v0.9.0a12 — preview alpha

Published artifacts:

• PyPI: pip install --pre stigmem-py==0.9.0a12 (also: stigmem, stigmem-node, stigmem-openclaw)
• npm: npm install @eidetic-labs/stigmem-ts@0.9.0-alpha.12
• GHCR: docker pull ghcr.io/eidetic-labs/stigmem-node:0.9.0a12 (also :0.9.0-alpha.12)
• Supply-chain evidence: GHCR image is keyless-signed with Sigstore/cosign; SBOM and BuildKit provenance are attached as OCI referrers. Verification instructions: https://docs.stigmem.dev/operators/release-verification
• GPG signatures: The release tag is maintainer-signed. Detached artifact signatures may be uploaded manually after publication.

---

[0.9.0a12] — 2026-06-17

Added

• Federation DNSSEC origin trust (Phase 3), default-OFF behind
  federation_dnssec_trust_enabled (and only meaningful when
  federation_relay_enabled is also on). A relayed fact whose origin node is
  unreachable and otherwise unanchored can now have its key re-derived from a
  DNSSEC-signed binding record at _stigmem-fed._key.<host>, so revocation and
  recency stay enforceable while the origin node is offline (its DNS is
  independent of its node). The first-trust ladder is operator-pin → DNSSEC →
  operator-confirm → fail-closed; a trusted DNSSEC key is honored only after a
  relay-path recency/revocation re-check (cadence clamp(TTL, floor, cap)
  anchored on the last genuine DNS validation), which hard-rejects a positive
  withdrawal (status=revoked tombstone) or an epoch rollback, time-boxes an
  unreachable/suppressed binding, and reconciles key rotation via the record's
  prev_fpr grace. Unsigned, absent, or slow-resigning origins fall through to a
  bounded operator-confirm queue (stigmem federation dnssec pending|confirm|reject
  • GET/POST /v1/federation/dnssec/pending[/confirm|/reject]). The carried v2.2
    envelope dnssec_binding is re-validated on ingest (never trusted as bytes).
    Completes the Phase-3 3a (DNSSEC chain validator) / 3b (first-trust ladder +
    pin store + operator-confirm) / 3c (relay-path re-check + 4-node proof) arc.
    The feature is inert and the relay path is byte-identical to before unless the
    flag is explicitly enabled. See the
    Federation DNSSEC Trust runbook.

Security

• Dependency advisory sweep — cleared the open Dependabot dependency alerts
  across all four lockfiles (38 of 41 resolved by version bumps/overrides; 3
  no-upstream-patch residuals documented as unreachable or build-time-only).
  Python runtime (uv.lock): starlette→1.3.1, aiohttp→3.14.1,
  cryptography→49.0.0, python-multipart→0.0.32. SDK/MCP workspace:
  hono→4.12.25, vite→6.4.3, ws→8.21.0, js-yaml→4.2.0. Docs toolchain:
  ws/dompurify/js-yaml/launch-editor/@babel/core. Obsidian plugin:
  vite→6.4.3. Residuals (nltk, dompurify#83 by ceiling, gray-matter's
  js-yaml 3.x) are dispositioned in SECURITY.md.

v0.9.0a11 — preview alpha

Published artifacts:

• PyPI: pip install --pre stigmem-py==0.9.0a11 (also: stigmem, stigmem-node, stigmem-openclaw)
• npm: npm install @eidetic-labs/stigmem-ts@0.9.0-alpha.11
• GHCR: docker pull ghcr.io/eidetic-labs/stigmem-node:0.9.0a11 (also :0.9.0-alpha.11)
• Supply-chain evidence: GHCR image is keyless-signed with Sigstore/cosign; SBOM and BuildKit provenance are attached as OCI referrers. Verification instructions: https://docs.stigmem.dev/operators/release-verification
• GPG signatures: The release tag is maintainer-signed. Detached artifact signatures may be uploaded manually after publication.

---

[0.9.0a11] — 2026-06-11

Added

• Federation Multi-Tenancy Phase 2c — multi-hop relay (#724), default-OFF
  behind federation_relay_enabled. A node may re-federate inbound facts,
  tombstones, and revocations to its peers under a zero-transitive-trust key
  resolver (operator-pin → stored-binding → fetch-on-first → fail-closed);
  per-fact origin signatures are carried verbatim across hops (never re-signed),
  and relay is additionally gated per peer by relay_trusted. The capability is
  inert unless explicitly enabled with trusted peers — egress stays self-only
  and ingest fail-closes for a default node. Migrations 045–050 are additive.

