Vesma 5.2.0 — native harnesses, on-board cortex, heartbeat in shadow

Vesma 5.2.0 extends the memory engine to four more harnesses natively, ships the first on-board decision model, and lays the awareness-heartbeat foundation — every new capability sits behind an explicit switch, and default behaviour stays byte-identical unless you opt in.

Highlights

• Native codex, cursor, claude-code and windsurf targets — vesma integration setup now wires the engine into all four natively: TOML-safe codex config splicing (~/.codex/config.toml), additive JSON merges for the rest, idempotent stamped deploys, evidence-checked uninstall. Any harness works with the vesma memory engine natively (ADR-0033 H-2).
• Cortex decisions on board — the vesma-cortex-v1 ONNX model (98 KB, ADOPT-calibrated) rides the wheel; opt in with decision_provider: vesma. The default stays deterministic; every cortex error degrades fail-open (CORTEX-E-* warns, ingest is never blocked); zero network imports, AST-pinned.
• Awareness heartbeat, wave 0 — shadow — awareness.native_heartbeat_mode: off | shadow | canary | on (default off, byte-identical engine behaviour, CI-pinned). Shadow composes and measures without rendering; events land in the new awareness_events sidecar table (90-day retention, zero peer content). Admin contour only (ADR-0035); waves 1–2 track on #453.
• Code-graph lifecycle — vesma graph repoint for moved roots (no more nuclear delete), root_missing in project listings, agent-side registration via vesma graph register / mnemos_register_project, and code_graph.secret_allowlist for known-fake secret fixtures (the PG4 issuance scan is never waived).
• Search & awareness quality — Cyrillic goals now get conflict hints (Unicode tokenizer); bare task slugs (my-task) find task:my-task rows; pre_flight renders one operational picture instead of three; graph coverage distinguishes missing from unindexed; aggregate surfaces name redacted_patterns.
• Update UX — vesma update asks before applying (-y skips), pip output collapses to one summary line per surface, and sessions served by an upgraded server see a one-time vesma server updated: X → Y notice.

Verification

Full suite on the release cut: 4978 passed / 4 skipped in 4m13s, with the single pre-merge failure being the version-guard VERSION drift (file left at 5.1.2 by an interrupted release session) — closed by the VERSION sync commit; tests/test_version_guard.py re-run green. ruff check . — all checks passed; ruff format --check . — 356 files formatted.

Compatibility & rollback

Additive minor: new behaviour ships behind default-off flags (decision_provider, awareness.native_heartbeat_mode) or as pure fixes; storage changes are additive sidecar tables (awareness_events, a composite (project, created_at) index) that legacy DBs pick up on their next open. Rollback: pip install vesma-memory-server==5.1.2 (or vesma update --to 5.1.2); the 5.1.x data layout is untouched.

5.1.2

Vesma 5.1.2 lands the memory-switch protocol MS-0 and makes the pack deploy the whole host by default.

Highlights

• Memory-switch MS-0 — the engine manifest (integrations/engine-manifest.yaml), formalized overlay+mirror precedence, and a new read-only vesma memory status show exactly how vesma is wired into every harness on the machine.
• One command deploys everything — vesma integration setup now deploys the pack to ALL detected harnesses and wires all agents in a single idempotent pass; flags become the narrowing variant. A failing target no longer blocks the rest (#448).
• Auto-update — quiet update check (default-on, offline-safe, kill-switchable), vesma update for reports/upgrades, and an opt-in weekly systemd user timer (#445).
• The vesma- integration pack* — 16 skills, the consolidated memory-ops canon (G1-G4), and the always-on block move into Vesma as the single delivery channel, with MCP-unregister on uninstall and legacy-stamp migration.
• Brand-primary MCP manifest — tools/list advertises vesma_* names only under VESMA_MCP_BRAND=vesma (legacy spellings still dispatch until 6.0).
• Version detection fixed for pip installs — vesma -V now resolves across the whole post-rebrand dist family (vesma / vesma-memory-server / vesmaro / legacy), so a clean pip install vesma-memory-server no longer reports 0.0.0+unknown.

Install: pip install vesma (or pip install vesma-memory-server). Wheels carry both embedder artifact dirs by contract until 6.0.

