ContextLattice v4.0.7: State Without Guesswork

ContextLattice v4.0.7: State Without Guesswork.

Durable agent memory depends on more than a healthy process. Every gateway-owned state surface must resolve to persistent storage, operators must be able to prove where it lives, and upgrades must preserve both current data and a bounded recovery path. v4.0.7 closes that lifecycle gap.

The CLI remains the primary interface. The dashboard, HTTP, and MCP remain companion surfaces.

What Changed

• The public lane inventories 33 public-core state surfaces beneath one canonical CONTEXTLATTICE_GATEWAY_STATE_ROOT; the commercial lane adds 14 owner-only surfaces for 47 total. Both inventories are independent of the process working directory.
• Existing absolute per-surface path variables remain higher-priority compatibility overrides.
• Full and Lite Compose persist the canonical root at /data/memory-bank/_contextlattice on the operator-selected memory-bank volume.
• /status, /telemetry/storage, contextlattice state status, and contextlattice doctor expose the resolved path, storage tier, persistence class, override source, and access result for every state owner.
• contextlattice state migrate plans migrations without mutation by default, supports one regular file or a directory tree, and requires explicit confirmation to apply.
• Migration manifests bind the source type, canonical roots, path inventory, byte counts, and SHA-256 digests. Symlinks, special files, destination conflicts, insufficient space, and reserved migration namespaces fail before commit.
• contextlattice state rollback restores only manifest-bound, unchanged content and refuses to remove canonical files that changed after migration.
• The gateway now handles SIGTERM and SIGINT with a bounded HTTP drain. A completed drain exits zero and emits gateway-go shutdown complete; a timeout closes the listener and exits nonzero.
• Final decision records close the parked runtime, toolset, objective-state, external-provider discovery, container-runtime, and macOS distribution research loops without silently expanding credentials, network calls, or runtime scope.

Evidence Boundary

The commercial release candidate was exercised against the existing local ContextLattice installation. The v4.0.6 session ledger was migrated as a single 62,118,723-byte regular file, rolled back, digest-verified, and reapplied before restart. The installed candidate retained 512 sessions, all 47 commercial state owners reported healthy and writable, Qdrant payload indexes remained ready, and a real scoped checkpoint write/readback returned without degraded mode.

Failure-injection coverage includes copy failure cleanup, insufficient space, destination conflicts, source changes before commit, symlink and reserved-namespace escapes, manifest path tampering, changed-destination rollback refusal, graceful drain, and forced drain timeout. Exact merged-release installation proof is required before this release is declared complete.

What Did Not Change

• Owner memory remains authoritative; vector stores remain derived retrieval projections.
• Public local mode remains account-free, and raw memory remains local by default.
• The migration command never applies without --apply --yes; rollback never applies without --yes.
• Timestamped migration backups are intentional recovery copies and remain until the operator accepts restart and retrieval proof, then retires them through normal backup policy.
• External provider discovery remains network-free by default. No paid provider call, login, logout, account change, or credential mutation is implied.
• The macOS DMG remains an unsigned technical preview until a human supplies and authorizes Developer ID signing and notarization credentials.
• Aggregate Signal remains a controlled activation preview under its existing privacy and utility gates.
• The public Apache-2.0 and commercial BUSL-1.1 source boundary remains unchanged.

Upgrade

Stop only the exact gateway writer after identifying its PID or container and active dependents. For the v4.0.6 Compose session ledger, first review a dry run:

contextlattice state migrate \
  --legacy-root /data/agent_sessions.json \
  --state-root /data/memory-bank/_contextlattice \
  --pretty

Apply only after the plan, digests, conflicts, and free-space result are accepted:

contextlattice state migrate \
  --legacy-root /data/agent_sessions.json \
  --state-root /data/memory-bank/_contextlattice \
  --apply --yes --pretty

Rebuild and restart the gateway from the exact v4.0.7 source, then run contextlattice state status, contextlattice doctor, and a representative scoped retrieval readback. Preserve the timestamped legacy backup and migration manifest until that evidence is accepted.

Rollback requires the exact manifest, an unchanged canonical destination, and explicit confirmation:

contextlattice state rollback \
  --manifest /data/memory-bank/_contextlattice/.migrations/<migration-id>.json \
  --yes --pretty

If the canonical session ledger has received live writes, rollback correctly refuses to remove it. Stop the writer and use the retained backup through the operator's recovery procedure instead of bypassing the digest guard.