0.3.0 — outcome tracking (V4)

• bench: internal benchmark suite (bench/run_bench.py) — engine-overhead
  medians against a zero-latency scripted model, the acceptance eval, and the
  robustness tier at --s4-samples 50 with duplicate-shape classification
  (the value-equivalence T0 measurement), recorded per-release to
  bench/results.jsonl with a --compare regression gate. Now part of the
  maintainer release checklist. See bench/README.md.

• mcp 2.0 compat: the MCP SDK 2.0.0 renamed FastMCP to MCPServer
  (same decorator API) — veracium-mcp now imports whichever the installed
  SDK provides, so mcp>=1.0 stays the supported range on both majors.

• outcome tracking (V4): co-designed with the first production consumer —
  record_outcome() records uses and judgments of facts as kind="outcome"
  episodes (the source of truth) with derived edge counters
  (times_used/outcome_counts/last_outcome); judgments upgrade the
  matching use in place via (edge_id, evidence_ref). Vocabulary:
  unreviewed/confirmed/corrected (human) /challenged/concurred
  (LLM judge), actor rules enforced. Edge-blind by design: record_outcome
  never supersedes facts; the explicit fact-level correct() verb supersedes
  with reason "corrected". challenged reuses the possibly-stale flag;
  counters render into recall as information, never gating; outcome episodes
  are excluded from the narrative recall window and from LLM consolidation.
  Portability format v2 ("record" marker; v1 imports unchanged). Neither
  verb is an MCP tool.

Release checklist: bench --live baseline recorded (bench/results.jsonl) — hard metrics all zero, eval 5/5, --compare no regressions.

v0.2.4 — selfcheck provider preflight

• selfcheck UX: veracium selfcheck now preflights the provider — a
  missing SDK or missing ANTHROPIC_API_KEY exits with one clear install
  hint instead of a traceback or, worse, a garbage FAIL … injection asserts=1 scorecard (an erroring check was conservatively scored as an
  assert, which read exactly like the injection guarantee failing). If the
  provider fails every check mid-run (e.g. bad credentials), the result is
  now reported as DID NOT RUN (exit code 2) — an environment problem is
  never rendered as a memory-safety result.

v0.2.3 — MCP Registry readiness

• MCP Registry: README carries the mcp-name validation marker and
  server.json (current registry schema) sits at the repo root — Veracium is
  publishable to registry.modelcontextprotocol.io, which the MCP directories
  crawl. docs/mcp.md refreshed: PyPI install flow (the page still described
  a pre-PyPI clone install), the remember tool row now documents
  derived_from, recall documents token_budget, and the deliberately
  non-MCP verbs are listed with their rationale.

v0.2.2 — veracium-mcp --help/--version + clear boot errors

• veracium-mcp CLI: --help and --version now work (previously any
  argument was ignored and the stdio server booted silently — confusing on a
  first install); unknown arguments fail with a pointer to --help; a boot
  failure (e.g. missing ANTHROPIC_API_KEY) exits with a clear one-line
  message instead of a traceback.

v0.2.1 — host queries: list_entities() + edges_since()

• host queries (requested by the first production consumer for its
  intelligence layer): Memory.list_entities() — distinct ids with
  edge/episode counts, for proactive-recall planning and coverage audits — and
  Memory.edges_since(user_id, since) — edges learned after a date, filtered
  on provenance.observed_at, including superseded/quarantined material so
  change-detection sees everything. Host/admin surface; neither is an MCP tool
  (cross-user enumeration is not an agent capability). Store gains
  list_users() (non-abstract, like forget_user).

v0.2.0 — budget-aware recall, portable memory, forget, feedback verbs, audit log

The launch release: the five capability gaps identified by an independent
landscape analysis, plus the display-brand and one-liner refresh.

• branding: display brand is capitalized Veracium in all prose (code
  identifiers stay lowercase); canonical one-liner applied to the PyPI summary,
  README lead, and MCP server description.
• audit: opt-in operation audit log — Memory(audit=AuditLog(path))
  appends one content-free JSONL line per operation (UTC timestamp, op,
  user_id, the op's counters; never memory text) covering
  remember/recall/answer/maintain/dispute/confirm/forget/export/import.
  Append-only, host-owned; sink failures never break memory.
• feedback verbs: dispute(user_id, edge_id, reason=, actor=) — the edge
  leaves every assertable surface immediately (non-destructive invalidation,
  reason "disputed"), and the dispute itself is remembered as an episode with
  actor and reason; confirm(user_id, edge_id) — refreshes validity, clears
  the possibly-stale flag, records the confirmation. confirm refuses
  non-assertable edges (elevating a claim by confirmation would be a laundering
  vector — affirmation is new evidence, use remember()). Neither is an MCP
  tool by design. Content-free feedback telemetry event.
• forget (compliance erasure): Memory.forget(user_id) irreversibly erases
  everything stored for a user — edges incl. superseded history and quarantined
  claims, episodes, wiki cache, counters. Distinct from lifecycle by design
  (maintain() never deletes; forget() never preserves). CLI:
  veracium forget --user X (confirmation prompt; --yes to skip).
  Deliberately not exposed over MCP — an agent-callable wipe verb is a standing
  prompt-injection target. Store gains forget_user() (non-abstract;
  custom stores keep working until they implement it).
• portability: JSONL export/import — Memory.export_memory(user_id, path)
  writes the complete store of record (all edges incl. superseded history and
  quarantined claims, all episodes, full provenance/disclosure);
  import_memory(path, user_id=...) is idempotent (existing ids skipped, never
  overwritten) and can remap users. CLI: veracium export / veracium import
  (store-only, no LLM needed). The wiki cache is not exported — it recompiles.
• recall: token-budget-aware context assembly — recall(user_id, query, token_budget=N) caps the rendered context (chars/4 heuristic; Veracium is
  tokenizer-agnostic). Trimming follows a documented priority: query-matched
  facts, then unverified-claim flags (never silently dropped below the facts
  they annotate), then the curated wiki (all-or-nothing), then recent episodes
  newest-first; best-effort minimum of one item. Recall gains
  tokens_estimated/truncated; the MCP recall tool exposes the parameter;
  the content-free telemetry recall event gains a trimmed counter.