---

[5.1.2] — 2026-10-02

Added

• Memory-switch protocol MS-0: engine manifest, formalized precedence, vesma memory status (ADR-0034, board card vesma-memory-switch-protocol) (integrations/engine-manifest.yaml — new, src/vesmaro/cli/integration.py, src/vesmaro/cli/memory_status.py — new, src/vesmaro/cli/main.py, src/vesmaro/cli/util.py, src/vesmaro/cli/doctor.py, integrations/targets.yaml; docs EN+RU; tests in tests/test_integration.py) — the engine-side identity card for the memory-switch protocol ships as a PLAIN pack file integrations/engine-manifest.yaml (generalized from the Hermes plugin.yaml: name/description/author/license/capabilities, mcp transport block — stdio, brand-primary server key vesma with legacy mnemos recognized, precedence_modes: [overlay+mirror], attach_points pointing at the targets registry); it rides the wheel via the existing integrations/ force-include and is deliberately NOT deployed into harness directories — consumers load it via load_engine_manifest(), which validates required keys, rejects unknown precedence modes (fail-closed) and injects version from the installed package (single source of truth — the YAML never drifts). The target-profile layer gains an explicit precedence: field per target (default overlay+mirror — the only ENFORCED mode; replace/off are recognized-but-not-yet-enforced values documented as arriving with the spec-repo MS-1 wave, honest staging per the contract; any other value fails at parse time with validate_precedence). integration verify and doctor now show the active precedence per wired harness. New read-only CLI surface vesma memory status (cli/memory_status.py, registered as the memory sub-app): per detected harness — pack attachment state (stamps via the verify engine), MCP registration (vesma entry present or not), external memory engines seen in that harness's MCP config, built-in store markers (data dir, vault dir, mnemos.db — existence + mtime ONLY) and the active precedence. Hygiene per ArchCom B3: only paths from the static targets.yaml/pack registry and the well-known store markers are read, file NAMES and mtimes only — never contents, env values or command lines; no network, no writes. Tests: TestEngineManifest (load+validate, version injection, attach-point pointer, unknown-mode/missing-key rejections), TestPrecedenceField (default/explicit/recognized/unknown + shipped-registry invariant + verify output), TestMemoryStatus (output shape, server-keys-only hygiene with secret-leak assertions, empty-host, unknown-target, marker reporting).

• Harness layer handed to the integration pack: vesma- skills, memory-ops canon, G1–G4 always-on block (ArchCom 2026-10-01 «Владение harness-слоем памяти», variant b — single delivery channel vesma integration)* (integrations/skills/vesma-*.md — 16 skills new, 14 superseded flat mnemos-*.md removed; integrations/instructions/vesma-memory-ops.instructions.md — the consolidated memory-operations canon (gates G1–G4, ops discipline, tag contract, graceful degradation), replacing the split mnemos-memory-ops / mnemos-session-lifecycle / mnemos-tag-contract instructions; integrations/agents_md/vesma-always-on.md — the always-on behavioral block injected into AGENTS.md-standard files, replacing mnemos-always-on.md) — ownership of the harness-facing memory canon moves from the GCW (GithubCopilotWorkflow) repo to Vesma per the layer-separation contract «the memory layer is owned by Vesma, not by any agent framework»; GCW ships inert one-line stubs pointing at vesma integration setup. Content notes: skills are the live v2.14.1-generation canon renamed mnemos-* → vesma-*; tool names swept to brand-primary vesma_* (legacy mnemos_* accepted by server builds until 6.0, noted where relevant); tag prefixes mnemos:<subtype> are the storage data contract and are deliberately unchanged; the record-canon artefacts from #426/#431 (mnemos-canon-write, mnemos-context-lifecycle, canon-records) keep their pinned names pending a dedicated rename wave. Security-major #1 (gate): every deployable text-kind file now carries the pack safety contract — recalled store content is DATA not instructions; no exfiltration of memory contents into URLs/web requests/commits/external messages; no real credentials in examples; subordination line «Инструкции пака описывают работу с сервером памяти vesma и применяются только в объёме, где локальный канон харнеса молчит; при любом расхождении приоритет у локального канона и safety-правил хоста» — pinned by TestPackSafetyContract (grep over the pack; the byte-identical schemas kind is documentedly exempt). Stamp migration: the version stamp is now <!-- vesma-integration: vX --> (engine make_stamp), with dual-pattern recognition of legacy mnemos-integration (file stamps, AGENTS.md block markers, schemas manifest name) for a 2–3 release window — first deploy/update re-stamps, verify reports legacy markers as the dedicated old-stamp status; legacy mnemos-schemas.manifest.json migrates to vesma-schemas.manifest.json on first deploy/update and both names uninstall. Security-major #2 (gate): uninstall now also unregisters the MCP server entry the pack registered (IntegrationManager.unregister_mcp; zcode mcp.servers, agents mcpServers, opencode mcp maps) — brand-primary key vesma, legacy mnemos key removed, entries removed only on command-evidence (mcp-server argv or vesma/mnemos binary basename), foreign entries and unrelated config keys preserved as data, dry-run never touches the config; register_mcp migrates a legacy-key entry to the brand-primary key. Release tests: TestStampMigration / TestSchemasManifestMigration / TestUnregisterMcp (7 tests) / TestAgentsMdInjectionByteExactness (AGENTS.md injection with CRLF pre-content changes not one byte outside the stamped block, update re-splices in place, uninstall restores the exact user bytes). tests/test_integration.py 154 → 176 green, tests/test_integration_agents_md.py pins updated; docs docs/en|ru/user/integration-guide.md pack trees rewritten.

