(S)AGE — Sovereign Agent Governed Experience

Persistent, consensus-validated memory infrastructure for AI agents.

SAGE gives AI agents institutional memory that persists across conversations, goes through consensus validation, carries confidence scores, and decays naturally over time. On a multi-validator network that validation is a BFT quorum; on a personal install it is the node's own signed vote. Not a flat file. Not a vector DB bolted onto a chat app. Infrastructure — built on the same consensus primitives as distributed ledgers.

The architecture is described in Paper 1: Agent Memory Infrastructure.

Just want to install it? Download here — double-click, done. Works with any AI.

Quick Start · Architecture · Capabilities · Dashboard · Release history · Documentation

Quick Start

Desktop: Download the latest release, open SAGE, then use CEREBRUM to connect your AI. For a full walkthrough, see Getting Started.

From source (Go 1.26.8+):

git clone https://github.com/l33tdawg/sage.git && cd sage
go build -o sage-gui ./cmd/sage-gui/
./sage-gui setup    # Pick your AI, get MCP config
./sage-gui serve    # SAGE + Dashboard on :8080

Or grab a binary: macOS DMG (signed & notarized) | Windows EXE | Linux tar.gz

Docker

docker pull ghcr.io/l33tdawg/sage:latest
docker run -d --name sage \
  -p 8080:8080 \
  -v ~/.sage:/root/.sage \
  ghcr.io/l33tdawg/sage:latest

Pin a specific version with ghcr.io/l33tdawg/sage:11.20.3.

The SAGE server stays in that container. To give a local MCP client a stdio bridge, start a second process inside the same running container:

docker exec -i \
  -e SAGE_PROVIDER=claude-code \
  -e SAGE_PROJECT=my-project \
  -e SAGE_IDENTITY_PATH=/root/.sage/agents/claude-code-my-project/agent.key \
  sage /usr/local/bin/sage-gui mcp

For the shipped Compose stack, use the service name rather than a generated container name:

docker compose -f docker-compose.sage-gui.yml exec -T \
  -e SAGE_PROVIDER=claude-code \
  -e SAGE_PROJECT=my-project \
  -e SAGE_IDENTITY_PATH=/root/.sage/agents/claude-code-my-project/agent.key \
  sage /usr/local/bin/sage-gui mcp

If an MCP client launches this through a wrapper, point its stdio configuration at the wrapper's absolute path. Pass SAGE_PROVIDER, SAGE_PROJECT, and SAGE_IDENTITY_PATH through docker exec -e/docker compose exec -e; setting them only on the host-side Docker command does not place them in the container. Keep the whole SAGE data root mounted at /root/.sage, including agent keys and the ledger. Do not start a separate docker run ... mcp container: its localhost:8080 is isolated from the running SAGE server.

HTTP MCP is also available at /v1/mcp/sse and /v1/mcp/streamable, but both require a bearer token or OAuth. Bare http://localhost:8080 is the REST base, not an unauthenticated MCP endpoint.

Upgrading from an older version?

Upgrading an existing node — including the v10.x → v11 jump — is docs/UPGRADING.md. In the desktop app, accept the update: SAGE verifies canonical upgrade compatibility, captures a full recovery snapshot, installs, and restarts automatically. Headless and quorum operators have separate technical procedures in the guide. Your chain advances in place; a personal node climbs the consensus fork ladder by itself. Read the guide before a multi-admin chain crosses app-v23 — that activation re-derives administrator authority.

If you installed SAGE before v5.0 and your AI isn't doing turn-by-turn memory updates, re-run the installer in your project directory:

cd /path/to/your/project
sage-gui mcp install

This installs Claude Code hooks that prompt the memory lifecycle (boot, turn, reflect) — even if your .mcp.json is already configured. Restart your Claude Code session after running this.

Related MCP server: universal-memory

Architecture

flowchart TB
    A["AI agents · MCP / SDK / REST"] --> P["SAGE node · authenticated admission + live policy"]
    H["CEREBRUM · local human control"] --> P
    P --> M["Memory + local policy transactions<br/>CometBFT / ABCI"]
    P --> W["Node-local coordination<br/>inbox / claims / replies"]
    M --> B["BadgerDB<br/>authoritative chain state"]
    B --> Q["Commit-time SQL projection<br/>content + vectors for authorized recall"]
    P -. "explicit peer trust and sharing" .-> F["Separate SAGE chain<br/>bounded Read / receiver-controlled Copy"]
    classDef entry fill:#eef2ff,stroke:#6366f1,color:#1e293b
    classDef memory fill:#ecfdf5,stroke:#059669,color:#064e3b
    classDef work fill:#fff7ed,stroke:#d97706,color:#7c2d12
    class A,H,P entry
    class M,B,Q memory
    class W,F work

Agents are not validators. Personal mode runs one real CometBFT validator with a per-node memory auto-voter; it has no Byzantine redundancy. Registering more agents does not add consensus voters. A multi-validator deployment runs one shared chain; federation connects separate chains under explicit policy.

Storage has two roles. BadgerDB is authoritative for consensus state. SQLite (personal) or PostgreSQL + pgvector (cluster) projects memory content and vectors at Commit. Node-local message coordination is separate from the memory consensus path. Block inclusion is not the same as memory acceptance.

For the detailed trust boundaries, lifecycles, and deployment topology, see Architecture & Deployment.

Current Capabilities

How agents collaborate

flowchart TB
    T["Task assigned to exact agent"] --> N["One-way assignment notice"]
    N --> I["Unified inbox"]
    R["Request addressed to exact agent"] --> I
    I -->|"task notice"| V["Verify current assignment in backlog<br/>then update the task"]
    I -->|"inbound request"| C["Claimed by one MCP runtime"]
    C -->|"normal completion"| O["Idempotent reply"]
    C -. "intentional same-agent takeover" .-> H["Handoff: expected session + revision"]
    H --> O
    O --> S["Original sender reads reply_items<br/>or pages retained replies"]
    classDef input fill:#eef2ff,stroke:#6366f1,color:#1e293b
    classDef task fill:#ecfdf5,stroke:#059669,color:#064e3b
    classDef message fill:#fff7ed,stroke:#d97706,color:#7c2d12
    class I input
    class T,N,V task
    class R,C,H,O,S message

Assignment, claim, and reply are different states. A task notice is not a request for a message result, and a reply is not a new assignment. Runtime handoff does not reassign a task to another agent. Wake notifications are payload-free hints, not delivery or claim evidence. Every agent request and result remains untrusted data, not authority to expand the user's instructions.

See the MCP task/inbox reference and message/reply lifecycle for exact fields, recovery, and authorization rules.

CEREBRUM Dashboard

http://localhost:8080/ui/ — a dashboard-native operator console centered on the 3D MRI memory brain, with chain health, agents, federation, semantic memory, recall tuning, vault recovery, tasks, imports, and updates around it. Every major workflow is available from the browser; the CLI stays there for automation and recovery.

The dashboard also includes governed agent enrollment, Access Groups, domain permissions, separate CEREBRUM Root credential handover, import/export, software updates, and encryption controls. Ordinary agent identity replacement uses re-enrollment; historical memory authorship is preserved.

What's New in v11.20.3

A peer's "too large" answer no longer kills the message. The federated outbox classified 413 alongside the 4xx statuses that mean the peer understood the request and refused the bytes, so a single refusal marked the transport event failed and the canonical message with it: the row is never scanned again, and a durable-until-handled message carries an expiry a century out that never relieves it. That verdict is wrong for this status. A peer's per-route body cap is a build-time constant that moves when the peer upgrades, and the refusal is frequently not about size at all — on 2026-09-15 a message was refused as too large while its signed body sat 2.6 KB under the route's 16 KiB cap, and a larger message to the same peer was accepted unchanged minutes later. 413 now retries on an hourly floor, like the other capability-shaped status, so the event stays pending and delivers once the peer can take it.

The listener stopped calling every body it could not read "too large". The federation gate read the request body and answered 413 for any error, which merged a genuine over-cap body with a truncated upload, a mid-body disconnect and a stream reset — and the sender's terminal 413 rule turned that mislabel into permanent loss. Only a real *http.MaxBytesError is 413 now; a body this node could not read is answered as a read failure, which stays retryable, and logged with its underlying cause.

A delivery failure is visible in the log. The transport worker logged only when recording a failure failed, so an event could die with nothing in the log to say why. Every failed attempt now carries the event, the peer, the kind, the attempt count, the verdict and the retry delay.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.20.3. SDK 11.20.3.

What's New in v11.20.2

A submission whose outcome the node could not observe is now reported as exactly that, instead of as a failure. Every REST submit waits for broadcast_tx_commit, and that wait can expire before the block lands — on a loaded cluster the transaction then commits seconds later, while the caller has already been told 500 Broadcast error, indistinguishable from a genuine internal fault. That was worse than unhelpful: a caller retrying "on error" re-signs, so one write can be applied twice. The endpoint now answers 202 with "status":"indeterminate", the exact tx_hash of the bytes that went on the wire, the allocated nonce, and "retryable":false, while the node's signer nonce fence keeps reconciling the real fate.

Definitive outcomes keep their verdicts. A CheckTx or FinalizeBlock rejection still returns the status it always did, and a full mempool still returns 429 with Retry-After — nothing was admitted, so there is nothing in flight to chase.

Generated testnets stop inheriting the wait that causes it. deploy/init-testnet.sh now writes timeout_broadcast_tx_commit explicitly (45s) rather than leaving CometBFT's 10s default, and keeps it strictly below SAGE's own client-side wait (SAGE_TX_COMMIT_TIMEOUT_MS, 60s) so the node — which knows whether it admitted the bytes and can name the transaction hash — is always the party that answers.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.20.2. SDK 11.20.2.

What's New in v11.20.1

Federated replies are deliverable for a week, not a day. The window a reply stays admissible, and the deadline its retained outbox event is retried until, move from 24 hours to seven days (federation.PipeEventResultLifetime). A destination re-derives that window from the signed proof, still admits the legacy 24-hour window, and a destination that predates the longer one is answered by one downgraded retry at the old window instead of a terminal failure — so replies keep flowing while peers upgrade at their own pace. Receipt evidence about a message keeps its own separate 24-hour grace.

Replies can no longer be permanently lost to a local retention re-stamp. The startup migration that extends durable canonical sends matched every pending msg-% outbox row, including the receiver-local msg-fed-… id of an imported message — whose outbox row is a reply. It re-stamped those replies to a +100-year lifetime, which the destination refuses as an invalid proof, and because the same column is the retry deadline it also removed the give-up path, so the reply retried until it happened to reach the peer and collect the permanent 400. The rescue is now scoped to sends, stamps the exact durable sentinel (+36500 days, not SQLite's calendar +100 years), repairs rows an earlier build already extended, and reply envelopes are built from the signed proof so local retention state can never reach the wire.

A refused proof now says why. The destination logged nothing when it refused a proof, and the sender only recorded the destination's single opaque invalid pipeline agent proof refusal, which is how ten historical reply failures stayed unattributable. The destination now logs the exact reason and the sender checks its own reply envelope against that same rule before pushing.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.20.1. SDK 11.20.1.

What's New in v11.20.0

An agent's working state can now be stored encrypted on the node. Two new surfaces are reachable only from inside the app-v23 pipeline agent boundary, and both refuse to run without the Synaptic Ledger vault: PUT/GET /v1/private-media/{uuid} stores immutable JPEG originals with ciphertext-only rows, per-caller actor isolation, quota enforcement and a startup disk-floor probe, and PUT/GET /v1/workflows[/{uuid}] gives an agent an encrypted, actor-bound journal for long-running work with compare-and-swap revisions, strict argument bounds and an opt-out conversation guard. Neither surface can be reached for another agent's rows, and neither writes a plaintext copy to the database or its WAL.

You can now prove whether message storage is encrypted. GET /v1/messages/storage reports the honest storage posture of this node, and POST /v1/messages accepts a strict signed require_encrypted_storage boolean: an agent that must not be stored in the clear now gets a 503 instead of a silent downgrade, and a malformed or unsigned value is rejected rather than ignored. The authenticated request-body limit became route-aware for exactly one route: a canonical-UUID private-media PUT gets one extra MiB, everything else keeps the 1 MiB ceiling.

Local durability is no longer taken on faith. SQLite opens with synchronous=FULL in both DSN and PRAGMA form and the node verifies journal_mode and synchronous at boot, refusing to serve when the durability posture is not provable. Vault publication is atomic in the same vein: attaching a vault and marking encryption required can no longer be observed separately, so an unlock cannot leave a window where a write is accepted against a store that does not yet require encryption.

Lantern bring-up support. sage-gui init-lantern-private creates a fresh-only hardware identity — it refuses an existing or mismatched node rather than reusing it, takes its companion-key bootstrap explicitly, and never installs services or enables public enrollment. A SAGE_LANTERN_PRIVATE_LISTENERS node treats a missing config as an error instead of a default, and the policy is re-checked when the YAML is loaded so an edit cannot silently weaken it.

A public-memory Merkle index ships dormant, and no fork is opened. The sparse SHA-256 index over committed PUBLIC=0 records, its migration builder and its stage/promote path are in the tree with their tests, and no production code calls any of them. Staged rows live under a local namespace that is excluded from the AppHash; promotion is what writes into AppHash-covered state, it is explicitly named for app-v28, and it is not reachable from a running node. Read that as preparation, not as activation.

Federation: you decide which of your agents the other side can find. A trusted link advertised every eligible ordinary agent to the peer, which is convenient with one agent and confusing with a dozen — the other operator sees names they do not recognise and sends work to the wrong one. Each connection now carries an explicit discovery policy: All agents (the default), Only the ones I pick, or None. Ticking one agent narrows the connection to exactly that agent, ticking more adds them, and Save discovery policy commits it under the same revision-bound agreement the rest of federation uses. It governs listing and exact-name search only: it grants no memory Read and authorises no delivery, and an agent that still refuses federated delivery stays visible as Not accepting by design so the peer is never promised a route it cannot use.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.20.0. SDK 11.20.0.

What's New in v11.19.22

The Go build floor moves to patched 1.26.8. Both modules now declare go 1.26.8, up from 1.25.13, and every Go container builder moved with them: Dockerfile, deploy/Dockerfile.abci, deploy/Dockerfile.node, both federation-acceptance Dockerfiles and deploy/init-testnet.sh. Building from source now requires Go 1.26.8 or later.

This is not a fix for a hole you have. v11.19.21 and everything before it were built with Go 1.25.13, and that toolchain scans clean on its own standard library. It is a deliberate move forward: the dependency group below requires Go 1.26, and the bare 1.26.0 those tools would otherwise have pinned is precisely the version govulncheck reports 26 reachable standard-library advisories against — among them net/url (GO-2026-6218), html/template (GO-2026-6091), crypto/tls (GO-2026-6090, GO-2026-5856), net/http (GO-2026-6089, GO-2026-5026), encoding/xml (GO-2026-6088), encoding/asn1 (GO-2026-5972), net/textproto (GO-2026-5039) and crypto/x509 (GO-2026-5037). 1.26.6 is the minimum fix for those; 1.26.8 is the newest patch of the line, and on it the vulnerability gate reports no reachable vulnerabilities in either module.

Dependencies refreshed. github.com/jackc/pgx/v5 v5.11.0, github.com/klauspost/compress v1.20.0, golang.org/x/crypto v0.57.0, golang.org/x/sync v0.23.0, golang.org/x/sys v0.48.0, golang.org/x/tools v0.50.0 and modernc.org/sqlite v1.58.0, plus the x/net, x/mod, x/text and x/telemetry indirects. The SQLite driver moves to SQLite 3.53.4, which carries upstream's own journal-rollback fix — the reason the local super-journal patch existed — so that patch retires with no change to recovery behaviour. The pgx bump adds TypeMap to the pgx.Rows interface, so the store tests move from pgxmock/v4 to pgxmock/v5; that is a test-only import change with no runtime effect.

Also in this release: golang.org/x/crypto still carries GO-2026-5932 at v0.57.0, its newest release. It is in the module graph and is not reachable from SAGE code; the gate reports it as uncalled rather than failing.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.19.22. SDK 11.19.22.

What's New in v11.19.21

A co-commit can no longer re-commit bytes the quorum already rejected. A co-commit commits on block inclusion and never runs the voter, so the content-hash dedup that keeps a rejected memory's exact bytes out was skipped on that one write path: a jointly-signed envelope could re-admit content that had been deprecated, under a fresh memory id, while the same bytes submitted through POST /v1/memory/submit were refused as a duplicate. POST /v1/cocommit/submit now consults the same lookup before it broadcasts and refuses a tombstoned hash with 409 Tombstoned content; the envelope's own SharedID is excluded so an idempotent re-send still works. It is a submission-boundary check rather than a consensus rule — the consensus path deliberately reads no off-chain state — so a node that broadcasts a co-commit transaction directly, bypassing its own REST surface, is not covered by it.

The MCP client stopped keeping its own duplicate rule. sage_remember, sage_observe and sage_reflect used to drop a write when more than 60% of its significant words appeared inside one of the first 50 committed memories in the domain — silently, order-dependently, and only on MCP, so the same write over REST or the SDK landed. They now report the node's own verdict: POST /v1/memory/pre-validate runs the same dedup, quality and consistency checks the vote applies, an exact duplicate comes back as status: "skipped" carrying the node's reason, and a memory that merely shares vocabulary with an existing one is stored instead of discarded.

Also in this release: the validated status is documented as declared-but-unwritten (nothing has ever produced it, and recall would hide such a row), an unused ValidateMemoryRecord that duplicated the REST validator is gone, and the reference docs state plainly that knowledge triples and access_logs are write-only.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.19.21. SDK 11.19.21.

What's New in v11.19.20

Dedup rejection is sticky. Content that was rejected, challenged, or forgotten can no longer be re-admitted by submitting the identical bytes again: the voter's dedup lookup now matches any other memory that has left proposed, not just committed ones, while a candidate can never match its own row (the v10.1 self-match fix stays fixed). Two identical submissions racing each other no longer veto each other, and a correction still passes whenever its content actually changed.

The dedup lookup — evaluated once per pending memory on the voter's two-second poll — is now indexed on both stores. SQLite gains a content_hash index; Postgres drops its legacy committed-only partial index at startup and rebuilds once, which can make the first boot after upgrade slower on a large memories table.

Also in this release: the README, the sage-memory skill, and the reference docs qualify the BFT/consensus claims for single-validator personal installs, and the papers section now cites the true published provenance.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.19.20. SDK 11.19.20.

What's New in v11.19.19

Security dependency update: upgrades gRPC-Go from v1.83.1 to v1.83.2, addressing CVE-2026-84445 / GHSA-2v4p-qf9q-27wj. The upstream fix rejects HTTP/2 requests missing both :authority and Host headers, preventing a panic in xDS servers. SAGE's CometBFT servers use ordinary gRPC servers, but the dependency is patched for defense in depth.

No consensus or storage migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.19.19. SDK 11.19.19.

What's New in v11.19.18

Federation agents now visibly orbit their nodes. Motion continues over empty map space and resumes after pointer selection; hovering an agent, keyboard inspection, and dragging keep targets steady. Pause motion and reduced-motion preferences remain supported.

Container: ghcr.io/l33tdawg/sage:11.19.18. SDK 11.19.18.

What's New in v11.19.17

See your federation. CEREBRUM opens connected nodes as an interactive connectome with agent clusters, search, zoom, a List view, and a selection panel for exact addresses and connection controls. Gentle ambient agent drift includes a pause toggle, stops during interaction, and respects reduced-motion settings. Actual node names make the viewed node clear, including when you open another SAGE through a tunnel.

A dedicated operator-only SSE stream shows recent message and reply transport status without exposing message text or proofs. Live changes animate when their endpoints are loaded; reconnecting refreshes history without replaying old traffic. The view is bounded, with explicit agent and node paging.