Changed

• /metrics now requires admin authentication by default (#726).
  Breaking: set STIGMEM_METRICS_REQUIRE_AUTH=false to restore the previous
  unauthenticated Prometheus scrape for trusted-network deployments.
• Terminal subscription_events past the retention window are now pruned,
  bounding table growth on the delivery path (#726).
• Tightened the a11 eval-harness quality gate documentation and release
  readiness posture around make eval-fast, path-filtered CI, recall baseline
  behavior, and generated eval result artifacts.
• Opened the post-v0.9.0a10 release-prep lane after the adapter publication
  batch.
• ADR consolidation + de-contrition. Consolidated the ADR set from 20 to 10
  living records (amendments/clusters folded into their surviving ADR;
  superseded originals retained in docs/adr/archive/), and removed the
  post-v1.0-retraction "contrition" framing from the public docs while keeping
  the honest per-scenario scoping. The 0.x version line is the sole
  pre-stability signal. Added scripts/check_adr_references.py as a CI guard
  against dangling/stale ADR references.
• ADRs are now living documents (previously: immutable after acceptance).
  Editorial edits are made in place — git holds the history; material decision
  changes are recorded as dated ## Amendments entries, never silent
  overwrites — mirroring Stigmem's own supersede-with-a-record model for facts.
• Feature graduation Gate 4 (ADR-008) changed from a mandatory 30-day
  external-operator soak to an internal-quality bar; external-operator
  validation relocated to the 1.0 GA stability gate (ADR-001).

Fixed

• Removed stale recall consecutive-failure wording and tracked state now that
  recall regressions block immediately once a non-zero baseline is frozen.
• Made the tag coverage workflow tolerate the release-creation race by keeping
  the generated artifacts and coverage branch green when coverage.xml cannot
  be attached to the GitHub release before the publish workflow creates it.

Security

• GHSA-5p3m-vhh6-9236 — blind SSRF via webhook delivery_address.
  Completed remediation of the webhook delivery SSRF. delivery_address is now
  validated at subscription-creation time (https-only by default), and webhook
  delivery resolves the host once and pins the connection to the validated IP,
  closing a DNS-rebinding TOCTOU window while preserving the Host header and
  TLS SNI so certificate verification still binds to the original hostname.
  Reported by @chaitanyagarware — thank
  you for the responsible disclosure. (#726)
• Hardened the outbound SSRF address filter to classify IPv4-in-IPv6 embeddings
  (IPv4-mapped ::ffff:, 6to4, NAT64) and RFC 6598 CGNAT space as non-public,
  closing a bypass where an attacker-controlled AAAA record could smuggle a
  blocked IPv4 (loopback, cloud IMDS, or RFC 1918) past the guard. Classification
  now uses the stdlib address flags in addition to the explicit denylist.
• Bumped the hono workspace override from >=4.12.18 to >=4.12.23
  (resolving hono@4.12.18 → 4.12.23), clearing the four moderate Hono
  advisories surfaced by pnpm audit (IP-restriction static-deny bypass,
  cookie sameSite sanitization, JWT-middleware Authorization-scheme
  acceptance, and app.mount() undecoded-prefix handling). pnpm audit
  now reports no known vulnerabilities.
• Updated the locked aiohttp transitive dependency from 3.13.5 to
  3.14.0, resolving Dependabot alerts GHSA-hg6j-4rv6-33pg and
  GHSA-jg22-mg44-37j8 in optional adapter/provider dependency paths.
• Corrected the six published v0.9.0a2 Critical/High GitHub Security
  Advisory affected ranges from <0.9.0a2 to ==0.9.0a1, matching the
  reset-line vulnerable artifact and preventing false-positive Dependabot
  alerts against later alpha lockfile entries.

v0.9.0a10 — preview alpha

Published artifacts:

• PyPI: pip install --pre stigmem-py==0.9.0a10 (also: stigmem, stigmem-node, stigmem-openclaw)
• npm: npm install @eidetic-labs/stigmem-ts@0.9.0-alpha.10
• GHCR: docker pull ghcr.io/eidetic-labs/stigmem-node:0.9.0a10 (also :0.9.0-alpha.10)
• Supply-chain evidence: GHCR image is keyless-signed with Sigstore/cosign; SBOM and BuildKit provenance are attached as OCI referrers. Verification instructions: https://docs.stigmem.dev/operators/release-verification
• GPG signatures: The release tag is maintainer-signed. Detached artifact signatures may be uploaded manually after publication.

