v0.50.0: the estate memory is back, with no model and no network

The estate memory is back, with no model and no network. A minor: one new capability, two new variables (PROXIMO_MEMORY, on by default, and PROXIMO_MEMORY_PATH), four new verbs on the core door. Nothing an existing setup sends changes; PROXIMO_MEMORY=0 creates nothing.

What Proximo has seen, answered from one file. Every governed read of a source the estate reads (cluster resources, storage, pools, backup jobs, ACLs, a node's network, a guest's config and pending) already fed memory.db, one SQLite file beside the ledger. proximo-core learn is the one deliberate pass, every read through the engine and receipted, and it says when it is incomplete and why. where 105 answers the kind, node, status, how old the answer is, and the published path that reads the thing live. uses local lists the guests with a disk or a NIC on a storage or bridge, by slot, and is incomplete while any guest's config is not in memory. changed 24h lists what was added, what is gone and whose status changed; gone means every whole read that had listed it has since read whole without it. A thing memory has not seen is "not in memory", never "does not exist", and an empty memory answers with no count at all. Derived, never proof: the ledger never reads it, and every memory answer is a core.recall row on it.

Owner-only, bounded, and taint survives storage. The file is created 0600 and opened read-write, never creating; a symlink, a hard link, another owner, a group or other bit, or an empty file memory did not create is refused, never quietly tightened. Names and tags are cut to 120 characters and an id longer than that is not kept; a read over 20,000 rows is not kept; a box holds at most 50,000 entities and 200,000 edges; every answer fits 4 KB and a path is never cut. A row from an untrusted address keeps the mark, and an answer built from it marks the session as the read did. Three adversarial rounds ran on the branch; each fix carries the probe that was red before it.

The one-line description says what Proximo is: the governed client for Proxmox, of which MCP is one door. On PyPI, the MCP registry, LobeHub, the Debian package and the LXC listing it read "the Proxmox MCP you can hand the keys", a frame that was never the product.

Also: docker/login-action 4.7.0 pinned by the SHA of its release (Dependabot #112); the curated public commit now ends with a Co-authored-by trailer for every outside author of the release range, and RavenLiao's #107 is merged on GitHub as his.

4,323 tests.

Full history for this release, commit by commit, is on the internal mirror; this public branch carries one squashed commit per release by design. Every change here is described in CHANGELOG.md.

Where to read more

• The estate memory, its verbs and its variables: docs/SETUP.md
• What each control honestly holds: SECURITY.md
• Verifying the image signature, the SBOM and the provenance yourself: VERIFY.md
• Full change detail: CHANGELOG.md

Install: uvx proximo-proxmox · pip install proximo-proxmox · ghcr.io/john-broadway/proximo:0.50.0