(S)AGE
by l33tdawg
README.md
# (S)AGE — Sovereign Agent Governed Experience
**Persistent, consensus-validated memory infrastructure for AI agents.**
SAGE gives AI agents institutional memory that persists across conversations, goes through consensus validation, carries confidence scores, and decays naturally over time. On a multi-validator network that validation is a BFT quorum; on a personal install it is the node's own signed vote. Not a flat file. Not a vector DB bolted onto a chat app. Infrastructure — built on the same consensus primitives as distributed ledgers.
The architecture is described in [Paper 1: Agent Memory Infrastructure](papers/Paper1%20-%20Agent%20Memory%20Infrastructure%20-%20Byzantine-Resilient%20Institutional%20Memory%20for%20Multi-Agent%20Systems.pdf).
> **Just want to install it?** [Download here](https://l33tdawg.github.io/sage/) — double-click, done. Works with any AI.
[Quick Start](#quick-start) · [Architecture](#architecture) ·
[Capabilities](#current-capabilities) · [Dashboard](#cerebrum-dashboard) ·
[Release history](#release-history) · [Documentation](#documentation)
<a href="https://glama.ai/mcp/servers/l33tdawg/s-age">
<img width="380" height="200" src="https://glama.ai/mcp/servers/l33tdawg/s-age/badge" alt="(S)AGE MCP server" />
</a>
---
## Quick Start
**Desktop:** [Download the latest release](https://github.com/l33tdawg/sage/releases/latest),
open SAGE, then use CEREBRUM to connect your AI. For a full walkthrough, see
[Getting Started](docs/GETTING_STARTED.md).
**From source (Go 1.26.8+):**
```bash
git clone https://github.com/l33tdawg/sage.git && cd sage
go build -o sage-gui ./cmd/sage-gui/
./sage-gui setup # Pick your AI, get MCP config
./sage-gui serve # SAGE + Dashboard on :8080
```
Or grab a binary: [macOS DMG](https://github.com/l33tdawg/sage/releases/latest) (signed & notarized) | [Windows EXE](https://github.com/l33tdawg/sage/releases/latest) | [Linux tar.gz](https://github.com/l33tdawg/sage/releases/latest)
<details>
<summary>Docker and containerized MCP setup</summary>
### Docker
```bash
docker pull ghcr.io/l33tdawg/sage:latest
docker run -d --name sage \
-p 8080:8080 \
-v ~/.sage:/root/.sage \
ghcr.io/l33tdawg/sage:latest
```
Pin a specific version with `ghcr.io/l33tdawg/sage:11.20.3`.
The SAGE server stays in that container. To give a local MCP client a stdio
bridge, start a second process **inside the same running container**:
```bash
docker exec -i \
-e SAGE_PROVIDER=claude-code \
-e SAGE_PROJECT=my-project \
-e SAGE_IDENTITY_PATH=/root/.sage/agents/claude-code-my-project/agent.key \
sage /usr/local/bin/sage-gui mcp
```
For the shipped Compose stack, use the service name rather than a generated
container name:
```bash
docker compose -f docker-compose.sage-gui.yml exec -T \
-e SAGE_PROVIDER=claude-code \
-e SAGE_PROJECT=my-project \
-e SAGE_IDENTITY_PATH=/root/.sage/agents/claude-code-my-project/agent.key \
sage /usr/local/bin/sage-gui mcp
```
If an MCP client launches this through a wrapper, point its stdio configuration
at the wrapper's absolute path. Pass `SAGE_PROVIDER`, `SAGE_PROJECT`, and
`SAGE_IDENTITY_PATH` through `docker exec -e`/`docker compose exec -e`; setting
them only on the host-side Docker command does not place them in the container.
Keep the whole SAGE data root mounted at `/root/.sage`, including agent keys and
the ledger. Do not start a separate `docker run ... mcp` container: its
`localhost:8080` is isolated from the running SAGE server.
HTTP MCP is also available at `/v1/mcp/sse` and `/v1/mcp/streamable`, but both
require a bearer token or OAuth. Bare `http://localhost:8080` is the REST base,
not an unauthenticated MCP endpoint.
</details>
<details>
<summary>Upgrading an existing node</summary>
### Upgrading from an older version?
**Upgrading an existing node — including the v10.x → v11 jump — is
[docs/UPGRADING.md](docs/UPGRADING.md).** In the desktop app, accept the update:
SAGE verifies canonical upgrade compatibility, captures a full recovery
snapshot, installs, and restarts automatically. Headless and quorum operators
have separate technical procedures in the guide.
Your chain advances in place; a personal node climbs the consensus fork ladder by
itself. Read the guide before a multi-admin chain crosses app-v23 — that
activation re-derives administrator authority.
If you installed SAGE before v5.0 and your AI isn't doing turn-by-turn memory updates, re-run the installer in your project directory:
```bash
cd /path/to/your/project
sage-gui mcp install
```
This installs Claude Code hooks that prompt the memory lifecycle (boot, turn, reflect) — even if your `.mcp.json` is already configured. Restart your Claude Code session after running this.
</details>
---
## Architecture
```mermaid
flowchart TB
A["AI agents · MCP / SDK / REST"] --> P["SAGE node · authenticated admission + live policy"]
H["CEREBRUM · local human control"] --> P
P --> M["Memory + local policy transactions<br/>CometBFT / ABCI"]
P --> W["Node-local coordination<br/>inbox / claims / replies"]
M --> B["BadgerDB<br/>authoritative chain state"]
B --> Q["Commit-time SQL projection<br/>content + vectors for authorized recall"]
P -. "explicit peer trust and sharing" .-> F["Separate SAGE chain<br/>bounded Read / receiver-controlled Copy"]
classDef entry fill:#eef2ff,stroke:#6366f1,color:#1e293b
classDef memory fill:#ecfdf5,stroke:#059669,color:#064e3b
classDef work fill:#fff7ed,stroke:#d97706,color:#7c2d12
class A,H,P entry
class M,B,Q memory
class W,F work
```
**Agents are not validators.** Personal mode runs one real CometBFT validator
with a per-node memory auto-voter; it has no Byzantine redundancy. Registering
more agents does not add consensus voters. A multi-validator deployment runs
one shared chain; federation connects separate chains under explicit policy.