---

[0.9.0a10] — 2026-05-26

Added

• stigmem-plugin-cognee-adapter v0.1.0 — Cognee memory-graph bridge
  adapter, experimental opt-in. Discoverable via stigmem plugins list and
  installable via pip install stigmem-plugin-cognee-adapter. See
  feature record.
• stigmem-plugin-gemini-adapter v0.1.0 — Gemini FunctionDeclaration bridge
  adapter, experimental opt-in. Discoverable via stigmem plugins list and
  installable via pip install stigmem-plugin-gemini-adapter. See
  feature record.
• stigmem-plugin-letta-adapter v0.1.0 — Letta archival-memory bridge
  adapter, experimental opt-in. Discoverable via stigmem plugins list and
  installable via pip install stigmem-plugin-letta-adapter. See
  feature record.
• stigmem-plugin-openai-tools-adapter v0.1.0 — OpenAI-compatible tool-use
  adapter, experimental opt-in. Discoverable via stigmem plugins list and
  installable via pip install stigmem-plugin-openai-tools-adapter. See
  feature record.
• stigmem-plugin-zep-adapter v0.1.0 — Zep session-memory bridge adapter,
  experimental opt-in. Discoverable via stigmem plugins list and installable
  via pip install stigmem-plugin-zep-adapter. See
  feature record.
• stigmem[adapters] meta-package extra for installing the five
  host-application adapter plugins as a single group.

Changed

• Prepared the v0.9.0a10 adapter batch publication release line.
• Pointed the previous-release SDK compatibility smoke at the shipped
  v0.9.0a9 baseline until a later tagged baseline supersedes it.
• Kept the previous-release SDK compatibility smoke focused on SDK behavior by
  disabling plugin auto-discovery during its local node startup.

Fixed

• Hardened stigmem mcp install operator output: dry runs now show the planned
  Stigmem server entry while omitting the credential field, --write
  identifies whether the credential came from the environment, a flag, or the
  placeholder, and POSIX backup files are written owner-only.
• Clarified that stigmem mcp config <editor> intentionally prints metadata
  and guide links rather than a copy-paste config snippet.
• Extended the MCP catalog consistency guard to validate the
  /v1/mcp/connectors payload alongside README, adapter README, docs, and CLI
  editor surfaces.
• Added federation-soak startup diagnostics so failed node health checks print
  Compose state and recent per-node logs before the nightly job exits.
• Restored the local federation soak harness by explicitly marking its
  container-only HTTP federation topology as insecure local/dev/test mode with
  Docker's non-loopback dev override, generated node signing keys, and an eval
  tombstone-signer manifest while writing local transparency-log artifacts to
  the writable eval data volume.
• Updated the federation soak harness for the current peer approval lifecycle
  and admin-only tombstone endpoints.
• Mounted the tombstone admin API router so RTBF tombstone endpoints are
  available on the reference node.
• Fixed tombstone status lookups for URI entities whose percent-encoded form
  contains path separators.
• Mounted federation tombstone poll and ingest routes on the federation router.

v0.9.0a9 — preview alpha

Published artifacts:

• PyPI: pip install --pre stigmem-py==0.9.0a9 (also: stigmem, stigmem-node, stigmem-openclaw)
• npm: npm install @eidetic-labs/stigmem-ts@0.9.0-alpha.9
• GHCR: docker pull ghcr.io/eidetic-labs/stigmem-node:0.9.0a9 (also :0.9.0-alpha.9)
• Supply-chain evidence: GHCR image is keyless-signed with Sigstore/cosign; SBOM and BuildKit provenance are attached as OCI referrers. Verification instructions: https://docs.stigmem.dev/operators/release-verification
• GPG signatures: The release tag is maintainer-signed. Detached artifact signatures may be uploaded manually after publication.