Federation onboarding now explains Exchange codes → Verify together → Explore agents. Both confirmation screens preserve the explicit number check and explain that memory sharing is optional. Read, Copy, and Clear domain permissions accept bulk selection or drag-and-drop into a draft, with an explicit save. Removing trust keeps its separate confirmation and pairing-again explanation.

No consensus-rule or application-version change; app-v27 remains the ceiling. Existing permissions and trust agreements stay in place. Container: ghcr.io/l33tdawg/sage:11.19.17. SDK 11.19.17.

What's New in v11.19.16

Connect nodes, find agents, send messages. Trusted peers running v11.19.16 make eligible ordinary agents discoverable and messageable automatically, without exporting each agent or granting access to memory domains. Root identities stay excluded, and explicit messaging blocks still apply.

CEREBRUM adds a searchable directory grouped by node, exact-address copying, and paged agent lists. Bulk selection and drag-and-drop prepare Read/Copy sharing choices; saving those choices explicitly grants memory access. Pairing alone shares no memory domains, and existing approved grants remain in place.

MCP sage_directory searches local and federated agents by default. Upgrade both peers for automatic node messaging; older peers retain their export-based behavior. New sends refresh legacy recipient tickets, while queued messages retain their original authorization mode.

Federated replies now accept the signed claimant-session field emitted by MCP, fixing peer rejection of otherwise valid replies. Reply retries report the actual retained delivery state and diagnostic instead of always claiming "queued". Existing failed events remain failed; the upgrade does not silently resend them.

No consensus-rule or application-version change; app-v27 remains the ceiling. Container: ghcr.io/l33tdawg/sage:11.19.16. SDK 11.19.16.

What's New in v11.19.15

Consensus-safe memory cleanup, without the 500-record cap. CEREBRUM now scans the full inventory, previews verified eligible counts, and processes manual or automatic cleanup through existing consensus challenge transactions. Open tasks and internal records are protected. The UI distinguishes queued work, confirmed submissions, and observed outcomes instead of reporting premature success.

Automatic cleanup requires fresh current-Root authorization after upgrading; old enabled toggles do not silently activate it. Preview does not enable cleanup. Exact signed transactions are saved before submission for safe recovery. A challenge may need further votes; audit history is retained. See the cleanup guide.

No consensus-rule or application-version change; app-v27 remains the ceiling. Container: ghcr.io/l33tdawg/sage:11.19.15. SDK 11.19.15.

What's New in v11.19.14

Security dependency update: gRPC-Go is upgraded to v1.83.1 to address HTTP/2 DATA-frame fragmentation heap exhaustion (CVE-2026-84304, Dependabot alert #45). The required genproto and OpenTelemetry dependencies are refreshed alongside it. CodeQL workflow actions are pinned to the verified v4.37.9 commit.

This patch introduces no consensus-rule, AppHash-input, key-encoding, fork-target, or application-version changes. App-v27 remains the supported ceiling.

Container: ghcr.io/l33tdawg/sage:11.19.14. SDK 11.19.14.

What's New in v11.19.13

The stdio MCP bridge no longer self-installs project hooks into the user’s home directory. When sage-gui mcp starts with $HOME as its working directory, automatic project repair now returns without writing .claude hooks or project-relative hook registrations into user-global configuration.

Explicit sage-gui mcp install and sage-gui codex install commands keep their existing home-directory refusal. Normal project-directory self-healing also remains unchanged, including when CLAUDE_CONFIG_DIR points elsewhere.

This patch changes no consensus rule, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.13. SDK 11.19.13.

Release History

The latest release notes are above. Earlier entries below describe behavior at their release dates; use the current reference for present-day contracts.

What's New in v11.19.12

Project-scoped MCP and Codex installs can no longer corrupt user-global host configuration. sage-gui mcp install and sage-gui codex install now refuse to run when the working directory resolves to the user's home directory. Run the command from the intended project instead; ordinary project installs are unchanged.

The native-shell build also refreshes its fail-closed checksum for the official September linuxdeploy-plugin-appimage rebuild. The replacement was produced by the upstream project's successful scheduled workflow from its unchanged source commit, and its downloaded SHA-256 matches GitHub's release-asset digest. An unexpected future replacement will continue to stop the build.

This patch changes no consensus rule, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.12. SDK 11.19.12.

What's New in v11.19.11

CEREBRUM now supports operator-configured hostnames behind a local TLS reverse proxy. Set SAGE_ALLOWED_CEREBRUM_HOSTS to an exact comma-separated hostname allowlist when Caddy, Traefik, or another loopback proxy preserves the browser-facing Host instead of rewriting it to localhost. Ports are normalized and wildcards are deliberately unsupported.

The trust boundary stays local: the connected peer and every forwarded IP hop must still be loopback, unconfigured hostnames still fail closed, and browser origin matching accepts X-Forwarded-Proto only when every field-line and comma-joined token is a valid, case-insensitive http or https value and all hops agree. Empty, malformed, or mixed scheme chains are rejected.

This patch changes no consensus rule, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.11. SDK 11.19.11.

What's New in v11.19.10

Returning agents can be reviewed normally again. When app-v26 retirement has handed an agent's former home domain to the stable Root principal, CEREBRUM reapproval now binds the existing owner and uses the established Root-to-agent recovery transfer for that exact recorded home. Fresh or operator-entered domains never receive an implicit transfer.

Rejecting a pending registration now counts active memories—the same lifecycle view shown by the recovery panel—instead of treating deprecated audit history as work the operator can still remediate. Active records continue to block ordinary rejection unless they are deprecated, transferred, or the explicit attribution-preserving force path is chosen.

This patch changes no consensus rule, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.10. SDK 11.19.10.

What's New in v11.19.9

Codex workspace identity resolution now fails closed at the filesystem root. A user-level Codex MCP process launched from / can no longer reuse the retired global-codex signer or auto-register the synthetic name codex//. SAGE rejects that broad, untrustworthy boundary before Git discovery, project-config lookup, key loading, or key generation. Real project and linked worktree roots continue to resolve to their stable workspace identities; operators who intentionally need a non-workspace shared identity must pin it explicitly with SAGE_IDENTITY_PATH.

This patch changes no transaction, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.9. SDK 11.19.9.

What's New in v11.19.8

Access Groups now discover transferred historical domains, not only each member's enrollment-time home domain. CEREBRUM's bounded caller-domain projection consults the consensus-maintained current-owner index for the caller and active local group peers. A transferred user-* domain therefore appears as a usable exact recall or write target even when its current owner never authored a memory there.

Every discovered candidate is still re-authorized against current ownership, group authority, profile restrictions, and hard denies before it is returned. Per-record classification checks remain on the memory disclosure path. The result remains bounded and explicitly reports truncation; it does not expose a global domain roster, change ownership, copy grants, or weaken shared-domain and foreign-write restrictions.

This patch changes no transaction, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.8. SDK 11.19.8.

What's New in v11.19.5

Claim recovery and host wake coordination now survive real multi-transport runtimes. Both exact-local compatibility claim paths—GET /v1/pipe/inbox and explicit PUT /v1/pipe/{pipe_id}/claim—atomically bind the session and create its receipt, so ownership cannot commit without recovery evidence. MCP claimant identities are durable and transport-scoped across stdio, Streamable HTTP, and SSE; claimant_identity_mode discloses whether the identity is durable, a safe concurrent ephemeral fallback, inherited, or unavailable.

Claim transfer remains deliberate. sage_message_handoff requires the exact claimant_session_id and claim_revision returned by passive history; stale or A→B→A delayed transfers fail the revisioned compare-and-swap fence. The direct REST route preserves pre-v11.19.5 clients by treating an omitted from_revision as 0 only, so it can move an untouched first-generation claim but safely conflicts after any transfer. SAGE never steals a claim merely because it is old.

The new signed, payload-free GET /v1/inbox/activity-state returns exactly {version,epoch,seq} so host hooks can notice fresh task assignments and replies. The opaque 32-character database-incarnation epoch survives process restarts and backup restore, but changes for a fresh database so an old host cursor cannot suppress new cues after reinitialization. Those events remain nonblocking coordination: they do not change the exact three-field {version,seq,pending} contract of /v1/messages/wake or /v1/messages/wake-state, and they never make Stop treat a reply as unfinished work. Hooks can surface activity on the next prompt, but cannot resurrect an already-idle host task.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. The supported consensus ceiling remains app-v27.

Container: ghcr.io/l33tdawg/sage:11.19.5. SDK 11.19.5.

What's New in v11.19.4

Updater governance compatibility and recovery state are now one atomic proof. The replacement binary reports its own maximum supported application version. SAGE validates canonical pending-plan and active-ballot state against that exact ceiling while holding the same runtime read fence that pins the snapshot height and AppHash. Consensus cannot publish newer governance state between the compatibility decision and the verified recovery snapshot.

v11.19.3 acquired those two read fences separately. Its snapshot was coherent, but a concurrent Commit could make the preceding compatibility verdict stale. Personal single-node installs still upgrade normally in the app: v11.19.3 and v11.19.4 have the same app-v27 ceiling, the personal-node watchdog cannot create an unsupported app-v28 transition, and the updater performs the recovery snapshot, coordinated stop, final stopped-state snapshot, install, rollback, and restart automatically. No CLI or manual preflight is required. The stopped-node procedure in docs/UPGRADING.md is only for quorum or externally managed nodes where an operator can mutate governance during the v11.19.3 check-to-fence window.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.4. SDK 11.19.4.

What's New in v11.19.3

Normal upgrades now preserve compatible governance state automatically. The desktop updater reads the canonical pending plan and active proposal under one runtime-consistent view before changing the executable. A supported in-flight upgrade is included in the existing verified recovery snapshot and continues after restart; it is not a reason to interrupt the user or block the update. No terminal command, preflight ceremony, or governance expertise is required.

Malformed canonical state, an undecodable upgrade ballot, or a target newer than this binary supports still fails closed before executable mutation. The technical upgrade status and stopped-node upgrade preflight commands remain available for headless and quorum operators. Superseded safety notice: the v11.19.3 live updater did not hold one uninterrupted fence across that check and snapshot capture. That does not impose a CLI step on a personal node; only quorum or externally managed governance needs the coordinated stopped-node procedure when leaving v11.19.3.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.3. SDK 11.19.3.

What's New in v11.19.2

Binary replacement now has consensus-authoritative upgrade-governance proof. The read-only /upgrade/governance-status ABCI query reports the current application version, the exact pending upgrade:plan record, and the canonical state:gov:active proposal. Upgrade ballots include their decoded target application version. Storage, pointer/proposal identity, bounds, canonical-name, status, height, and payload-decode failures return ABCI code 1 instead of being misreported as an empty plan or ballot.

sage-gui upgrade status now consumes that fail-closed query rather than inferring safety from /abci_info plus the off-chain dashboard projection. The stopped-node sage-gui upgrade preflight command uses the same canonical inspector before the new server starts. v11.19.3 integrates that compatibility decision into the normal updater and lets supported in-flight operations continue automatically.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.2. SDK 11.19.2.

What's New in v11.19.1

Stranded message claims remain recoverable beyond the retained-history window. sage_inbox now embeds the first passive, payload-free page of unfinished claims held by another runtime sharing the same exact agent identity. Agents can continue through every older page with sage_message_history(folder="claimed_elsewhere"), then deliberately transfer an exact claim through the existing compare-and-swap sage_message_handoff path after deciding that its former claimant is dead or stale.

The recovery projection exposes only the message ID, claimant-session fence, timestamps, and local/federated classification needed for safe handoff. It does not expose sender identity, intent, payload, result, provider, or chain IDs. Expired TTL-bounded claims are also excluded consistently from both the exact diagnostic count and its recovery pages before the periodic expiry sweep runs.

Provider-addressed compatibility messages now bind atomically to the exact claiming agent and MCP session, resurface on later polls, support CAS handoff, and complete idempotently through sage_message_reply. A failed reply explicitly does not authorize creating a substitute sage_message_send; agents must recover the original claim or report the failure. Existing claimed provider rows receive an off-chain SQLite legacy session fence during startup migration.

This patch introduces no consensus change or application-version increase. The supported consensus ceiling remains app-v27.

Container: ghcr.io/l33tdawg/sage:11.19.1. SDK 11.19.1.

What's New in v11.19.0

Record authors regain lifecycle authority in reserved shared namespaces. After app-v27 activates, the immutable author of a record in general, self, meta, or sage-* may challenge that record and may reinstate its open challenge without separately holding a level-3 Modify grant. The exception is record-scoped and does not apply to governance-promoted shared domains. Pending or inactive enrollment, read-only/profile restrictions, shared-write denies, and classification/clearance failures still deny the action. App-v21 weighted challenge rounds include the eligible record author in their frozen electorate.

Omitted task status now has one canonical meaning. After app-v27, a signed new-task request that omits task_status is canonicalized to planned by both REST transaction construction and consensus proof verification. Pre-app-v27 chains retain the historical requirement to send task_status: "planned" explicitly, preserving replay and AppHash compatibility.

App-v27 is a governed consensus upgrade from app-v26 with no state migration. Its rules begin at H+1 after activation; older blocks replay under their original application version.

Container: ghcr.io/l33tdawg/sage:11.19.0. SDK 11.19.0.

What's New in v11.18.28

Reserved shared domains are readable again without becoming ownable. Active local principals can read the compile-time shared namespaces general, self, meta, and sage-*, while each record's classification still applies. This restores the shared-domain behavior expected by existing agents without opening private or restricted records.

Access-grant transactions now reject attempts to register either those reserved namespaces or governance-promoted shared domains as owned domains. REST reports that conflict as a forbidden request, and the API, SDK, and RBAC references now state the same contract.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.28 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.28. SDK 11.18.28.

What's New in v11.18.27

Empty semantic recall now distinguishes genuine absence from an incomplete vector-space view. For an empty, domain-scoped semantic query, index_status reports complete, incomplete, or fail-closed unavailable only when the caller and exact query universe support that conclusion. The same signal is relayed through sage_recall and sage_turn, so write-on-absence agents can avoid manufacturing duplicates when committed memories are temporarily unreachable in the active embedding space.

The proof is caller-safe and race-fenced across canonical projection, SQL, embedding-space, and vault generations. Narrowed or federated queries and unhealthy projections never receive a false completeness claim, while bounded indexed probes keep the empty-result path operationally safe.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.27 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.27. SDK 11.18.27.

What's New in v11.18.26

The supported Go dependency baseline is refreshed. This release carries the validated testify 1.12.0, x/crypto 0.55.0, and x/tools 0.49.0 module updates already exercised by the full repository gate.

Code scanning and native-shell CI actions are refreshed to their pinned current revisions. CodeQL runs with the updated action bundle and the native shell cache action is updated, without changing SAGE runtime behavior.

HTTP MCP tokens now bind to existing approved managed identities. On app-v23 nodes, token creation no longer generates an unapprovable pending principal: Root/Admin selects an active ordinary agent already managed by the node, and issuance fails closed if its exact key is unavailable. The CLI also handles mcp-token create --help without minting a credential and rejects unknown creation flags.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.26 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.26. SDK 11.18.26.

What's New in v11.18.24

Federated inbox work now has recoverable, session-fenced ownership. SAGE binds an inbound federated claim to the receiving MCP session before exposing its payload. Retained older claims receive an explicit legacy CAS fence for deliberate handoff; live work is never stolen by a timeout. Reply completion, the claimant check, encrypted result fingerprint, and durable return event now commit atomically, so a lost-response retry returns the original event while a different second reply conflicts.

MCP boot guidance no longer rides inside ordinary tool results. Lifecycle standing stays in initialize.instructions, including for a client that initializes after its first tool call. The former imperative block that asked an agent to invoke tools and edit a memory file has been removed, keeping the inbox trust boundary internally consistent.

Embedding-space and retention diagnostics are more precise. The readiness guard labels only a qualified-versus-bare spelling of the same provider/model leaf/dimension as a likely alias, without collapsing two organizations that publish the same basename. Durable-until-handled presentation is limited to actionable pending/claimed work, while mixed-version retention-only responses remain compatible.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.24 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.24. SDK 11.18.24.

What's New in v11.18.23

Turn-time recall now carries the same trust and lifecycle evidence as explicit recall. sage_turn includes each recalled memory's corroboration_count and status, so the every-turn path no longer hides corroboration weight or whether a recalled row is committed or currently challenged.

Embedding-space drift is visible before it silently empties semantic recall. At boot, SAGE compares the active embedder with the non-deprecated vector spaces already in the local store. A mismatch produces a loud warning and a structured embedding_space block in /ready; the node remains available by default while strict readiness returns 503, allowing an intentional re-embed migration to finish instead of turning a quality warning into an outage.

Managed reranker setup now diagnoses incompatible prebuilt engines. After a verified install, SAGE preflights llama-server. Proven GLIBC, GLIBCXX, or CXXABI loader failures preserve the loader's real error and point operators to the bring-your-own reranker path instead of reporting a successful unusable install.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.23 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.23. SDK 11.18.23.

What's New in v11.18.22

A missing optional ForceGraph API can no longer strand CEREBRUM after the verified brain has rendered. The renderer now publishes the core graph and truthful counts before optional anatomical, control, and interaction setup. The bundled runtime's absent clickAfterDrag helper is feature-gated, so the brain hull, controls, and auto-rotation continue instead of falling into the cold unavailable path with real nodes already on screen.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.22 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.22. SDK 11.18.22.

What's New in v11.18.21

A domain-summary refresh can no longer cover a verified MRI graph. The MRI renderer is now the sole authority for the central unavailable overlay. Domain inventory failures stay localized to their own retrying panel, while genuine cold graph failures and unsafe mode switches remain fail-closed.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.21 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.21. SDK 11.18.21.

What's New in v11.18.20

A transient MRI refresh no longer hides a graph CEREBRUM has already verified. Memory and Connectome snapshots now retain their explicit source mode. If a live refresh fails, CEREBRUM keeps the last verified snapshot visible only when it belongs to that same mode, while retrying in the background. Cold failures and failed mode switches still fail closed, so Connectome bytes can never masquerade as a verified memory projection.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.20 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.20. SDK 11.18.20.

What's New in v11.18.19

Codex project hooks stay inside their project. The v11.18.18 byte-exact self-healer could mistake Codex's user-global ~/.codex configuration directory for a project and generate a global hooks.json. That made an unrelated Codex task receive SAGE inbox Stop nudges for the shared agent identity. The healer now refuses the user-home/global scope; project-local hooks continue to self-repair.

Connectome clicks now have one hit-tested owner. The redundant DOM click fallback that raced ForceGraph's deferred node click is gone. Small pointer wobble is handled by one explicit tolerance, background dismissal uses the graph's raycast result, and clicking a second neuron no longer closes the inspector and starts a competing zoom-out first. Raw domain-access metadata is summarized behind a bounded disclosure below traffic, relationships, and memory details; bloomed memory nodes now expose hover and accessible click feedback.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.19 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.19. SDK 11.18.19.

What's New in v11.18.18

Codex upgrades now repair stale SAGE lifecycle hooks automatically. On every MCP startup, the project self-healer compares all five installer-owned Codex hook scripts with their fully rendered current templates. A mixed generation can no longer pass merely because the files exist or another hook mentions the current binary. Upgrading therefore replaces legacy no-op Stop hooks and malformed prompt hooks without requiring a second manual sage-gui codex install run.

The CEREBRUM Connectome now leads with the graph itself. Neurons have a larger practical click target; clicking one opens its persistent identity, visible incoming/outgoing traffic, strongest peer, directed connection list, and visible memory lobe. The compact fallback selector now shows only agents with visible peer relationships, ordered by retained traffic, instead of turning a large dormant/test roster into the primary navigation surface. Isolated authorized neurons remain visible and clickable in the brain and join the selector while selected.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.18 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.18. SDK 11.18.18.