v0.1.7 — system-event laundering fix (security) + derived_from

• security (ingest/gate/compile): closed the system-event laundering
  bypass — third-party text embedded inside a SYSTEM/USER-authored event (a
  triage verdict quoting a received email's subject, a summary of a message
  body) previously acquired the event's full trust and could surface as
  assertable user facts. remember() gains derived_from: declare
  author=SYSTEM, derived_from=THIRD_PARTY and trust is capped at the minimum
  of the two — edges cap at use_only (claims still quarantine), and the
  episode routes to the unverified channel at the gate and is excluded from
  the compiled wiki (episodes now route by third-party influence, not
  authorship alone). Provenance records both fields; MCP remember exposes
  the parameter; documented in docs/concepts.md ("Mixed provenance") and
  SECURITY.md. Found by the first production consumer on a real-mailbox
  backfill (130 laundered assertable edges); reported in
  proposals/system-event-laundering.md with the attack fixture now locked as
  a regression test.

• ingest: an unparseable extraction no longer leaves a history gap — the
  turn records a content-free placeholder episode ("(unprocessed event —
  extraction returned no parseable JSON; content not retained)") with full
  provenance/evidence_ref. Deliberately not the raw event text: that would
  feed unmediated, possibly adversarial input straight into recall prompts.

• _json: among list fallbacks, extract_json now prefers a non-empty
  list of dicts (the shape of a bare triples array) over junk like [] or
  [1, 2] that happened to parse earlier in the prose.

• graph: his/her removed from the value-equivalence filler list — they
  can point at a third party ("his assistant" vs "her assistant") and so carry
  meaning; user-referential possessives (my/our/their) remain filler.

• examples: openai_provider.py — OpenAIComplete wraps any
  OpenAI-compatible chat-completions API (OpenAI, vLLM, Ollama's /v1), with
  per-role model mapping, honest structured-output fallback, and a memoized
  capability check. First outside contribution — thanks @vreddy-commits (#8).

v0.1.6 — use_only enforcement completed for the wiki path (security)

• security (compile): a third-party inference (use_only) is no longer fed
  into the compiled wiki. recall() places the wiki in the gate's assertable
  GROUNDED block, so a use_only fact reaching the wiki could be asserted through
  the wiki path — even though gate.partition (0.1.3) already routed such inferences
  to UNVERIFIED. compile._grounded_inputs now excludes use_only edges, mirroring
  the gate; the inference still shapes behavior via recall's unverified channel, only
  kept out of the assertable body. Completes the 0.1.3 fix (which covered only the
  subgraph path). Adds a unit lock (test_grounded_inputs_excludes_use_only).

v0.1.5 — survive list-shaped distill responses; robustness tier complete

• ingest/_json: a distill response whose first parseable JSON value is a
  list no longer crashes remember() ('list' object has no attribute 'get'). extract_json now prefers the first JSON object — skipping prose
  debris like a stray [] before the real payload — and returns a bare array
  only as a fallback, which ingest normalizes as the triples payload with its
  wrapper omitted. Found by the robustness tier's first lmsys-chat-1m run
  (3/368 real turns crashed, all code-shaped inputs).
• tests: robustness tier Phase 2 — S4 (reinforcement ≠ duplication: a seeded
  sample of fact-yielding turns is re-ingested; new-edge growth is reported as a
  distribution) and S5 (every maintain() report must carry non-negative counts
  bounded by the store it ran over). Both soft signals; hard gates unchanged.

v0.1.4 — graceful unparseable-extraction handling + robustness tier

• ingest: an unparseable distill response (the extractor answering in prose —
  typically a refusal on jailbreak-shaped or degenerate input) no longer raises
  out of remember(); it records nothing and returns
  {"episode": "", "facts": 0, "quarantined": 0, "unparseable": True}, with a
  content-free unparseable counter in the telemetry ingest event. Found by
  the new robustness tier on its first run (7/19 fixture turns crashed).
• tests: new opt-in robustness tier (tests/robustness/,
  VERACIUM_ROBUSTNESS=1) — streams real, messy conversations through the write
  path and holds veracium's guarantees as hard invariants (no internal crashes,
  no cross-user leakage, no assertable third-party user-facts, well-formed
  persistence), plus soft distributions (yield, relation drift, latency,
  provider crash-rate). Ships a committed adversarial fixture corpus
  (fixtures/messy.jsonl); points at a locally exported lmsys-chat-1m for the
  full run. Reports are redacted — raw corpus text never appears.