v1.6.0

Added

• Passkey sign-in for the admin panel. The operator gives the panel owner a
  one-time setup link (memrain admin setup-link, or POST /admin/api/setup-links with the bootstrap token); the owner registers a
  passkey and gets ten single-use recovery codes. A Security page lists,
  renames and revokes passkeys, adds another, replaces recovery codes and
  shows sign-in events. The bootstrap token and magic links keep working as
  the operator's way in. Needs MEMRAIN_PUBLIC_URL set to the panel's
  https:// address.
• A passkey created from a recovery code, or from a setup link while another
  passkey exists, starts in a 24-hour cooldown that blocks creating lasting
  access and removing the owner; the owner's first passkey from a setup link
  has none.

Changed

• Admin POSTs from a browser must come from the configured public origin,
  scheme included, when MEMRAIN_PUBLIC_URL names the request's host.
• /admin responses carry a Permissions-Policy that allows WebAuthn only on
  the panel's own origin.

v1.5.0

Added

• The admin Overview shows charts with 7, 30 or 90 days of history: agent
  calls and errors, searches, spend against the daily cap, corpus growth
  (pages, edits, facts), top tools and top agents, with a "what changed"
  comparison against the previous period.
• GET /admin/api/timeseries, GET /admin/api/graph/hubs and
  GET /admin/api/onboarding feed the charts, the Graph home view and the
  setup checklist. All three are admin-only aggregates and make no model calls.
• Every admin page opens with a short explanation, every metric has a ?
  help button, and a Glossary page explains pages, facts, entities, chunks,
  links and the other terms the panel uses.
• A Setup guide and a first-run checklist walk a new admin through connecting
  an AI agent (the instance's MCP URL plus Claude Desktop, Claude Code and
  ChatGPT instructions), writing a first page and running a first search; each
  step is ticked from real activity.
• The Graph page opens on the most connected pages instead of an empty slug
  box, and explains what a link is.

Changed

• Traffic, error-rate and per-credential usage counts leave out tools/list
  handshakes and webhook deliveries, so they agree with the new charts.

v1.4.0

Added

• The admin panel opens on an Overview cockpit: brain health, request
  traffic and error rate, today's spend against caps, the job queue, corpus
  counts (documents, pages, chunks, facts, entities, links) and the live feed.
• A brain explorer inside the admin panel: Search, Pages with a page view
  (rendered body, tags, versions, backlinks, outgoing links, neighbor graph),
  Entities and facts, a Graph view, a Timeline and a Spend page, plus a ⌘K
  palette that jumps to any page.
• POST /admin/api/tool serves the explorer. It accepts an allowlist of 18
  read tools plus add_tag / remove_tag, rebuilds each call's arguments
  from a per-tool key list with clamped limits, and runs search with every
  paid stage off (no rerank, expansion or LLM intent; one query embedding).
  Embedding calls share a rate limit, every call is written to the request
  log as admin-panel, and panel rows stay out of the traffic and error-rate
  indicators.

Security

• /admin responses carry a strict Content-Security-Policy,
  X-Frame-Options: DENY, X-Content-Type-Options: nosniff and
  Referrer-Policy: no-referrer. The admin page no longer loads web fonts
  from a third party.
• Page bodies render through an escape-only markdown renderer; links keep
  only http, https and mailto targets.

v1.3.0

Changed

• The built-in model defaults move to the 5.5 generation: the utility tier
  runs on Claude Haiku 5.5 (eu.anthropic.claude-haiku-5-5) and the reasoning
  tier on Claude Sonnet 5.5 (eu.anthropic.claude-sonnet-5-5). Installs that
  set MEMRAIN_UTILITY_MODEL / MEMRAIN_FACTS_MODEL keep what they set. A
  fresh install needs model access to both 5.5 models in its Bedrock account;
  the IAM policy already allows them.

v1.2.2

Fixed

• memrain skillify and friction propose-fix ask the utility-tier model
  (MEMRAIN_UTILITY_MODEL) instead of a pinned Claude Haiku 4.5. An explicit
  SKILLIFY_MODEL_ID still wins.

v1.2.1

Fixed

• A recursive this.save() / self.save() inside save no longer becomes a
  call edge that code_flow and code_blast resolve to another class's
  save. Run memrain reindex --source code --all to drop existing ones.
• A subagent job refused by the brain or cycle daily cap is deferred to the
  next UTC day and resumed from its ledger, instead of finishing as
  budget_exhausted.
• docs: MEMRAIN_SECRET_SCAN_ALLOW takes 16-hex fingerprints, as the
  redaction marker prints them.