What's New in v11.18.17

Routine MCP restarts no longer make the same stdio agent disown its own unfinished messages. The primary stdio runtime now persists one opaque claimant identity per exact signed agent, provider, and project under SAGE_HOME, and holds an OS advisory lock as the liveness fence. A later runtime reuses that identity only after the earlier process is no longer live; a genuinely concurrent runtime receives an independent identity and retains the existing one-handler and compare-and-swap handoff boundary. In-place installed-binary handoff also carries the current claimant identity while the old process keeps the lock alive.

The fix is deliberately prospective and does not bulk-transfer historical claims created by pre-v11.18.17 random process identities. Those rows remain visible through claimed_elsewhere_count and passive history and can still be transferred one at a time with the existing CAS-fenced handoff after the old claimant is known dead. HTTP MCP conversations remain transport-scoped. This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.17 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.17. SDK 11.18.17.

What's New in v11.18.16

Claimed agent work no longer disappears from the inbox that claimed it. sage_inbox now returns a separate bounded own_claimed_unfinished projection for messages already owned by the exact current agent session. The projection is passive: it never claims, refreshes, transfers, or duplicates work, and it does not change the established items or count meaning of newly available work. Exact agent/session filtering, completion and expiry handling, bounded results with an exact total, reply-after-repoll, and nonmutation are pinned by store, REST, and MCP regression coverage.

The payload-free hook status path also checks the durable wake snapshot, so claimed-but-unfinished work cannot be reported as a clean inbox merely because no unclaimed row remains. Older or temporarily incapable nodes degrade to an explicit unavailable state instead of either a false zero or a failed primary inbox call. This patch does not automatically transfer claims from another session; passive history plus explicit compare-and-swap handoff remain the recovery boundary. It introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.16 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.16. SDK 11.18.16.

What's New in v11.18.15

Every unfinished exact-recipient local canonical message now has a durable wake generation, including upgrade-era claimed-only work and sends through the deprecated pipe route. Startup backfill covers both pending and claimed rows, so a recipient whose only live work was already claimed cannot reopen as the silent {seq:0,pending:true} state. Keyed exact-local pipe sends use the canonical idempotent admission path; unkeyed sends insert the row and advance the same recipient sequence atomically. Publication happens only after commit, exact replays do not republish, and an incapable backend fails before insertion rather than creating durable work that wake consumers cannot observe as new.

The experimental Claude notification adapter is explicitly opt-in again. The shipped Claude Code host registers the custom notification handler, but end-to-end delivery from a plain .mcp.json server through its plugin-scoped gate remains unverified. An idle adapter would also acquire the one exact-agent wake lease and exclude a useful long-running consumer. SAGE_CLAUDE_CHANNEL=true enables it for an operator who has confirmed that delivery path.

Pending-memory presentation is deterministic even when creation timestamps tie: SQLite and PostgreSQL both use memory_id as the final ordering key. The documentation citation guard now parses newline-separated and hyphenated paths, pins every concrete declaration/lead/interior anchor, repairs only explicitly accepted declaration anchors, refuses semantic locations it cannot reconstruct, and inventories the remaining legacy skipped and bare references. This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.15 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.15. SDK 11.18.15.

What's New in v11.18.14

Durable agent messages now stay visible until the work is actually finished. Claiming a message no longer makes the payload-free wake surface go quiet: both pending and claimed rows remain unfinished, a reconnect at the current cursor receives an immediate wake, and sage_inbox reports an exact payload-free claimed-elsewhere state instead of a bounded-scan false zero. Claude Code project sessions arm the signed wake channel by default, while the optional Stop hook reads a lease-free monotonic snapshot so new or stranded work can nudge a session once without stealing the live SSE consumer lease.

The same recovery path is honest at its edges. A claimant-session fence rejection remains a typed conflict instead of masquerading as a missing message, and history plus explicit compare-and-swap handoff remain the only way to recover another session's claim. Canonical retention migration now rescues only the exact historical 24-hour stamp, preserving a sender's chosen bounded TTL across every store reopen, including RFC3339 nanosecond timestamps.

CEREBRUM's Connectome now identifies the agents it renders. Hover details are positioned and escaped reliably, while click, tap, and keyboard selection open one persistent inspector with exact agent identity, visible retained traffic, peers, activity, and an independently loading visible-memory lobe. Selection survives authorized live refreshes, error and empty states stay truthful, mobile uses a bounded sheet, and reduced-motion and established Connectome guidance remain intact.

Agent-as-lobe corroborator reads now use one deterministically ordered bounded batch instead of an N+1 query pattern, with matching SQLite and PostgreSQL ordering. The MCP contract also states the server-enforced 31-day sage_timeline range rather than advertising requests the server rejects. This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.14 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.14. SDK 11.18.14.

What's New in v11.18.13

Hubanov's distributed-engram contribution now connects memories to the neurons that corroborated them. CEREBRUM keeps agent and memory identities in separate graph namespaces, rejects stale bloom generations, and removes every transient bridge on focus or graph replacement. The server uses a deterministic, indexed 96-row evidence prefix and exposes at most 12 authorized bridges without turning historical corroboration into a claim of current possession.

Claude's production wake source can now arm the payload-free message bus. When explicitly enabled with SAGE_CLAUDE_CHANNEL, the MCP runtime consumes the existing signed SSE wake route with a random process lease and resumable cursor. Delivery applies backpressure instead of dropping the newest wake, and shutdown releases saturated readers without leaking goroutines or claiming message content.

The Connectome no longer floats an instructional card over the brain. Its guidance lives in the existing reading panel, the mode toggle keeps one stable name and visible pressed state in both themes, keyboard focus remains clear, mobile Reset behavior stays intentional, and view changes are announced to assistive technology.

This patch also closes a claimant-session compatibility bypass: a current typed 404 is authoritative, the deprecated pipe-result alias carries the active MCP session, and only a genuine old-node route miss may fall back. It introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.13 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.13. SDK 11.18.13.

What's New in v11.18.12

CEREBRUM can now open an agent as a memory lobe. Selecting a connectome neuron lazily blooms that agent's highest-confidence visible memories as engrams, while retaining the operator-only route and app-v23 per-record projection checks. The indexed, bounded query avoids whole-brain scans; stale, failed, and disposed frontend requests cannot leave another agent's lobe on screen.

Dashboard live activity is now guarded as one exact 20-event registry. The seven previously unwired operator events now reach the existing dashboard SSE stream, while message wake, MCP, and wizard protocols stay route-local. A fail-closed typed control-flow audit and executable browser contract reject dead, aliased, escaped, build-tagged, or decoy event sinks.

Signed task creation and message attribution now agree end to end. Every official task constructor explicitly signs the required initial planned status, and REST fails fast instead of mutating an omitted signed field into a transaction that app-v23 through app-v26 must reject. Authorized message and pipe responses retain exact immutable agent IDs alongside mutable presentation labels, use one bounded batch metadata query on healthy production stores with a bounded exact-ID fallback, suppress foreign-chain label collisions, and keep count-only responses identity-free.

This patch also repairs release-facing documentation drift, pins the current 33-tool MCP inventory, and adds fail-closed symbol/citation coverage for the references it can verify. It introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.12 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.12. SDK 11.18.12.

What's New in v11.18.11

The CEREBRUM connectome now fires live without widening its operator-only boundary. Successful local message sends emit a contentless invalidation tick; the browser then refetches the existing caller-filtered snapshot and pulses only newly observed synapses. Monotonic generations preserve later ticks across in-flight requests, ordinary reloads, failures, and retries, while initial loads and unrelated refreshes never create false activity.

Dashboard retrieval activity no longer duplicates authorized memory plaintext into the global operator stream. Recall, search, and hybrid events now expose only their event type and result count. The obsolete expandable plaintext panel is gone, and serialized-frame regressions pin the contentless contract and live, non-replayed delivery.

Claude bookend sessions can discover waiting SAGE messages without claiming or revealing them. A signed, payload-free inbox-status hook reports only the current identity and unread count, makes failures visible, preserves unrelated user hooks during self-heal, and exposes the read-only message tools needed to perform the explicit inbox fetch.

This patch also keys local connectome locality by chain identity, removes a stale app-v7 validator warning after app-v14, dims the connectome skull for legibility, requires patched Go 1.25.13 throughout current builders and CI, and publishes checksum sidecars for Windows executables. It introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.11 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.11. SDK 11.18.11.

What's New in v11.18.10

Multiple MCP runtimes sharing one agent identity can no longer silently lose track of claimed messages. Every MCP conversation now has an opaque claimant session ID. Atomic inbox claims persist that session in passive history, an explicit compare-and-swap handoff transfers work between runtimes, and a stale former owner is rejected if it tries to reply after ownership moved. Receive tokens remain replay-safe after a lost response, while legacy direct REST clients retain their existing agent-level compatibility path.

CEREBRUM can render the agent message bus as a live connectome inside the 3D brain. Registered agents become domain-coloured neurons, directed channels become traffic-weighted synapses, and hub agents settle toward the core. The view consumes the existing RBAC-filtered synapse projection, drops ghost edges, and fences asynchronous mode switches so a slow memory response can never be displayed as connectome data.

Upgrade-watchdog submissions can no longer hold a signing key's nonce lease for the process lifetime when CometBFT wedges. One bounded context now covers both lease acquisition and the broadcast. A deadline after submission remains a typed indeterminate outcome, so the exact signer and bytes stay fenced until their fate is reconciled; elapsed time never releases the key fail-open.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.10 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.10. SDK 11.18.10.

What's New in v11.18.9

Ambiguous CometBFT commit and sync outcomes are now typed at the shared broadcaster boundary. Transport, status, RPC, decode, shape, hash-binding, and missing-height failures return ErrSubmitIndeterminate for valid signing keys, while the existing live-registration path remains an independent fence backstop. Pre-send request-construction failures remain definitive and do not fence a key over bytes that never reached a transport.

Federation sync now fails closed if its commit broadcaster ever violates its contract by returning neither a result nor an error. The exact signer and encoded transaction remain fenced until reconciliation proves their fate, instead of releasing the key for a potentially in-flight transaction. A new cross-package decoder contract also pins the HTTP prologue shared by internal/tx and the CEREBRUM web path while recording their deliberate verdict and envelope-tolerance differences.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.9 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.9. SDK 11.18.9.

What's New in v11.18.8

CometBFT transaction submissions no longer permit Go's HTTP transport to transparently redeliver a fenced request after a reused connection fails while reading the response. Commit, sync, byte-identical nonce-fence reconciliation, and CEREBRUM submission paths now share a non-reusing HTTP/1.1 transport seam. Each submission call writes its transaction on one connection and returns an indeterminate result instead of silently delivering the same signed bytes to a second responder. Restart failure reporting also preserves the signer-fence veto ahead of a generic drain timeout.

MCP reply polling now fails safe when a caller presents an unsafe forward watermark. If reply_since is later than the authoritative retained-reply head, or no head exists to validate it, sage_inbox returns the newest passive reply page for deduplication instead of filtering a formal reply into a false empty result. Complete recovered pages become a new safe baseline; truncated pages require composite-cursor catch-up, and failed page reads never claim recovery. A successful outbound sage_message_send also performs one bounded, sender-exact passive inbox snapshot so an inbound message that arrived after an earlier empty poll is surfaced during continued coordination.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.8 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.8. SDK 11.18.8.

What's New in v11.18.7

Large signed transactions now use a bounded CometBFT transport instead of overflowing request headers. Existing smaller broadcasts keep the established GET wire shape, while large commit, sync, and byte-identical nonce-fence reconciliation requests use JSON-RPC POST with base64 transaction bytes. Client transaction and JSON-RPC body limits are independently range-checked, capped at 8,000,000 bytes, and refuse an oversized request before send. Operators raising them must configure matching CometBFT limits. Independently, every validator enforces a 1,200,000-byte aggregate raw-transaction budget for app-v20 atomic finalization, sufficient for the measured 1,304-entry SkillRegistry transaction. Memory content remains bounded at 512 KiB, while the canonical signed AgentRequest proof has its own 600,000-byte consensus bound, admitting the measured 573,723-byte proof without widening the content or aggregate limits. Response handling accepts strict quoted or numeric int64 heights, rejects fractional, exponent, null, malformed, and out-of-range heights, and refuses unsupported content types.

Federation route refresh no longer risks recursively acquiring the sync-policy read lease from a peer-request caller. Opportunistic refresh admission is policy-free and bounded to one pending refresh per peer; the agreement and binding lookup runs asynchronously after the request caller can release its lease. Failed-request and successful-Direct triggers remain covered, while the route-exchange endpoint does not self-trigger refresh.

P2P-only peers can recover when their stored route snapshot is missing or belongs to an older trust generation. Only the authenticated /fed/v1/p2p/routes bootstrap exchange may use stale or current route addresses as connection hints; the current agreement's pinned mTLS identity remains authoritative. Protected requests reject missing or cross-generation snapshots with trust_generation_mismatch. A matching-generation empty target set remains explicitly pinned and cannot fall back to current configuration.

Federation diagnostics now give security evidence precedence over route availability evidence. Mixed route-availability plus certificate, SPKI, pin, identity-mismatch, or security-block evidence is classified as security_blocked; revocation, expired or unknown agreement, trust-failure, or authentication evidence is classified as trust_failure. Both verdict classes outrank route availability.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.7 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.7. SDK 11.18.7.

What's New in v11.18.6

Updater snapshots now prove both supported CometBFT layouts before they are published or reused. Application Badger and persisted consensus state must match at height H and agree on the application hash. A blockstore committed through H is accepted only after its H block ID and seen commit match that state. If the blockstore is durably one block ahead at H+1, SAGE additionally verifies the complete block and part identity, direct-parent and state-derived header fields, last and seen commits, validator signatures, and CometBFT's replay-time block validation. Regression coverage restores the candidate and runs the real CometBFT handshaker, proving exactly one replayed block and safe restart reuse. Malformed or more-than-one-ahead provenance is rejected, and an invalid prior publication is quarantined before a valid replacement can be published. Cancellation always blocks executable updater handoff, although a safe snapshot may already have been atomically published. Non-empty H+1 evidence is retryable until application and state catch up.

Federation Retry now performs one bounded, exact-generation recovery workflow. Concurrent operator clicks share the same route refresh and authenticated status probe. Direct and relay targets are frozen to the active JOIN generation, HTTP 401/403 and certificate/identity failures stop before re-probing, and a revoke or re-pair during the response invalidates the result. Typed dashboard diagnostics distinguish missing or expired route bundles, stale Direct routes, unavailable relays, trust-generation changes, and legacy connections that must be paired again. Ordinary polling and mutating requests do not enter this retry path.

Memory-reassignment audit failures no longer place request-controlled agent IDs in logs. The source and target are represented by fixed 96-bit truncated SHA-256 fingerprints (24 lowercase hexadecimal characters), preserving stable incident correlation without allowing CR/LF or other control characters to forge log records.

This patch does not change consensus state or application activation. The ceiling remains app-v26; v11.18.6 introduces no app-v27. The signer fence also remains process-local: unresolved submissions still require proof of fate, and crash/restart or a separate signing process is not claimed safe until durable cross-process pre-broadcast intent exists.

Container: ghcr.io/l33tdawg/sage:11.18.6. SDK 11.18.6.

What's New in v11.18.5

Long-lived stdio MCP sessions now follow an installed SAGE upgrade without executing a request under stale tools. The MCP process snapshots the exact executable that started it. If the app bundle or binary is atomically replaced, the next unread JSON-RPC frame is handed to the new executable together with the remaining stdio stream. The upgraded runtime—not the stale process—receives that request. The old runtime never executes the handed-off frame; transport failure remains an ordinary indeterminate outcome for callers to reconcile. Sessions initialized on 11.18.5 advertise MCP tool-list change support; the replacement emits notifications/tools/list_changed only after the logical session has completed initialization, so conforming clients refresh cached definitions as well as runtime behavior.

The unified coordination response identifies its live contract. Every sage_inbox result now carries coordination_schema: "sage.inbox.v2", the running mcp_runtime_version, and sender_replies_embedded: true|false. Monitors can therefore reject or report a stale pointer-only session instead of silently assuming that an empty addressed inbox also means no threaded reply arrived. The existing bounded reply_items, inclusive watermark, composite catch-up cursor, and passive sender-only authorization remain unchanged.

The upgrade from a pre-11.18.5 MCP process still requires one agent-session restart because that already-running older process cannot contain this handoff logic. Once a session starts on 11.18.5 or later, subsequent binary replacements use the automatic request-preserving handoff. Clients that ignore the negotiated tool-list notification must still re-list tools or reconnect to discover new definitions.

The consensus ceiling remains app-v26; v11.18.5 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.5. SDK 11.18.5.

What's New in v11.18.4

One inbox poll now surfaces both new work and threaded answers. sage_inbox returns replies to messages you sent under the separate passive reply_items key by default, while genuine inbound work remains under items. Reply rows never inflate work counts and explicitly require no reply. Inclusive reply_since polling prevents same-millisecond loss; truncated pages fail safe with an exact composite-cursor catch-up action and forbid advancing the watermark until the window is drained.

Release builders now enforce the patched Go floor. Root and natter modules require Go 1.25.12, CI and release jobs resolve that exact go.mod toolchain, every Go container builder uses 1.25.12, and pinned govulncheck v1.6.0 scans both modules before either CI fan-in or release publication can pass.

Legacy pipeline retention compares time chronologically and conservatively. SQLite purge eligibility no longer relies on variable-width RFC3339 text. Cutoffs are floored to SQLite's millisecond precision, so ambiguous same-millisecond rows are retained rather than deleted early; malformed read evidence also retains fail safe.

The consensus ceiling remains app-v26; v11.18.4 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.4. SDK 11.18.4.

What's New in v11.18.3

Same-key consensus submissions now fail closed across every producer in the running daemon. The dashboard, REST API, federation manager, voter, and upgrade watchdog share a per-key nonce lease. Once exact transaction bytes reach CometBFT, any unproven transport, status, RPC, decode, shape, hash, or height outcome fences that signing key until reconciliation proves those same bytes committed or permanently refused. Strict shared Comet decoders require a single bounded JSON document, explicit nested verdicts, the exact transaction hash, and a positive committed height for success.

Update restart advice now follows live fence state. A completed download no longer leaves stale restart guidance behind: retained update status reads recompute whether restart is currently safe, and the dashboard renders the server-provided instructions. Coordinated restarts are refused when a fence is present. Crash, power-loss, cross-restart, and separate-process CLI exposure still require durable pre-broadcast intent and remain explicitly out of scope.

The consensus ceiling remains app-v26; v11.18.3 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.3. SDK 11.18.3.

What's New in v11.18.2

A reply to a message you sent is readable again, through an advertised MCP tool. Previously a recipient could answer, the durable row flipped to completed, and the answer was reachable only through the passive REST projection GET /v1/pipe/results — which no MCP tool ever called. sage_inbox shows work addressed to you, not answers to you, and sage_message_status is sender-only but deliberately payload-free. So in MCP and bookend clients the reply was invisible and work round-tripped. v11.18.2 adds sage_message_replies as an explicit sender-side read (SAGE now advertises 32 MCP tools) plus a payload-free pointer inside sage_inbox that reports how many replies are retained without ever presenting them as new work.

The reply read is exact-sender-only, passive, and honest about provenance. Authorization is the SQL predicate from_agent = ? against the caller's own signed identity — not the wider callerCanViewPipe rule the workflow route uses — and no parameter names another agent, so the tool cannot serve as a message-existence oracle. Reading claims nothing, acknowledges nothing, and re-queues nothing. Every body is labelled untrusted data and attributed to the agent that actually wrote it rather than the agent you addressed. GET /v1/pipe/results gains a payload-free ?count_only=1 probe and a composite (completed_at, pipe_id) before= cursor, so replies sharing a millisecond are never stranded behind the page boundary. A store backend lacking the optional capability answers 501 instead of an empty page that would read as "no replies".