**Storage has two roles.** BadgerDB is authoritative for consensus state.
SQLite (personal) or PostgreSQL + pgvector (cluster) projects memory content
and vectors at Commit. Node-local message coordination is separate from the
memory consensus path. Block inclusion is not the same as memory acceptance.
For the detailed trust boundaries, lifecycles, and deployment topology, see
[Architecture & Deployment](docs/ARCHITECTURE.md).
## Current Capabilities
| Capability | What it provides |
|------------|------------------|
| Governed memory | Persistent, attributed memories with consensus validation, semantic recall, confidence, and lifecycle controls |
| Durable tasks | Exact-agent assigned backlog; open tasks do not decay; idempotent creation and workflow status |
| Unified inbox | Local/federated requests, assignment notices, and a separate passive reply page |
| Runtime handoff | Explicit session-and-revision-fenced takeover of claimed work within the same signed agent identity |
| Access controls | Active enrollment, roles/profiles, ownership, Access Groups, compatible grants, and classification checks |
| Controlled federation | Explicit agent exports and bounded Read/Copy policy, without granting local membership or Write |
| Recovery and updates | In-place chain upgrades, recovery snapshots, and retained message claims across ordinary restarts |
### How agents collaborate
```mermaid
flowchart TB
T["Task assigned to exact agent"] --> N["One-way assignment notice"]
N --> I["Unified inbox"]
R["Request addressed to exact agent"] --> I
I -->|"task notice"| V["Verify current assignment in backlog<br/>then update the task"]
I -->|"inbound request"| C["Claimed by one MCP runtime"]
C -->|"normal completion"| O["Idempotent reply"]
C -. "intentional same-agent takeover" .-> H["Handoff: expected session + revision"]
H --> O
O --> S["Original sender reads reply_items<br/>or pages retained replies"]
classDef input fill:#eef2ff,stroke:#6366f1,color:#1e293b
classDef task fill:#ecfdf5,stroke:#059669,color:#064e3b
classDef message fill:#fff7ed,stroke:#d97706,color:#7c2d12
class I input
class T,N,V task
class R,C,H,O,S message
```
Assignment, claim, and reply are different states. A task notice is not a
request for a message result, and a reply is not a new assignment. Runtime
handoff does not reassign a task to another agent. Wake notifications are
payload-free hints, not delivery or claim evidence. Every agent request and
result remains untrusted data, not authority to expand the user's instructions.
See the [MCP task/inbox reference](docs/reference/mcp-tools.md) and
[message/reply lifecycle](docs/reference/concepts/message-reply-lifecycle.md)
for exact fields, recovery, and authorization rules.
---
## CEREBRUM Dashboard
`http://localhost:8080/ui/` — a dashboard-native operator console centered on the 3D MRI memory brain, with chain health, agents, federation, semantic memory, recall tuning, vault recovery, tasks, imports, and updates around it. Every major workflow is available from the browser; the CLI stays there for automation and recovery.
| Control Board | Federation | Recall Engine |
|:---:|:---:|:---:|
|  |  |  |
| Chain health, quorum, agents, federation, and embeddings | One trust-only JOIN that prepares Direct and Secure relay automatically, followed by independent Read/Copy choices on each SAGE | Smart-memory setup, managed reranker install, and recall-depth tuning |
The dashboard also includes governed agent enrollment, Access Groups, domain
permissions, separate CEREBRUM Root credential handover, import/export,
software updates, and encryption controls. Ordinary agent identity replacement
uses re-enrollment; historical memory authorship is preserved.
---
## What's New in v11.20.3
**A peer's "too large" answer no longer kills the message.** The federated outbox classified `413` alongside the 4xx statuses that mean the peer understood the request and refused the bytes, so a single refusal marked the transport event `failed` and the canonical message with it: the row is never scanned again, and a durable-until-handled message carries an expiry a century out that never relieves it. That verdict is wrong for this status. A peer's per-route body cap is a build-time constant that moves when the peer upgrades, and the refusal is frequently not about size at all — on 2026-09-15 a message was refused as too large while its signed body sat 2.6 KB *under* the route's 16 KiB cap, and a *larger* message to the same peer was accepted unchanged minutes later. `413` now retries on an hourly floor, like the other capability-shaped status, so the event stays pending and delivers once the peer can take it.
**The listener stopped calling every body it could not read "too large".** The federation gate read the request body and answered `413` for any error, which merged a genuine over-cap body with a truncated upload, a mid-body disconnect and a stream reset — and the sender's terminal `413` rule turned that mislabel into permanent loss. Only a real `*http.MaxBytesError` is `413` now; a body this node could not read is answered as a read failure, which stays retryable, and logged with its underlying cause.
**A delivery failure is visible in the log.** The transport worker logged only when *recording* a failure failed, so an event could die with nothing in the log to say why. Every failed attempt now carries the event, the peer, the kind, the attempt count, the verdict and the retry delay.
No consensus change or chain migration; app-v27 remains the ceiling.
Container: `ghcr.io/l33tdawg/sage:11.20.3`. SDK 11.20.3.
## What's New in v11.20.2
**A submission whose outcome the node could not observe is now reported as exactly that, instead of as a failure.** Every REST submit waits for `broadcast_tx_commit`, and that wait can expire before the block lands — on a loaded cluster the transaction then commits seconds later, while the caller has already been told `500 Broadcast error`, indistinguishable from a genuine internal fault. That was worse than unhelpful: a caller retrying "on error" re-signs, so one write can be applied twice. The endpoint now answers `202` with `"status":"indeterminate"`, the exact `tx_hash` of the bytes that went on the wire, the allocated `nonce`, and `"retryable":false`, while the node's signer nonce fence keeps reconciling the real fate.
**Definitive outcomes keep their verdicts.** A CheckTx or FinalizeBlock rejection still returns the status it always did, and a full mempool still returns `429` with `Retry-After` — nothing was admitted, so there is nothing in flight to chase.
**Generated testnets stop inheriting the wait that causes it.** `deploy/init-testnet.sh` now writes `timeout_broadcast_tx_commit` explicitly (45s) rather than leaving CometBFT's 10s default, and keeps it strictly below SAGE's own client-side wait (`SAGE_TX_COMMIT_TIMEOUT_MS`, 60s) so the node — which knows whether it admitted the bytes and can name the transaction hash — is always the party that answers.