v1.2.0

Added

• Six ranking changes ship behind MEMRAIN_RANK_* flags, all off by default:
  METADATA_GATE (metadata boosts only when a lexical arm voted),
  ENTITY_TRUTH_SOFT, KEYWORD_OR_RETRY (OR keyword pass when the vector arm
  is empty), PAGE_FUSION (fusion per page instead of per chunk),
  KEYWORD_CONFIDENCE and EXACT_LOOKUP. With every flag off results and
  cache keys are unchanged. Operators also get meta.confidence
  (strong, moderate, weak, or unknown on a cache hit).
• memrain eval A/B runs flip env per query, interleave the two sides,
  record latency and report per-metric deltas with cluster sign-flip
  p-values and Holm correction. Qrels gain dev/sealed splits, clusters and
  expected_top1; a sealed run needs a preregistration and runs once.
  memrain eval qrels build writes private qrels from stored eval queries.
  docs/eval/PREREG-TEMPLATE.md describes a ranking decision.
• Links to pages that do not exist yet are remembered and reconnected when
  the page is created, restored or renamed; wanted_pages lists them.
• A capped links-stale cycle phase re-extracts pages when the link extractor
  version or the link switches change (MEMRAIN_LINKS_STALE_MAX_PER_CYCLE,
  default 200, 0 off).
• context_pack entity cards list up to 8 newer mentions
  (MEMRAIN_CONTEXT_NEWER_MENTIONS=0 turns this off).
• code_def, code_callers, code_refs, code_callees, code_blast and
  code_flow take lang; mentions carry language, kind and line range;
  code_callees accepts a symbol name. A code-graph doctor check reports
  code documents without definitions and stale unresolved edges.
• MEMRAIN_SEARCH_SNIPPET_CHARS caps each search/query hit to that many
  characters with a pointer to page_get (default 0, unchanged).

Fixed

• code_blast and code_flow returned nothing for class methods because
  call edges store the callee as written; walks now match bare or qualified
  names, stay in one language, read only live visible documents and suggest
  names on a miss. Go pkg.Fn() calls and this.repo.save() delegations
  become edges, and map.get is no longer an HTTP sink. Edges are written in
  the document's transaction.
• Graph reads (graph_neighbors, graph_query, traverse_graph,
  get_links, relational recall) no longer return deleted, archived or
  quarantined pages. Verb inference no longer types former roles or board
  seats as employment.
• memrain eval gate fails on query errors and on latency above
  --max-latency-x (default 2.0); A/B receipts no longer count as the
  nightly probe snapshot.
• Jobs pass their abort signal to agent model calls. Daily-cap refusals that
  clear at midnight defer the job instead of spending retries; permanent ones
  fail it. Background mirrors are charged to the client that wrote the page,
  under its cap.
• secrets audit scans slugs and fails when a rewritten page's search mirror
  could not be refreshed.
• Chunks that Bedrock rejects for their content stop blocking the embed-gaps
  phase after three attempts (migration 140); infrastructure errors no longer
  count against a chunk.
• JSON-RPC batches and add_fact items count against both rate limiters.
• Quarantined content no longer feeds atoms, facts backfill, on-write fact
  extraction, reflections, thin-page enrichment or drift.
• With MEMRAIN_OWNER_ENTITY set, a user claim that opens with a known
  person or company is filed on that entity.

Migrations

• 135 eval_snapshots.kind, 136 wanted_links, 137 index on
  code_edges_symbol.from_symbol_qualified, 138 index on
  reverse(documents.source_path), 140 chunks.embed_failures.

v1.1.0

Added

• page_edit changes part of a page: exact old/new text replacements at a
  given version, all or nothing, with facts and takes fences protected and a
  diff in the answer (redacted like any retrieval for non-operator callers);
  it refuses a caller without its own write source. MEMRAIN_REQUIRE_WRITE_PRECONDITION (off, warn,
  refuse) controls a page_put that would overwrite a page without
  expected_version.
• add_fact takes up to 20 facts in one call and can replace an older fact,
  retiring it as superseded. forget_fact lists live facts that look like
  the one withdrawn (ids and scores only).
• Session logs can be pushed from the laptop: POST /ingest accepts a
  transcript content type and memrain transcripts push sends one log
  (docs/TRANSCRIPTS.md shows the SessionEnd hook). Pushes run under the
  pushing client's spend cap, one at a time per client, up to 8 MiB.
• Facts record who said them (attributed_to: user, assistant or other).
  With MEMRAIN_OWNER_ENTITY set, the operator's own claims from operator
  transcripts land on that entity instead of being dropped, and relative dates
  resolve against the date the conversation happened.
• think states the current date and each page's date, takes a
  reference_date, and checks every quoted span against its evidence; a quote
  it cannot find loses its quotation marks and is marked [unverified].
• Brain-wide daily spend caps: MEMRAIN_DAILY_BUDGET_USD over every paid call
  and MEMRAIN_CYCLE_MAX_USD_PER_DAY over cycle phases. Both are off by
  default. memrain spend breaks spend down by phase and job.
• memrain secrets audit rescans stored data with the current scanner and
  reports where credentials sit, never their values; --apply --yes
  rewrites them. SECURITY.md has a runbook. Source files are scanned before
  the code indexer reads them.
• The secret scanner recognises Google, Hugging Face, npm, SendGrid, Twilio,
  Supabase, DigitalOcean and Stripe webhook keys, credentials in URLs, Basic
  auth and high-entropy values assigned to secret-looking keys, and scrubs a
  caught value where it repeats bare in the same write.
• The connect instructions name only tools the caller can call and point at
  the skill catalog; list_skills and get_skill return each skill's
  triggers and the tools it can use for this caller, and whoami reports the
  caller's limits.
• A Bedrock outage, throttle or spend refusal no longer fails a page write:
  chunks are stored without vectors, stay keyword-searchable, and a new
  embed-gaps cycle phase fills them later. Jobs defer through an outage
  instead of burning retries.
• Retrieval tools scan what they return to non-operator callers and replace
  any credential with a redaction marker (MEMRAIN_OUTPUT_REDACTION, on by
  default). A quarantined page comes back without its body to a tenant.
  purge_deleted_pages takes a slug list and a dry-run plan hash.
• memrain jobs stats --by-kind, memrain transcripts status, and doctor
  checks for embedding backlog and secret exposure.

