Skip to content

v0.1.0 — first public beta

Choose a tag to compare

View all tags
@saiyam1814 saiyam1814 released this 26 Aug 17:01
· 4 commits to main since this release
v0.1.0
dc9590b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The first public beta. Everything here was found by running the tool against a real install rather than a fixture, which is why the version moved off 0.0.x.

Fixed

  • Canon push/pull actually round-trips — authenticated, project-scoped export/import preserving hashes, identity, content and attestation with safe merge semantics (#65)
  • Explicit saves survive retention — a durable mem::remember path with honest authorship, supersession, deletion receipts, and path normalization hardened against traversal, null bytes and symlink escapes (#66)
  • MCP search is firewalled and labeled — trust classification runs independently of the inclusion policy; search defaults to project-scoped current recall (#67)
  • Consolidation preserves distinct same-file claims instead of folding two different decisions about one file into one memory (#68)
  • Project identity is separate from checkout path, so worktrees of one repo stop confusing scoping across search, doctor, why, consolidation, Canon, bundles and fleet (#69)

The statistic we published was wrong

The half-life study's quantile helper took the upper-middle value for even samples instead of averaging the two middle ones, biasing every median high. The 180-day median is 61.8%, not the previously published 78.1%.

Worse, the bug masked the sensitivity analysis. fastapi's 180-day rate is 11.8% with localized docs excluded and 71.5% with them included — but both orderings placed 78.1% at the same index, so the two runs looked identical and that coincidence was reported as evidence of robustness. It was not. Fixed with tested R-7 quantiles plus a pinned four-repository manifest, both control arms, microdata and hashes, so anyone can recompute it (#70).

Added

  • The release is gated on the packed npm artifact, not the repo. The exact npm pack output is installed under an isolated HOME and driven through real CLI, daemon, MCP, authenticated HTTP, persistence, Canon, erasure and clean shutdown — on Linux, macOS and Windows. This is precisely the check that would have caught the 0.0.5 defect where consolidate.js was simply absent from the published tarball (#71).
  • A cosmetic trust state. A reformatted file whose normalized content is unchanged is labeled source-cosmetic — current, but explicitly not byte-identical — and is admitted under verified-only. Two eval gates bound it: cosmetic-admitted (reformatted memory flows under strict policy) and cosmetic-bounded (genuinely drifted memory is still refused). The pair is the point; alone, the first would let "cosmetic is allowed" drift into "any change is allowed" without the eval noticing.

Install

npm install -g memwarden
memwarden up
memwarden status        # daemon, firewall activity, storage
memwarden doctor .      # trust audit of this project

Memories captured before 0.0.8 keep their older shape and age out through normal retention. npm run inspect (from a clone) grades your store; memwarden doctor . --fix-stale clears stale records now.

824 tests · firewall eval 10/10 gates · packed-artifact smoke on Linux, macOS and Windows · published with SLSA provenance.

Assets 2
Loading