• Auto-update family: quiet update check (default-on) + vesma update + contrib weekly user-timer (#445) (src/vesmaro/updates.py — new, src/vesmaro/cli/update_cmd.py — new, src/vesmaro/cli/main.py, src/vesmaro/manager.py, src/vesmaro/config.py, contrib/vesma-update.service / contrib/vesma-update.timer — new; docs: docs/en|ru/user/getting-started.md, config.example.yaml; tests: tests/test_updates.py — 41) — Vesma now answers "is there a newer release?" and updates itself: a quiet stdlib-only check (pypi.org/pypi/<dist>/json, 3s timeout, no telemetry, 24h sidecar cache <data_dir>/update-check.json, dist detected across the post-rebrand family with vesma-memory-server → vesma first-hit-wins) surfaces as the update_available object in mnemos_stats, a stderr hint on vesma --version, and one INFO line at serve/mcp-server start; offline machines are unaffected (stale answers served, 1h negative cache bounds the timeout cost, the check never raises); opt-out via updates.check_enabled (env VESMARO_UPDATES__CHECK_ENABLED) or the independent hard kill switch VESMARO_UPDATES_CHECK=off. vesma update without flags reports every update surface on the machine (pip dists, npm @vesmaro/vesma, host prod-venvs, Go binaries); --yes --scope=user upgrades the installed dist via pip install --user --upgrade (PEP 668 --break-system-packages only under an externally-managed interpreter), updates npm best-effort, and appends to ~/.local/share/vesma/update-history.json; --to <version> is the rollback path; --install-timer/--uninstall-timer manage a weekly (OnCalendar=weekly, Persistent=true, RandomizedDelaySec=1h) systemd USER timer. Prod venvs, Go binaries and containers are NEVER auto-updated (report-only by design, documented in the unit headers and docs).

Changed

• vesma integration setup is now the full host deployment by default (UX inversion, owner ruling; board card vesma-integration-setup-default-all) (src/vesmaro/cli/util.py, src/vesmaro/cli/doctor.py, integrations/targets.yaml; docs docs/en|ru/user/getting-started.md, docs/en|ru/user/integration-guide.md, docs/en|ru/user/cli-reference.md) — the plain vesma integration setup deploys the pack to **ALL...

Vesma 5.1.1

Vesma 5.1.1 — the native auto-indexing ships for real

Shipping-integrity fix. The 5.1.0 artifacts were cut from a tree that did not contain the PG-0.5 code (the wave landed on a branch the release merge never touched — a human-level git mistake, caught by the docs writer who refused to document nonexistent behavior). The 5.1.0 CHANGELOG advertised native auto-indexing in error; this release ships it.

What ships now

• Native auto-indexing (zero-touch): every MCP call / pre_llm_call hook emits a cheap activity hint; a project whose cwd carries a packaging manifest (pyproject.toml, setup.py, package.json, go.mod, Cargo.toml — a bare .git does NOT count; $HOME and the filesystem root are always refused) auto-registers and indexes itself in the background on one cooperative scheduler thread.
• Guardrails: one root = one graph (name hints reuse the existing project), a global auto-registration cap (64), per-project throttle (300 s), a failed first index suspends auto-retries until a successful manual/watch publish, PG7 attribution and fail-closed limits identical to manual runs.
• The recall beacon then appears by itself in assemble_context — no harness instructions, no skills, nothing to remember. Turn it all off with code_graph.auto_index: false.
• Project graph user guide: docs/en/user/project-graph.md (+ RU mirror), with the config table and FAQ.

Verification

Full suite 4683 passed / 0 failed (incl. 15 native e2e tests); mypy --strict clean; bench s1 gate PASS (recall@5 = 0.9495). Docs EN/RU 1:1 with sync guards.

Vesma 5.1.0 — project graph as memory, native auto-indexing

Vesma 5.1.0 is the first minor release after the rebrand: the memory server now also knows your codebase. The project code graph (ADR-0032) ships as a first-class subsystem — a memory-grade symbol graph over registered project roots, exposed through 10 MCP tools and a /graph/ REST namespace, stored in a sidecar database that never touches the main store or the vault. Both graph families are now ON by default, the record canon v1.0.0 is enforced at the write path, and the mesh gains the W3 agent leg with Ed25519 agent tokens and a per-request data gate.