Memory, agent, RBAC, federation, and consensus behavior are unchanged; app-v26 remains the binary ceiling and v11.18.2 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.2. SDK 11.18.2.

What's New in v11.18.1

MCP session guidance now uses the protocol surface intended for it. SAGE runs its per-session boot standing during initialize and returns the adaptive full, bookend, on-demand, pending-review, or unavailable guidance through initialize.instructions. The first real tool result is therefore only that tool's payload instead of being prefixed with a 1.5–2.9 KB auto-connect block. Repeated or concurrent initialization in one transport session reuses the same standing without duplicating signed registration or caller-scoped reads. Clients that skip the MCP initialization handshake keep the one-time first-tool fallback for compatibility.

Legacy-lineage recovery now represents real skip-ahead history truthfully. When retained Comet history proves a version jump such as 1→7 or 8→11, the app-v21 doctor emits a v2 transition claim at the real activation height and records the skipped predecessors as virtual, subsumed coverage. It never invents interleaved heights or writes synthetic upgrade:applied:* records. Every validator independently replays the retained history and hashes before an explicit vote, and the immutable audit is installed atomically only when app-v22 activates. Existing valid v1 receipts on already-upgraded app-v22+ chains remain readable; new v1 repair proposals fail closed.

The lineage change is confined to the exceptional app-v21 → app-v22 recovery ceremony. Memory, agent, RBAC, and federation policy are unchanged; app-v26 remains the binary ceiling and v11.18.1 introduces no app-v27.

What's New in v11.18.0

A connected pair is now the federation group users expect it to be. Each side explicitly exports the ordinary local agents it places in that pair. Every active ordinary agent on the other SAGE may then live-read those exported agents' owned domain trees by default—no matching local group, receiving domain, or linked-reader grant is required. A receiving operator can narrow that default with exact agent/domain denials. Local-only group membership is never exported transitively, and adding another federated agent is an explicit new export. Read remains borrowed; Copy still requires a source offer plus the receiver's Save here subscription, while remote memory Write remains reserved and fails closed.

Federated authorization now stays true through disclosure. The signed Read plan and single-use challenge bind the exact source-agent standing, clearance, export, agreement, policy generation, and negotiated authorization model. The source authorization lease is revalidated and held until the destination query finishes, so a concurrent rename-safe identity change, restriction, ownership change, pause, or revoke cannot leak a result. CEREBRUM and sage_federation also report authenticated-read readiness honestly, and the Docker acceptance lane proves default Read, explicit denial, non-transitive exports, bidirectional Copy backfill/incremental sync, and restart recovery.

People can address agents without giving up canonical identity. Local and federated message targets accept a unique display or immutable registered name; the resolved request and wire proof still carry only the canonical agent ID and chain. Ambiguous local/remote collisions fail with bounded immutable choices instead of selecting the first label. Federated replies now return an immutable reply_event_id, and the replier can query that exact event's delivery status without pretending it is a new inbox message.

Access Controls is now one usable control surface. Dedicated Agents, Groups, and Federation tabs use compact searchable/sortable lists and focused detail drawers instead of mounting every permission matrix at once. Modern and legacy URL deep links preserve the selected tab and exact local or federated identity. Dialog/drawer focus ownership, Escape/Tab handling, ARIA labels, and narrow-screen behavior are covered by browser-contract tests.

JOIN and upgrade recovery are bounded and explicit. A JOIN session still expires after 15 minutes, while each pasted/scanned code gets up to five minutes of Direct/relay discovery as long as its pairing screen remains open. v11.18.0 is also the first concrete release containing stopped-node backup --full, recoverable restore --from, upgrade preflight, and the app-v21 → app-v22 upgrade lineage status|doctor|verify workflow. A legacy-lineage repair is create-only, chain/current-state bound, embedded in the exact immutable upgrade proposal, never auto-voted, and requires every validator to verify and vote explicitly; an unverified anchor requires a deliberate acknowledgement.

The federation/UI work is off-consensus. The narrow lineage ceremony repairs only an eligible chain still at app-v21 before its governed app-v22 transition. Existing app-v22 through app-v26 chains are not rewritten, app-v26 remains the binary ceiling, and v11.18.0 introduces no app-v27. Both SAGEs should run v11.18.0 for the complete signed federation tuple; older peers fail closed rather than silently downgrade it.

Container: ghcr.io/l33tdawg/sage:11.18.0. SDK 11.18.0.

What's New in v11.17.15

Blank home-domain approval now does what the form promises. When an operator approves a writable pending agent without typing a home domain, CEREBRUM derives a readable slug from that agent's committed name, adds a cryptographically random suffix, and includes the resulting unowned domain in the same dual-signed approval transaction. An explicitly entered domain still wins. The unpublished v11.17.14 workflow was canceled after this browser-found regression, so v11.17.15 is the first published release containing the changes below.

Bulk domain recovery now completes on idle personal chains. CEREBRUM keeps an explicitly confirmed multi-domain transfer alive across the existing 50-block governance cooldown, shows the current/required block while consensus advances, and stops on every non-cooldown failure. Confirmed batches belong to the CEREBRUM session rather than one screen, so operators may navigate away and enqueue another transfer behind the active governance job. If an idle CometBFT clock rejects the first app-v20 authorization as too far ahead, the server re-signs the exact request once against the newly committed chain time; the proof window and every consensus authorization check remain unchanged.

Companion inbox setup now matches the profile’s purpose. Choosing the Companion/voice-bridge preset enables connected-SAGE inbox messaging by default; the independent emergency block remains available afterward. If an existing agent is blocked, Federation now keeps the warning visible and provides a one-click path to that exact agent and inbox switch in Access Controls.

v11.17.15 also contains the v11.17.13 Agents directory and Linux packaging changes below; v11.17.13 and v11.17.14 were never published after their release runs were canceled.

Included from v11.17.13

New agents now appear where operators expect them. Agents waiting for first approval are separated from activated local principals and shown in a conditional review queue at the top of Agents, with the existing atomic approve/reject controls. Access Controls remains focused on activated local agents. Exact ordinary agents advertised by connected SAGEs now have a distinct From federation directory, including whether read-only group permissions are unset or already linked; permission setup opens the existing Linked readers control focused on that exact agent_id@chain pair. Federation transport, ceremony, and Root identities are never cast as ordinary agents.

Linux preview packaging survives transient helper outages. The native-shell gate preloads every Tauri AppImage helper through a three-attempt bounded retry, an atomic reusable cache, and an exact SHA-256 allowlist. Partial or corrupt entries are rejected, retries report the helper and attempt, and persistent or changed upstream artifacts fail with deterministic diagnostics instead of being silently trusted.

This patch also refreshes the pinned Go runtime dependencies and CodeQL action. It changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing v11.17 chains upgrade in place.

Container: ghcr.io/l33tdawg/sage:11.17.15. SDK 11.17.15.

What's New in v11.17.12

Federation agent sharing now fails safely and explains the real policy. The agent picker checks the selected local agent's federated-inbox capability before changing any shared domains, so an inbox blocked by policy can no longer leave a partial domain share followed by a misleading refresh error. Access Controls now shows an explicit Allow messages from connected SAGEs switch and changes only the independent federation-deny bit; Companion agents keep their existing role, clearance, home domain, and other restrictions.

The Tasks board stays inside the viewport. Four- and two-column layouts now allow every track to shrink below its content's intrinsic width, so long Done or Dropped cards wrap inside their columns instead of creating a page-level horizontal scrollbar or clipping the final column.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing v11.17 chains upgrade in place without rewriting trust, domain grants, agent acceptance, memories, or history.

Container: ghcr.io/l33tdawg/sage:11.17.12. SDK 11.17.12.

What's New in v11.17.11

CPU-only embeddings are faster, bounded, and observable. Native Ollama and OpenAI-compatible batches replace per-record request loops, concurrent identical work is coalesced without retaining a cross-agent plaintext cache, imports embed in bounded windows after authorization, and MCP clients let current SAGE nodes authoritatively queue their own vectors. Provider, model, dimension, timeout, managed-Ollama, and amid configuration now describe one coherent vector space. A reproducible sage-embedding-bench command and CPU deployment guide cover measurement and tuning.

Idle nodes can transfer domains again. Newly signed dashboard governance proofs use the fresher safe clock when the latest committed block is old, while the consensus proof window remains unchanged and future-skewed clocks still fail closed. Federation connection details also expose Save and Revoke controls both above and below long permission catalogs, avoiding a full-page scroll.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing v11.17 chains upgrade in place without rewriting trust, domain grants, agent acceptance, memories, or history.

Container: ghcr.io/l33tdawg/sage:11.17.11. SDK 11.17.11.

What's New in v11.17.10

Federation visibility is symmetric again. CEREBRUM's single authenticated peer-status probe now preserves the peer-scoped domain permission and agent contact projections that the remote SAGE returned. A reachable connection can no longer show an agent from the other SAGE while claiming that its domains were never reported, and the reverse side receives the same shared-agent view. Transport binding internals remain hidden from the dashboard response.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing v11.17 chains upgrade in place without rewriting trust, domain grants, agent acceptance, memories, or history.

Container: ghcr.io/l33tdawg/sage:11.17.10. SDK 11.17.10.

What's New in v11.17.9

CEREBRUM's agent and recovery surfaces now reflect the operator's model. Friendly renamed-agent labels are used consistently, the Access Controls agent rail is wider, and the Agents directory is searchable by name or ID and sortable by recent presence, recent committed memory, or name. The busy agent directory now appears before the low-traffic governance controls. Federation permissions use separate outgoing and incoming tabs, so a large local domain catalog no longer buries the peer's shared-back view below an endless matrix.

Domain transfer recovery is ownership-safe and retry-safe. The dashboard distinguishes immutable memory authorship from canonical domain ownership, excludes the actual current owner from transfer targets, and treats a replay of an already-committed transfer as success. Governance proof timestamps are bound to the latest committed CometBFT time, preventing false five-minute-ahead rejections on recovering or CPU-starved nodes.

Messages now behave like an inbox, not a short-lived pipe. Omitted/zero TTL keeps local and federated work durable until handled, v11.17.8 unread rows are extended during upgrade, and canonical inbox/outbox history is no longer swept by the legacy 24/48-hour pipeline retention jobs. Callers can still request an explicit 1–1440 minute expiry.

sage_turn now reports only message_inbox_unread and its count; it never claims or injects message payloads. Agents call sage_messages_receive to read the inbox and use status/history for replies and lifecycle evidence.

Container: ghcr.io/l33tdawg/sage:11.17.9. SDK 11.17.9.

What's New in v11.17.8

The v11.17 security backlog is cleared in code. Pion DTLS and STUN are upgraded to their patched releases in both the SAGE and Natter modules. Recall result slices no longer use caller-derived allocation hints, app-v23 migration keys avoid length-arithmetic preallocation, and the CEREBRUM inline-script contract recognizes HTML tag case without a fragile sanitizer-style regexp. The roadmap, architecture, federation guide, onboarding guide, and Python SDK docs were reconciled to the then-current canonical Messages API and 24-hour default TTL (superseded by v11.17.9 durable-until-handled delivery), deprecated hidden sage_pipe* aliases, app-v26 authority names, signed macOS in-place updater, and the remaining physical acceptance boundaries.

Container: ghcr.io/l33tdawg/sage:11.17.8. SDK 11.17.8.

What's New in v11.17.7

Releases no longer pause for a manual two-Mac approval. Publication still requires the exact staged macOS applications and DMGs to pass writable-copy, launch, signature, Team ID, notarization, and stapling verification, then continues automatically through immutable package and GitHub publication.

Federation now recovers across LAN changes, internet relays, restarts, and roaming addresses. Signed route snapshots retain the stable peer identity, rank safe Direct and Secure relay candidates, republish after relay reservation changes, and migrate v11.17.4 p2p_peers state without treating stale routes as authorization. Unsafe DNS, loopback, link-local, unspecified, multicast, mixed peer-ID, and wrong-protocol routes fail closed.

Federated agent discovery and Messages now work as one durable inbox. Exact peer_chain lookup disambiguates same-named agents. A previously authenticated exact address can be queued while its node is offline, remains caller- and policy-bound across restart, and is revalidated before any payload leaves the sender. Canonical status independently reports transport, exact-recipient read, and workflow completion to the original sender. Legacy sage_pipe* tools stay callable for compatibility but are no longer advertised to new MCP clients.

A reproducible Docker federation acceptance lane covers the real product path. It exercises same-LAN links, relay-only isolated networks, both-sided IP churn, relay outage and recovery, expired route snapshots, v11.17.4 migration, offline queueing, recipient inbox/read/reply, and final sender confirmation.

Container: ghcr.io/l33tdawg/sage:11.17.7. SDK 11.17.7.

What's New in v11.17.5

Federated agent sharing now sends the canonical permission wire shape. Choosing a named local agent may add the domains that agent owns to the trusted connection. That automatic path now serializes the same permissions array as the normal domain editor, so the peer can expose the agent contact and the two agents can use canonical Messages/Inbox over the existing direct-or-relay link.

Upgrade recovery accepts the first valid revision-zero snapshot. Legacy databases can legitimately publish their first preserved-record inventory at projection revision zero. CEREBRUM can now deprecate an exact selected subset of that inventory while still requiring the revision field, positive count, typed confirmation, current Root authority, and atomic queue validation.

Federation enrollment now carries one validated route bundle from JOIN to roaming operation. Direct and secure-relay candidates survive the ceremony, the dashboard reports the route that actually carried authenticated traffic, and stale host windows fail closed. Canonical agent messaging uses the exact linked-reader relationship plus independent receiver-local consent on the same direct-or-relay transport.

Canonical Messages are the public agent-to-agent workflow. sage_message_send, sage_inbox, sage_message_reply, sage_message_status, and sage_message_history cover idempotent send, receive, reply, receipts, and restart-persistent history. Legacy sage_pipe* MCP tools remain compatibility aliases but are explicitly deprecated. The federated proof verifier accepts the sender-local idempotency field in the exact signed request without exporting that replay token into the peer event. New messages now default to the full supported 24-hour inbox lifetime, rather than expiring after one hour while a recipient agent may be offline.

CEREBRUM recovery and consensus stay usable on upgraded nodes. The consensus page authenticates its scope request, incompatible historical domain-continuity candidates are retired instead of being reproposed every block, and recovery deprecation records an honest recovery activity event. The recovery authority controls use a responsive grid, so the explanatory copy and selectors no longer collapse into a horizontally scrolling row. Access Controls also normalizes historical empty groups to members: [], so a valid empty group cannot throw during the first render and leave the page stuck on “Loading consensus access policy…”.

Historical app-v25 home defects no longer prevent app-v26 repair from starting. Nodes with the narrow legacy shared_home shape may rebuild their local agent serving projection long enough for the existing deterministic app-v26 migration to run. Eligibility and validation share one Badger snapshot, completed app-v26 chains stay strict, and a concurrent repair falls back to one strict retry. This changes no memory, historical author, ownership history, or prior block outside the already-governed app-v26 repair.

Large federation agreements stay responsive. CEREBRUM renders bounded 75-domain windows, keeps existing grants and retained subscriptions first, and skips reconciliation when polling returns identical state. Search, bulk actions, and Save still operate on the complete filtered permission set and full draft rather than only the rendered rows.

Local MCP clients use the listener SAGE actually binds. Generated configs, hooks, bundles, and internal defaults now use 127.0.0.1 instead of allowing localhost to resolve to an unbound IPv6 ::1. sage_find_agent also preserves its bounded federated continuation cursor when a fuzzy local result exists, so a caller can explicitly request the next peer page without any automatic federation walk.

App-v26 makes Access Group authority explicit and reviewable. Every local group now stores one deterministic member authority: read, read_write, or read_write_modify. Existing groups migrate to the safe read baseline at the strict H+1 fork boundary. A domain owner always retains full control of its own domain; group membership is additive, the strongest applicable group wins, and removing an agent revokes only that cross-member relationship without touching the agent's own domains. Linked federated agents remain read-only guests and can never acquire local Write, Modify, ownership, or governance.

Local agent messaging now has one canonical, durable receipt contract. An idempotent send, exact receive-batch replay, recipient-only reply/read acknowledgement, and sender-only payload-free status projection use the existing encrypted pipeline inbox rather than a second queue. Connected HTTP MCP SSE sessions for the exact recipient may receive a metadata-only wake-up; this is a best-effort hint, never presence, delivery, comprehension, or read evidence. The enforced sage_turn reminder/checkpoint nags are removed.

CEREBRUM helps Root finish historical recovery instead of leaving a warning. Unresolved preserved records can be inspected through bounded safe previews, selected, assigned to an active local ordinary agent when exact verified evidence permits it, or deprecated. Already-deprecated rows are excluded. Authorship, content, domains, and chain history remain immutable; assignment changes only current operational ownership. Conflicting or unverifiable rows remain deprecate-only.

Linked SAGE discovery closes over the relationship agents can actually use. Caller-scoped directory results include only consented linked peers and expose their exact address plus registered/display name metadata. The same authority is enforced for direct and secure-relay paths; discovery grants no remote memory write or local group membership.

Operator mutations and signed updates fail safely without lying. CEREBRUM reconciles uncertain consensus responses against canonical state and repairs the local agent projection after a committed approval. Access Controls can also commit a new agent display label without changing its immutable registered name, agent ID, boot purpose, domains, or authorship; the rare Root handover card now sits below everyday agent and group controls. The macOS release gate mounts the signed DMG, copies the app to a fresh writable APFS location, verifies the exact leaf identities and version before and after first execution, and publishes only that verified immutable asset. CEREBRUM now stages that signed DMG, verifies the replacement, swaps the installed application through a separate helper, and restarts into the new build with bounded readiness checks and rollback. Manual drag-and-drop remains the explicit fallback. Linux keeps its verified in-place updater.

This is a governed consensus upgrade from app-v25 to app-v26. Existing chains advance in place; memories, historical authors, domains, and prior blocks are not rewritten.

Container: ghcr.io/l33tdawg/sage:11.17.5. SDK 11.17.5.

What's New in v11.16.4

Existing nodes recover from stale app-v23 serving projections at startup. A rebuildable local SQLite projection whose old duplicate policy fields disagree with the canonical committed enrollment is normalized from that canonical policy record instead of preventing the node from starting. This is a local read-model repair only: it does not alter blocks, memory content, historical authors, domains, access groups, or the consensus application version.

The release pipeline verifies the installer that users actually download. After macOS packages upload, CI downloads the staged DMG, checks its checksum, mounts it, and verifies the app signature, Gatekeeper assessment, and notarization before publication. The MCP server also no longer spends an agent's context budget on repeated per-tool sage_turn reminder messages.

Claiming a message no longer makes it disappear for either participant. The active inbox remains a pending-only, claim-on-read work queue so old work does not reappear in every turn. A new passive retained inbox/outbox history lets the recipient reopen claimed or completed work and lets the sender revisit its local lifecycle until the normal transient pipeline retention sweep. Agents can also list the signed active local directory—with display name, immutable registered name, provider, and exact agent ID—before addressing a message, instead of guessing a recipient from a fuzzy provider label.

CEREBRUM now settles operator actions against the canonical chain instead of undoing them in the browser. Clearing a terminal task column keeps cards out of intermediate refreshes while the local projection catches up, then reloads the authoritative board. A lost or late commit response is reported as confirmation in progress rather than the false claim that nothing changed; only a definite consensus rejection is red. A multi-manager deprecation that opens a challenge is shown honestly as awaiting its distinct eligible confirmation rather than called cleared.