---

[0.9.0a9] — Unreleased

Changed

• Advanced live release-version surfaces toward v0.9.0a9 for the plugin
  discovery release line.
• Opened the post-v0.9.0a8 plugin publication readiness track, marked the
  alpha extraction train as complete through v0.9.0a8, and added the
  standalone experimental plugin publication contract.
• Added operator-facing plugin discovery surfaces: README plugin catalog,
  meta-package plugin extras, docs-site catalog pages, and stigmem plugins
  search/enable/disable/doctor CLI commands.
• Added MCP enablement surfaces: README editor integration table, docs-site
  MCP connector catalog, stigmem mcp doctor/detect/config/install/status/smoke
  CLI commands, and GET /v1/mcp/connectors catalog discovery.
• Added a structural guard that keeps README, PyPI extra definitions, and docs
  plugin catalog entries aligned for the six published experimental plugins.
• Added a structural guard that keeps README, adapter README, docs-site MCP
  connector pages, and the stigmem mcp editor catalog aligned.

Security

• Remediated qs CVE-2026-8723 / GHSA-q8mj-m7cp-5q26 in the documentation
  build toolchain by forcing qs>=6.15.2 in docs/package.json and refreshing
  docs/package-lock.json. The root pnpm workspace was already pinned to the
  patched qs@6.15.2 release.

v0.9.0a8 — preview alpha

Published artifacts:

• PyPI: pip install --pre stigmem-py==0.9.0a8 (also: stigmem, stigmem-node, stigmem-openclaw)
• npm: npm install @eidetic-labs/stigmem-ts@0.9.0-alpha.8
• GHCR: docker pull ghcr.io/eidetic-labs/stigmem-node:0.9.0a8 (also :0.9.0-alpha.8)
• Supply-chain evidence: GHCR image is keyless-signed with Sigstore/cosign; SBOM and BuildKit provenance are attached as OCI referrers. Verification instructions: https://docs.stigmem.dev/operators/release-verification
• GPG signatures: The release tag is maintainer-signed. Detached artifact signatures may be uploaded manually after publication.

---

[0.9.0a8] — 2026-05-23

Status: preview alpha — pre-stable, not for production federation across
organizational boundaries. Multi-tenant scoping remains experimental, opt-in,
and operator-gated.

Per-ecosystem version strings (per ADR-019):

• PyPI / Python: stigmem 0.9.0a8, stigmem-py 0.9.0a8, stigmem-node 0.9.0a8, and stigmem-openclaw 0.9.0a8 (PEP 440).
• npm / Node: @eidetic-labs/stigmem-ts@0.9.0-alpha.8 (semver).
• GHCR: ghcr.io/eidetic-labs/stigmem-node:0.9.0a8 and :0.9.0-alpha.8.
• Git tag, GitHub release, prose: v0.9.0a8 (shorthand).

Changed

• Advanced the enforced release-version surfaces to the v0.9.0a8 alpha line
  across Python packages, npm packages, API metadata, conformance metadata,
  plugin compatibility defaults, release documentation, and current-facing
  adopter guidance.
• Validated the v0.9.0a8 multi-tenant alpha horizon in the feature-owned
  records. Default installs collapse callers to the default tenant;
  non-default tenant isolation requires stigmem-plugin-multi-tenant
  registration and explicit operator enablement.

Security

• Recorded the multi-tenant scoping disposition for default identity collapse,
  plugin-enabled tenant resolution, fact/garden/recall/audit/observability and
  subscription scoping, and node-level federation pull default-tenant-only
  behavior.
• Added tenant-ID normalization and validation, explicit TenantContext source
  metadata, and a structural CI guard that rejects unclassified tenant context
  construction.
• Clarified that multi-tenant scoping is experimental and does not yet claim
  stable shared-node readiness, tenant-aware non-default federation,
  per-tenant quota/resource isolation, external operator soak evidence, or a
  signed standalone plugin artifact.

v0.9.0a7 — preview alpha

Published artifacts:

• PyPI: pip install --pre stigmem-py==0.9.0a7 (also: stigmem, stigmem-node, stigmem-openclaw)
• npm: npm install @eidetic-labs/stigmem-ts@0.9.0-alpha.7
• GHCR: docker pull ghcr.io/eidetic-labs/stigmem-node:0.9.0a7 (also :0.9.0-alpha.7)
• Supply-chain evidence: GHCR image is keyless-signed with Sigstore/cosign; SBOM and BuildKit provenance are attached as OCI referrers. Verification instructions: https://docs.stigmem.dev/operators/release-verification
• GPG signatures: The release tag is maintainer-signed. Detached artifact signatures may be uploaded manually after publication.

---

[0.9.0a7] — 2026-05-23

Status: preview alpha — pre-stable, not for production federation across
organizational boundaries. Source attestation remains experimental, opt-in, and
operator-gated.

