v0.9.0a11 — preview alpha

Published artifacts:

• PyPI: pip install --pre stigmem-py==0.9.0a11 (also: stigmem, stigmem-node, stigmem-openclaw)
• npm: npm install @eidetic-labs/stigmem-ts@0.9.0-alpha.11
• GHCR: docker pull ghcr.io/eidetic-labs/stigmem-node:0.9.0a11 (also :0.9.0-alpha.11)
• Supply-chain evidence: GHCR image is keyless-signed with Sigstore/cosign; SBOM and BuildKit provenance are attached as OCI referrers. Verification instructions: https://docs.stigmem.dev/operators/release-verification
• GPG signatures: The release tag is maintainer-signed. Detached artifact signatures may be uploaded manually after publication.

---

[0.9.0a11] — 2026-06-11

Added

• Federation Multi-Tenancy Phase 2c — multi-hop relay (#724), default-OFF
  behind federation_relay_enabled. A node may re-federate inbound facts,
  tombstones, and revocations to its peers under a zero-transitive-trust key
  resolver (operator-pin → stored-binding → fetch-on-first → fail-closed);
  per-fact origin signatures are carried verbatim across hops (never re-signed),
  and relay is additionally gated per peer by relay_trusted. The capability is
  inert unless explicitly enabled with trusted peers — egress stays self-only
  and ingest fail-closes for a default node. Migrations 045–050 are additive.

Changed

• /metrics now requires admin authentication by default (#726).
  Breaking: set STIGMEM_METRICS_REQUIRE_AUTH=false to restore the previous
  unauthenticated Prometheus scrape for trusted-network deployments.
• Terminal subscription_events past the retention window are now pruned,
  bounding table growth on the delivery path (#726).
• Tightened the a11 eval-harness quality gate documentation and release
  readiness posture around make eval-fast, path-filtered CI, recall baseline
  behavior, and generated eval result artifacts.
• Opened the post-v0.9.0a10 release-prep lane after the adapter publication
  batch.
• ADR consolidation + de-contrition. Consolidated the ADR set from 20 to 10
  living records (amendments/clusters folded into their surviving ADR;
  superseded originals retained in docs/adr/archive/), and removed the
  post-v1.0-retraction "contrition" framing from the public docs while keeping
  the honest per-scenario scoping. The 0.x version line is the sole
  pre-stability signal. Added scripts/check_adr_references.py as a CI guard
  against dangling/stale ADR references.
• ADRs are now living documents (previously: immutable after acceptance).
  Editorial edits are made in place — git holds the history; material decision
  changes are recorded as dated ## Amendments entries, never silent
  overwrites — mirroring Stigmem's own supersede-with-a-record model for facts.
• Feature graduation Gate 4 (ADR-008) changed from a mandatory 30-day
  external-operator soak to an internal-quality bar; external-operator
  validation relocated to the 1.0 GA stability gate (ADR-001).

Fixed

• Removed stale recall consecutive-failure wording and tracked state now that
  recall regressions block immediately once a non-zero baseline is frozen.
• Made the tag coverage workflow tolerate the release-creation race by keeping
  the generated artifacts and coverage branch green when coverage.xml cannot
  be attached to the GitHub release before the publish workflow creates it.

Security

• GHSA-5p3m-vhh6-9236 — blind SSRF via webhook delivery_address.
  Completed remediation of the webhook delivery SSRF. delivery_address is now
  validated at subscription-creation time (https-only by default), and webhook
  delivery resolves the host once and pins the connection to the validated IP,
  closing a DNS-rebinding TOCTOU window while preserving the Host header and
  TLS SNI so certificate verification still binds to the original hostname.
  Reported by @chaitanyagarware — thank
  you for the responsible disclosure. (#726)
• Hardened the outbound SSRF address filter to classify IPv4-in-IPv6 embeddings
  (IPv4-mapped ::ffff:, 6to4, NAT64) and RFC 6598 CGNAT space as non-public,
  closing a bypass where an attacker-controlled AAAA record could smuggle a
  blocked IPv4 (loopback, cloud IMDS, or RFC 1918) past the guard. Classification
  now uses the stdlib address flags in addition to the explicit denylist.
• Bumped the hono workspace override from >=4.12.18 to >=4.12.23
  (resolving hono@4.12.18 → 4.12.23), clearing the four moderate Hono
  advisories surfaced by pnpm audit (IP-restriction static-deny bypass,
  cookie sameSite sanitization, JWT-middleware Authorization-scheme
  acceptance, and app.mount() undecoded-prefix handling). pnpm audit
  now reports no known vulnerabilities.
• Updated the locked aiohttp transitive dependency from 3.13.5 to
  3.14.0, resolving Dependabot alerts GHSA-hg6j-4rv6-33pg and
  GHSA-jg22-mg44-37j8 in optional adapter/provider dependency paths.
• Corrected the six published v0.9.0a2 Critical/High GitHub Security
  Advisory affected ranges from <0.9.0a2 to ==0.9.0a1, matching the
  reset-line vulnerable artifact and preventing false-positive Dependabot
  alerts against later alpha lockfile entries.