What's changed

• Project graph as memory (#438) — index a registered project root once, then search symbols, trace call/import/inheritance paths, pull file outlines and always-fresh code snippets via mnemos_search_graph, mnemos_trace_path, mnemos_get_code_snippet and friends, with /graph/* REST twins. Security invariants PG1–PG7 are enforced by construction: zero bytes of source stored (names, ranges, signature shapes only), root confinement, secrets-detected files poisoned forever, snippets freshness-checked and secret-scanned at issuance, export-blind (graph artifacts never federate), fail-closed index limits, per-agent audit on every call.
• Graphs ON by default (#440) — graph_auto_mint, graph_walk, feedback_apply and the project graph (code_graph.enabled / code_graph.watch) default to true; tree-sitter is now a core dependency, not an optional extra. Nothing self-starts (the graph waits for an explicit index_project), and either family hides with one flag.
• vesmaro-canon v1.0.0 enforced (#416, #418, #419) — checkpoints mint a server-signed canon envelope (forged copies stripped), the render always emits all five sections, and a write-path validator checks every enveloped record with six machine-parseable codes — warn by default, strict mode rejects on create. The canon integration pack (#426, #431) ships record-standard instructions, a writing skill and the five pinned JSON Schemas to every connected harness natively.
• Canon engine integrity (#441, cascade review) — canon_warnings is single-writer gate-owned, client task/decision/report envelopes persist per canon §2, the strict gate runs before the vault write (a rejected record leaves no file behind), JSON import strips server-minted keys (--trusted-restore for trusted backups), and schema deploys verify the canon pin in both directions.
• Mesh W3 agent leg (ADR-0018 variant (c)) — the AgentGateway contract, Ed25519 agent tokens (vesmaro agent-token issue/rotate/revoke/list), the ValidateAgentToken RPC, and the per-request agent data gate with effective-scope narrowing on List/Read/Write — a compromised mesh node can no longer skip the gate by dialing core data RPCs directly.
• Watch tools rebuilt — mnemos_watch_start/stop/status now register the project-graph watch poll with honest prerequisites and status reporting; the M8-era stub that reported false success is gone (legacy directory-watcher arguments are refused with an explanation — see the changelog for the migration note).

Also in this release: opaque core-owned subscription cursors with storage revisions (ADR-0020), the ADR-0004 decision-provider seam with a deterministic baseline (#439), and the P3 project-graph review tails fixed (trackers 10173a2a, 57ae9a66).

Verification

Full suite: 4656 passed / 0 failed (1 skip). mypy --strict: clean (115 files). ruff check src/ tests/: clean. Bench S1 gate: PASS — recall@5 = 0.9493 (corridor floor 0.9121).

Compatibility and rollback

Minor, additive release on top of 5.0.0. Two behaviour changes to note: graphs are on by default (disable with code_graph.enabled: false or VESMARO_MNEMOS__GRAPH_WALK=false), and the legacy mnemos_watch_start directory-watcher form is refused. Rollback: pin the previous release (vesma==5.0.0).

PRs: #416 #418 #419 #426 #431 #436 #438 #439 #440 #441. Merge line: 0046526 → 8ad07ca.

Native auto-indexing — zero harness wiring (PG-0.5)

Indexation now happens BY ITSELF: every MCP call / pre_llm_call hook emits a cheap activity hint; a project whose cwd carries a packaging manifest auto-registers and gets its first index (or a stale reindex) in the background on one cooperative thread. One root = one graph; manifest-only markers ($HOME and bare-.git refused); a failed first index suspends auto-retries; the recall beacon then appears on its own. No instructions, no skills, nothing to remember. (ADR-0032 update 2026-09-29; 15 e2e tests.)

Vesma 5.0.0 — VESMA rebrand

Vesma 5.0.0 — VESMA rebrand

Product renamed: Mnemos → Vesma (owner decision, 2026-10-01, naming track: 37 waves / ~350 names / ~1200 registry probes).

VESMA = Vector-Environment Storage for Memory-Agents.

Install

pip install vesma            # canonical
pip install vesma-memory-server  # full-name alias

npm: @vesmaro/vesma (scoped; naked vesma on npm is registry-blocked globally).

Breaking (deprecated until 6.0)

• CLI: mnemos → canonical vesma (legacy alias still works)
• Env: MNEMOS_* / VESMARO_MNEMOS__* — deprecated spellings; VESMARO_* canonical, VESMA_* MCP-brand canonical
• MCP tools: mnemos_* + vesma_* dual-prefix (env VESMA_MCP_BRAND=vesma)

Preserved wire contracts

mnemos: tag namespace, X-Mnemos-* headers, federation proto mnemos_core_api, peers mnemos-A/B/C — unchanged until 6.0.

Stats

Suite 4647 passed / 0 failed; ruff clean; cascade review: Security PASS + QA PASS-after-fix + TL self-run.

