpkg -i ai-memory_0.9.0_*.deb

Language SDKs — the 0.9.0 package slots were reserved by a withdrawn build, so the SDKs ship the 0.9.0 line under fresh versions (both wrap the 0.9.0 core):

pip install ai-memory-mcp==0.9.0.post1       # PyPI  (import name: ai_memory)
npm  install @alphaone/ai-memory@0.9.1       # npm

⚠️ Required next step — set up attestation. Because attestation is required by default, an unsigned first write returns 403 ATTESTATION_FAILED. Bind a key and sign, or set AI_MEMORY_REQUIRE_AGENT_ATTESTATION=0. The Attestation setup guide walks it through for CLI / HTTP / MCP on Linux / macOS / Windows / iOS / Android.

⬇️ Direct downloads — prebuilt binaries & packages (click to expand)

Platform	Asset
Linux x86_64	ai-memory-x86_64-unknown-linux-gnu.tar.gz · ai-memory_0.9.0_amd64.deb · ai-memory-0.9.0-1.x86_64.rpm
Linux aarch64	ai-memory-aarch64-unknown-linux-gnu.tar.gz · ai-memory_0.9.0_arm64.deb · ai-memory-0.9.0-1.aarch64.rpm
macOS Apple Silicon	ai-memory-aarch64-apple-darwin.tar.gz
macOS Intel	ai-memory-x86_64-apple-darwin.tar.gz
Windows x86_64	ai-memory-x86_64-pc-windows-msvc.zip · ai-memory.exe
iOS (xcframework)	ai-memory-ios.xcframework.tar.gz (+ .sha256)
Android (jniLibs)	ai-memory-android.tar.gz (+ .sha256)

Verify a download: the iOS + Android bundles ship a .sha256 sidecar —
shasum -a 256 -c ai-memory-android.tar.gz.sha256. Homebrew, COPR, crates.io, and the Docker image carry their own registry-signed integrity.

---

✨ What's new

Headline hardening

• 🔐 Attestation required by default — unsigned direct writes are rejected (#1751).
• 🪝 Mandatory-hook enforcement wired live on MCP + HTTP (#1885 / #1924).
• 🖊️ Three-key governance signing — separable Recorder / Judge / Stopper roles (#1826), macaroon capability tokens (#1827), signed identity-lineage succession (#1828).

All 49 hardening fixes (highlights)

• bulk_create per-row attestation gating (#1919)
• Inbound federated PENDING approvals routed through the registered-approver gate (#1920)
• Tightened team / unit / org visibility scope (#1921)
• skill_register folder_path symlink jail (#1923)
• Non-argv credential channel AI_MEMORY_STORE_URL / AI_MEMORY_STORE_URL_FILE (0600) keeps the store password off /proc/<pid>/cmdline (#1927)
• Full set: #1885–#1935 (32 code-review + 17 security findings, all fixed & tested)

Additive features

• 🧩 Skill memories — first-class, with parameters_schema + invocation_record (#1865)
• 🔁 recall_observations shadow-feedback loop (#1706)
• 🕸️ Memory-derivation lineage-DAG — memory_lineage MCP tool + GET /api/v1/memories/{id}/lineage + ai-memory lineage (#1859)
• 🔎 Opt-in vector-search slice with capacity / dimension guards (#1005)

---

📐 Surface

	v0.9.0
Schema	v78 (both adapters)
MCP tools	101 at --profile full (100 callable + memory_capabilities) / 7 at --profile core
HTTP routes	92 production registrations / 78 unique URL paths
CLI subcommands	89 (--features sal) / 87 default build
Memory struct	28 fields · 9 typed MemoryLink relations
Backends	embedded SQLite + PostgreSQL + Apache AGE — one identical API
Platforms	Linux · macOS · Windows · iOS · Android

---

Release notes ·
What's new ·
Attestation setup ·
Changelog ·
Docs

Apache-2.0 · © 2026 AlphaOne LLC