v0.58.0

Added

• The release tagger also marks the Python package.

  Heads-up: a repo admin must list the release-tag App as a bypass actor on
  the adk-flair-v* tag ruleset (id 24044018). Until then the second POST is
  rejected (403) and the release refuses with adk-ref-write-rejected.

• The release attempt now carries its certified digest, the canary has a machine surface, and an unprivileged poll can start the promote.

• Memories now support validated host-source pointers, stored in MemoryHostSource and returned through visibility-gated reads (slice 1 of #1940). (#1940)

• Claude Code can now recall Flair memories on every prompt, not only at session start. (#2066)

• Claude Code can now save a continuity record just before a compaction and show it first when the session continues or restarts. (#2069)

Changed

• The supply-chain bake-time gate now also checks exact-pinned external optionalDependencies, not only dependencies. (#1935)

  Heads-up: a project that copies the gate, as described in
  docs/supply-chain-policy.md, needs both files now: copy
  scripts/lib/check-dep-ages-collect.mjs into a lib/ directory beside
  the script, keeping the relative layout, or the script fails at import.

• Breaking: non-admin Memory reads return full authorized rows and ignore select/property; clients must select fields from the returned object. (#1940)

• A Relay POST /Message that reuses a stored message id gets the idempotent answer only when it comes from that message's sender.

• Bootstrap tests pin the priority winner for duplicate soul values. (#1730)

• In CI the unit lane now keeps going past a failing step and reports all failures at once, instead of stopping at the first. (#2030)

• POST /RecordUsage counts only memories in the caller's read scope, and a non-admin MemoryUsage read shows a row only while its memory is readable.

  Heads-up: a usage report counts only when the memory is in the reporting agent's read
  scope. Memories created through Memory.post() or Memory.put() default to private for
  standard and ephemeral durability. POST /FeedMemories defaults ephemeral records to
  private, while a new standard feed record with no visibility field is non-private; usage
  reports from other agents can count it.

Fixed

• flair init stops before authenticating when one read shows another data directory.

• A workspace package's non-optional peer must now resolve, in bun.lock, to a version its declared range allows. (#1936)

• Cleanup failures now fail the maintenance response, the transaction helper refuses to run unwrapped, and the pointer failure switch is a test-only adapter replacement. (#1940)

• The host pointer joins on a server-stamped row incarnation token, so a stale pointer is never returned and cleanup is hygiene. (#1965, #1940)

• A pointer commits with its Memory row, and an echoed pointer keeps a SHARED pointer shared. (#1940)

• Reindex retains memory provenance, feed ingestion stamps it anew, and failed pointer cleanup preserves lexical recall. (#1940)

• Client wiring, signing and read-scope text match the code in the README, the MCP guide and the tool descriptions. (#1943)

• FlairStore structurally satisfies LangGraph's BaseStore type, and its documentation describes the implemented adapter. (#1943)

• Read-scope comments and model-facing tool text describe what the server does. (#1943)

• The Hermes plugin's key loader now accepts a base64-encoded raw 32-byte Ed25519 seed

• flair-client, the ADK Python memory service and the Hermes plugin sign the path they send when the base URL has a path.

• The release guide and the release run's summary give all three post-publish canary inputs. (#1996)

• Metal engagement is read from the embedding engine, so an empty launchd capture is no longer reported as CPU.

  Heads-up: for GPU-offload requests, Apple Silicon status uses engine
  readback; absent readback is reported as unconfirmed.

• A CLI and an instance in different install trees are now named; flair init re-points only a service unit it proves is its own. (#2034)

• Launchd handoffs check before stopping anything, report what they could not verify, and claim launchd only when proven (flair#2040). (#2040)

  Heads-up: to hand a directly running instance to launchd, run
  flair doctor --fix from a console (GUI) login session on the Mac. launchd
  may also start the job at the next console login (the plist sets RunAtLoad),
  provided the plist is valid and the job is enabled.