Access Groups and agent recovery are usable in the flow operators actually use. Dragging one active local agent onto another creates or extends the narrowest local group, so members read each other's owned domains by default until the operator explicitly selects Read + write or Read + write + modify for that group. Global Manager labels never silently widen the selected group permission. Dragging a member back out revokes only that group relationship. CEREBRUM also settles agent removal and first-use domain authority against committed state, rather than leaving a stale progress screen or asking a newly-created domain to retry its first operation.

Federation no longer requires a relay reservation to use a working direct route. A trusted pair may connect immediately over its authenticated direct candidate—especially useful on the same LAN—and keeps the secure relay as an automatic roaming/NAT fallback. Direct-only route bundles now validate on both the dashboard and peer transport paths.

This patch does not rewrite memories, domains, historical authors, existing groups, or chain history. It keeps consensus application version 25 and the existing governed upgrade path unchanged. Existing nodes upgrade in place.

Container: ghcr.io/l33tdawg/sage:11.16.4. SDK 11.16.4.

What's New in v11.16.2

App-v25 repairs historical continuity without rewriting history. It is the strict H+1 successor to app-v24. New submissions receive an immutable canonical envelope: a memory ID can be replayed exactly, but cannot later be reused for different content, author, domain, or classification. That closes the old projection-overwrite path that could leave an agent able to write a domain but unable to read it back.

On upgrade, SAGE scans historical SQL rows against canonical state in the background. Complete, content-hash-verified records are adopted through bounded Root-authorized, validator-attested governance batches. No memory content, author attribution, domain, classification, or earlier block is rewritten. For each recovered local domain, the earliest verified historical writer is retained as the operational owner; every other verified local writer is restored into the exact local Access Group with read/write continuity. If the earliest writer is no longer a valid local principal, CEREBRUM Root owns the recovered domain rather than promoting a later writer by guesswork.

One bad historical row can no longer blank CEREBRUM or take agents offline. v11.16.2 quarantines each unverified record individually. Broad list/search, graph, timeline, stats, and dashboard-health reads continue with the verified set and disclose a partial-projection state. A completed audit returns /ready as HTTP 200 / degraded; actual backend failures and incomplete audits remain unavailable. This keeps supervisors, MCP bootstrap, sage_inception, and healthy agent work online without pretending incomplete data is safe.

Unreadable or conflicting records are preserved byte-for-byte. CEREBRUM Root can retry the evidence scan or explicitly deprecate the exact unresolved inventory after a typed confirmation; deprecation retires it from automatic repair and normal views but does not delete historical data. See App-v25 upgrade and recovery.

Container: ghcr.io/l33tdawg/sage:11.16.2. SDK 11.16.2.

What's New in v11.16.0

App-v24 closes the canonical terminal-hash lifecycle defect without rewriting history. New memory submissions bind content_hash to the exact SHA-256 of their content, and challenge, deprecate, and other terminal transitions preserve that canonical hash. App-v24 activates at the strict height after its app-v23 predecessor, so the activation block and every earlier block retain their exact historical semantics. A governed, Root-planned validator vote can re-anchor eligible historical terminal rows in bounded, atomic, idempotent batches from their unchanged canonical content. The repair changes neither content, authorship, domain ownership, nor prior blocks.

Fresh first-party Mynah nodes now wait for the safe protocol floor instead of starting mute or writing through the vulnerable interval. Direct app-v23 genesis remains the authenticated bootstrap origin, but /ready reports waiting_for_app_v24 until the next admitted transaction will execute under app-v24. Consensus independently rejects direct-genesis Companion memory and co-commit writes during that short governed climb, so bypassing the readiness endpoint cannot reproduce the defect. Personal nodes require app-v24 even when optional future auto-upgrades are disabled. This narrow barrier does not mute ordinary upgraded nodes: existing agents retain their app-v23 write authority while app-v24 activates.

Agent recall and caller-scoped discovery work again under the new access model. sage_turn now uses the shared local semantic-recall path and forwards the exact embedding provider returned by /v1/embed; it no longer misclassifies every turn as federated and then trips the app-v23 federated-vector gate. The signed sage_find_agent path again searches active ordinary local agents first and then only federated contacts authorized for that caller. It is discovery metadata, not presence: an empty match does not prove that a saved exact Agent ID is unreachable, and sends always revalidate the destination.

CEREBRUM RBAC now preserves the policy the operator actually approves. Companion enrollment accepts its documented 15/31 profiles, valid existing federated-pipe restrictions are not silently stripped, and a newly pending mask-30 principal becomes the documented Companion mask 15 only after approval. Encrypted and unencrypted loopback CEREBRUM use the same Root/Admin authorization boundary; an encrypted vault additionally requires its valid unlocked session. A level-2 grant is never presented as a cure for a hard capability, pending-review, profile, or ownership denial.

CEREBRUM no longer mistakes a missing ordinary-memory projection for an empty brain. App-v23 readiness now checks the complete canonical Badger inventory against the local SQL serving projection, so deletion, rollback, or partial projection loss returns 503 instead of a plausible zero-memory dashboard or empty backup. A state-sync receiver seals and node-key-signs the exact historical canonical IDs whose ordinary plaintext was intentionally not transferred; every memory committed after that baseline remains mandatory. Such a node reports canonical_subset, and portable full-brain export stays disabled rather than producing a partial file labeled as a backup. Pre-v11.16 receivers that do not have this exact authenticated baseline fail strict readiness and must be explicitly repaired or state-synchronized again; upgrade-time SQL state is never guessed into an omission allowlist.

Container: ghcr.io/l33tdawg/sage:11.16.0. SDK 11.16.0.

What's New in v11.15.1

Emergency CEREBRUM rendering recovery. v11.15.0 shipped one malformed nested-template expression in the Access Control view. Because CEREBRUM is a browser-module application, that single parser error prevented the entry module from executing and left the otherwise healthy local node behind a blank page. v11.15.1 corrects the expression and changes the static JavaScript release gate to parse every first-party file with browser-equivalent ES-module grammar, so this class of packaging failure is rejected before publication. A dependency-free Loading shell now turns future bootstrap failures into a sanitized recovery panel, and missing module assets return a true 404 instead of a misleading HTML 200.

This patch does not migrate, delete, rewrite, reassign, or re-encrypt memories. It changes no consensus rule, transaction, key encoding, AppHash input, fork height, or application version; app-v23 and every historical block remain byte-identical. Existing nodes upgrade in place. Container: ghcr.io/l33tdawg/sage:11.15.1. SDK 11.15.1.

What's New in v11.15.0

App-v23 replaced capability-bit administration with roles, security profiles, and Access Groups that match how people actually share a SAGE. Members can read the domains owned by other active local members of their groups. Managers could also write and modify within those same group boundaries under the original app-v23 rule; app-v26 supersedes that derivation with each group's explicit authority tier. Admins have sudo-equivalent authority over normal local data, policy, governance, federation, and CEREBRUM operations. Clearance remains the maximum classification an agent may read, and hard security-profile restrictions still override roles, groups, and grants.

CEREBRUM Root is now a separate, singleton authority rather than an agent card. It cannot be dragged into groups, messaged, demoted, or removed through ordinary agent controls. A dedicated two-confirmation handover rotates the current Root credential while preserving the immutable Root authority over its existing domains, grants, and groups. Historical memories keep the exact credential that authored them; new Root memories record the new credential. No chain history is rewritten, no domain is bulk-transferred, and retired Root credentials can never become agents or Root again.

Federated agents are linked readers, never remote members. A remote agent@chain may be attached to a local Access Group for live, classification-bounded reads only. It receives no Copy, Write, Modify, claim, ownership, grant, role, governance, or transitive-agent authority. Agent pipeline messages remain untrusted requests; any resulting memory action is a separate local decision made under the receiving agent's own identity.

First-party vendored companions no longer start mute. A clean Mynah / SAGE Voice Bridge installation atomically binds its exact key, reviewed Companion profile, clearance, local enrollment, and owned non-shared home domain before readiness succeeds by starting its fresh vendored node directly at app-v23. Mynah has no released legacy population, so there is no Mynah-specific upgrade or repair path. Other agents stranded by app-v22's default mask 30 remain pending review until a local Admin completes the atomic onboarding operation; they cannot self-promote or claim a domain.

CEREBRUM now enforces the localhost-only promise already shown in its UI. The human control plane, including authentication, recovery, RBAC, federation management, and the SPA itself, is unavailable over LAN or a federated link. On an unencrypted personal node, the real same-origin loopback SPA has complete Root control without inventing a password or copying the genesis key; when vault encryption is enabled, the same local surface additionally requires its unlocked session. Signed Admin/Root management is also local-only. Dedicated signed agent APIs, pairing/claim redemption, health, and federation data-plane traffic retain their designed network reachability.

App-v23 activates only after the canonical predecessor ladder through app-v22, with the activation block retaining v22 semantics and v23 beginning at the next height. Replay and state sync preserve every historical AppHash while validating the new Root, role, enrollment, group, and revision invariants. Personal nodes automatically walk the governed ladder to the required app-v23 security floor even when optional future auto-upgrades are disabled. Multi-validator networks must first install this exact binary on every validator, then activate app-v23 through their normal governed upgrade ceremony. Legacy or keyless MCP/OAuth bearers that could fall back to Root are revoked; current tokens require a distinct pending-review keyed identity. Vault-enabled nodes and unencrypted nodes both seal new token keys under the one-time bearer, so credentials survive optional ledger state changes, the stored database digest cannot decrypt them, and no bearer ever falls back to Root. Existing vault-sealed token rows migrate on their next unlocked use. Public OAuth authorization crosses an opaque, short-lived, single-use handoff into a localhost-only approval page—CEREBRUM, its cookies, and /ui are never exposed through the Cloudflare tunnel. SDK 11.15.0.

What's New in v11.14.2

Emergency CEREBRUM and updater recovery patch. Local installations with vault encryption disabled no longer open to a blank dashboard after upgrading: the real loopback CEREBRUM browser can read memories, search, use the task board, enable the vault, and apply or restart official verified updates. Unsigned background processes, LAN and cross-site browsers, ordinary signed agents, and sensitive operator mutations remain denied. The updater now prefers GitHub's immutable release-asset SHA-256 digest and uses checksum sidecars only as a fallback, removing the transient checksum-discovery failure that blocked some v11.14.1 upgrades. Existing memories were never removed by this issue.

SDK 11.14.2.

What's New in v11.14.1

SAGE now gives co-located companion agents a consensus-enforced least-privilege profile. App-v22 adds operator-controlled capabilities for clearance-bounded cross-domain reads while denying shared-domain writes, foreign-domain writes, and domain claims. The companion preset keeps local and federated agent inbox messaging enabled, so a voice bridge can delegate work to a visible agent on another compatible SAGE and relay its eventual result. Short-name agent lookup now searches bounded local metadata, so names such as mynah resolve without requiring the full registered display name. Direct remote memory Write remains unavailable: agents send a pipeline request to the remote agent, which performs any separately authorized local action. Codex's user-level MCP registration now derives a separate stable signing identity from each workspace folder instead of silently reusing global-codex; explicit custom key pins remain supported. CEREBRUM shows the exact signer ID beside every access grant so a display-name match cannot hide an identity mismatch, and its access matrix only filters and assigns domains already created by agents rather than asking an administrator to create domain tags. Fresh self-registrations after app-v22 start quarantined (mask 30): they cannot write or claim domains or use federated inbox routing until a global administrator assigns an intentional profile; existing agents retain their pre-upgrade mask.

App-v22 also refuses to be proposed, approved into a pending plan, activated, or restored unless consensus storage proves the complete predecessor ladder. The canonical persisted app-v6 record is the one compatibility proof for the historical cumulative app-v2 through app-v5 activation; app-v7 through app-v21 must each have their own canonical applied-upgrade record, with the exact target and strictly increasing positive activation heights. Missing, synthesized, or out-of-order v7+ evidence fails closed. Historical pre-v22 block replay is unchanged.

Agent inboxes now enforce an explicit prompt-injection trust boundary. Every local or federated payload is surfaced as an untrusted request_only request, never as system, developer, or user instructions; pipeline results are untrusted data_only content, and task notices are notifications that must be confirmed against the exact current backlog assignment. Tool descriptions, inception guidance, response metadata, docs, and regression tests all carry the same rule.

SDK 11.14.1.

What's New in v11.13.9

SAGE now closes the WebTransport memory-exhaustion advisory and makes task updates explicit. Root and Natter modules use patched WebTransport/QUIC dependencies. sage_task rejects immutable content replacements locally, requires an explicit status transition, and supports link-only updates without an implicit re-plan.

SDK 11.13.9.

What's New in v11.13.8

CEREBRUM now records committed permission changes in Chain Activity. Access saves, grants, and revocations show only after their transaction commits, with the block and transaction available on expansion. Chain Activity can now be resized even when it is empty, and its clear Expand/Collapse control works reliably from the header.

SDK 11.13.8.

What's New in v11.13.7

MCP identities are now isolated by client provider, and federation shares an agent with its owned domains in one guided action. Claude Code and Codex get distinct project keys, while explicit legacy keys remain stable; direct session hooks use that exact configured identity too. Federation now loads the peer's published contact snapshot when the panel opens. Selecting a local agent can add its owned, shareable domains to the connection after one clear confirmation.

SDK 11.13.7.

What's New in v11.13.5

CEREBRUM now shows the live consensus app version and makes level-3 Modify grants explicit. Overview reads CometBFT's live ABCI application version, instead of presenting a stale status-cache value after an upgrade. The domain access matrix now has Read, Write, and Modify levels, with a server-enforced permission ladder and real owner-signed level-3 grants on Save. Shared domains remain read/write-only by design; CEREBRUM rejects Modify before it can display an unenforceable permission, including dynamically shared domains.

• Safer RBAC administration. Only a local CEREBRUM operator can create an agent or change its security-critical access policy. Signed agents cannot self-elevate through the dashboard's admin/validator credentials.

• App-v20 governance compatibility. Domain reassignment and cancellation use the canonical governance proof shape once the app-v20 gate is active, while older chains retain their legacy transaction compatibility.

SDK 11.13.5.

What's New in v11.13.4

Challenges now respect corroborated knowledge, and clients can inspect the evidence instead of bypassing the API. Governed app-v21 snapshots the eligible modify holders plus current read-authorized canonical corroborators for each new challenge and requires k+1 distinct challengers when k canonical corroborators support the memory. Only a modify holder can open the dispute; snapshotted corroborators may then reverse their support by endorsing it. Zero-corroborator noise still resolves on the first authorized challenge; an eight-corroborator memory now requires nine distinct challengers.

• First-class, replay-safe challenge rounds. The electorate, threshold, round, and distinct challenge votes are AppHash-covered and committed atomically. Grant churn cannot rewrite an open round, duplicate or stale votes cannot accrue, and legacy app-v17 disputes finish under their original rules.

• Evidence is visible everywhere. REST query/search/detail, federated recall, MCP recall, and the Python SDK now return distinct corroboration_count and lifetime challenge_count values. evidence_counts_available is true only when both queries succeed and no recovery/repair-incomplete marker is present; after pristine recovery the numeric values remain useful canonical lower bounds, but a zero is not proof that no historical evidence existed. Open disputes also expose the current app-v21 round tally and threshold. Challenge and forget responses report authoritative durable post-commit status instead of assuming every challenge deprecated.

• Safe state-sync upgrade. Authorized state sync accepts app-v20 and app-v21 images, reconstructs canonical corroborator/challenger counts into a pristine serving projection as explicitly incomplete lifetime lower bounds, and pins each transfer to one exact application version. Older v20 sessions remain compatible; mismatched or unsupported images fail closed.

Caller-asserted memory type, confidence, and challenge strength are deliberately not consensus weights: they are not validator-attested facts and would otherwise let a caller self-assign immunity. Existing chains retain the exact app-v17 policy until the governed app-v21 activation. SDK 11.13.4.

What's New in v11.13.3

CEREBRUM now manages federated agent contacts by name and keeps access changes bounded to what the operator can actually see. The federation panel replaces raw 64-character agent-ID entry with the active local agent directory, then verifies the chosen identity against current shared-domain access before showing its default-off work-request switch.

• Friendly selection, exact authorization. Names, registered names, and providers are shown for humans while every request still carries the exact agent and opaque contact identities. Exact out-of-sample contacts are revalidated through a bounded background projection and disappear promptly after access, availability, agreement, or consent changes.

• Visible means visible. Access Control bulk actions now affect only the filtered domain rows on screen. Their labels say so explicitly, preventing a six-row search result from silently launching changes across the full domain catalog.

• Honest on-chain save state. Duplicate saves, mid-save agent switching, and edits to a submitted snapshot are blocked while consensus work is in flight. Partial grant failures keep retry available and are not mislabeled as saved; directory, lookup, and reconciliation failures remain actionable.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.13.3.

What's New in v11.13.2

This corrective release completes shared-domain federated recipient discovery at scale. v11.13.2 keeps a deterministic, valid v1 status subset compatible with v11.13.0 (at most 1,024 contacts and 1 MiB), then resolves a requested human name or exact agent address through a new authenticated, RBAC-filtered lookup route. So a shared domain can have more recipients without turning the whole snapshot or a later cache entry into a failure.

• Revocations linearize with delivery. Direct grants, organization membership/clearance, federation status, and department membership changes wait for an in-flight authorized inbox admission, claim, completion, or bounded result delivery; the next operation rebuilds the contact and rejects the old route.

• Fast, caller-safe cache. Repeated lookup of the same name is cached for one minute per signing caller. Each result retains one caller-authorized domain basis and is rechecked locally on every hit. Keyless legacy bearer tokens cannot use federated discovery or delivery as the node operator.

• No change to consent or scope. Contacts remain domain-scoped, caller-authorized, and default-off until the recipient enables that exact contact. This is still not a global directory.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.13.2.

What's New in v11.13.0

A shared domain can now route work to every active agent that holds current RBAC access to it—not only its owner. A level-1 reader or level-2 writer on SAGE A can opt in to receiving federated work from authorized agents on SAGE B. The existing sage_find_agent local-first lookup and short-lived, caller-scoped cache then discover those opted-in contacts by name.

• Domain-scoped, not a global directory. Contacts are exposed only through a live shared Read/Copy domain and retain that domain as their routing basis. Open-shared and ownerless domains still publish no guessed recipient.

• RBAC is rechecked at delivery. The receiver rebuilds the contact from current access grants before admitting, claiming, or completing foreign work. While a grant is revoked or expired—or an agent, owner, or federation policy changes—the old route is rejected. Inbound work remains default-off until the local operator enables that exact contact.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.13.0.

What's New in v11.12.2

Agents can now resolve a human recipient name safely across a federation. The new sage_find_agent MCP tool searches active local registrations first, then only the remote contacts already authorized for the signed caller. Its short-lived, caller-scoped in-memory projection makes repeat lookups fast without creating a global agent directory.

• Immediate, policy-safe repeat lookup. Cached remote contacts are bounded and re-authorized against current local domain access on every cache hit, so a local revoke applies to the very next lookup without a peer round trip.

• Pipeline authorization matches discovery. Federated pipe resolve and direct send both recheck the caller against the target's currently disclosed domain scope; a borrowed or stale route cannot bypass local RBAC. The outbox still requires a fresh authenticated remote contact match before payload bytes leave the SAGE.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.12.2.

What's New in v11.12.1

Federation now stays useful while another SAGE is slow or offline. Trusted relationships and their last-known route state render immediately from local state, initial permission and agent-contact controls no longer wait on a remote round trip, repeated status probes are shared instead of multiplied across panels, and the bounded live-status check fails promptly without hiding saved controls behind a long “Loading…” state.