Per-ecosystem version strings (per ADR-019):

• PyPI / Python: stigmem 0.9.0a7, stigmem-py 0.9.0a7, stigmem-node 0.9.0a7, and stigmem-openclaw 0.9.0a7 (PEP 440).
• npm / Node: @eidetic-labs/stigmem-ts@0.9.0-alpha.7 (semver).
• GHCR: ghcr.io/eidetic-labs/stigmem-node:0.9.0a7 and :0.9.0-alpha.7.
• Git tag, GitHub release, prose: v0.9.0a7 (shorthand).

Changed

• Advanced the enforced release-version surfaces to the v0.9.0a7 alpha line
  across Python packages, npm packages, API metadata, conformance metadata,
  plugin compatibility defaults, release documentation, and current-facing
  adopter guidance.
• Validated the v0.9.0a7 source-attestation alpha horizon in the
  feature-owned records. Default installs remain source-attestation-inert;
  assertion source checks, source-trust recall signals, and inbound federation
  source validation require stigmem-plugin-source-attestation registration
  and explicit operator gates.

Security

• Recorded the source-attestation disposition for direct source matches,
  normalized source matches, identity-provided delegated source entities,
  recall source-trust contribution, and federation inbound source guards.
• Clarified that source attestation validates fact authorship claims in
  plugin-loaded deployments and does not prove release artifact provenance.
  Signed tags, detached artifact signatures, SBOMs, image digests, provenance,
  and Rekor/Sigstore evidence remain release-process responsibilities.
• Documented residual source-attestation gaps: accepted facts are not marked
  as locally re-attested, federated facts are not silently re-attested, durable
  API-backed delegation persistence remains future hardening, and standalone
  plugin artifact evidence is deferred to the plugin launch train.

v0.9.0a6 — preview alpha

Published artifacts:

• PyPI: pip install --pre stigmem-py==0.9.0a6 (also: stigmem, stigmem-node, stigmem-openclaw)
• npm: npm install @eidetic-labs/stigmem-ts@0.9.0-alpha.6
• GHCR: docker pull ghcr.io/eidetic-labs/stigmem-node:0.9.0a6 (also :0.9.0-alpha.6)
• Supply-chain evidence: GHCR image is keyless-signed with Sigstore/cosign; SBOM and BuildKit provenance are attached as OCI referrers. Verification instructions: https://docs.stigmem.dev/operators/release-verification
• GPG signatures: The release tag is maintainer-signed. Detached artifact signatures may be uploaded manually after publication.

---

[0.9.0a6] — 2026-05-22

Status: preview alpha — pre-stable, not for production federation across
organizational boundaries. Memory Garden advanced ACL remains experimental,
opt-in, and operator-gated.

Per-ecosystem version strings (per ADR-019):

• PyPI / Python: stigmem 0.9.0a6, stigmem-py 0.9.0a6, stigmem-node 0.9.0a6, and stigmem-openclaw 0.9.0a6 (PEP 440).
• npm / Node: @eidetic-labs/stigmem-ts@0.9.0-alpha.6 (semver).
• GHCR: ghcr.io/eidetic-labs/stigmem-node:0.9.0a6 and :0.9.0-alpha.6.
• Git tag, GitHub release, prose: v0.9.0a6 (shorthand).

Changed

• Advanced the enforced release-version surfaces to the v0.9.0a6 alpha line
  across Python packages, npm packages, API metadata, conformance metadata,
  plugin compatibility defaults, release documentation, and current-facing
  adopter guidance.
• Validated the v0.9.0a6 Memory Garden advanced ACL alpha horizon in the
  feature-owned records. Basic garden CRUD, membership, direct garden_id
  guards, and quarantine moderation remain core; advanced cross-surface ACL
  behavior remains opt-in behind stigmem-plugin-memory-garden-acl
  registration and operator gates.