• A leftover daemon identity sidecar no longer makes a stop or restart refuse.

• check-dep-ages treats an unparseable publish time as a registry failure.

• The CI dependency-age gate refuses the fixture-root override.

• flair init puts back the plist it wrote when the check of that plist cannot run (flair#2078). (#2078)

• ADK record ids for colon-bearing tuples sit outside historical event-join ids.

• The BM25 index builds in the background after startup, and flair status shows its progress. (#2032)

• Doctor names continuity hook pins that are not resolved versions. (#1819)

• REM now archives validTo-expired memories, making expired-memory health warnings actionable. (#2033, #1503)

• Federation documentation distinguishes implemented behavior from protocol placeholders. (#1453)

• Memory and soul feed subscriptions apply the subscriber's read scope.

• Changelog validation rejects odd continuation indentation and leading tabs. (#2007)

• Symlinked PATH directories no longer trigger false missing-PATH warnings. (#2034)

• The native /mcp path checks the principal's status on each tool call it dispatches through a credential mapping.

• MCP setup follows the quickstart and documents BM25 cold starts. (#1486)

• Memory delete waits for request commit before updating the lexical index.

• Memory PATCH validates a durability it sets. (#1961)

• flair memory search accepts --json. (#1717)

• PATCH updates existing rows; for a caller that is neither an administrator nor a trusted internal call it never creates one.

  Heads-up: a client that created rows with PATCH using an agent key now
  gets a refusal: 404 from the table's guard, or an earlier refusal from
  Harper's permission check or from the resource. Where the resource permits
  creation, create the row with POST or PUT first; PATCH then updates it.

• The release guide explains nightly tag recovery after an advisory CI failure. (#1992)

• REM records invalid stage response envelopes as failures. (#1738)

• Table subscription routes are served to administrators only.

  Heads-up: a client that subscribed to a table route with an agent key now
  gets 403. Subscribe with an administrator's credential; a verified agent can
  use /FeedMemories for changes to the memories it can read, and
  /FeedSouls for soul changes.

• Task summaries accept an optional generic reference. (#1780)

• Failed post-upgrade restarts keep a swapped Flair package after a refused pre-upgrade /Health connection.

  Heads-up: After a refused pre-upgrade /Health connection, a failed
  restart keeps the new version only when Flair itself was swapped, exits
  successfully, and prints flair start. Timeouts remain indeterminate.
  A pre-upgrade snapshot leaves an instance with a refused /Health connection
  stopped; it no longer starts the old version before the package swap.
  Engine-change rollback retains pre-restore data beside the data directory;
  keep this copy to recover post-snapshot writes with the engine that wrote them.

• Rollback recovery now warns when the proposed version failed earlier in the upgrade.

• Client wiring and hook repairs check the package pin they replace. (#1848)

Security

• Agent-auth and federation nonces are recorded once per instance, in a table every Harper worker thread shares. (#2061)

  Heads-up: FLAIR_AGENT_AUTH_WINDOW_MS, if you set it, must stay below
  60000. A larger window refuses every TPS-Ed25519 request with
  replay_store_unavailable, and the log names the variable.

• The by-id read gate checks the unselected row through its own target.

• A non-admin HTTP collection POST is served only by a resource's own post(), and Relationship has one.

• Application creates derive originatorInstanceId from the local instance identity, or stamp null when unavailable; updates preserve the stored value.

  Heads-up: application POST/PUT/PATCH bodies do not choose
  originatorInstanceId; creates derive local identity and updates retain
  stored attribution.

• Root dependency overrides for brace-expansion, fast-uri and moment move the repo lockfile out of their advisories' affected ranges.

• Root dependency overrides raised for undici, ip-address, lodash, joi and fast-uri advisories in the repo lockfile.

• provenance.verified.timestamp is now stamped from the server clock. (#1960)

---

Full record: CHANGELOG.md