No consensus change or chain migration; app-v27 remains the ceiling.
Container: `ghcr.io/l33tdawg/sage:11.20.2`. SDK 11.20.2.
## What's New in v11.20.1
**Federated replies are deliverable for a week, not a day.** The window a reply stays admissible, and the deadline its retained outbox event is retried until, move from 24 hours to seven days (`federation.PipeEventResultLifetime`). A destination re-derives that window from the signed proof, still admits the legacy 24-hour window, and a destination that predates the longer one is answered by one downgraded retry at the old window instead of a terminal failure — so replies keep flowing while peers upgrade at their own pace. Receipt evidence about a message keeps its own separate 24-hour grace.
**Replies can no longer be permanently lost to a local retention re-stamp.** The startup migration that extends durable canonical sends matched every pending `msg-%` outbox row, including the receiver-local `msg-fed-…` id of an imported message — whose outbox row is a reply. It re-stamped those replies to a +100-year lifetime, which the destination refuses as an invalid proof, and because the same column is the retry deadline it also removed the give-up path, so the reply retried until it happened to reach the peer and collect the permanent 400. The rescue is now scoped to sends, stamps the exact durable sentinel (`+36500 days`, not SQLite's calendar `+100 years`), repairs rows an earlier build already extended, and reply envelopes are built from the signed proof so local retention state can never reach the wire.
**A refused proof now says why.** The destination logged nothing when it refused a proof, and the sender only recorded the destination's single opaque `invalid pipeline agent proof` refusal, which is how ten historical reply failures stayed unattributable. The destination now logs the exact reason and the sender checks its own reply envelope against that same rule before pushing.
No consensus change or chain migration; app-v27 remains the ceiling.
Container: `ghcr.io/l33tdawg/sage:11.20.1`. SDK 11.20.1.
## What's New in v11.20.0
**An agent's working state can now be stored encrypted on the node.** Two new surfaces are reachable only from inside the app-v23 pipeline agent boundary, and both refuse to run without the Synaptic Ledger vault: `PUT`/`GET /v1/private-media/{uuid}` stores immutable JPEG originals with ciphertext-only rows, per-caller actor isolation, quota enforcement and a startup disk-floor probe, and `PUT`/`GET /v1/workflows[/{uuid}]` gives an agent an encrypted, actor-bound journal for long-running work with compare-and-swap revisions, strict argument bounds and an opt-out conversation guard. Neither surface can be reached for another agent's rows, and neither writes a plaintext copy to the database or its WAL.
**You can now prove whether message storage is encrypted.** `GET /v1/messages/storage` reports the honest storage posture of this node, and `POST /v1/messages` accepts a strict signed `require_encrypted_storage` boolean: an agent that must not be stored in the clear now gets a `503` instead of a silent downgrade, and a malformed or unsigned value is rejected rather than ignored. The authenticated request-body limit became route-aware for exactly one route: a canonical-UUID private-media `PUT` gets one extra MiB, everything else keeps the 1 MiB ceiling.
**Local durability is no longer taken on faith.** SQLite opens with `synchronous=FULL` in both DSN and `PRAGMA` form and the node verifies `journal_mode` and `synchronous` at boot, refusing to serve when the durability posture is not provable. Vault publication is atomic in the same vein: attaching a vault and marking encryption required can no longer be observed separately, so an unlock cannot leave a window where a write is accepted against a store that does not yet require encryption.
**Lantern bring-up support.** `sage-gui init-lantern-private` creates a fresh-only hardware identity — it refuses an existing or mismatched node rather than reusing it, takes its companion-key bootstrap explicitly, and never installs services or enables public enrollment. A `SAGE_LANTERN_PRIVATE_LISTENERS` node treats a missing config as an error instead of a default, and the policy is re-checked when the YAML is loaded so an edit cannot silently weaken it.
**A public-memory Merkle index ships dormant, and no fork is opened.** The sparse SHA-256 index over committed `PUBLIC=0` records, its migration builder and its stage/promote path are in the tree with their tests, and no production code calls any of them. Staged rows live under a local namespace that is excluded from the AppHash; promotion is what writes into AppHash-covered state, it is explicitly named for app-v28, and it is not reachable from a running node. Read that as preparation, not as activation.
**Federation: you decide which of your agents the other side can find.** A trusted link advertised every eligible ordinary agent to the peer, which is convenient with one agent and confusing with a dozen — the other operator sees names they do not recognise and sends work to the wrong one. Each connection now carries an explicit discovery policy: **All agents** (the default), **Only the ones I pick**, or **None**. Ticking one agent narrows the connection to exactly that agent, ticking more adds them, and **Save discovery policy** commits it under the same revision-bound agreement the rest of federation uses. It governs listing and exact-name search only: it grants no memory Read and authorises no delivery, and an agent that still refuses federated delivery stays visible as **Not accepting** by design so the peer is never promised a route it cannot use.
No consensus change or chain migration; app-v27 remains the ceiling.
Container: `ghcr.io/l33tdawg/sage:11.20.0`. SDK 11.20.0.
## What's New in v11.19.22
**The Go build floor moves to patched 1.26.8.** Both modules now declare `go 1.26.8`, up from `1.25.13`, and every Go container builder moved with them: `Dockerfile`, `deploy/Dockerfile.abci`, `deploy/Dockerfile.node`, both federation-acceptance Dockerfiles and `deploy/init-testnet.sh`. Building from source now requires Go 1.26.8 or later.
This is not a fix for a hole you have. v11.19.21 and everything before it were built with Go 1.25.13, and that toolchain scans clean on its own standard library. It is a deliberate move forward: the dependency group below requires Go 1.26, and the bare `1.26.0` those tools would otherwise have pinned is precisely the version `govulncheck` reports 26 reachable standard-library advisories against — among them `net/url` (GO-2026-6218), `html/template` (GO-2026-6091), `crypto/tls` (GO-2026-6090, GO-2026-5856), `net/http` (GO-2026-6089, GO-2026-5026), `encoding/xml` (GO-2026-6088), `encoding/asn1` (GO-2026-5972), `net/textproto` (GO-2026-5039) and `crypto/x509` (GO-2026-5037). 1.26.6 is the minimum fix for those; 1.26.8 is the newest patch of the line, and on it the vulnerability gate reports no reachable vulnerabilities in either module.