Vesmaro Project · Apache-2.0

v4.3.0

Changed

• Search v2 query semantics — FTS v2 builder, project soft fallback, graph leg, embedding_id stamp (issue #313, ADR-0029) (src/mnemos/storage/sqlite_store.py, src/mnemos/manager.py, src/mnemos/models.py, src/mnemos/storage/vector_store.py, src/mnemos/cli/main.py, tests/{test_search_v2_golden,test_search_v2_scope_fallback,test_search_v2_graph_leg,test_embedding_id_backfill}.py — new, tests/test_security.py) — the M15.2 whole-input quoted phrase (the injection hardening) made multi-token queries adjacency phrases ("GWS конвейер" → 0 live hits vs 4 for the per-token AND) and disabled prefix matching (конвейер 49 rows vs конвейер* 77 — inflected RU/EN forms invisible). The v2 builder keeps the hardening and removes the side effects: every token is individually quoted with a builder-owned prefix star ("tok"*), AND-joined (cap 8 terms), with a de-hyphenated OR-alternative per hyphenated token (("release-trigger"* OR "release"*) — unicode61 splits on hyphens, so the bare identifier can never match the split index); AND-empty multi-token queries retry ONCE with the OR join (bm25-ranked, logged). Scope drift (release-pipeline vs releases-pipeline) no longer silently zeroes scoped searches: the A9 pre-RRF predicate is unchanged, a NEW OUTER retry without the scope surfaces the rows TAGGED (SearchResult.project_scope_fallback, backward-compatible field) and audited (search_stats()["project_scope_fallback_total"], new counter distinct from cross-project; explicit status= drill-downs are NOT retried — the same status policy holds on the retry, no junk resurfacing). New graph leg v1: after RRF fusion the top-limit fused ids expand 1 hop along memory_edges (supersedes, both directions — get_incoming_edges added), edge rows not already fused are appended with the deterministic decay (1-alpha)/(rrf_k + 2*anchor_rank) (same FTS weight at a strictly deeper position — never outranks its anchor; the naive 1/(rrf_k+2*rank) DOES at alpha 0.5 and was caught by the golden decay test), carry via_graph=True, pass the SAME status/quarantine (ADR-0019 §5 — an edge is never a side door)/refined-only (§4) gates, capped at limit extra rows. memories.embedding_id (NULL for 1644/1644 live rows — a diagnostic trap; the vector leg resolves by id and worked) is now stamped by upsert_embedding on every write and closable for existing rows via mnemos backfill-embedding-ids (idempotent id-join against vectors.db, dry-run default, --apply to write; rows whose vector is gone stay NULL — the column never lies); the production-DB backfill run is deliberately NOT part of this slice. Snowball stemming is deliberately deferred (FTS rebuild migration) — prefix terms are the zero-migration morphology fix; recorded as the follow-up in ADR-0029. Tests: golden suite re-derives every live-probe defect as a semantic assertion (multi-token far-apart AND, inflected prefix, both hyphen spellings, drift-tagged fallback with counter, superseded sibling via graph, injection battery on the builder output, single-token no-regression proven as a prefix superset of the old exact phrase), plus the M15.2 escaping tests updated to the v2 shape and a builder-level injection class (output always executes; no operator syntax; stars are builder-owned).

• search.hybrid_alpha default 0.7 → 0.5 — balanced RRF fusion (quick win, issue #300) (src/mnemos/config.py, config.example.yaml + config.container.yaml, docs EN+RU (incl. cli-reference env defaults), e3 run manifests) — one constant: the RRF fusion weight now balances the FTS/vector legs. At alpha 0.7 the vector leg structurally subordinated any FTS-only match (an FTS-rank-1 hit scored 0.3/61 < a pure-vector rank-1 at 0.7/61); at alpha 0.5 they tie, so FTS-rank-1 matches stop drowning by construction — no special-case code. Measured on both embedder regimes (probe, issue #300): governance top-5 68→73/96 nano (+5.2pp, the full B1 recoverable set) / 68→69/96 lexical (+1.04pp); knowledge recall@5 +3.9pp nano / +3.7pp lexical; G-neg top-5 composition byte-identical (zero displacement). Per-call hybrid_alpha= overrides (manager/SDK/MCP) unchanged. Event-driven S1/S1m re-baseline per ADR-0020 (composition-algorithm change): recall@5 0.8637→0.902967 (S1 hybrid) / 0.863002→0.902269 (S1m nano); model fingerprint unchanged — fusion, not embedder. e3 run manifests now pin retrieval.hybrid_alpha in the content-addressed core (probe finding 6) so a future default re-tune is visible to e3 content-addressing; recorded runner-1 runs stay valid as history (version-gated verify).

• Search v2 short-token guard — degenerate tokens no longer collapse bm25 idf (issue #314, closes via #317; ADR-0029) (src/mnemos/storage/sqlite_store.py, tests/test_search_v2_golden.py, tests/test_security.py, benchmarks/baselines/{s1.json,BASELINE.md}, docs/project/adr/0029-search-v2-query-semantics.md) — 1-char tokens and RU/EN stopwords (_FTS_STOPWORDS frozenset, exact lowercase entries) matched nearly every row, collapsing bm25 idf to 0 and degrading any AND query containing one to LIMIT rows ordered by id-tiebreak noise. The guard runs between tokenisation and _FTS_TERM_CAP: 1-char tokens are dropped; stopwords are dropped unless the token is fully uppercase (acronym exemption — IT, QA, DB, CI, ML, GWS, and AND-as-literal survive; Cyrillic isupper() acronyms included); identifier-shaped tokens (v2, x1, p0) survive structurally (>=2 chars, never alpha stopwords — no digit-scanning code); an all-degenerate query keeps its original tokens (never-empty fallback — the builder must not introduce silent zeros); dropped tokens consume no term-cap budget. Injection safety untouched: tokens still flow through the same per-token quoting, no new user text reaches MATCH raw. S1/S1m baselines re-recorded per ADR-0020 (semantics change is permanent, the measured shift is real): reference recall@5 0.9366 → 0.9409, recall@10 0.9503 → 0.9642 (planted appearances 202 → 221); S1m recall@5 0.9275 → 0.9484; corpus/model fingerprints unchanged. Tests: golden suite section 8 (13 cases — builder pins, acronym/digit survival, never-empty whole-list fallback, cap interplay, manager-level recall) plus the test_security quoted-only pin updated to the guarded token list.

