Eidetic Engine 0.17.0

Eidetic Engine 0.17.0

[0.17.0] - 2026-10-02

Covers v0.16.0..v0.17.0: 258 commits before the release commit (208
non-merge: 22 features, 76 fixes, 3 performance changes), cut in the
2026-10-01 release wave.

Retrieval quality ranking

• Search and packs apply an authoritative quality ranking on top of engine
  relevance: confidence, utility, scope match and recency, with the controls
  validated and exposed under [scoring] (ADR 0087 §2c). Recency uses one 30-day
  time constant for every memory level by default; see Known open below.
• Search can retrieve from authoritative sources before the index is first
  published, under the same source-admission controls as indexed retrieval,
  and reconciles that unpublished path with current sources and pack handoffs.
• Explicit candidate-pool bounds and a configurable context read pool;
  ee pack resolves an omitted candidate pool from pack configuration (GH #49).

Packs, resume and native evidence

• Packs expose per-item evidence freshness and origin (GH #60), bind the
  effective reference time to the snapshot identity, and enforce native pack
  identity while preserving omission history. Persisted pack diffs compare
  native evidence (ee.pack.diff.v3: items are typed entities, not only
  memory IDs).
• ee resume includes admitted native transcript history in the same
  snapshot as memory authority, and recovers unfinished task frames and
  blockers (taskFrames) without adopting, activating or reopening work.
• ee focus recommends native CASS topics without synthetic memories; rule
  identity is explained and applied index-repair receipts are preserved;
  native rule feedback applies atomically in its owning workspace.
• Subscriptions deliver filtered revocations as identity-only invalidations.
• ee insights --section knowledgeSkyline computes a true Pareto frontier
  (onion layer, k-truss rank, PPR percentile, recency, trust rank) alongside
  the cell-mean grid.

Storage, recovery and safety

• Explicit recovery of moved stores is authenticated; index publication
  gains rejection-manifest fencing with filesystem fault regressions; fresh
  read-only retrieval is served while committed daemon acknowledgements are
  preserved.
• Backup restore fences the complete restored populations (pack history,
  trust rows, learning signals) and keeps restored authority through the final
  publication boundary.
• ee ask reclaims same-lineage duplicate copies without losing independent
  support and admits complete corroborated answer bundles past duplicate
  saturation; pack verification streams canonical items without copying the
  pack.

Fixed in this cut

• A search that returned any rule, evidence, session or registered-artifact
  hit stopped the retrieval-affinity refresh for good: every later refresh
  failed and the affinity snapshot never updated again (since cdc948e).
  Such hits now delimit the run like native targets; malformed rows still fail
  closed.
• ee resume --json emitted taskFrames, which ee.resume.v1 did not
  declare under additionalProperties: false, so every resume report failed
  validation against the published schema. The schema now declares it.
• With a remote embedding endpoint configured, ee search --use-daemon
  rejected the daemon's remote_api backend label and silently re-ran every
  search in process (the remote call twice). remote_api is accepted there
  and in ee.pack.v2 and ee.daemon.search.response.v2/v3.
• Standard backups preserve canonical evidence security metadata and lineage
  (GH #61). The metadata scanner exempts only the fixed canonical key names;
  secret-bearing values, including escaped and duplicate fields, still cause
  redaction and revoke the copied evidence's search and pack admission.
• Recognized settings with equivalent spacing and quoting can corroborate
  each other again; their template and value must agree exactly. Unparsed
  command literals retain the existing ordering safeguards.
• The lib test target compiled again (a duplicated #[test] on the skyline
  frontier test) and cargo fmt --check is clean again.

Dependencies

• FrankenSQLite 0.4.1 -> 0.4.6 for the whole family (page referenced twice
  across a WAL generation, lost index entries, durable pending-freelist
  repairs). 0.4.7 is deliberately not used: it regresses strict read-only
  opens. frankensearch 0.6.0 -> 0.6.1, franken-agent-detection 0.2.3 -> 0.3.3,
  clap 4.6.7, clap_complete 4.6.11, rustix 1.1.5, tiktoken-rs 0.12.1. See
  UPGRADE_LOG.md.

Known open at release

• Archives carry SHA-256 checksums and Minisign signatures. The installers
  retain their existing checksum and optional Sigstore verification paths;
  Minisign sidecars do not satisfy --require-provenance. No Sigstore bundles
  or SLSA attestations are published, as in v0.16.0.
• Ranking: the 30-day recency decay applies to every memory level, although
  the README level table describes procedural memories as decaying slowest,
  and pack relevance floors (0.05) were not recalibrated for the new score
  scale. Older procedural knowledge can rank below fresh working notes.
• Chronic library-test reds remain tracked in bd-rm8wj; the release gate's
  exact library and contract results for this cut are listed in the GitHub
  release notes.
• Two requested-index-repair tests publish a synthetic embedder identity but
  validate it against the process default model
  (GH #64).
  Their fixture and compatibility validator are unchanged from v0.16.0;
  incompatible embedding backends remain rejected.
• Deferred review findings (low frequency): a topic with two live decision
  heads cannot be recorded until one is superseded; one malformed
  supersedes link fails ee decide list; store auth keys need read access
  to every ancestor directory; one session row with ended_at before
  started_at fails ee resume.
• The explicit ee install --manifest consumer expects
  ee.release_manifest.v1, while DSR emits its own build-manifest schema and
  the canonical repository filename. These are not interchangeable
  (DSR #18).
  The default shell and PowerShell installers use archive checksum sidecars.
• The explicit daemon write RPC rejects JSON null for optional string fields,
  although the internal typed payload serializer emits it for absent values
  (GH #62).
  This behavior predates v0.16.0; automatic CLI remember routing is unaffected.
• With HOME/USERPROFILE unset, search configuration cannot expand its
  built-in tilde paths even when XDG_DATA_HOME selects a valid global store
  (GH #63).
  Set a valid home directory in that environment; configuration errors remain
  explicit rather than silently selecting defaults.

Release qualification

All five native targets passed strict DSR builds from the release source below.
The Linux x86-64 GNU supplemental archive and ARM archive meet glibc 2.28;
the default x86-64 archive uses musl. Archive SHA-256 sidecars and epoch-2
Minisign signatures accompany the six archives; the signed aggregate also
covers both installers. No Sigstore or SLSA attestation is claimed.

All-target Clippy passed with warnings denied, and the final backup/history
roundtrip suite passed three tests preserving canonical metadata and lineage.
Formatting passed. A real
release-binary probe initialized a private store and preserved a durable fact.

The full library suite was run: 11,738 passed, 37 failed and five were ignored
before the final backup fix. A serial rerun of the failing selection passed
11 and failed 26. The final focused backup/history suite passed after the fix;
the full library suite was not rerun after that fix and is not claimed green.
An additional 266-test selection reached 135 passing tests and no failing
tests before its two-hour deadline; it has no completed suite verdict.
Within that selection, both regressions for secret-bearing values under
exempted canonical key names passed individually; the key-name exemption
does not exempt values or unknown names from scanning and redaction.
Remaining known failures and optional-surface limits are retained in the
changelog and linked issues. Published installer upgrade, registry and ACFS
receipts are tracked separately.

Release source: b7a490be51a7eb3632437c04c0e629e2f0985ba9.