**Dependencies refreshed.** `github.com/jackc/pgx/v5` v5.11.0, `github.com/klauspost/compress` v1.20.0, `golang.org/x/crypto` v0.57.0, `golang.org/x/sync` v0.23.0, `golang.org/x/sys` v0.48.0, `golang.org/x/tools` v0.50.0 and `modernc.org/sqlite` v1.58.0, plus the `x/net`, `x/mod`, `x/text` and `x/telemetry` indirects. The SQLite driver moves to SQLite 3.53.4, which carries upstream's own journal-rollback fix — the reason the local super-journal patch existed — so that patch retires with no change to recovery behaviour. The pgx bump adds `TypeMap` to the `pgx.Rows` interface, so the store tests move from `pgxmock/v4` to `pgxmock/v5`; that is a test-only import change with no runtime effect.
Also in this release: `golang.org/x/crypto` still carries GO-2026-5932 at v0.57.0, its newest release. It is in the module graph and is not reachable from SAGE code; the gate reports it as uncalled rather than failing.
No consensus change or chain migration; app-v27 remains the ceiling.
Container: `ghcr.io/l33tdawg/sage:11.19.22`. SDK 11.19.22.
## What's New in v11.19.21
**A co-commit can no longer re-commit bytes the quorum already rejected.** A co-commit commits on block inclusion and never runs the voter, so the content-hash dedup that keeps a rejected memory's exact bytes out was skipped on that one write path: a jointly-signed envelope could re-admit content that had been deprecated, under a fresh memory id, while the same bytes submitted through `POST /v1/memory/submit` were refused as a duplicate. `POST /v1/cocommit/submit` now consults the same lookup before it broadcasts and refuses a tombstoned hash with `409 Tombstoned content`; the envelope's own `SharedID` is excluded so an idempotent re-send still works. It is a submission-boundary check rather than a consensus rule — the consensus path deliberately reads no off-chain state — so a node that broadcasts a co-commit transaction directly, bypassing its own REST surface, is not covered by it.
**The MCP client stopped keeping its own duplicate rule.** `sage_remember`, `sage_observe` and `sage_reflect` used to drop a write when more than 60% of its significant words appeared inside one of the first 50 committed memories in the domain — silently, order-dependently, and only on MCP, so the same write over REST or the SDK landed. They now report the node's own verdict: `POST /v1/memory/pre-validate` runs the same dedup, quality and consistency checks the vote applies, an exact duplicate comes back as `status: "skipped"` carrying the node's reason, and a memory that merely shares vocabulary with an existing one is stored instead of discarded.
Also in this release: the `validated` status is documented as declared-but-unwritten (nothing has ever produced it, and recall would hide such a row), an unused `ValidateMemoryRecord` that duplicated the REST validator is gone, and the reference docs state plainly that knowledge triples and `access_logs` are write-only.
No consensus change or chain migration; app-v27 remains the ceiling.
Container: `ghcr.io/l33tdawg/sage:11.19.21`. SDK 11.19.21.
## What's New in v11.19.20
**Dedup rejection is sticky.** Content that was rejected, challenged, or forgotten can no longer be re-admitted by submitting the identical bytes again: the voter's dedup lookup now matches any *other* memory that has left `proposed`, not just committed ones, while a candidate can never match its own row (the v10.1 self-match fix stays fixed). Two identical submissions racing each other no longer veto each other, and a correction still passes whenever its content actually changed.
The dedup lookup — evaluated once per pending memory on the voter's two-second poll — is now indexed on both stores. SQLite gains a `content_hash` index; Postgres drops its legacy committed-only partial index at startup and rebuilds once, which can make the first boot after upgrade slower on a large `memories` table.
Also in this release: the README, the `sage-memory` skill, and the reference docs qualify the BFT/consensus claims for single-validator personal installs, and the papers section now cites the true published provenance.
No consensus change or chain migration; app-v27 remains the ceiling.
Container: `ghcr.io/l33tdawg/sage:11.19.20`. SDK 11.19.20.
## What's New in v11.19.19
**Security dependency update:** upgrades gRPC-Go from v1.83.1 to v1.83.2, addressing [CVE-2026-84445 / GHSA-2v4p-qf9q-27wj](https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj). The upstream fix rejects HTTP/2 requests missing both `:authority` and `Host` headers, preventing a panic in xDS servers. SAGE's CometBFT servers use ordinary gRPC servers, but the dependency is patched for defense in depth.
No consensus or storage migration; app-v27 remains the ceiling.
Container: `ghcr.io/l33tdawg/sage:11.19.19`. SDK 11.19.19.
## What's New in v11.19.18
Federation agents now visibly orbit their nodes. Motion continues over empty map space and resumes after pointer selection; hovering an agent, keyboard inspection, and dragging keep targets steady. Pause motion and reduced-motion preferences remain supported.
Container: `ghcr.io/l33tdawg/sage:11.19.18`. SDK 11.19.18.
## What's New in v11.19.17
**See your federation.** CEREBRUM opens connected nodes as an interactive
connectome with agent clusters, search, zoom, a List view, and a selection panel
for exact addresses and connection controls. Gentle ambient agent drift includes
a pause toggle, stops during interaction, and respects reduced-motion settings.
Actual node names make the viewed
node clear, including when you open another SAGE through a tunnel.
A dedicated operator-only SSE stream shows recent message and reply transport
status without exposing message text or proofs. Live changes animate when their
endpoints are loaded; reconnecting refreshes history without replaying old
traffic. The view is bounded, with explicit agent and node paging.
Federation onboarding now explains **Exchange codes → Verify together → Explore
agents**. Both confirmation screens preserve the explicit number check and
explain that memory sharing is optional. Read, Copy, and Clear domain permissions accept
bulk selection or drag-and-drop into a draft, with an explicit save. Removing
trust keeps its separate confirmation and pairing-again explanation.
No consensus-rule or application-version change; app-v27 remains the ceiling.
Existing permissions and trust agreements stay in place.
Container: `ghcr.io/l33tdawg/sage:11.19.17`. SDK 11.19.17.
## What's New in v11.19.16
**Connect nodes, find agents, send messages.** Trusted peers running v11.19.16
make eligible ordinary agents discoverable and messageable automatically, without
exporting each agent or granting access to memory domains. Root identities stay
excluded, and explicit messaging blocks still apply.