Changed

• Narrowing an OAuth client's scopes narrows its live tokens at once, and
  widening it later does not give old tokens their scopes back. PAT and client
  grant changes are recorded with a revision and an audit row. The unused
  sources_admin and users_admin scope names are retired.
• Quarantined documents no longer feed takes, think or the contradiction
  probe, and a cleared document stays cleared while its content is unchanged.
• Takes and atoms back off documents whose model call keeps failing, the
  contextual tier sends a window around each chunk, and synthesis phases run
  at most once per UTC day.
• Tags are scanned for credentials before they are stored.
• Allowlist entries in MEMRAIN_SECRET_SCAN_ALLOW must now be 16-64 hex;
  12-hex entries are ignored with a warning (see UPGRADING.md).
• Migrations 122-132 and 134 run on start.

Fixed

• A deploy no longer leaves a job running unbounded: running jobs renew their
  lease, receive an abort signal on shutdown, timeout or a lost claim (the
  built-in handlers stop at their next step), and malformed payloads fail once
  instead of retrying.
• The contradiction probe dates each claim, skips forgotten facts and retired
  takes, and counts judge errors instead of reading them as "no conflict".
• Chronicle extraction drops events dated only to a year or month, events
  dated after their page, and impossible calendar dates.

v1.0.9

Fixed

• Retrieval scores are measured per page. Several chunks of one page used to
  count as separate hits, which inflated recall and skewed MRR in eval,
  the replay probe and A/B compares.
• Queries with no expected answer no longer score a perfect recall. eval
  keeps them out of the averages and reports them on their own, with how
  often they still returned something.
• The capped replay probe scores the same questions every run (lowest ids
  first) and records a hash of the set, so trends compare like with like.
• A probe run that fails or is capped now leaves a snapshot row with its
  status (ok, capped or error) instead of vanishing. doctor shows it.
• eval stops with exit code 2 when more than half of the expected pages are
  missing from the brain, instead of reporting a score for a stale set.
• The prompt sanitizer no longer redacts the name "Dan". Only the uppercase
  jailbreak token and "DAN mode" phrases are removed.
• doctor warns when the database has migrations this build does not know
  (after an image rollback) or is missing ones below the newest applied, and
  /health reports schema_ahead.
• backlinks works for Cyrillic and long page names, and follows renamed
  pages. It now reads page links as well as the links in vault documents;
  the old lookup reduced every non-Latin name to the same id. Names over 256 characters are refused, and a
  remote caller no longer sees links into a diary page, including through an
  alias of one.
• The Postgres driver survives a backend that is killed mid-query or during
  an RDS failover: the pool slot reconnects at once instead of waiting out
  the connect timeout, a connection that died inside a transaction is not
  reused, and a stale error can no longer surface on the next caller's query.
• A deploy no longer costs a running job a retry. On stop the worker lets the
  job finish for up to MEMRAIN_WORKER_DRAIN_MS (default 8 s), then hands it
  back to the queue untouched and releases the worker lock, so the new
  container picks it up straight away. Compose gives the service 30 s to stop.

Changed

• eval gate refuses to judge a run against a baseline written under the old
  scoring (page dedup and abstention changed the numbers). It reports
  rebaseline: true and asks for --write-baseline instead of failing.
• Migration 121 adds a status column to eval_snapshots. Rolling back past
  1.0.0 now needs --down 121 before --down 120 (see UPGRADING.md).

v1.0.8

Fixed

• The deployed stack now passes MEMRAIN_UTILITY_MODEL to the container, so
  setting it in .env moves every utility-tier call, not only the ones with a
  per-feature key.
• The agent loop can run on models that keep thinking on, such as Sonnet 5.5.
  Redacted reasoning blocks were stored as JSON and came back as an
  index-keyed object, so the next turn failed with a 400; the ledger now keeps
  their bytes as base64 and restores them on replay.