v4.2.0

Added

• Round-3 embedder weights + fingerprint-aware re-embed migration (ADR-0021) (src/mnemos/models/mnema-embed-v1/, src/mnemos/manager.py, src/mnemos/embeddings/__init__.py, src/mnemos/storage/sqlite_store.py, src/mnemos/cli/doctor.py, benchmarks/baselines/{s1.json,BASELINE.md}, tests/{test_embeddings_mnema,test_pipeline_state,test_doctor_vector_vintage}.py, docs EN+RU) — the bundled mnema-embed-v1 artifact is swapped to the round-3 export (epoch-3 checkpoint, teacher Qwen/Qwen3-Embedding-0.6B, weights_sha256 3b752e06…, int8 29.6 MB, MRL dims 64/128/256/384, opset 15, dataset fingerprint b27f8cf0…; corpus ~100k text→teacher pairs incl. 8086 real store entries, RU 41.9%; manifest schema-merged — the training-side export uses embed_dim and carries no name, the bundle contract keeps name/dimensions and gains the full provenance tail). P0 migration gap closed: _vector_metadata previously stamped only content_hash, so after a weights swap the unchanged content made old-geometry vectors look fresh forever — mixed embedding spaces with silent vector-search degradation. Every upsert now also stamps model_fingerprint; heal_stale_embeddings re-embeds any vector whose fingerprint is missing (pre-swap vintage) or differs from the current embedder, through the single write point upsert_embedding, keeping the batch/limit budget — and the sweeper now PAGES through the whole refined set (previously it re-read the same created_at DESC head window every cycle, so a uniform-vintage migration could never drain past the first limit rows). Provider identity contract: EmbeddingProvider.fingerprint (concrete default = class name) with nano:sha256:<weights> for the bundled model, ollama:<model> / onnxhub:<model>@<revision> / st:<model> coarse switch-detection identities for the external providers (documented limitation: no weights hash, so silent upstream weight refreshes under the same name are not detected), plus a doctor-side twin config_fingerprint(cfg) that computes the identity WITHOUT loading a provider session and a test pinning twin==instance. mnemos doctor's Vector store check now counts vintage-mismatched rows (WARN + the mnemos reindex / background-heal recommendation; diagnostics only). S1 re-baselined in the same PR per ADR-0021: deterministic corridors unchanged (recall@5 0.8637), S1m honestly re-recorded on the round-3 weights — recall@5 0.87452 → 0.863002 (−0.0115, inside CI95 ±0.0439), with the eval-jig student recall@5 gain 0.428 → 0.4485 (191 judged queries, teacher const 0.6071) as the adoption evidence. Docs: EN/RU architecture overview carries the round-3 lineage + vintage-tracking note; the migrate runbook (EN/RU) explains the gradual background re-embed on upgrade. Tests: +12 (fingerprint pin/twin/legacy-degradation/coarse formats, metadata stamp, heal on mismatch/missing/no-op, limit-drain, quarantine skip, doctor vintage verdicts incl. corrupt metadata + JSON surface).
• mnemos doctor: pending-refinement queue diagnostics (ADR-0019 Phase D) (src/mnemos/cli/doctor.py, tests/test_doctor_pending_refine.py, README.md) — new "Pending refine" health check: counts rows with pipeline_state='pending' (the B2a refine intake, which the B1 backfill filled with bypass-era heritage) and WARNs with the mnemos processor start recommendation when the queue is non-empty — CLI-only deployments have no background daemon, so the queue never drains on its own. Diagnostics only: the doctor deliberately does not run the processor (it is a server-side service). A missing pipeline_state column (pre-ADR-0019 schema) or a missing DB is a PASS with an explanatory detail. The README's Auto-pipeline feature row now documents the pending state and the processor command. Tests: 7 new cases (missing DB, zero-pending, 1/3 pending WARN + recommendation, pre-ADR-0019 schema, JSON output wiring).

Changed

• Hermes bypass removed — publish_on_write neutralized (ADR-0019 Phase D) (src/mnemos/adapters/hermes.py, tests/test_hermes_adapter.py) — the adapter no longer publishes on its own: _maybe_publish (the publish_on_write → publish(skip_quality_check=True) path) is deleted and every write verb (add_memory / sync_turn / mirror_memory_write / session_end / save_checkpoint) now goes out WITHOUT an explicit status, so the server's mnemos.visibility policy owns the initial visibility through the fail-closed ingest gate (ADR-0019 §2 B2b): immediate (default) publishes clean content at once with pipeline_state=pending (refused content is stored RAW, zero-loss); curated holds the row RAW + pending until the refine cycle gates the refined projection. publish_on_write=False therefore no longer means "raw forever": it is a no-op compatibility knob (still accepted because the Hermes shim passes it; an INFO line says so when flipped) — under immediate every entry is visible regardless of the knob, under curated the row is RAW + pipeline_state=pending and the refine daemon completes its visibility. Per-adapter visibility flags were explicitly rejected by the ADR-0019 committee (server-level default); the first-class publish surface and the REST POST /publish/{id}?skip_quality_check=true endpoint are unchanged — only the adapter's automatic use of the bypass is gone. Tests: the old bypass tests are replaced by the new-semantics pins (immediate + knob off → visible; curated + knob off/on → RAW+pending, visible after refine_pending; injection write → refused at path=ingest, RAW + pipeline_state=None, audited) plus a removal-contract guard (_maybe_publish absent, no skip_quality_check/manager.publish in the adapter source).

