Verified Memory 0.4.1

Verified Memory 0.4.1

A small follow-up to 0.4.0. Signature, sequence, revocation and stop-on-change behavior are unchanged.

Changed

• A pack with 0 records is refused at load. An empty records.jsonl used to load and answer every search with no matches. Now the server refuses to start, exits 1, and prints: pack has no records; records.jsonl must hold at least one record. The OpenClaw plugin and the pack maker refuse such a pack too.
• sign-pack ships in the npm package as the verified-memory-sign-pack command. No checkout is needed to sign a pack: npx -y -p @python1/verified-memory-mcp verified-memory-sign-pack --pack my-pack --key ~/.ssh/verified-memory-pack --expires 90d --sequence 1 --out my-pack-signed. It never opens the private key; ssh-keygen does.
• Pack maker: the Strict checkbox now reads "require a pinned or trusted signature", matching what it checks.
• Pack maker site: deploys automatically on every push to master, and can still be run by hand.

Documentation

• README and VALIDATION.md now say plainly: quotes are checked against their source messages when the pack is built, and after that the signature protects them. The server does not re-check quotes against message_sha256 at load or serve time.

Compatibility

• Every pack that loaded on 0.4.0 loads on 0.4.1, except one with no records.
• Node: MCP server >=22.0.0, unchanged.

Downloads

• verified-memory-0.4.1.mcpb, SHA-256 fb7bc64d21ba000e3e0ca1a3bf00441b177d92615ddfef73d54b4ac928d41873. It is not code-signed, so Claude Desktop shows its "not verified by Anthropic" warning for add-ons installed from a file.
• npm: @python1/verified-memory-mcp@0.4.1