• One domain surface in the Brain. The duplicate right-side Domain tags rail is consolidated into the Local/Shared Domain sources panel. Local domains can filter the MRI directly, the panel includes domain search and the compact reading guide, and remote-only domains remain visibly separate from memories actually stored on this SAGE.

• A workspace that stays where you put it. Domain sources can be moved and resized, saves its geometry across reloads, clamps itself back into the visible canvas, and includes a one-click Reset.

• Cached first paint, authenticated refresh. CEREBRUM reuses manager route diagnostics and persisted local permission state immediately, then performs one authenticated peer refresh in the background. Manual Refresh still requests fresh remote RBAC and agent-contact state.

• Native preview version alignment. The alpha shell now accepts its version-matched v11.12 daemon instead of rejecting the daemon bundled by the v11.12 release pipeline.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.12.1.

What's New in v11.12.0

This release makes first run, sharing, recovery, and day-to-day federation understandable without technical knowledge. CEREBRUM now presents one create-or-join decision, keeps a new SAGE private by default, explains that pairing alone shares nothing, and routes sharing into the same owner-controlled RBAC surface used everywhere else.

• File-sharing-style groups with Active Directory semantics. Owners choose already-trusted SAGEs and existing domains, guests control only their own receive role, and group deletion removes the group everywhere without deleting the trusted connections underneath it. Concurrent guest role changes are serialized by the owner, and Refresh waits for signed journal reconciliation before showing the result.

• Federation visible to ordinary agents. The read-only sage_federation MCP tool lets an authorized agent inspect the SAGE connections and Read/Copy scopes visible to its own subtree. An exact-domain sage_recall can opt into authorized peers with scope:auto, merges peer results under one global limit, preserves provenance, and falls back safely when peers use different embedding providers.

• One automatic connection path. Users no longer choose LAN versus internet. SAGE prepares direct and secure-relay candidates behind one Connect action, labels them as prepared until a real exchange selects one, prefers a working direct route, falls back without replaying a request, refreshes stale routes, and keeps route, trust, lock, compatibility, offline, degraded, and security failures distinct.

• Clear local-versus-shared visibility. Already-shared domains stay in a separate first section of the permissions list. The main Brain identifies local, remote, saved-here, and copied-from sources—even after a connection is revoked—while internal federation/RBAC audit records stay out of user memory views and sharing controls.

• Recovery that is visible and honest. Recovery-key backup acknowledgement survives reloads; a wrong recovery key is rejected before the vault is touched; successful recovery establishes the ordinary dashboard session; portable JSONL backups restore through Preview and Confirm; forgotten memories are excluded and cannot be resurrected from older backups.

• Safe same-network join. Join codes bind the exact SAGE executable as well as the version, and adopting the host chain clears only old chain-projection receipts while preserving the guest's local memories.

• Accessible, consistent controls. Destructive and privacy-affecting actions use explanatory dialogs that say what changes and what remains safe. Search filters, cleanup and preference switches, recall controls, and per-domain access switches expose useful screen-reader names.

The structured v11.12 proxy acceptance exercised first run, same-network join, three-node federation, group creation/removal, concurrent roles, restore, forgetting, cleanup, keyboard focus, and recovery on disposable nodes. The protected release workflow supplies the remaining signed/notarized clean-install artifact check.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.12.0.

What's New in v11.11.2

Sharing & Sync becomes operable at a glance. Group owners can give a group a friendly, signed name; choose one or more existing controlled domains instead of typing fragile tags; see each member's friendly name, live reachability, and catch-up state; and add an already-trusted SAGE through a guided invitation without copying a chain ID or public key. Group names ride the established signed roster manifest, so v11.11.1 peers safely ignore the optional label while continuing to synchronize during a rolling patch upgrade.

MCP reflection failures are now honest. A completely unwritable reflection returns an error, partial writes report their lost components, and degraded embedding status is preserved. Permanent domain-write ACL denials are now typed so clients do not waste a registration-and-retry cycle on a refusal that cannot succeed.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.11.2.

What's New in v11.11.1

Release-pipeline fix for v11.11.0. v11.11.0 was tagged but never published: the release workflow's native-shell evidence and publication jobs only execute for version 11.11 and above, so v11.11.0 was the first tag in the project's history to run them, and two latent defects surfaced in a path no pull request can exercise. The bundled daemon was staged after the Rust build that consumes it, and the publication gate expected an artifact-kind string the bundle verifier never records. Both are fixed and pinned by tests. No user received v11.11.0 on any channel.

Everything below shipped in this release.

What's New in v11.11.0

The Sharing & Sync control plane is complete, and the desktop shell foundation lands as an opt-in alpha that nothing depends on. Browser CEREBRUM remains the product; the native shell is a background track that is built and runtime-tested in CI but not distributed and not intended for end-user use.

• CEREBRUM sharing and sync controls completed. The Sharing & Sync surface finishes the control plane over synchronization groups, member roles, selective-sync state, shared domains, ownership, and catch-up position.

• Storage and task-board correctness. Postgres now enforces the same content-hash dedup parity as SQLite, so the two backends no longer disagree about what counts as a duplicate memory. The task board persists lifecycle and ordering correctly, and terminal tasks retain their original agent attribution instead of losing authorship on completion.

• Tighter local trust boundary. Acceptance endpoints are isolated from the globally configured Codex endpoint, and RBAC key caching is bounded rather than growing without limit.

• Native shell foundation (alpha, not distributed). A Tauri 2 shell starts the bundled daemon through an authenticated SSCP startup proof, owns one window with fail-closed navigation pinned to the exact authenticated loopback origin, keeps a visible recovery surface, and hands off to an existing instance on relaunch. Its installed-package lifecycle is proven on hosted runners for macOS, Windows, and Linux — install, launch, single-instance handoff, ordinary close with daemon survival, uninstall preserving the node data root, and reinstall to a genuinely new instance generation. macOS additionally proves offline startup with no external requests. Every package is unpacked and must contain exactly one bundled daemon whose embedded OS/architecture and version match the build.

• The shell does not gate releases. v11.11 distributes no native shell, so signing, notarization, update/rollback, recovery, performance, and accessibility evidence are the bar for distributing it — which the roadmap places at v12 — not a v11.11 shipping requirement. Federation, agent-to-agent messaging, and the rest of the roadmap do not queue behind desktop packaging.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.11.1.

What's New in v11.10.0

Federation now feels like connecting two colleagues' SAGE nodes, not configuring infrastructure. The reciprocal QR ceremony derives the exact listener or internet/P2P route, survives retries and rapid confirmation, and creates trust with zero implicit sharing. CEREBRUM keeps Read, Copy, Pause/Resume, and permanent revoke distinct, preserves saved choices while paused, explains peer revocation on both sides, and keeps historical connections out of the active list.

• Independent, visible sharing controls. Each operator chooses existing local domains at any time without reconnecting. Read borrows live answers; Copy requires both the source offer and the receiver's separate Save here opt-in. Long permission lists scroll cleanly, domain-owner contacts show exact agent@chain addresses plus friendly handles, and cross-host Write remains unavailable until it has connection-bound consensus authorization.

• The agent inbox crosses trusted federation edges. Existing sage_pipe work can target an explicitly visible remote agent over direct mTLS or the persisted roaming route. Receiver acceptance is default-off, payloads are marked untrusted, offline work queues durably, Pause and acceptance-off are retryable, reconnect resumes unchanged work, and delivery/result import is replay-safe and idempotent. This is agent-to-agent infrastructure—not a CEREBRUM user messaging client and not remote memory Write.

• Fail-closed ceremony and operator polish. Exact configured ports are preserved, incomplete endpoints cannot create or scan codes, internet pairing never invents a LAN fallback, double-submit is idempotent, and exact CA/operator/epoch identity still gates every action. Copy-save errors stay beside their controls; keyboard, QR, navigation, lock, and connection affordances have accessible names and clear feedback. The Python SDK also accepts legacy empty inboxes encoded as items: null.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.10.0.

Older releases

Federation now behaves like colleague sharing in CEREBRUM. JOIN establishes exact node/operator trust but shares zero domains by default. Each SAGE independently chooses and changes existing domains for live Read or optional Copy after pairing; remote Write remains explicitly unavailable until a future connection-bound consensus authorization exists.

• Connections that stay manageable. Every active row opens into clear local-versus-remote permissions, current Read/Copy state, and domain selection. Pause temporarily disconnects a colleague without losing the pairing or saved choices; Resume reconnects immediately. Permanent revoke remains available in details, not as everyday clutter, and the peer receives a durable explanation instead of a mysterious failure. Revoked history is collapsed out of the main list.

• A shorter, clearer trust ceremony. The common path is two reciprocal QR scans followed by one six-digit anti-swap fingerprint check per person. The host's redundant pre-confirmation screen is gone; peer identity and the “trust only—no domains shared” boundary now live on the single real confirmation screen. Wide layouts keep both scan cards side by side, while narrow and short screens scroll cleanly around the camera preview.

• Fail-closed under races and retries. JOIN activation, permission replacement, Pause/Resume, revocation, peer notification, stale reconciliation, and policy-label delivery are linearized against the exact CA/operator/epoch agreement generation. An old generation cannot disclose a newly built domain list, overwrite a fresh pairing, resurrect retired access, or clear a concurrent operator Pause.

This patch changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.9.2.

Task creation applies the [TASK] marker exactly once. MCP sage_task and CEREBRUM's task-creation path preserve content that is already marked instead of storing [TASK] [TASK] ...; unmarked content still receives the canonical prefix. Direct regression tests cover both entry points and both marked/unmarked inputs.

• A failed publication can be resumed only from the current protected main workflow and always checks out the exact immutable tag. The staged Python wheel smoke test installs declared runtime dependencies before importing the SDK.

• The four-validator partition proof accepts observed reject activity on either symmetric firewall endpoint while still verifying the exact peer topology on every node before, during, and after healing.

• The Go database, compression, TOML, and SQLite dependencies were refreshed through the full race and fault matrix. GitHub's Go, Node, and CodeQL actions remain pinned to immutable commits.

Release evidence: the exact-source make v119-state-sync cold run passed on source identity 7080580b15e7e5158a04e8b294ab772e51f294633be2737f904276afec4c3458. The branch and tag workflows independently rerun the complete race, lint, SDK/frontend, security, fault, packaging, and publication gates before exposing release artifacts.

Validator rollout boundary: install and restart the exact frozen v11.9 artifact on every participating validator before anyone broadcasts the non-empty-domain app-v20 / target-20 ceremony transaction. A merely >2/3 upgraded subset is unsafe: v11.8 does not understand the signed governance-domain tail. For operator-managed socket-mode Comet, keep recheck=true, cap max_tx_bytes at 1 MiB, and restart Comet as well so no pre-rollout oversized mempool entry survives.

Selected domains can now become canonical, recoverable quorum state inside one SAGE consensus chain. App-v20 adds exact-domain scopes whose on-chain roster and integer weights are fixed by validator governance. Each scoped memory pins its submission-time denominator, so later membership changes cannot rewrite an in-flight ballot; acceptance requires strictly greater than two-thirds of that pinned weight. Scope membership grants voting weight only—it does not grant domain ownership, RBAC, federation access, or administrator authority.

• Canonical recovery instead of projection trust. Scoped content, classification, tags, roster revisions, and ballots are AppHash-covered in Badger. A recovering replica verifies the canonical envelopes and rebuilds its discarded SQLite/PostgreSQL serving projection; /ready stays unavailable when required scoped content is missing, locked, or inconsistent.

• Authorized, boot-only network state sync. Real ABCI state-sync endpoints serve a bounded latest-visible consensus stream, never the private local rollback bundle. A strict local authorization binds the chain, existing validator/provider IDs, joining node and validator key, app version, height floor, and expiry. The effective Comet profile disables peer discovery and ordinary peer capacity, enables authenticated exact-ID filtering, and requires two distinct reachable RPC origins for light-client verification. A synchronized receiver remains a non-validator until a separate signed governance action admits its validator key.

• Crash-safe seal-before-serving. A pristine receiver verifies the candidate in isolation, activates a complete application bundle under an exclusive lease, waits for Comet's signed commit/state/block-sync handoff, durably writes the sealed activation journal, durably disarms quorum.state_sync.receiving, cleans recovery evidence, and only then publishes the runtime seal. Projection rebuild, snapshots, REST/dashboard/MCP/federation, voters, and background workers start from that final frozen bundle.

• Validator-bound governance sessions. The configured operator signs the exact REST/MCP action, while the live validator still owns the outer transaction, proposal, vote, and voting power. App-v20 binds delegated governance proofs to the target validator and a chain-derived governance domain, with deterministic freshness and single-use replay protection.

• Colleague-style sharing between independent SAGE brains. A fresh JOIN establishes exact chain/operator/CA/epoch trust and starts with zero shared domains. Each peer independently selects existing domains and can change them without pairing again: Read borrows live recall, while Copy also requires the receiver's separate “Save here” opt-in. Cross-host Write remains an authenticated 501 until it has connection-bound consensus authorization. Direct and synchronization-group traffic revalidate the exact live identity, and agreement set, JOIN activation, narrowing, and revocation are linearized so a completed change cannot leave stale access in flight.

• Crash-atomic app-v20 blocks. The one authenticated app-v20 bootstrap is isolated into a dedicated block; after its marker commits, FinalizeBlock evaluates each complete block in one speculative Badger transaction. Commit atomically persists every ordinary/governance write, validator reconfiguration, nonce, AppHash, and handshake height. A pre-Commit crash discards the whole transition, so ordinary mixed blocks replay exactly without an app-local result journal or ongoing governance-only block isolation.

• Release evidence spans real failures. The gate suite combines signed app-v20 scope formation/revision in independent OS processes, FinalizeBlock/Commit SIGKILL replay, held-replica catch-up, real four-validator Comet TCP crash/partition/heal checks, and the integrated provider/observer/unauthorized/two-receiver state-sync topology. The final exact-tree cold execution passed before the release branch was published.

This is same-chain validator replication, not a relabeling of v11.8 synchronization groups or independent-chain federation. Internet validators still need mutually routable Comet TCP, explicit port forwarding, or an operator VPN, plus reachable RPC origins. Federation is not a validator tunnel; a future tunnel layer is separate work and is not part of v11.9.0.

App-v20 remains dormant until the governed upgrade activates it, preserving byte-identical pre-activation replay. A rolling binary install is safe only while the tagged target-20 ceremony has not been submitted. SDK 11.9.0.

MRI memories now remain inside the anatomical cranium at every zoom and rotation. The memory cloud previously used a vertically symmetric ellipsoid even though the bundled anatomical mesh has a much shallower lower cranial boundary outside its narrow, off-centre brainstem. Lower-hemisphere nodes could therefore protrude through the mesh, especially after the v11.8.3 spread increase. CEREBRUM now uses an asymmetric vertical envelope with explicit clearance for each rendered sphere and bloom halo. The upper cortex keeps its full spread, and the newest-to-outer / oldest-to-inner age ordering is unchanged.

The placement contract is directly regression-tested across the full age, radial-jitter, and elevation range, including a fixed lower-cranium safety threshold. This patch changes no consensus rule, AppHash, transaction type, key encoding, fork, graph API limit, or server workload; existing chains replay byte-identically and app version 20 remains unallocated.

SDK 11.8.5.

Domain write denials now say what is wrong and how to fix it. When consensus rejects a memory because its authenticated agent lacks level-2 write access to an owned domain, the REST API now returns a distinct, sanitized RFC 7807 domain-write-denied problem instead of collapsing it into a generic 403. MCP preserves that machine-readable type, immediately points the agent to CEREBRUM Access Controls or the domain owner, and performs no pointless re-registration, retry loop, or /mcp reconnect suggestion. Older servers' generic denial remains on the bounded compatibility recovery path.

The built-in CEREBRUM guide also explains SAGE's token-efficiency story without pretending every session necessarily uses fewer tokens: durable context lives outside any one model and only the relevant pieces are brought back, so token spend carries useful memory instead of repeated explanations and each tool rebuilding the same history.

This patch changes no consensus rule, AppHash, transaction type, key encoding, fork, or authorization decision; existing chains replay byte-identically and app version 20 remains unallocated.

SDK 11.8.4.

A memory brain that uses its full anatomy while keeping age meaningful. CEREBRUM now spreads its 2,500-memory representative sample through a substantially broader portion of the MRI mesh instead of crowding long-lived histories into the centre. Fresh memories remain nearest the outer cortex; memories move progressively inward as they age, and the oldest cohort settles toward the lower inner brainstem. A one-year age window replaces the old 90-day clamp, while a small deterministic radial offset separates same-age memories without turning the stable layout into a force simulation.

The placement calculation now lives in a pure, directly tested module with bounded mesh extents and monotonic age-to-depth checks. This patch changes no consensus rule, AppHash, transaction type, key encoding, fork, graph API limit, or server workload; existing chains replay byte-identically and app version 20 remains unallocated.

SDK 11.8.3.

Synchronization groups — human-verified, signed memory sharing between separate SAGE brains. A synchronization group coordinates memory sharing off-consensus through a partitioned, hash-chained, ed25519-signed audit journal: a roster sub-chain replicated to every member and independent per-domain sub-chains replicated only to the members who share that domain, so a node never learns of a domain it does not share. Group items are origin-signed, so a relaying peer can back-fill the mesh without being able to forge or mis-attribute them. Adding a shared domain is a two-party action — the owning member and the group controller both sign — members express selective-sync consent over the subset of domains they receive, and controller epoch rotation, member removal, and rejoin are all explicit signed roster events reconciled between peers by anti-entropy exchange.

At the time of v11.8.2, each MCP bearer minted and registered its own signing identity. Current app-v23 behavior supersedes that design: v11.18.26 binds new bearers to existing approved locally managed agents so token creation cannot strand an unapprovable identity. This release also hardens group authorization: a controller epoch rotation now re-attests the shared domain set under the incoming controller, so rotating control away from a node revokes that node's ability to admit or re-widen shared domains with its old key; and a removed or departed member cannot be silently re-activated with stale entitlements — re-entry requires a fresh, co-signed invitation. The v11.8 consensus fork gate is present but dormant.

The CEREBRUM MRI now renders a 2,500-memory representative sample instead of stopping at 500, filling large brains with a denser view while preserving a bounded GPU and API workload. The dashboard and fullscreen MRI share one limit, and operators can still tune the server ceiling with SAGE_GRAPH_MAX_NODES.

v11.8.2 is the first published build of the v11.8 line. It also clears the release lint gate and adds a replay-safety regression guard for the delegated-proof rules already committed by v11.7.6 and v11.7.7 chains. The recovery changes no production behavior beyond the reviewed v11.8 source tree apart from the denser MRI visualization.

SDK 11.8.2.

One CEREBRUM tab in Firefox, including across app restarts. v11.7.7 fixes the remaining macOS launch path that could create duplicate CEREBRUM tabs. The earlier tab-focus implementation could inspect Safari and Chromium-family tabs, but Firefox exposes no equivalent AppleScript tab API; the native app also incorrectly assumed a newly started tray process could not inherit a browser tab left open by the previous process. SAGE now checks a loopback-only live-dashboard presence signal before opening a URL and activates the default browser when CEREBRUM is already connected. Initial app launch, post-update restart, dock reopen, and the Open CEREBRUM menu all use the same reuse path.

This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.

SDK 11.7.7.

Reliable MCP turn writes and task cards that show the whole job. v11.7.6 fixes two post-app-v17 delegated-proof failures that v11.7.4 exposed after making the node authoritative for embeddings. Consensus now keeps every agent-controlled memory field bound to the exact signed request while accepting the validator-signed node's derived embedding hash, so provider cutovers no longer turn valid sage_turn observations into opaque CheckTx rejections. Fresh requests also survive the first block after a long idle period even when deterministic chain time trails the already wall-clock-validated MCP request; captured old proofs remain rejected. Public REST/MCP errors now distinguish proof mismatch and expiry from a generic request rejected.