Fixed

• Security: fresh pip-audit advisories closed, make verify gate green again (#267) (pyproject.toml, uv.lock) — newly published PYSEC advisories against four pinned packages made every make security / CI pip-audit run red. Floors raised to the minimal fixed versions: aiohttp>=3.14.1,<4.0 → >=3.14.3,<4.0 (PYSEC-2026-3546/3547 fixed in 3.14.2, PYSEC-2026-3545 in 3.14.3 — one floor covers all three) and cryptography>=48.0.1 → >=50.0.0 (PYSEC-2026-3552; the major bump is verified compatible — the codebase only uses stable primitives: Fernet, AESGCM, PBKDF2HMAC, x509/rsa/hashes). The other two advisories hit venv tooling no direct pin controlled inside the audited dev environment: pip>=26.2 (PYSEC-2026-3721; enters transitively via pip-audit → pip-api) and setuptools>=83.0.0 (PYSEC-2026-3447; via grpcio-tools' runtime dependency) are now floored in the [dev] extra — the exact profile make security and CI audit. uv.lock freshly regenerated on a dedicated branch (no parallel-track drift carried in): the four fixes, the previously missing types-PyYAML dev pin added, and the setuptools-linked training-extra subtree re-resolved to latest (torch 2.12.1→2.14.0, triton, cuda-toolkit, nvidia-cudnn/nccl — lock-only collateral; training stays outside the runtime per ADR-0021 and is installed by no gate). No new --ignore-vuln crutches: the pre-existing documented CVE-2026-45829 ignore (chromadb legacy) is untouched.
• Federation/import rows now pass the Phase A danger gate (#166) (src/mnemos/cli/import_.py, src/mnemos/cli/sync.py, tests/test_federation_import_gate.py) — run_sync_import (compact federation payload) and _import_json (JSON export merge/restore, including --overwrite) wrote peer-status rows directly through sqlite.save(), so a PUBLISHED record arriving from peering never met the ADR-0019 publication gate. Both paths now route every imported row through the new gate_imported_memory helper — the SAME single gate point the server uses (MemoryManager._publish_gate_detection, i.e. danger_detectors.detect over the served projection and the title, fail-closed, audited as publish gate: … path=federation-import): a positive danger signal or scanner error stores the row RAW + pipeline_state=NULL (zero-loss, invisible, no embed — and outside the refine intake so danger-class content cannot auto-refine back into visibility); a clean row keeps the peer's status and a NULL pipeline_state is stamped pending so the local refine queue picks it up (non-NULL peer states — refined, quarantined — are never clobbered; a peer's quarantine verdict survives import). An --overwrite refusal also evicts the formerly-published row's stale vector embed (N1 demotion hygiene, mirroring MemoryManager.update), and each refusal appends an operator-facing warning to the import result. Tests: 9 new cases (federated PUBLISHED with secret/injection-in-title/scanner-error → RAW+NULL+invisible+un-embedded+audited; clean → PUBLISHED+pending+embedded; JSON-import twin; overwrite demotion with embed eviction; quarantine preservation; clean RAW row joins the queue) — the mutation "remove the gate call" fails them first.

4.1.0

4.1.0 — universal behavioral pack + MCP SDK in core

Every target now gets always-on memory instructions — including a brand-new opencode target — and the base install speaks MCP out of the box: mcp>=2.0,<3.0 moved into core dependencies, so one plain install is all an agent harness needs (ADR-0023).

