ContextLattice v4.0.8: Right Context. Right Worker.

ContextLattice v4.0.8: Right Context. Right Worker.

Agent continuity is dependable only when retrieval failure is reported honestly, search intelligence can be evaluated without silently changing live results, and task leases preserve the identity of the runner that claimed them. v4.0.8 closes those truth and routing gaps.

The CLI remains the primary interface. The dashboard, HTTP, and MCP remain companion surfaces.

What Changed

• Agent policy packs remain parseable when scoped retrieval is unavailable, empty, malformed, inconsistent, or too large for an argument vector. The pack now reports ok=false, retrieval.degraded=true, and the canonical degraded-memory directive instead of false health.
• Search candidates now carry full-digest identity for candidate, content, passage, and locator state. True duplicates can merge without collapsing distinct passages from the same file.
• A bounded shadow frontier records query alignment, provenance, trust, contradiction, diversity, acquisition risk, and expected-regret signals while preserving literal production result order.
• Context-pack quality samples can retain opaque selection receipts, and candidate outcomes require exact sample, project, receipt, candidate, verifier, and evidence binding before becoming eligible for advisory reputation or causal analysis.
• Search-impact evaluation is scoped, chronological, denominator-bound, and fail-closed. It abstains unless comparative saved cases, independently reconciled outcomes, and causal evidence satisfy every gate.
• External task clients send one trimmed worker identity in both the claim query and JSON body for mixed-version compatibility.
• The commercial gateway accepts worker identity from either location, rejects conflicting non-empty values with 400 before mutation, filters assignment eligibility before comparing priority, and persists the resolved worker in the task lease and claim event.
• Named workers can claim matching assignments plus empty or any tasks. The default gateway-worker path is explicitly limited to internal, gateway, empty, or any assignments.

Evidence Boundary

The policy-pack contract passed a 15-case isolated response matrix, including transport failure, malformed response shape, contradictory lifecycle state, invalid result rows, and a body larger than the host argument limit. Installed success and failure paths retained the same truthful contract.

Search intelligence passed focused, race, full-module, vet, cross-build, projection, privacy, provenance, persistence, and strict-storage holdouts. Its current impact status remains abstain: no learned or calibrated ordering is applied to live results, and no canary or activation is performed.

Worker routing passed the focused Go contract and race suites, the full gateway suite, Go vet, the worker and surrounding Python suites, archived-client compatibility, open-core boundary checks, and all three lane projections. A source-bound isolated gateway built from the merged implementation rejected a conflicting query/body identity without mutation, left a priority-100 foreign task queued, claimed the matching priority-10 task, and retained the exact worker in the row, lease, and claim receipt across a scoped restart cycle.

What Did Not Change

• Owner memory remains authoritative; vector stores remain derived retrieval projections.
• Search intelligence is shadow and advisory. It does not reorder production results, activate a canary, call a provider, or make an additional network request.
• The public client and agent guidance carry the dual-location worker contract; paid routing enforcement remains within the commercial gateway boundary.
• Existing task-store rows remain schema-compatible. No data migration is required.
• Public local mode remains account-free, and raw memory remains local by default.
• Aggregate Signal remains a controlled activation preview under its existing privacy and utility gates.
• The public Apache-2.0 and commercial BUSL-1.1 source boundary remains unchanged.

Upgrade

Update all external runners together with the gateway when possible. Mixed-version clients remain compatible because the worker is sent in both supported locations. A caller that supplies both locations with different non-empty values must correct the request; the gateway intentionally refuses to guess.

Rebuild and restart only the exact gateway process or container from the v4.0.8 source, then verify /health, run a representative named-worker claim against isolated task state, and confirm the persisted lease and event carry the same worker identity. No task-store migration is needed.

Rollback remains tag-pinned. Existing task files can be read by the prior release; queued assignments and completed history do not require rewriting.