CEREBRUM adds a searchable directory grouped by node, exact-address copying, and
paged agent lists. Bulk selection and drag-and-drop prepare Read/Copy sharing
choices; saving those choices explicitly grants memory access. Pairing alone
shares no memory domains, and existing approved grants remain in place.
MCP `sage_directory` searches local and federated agents by default. Upgrade both
peers for automatic node messaging; older peers retain their export-based behavior.
New sends refresh legacy recipient tickets, while queued messages retain their
original authorization mode.
Federated replies now accept the signed claimant-session field emitted by MCP,
fixing peer rejection of otherwise valid replies. Reply retries report the actual
retained delivery state and diagnostic instead of always claiming "queued".
Existing failed events remain failed; the upgrade does not silently resend them.
No consensus-rule or application-version change; app-v27 remains the ceiling.
Container: `ghcr.io/l33tdawg/sage:11.19.16`. SDK 11.19.16.
## What's New in v11.19.15
**Consensus-safe memory cleanup, without the 500-record cap.** CEREBRUM now
scans the full inventory, previews verified eligible counts, and processes
manual or automatic cleanup through existing consensus challenge transactions.
Open tasks and internal records are protected. The UI distinguishes queued work,
confirmed submissions, and observed outcomes instead of reporting premature success.
Automatic cleanup requires **fresh current-Root authorization after upgrading**;
old enabled toggles do not silently activate it. Preview does not enable cleanup.
Exact signed transactions are saved before submission for safe recovery. A
challenge may need further votes; audit history is retained. See the
[cleanup guide](docs/reference/concepts/memory-cleanup.md).
No consensus-rule or application-version change; app-v27 remains the ceiling.
Container: `ghcr.io/l33tdawg/sage:11.19.15`. SDK 11.19.15.
## What's New in v11.19.14
**Security dependency update:** gRPC-Go is upgraded to v1.83.1 to address
HTTP/2 DATA-frame fragmentation heap exhaustion (CVE-2026-84304, Dependabot
alert #45). The required genproto and OpenTelemetry dependencies are refreshed
alongside it. CodeQL workflow actions are pinned to the verified v4.37.9 commit.
This patch introduces no consensus-rule, AppHash-input, key-encoding, fork-target,
or application-version changes. App-v27 remains the supported ceiling.
Container: `ghcr.io/l33tdawg/sage:11.19.14`. SDK 11.19.14.
## What's New in v11.19.13
**The stdio MCP bridge no longer self-installs project hooks into the user’s
home directory.** When `sage-gui mcp` starts with `$HOME` as its working
directory, automatic project repair now returns without writing `.claude`
hooks or project-relative hook registrations into user-global configuration.
Explicit `sage-gui mcp install` and `sage-gui codex install` commands keep their
existing home-directory refusal. Normal project-directory self-healing also
remains unchanged, including when `CLAUDE_CONFIG_DIR` points elsewhere.
This patch changes no consensus rule, AppHash input, key encoding, fork target,
or application version. Existing app-v27 chains replay byte-identically.
Container: `ghcr.io/l33tdawg/sage:11.19.13`. SDK 11.19.13.
## Release History
The latest release notes are above. Earlier entries below describe behavior at
their release dates; use the current reference for present-day contracts.
<details>
<summary>Earlier releases — preserved changelog</summary>
## What's New in v11.19.12
**Project-scoped MCP and Codex installs can no longer corrupt user-global host
configuration.** `sage-gui mcp install` and `sage-gui codex install` now refuse
to run when the working directory resolves to the user's home directory. Run
the command from the intended project instead; ordinary project installs are
unchanged.
The native-shell build also refreshes its fail-closed checksum for the official
September `linuxdeploy-plugin-appimage` rebuild. The replacement was produced
by the upstream project's successful scheduled workflow from its unchanged
source commit, and its downloaded SHA-256 matches GitHub's release-asset
digest. An unexpected future replacement will continue to stop the build.
This patch changes no consensus rule, AppHash input, key encoding, fork target,
or application version. Existing app-v27 chains replay byte-identically.
Container: `ghcr.io/l33tdawg/sage:11.19.12`. SDK 11.19.12.
## What's New in v11.19.11
**CEREBRUM now supports operator-configured hostnames behind a local TLS
reverse proxy.** Set `SAGE_ALLOWED_CEREBRUM_HOSTS` to an exact comma-separated
hostname allowlist when Caddy, Traefik, or another loopback proxy preserves the
browser-facing `Host` instead of rewriting it to `localhost`. Ports are
normalized and wildcards are deliberately unsupported.
The trust boundary stays local: the connected peer and every forwarded IP hop
must still be loopback, unconfigured hostnames still fail closed, and browser
origin matching accepts `X-Forwarded-Proto` only when every field-line and
comma-joined token is a valid, case-insensitive `http` or `https` value and all
hops agree. Empty, malformed, or mixed scheme chains are rejected.
This patch changes no consensus rule, AppHash input, key encoding, fork target,
or application version. Existing app-v27 chains replay byte-identically.
Container: `ghcr.io/l33tdawg/sage:11.19.11`. SDK 11.19.11.
## What's New in v11.19.10
**Returning agents can be reviewed normally again.** When app-v26 retirement
has handed an agent's former home domain to the stable Root principal,
CEREBRUM reapproval now binds the existing owner and uses the established
Root-to-agent recovery transfer for that exact recorded home. Fresh or
operator-entered domains never receive an implicit transfer.
Rejecting a pending registration now counts active memories—the same lifecycle
view shown by the recovery panel—instead of treating deprecated audit history
as work the operator can still remediate. Active records continue to block
ordinary rejection unless they are deprecated, transferred, or the explicit
attribution-preserving force path is chosen.
This patch changes no consensus rule, AppHash input, key encoding, fork target,
or application version. Existing app-v27 chains replay byte-identically.
Container: `ghcr.io/l33tdawg/sage:11.19.10`. SDK 11.19.10.
## What's New in v11.19.9
**Codex workspace identity resolution now fails closed at the filesystem
root.** A user-level Codex MCP process launched from `/` can no longer reuse the
retired `global-codex` signer or auto-register the synthetic name `codex//`.
