v2.7.1

Adds official MCP Registry publishing on release.

v2.7.0 — pip install cogmem

cogmem is now a pip-installable package.

Install

pip install cogmem            # CLI + MCP server + verifiable-memory tools
pip install 'cogmem[recall]'  # add local semantic recall
cogmem init                   # wire the Claude Code hooks + build the index

Or run the MCP server on demand: uvx cogmem mcp.

Highlights

• PyPI packaging (#7): the engine is now an importable cogmem package with a cogmem console script and a core/[recall] dependency split (provenance tools need only cryptography + cbor2).
• Full loop via pip: cogmem init records the interpreter, materializes the hooks, wires settings.json, and builds the index — so pip install gives the complete Claude Code integration, not just the CLI. Hooks now run python -m cogmem.<module> and work for both clone and pip installs.
• COGMEM_HOME isolation: runtime artifacts (recall socket, index) live under COGMEM_HOME; note.py and all hooks honor it.
• Cross-platform daemon (#8): Linux systemd --user service alongside macOS launchd.
• Reproducible MCP Dockerfile (#6).
• Publishing via PyPI Trusted Publishing (OIDC).
• Tests 87 → 125.

v2.6.0

cogmem 2.6.0

Provenance hardening, an honest efficacy signal, and the verification surface.

Verifiable memory

• Issuer pinning — credentials, the transparency log, and the signed tree head are now pinned to a TOFU trust anchor ($COGMEM_HOME/trust.json); a chain re-signed under a foreign key is rejected.
• Key rotation — cogmem trust --rotate re-anchors to a new key while keeping prior DIDs trusted, so history still verifies.
• macOS Keychain custody (opt-in, config keychain: true) — moves the agent key out of the 0600 file into the login keychain.
• External transparency witness — cogmem witness keygen|trust|cosign|verify: a separate key co-signs the STH so the agent can't fork history alone.

Observability & evaluation

• cogmem doctor — end-to-end learning-loop health (daemon, API key, trust anchor, key custody, capture freshness, backlog).
• cogmem eval --outcomes — realized, non-circular recall efficacy from real-session feedback.

Robustness

• Guard tripwire matching bounded against ReDoS; daemon/recall socket reads capped.
• Consolidation dedup corpus bounded and scope-prioritized (no more unbounded-prompt cliff).
• Model IDs centralized in config; duplicated LLM helpers removed; portable hooks for Linux.

CI & docs

• CI now installs the real deps, runs all three suites, import-smokes the engine, and lints with ruff.
• COGMEM_HOME documented; PROVENANCE.md now in the repo; privacy and THREAT-MODEL claims corrected.

Full history regenerated in CHANGELOG.md.

v2.5.0 — MCP server, SCITT statements, one-command install

Added

• MCP server (cogmem mcp): stdio JSON-RPC with 8 tools — recall, note, status, verify, receipt, tree_head, progress, review_pending — plus read-only user-model and project-state resources. Every tool meets Glama TDQS 5/5: title, structured description, per-parameter docs, honest annotations, output schema, and structuredContent.
• COSE_Sign1 SCITT signed statements (byte-compatible with Holographic Memory) and RFC 6962 inclusion receipts over a signed Merkle transparency log.
• One-command installer (install.sh): idempotent setup of the virtualenv, dependencies, the cogmem CLI, Claude Code hooks (shipped under hooks/), and a macOS warm-recall daemon.
• glama.json for the Glama MCP directory.

Security

• Fixed a vault/ .gitignore pattern so the local vault and Ed25519 identity key are correctly ignored.
• Added SECURITY.md.

Local-first: semantic recall runs on a local model (fastembed); nothing leaves your machine.