Skip to content

v0.9.0a6 — preview alpha

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 May 07:20
· 92 commits to main since this release
v0.9.0a6
703d30e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Published artifacts:

  • PyPI: pip install --pre stigmem-py==0.9.0a6 (also: stigmem, stigmem-node, stigmem-openclaw)
  • npm: npm install @eidetic-labs/stigmem-ts@0.9.0-alpha.6
  • GHCR: docker pull ghcr.io/eidetic-labs/stigmem-node:0.9.0a6 (also :0.9.0-alpha.6)
  • Supply-chain evidence: GHCR image is keyless-signed with Sigstore/cosign; SBOM and BuildKit provenance are attached as OCI referrers. Verification instructions: https://docs.stigmem.dev/operators/release-verification
  • GPG signatures: The release tag is maintainer-signed. Detached artifact signatures may be uploaded manually after publication.

[0.9.0a6] — 2026-05-22

Status: preview alpha — pre-stable, not for production federation across
organizational boundaries. Memory Garden advanced ACL remains experimental,
opt-in, and operator-gated.

Per-ecosystem version strings (per ADR-019):

  • PyPI / Python: stigmem 0.9.0a6, stigmem-py 0.9.0a6, stigmem-node 0.9.0a6, and stigmem-openclaw 0.9.0a6 (PEP 440).
  • npm / Node: @eidetic-labs/stigmem-ts@0.9.0-alpha.6 (semver).
  • GHCR: ghcr.io/eidetic-labs/stigmem-node:0.9.0a6 and :0.9.0-alpha.6.
  • Git tag, GitHub release, prose: v0.9.0a6 (shorthand).

Changed

  • Advanced the enforced release-version surfaces to the v0.9.0a6 alpha line
    across Python packages, npm packages, API metadata, conformance metadata,
    plugin compatibility defaults, release documentation, and current-facing
    adopter guidance.
  • Validated the v0.9.0a6 Memory Garden advanced ACL alpha horizon in the
    feature-owned records. Basic garden CRUD, membership, direct garden_id
    guards, and quarantine moderation remain core; advanced cross-surface ACL
    behavior remains opt-in behind stigmem-plugin-memory-garden-acl
    registration and operator gates.

Security

  • Recorded the Memory Garden advanced ACL cross-surface disposition for fact
    query filtering, recall ranking, graph traversal, OIDC permission ceilings,
    subscription delivery/replay, and quarantine moderation. The feature supports
    and coexists with R-21 mitigation work but does not itself close
    same-session read/write graph isolation.
  • Documented Memory Garden ACL posture explicitly: default deployments enforce
    direct garden_id read guards but do not filter tenant-wide queries, recall
    ranking, push subscriptions, OIDC permission ceilings, or graph traversal
    unless stigmem-plugin-memory-garden-acl is installed, registered, and the
    per-surface enablement flags are set. SECURITY.md, quickstart, a startup
    warning, and the /v1/doctor endpoint now surface the opt-in posture.
  • Recorded the /v1/doctor disclosure disposition: the unauthenticated
    endpoint exposes only coarse memory_garden_acl_filtering posture in
    v0.9.0a6; future hardening can auth-gate the endpoint or suppress the
    posture field for anonymous callers.
  • Plugin scaffold handlers in stigmem-plugin-memory-garden-acl now carry
    docstrings explaining stub behavior, failure modes, and core fallback.
  • Quarantine moderator node-admin bypass is now documented in code and in the
    Memory Garden advanced ACL feature security record.
  • Release signing key hygiene now excludes stigmem-release-signing-key*.asc
    and private/secret signing-key .asc files from the repository.
Assets 2
Loading