Security

• Recorded the Memory Garden advanced ACL cross-surface disposition for fact
  query filtering, recall ranking, graph traversal, OIDC permission ceilings,
  subscription delivery/replay, and quarantine moderation. The feature supports
  and coexists with R-21 mitigation work but does not itself close
  same-session read/write graph isolation.
• Documented Memory Garden ACL posture explicitly: default deployments enforce
  direct garden_id read guards but do not filter tenant-wide queries, recall
  ranking, push subscriptions, OIDC permission ceilings, or graph traversal
  unless stigmem-plugin-memory-garden-acl is installed, registered, and the
  per-surface enablement flags are set. SECURITY.md, quickstart, a startup
  warning, and the /v1/doctor endpoint now surface the opt-in posture.
• Recorded the /v1/doctor disclosure disposition: the unauthenticated
  endpoint exposes only coarse memory_garden_acl_filtering posture in
  v0.9.0a6; future hardening can auth-gate the endpoint or suppress the
  posture field for anonymous callers.
• Plugin scaffold handlers in stigmem-plugin-memory-garden-acl now carry
  docstrings explaining stub behavior, failure modes, and core fallback.
• Quarantine moderator node-admin bypass is now documented in code and in the
  Memory Garden advanced ACL feature security record.
• Release signing key hygiene now excludes stigmem-release-signing-key*.asc
  and private/secret signing-key .asc files from the repository.

v0.9.0a5 — preview alpha

Published artifacts:

• PyPI: pip install --pre stigmem-py==0.9.0a5 (also: stigmem, stigmem-node, stigmem-openclaw)
• npm: npm install @eidetic-labs/stigmem-ts@0.9.0-alpha.5
• GHCR: docker pull ghcr.io/eidetic-labs/stigmem-node:0.9.0a5 (also :0.9.0-alpha.5)
• Supply-chain evidence: GHCR image is keyless-signed with Sigstore/cosign; SBOM and BuildKit provenance are attached as OCI referrers. Verification instructions: https://docs.stigmem.dev/operators/release-verification
• GPG signatures: The release tag is maintainer-signed. Detached artifact signatures may be uploaded manually after publication.

---

[0.9.0a5] — 2026-05-22

Status: preview alpha — pre-stable, not for production federation across
organizational boundaries. RTBF tombstones remain experimental, opt-in, and
operator-gated.

Per-ecosystem version strings (per ADR-019):

• PyPI / Python: stigmem 0.9.0a5, stigmem-py 0.9.0a5, stigmem-node 0.9.0a5, and stigmem-openclaw 0.9.0a5 (PEP 440).
• npm / Node: @eidetic-labs/stigmem-ts@0.9.0-alpha.5 (semver).
• GHCR: ghcr.io/eidetic-labs/stigmem-node:0.9.0a5 and :0.9.0-alpha.5.
• Git tag, GitHub release, prose: v0.9.0a5 (shorthand).

Changed

• Advanced the enforced release-version surfaces to the v0.9.0a5 alpha line
  across Python packages, npm packages, API metadata, conformance metadata,
  plugin compatibility defaults, release documentation, and current-facing
  adopter guidance.

Security

• Validated the v0.9.0a5 RTBF tombstone alpha scope as an opt-in
  stigmem-plugin-tombstones feature. Default installs remain inert until the
  plugin is registered and operator gates are enabled; admin issuance,
  federation signer authority, forged-signature rejection, audit events,
  selective revocation, legal-hold silence, and no-leak behavior are covered in
  the feature-owned evidence record.
• Consolidated admin determination to use Identity.is_admin() across
  tombstone admin routes, instruction admin routes, and provenance tombstone
  filtering. This removes the can_write() and can_federate() proxy so admin
  checks consult the dedicated admin capability and capability_check voting
  hook consistently.
• Added scripts/check_admin_determination_consistency.py to reject future
  capability-combination-as-admin-proxy patterns in the Python node source.

v0.9.0a4 — preview alpha

Published artifacts:

• PyPI: pip install --pre stigmem-py==0.9.0a4 (also: stigmem, stigmem-node, stigmem-openclaw)
• npm: npm install @eidetic-labs/stigmem-ts@0.9.0-alpha.4
• GHCR: docker pull ghcr.io/eidetic-labs/stigmem-node:0.9.0a4 (also :0.9.0-alpha.4)
• Supply-chain evidence: GHCR image is keyless-signed with Sigstore/cosign; SBOM and BuildKit provenance are attached as OCI referrers. Verification instructions: https://docs.stigmem.dev/operators/release-verification
• GPG signatures: The release tag is maintainer-signed. Detached artifact signatures may be uploaded manually after publication.

---

[0.9.0a4] — 2026-05-22

Status: preview alpha — pre-stable, not for production federation across
organizational boundaries. Time-travel historical reads remain experimental,
opt-in, and operator-gated.

