Melete v0.1.0

Melete carries a responsibility to completion on your own machine: it never repeats an external effect it is unsure about, and it asks you exactly once when only you can decide.

This is the first release, and it is a pre-release. It states what the code does and, just as plainly, what it does not claim. Every claim below maps to a named test in the repository.

Getting started

Melete runs with Docker Compose on a Linux host. Connect the model provider and the accounts you choose, then delegate jobs. The README covers installation, keys, the first run, and how to run the conformance suites yourself.

Ships

• Durable jobs. A job is a bounded Postgres state machine with disposable attempts, leases, waits, approvals and receipts. Wakes are recovered, stale attempts are fenced, and runtime death is survived.
• Brokered effects. Every external action is canonicalized, hashed, scope-checked, approved when its effect class needs it, budget-reserved and receipted. An unknown outcome is verified or settled, never resent. One logical effect keeps one identity across attempts.
• Typed repair. A failing connector says what kind of failure it met. The broker retries what did not leave, parks a rate limit, refreshes an expired credential once, stops on a revoked grant, and never re-aims an effect. Safe stops are counted apart from completions.
• A pinned engine per attempt. Hermes Agent v2026.9.7, started fresh for every attempt in a container with no route out, mounting only the job's own workspace.
• Tool discovery. A token-budgeted core catalog plus search_tools and load_tool, with loaded schemas persisted for the attempt.
• Connectors. Files, web with SSRF checks, IMAP and SMTP email, ICS and CalDAV calendars, in-cell code execution with artifact validation, speech generation, operator-configured MCP servers over HTTP with installation during a running session, bounded reconnect and sealed credential refresh, and a browser worker outside the cell with person takeover.
• Memory. Evidence with exact spans, versioned claims, protected corrections that invalidate exactly the outputs that cited them, deterministic extraction, and forgetting that survives a database restore through an independent removal journal.
• Attention. One question per wake, one owner queue, a reason on every notification, reactions as acknowledgements, and watch predicates that wake a job only when a small deterministic test holds.
• Learning, scoped. A correction becomes an episode, a candidate procedure, a held-out evaluation with a baseline arm, a canary and an activation, with rollback, for one procedure family.
• Experience API and web app. Conversations, permission cards, receipts with undo, drafts sent by the person, quick answers, agents, plans, routines, saved details, rules, search, reactions, and sign-out.
• Deployment. A Compose stack with an internal-only runtime network, a per-attempt work subpath, 23 static boundary checks, a runtime image that asserts its engine commit and plugin hash and writes a CycloneDX inventory, and a restore procedure.
• Evaluation evidence. A resumable harness with bounded spend reservations, 70 synthetic destination fixtures, and separate deterministic and language grades.

Measured

• The test suite passes 1,734 tests with 29 skipped and none failing on the released commit.
• Conformance scenarios 1 to 8 passed 44 tests on a Linux Docker host and skipped one, the second-provider comparison, which needs a credential.
• The memory runner passed ten scenarios, with every withheld-memory arm failing as required.
• Restart under an active job and under a parked approval recovered with exactly one receipt. The restore proof served the forgotten fact to nobody and produced exactly one destination effect.
• The combined capability proof against the real engine passes five stages and 85 assertions.

Not claimed

• Reliable task performance or answer quality with a real model. The recorded evaluation campaign on DeepSeek V4.1 Flash failed its own gate: deterministic checks passed 34, 32 and 38 of 70 across three runs. It observed zero duplicate effects and zero successful injections within the documented fixture exposure. Ordinary tests use scripted providers.
• Learning beyond the one evaluated procedure family.
• Real transcript compaction, and production stdio MCP launch, which needs an isolated launcher.
• Virtual-machine isolation, confidential compute, host-compromise containment, rootless Docker, and any operating system other than a Linux Docker host for the sealed cell. The service holds the Docker socket and sits inside the host trust boundary.
• Interactive sign-in inside the browser worker, and provider OAuth stored inside the runtime.
• An exportable tamper-evident action ledger, an upgrade procedure between releases, universal physical erasure of forgotten data, and an invitation interface for shared spaces.

On current Linux hosts the embedded Postgres binary does not start, so the test suite needs DATABASE_URL. bun run doctor names each missing prerequisite. The full changelog is in CHANGELOG.md.