SAGE rejects that broad, untrustworthy boundary before Git discovery,
project-config lookup, key loading, or key generation. Real project and linked
worktree roots continue to resolve to their stable workspace identities;
operators who intentionally need a non-workspace shared identity must pin it
explicitly with `SAGE_IDENTITY_PATH`.
This patch changes no transaction, AppHash input, key encoding, fork target, or
application version. Existing app-v27 chains replay byte-identically.
Container: `ghcr.io/l33tdawg/sage:11.19.9`. SDK 11.19.9.
## What's New in v11.19.8
**Access Groups now discover transferred historical domains, not only each
member's enrollment-time home domain.** CEREBRUM's bounded caller-domain
projection consults the consensus-maintained current-owner index for the caller
and active local group peers. A transferred `user-*` domain therefore appears
as a usable exact recall or write target even when its current owner never
authored a memory there.
Every discovered candidate is still re-authorized against current ownership,
group authority, profile restrictions, and hard denies before it is returned.
Per-record classification checks remain on the memory disclosure path. The
result remains bounded and explicitly reports truncation; it does
not expose a global domain roster, change ownership, copy grants, or weaken
shared-domain and foreign-write restrictions.
This patch changes no transaction, AppHash input, key encoding, fork target, or
application version. Existing app-v27 chains replay byte-identically.
Container: `ghcr.io/l33tdawg/sage:11.19.8`. SDK 11.19.8.
## What's New in v11.19.5
**Claim recovery and host wake coordination now survive real multi-transport
runtimes.** Both exact-local compatibility claim paths—`GET /v1/pipe/inbox`
and explicit `PUT /v1/pipe/{pipe_id}/claim`—atomically bind the session and
create its receipt, so ownership cannot commit without recovery evidence. MCP
claimant identities are durable and transport-scoped across stdio,
Streamable HTTP, and SSE; `claimant_identity_mode` discloses whether the
identity is durable, a safe concurrent ephemeral fallback, inherited, or
unavailable.
Claim transfer remains deliberate. `sage_message_handoff` requires the exact
`claimant_session_id` and `claim_revision` returned by passive history; stale
or A→B→A delayed transfers fail the revisioned compare-and-swap fence. The
direct REST route preserves pre-v11.19.5 clients by treating an omitted
`from_revision` as 0 only, so it can move an untouched first-generation claim
but safely conflicts after any transfer. SAGE never steals a claim merely
because it is old.
The new signed, payload-free `GET /v1/inbox/activity-state` returns exactly
`{version,epoch,seq}` so host hooks can notice fresh task assignments and
replies. The opaque 32-character database-incarnation `epoch` survives process
restarts and backup restore, but changes for a fresh database so an old host
cursor cannot suppress new cues after reinitialization.
Those events remain nonblocking coordination: they do not change the exact
three-field `{version,seq,pending}` contract of `/v1/messages/wake` or
`/v1/messages/wake-state`, and they never make Stop treat a reply as unfinished
work. Hooks can surface activity on the next prompt, but cannot resurrect an
already-idle host task.
This patch changes no consensus rule, AppHash input, transaction type, key
encoding, fork target, or application version. The supported consensus ceiling
remains app-v27.
Container: `ghcr.io/l33tdawg/sage:11.19.5`. SDK 11.19.5.
## What's New in v11.19.4
**Updater governance compatibility and recovery state are now one atomic
proof.** The replacement binary reports its own maximum supported application
version. SAGE validates canonical pending-plan and active-ballot state against
that exact ceiling while holding the same runtime read fence that pins the
snapshot height and AppHash. Consensus cannot publish newer governance state
between the compatibility decision and the verified recovery snapshot.
v11.19.3 acquired those two read fences separately. Its snapshot was coherent,
but a concurrent Commit could make the preceding compatibility verdict stale.
Personal single-node installs still upgrade normally in the app: v11.19.3 and
v11.19.4 have the same app-v27 ceiling, the personal-node watchdog cannot create
an unsupported app-v28 transition, and the updater performs the recovery
snapshot, coordinated stop, final stopped-state snapshot, install, rollback,
and restart automatically. No CLI or manual preflight is required. The
stopped-node procedure in [`docs/UPGRADING.md`](docs/UPGRADING.md) is only for
quorum or externally managed nodes where an operator can mutate governance
during the v11.19.3 check-to-fence window.
This patch changes no consensus rule, AppHash input, transaction type, key
encoding, fork target, or application version. Existing app-v27 chains replay
byte-identically.
Container: `ghcr.io/l33tdawg/sage:11.19.4`. SDK 11.19.4.
## What's New in v11.19.3
**Normal upgrades now preserve compatible governance state automatically.**
The desktop updater reads the canonical pending plan and active proposal under
one runtime-consistent view before changing the executable. A supported
in-flight upgrade is included in the existing verified recovery snapshot and
continues after restart; it is not a reason to interrupt the user or block the
update. No terminal command, preflight ceremony, or governance expertise is
required.
Malformed canonical state, an undecodable upgrade ballot, or a target newer
than this binary supports still fails closed before executable mutation. The
technical `upgrade status` and stopped-node `upgrade preflight` commands remain
available for headless and quorum operators. **Superseded safety notice:** the
v11.19.3 live updater did not hold one uninterrupted fence across that check and
snapshot capture. That does not impose a CLI step on a personal node; only
quorum or externally managed governance needs the coordinated stopped-node
procedure when leaving v11.19.3.
This patch changes no consensus rule, AppHash input, transaction type, key
encoding, fork target, or application version. Existing app-v27 chains replay
byte-identically.
Container: `ghcr.io/l33tdawg/sage:11.19.3`. SDK 11.19.3.
## What's New in v11.19.2
**Binary replacement now has consensus-authoritative upgrade-governance
proof.** The read-only `/upgrade/governance-status` ABCI query reports the
current application version, the exact pending `upgrade:plan` record, and the
canonical `state:gov:active` proposal. Upgrade ballots include their decoded
target application version. Storage, pointer/proposal identity, bounds,
canonical-name, status, height, and payload-decode failures return ABCI code 1
instead of being misreported as an empty plan or ballot.