Per-ecosystem version strings (per ADR-019):

• PyPI / Python: stigmem 0.9.0a4, stigmem-py 0.9.0a4, stigmem-node 0.9.0a4, and stigmem-openclaw 0.9.0a4 (PEP 440).
• npm / Node: @eidetic-labs/stigmem-ts@0.9.0-alpha.4 (semver).
• GHCR: ghcr.io/eidetic-labs/stigmem-node:0.9.0a4 and :0.9.0-alpha.4.
• Git tag, GitHub release, prose: v0.9.0a4 (shorthand).

Changed

• Advanced the enforced release-version surfaces to the v0.9.0a4 alpha line
  across Python packages, npm packages, API metadata, conformance metadata,
  plugin compatibility defaults, release documentation, and current-facing
  adopter guidance.
• Validated v0.9.0a4 time-travel behavior: as_of remains experimental and
  opt-in behind stigmem-plugin-time-travel, requires explicit operator gates,
  fails closed by default, and now has aligned feature, compatibility,
  security, and public-doc projections for the a4 release horizon.

Security

• Validated the time-travel read path against tombstone and legal-hold
  disclosure risks: historical reads suppress tombstoned facts retroactively
  and non-admin callers do not receive legal-hold existence signals.
• Closed R-18 federation valid_until extension rejection. Federation ingest
  now compares incoming valid_until against the locally stored value on
  re-ingest and raises FederationValidUntilExtensionError when the incoming
  value would extend visibility beyond the locally observed bound. Rejections
  emit a federation_valid_until_extension_rejected audit event with stored
  and incoming values for forensic inspection. Combined with local source-trust
  recomputation, R-18 is now closed.
• Consolidated is_admin_caller derivation across as_of recall and
  fact-query paths to consistently use Identity.is_admin().
• Tightened plugin handler docstrings in stigmem-plugin-time-travel to
  clarify the gate-only role and prevent duplicate authorization at the wrong
  layer.
• Removed orphan retention_floor configuration from the time-travel plugin;
  retention floor remains a single core setting
  (STIGMEM_AS_OF_RETENTION_FLOOR).
• Remediated maintainer-audit finding NF-A1 / PYSEC-2026-161 before a4
  publication by adding an explicit starlette>=1.0.1 node dependency floor
  and refreshing uv.lock from starlette 1.0.0 to 1.0.1.
• Retained the standing advisory publication policy: Critical and High
  vulnerabilities use GHSA where applicable after a patched artifact is
  available; Medium and Low findings remain in SECURITY.md unless a
  documented carve-out applies.

v0.9.0a3 — preview alpha

Published artifacts:

• PyPI: pip install --pre stigmem-py==0.9.0a3 (also: stigmem, stigmem-node, stigmem-openclaw)
• npm: npm install @eidetic-labs/stigmem-ts@0.9.0-alpha.3
• GHCR: docker pull ghcr.io/eidetic-labs/stigmem-node:0.9.0a3 (also :0.9.0-alpha.3)
• Supply-chain evidence: GHCR image is keyless-signed with Sigstore/cosign; SBOM and BuildKit provenance are attached as OCI referrers. Verification instructions: https://docs.stigmem.dev/operators/release-verification

---

[0.9.0a3] — in progress

Status: active alpha release prep — pre-stable, not for production
federation across organizational boundaries. Final release evidence, security
posture, and publication notes are completed through the v0.9.0a3 milestone
before tag.

Per-ecosystem version strings (per ADR-019):

• PyPI / Python: stigmem 0.9.0a3, stigmem-py 0.9.0a3, stigmem-node 0.9.0a3, and stigmem-openclaw 0.9.0a3 (PEP 440).
• npm / Node: @eidetic-labs/stigmem-ts@0.9.0-alpha.3 (semver).
• GHCR: ghcr.io/eidetic-labs/stigmem-node:0.9.0a3 and :0.9.0-alpha.3.
• Git tag, GitHub release, prose: v0.9.0a3 (shorthand).

Added

• Validated content-addressed fact IDs as a core alpha feature across the
  feature record, modular spec projection, compatibility matrix, and release
  evidence surfaces.
• Captured a3 release-readiness evidence for the core Python packages,
  TypeScript SDK package, OpenClaw adapter package, GHCR tag posture, and docs
  publication posture.

Changed

• Advanced the enforced release-version surfaces to the active v0.9.0a3
  alpha line so package, API metadata, conformance, plugin fallback, and
  release-documentation surfaces use consistent per-ecosystem spellings.
• Align roadmap, security, operator, SDK, and spec documentation around the current release horizon: v0.9.0a3 is the only active release target; beta, release-candidate, and GA lines remain future gates until explicitly opened.
• Prepared the OpenClaw adapter and ClawHub skill metadata for the a3 alpha
  artifact line while preserving the alpha/evaluation-only posture.