CEREBRUM task cards stay compact by default but can expand to show complete multiline text. Planned tasks can be edited and saved without rewriting consensus history: SAGE confirms a replacement task first, then retires the original card. Existing committed blocks replay byte-identically; this patch changes only admission of requests that older binaries incorrectly rejected.

SDK 11.7.6.

Readable contextual help at every CEREBRUM boundary. Help tooltips now account for the nearest scroll-clipping container as well as the browser viewport, so hints near the top of Settings and other bounded panels flip downward instead of opening behind the fixed application chrome. The positioning check runs after the tooltip is rendered and keeps keyboard/focus behavior intact. This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.

SDK 11.7.5.

Provider-safe Smart Memory, automatic repair, and one CEREBRUM tab. The SAGE node is now authoritative for every stored vector: it regenerates agent submissions with the selected embedding provider, stamps the exact vector space, and filters vector recall to that same space. Switching between preferred Ollama embeddings and local hash embeddings cuts write/query authority over before background migration, so active agents cannot keep a migration alive forever and recall never compares incompatible vectors. Provider recovery is watched continuously, so vectorless observations left by a transient outage repair automatically after Ollama or another configured embedder returns. New MCP clients still attach a compatibility vector for older SAGE nodes, while v11.7.4 nodes safely regenerate it.

CEREBRUM Settings now presents Ollama/hash embeddings and the independent reranker On/Off control directly, and the top status strip shows reranker state. The macOS dock app focuses an existing localhost CEREBRUM tab before opening a new one, with bounded browser automation and a safe fallback. PostgreSQL mirrors the embedding-provider provenance used by personal SQLite nodes. This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.

SDK 11.7.4.

Strict project memory and task ownership, plus a cooler Settings page. sage_turn now treats its domain as an exact recall boundary, so one repository's session cannot be re-anchored by memories from another repository. Agent backlogs return only tasks whose assignee exactly matches the signature-verified agent ID; unassigned work stays in human CEREBRUM triage and cannot be self-claimed. Agent-created tasks are assigned to their creator, every in_progress task must have an owner, and historical ownerless running rows return to Planned on upgrade. Assignment also remains subject to the agent's domain-access policy.

CEREBRUM no longer polls health, full memory statistics, and the complete agent inventory every three seconds. Health refreshes at a calmer interval, the existing health payload supplies memory totals without a duplicate full-store scan, agents load only when Overview is visible, and all Settings polling pauses in background tabs. An RBAC save that fails on-chain now says clearly that access is not active and keeps Save enabled for an actual retry. This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.

SDK 11.7.3.

Background macOS updates are back, without compromising the signed app. SAGE now downloads and installs directly from the update banner, verifies the architecture-specific DMG against its published SHA-256, mounts it read-only, enforces the expected bundle identifier and Developer ID team, and asks Gatekeeper to validate both the release app and its staged copy. Activation atomically exchanges the entire signed SAGE.app bundle while preserving the previous bundle for proof-of-boot rollback. CEREBRUM also restores Access Controls, fixes Task Board page scrolling, and isolates the live block countdown so it no longer re-renders the entire Settings screen. Existing chains replay byte-identically.

SDK 11.7.2.

Smart-memory reliability and task-board maintenance release. Managed Smart Memory now stays managed: SAGE supervises the local Ollama runtime, adopts it across upgrades, and automatically restarts it after a crash instead of leaving semantic recall offline until manual repair. CEREBRUM tasks, imports, and pipeline journals now preserve embedding provenance, so newly indexed memories no longer drift back into the “needs fixing” queue after a successful repair. The task board also correctly fills the remaining application height, keeping the bottom of every column reachable. This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.

SDK 11.7.1.

Administration, connection, and lifecycle release. The genesis admin can now give a locally installed agent read or read+write access to a domain another agent owns, directly from CEREBRUM: the original owner is shown before confirmation, bound into the consensus transaction, and the override is recorded as an ordinary on-chain grant/revoke. Consensus support ships behind the dormant app-v18 gate; existing chains replay byte-identically. Connecting AI tools now follows OpenAI's current product surfaces: ChatGPT desktop's Codex mode gets a one-click app-wide local connection (shared with Codex CLI and the IDE extension), while ChatGPT Work uses the hosted connector path. Restarts and updates are coordinated end-to-end: a single-instance lock, clean draining of MCP sessions and dashboard streams, checksum-verified updates with automatic rollback and proof-of-boot verification. CEREBRUM now checks for new releases automatically and shows an update banner at the top of every page, with release notes and a direct path to update or restart options. This release also fixes the v11.6.1 reports of intermittent lost MCP connections and "cannot save to domain" errors (a boot-time key cache, transport blips mislabeled as permission denials, and a keep-alive race), hardens the HTTP MCP transport (operator-only bearer principal, nonce replay cache, exact origin allowlist), and rewrites the in-app CEREBRUM guide in plain language for non-technical users.

SDK 11.7.0.

Security and task-handoff maintenance release. v11.6.1 upgrades the transitive federation dependency quic-go to 0.59.1, incorporating the upstream fix for CVE-2026-40898. Assigned board tasks now reliably appear across provider boundaries, create dedicated one-way agent inbox notices, and are checked alongside backlog at agent boot. CEREBRUM also replaces browser-native confirmation prompts with accessible, themed SAGE dialogs. It changes no SAGE consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.

SDK 11.6.1.

SAGE federation can now travel with you, and selected memories can become a shared, durable two-node brain without turning the relay into a trusted server. v11.6.0 is an off-consensus connectivity, replication-control, and UX release: it changes no consensus rule, AppHash, transaction type, key encoding, or fork. app-v17 remains shipped-dormant until governed activation, and existing chains replay byte-identically.

• Pair across the internet without port-forwarding. Current CEREBRUM prepares direct and secure-relay candidates behind one connection flow; v11.6 introduced the bounded libp2p route bundle, NAT traversal, and Circuit Relay v2 fallback that make that possible. Federation mTLS, the pinned CA, active treaty, and signed requests remain the trust boundary; the relay sees encrypted bytes and connection metadata, never plaintext memories or federation keys.

• LAN relationships roam without re-pairing. A legacy-shaped LAN QR stays compatible with older guests. Once two v11.6 nodes finish signing, they exchange relay/direct routes over the authenticated agreement, persist them atomically, and can move LAN → internet → LAN without changing federation identity.

• Memory sync is host-controlled and off by default. After signing, the host can leave copying off or choose concrete domains permitted by both treaty scopes and local domain ownership. The selected set is the complete bidirectional replication allowlist; the guest can view it or disconnect, but cannot widen it. Existing pre-v11.6 links retain their legacy bilateral behavior until they re-pair.

• Offline catch-up keeps domain boundaries intact. The existing durable outbox and anti-entropy engine now propagate versioned host policy before data, preserve user tags, retry across restarts and outages, and catch a returning peer up. Memories outside selected domains never enter the sync outbox.

• Crash-safe no-forward provenance. A received copy is durably quarantined before its local consensus submission. Ambiguous timeouts, restarts, and revocation cannot make a foreign copy look native or leak into A→B→C forwarding; exact mirrors promote without rebroadcast, while identity mismatches fail closed.

• Federation remains opt-in. A fresh or upgraded node does not contact the project relay while federation is disabled and no persisted peer routes exist. The shipped relay is a connectivity dependency for relay-only paths, not a validator or memory store; operators can configure their own relay multiaddrs.

SDK 11.6.0.

Quorum-governed memory lifecycle plus pipe anti-DoS hardening: a two-phase challenge whose bar scales to the network, a first-class reinstate verb, disputed-but-recallable memories, and size caps and quotas on the agent pipe. v11.5.0 introduces a new consensus fork app-v17 that ships dormant - it changes no live-chain behavior until a network activates it through the governed upgrade ladder (a 2/3 quorum vote, past a 200-block floor). Until then app-v15 stays the active v11 consensus fork, app-v16 stays shipped-dormant, and historical replay of every existing chain stays byte-identical. The pipe hardening is off-consensus and active on upgrade.

• Deprecation gates on a quorum that scales to the network (opt-in fork). When a memory is challenged, app-v17 counts the distinct modify-verb holders on its domain from committed state - the owner, ancestor-domain owners, and unexpired level-3 grantees, enumerated in sorted order. A personal node with one holder keeps the byte-identical legacy one-strike deprecate; where two or more holders exist the memory is parked as challenged, and a second, distinct holder must confirm before it deprecates - the original challenger cannot self-confirm. So a small-LAN node and a large federation apply proportionate bars instead of one hardcoded threshold.

• Reinstate is a first-class verb again (opt-in fork). A new app-v17 transaction, TxTypeMemoryReinstate, takes a challenged memory back to committed, restoring its original content hash from the challenge record; a challenger who wants to withdraw rides the same tx even if their grant has since expired or been revoked. It is reachable through REST (POST /v1/memory/{id}/reinstate), MCP (sage_reinstate), the Chrome bridge, and both Python SDK clients.

• Delegated agent proofs are action-bound on-chain (opt-in fork). When a REST node signs a transaction for a different agent, app-v17 carries the exact canonical signed request in a backward-compatible optional envelope. Consensus re-hashes and re-verifies it, reconstructs the authorized type-specific payload, applies the ±5-minute window against deterministic block time, and consumes an AppHash-folded proof marker once. A captured proof cannot be transplanted onto another action or rewrapped under a fresh node nonce. Node-originated transactions signed end-to-end by the same key keep the existing outer-signature + nonce path.

• Challenged memories stay recallable, clearly marked. A memory under a two-phase challenge is no longer hidden while the dispute resolves: recall (REST and MCP) still returns it with a new disputed flag set and a query-time confidence haircut already applied to confidence_score, so an agent sees the marker and the softened score instead of silently losing the memory.

• The agent pipe has anti-DoS guards on every write path. Pipe payloads and results are capped at 256 KiB and intents at 8 KiB at the store chokepoint, with matching 413 fast-fails in the REST and dashboard handlers. Open pipes are quota'd - 256 per verified agent identity, 10000 node-wide - checked and inserted under one write lock so a parallel burst cannot race past the cap, then rejected as 429 with Retry-After (the same backpressure recipe as a full mempool). The quota keys on the Ed25519-verified from_agent, not the spoofable rate-limit header.

• Stale pipes can't pile up. A retention backstop force-expires pending or claimed pipe rows older than 48h regardless of their stamped TTL, wired into the existing 5-minute sweep plus a new boot one-shot; terminal rows still purge 24h after creation, and the dashboard's TTL input is now clamped to 24h.

• CEREBRUM explains itself. Polished hover/focus tooltips are on by default, with detailed explanations for every sidebar destination and consistent upgrades for existing icon, status, filter, and settings hints. They stay keyboard-accessible, avoid viewport clipping, and can still be disabled under Settings → Maintenance → Preferences.

SDK 11.5.0.

ChatGPT setup is now a background-managed CEREBRUM flow. v11.4.11 is an off-consensus UX and packaging patch - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork, app-v16 stays shipped-dormant, and historical replay stays byte-identical.

• No terminal needed for ChatGPT. The ChatGPT setup wizard now downloads the pinned OpenAI tunnel-client, writes the local profile, and starts the daemon from inside CEREBRUM. The user only opens the OpenAI and ChatGPT browser tabs.

• The generated MCP command uses the running SAGE app. CEREBRUM gets the real sage-gui executable path from the backend instead of assuming sage-gui is on PATH, so macOS app-bundle installs work.

• The tunnel client avoids SAGE's port. The managed tunnel-client admin UI binds 127.0.0.1:8081, leaving SAGE's dashboard on 127.0.0.1:8080.

• No fake secret in copyable commands. The runtime API key is accepted once to launch the child process and is not written to the profile or preferences. Advanced manual commands use an explicit placeholder, not a valid-looking sk-....

• Patch-release metadata is current. The SDK, Docker/MCP registry metadata, dashboard fallback version, and release notes are bumped together for 11.4.11.

SDK 11.4.11.

Connecting two SAGEs works again. v11.4.10 is an off-consensus bug-fix patch - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork, app-v16 stays shipped-dormant, and historical replay stays byte-identical.

• The join ceremony completes. A URL-building regression in v11.4.8/v11.4.9 made the guest's "did they approve yet?" check fail silently, freezing every new connection at "1 of 2 confirmed" on both screens. The guest now sees the host's approval and the ceremony finishes.

• The wizard tells you what's wrong. If the guest can't check the host's side, the waiting screen now shows the actual reason instead of a generic network hint.

• Read-back copy is clearer. The host's "read this code" instruction now uses the other network's name.

• The public MCP registry stays current. Releases now publish SAGE's server manifest to the MCP registry automatically, and the public listing was refreshed to the current version.

• Patch-release metadata is current. The SDK, Docker/MCP registry metadata, dashboard fallback version, and release notes are bumped together for 11.4.10.

SDK 11.4.10.

ChatGPT setup now follows OpenAI's official Secure MCP Tunnel path. v11.4.9 is an off-consensus UX and packaging patch - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork, app-v16 stays shipped-dormant, and historical replay stays byte-identical.

• ChatGPT is first-class in Connect an AI tool. The setup menu now shows ChatGPT directly instead of hiding it behind the generic remote-tool branch.

• OpenAI Secure MCP Tunnel is the ChatGPT path. The wizard gives a copyable tunnel-client runbook for SAGE's local stdio MCP server. No domain, no public SAGE URL, and no inbound firewall rule.

• Remote-tool copy is clearer. Non-ChatGPT remote tools now point to LAN/VPN or a reachable HTTPS endpoint you manage instead of mixing those cases into the ChatGPT flow.

• Patch-release metadata is current. The SDK, Docker/MCP registry metadata, dashboard fallback version, and release notes are bumped together for 11.4.9.

SDK 11.4.9.

The join ceremony guardrails are tighter, and the release pipeline is cleaner. v11.4.8 is an off-consensus reliability and release-maintenance patch - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork, app-v16 stays shipped-dormant, and historical replay stays byte-identical.

• Join ceremony endpoint handling stays LAN-first. The federation join client accepts only localhost/private-LAN endpoints, canonicalizes the base URL, and re-checks the destination in the HTTP transport at dial time.

• Train-of-thought columns read cleaner. Empty MRI related-memory columns now say "None yet" instead of a placeholder dash.

• Release automation pins move in lockstep. The analysis workflow now keeps its setup and reporting steps on the same action version, avoiding mixed-version release noise.

• Patch-release metadata is current. The SDK, Docker/MCP registry metadata, dashboard fallback version, and release notes are bumped together for 11.4.8.

SDK 11.4.8.

Dependencies are current, agent pipeline replies are claimant-bound, and release gates now cover the nested natter module. v11.4.7 is an off-consensus dependency and release-hardening patch - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork, app-v16 stays shipped-dormant, and historical replay stays byte-identical. Everything here lives in dependency pins, local SQLite pipeline metadata, federation seed-at-rest handling, and CI/release automation.

• Natter dependency refresh. The nested natter Go module now carries the updated quic-go, x/crypto, and x/net dependency line, plus the matching x/* tidy updates. This keeps the optional connectivity service ready for the v11.5 internet-federation work without spending an app-version slot.

• Agent pipeline claim/result hardening. Pipeline claims now record claimed_by, and result submission is accepted only from the authenticated claimant (or a safe legacy recipient path for already-claimed pre-upgrade rows). Unrelated callers still get anti-enumeration 404s, senders can read their own pipe status but cannot complete recipient work, and failed/forged result attempts no longer create auto-journal memories.

• Federation TOTP seeds follow the vault. When a node starts with the vault already unlocked, federation TOTP seeds are wrapped at rest using that passphrase; legacy plaintext seed envelopes still load for backward compatibility. Changing the passphrase clears stale in-memory seed candidates before reload.

• Release gates now see the real tree. CI and release workflows now lint/test the nested natter module, run a cheap first-party JavaScript syntax check, and Dependabot is configured for root Go, natter, npm, the Python SDK, and GitHub Actions.

SDK 11.4.7.

Give your network a real name, connect without getting stuck, and scan a code your laptop camera can actually read. v11.4.6 is an off-consensus federation reliability + UX release - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork and app-v16 stays shipped-dormant, and historical replay stays byte-identical. Everything here lives on the federation transport (mTLS on :8444, outside consensus), a local display table, and the dashboard.

• Name your network. Your network was only ever identified by its raw id (something like sage-personal-ybly7j6fzxp5n4zsvomjzway4w) - so when someone tried to join you, that unreadable string was all you saw. You can now give your network a friendly name (e.g. "Dhillon's MacBook") from the Federation page. Peers see it during a join - the host's review step reads "Dhillon's Mac wants to connect" - and it labels the row in each side's connections list. The name is a cosmetic label carried alongside the permanent id, which never changes: it's not used to verify anyone (the scanned/spoken code still is that anchor), and it never touches the chain.

• Joining no longer gets stuck at the last step. A guest waiting for the host's approval polls for it every couple of seconds; that legitimate polling could trip the join listener's abuse rate-limit, so the host's approval sometimes never reached the guest and the ceremony hung on "waiting for them." The rate limit now separates read-only status polling (generous) from code-submitting steps (still tight), so a normal join always completes; a stalled connection now surfaces a reason instead of spinning forever.

• A QR your webcam can lock onto. Scanning with a laptop's built-in camera pointed at another laptop across a desk was fiddly. Click the QR (or "Make it bigger") to blow it up to a full-screen, high-contrast code. The host's connection code also shows immediately now instead of behind an extra click, and the whole join flow is centered and written in plainer language.

• Arrange your agents into groups. On the Agents page you can now drag one agent onto another to group them - handy for organizing by machine or purpose - with collapsible, renamable groups. It's a local view convenience only; it changes nothing on the network.

• ChatGPT setup wizard reads straight. The "Connect to ChatGPT" wizard's callout used to point at a flow that can't list ChatGPT (OpenAI connectors need a public URL), and a mixed-content banner rendered scrambled. Both are fixed - the copy now says plainly that ChatGPT always needs the tunnel, and the banner lays out in order.

SDK 11.4.6.

Federation grows up: it's opt-in behind one master switch, it survives restarts and hours-long peer outages, and a topic's memories can now be copied across a link, not just borrowed live. v11.4.5 is an off-consensus reliability and federation-UX release - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork and app-v16 stays shipped-dormant, and historical replay stays byte-identical. Everything here lives on the federation transport (mTLS on :8444, outside consensus) and the dashboard; domain sync admits a copied memory as an ordinary locally-signed MemorySubmit on the receiver's own chain, so there is no new transaction and no fork.

• Federation is opt-in now, behind one switch. A fresh or upgraded node accepts no inbound connections until you turn federation on - upgrading never silently opens the :8444 port. The Federation panel gains a master On/Off switch at the top, and the same toggle stays in Settings, so the control is discoverable in both places. While it's off, the join/host cards are hidden with a nudge to turn it on; when on, the listener still only admits peers pinned to an agreement you approved (on your LAN or a route you provide).

• Domain sync (preview): copy a topic across a link, not just borrow answers. A federated connection has always let each side borrow answers live within shared topics; now you can also copy a topic's memories across so they live on both brains. It's built from a durable outbox, an anti-entropy digest that reconciles what each side is missing, and a commit-tail watcher, and it stays off until both sides turn it on for a given topic. Copied memories are admitted on the receiver as ordinary locally-signed submissions - no new transaction type, no fork.

• Federation survives being offline. A peer that goes dark for hours no longer costs you the backlog: transport and environmental errors (peer offline, not-yet-upgraded, vault locked) no longer count toward the give-up cap, so queued memories keep retrying and drain when the peer returns. The rotating-seed cache is now loaded at boot, so federation no longer stops working after a node restart. Undeliverable and rejected items surface in the dashboard with a resend control and an out-of-office-style reason, so nothing fails silently.