`sage-gui upgrade status` now consumes that fail-closed query rather than
inferring safety from `/abci_info` plus the off-chain dashboard projection. The
stopped-node `sage-gui upgrade preflight` command uses the same canonical
inspector before the new server starts. v11.19.3 integrates that compatibility
decision into the normal updater and lets supported in-flight operations
continue automatically.
This patch changes no consensus rule, AppHash input, transaction type, key
encoding, fork target, or application version. Existing app-v27 chains replay
byte-identically.
Container: `ghcr.io/l33tdawg/sage:11.19.2`. SDK 11.19.2.
## What's New in v11.19.1
**Stranded message claims remain recoverable beyond the retained-history
window.** `sage_inbox` now embeds the first passive, payload-free page of
unfinished claims held by another runtime sharing the same exact agent identity.
Agents can continue through every older page with
`sage_message_history(folder="claimed_elsewhere")`, then deliberately transfer
an exact claim through the existing compare-and-swap `sage_message_handoff`
path after deciding that its former claimant is dead or stale.
The recovery projection exposes only the message ID, claimant-session fence,
timestamps, and local/federated classification needed for safe handoff. It does
not expose sender identity, intent, payload, result, provider, or chain IDs.
Expired TTL-bounded claims are also excluded consistently from both the exact
diagnostic count and its recovery pages before the periodic expiry sweep runs.
Provider-addressed compatibility messages now bind atomically to the exact
claiming agent and MCP session, resurface on later polls, support CAS handoff,
and complete idempotently through `sage_message_reply`. A failed reply explicitly
does not authorize creating a substitute `sage_message_send`; agents must recover
the original claim or report the failure. Existing claimed provider rows receive
an off-chain SQLite `legacy` session fence during startup migration.
This patch introduces no consensus change or application-version increase. The
supported consensus ceiling remains app-v27.
Container: `ghcr.io/l33tdawg/sage:11.19.1`. SDK 11.19.1.
## What's New in v11.19.0
**Record authors regain lifecycle authority in reserved shared namespaces.**
After app-v27 activates, the immutable author of a record in `general`, `self`,
`meta`, or `sage-*` may challenge that record and may reinstate its open
challenge without separately holding a level-3 Modify grant. The exception is
record-scoped and does not apply to governance-promoted shared domains. Pending
or inactive enrollment, read-only/profile restrictions, shared-write denies,
and classification/clearance failures still deny the action. App-v21 weighted
challenge rounds include the eligible record author in their frozen electorate.
**Omitted task status now has one canonical meaning.** After app-v27, a signed
new-task request that omits `task_status` is canonicalized to `planned` by both
REST transaction construction and consensus proof verification. Pre-app-v27
chains retain the historical requirement to send `task_status: "planned"`
explicitly, preserving replay and AppHash compatibility.
App-v27 is a governed consensus upgrade from app-v26 with no state migration.
Its rules begin at H+1 after activation; older blocks replay under their original
application version.
Container: `ghcr.io/l33tdawg/sage:11.19.0`. SDK 11.19.0.
## What's New in v11.18.28
**Reserved shared domains are readable again without becoming ownable.** Active
local principals can read the compile-time shared namespaces `general`, `self`,
`meta`, and `sage-*`, while each record's classification still applies. This
restores the shared-domain behavior expected by existing agents without opening
private or restricted records.
Access-grant transactions now reject attempts to register either those reserved
namespaces or governance-promoted shared domains as owned domains. REST reports
that conflict as a forbidden request, and the API, SDK, and RBAC references now
state the same contract.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.28 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.28`. SDK 11.18.28.
## What's New in v11.18.27
**Empty semantic recall now distinguishes genuine absence from an incomplete
vector-space view.** For an empty, domain-scoped semantic query, `index_status`
reports `complete`, `incomplete`, or fail-closed `unavailable` only when the
caller and exact query universe support that conclusion. The same signal is
relayed through `sage_recall` and `sage_turn`, so write-on-absence agents can
avoid manufacturing duplicates when committed memories are temporarily
unreachable in the active embedding space.
The proof is caller-safe and race-fenced across canonical projection, SQL,
embedding-space, and vault generations. Narrowed or federated queries and
unhealthy projections never receive a false completeness claim, while bounded
indexed probes keep the empty-result path operationally safe.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.27 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.27`. SDK 11.18.27.
## What's New in v11.18.26
**The supported Go dependency baseline is refreshed.** This release carries
the validated `testify` 1.12.0, `x/crypto` 0.55.0, and `x/tools` 0.49.0 module
updates already exercised by the full repository gate.
**Code scanning and native-shell CI actions are refreshed to their pinned
current revisions.** CodeQL runs with the updated action bundle and the native
shell cache action is updated, without changing SAGE runtime behavior.
**HTTP MCP tokens now bind to existing approved managed identities.** On
app-v23 nodes, token creation no longer generates an unapprovable pending
principal: Root/Admin selects an active ordinary agent already managed by the
node, and issuance fails closed if its exact key is unavailable. The CLI also
handles `mcp-token create --help` without minting a credential and rejects
unknown creation flags.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.26 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.26`. SDK 11.18.26.
## What's New in v11.18.24
**Federated inbox work now has recoverable, session-fenced ownership.** SAGE
binds an inbound federated claim to the receiving MCP session before exposing
its payload. Retained older claims receive an explicit `legacy` CAS fence for
deliberate handoff; live work is never stolen by a timeout. Reply completion,
the claimant check, encrypted result fingerprint, and durable return event now
commit atomically, so a lost-response retry returns the original event while a
different second reply conflicts.
**MCP boot guidance no longer rides inside ordinary tool results.** Lifecycle
standing stays in `initialize.instructions`, including for a client that
initializes after its first tool call. The former imperative block that asked an
agent to invoke tools and edit a memory file has been removed, keeping the inbox
trust boundary internally consistent.
**Embedding-space and retention diagnostics are more precise.** The readiness
guard labels only a qualified-versus-bare spelling of the same provider/model
leaf/dimension as a likely alias, without collapsing two organizations that
publish the same basename. Durable-until-handled presentation is limited to
actionable pending/claimed work, while mixed-version retention-only responses
remain compatible.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.24 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.24`. SDK 11.18.24.
## What's New in v11.18.23
**Turn-time recall now carries the same trust and lifecycle evidence as explicit
recall.** `sage_turn` includes each recalled memory's `corroboration_count` and
`status`, so the every-turn path no longer hides corroboration weight or whether
a recalled row is committed or currently challenged.
