v0.2.0a2 — honest-install fix + GHA actions v6 bump (pre-release)

Pre-release. Behavior-preserving patch on top of v0.2.0a1 following a post-release 3-agent re-audit. The three v0.2 surfaces (Article 12(2) export, MCP audit-verify, cross-repo emit shim) are byte-identical to v0.2.0a1; their public APIs and on-disk artefacts have not changed.

Why this exists

The post-release audit (architect + GitHub-state verifier + meta-critic, run in parallel against v0.2.0a1) surfaced:

• A-tier finding (immediate fix) — README.md's install command was pip install memcanon, but memcanon is not on PyPI: curl -sI https://pypi.org/pypi/memcanon/json returns HTTP/2 404 {"message": "Not Found"}. A first-time reader running the documented command would have seen ERROR: No matching distribution. This is a ship-and-yank style hazard.
• B-tier findings (short-term) — the README Status line still said 0.1.1 (alpha) (now reflects v0.2 pre-release); Systima's MIT-licensed @systima/aiact-audit-log was named only in CHANGELOG's R14-round-2 section, not in the README's Article 12(2) section (now named as prior art); and actions/checkout@v4 + actions/setup-python@v5 still ran on Node 20, which GitHub deprecates on 2026-06-02 (now bumped to @v6).

Install (PyPI not yet available)

pip install "git+https://github.com/hinanohart/memcanon@v0.2.0a2"

Optional extras (Mem0 adapter / Letta adapter / HuggingFace embedder slot) follow the same git+https form documented in the README.

Out of scope (deliberate)

• No change to article12.py / mcp.py / emit.py. All 165 unit tests pass with no edits.
• __init__.py re-export of v0.2 surfaces is intentionally deferred — module-level imports work; this would be a soft API change deserving its own version.
• PyPI publication, Systima JSON field-name interop, and zk policy-private exploration all remain on the v0.3 backlog.

Local CI parity at release

All 11 CI steps reran locally before push: ruff + mypy + pytest 165 passed + 6 honest-marketing guards + golden vectors + README render check + measure-roundtrip check, every step green.

🤖 Generated with Claude Code

v0.2.0a1 — Article 12 export + MCP + cross-repo emit (pre-release)

⚠️ Install path bug — please use v0.2.0a2 instead. The README shipped at this tag (v0.2.0a1) documents pip install memcanon, but memcanon is not on PyPI yet and that command produces ERROR: No matching distribution. The fix shipped in v0.2.0a2 (pip install git+https://github.com/hinanohart/memcanon@v0.2.0a2); v0.2 surfaces are otherwise byte-identical between v0.2.0a1 and v0.2.0a2.

---

Pre-release of memcanon's v0.2 surfaces. The v0.1 canonicalization + content hashing core (memcanon-c14n/1) is unchanged, and all v0.1 stores/bundles remain valid.

New (all opt-in, all SHAPE-only)

• Article 12(2) paragraph-mapped export — memcanon export --format eu-ai-act-12 --to OUT.json [--system-id ID]. Pinned at memcanon-eu-aiact-12/1. Operator-tag relay; NOT a conformity assessment, NOT a CE mark, NOT legal advice.
• Minimal MCP-compatible audit-verify server — memcanon mcp serve --source SOURCE. NDJSON JSON-RPC 2.0 over stdio, subset only. Three read-only tools: audit_summary, audit_verify_hash, audit_export_article12. Reports protocolVersion = memcanon-mcp/0.1 — NOT the full mcp SDK.
• Cross-repo emit shim — memcanon.emit.emit(source, event, store=...) accepts events from subjunctor / exitkit / foldconsensus / scorewright. Tags records source:<name> + schema:memcanon-emit/1.

Honest-marketing CI (6 guards)

banned-phrase / placeholder / version-string / Article-12 schema smoke / MCP smoke / emit smoke. CI green on Python 3.11 + 3.12.

Why this pivot (R14 round-2 5 fatal findings on attestlog)

C1 Systima @systima/aiact-audit-log MIT pre-existing /
C2 hinanohart/memcanon self-overlap (R17) /
C3 Halo2 + maturin + PyO3 + 12-week autonomous infeasible /
C4 EU Digital Omnibus 2027-12 deadline-evaporation risk /
C5 v0.1.0a1 scope could not mechanically verify "policy-private" Tagline.

See full CHANGELOG entry for details.

🤖 Generated with Claude Code

v0.1.1 — robustness, reachability & honesty fixes

Patch release from a full fresh-eyes re-audit of v0.1.0 by three independent reviewers (architecture-compliance, code-quality, anti-fake critic). The headline metrics were re-confirmed real, reproducible, and non-circular — no yank risk. No change to the canonicalization rule or any content hash; memcanon-c14n/1 is unchanged and all v0.1.0 stores/bundles remain valid.

Added

• import / export --adapter mem0|letta — move records to/from a vendor backend directly from the CLI (was a Python-API-only capability), with --user-id/--agent-id; writes stay verbatim (infer=False). The locked adapter path is now reachable from the binary, the README claim is accurate, and exit code 6 is reachable.
• doctor --probe mem0|letta — reports vendor adapter reachability.

Fixed

• verify / doctor / diff / dedup no longer crash with a traceback on a corrupt SQLite DB, malformed bundle JSON, or hand-edited non-object markdown front-matter — they surface a drift/validation report or a clean exit code.
• Exit code 4 (version mismatch) is now reachable.
• LocalStore.open() failure after the advisory lock is taken no longer orphans the lock.
• Markdown record files written atomically (temp + os.replace).
• HF embedder fails closed when HF_TOKEN is unset (no surprise network call).
• Transfer journal best-effort-fsyncs its parent directory on create.

Changed

• results/v0.1.0_roundtrip.json → results/roundtrip.json (values unchanged: 100% round-trip invariance over 946 checks, 100% dedup correctness).
• Removed dead, always-true TransferResult.ok.

116 tests pass; ruff + mypy --strict clean; golden/metrics/README reproducibility gates green; CI green on Python 3.11 and 3.12.

memcanon v0.1.0

First alpha release.

memcanon gives every agent-memory record a deterministic content hash over a normative canonical form (memcanon-c14n/1), then builds verify / diff / dedup / doctor on top — usable at N=1 (a single local store), no vendor cooperation required.

Measured (reproducible from a clean clone via scripts/measure_roundtrip.py --check):

• Round-trip content-hash invariance: 100% over 946 checks across 3 paths (store↔store, adapter snapshot, crash+resume)
• Dedup correctness: 100% (16/16 groups, no false groups)

Highlights: stdlib-only correctness core, golden vectors cross-checked by an independent re-implementation, SQLite+markdown LocalStore with drift detection, crash-resumable transfer journal, optional Mem0/Letta adapters (lossless: infer=False, exhaustive pagination), optional pass-through embedding slot. Apache-2.0.