v0.57.0

Added

• The server environment selector FLAIR_RETRIEVAL_MODE supports hybrid, vector-only and bm25-only retrieval for benchmark runs.

• A release PR that merges green on main now tags itself.

  Heads-up: a repo admin installs the GitHub App and splits the release-tag
  rulesets after this merges. Until then a release refuses loudly with
  condition app-not-configured and opens an issue instead of tagging.

Changed

• The post-publish canary binds promotion to a package-set digest and promotes only exact major.minor.patch versions to latest. (#1671)

• The listed CLI admin commands share password-source validation and reject conflicting file and inline credentials. (#1910)

  Heads-up: For the commands listed above, pass one explicit password
  source; prefer --admin-pass-file to --admin-pass.

• Renovate's configuration has been split into a shared org preset (.github/renovate-preset.json) and a per-repo overrides file (.github/renovate.json).

• flair-bootstrap, flair-sync, flair-sync-soul, migrate-memories, and flair-activity refuse to run without an explicit agent identity. (#1822)

• The CLI spawn-budget gate now sees Bun.spawn/Bun.spawnSync and named aliases, so an untimed Bun spawn of the CLI entry fails too. (#1825)

Fixed

• The canary promote block prints a restore line for a package whose dist-tag add FAILED, and says so when the check cannot read the state. (#1671)

• The canary promote block stops on a FAILED dist-tag ls, not just an empty one.

  Heads-up: if a canary promote block stops saying "unmeasurable is FAIL" or
  "is not a version", nothing moved — re-read the tag and promote again.

• The canary's promote block now PRINTS a rollback for a partially-moved latest instead of deleting it, and its rollback text matches the commands under it. (#1671)

• Supply-chain policy §2 no longer overstates how dependencies are pinned and checked.

• adk-flair's store_memory tool no longer reports an unconfirmed memory write as stored. (#1938)

• A parent-prefix search in the LangGraph store returns items in descendant namespaces, and namespace labels use a reversible stored encoding. (#1939)

• README claims in pi-flair, langgraph-flair, flair-mcp, cursor-wake-runner and cursor-flair are corrected to match the actual code. (#1943)

• ADK and Hermes descriptions now clarify the audited behaviors. (#1943)

• ADK search drops hits from a foreign agent id, and the ADK READMEs state only what ships. (#1943)

• Updates documentation for the native MCP endpoint, integrations, OpenClaw, Claude Code, and ADK JS.

• Corrected setup, authentication, and dedup guidance. (#1943)

• Five docs pages now accurately describe what the code does:

• The MCP client guide, the flair-mcp README and the native-OAuth note describe what ships. (#1943)

• Doc corrections clarify n8n tag and subject reads, OpenClaw identity, and wake-runner authentication. (#1943)

• The OpenClaw and Claude Code integration docs now match the code.

• Clarify Pi identity setup, registered tool signatures, and ephemeral expiry text. (#1943)

• The session-start hook attempts one stderr diagnostic when a bootstrap fails, naming the failure kind. (#1943)

• FlairClient refuses to send admin Basic credentials over plain http to a non-loopback host, before any request is made. (#1951)

• The hermes-flair plugin now loads the raw-seed key flair agent add writes, defaults to Flair's port 19926, and describes search honestly. (#1953)

• FlairWriteError now counts attempted records and reports skipped text-less ones, and its status_code is an int or None. (#1954)

• ADK JS stores events that have no id as separate records instead of overwriting one another. (#1967)

• ADK Python logs skipped text-less entries on a successful write, and the concierge example rejects empty input. (#1967)

• Adapters that build their own Memory request paths encode the id, and refuse a "." / ".." id. (#1970)

• Asset, Credential, Relationship and MemoryCandidate collection reads use the shared scoped-search helper.

• By-id reads are scoped on the full stored record.

• flair-client percent-encodes Memory and Relationship ids in request paths.