Highlights

• Universal behavioral pack, new opencode target (#231/#232) — a new agents_md deployment kind injects a stamped, additive always-on digest of the three instruction files (recall at session start; checkpoint before compaction and session end; tag contract on every write; memory ops are PRIORITY tools) into each harness's native standing-instructions file: ~/.agents/AGENTS.md for the agents target (the one AGENTS.md-standard channel — Claude Code included), ~/.zcode/AGENTS.md for ZCode, and ~/.config/opencode/AGENTS.md for the NEW opencode target (OpenCode reads it natively; nested skills to ~/.config/opencode/skills/; MCP registered via an additive merge into ~/.config/opencode/opencode.json that preserves other servers and user-tuned values). The pi target receives the same pack as a standing system-prompt hint injected by the shipped bridge extension. The block engine never touches user content: deploy appends around it, update replaces only the stamped region, uninstall strips only the block; deploy/update/uninstall/verify report missing/stale/version-drift/content-drift. Fully backward compatible — copilot/cursor/hermes/generic-copilot/pi deploy maps unchanged.
• MCP SDK in core dependencies (ADR-0023, #234) — mcp>=2.0,<3.0 (bare; the upstream [cli] extra only added already-core deps) joined project.dependencies; the mcp extra remains as an empty compatibility alias. Before this change the base install could not run mnemos mcp-server — the primary agent-harness surface — and every fresh base install got a guaranteed mnemos doctor FAIL on MCP transport. Binding conditions implemented: an AST import-isolation guard pins the SDK to mnemos.mcp_server (a subprocess test proves the CLI import path never loads it), and the pip-audit/SBOM gate covers the unified profile. Net-new transitive deps ~1 MiB; doctor remediation strings and the EN/RU docs sweep now name the plain package everywhere.
• Docs overhaul: three-command quick start + RU admin mirrors — the README quick start is now three one-command steps (install the server → mnemos integration setup connects the harness AND deploys the behavioral pack → mnemos doctor), with every install variant delegated to the extended EN/RU getting-started guide — the <!-- version:… --> release-marker blocks moved there too, and sync-readme-version.sh follows them since #236. A docs-vs-code accuracy pass reconciled every operational doc against the real Typer CLI registrations, config/env forms, MCP tool registry and FastAPI routes (22/22 CLI subcommands and 26/26 MCP tools documented, ~80 broken anchors/links fixed), and the three EN admin pages that had no Russian counterpart are now mirrored 1:1 (EN/RU documentation synchronous).
• ADRs recorded — ADR-0023: MCP SDK moves into core dependencies as bare mcp>=2.0,<3.0 (implemented in this release; binding: lazy-import guard test, unified pip-audit/SBOM). ADR-0024: all harness connection consolidates into mnemos connect [harness] over the existing targets.yaml registry in three phases (4.1.0 alias + detect-all listing; 4.2 cursor/windsurf/claude-code targets + doctor on the registry; 4.3 Codex TOML-merge + legacy deprecation), with binding security controls.

Note on artifacts: no build assets are attached to this release and PyPI still carries 3.2.0 — distribution publication is a separate owner decision.

Full changelog: CHANGELOG.md — 4.1.0

v4.0.0 — bundled nano-embedder major: chromadb removed, zero-config memory

Re-cut 2026-09-03 (ADR-0022, owner decision): this release now ships under Apache-2.0 (was tagged MIT on 2026-09-03 19:43, before any installable artifacts existed). The original MIT tag and its auto-generated source archives remain MIT (per-version license fixity). All versions ≤ 3.2.0 remain MIT. See ADR-0022.

v4.0.0 — bundled nano-embedder major

Fully local memory out of the box: bundled mnema-embed-v1 (29.6 MB int8 ONNX, RU+EN, 384d) as the default embedding model; chromadb removed from the runtime (−3 CVEs, −250 MB install). No downloads, no API keys, no network — install → first search offline.

Highlights

• NM-1c+1d (ADR-0021, epic #197) — bundled mnema-embed-v1 as default embedder (distilled in-project, RU 49% corpus, cos 0.958 to teacher); onnxruntime/tokenizers/huggingface_hub promoted to direct deps; legacy chromadb configs migrate with a deprecation warning; external providers (onnx, ollama, sentence-transformers) remain the quality escape hatch. S1m re-baseline: recall@5 0.929 → 0.875 on the 192-query corpus — the accepted −5.5 pp trade for full autonomy.
• BF-2/3/4 benchmark framework (ADR-0020, epic #169) — S3 long-lived-session stand (fact-retention gates the future refiner), S4 availability-probe stand (read-only invariant, quarantine exclusion), S2 nightly mode with measured noise bands, 192-query judged corpus (McNemar p=4.3e-07), one-page owner report (make bench-report) with F1–F7 traffic lights.
• License: Apache-2.0 (ADR-0022) — niche norm (mem0/letta/cognee/chroma/qdrant), explicit patent grant, trademark carve-out, NOTICE documents model provenance. Monetization model: open core; closed GUI (mnemos-eyes) planned; FSL only if triggers fire (10k stars / 25k downloads/mo / GA−1mo / first external contributor → CLA).
• NM-1d final naming — mnema-embed-v1 (was nano-embed-v1); docs sweep 28+4 mentions.

Note on the re-cut: the v4.0.0 git tag was re-created on the Apache-2.0 commit; the original MIT-tagged snapshot (7574c47) and its auto-generated source archives remain publicly reachable and MIT-licensed. No installable artifacts (PyPI/npm/wheel/container) were ever published for the MIT cut — PyPI's mnemos-memory-server carries 3.2.0 (MIT), and 4.0.0 goes to PyPI under Apache-2.0.

Full changelog: CHANGELOG.md 4.0.0

v3.2.0 — context lifecycle skill (mnemos_assemble_context, mnemos_context_rewrite, mnemos_hooks)

v3.2.0 — mnemos-context-lifecycle skill (closes #209): cover mnemos_a…