• A dashboard crash is fixed. The Settings page (and the new Federation panel) could hit a ReferenceError that froze the section; the shared status-dot helper is now module-scoped so both render cleanly.

• Groundwork for v11.5 internet federation. The optional natter connectivity service (a separate binary, outside the SAGE trust boundary) gains a coordinator-only mode and explicit address advertisement for cloud hosts - plumbing for the NAT-traversal/relay work that lands as the v11.5 headline. Built-in internet traversal is not in v11.4.5 yet; federation today is LAN or a route you provide.

SDK 11.4.5.

Handing a memory's domain to another agent is now one click from the search results themselves. v11.4.0 is a dashboard-only feature release: it changes no consensus rule, AppHash, transaction type, key-encoding, or fork - app-v15 stays the active v11 consensus fork and app-v16 stays shipped-dormant, and historical replay stays byte-identical. The new control reuses the existing v11.3 on-chain reassignment path, so there is no new transaction and no server change.

• "Transfer to agent" from the memory selection. The Search-page bulk action bar gains a "Transfer to agent" action alongside Move, Tag, and Forget: select one or more memories, pick a new owner, and their whole RBAC domain's ownership is handed over on-chain. This complements the existing filter-row "Transfer domain ownership" button (which starts from a source agent) with a second, more direct entry point that starts from the memories you are looking at. Both drive the same honest whole-domain transfer: it moves the entire domain (every memory in it, including ones not selected), transfers ownership plus read/write access, not authorship (submitting_agent stays immutable and auditable), and the previous owner is fully revoked. When a selection spans several domains, each is transferred in turn, and the confirmation copy spells out that unselected memories move too.

SDK 11.4.0.

A maintenance patch: golang.org/x/crypto is refreshed, and a latent transaction-encoding overflow is closed. v11.3.1 changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork and app-v16 stays shipped-dormant, and historical replay stays byte-identical. Both fixes sit off the consensus hot path.

• golang.org/x/crypto 0.51.0 to 0.52.0. Keeps the crypto dependency line current for the argon2 and hkdf packages SAGE actually imports.

• The transaction encoder bounds the payload length. EncodeTx now rejects a payload larger than MaxInt32 up front, so the total-length arithmetic cannot overflow and the 4-byte length prefix cannot silently truncate a pathologically oversized transaction. This mirrors the guard DecodeTx already had. No real transaction approaches this size, so behavior is unchanged for all valid traffic.

SDK 11.3.1.

Transferring a domain to another agent, and setting who can read and write it, are now real on-chain RBAC operations from CEREBRUM - and the access matrix finally enforces what it shows. v11.3.0 changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork and app-v16 stays shipped-dormant, unchanged from v11.2.x. The RBAC domain-ownership transfer is built entirely from existing on-chain transactions - DomainReassign (tx-30), AccessGrant (tx-6), and AccessRevoke (tx-7), gated by an existing gov_propose (operation=domain_reassign) - so there is no new transaction and no new fork. There is exactly one consensus-path code change (applyGovernanceProposal now returns early for OpDomainReassign instead of falling through to validator-pubkey derivation, which logged a spurious error on every reassign), and it is proven AppHash-neutral: the caller appends a validator update only when the result is non-nil, so both the old error path and the new clean return append nothing - identical validator updates and state writes, so historical replay stays byte-identical, with only the error log gone. Memory authorship (submitting_agent) is never rewritten by any v11.3 path.

• RBAC domain-ownership transfer, on-chain from CEREBRUM. A new Search-page action "Transfer domain ownership" lets you pick a source agent, pick one of its domains, and hand it to a target agent. The historical v11.3 orchestration was all commit-confirmed: a governance proposal (domain_reassign) was accepted by the sole validator, DomainReassign flipped the owner and purged the domain's stale grants, and a redundant AccessGrant mirrored the new owner's access. App-v26 retires that trailing self-grant: canonical ownership itself gives immediate policy-limited authority, so transfer no longer depends on CEREBRUM holding the target private key. This transfers ownership and current authority, not authorship - every memory stays authored by whoever wrote it (submitting_agent is immutable and auditable), and the new owner gains access through ownership rather than by rewriting history. The old label-based "Transfer by Tag" paths, which rewrote authorship off-chain, are retired.

• The access matrix now enforces what it shows. The per-agent read/write Domain Access matrix previously wrote only a cosmetic JSON blob that the consensus access checks never read, while the tooltip claimed "enforced on every request." On Save it now issues real on-chain AccessGrant / AccessRevoke transactions (signed as the domain owner), diffed against the actual on-chain grant state so it is idempotent and self-healing. Per-domain results are reported honestly (including "you do not hold this domain owner's key" skips), and the misleading copy is corrected. No admin-bypass was added to the consensus grant/revoke handlers.

• CEREBRUM light theme plus MRI redesign. A full light-mode theme lands for the dashboard (persisted, with a sun/moon toggle), including a light-mode render of the 3D MRI memory brain. The MRI layout now places memories by recency - recent at the surface, older deeper - with a draggable, width-auto-fitting "Domain tags" side panel.

• Search date filters plus sage_rename. The Search page gains a created-at date-range filter and a "Last hour" preset. A new sage_rename MCP tool renames an agent's display name and boot bio on-chain (via AgentUpdate), failing closed to preserve the existing bio - an agent rename, not a memory or domain rename.

• The version badge reads live. The CEREBRUM version badge (header and Overview node card) now reads the live node version from /health instead of a hard-coded constant, with the fallback constant kept in sync with the release.

SDK 11.3.0.

A reliability patch: sage_turn (and all embedding-backed recall/store) no longer fails on transient Ollama hiccups. Agents reported intermittent embed errors — the local embedder (nomic-embed-text) blipping or disconnecting "from time to time." The root cause was the embedder client: a single, unretried request with no keep_alive, so Ollama's default 5-minute idle unload meant the next embed paid a cold model reload that could time out or fail. sage_turn embeds twice (recall + store), so the flakiness hit both legs. All fixes are off-consensus — no chain, fork, or API-contract change.

• The embed model stays resident. Every embed request now sends keep_alive (default 30m, override OLLAMA_KEEP_ALIVE), so nomic-embed-text isn't unloaded between turns — eliminating the cold-reload behind most of the intermittent failures. Integer-form values (e.g. OLLAMA_KEEP_ALIVE=-1 to pin it in memory) are translated to the wire form Ollama accepts.

• Transient blips are retried; hangs fail fast. The embedder client now retries a couple of times with backoff on transient errors (connection reset, model-loading 5xx, empty result), but does not retry a timeout (a hung Ollama fails in one attempt instead of multiplying the wait) or a 4xx.

• An embedder outage never drops a sage_turn observation. If the embedder is genuinely down after retries, the memory is still committed (without a vector) rather than lost, and the turn now reports store_mode: "no_vector" + semantic_degraded: true so you know it isn't semantically recallable until a re-embed backfills the vector.

SDK 11.2.1.

Two correctness fixes: min_confidence recall now filters the value it reports, and legacy "un-forgettable" memories can be deprecated again. v11.2.0 introduces a new consensus fork app-v16 that ships dormant — it changes no live-chain behavior until operators activate it via a governance vote. The recall fix is off-consensus and active on upgrade.

• min_confidence filters the decayed confidence it reports. Recall (/v1/memory/query, /search, /hybrid, and sage_recall) filtered min_confidence against the stored confidence but returned the decayed value — so a min_confidence=0.7 query could hand back a result whose confidence_score was 0.54. The floor is now enforced on the same decayed, task-aware value that's serialized, over the full candidate set before the top-K trim (so corroboration-boosted memories aren't starved and top_k fills correctly). A new initial_confidence field exposes the stored value alongside the decayed one; open tasks are exempt from decay; federated results are re-checked against the floor.

• Legacy "no recorded domain" memories can be deprecated again (opt-in fork). Memories committed before app-v8.4 never received an on-chain domain record, so forget()/challenge() rejected them — with a cryptic error — even for their owner. The new app-v16 fork adds a governance-attested domain repair (OpMemoryDomainRepair, 2/3 supermajority) that backfills the missing domain — idempotent, existence-guarded, never overwriting — after which normal deprecation works. The deprecation gate now returns an actionable 409 (legacy, needs repair) / 404 (unknown id) / 403 (unauthorized) instead of a generic rejection, and new submits must carry a domain so the state can't recur. app-v16 activates only via a governance {Name:"app-v16", TargetAppVersion:16} upgrade — the release binary changes no consensus behavior until you vote it in.

SDK 11.2.0.

Historical v11.1 release note. v11.1.0 introduced a startup network-identity re-mint for legacy nodes. That mechanism is retired and disabled in v11.16.1 because it reset canonical history.

Safety update (v11.16.1): the automatic legacy re-mint described in this historical release note is disabled. It deleted canonical Badger/CometBFT history and SQLite cannot reconstruct that authority. Legacy ids now remain unchanged until a history-preserving governed migration exists.

• Historical v11.1 behavior (retired in v11.16.1). v11.1 attempted to replace the shared pre-v11 sage-personal network id during startup. That mechanism reset canonical history and is now disabled. Affected legacy ids remain unchanged until a governed, history-preserving migration exists.

• Turning on encryption is discoverable. The System Status "Synaptic Ledger Encryption" row now has an inline Enable → button (opens Settings → Security), instead of a dead-end "Off".

• Idle chains are explained. A new operator doc (concepts/block-production-and-idle.md) makes clear that a SAGE chain has no heartbeat — an idle chain mints no blocks, and a frozen height with an empty mempool is healthy, not stuck. /v1/dashboard/health now exposes chain.idle / chain.stuck / last_block_age_seconds so monitors alert on stuck, not a still height.

• Embedding health is visible. GET /ready now reflects the embedding provider: a down semantic embedder reports degraded (HTTP 200; ?strict=1 → 503) instead of a misleading ready, refreshed by a background watchdog. And sage_recall / sage_turn results carry recall_mode / semantic_degraded / degraded_reason so an agent knows when recall silently fell back to keyword-only.

• Mempool backpressure signals. New GET /v1/chain/backpressure (+ an X-Sage-Mempool-Pct header on every submit) lets clients pace writes without polling raw CometBFT RPC, and a mempool-full submit returns 429 + Retry-After (a distinct problem type) instead of an opaque 500.

• Guaranteed auto-commit is operable. --require-voter / voter.required makes a deployment that needs automatic proposed → committed flow fail-fast rather than silently run voterless; sage_voter_running + sage_proposed_oldest_age_seconds metrics and a /ready voter block turn a stuck backlog into a first-class alarm; a new concepts/voter-operations.md runbook covers per-mode ownership, key safety, quorum math, and triage.

• Safer upgrades + hardened archive extraction. The pre-upgrade backup is verified by content (integrity + memory row-count parity) rather than file size, and an un-checkpointable write-ahead log aborts the migration instead of being discarded. Archive extraction for the managed Ollama runtime now validates symlink/hardlink targets against the extract root.

SDK 11.1.0.

Smart memory setup now manages Ollama end to end. v11.0.2 is a patch release on top of v11.0.1: no consensus rule, AppHash, transaction, key-encoding, or migration change. Existing v11 chains update in place; app-v15 remains the active v11 consensus fork.

• Managed Ollama runtime for semantic memory. The CEREBRUM smart-memory wizard can now install a pinned Ollama runtime, start/adopt the local sidecar, pull nomic-embed-text, verify the embedding dimension, and remember the managed runtime preference across restarts. This gives Ollama the same dashboard-first setup path as the managed reranker.

• Setup endpoints are wizard-gated. The new install/start/pull routes run behind the dashboard setup security gate, and archive extraction refuses traversal, oversized payloads, incomplete downloads, and checksum mismatches before anything becomes active.

• Trust and deployment wording is clearer. The public Security FAQ now separates SAGE Personal from Enterprise threat models, calls out local BadgerDB/SQLite storage accurately, and tightens the GitHub Pages privacy copy so optional connector traffic is not confused with a SAGE-hosted relay.

• Docs stay current with v11 code truth. The reference docs, benchmark READMEs, SDK README, roadmap, and environment-variable notes are updated for the v11.0.2 surface without changing consensus semantics.

SDK 11.0.2.

CEREBRUM is now fully MRI-first. v11.0.1 is a launch-polish patch on top of v11.0.0: no consensus rule, AppHash, transaction, key-encoding, or migration change. Existing v11 chains update in place; app-v15 remains the active v11 consensus fork.

• MRI is the CEREBRUM view. The legacy 2D brain option is no longer exposed in the dashboard. CEREBRUM opens directly into the 3D MRI memory brain, with the same offline three.js / 3d-force-graph bundle and anatomical mesh fallback path.

• Focused memories are clearer and easier to leave. Clicking a memory brings it into focus with a visible white focus ring, and clicking open space exits the focused train-of-thought view back to all memories.

• Launch visuals now match the product. The README leads with the real MRI brain screenshot, and the supporting screenshots are tracked with the docs so GitHub, package archives, and release pages show the correct launch surface.

• Federation wording is tightened. v11.0 federation is LAN-first, or reachable over a VPN/tunnel/operator-provided route. First-class internet/NAT traversal remains scoped for v11.5.

• Dependency update. golang.org/x/net is bumped to v0.55.0 in the Go module graph.

• Docs and SDK metadata are lockstep. The Python SDK version, reference headers, roadmap status, and MCP/Docker registry metadata are bumped to 11.0.1.

SDK 11.0.1.

CEREBRUM becomes a real control board, semantic memory turns on in a few clicks, one click stands up a managed reranker, and two SAGE nodes can now federate their memory over a secure LAN-first join ceremony. v11.0.0 activates a new app-v15 consensus fork and ships as a major version: every validator must run this binary and fully converge before the app-v15 activation height (the auto-vote readiness gate enforces this on the governance path, so an unsupported upgrade never reaches quorum). Every existing chain replays byte-identically until activation (the fork gate is dormant pre-activation), and a node-by-node rolling upgrade is safe: a mixed v10.x / v11.0.0 cluster computes the identical AppHash while app-v15 is dormant. On personal/single-validator nodes the auto-advance ladder reaches app-v15 automatically.

• CEREBRUM dashboard overhaul. A new top-level Overview control board gives you a glanceable, read-only picture of the node: a status banner plus cards for chain health, quorum and nodes, agents, federation, and embeddings, each polling independently so one dead feed never blanks the board. The 3D MRI brain is now the default view, and it renders fully offline (three.js and 3d-force-graph are bundled locally instead of pulled from a CDN); established memories pull to the core and fresh ones ride to the rim, and clicking a memory blooms its "train of thought" as a labelled constellation with a side panel you can hop through. Search is real full-text plus semantic now (FTS5, relevance-ranked, RBAC-scoped) instead of a client-side filter over the newest 100, with status filters (all / committed / proposed / deprecated), corroboration counts, an editable memory domain, and bulk curation (multi-select with an action bar). A live Tasks board shows agent-vs-human authorship, supports drag-to-status, and uses an atomic compare-and-swap claim so two agents never double-work an assignment, and a Messages tab (the agent-to-agent pipeline, merged into Tasks) adds a human-to-agent note composer so a person can drop a note into an agent's inbox without impersonating one. A first-run onboarding wizard (welcome, semantic memory, connect an AI tool, pointers) shows only on a fresh node and is re-runnable any time from Settings > Maintenance > Run setup.

• Semantic memory made effortless. A "Turn on smart memory" flow switches the node off the keyword-only hash pseudo-embedder onto the bundled Ollama + nomic-embed-text (768-dim): it detects Ollama, downloads the model if missing, re-embeds your existing memories with a live progress bar (resumable, vault-gated, runs in the background), then restarts so every consumer picks it up. Memories orphaned by a past vault re-initialization (encrypted under a previous data key and undecryptable now) can be recovered by re-keying in place: paste the old recovery key, preview "X of N", and recover, with no new IDs and no new consensus records, since only content and embedding are encrypted while the content hash stays plaintext-derived. Deprecated memories are now audit-only and never surface in CEREBRUM.

• One-click managed reranker. SAGE gives the reranker the Ollama treatment: with one consent click it downloads a pinned llama.cpp release build itself (sha256-verified before any byte touches disk) and the bge-reranker-v2-m3 GGUF (Q8_0, 636MB, sha256-verified, atomic install so a truncated or tampered file never lands), then spawns and manages a llama-server sidecar on loopback that serves a real cross-encoder /v1/rerank. It survives node restarts (a healthy survivor is adopted via a real rerank probe rather than blindly respawned, with a probe-before-kill guard on shutdown). The whole thing is a zero-terminal hands-off checklist (engine, model, start, done), and recall k is now tunable from 3 to 20 (was 4 to 10) with copy that explains the token cost and flips its guidance based on whether the reranker is actually on.

• Federation v2. Two SAGE nodes can now share memory on the same LAN, or over connectivity you explicitly provide, established through a secure join ceremony. First-class internet/NAT traversal is scoped for v11.5, not v11.0. The v11 ceremony uses RFC-6238 TOTP-based mutual verification with a QR enrollment plus spoken 6-digit confirm codes, a pin-bound short-authentication-string that provably diverges if an enrollment is relayed, and a fail-closed version gate. Two modes, both consent-gated with a "nothing is deleted" guarantee: exchange mode keeps foreign data on its owner's chain and queries it live off-consensus over a pinned mTLS federation listener and query proxy, and co-commit mode writes native memories on both chains, each ratified by its own chain and cross-anchored by a hash of the other side's signed commit receipt (you remember and I remember, each on our own chain). Guided guest and host wizards make "add another computer to my SAGE network" an end-to-end dashboard flow.

• app-v15 consensus fork. The fork that makes federation v2 real on-chain: new co-commit transaction types (CoCommitSubmit / CoCommitAttest) and cross-federation exchange-terms types (set / revoke), a co-commit envelope validity window bound to jointly-signed times and to federation status, and an access-grant verb ladder that makes the level-3 "modify" verb grantable and requestable. It also tightens the authorization gates on existing consensus handlers as a hardening pass. Every one of these rules derives purely from committed state and the consensus block time (no wall clock, no per-node cache, no map-iteration order), so every replica reaches the same verdict; all of it is byte-identical pre-activation and reached through the same governed upgrade ladder every prior fork uses (auto-advanced on personal nodes, governance-activated on a quorum).

• Quality. New memories now stamp their embedding provider at insert, so a freshly-written memory stops posing as unembedded and the "needs re-reading" counter no longer creeps up forever over real vectors. Redeploy got a robustness pass: a single-validator agent add/remove no longer runs the destructive wipe-and-restart that could brick a personal node, a stuck "reconfiguration in progress" banner can no longer wedge forever, and redeploy status reports the real terminal outcome instead of flashing a false success. Underneath it all are dozens of fixes from multi-pass adversarial find-and-verify reviews across the consensus, transport, web, frontend, and crypto surfaces.

SDK 11.0.0.

The v10.x line (MRI 3D brain, the app-v12/v13/v14 idle-block + AppHash fork ladder, multi-node-safe voting, per-domain read-ACLs) and the full v3–v9 history — consensus-first writes, PoE-weighted quorum, governance-gated upgrades, TLS, RBAC/multi-org, hybrid recall — are on the Releases page.

Research

Documentation

Stack

Go / CometBFT v0.38 / chi / BadgerDB / SQLite or PostgreSQL + pgvector / Ed25519 + AES-256-GCM + Argon2id / MCP

License

Unless otherwise stated, SAGE source code is licensed under Apache 2.0. Papers: CC BY 4.0. Some bundled visual assets are third-party works under their own licenses (e.g. the 3D MRI brain mesh, CC BY 4.0) — see THIRD_PARTY_NOTICES.md.

Author

Dhillon Andrew Kannabhiran (@l33tdawg)