• flair doctor says UNVERIFIED when it could not run the pairing-role check, and its prune remedy names the form that deletes. (#1883)

• flair doctor reports two instance-identity mismatches, each with the one command that fixes it.

• flair federation token and pair read the admin password from an owner-only file, keeping it out of shell history and ps. (#1873)

• The pairing-cleanup sweep follows the identity row's role on every tick, and drops orphan bootstrap users too.

• The pairing cleanup pauses when the Instance table holds a row it cannot name.

• The pairing-cleanup sweep confirms each expired-token delete from Harper's result.

• Delete operations send the hash_values list Harper requires, so expired pairing tokens are actually removed.

• flair init --remote confirms the identity row it wrote, so an absent or wrong hub identity is never reported as reconciled. (#1883)

• The instance-identity readers see every row and never invent one, and a failure to read is an error. (#1883)

• A hub's federation identity is ONE Instance row, and flair init --remote reconciles it instead of inserting a second.

• flair federation instance prune verifies each delete, so it never prints a row it did not remove. (#1883)

• A reader with several identity rows refuses instead of picking one, and a read that established nothing is not a read that found none. (#1883)

• A failed flair federation token now really deletes the pairing token it minted. (#1895)

• The combined abort signal removes both listeners as soon as either input aborts. (#1751)

• The client's caller abort signal works on every Node version the package allows. (#1751)

• /HealthDetail reports a refusal, not a coin-toss pick, when several Instance rows exist, and marks a failed read unreadable, not absent. (#1896)

• Flair's REST middleware allows GET, HEAD, OPTIONS, POST, PUT, PATCH and DELETE through its method check.

• Concurrent first-boot GET /FederationInstance requests share one identity row; callers unable to acquire the creation lock receive a refusal. (#1897)

• A local Memory, Soul, Agent or Relationship POST/PUT with no originator now stamps no originator identity instead of an arbitrary one; PATCH is exempt. (#1896)

• memory_search's tools/list description now states it covers other agents' non-private memories.

• Native /mcp tool calls check declared argument types and required properties before the tool runs.

• Auto-capture now normalises block-shaped messages, uses the client's UUID memory ids, and reports machine-readable store outcomes. (#1751)

• OpenClaw auto-capture uses one bounded run map for capture state, retention and abort handling. (#1751, #1892)

• OpenClaw callback warnings suppress repeated keys while those keys remain in a bounded cache. (#1751, #1884)

• Memory updates now keep a record's stored private or shared visibility unless the write sets a new one

• The token-id redactor defines each rebuilt key as an own property, so a JSON-parsed __proto__ key stays an own key. (#1907)

• The release tagger reads the candidate commit as data, and the write job re-derives the decision (flair#1890 round 3). (#1890)

• The release shape check reads the release commit's own diff, and allows only the lockfile this repo tracks.

• The ownership map owns itself: CODEOWNERS is now owned by the repo admin.

• Release auto-tagging decides and writes in separate jobs, and refuses three edges it used to guess at.

• The release tagger refuses to tag from a stale main.

• A release PR must be a single commit, and the tagger refuses one that is not (flair#1890 round 7). (#1890)

• A release PR can no longer carry a change to the release tagger, and the checker scans the whole candidate tree.

• Integration, MemoryUsage and MemoryGrant reads use the shared read-scope helpers, and the shared scoped search keeps every caller condition.

• Pairing-token ids now reach every sweep and rollback log line only as their 8-character prefix, or [redacted] for an id too short to cut. (#1902)

• The CLI spawn-budget gate builds no regular expression from source text, so a file it scans cannot inject a pattern (flair#1825). (#1825)

• The spawn-budget gate's SEED output states exactly what the seed predicate guarantees (flair#1825). (#1825)

• The CLI spawn-budget gate's wait-bound rules are exact, closing the last classifier gaps (flair#1825). (#1825, #1921)

• A unit test that leaves a scratch directory behind now fails the unit lane (flair#1889). (#1889)

---

Full record: CHANGELOG.md