Security

• Reconciled a3 release notes and security posture with the standing
  publication policy: Critical and High findings use GHSA where applicable;
  Medium and Low dispositions remain in SECURITY.md unless a documented
  carve-out applies.
• Kept the dated security evidence registry as a proof ledger and SECURITY.md
  as the public disposition index, avoiding duplicate advisory tables in a3
  release notes.

Feature Change Records

Feature-local change history is canonical in feature records. This table is the
root changelog projection used during release prep.

Feature	Status	Release lines	Feature changelog
Async jobs	active	v0.9.0a1, 0.9.xA	features/async-jobs/changelog.md
Content-addressed fact IDs	active	v0.9.0a1, v0.9.0a3	features/content-addressed-ids/changelog.md
Decay semantics	deferred	v0.9.0a1, 0.9.xA	features/decay/changelog.md
Dashboard	deferred	v0.9.0a1, 0.9.xA	features/dashboard/changelog.md
Fly.io deployment	deferred	v0.9.0a1, 0.9.xA	features/deploy-fly/changelog.md
Grafana deployment	deferred	v0.9.0a1, 0.9.xA	features/deploy-grafana/changelog.md
Helm deployment	deferred	v0.9.0a1, 0.9.xA	features/deploy-helm/changelog.md
PaaS deployment	deferred	v0.9.0a1, 0.9.xA	features/deploy-paas/changelog.md
systemd deployment	deferred	v0.9.0a1, 0.9.xA	features/deploy-systemd/changelog.md
Evaluation harness	deferred	v0.9.0a1, 0.9.xA	features/eval-harness/changelog.md
Fuzzy resolver	active	v0.9.0a1, 0.9.xA	features/fuzzy-resolver/changelog.md
Gemini adapter	deferred	v0.9.0a1, 0.9.xA	features/gemini-adapter/changelog.md
Go SDK	active	v0.9.0a1, 0.9.xA	features/sdk-go/changelog.md
Intent envelope	deferred	v0.9.0a1, 0.9.xA	features/intent-envelope/changelog.md
Lazy instruction discovery	active	v0.9.0a1, 0.9.xA	features/lazy-instruction-discovery/changelog.md
Letta adapter	deferred	v0.9.0a1, 0.9.xA	features/letta-adapter/changelog.md
Memory Garden advanced ACL	active	v0.9.0a1, 0.9.xA	features/memory-garden-acl/changelog.md
MCP adapter	active	v0.9.0a1, 0.9.xA	features/mcp-adapter/changelog.md
Multi-tenant scoping	active	v0.9.0a8, 0.9.xA	features/multi-tenant/changelog.md
Obsidian adapter	active	v0.9.0a1, 0.9.xA	features/obsidian-adapter/changelog.md
Cognee adapter	deferred	v0.9.0a1, 0.9.xA	features/cognee-adapter/changelog.md
OIDC SSO	active	v0.9.0a1, 0.9.xA	features/oidc-sso/changelog.md
Ollama/LiteLLM adapter	superseded	v0.9.0a1, 0.9.xA	features/ollama-litellm-adapter/changelog.md
OpenAI tools adapter	deferred	v0.9.0a1, 0.9.xA	features/openai-tools-adapter/changelog.md
Paperclip adapter	deferred	v0.9.0a1, 0.9.xA	features/paperclip-adapter/changelog.md
Recall graph	deferred	v0.9.0a1, 0.9.xA	features/recall-graph/changelog.md
Source attestation	active	v0.9.0a1, 0.9.xA	features/source-attestation/changelog.md
Storage backends	active	v0.9.0a1, 0.9.xA	features/storage-backends/changelog.md
libSQL storage	active	v0.9.0a1, 0.9.xA	features/storage-libsql/changelog.md
Zep adapter	deferred	v0.9.0a1, 0.9.xA	features/zep-adapter/changelog.md
Subscriptions	deferred	v0.9.0a1, 0.9.xA	features/subscriptions/changelog.md
Synthesis	deferred	v0.9.0a1, 0.9.xA	features/synthesis/changelog.md
Time-travel queries	active	v0.9.0a1, v0.9.0a4	features/time-travel/changelog.md
RTBF tombstones	active	v0.9.0a1, 0.9.xA	features/tombstones/changelog.md

---