v0.4.3 — security release: hashed user keys, throttled and audited key checks, HTTPS profile, JSON distillation input

Before you upgrade

This release finishes the October security review. Check these before you upgrade; each one links to its section in UPGRADE → To 0.4.3.

If …	Then …
Docker runs rootless	memory-core sees every client as one address, so 20 wrong keys from anyone lock everyone out for 15 minutes. Set AGENT_MEMORY_THROTTLE_LOCK_AFTER=0, or put a reverse proxy on the host and trust it (rootless Docker)
Many people share one address (an office NAT, a VPN gateway)	A lockout refuses valid keys too, for everyone behind the address: check the addresses on Panel → Metadata → Audit after upgrading, and raise or turn off the lock (refused keys)
memory-core sits behind a reverse proxy other than the bundled Panel and Caddy	Name it in AGENT_MEMORY_TRUSTED_PROXIES, or every client counts as the proxy's address
A script calls internal/upgrade with issue_key to get a fresh admin key	It is refused unless there is legacy data to move or AGENT_MEMORY_ALLOW_KEY_RECOVERY=true (keys)
A script creates users or the first admin with its own key (user_key)	Use sk-mem- and at least 32 letters, digits, - or _
A department has custom memory prompts that mention the input's old labels, such as [New messages to extract]	Refer to the JSON fields instead (distillation input)

Existing installs keep listening where they did (upgrade.sh adds BIND_ADDR=0.0.0.0); new installs listen on 127.0.0.1 unless told otherwise.

Warning

Going back to 0.4.2 after this upgrade means restoring the backup. memory-core runs schema migration 6 at startup, which replaces every stored user key by its SHA-256 digest; 0.4.2 refuses data at schema version 6. upgrade.sh takes the backup; UPGRADE → Roll back restores it.

git fetch --tags && git checkout v0.4.3
./upgrade.sh

Then update amem on each client (REMOTE-CLIENTS §4).

Security

Advisories: GHSA-x7mg-477v-vq57, GHSA-pfg6-rm9f-v293, GHSA-rhcg-v6f6-2959, GHSA-2374-jpw4-x82w, GHSA-4h9p-q8r4-vxc7, GHSA-w56f-hx28-m78m.

• User keys are stored as SHA-256 digests (schema migration 6, converted in place; existing keys keep working). A lost key cannot be read back; a system admin issues a new one. internal/upgrade issues a key only along with legacy data to move, or with AGENT_MEMORY_ALLOW_KEY_RECOVERY=true.
• Refused credentials are throttled per client address: from the 5th in 15 minutes each refusal waits longer (up to 5 s), the 20th locks the address out for 15 minutes (429 with Retry-After). X-Forwarded-For counts only from trusted proxies (AGENT_MEMORY_TRUSTED_PROXIES). Limits: AGENT_MEMORY_THROTTLE_{DELAY_AFTER,LOCK_AFTER,LOCK_MINUTES}, 0 turns them off.
• Credential audit log: refusals, lockouts and keys issued with the server API key, with time, address, forwarding chain, user agent and the start of the key's digest, never the key. Kept 90 days. System admins see their department's on Panel → Metadata → Audit; the operator sees all with /v3/internal/audit/list.
• The distillation model gets all its input as JSON data: L1 extraction and dedup, L2 scenes and L3 persona, as skill extraction does since 0.4.2.
• amem closes the recall blocks it opened when it cuts a context, does not follow redirects (nor do the operator commands), creates its files private from the start, reads every word after -- as the query, and can trust a private CA (--ca-cert).
• Panel: the session key is kept per browser tab, a revoked key stops working within 10 s, a Content-Security-Policy is sent, and the browser's address is forwarded to Core.
• Smaller: internal errors answer with their code and request id only; an agent's owner who left its team can no longer manage the agent; a binding records the caller who set it; name filters treat % and _ literally; init-admin creates one administrator when called at once.

What's new

• New installs keep the ports on this machine. install.sh asks who reaches the server: this machine (BIND_ADDR=127.0.0.1, the default), other machines over HTTP, or other machines over HTTPS.
• An optional tls Compose profile puts Caddy with HTTPS in front of memory-core and the Panel (TLS guide).

Fixes

• Tasks whose skill proposals all expired are closed hourly.

Full list: CHANGELOG → 0.4.3.