**Embedding-space drift is visible before it silently empties semantic recall.**
At boot, SAGE compares the active embedder with the non-deprecated vector spaces
already in the local store. A mismatch produces a loud warning and a structured
`embedding_space` block in `/ready`; the node remains available by default while
strict readiness returns 503, allowing an intentional re-embed migration to
finish instead of turning a quality warning into an outage.
**Managed reranker setup now diagnoses incompatible prebuilt engines.** After a
verified install, SAGE preflights `llama-server`. Proven GLIBC, GLIBCXX, or CXXABI
loader failures preserve the loader's real error and point operators to the
bring-your-own reranker path instead of reporting a successful unusable install.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.23 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.23`. SDK 11.18.23.
## What's New in v11.18.22
**A missing optional ForceGraph API can no longer strand CEREBRUM after the
verified brain has rendered.** The renderer now publishes the core graph and
truthful counts before optional anatomical, control, and interaction setup. The
bundled runtime's absent `clickAfterDrag` helper is feature-gated, so the brain
hull, controls, and auto-rotation continue instead of falling into the cold
unavailable path with real nodes already on screen.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.22 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.22`. SDK 11.18.22.
## What's New in v11.18.21
**A domain-summary refresh can no longer cover a verified MRI graph.** The MRI
renderer is now the sole authority for the central unavailable overlay. Domain
inventory failures stay localized to their own retrying panel, while genuine
cold graph failures and unsafe mode switches remain fail-closed.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.21 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.21`. SDK 11.18.21.
## What's New in v11.18.20
**A transient MRI refresh no longer hides a graph CEREBRUM has already
verified.** Memory and Connectome snapshots now retain their explicit source
mode. If a live refresh fails, CEREBRUM keeps the last verified snapshot visible
only when it belongs to that same mode, while retrying in the background. Cold
failures and failed mode switches still fail closed, so Connectome bytes can
never masquerade as a verified memory projection.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.20 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.20`. SDK 11.18.20.
## What's New in v11.18.19
**Codex project hooks stay inside their project.** The v11.18.18 byte-exact
self-healer could mistake Codex's user-global `~/.codex` configuration directory
for a project and generate a global `hooks.json`. That made an unrelated Codex
task receive SAGE inbox Stop nudges for the shared agent identity. The healer now
refuses the user-home/global scope; project-local hooks continue to self-repair.
**Connectome clicks now have one hit-tested owner.** The redundant DOM click
fallback that raced ForceGraph's deferred node click is gone. Small pointer
wobble is handled by one explicit tolerance, background dismissal uses the
graph's raycast result, and clicking a second neuron no longer closes the
inspector and starts a competing zoom-out first. Raw domain-access metadata is
summarized behind a bounded disclosure below traffic, relationships, and memory
details; bloomed memory nodes now expose hover and accessible click feedback.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.19 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.19`. SDK 11.18.19.
## What's New in v11.18.18
**Codex upgrades now repair stale SAGE lifecycle hooks automatically.** On
every MCP startup, the project self-healer compares all five installer-owned
Codex hook scripts with their fully rendered current templates. A mixed
generation can no longer pass merely because the files exist or another hook
mentions the current binary. Upgrading therefore replaces legacy no-op Stop
hooks and malformed prompt hooks without requiring a second manual
`sage-gui codex install` run.
**The CEREBRUM Connectome now leads with the graph itself.** Neurons have a
larger practical click target; clicking one opens its persistent identity,
visible incoming/outgoing traffic, strongest peer, directed connection list,
and visible memory lobe. The compact fallback selector now shows only agents
with visible peer relationships, ordered by retained traffic, instead of
turning a large dormant/test roster into the primary navigation surface.
Isolated authorized neurons remain visible and clickable in the brain and join
the selector while selected.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.18 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.18`. SDK 11.18.18.
## What's New in v11.18.17
**Routine MCP restarts no longer make the same stdio agent disown its own
unfinished messages.** The primary stdio runtime now persists one opaque
claimant identity per exact signed agent, provider, and project under
`SAGE_HOME`, and holds an OS advisory lock as the liveness fence. A later
runtime reuses that identity only after the earlier process is no longer live;
a genuinely concurrent runtime receives an independent identity and retains
the existing one-handler and compare-and-swap handoff boundary. In-place
installed-binary handoff also carries the current claimant identity while the
old process keeps the lock alive.
The fix is deliberately prospective and does not bulk-transfer historical
claims created by pre-v11.18.17 random process identities. Those rows remain
visible through `claimed_elsewhere_count` and passive history and can still be
transferred one at a time with the existing CAS-fenced handoff after the old
claimant is known dead. HTTP MCP conversations remain transport-scoped. This
patch introduces no new consensus application version or state migration. The
ceiling remains app-v26; **v11.18.17 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.17`. SDK 11.18.17.
## What's New in v11.18.16
**Claimed agent work no longer disappears from the inbox that claimed it.**
`sage_inbox` now returns a separate bounded `own_claimed_unfinished` projection
for messages already owned by the exact current agent session. The projection
is passive: it never claims, refreshes, transfers, or duplicates work, and it
does not change the established `items` or `count` meaning of newly available
work. Exact agent/session filtering, completion and expiry handling, bounded
results with an exact total, reply-after-repoll, and nonmutation are pinned by
store, REST, and MCP regression coverage.
The payload-free hook status path also checks the durable wake snapshot, so
claimed-but-unfinished work cannot be reported as a clean inbox merely because
no unclaimed row remains. Older or temporarily incapable nodes degrade to an
explicit `unavailable` state instead of either a false zero or a failed primary
inbox call. This patch does not automatically transfer claims from another
session; passive history plus explicit compare-and-swap handoff remain the
recovery boundary. It introduces no new consensus application version or state
migration. The ceiling remains app-v26; **v11.18.16 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.16`. SDK 11.18.16.
## What's New in v11.18.15
**Every unfinished exact-recipient local canonical message now has a durable
wake generation, including upgrade-era claimed-only work and sends through the
deprecated pipe route.** Startup backfill covers both pending and claimed rows, so a recipient
whose only live work was already claimed cannot reopen as the silent
`{seq:0,pending:true}` state. Keyed exact-local pipe sends use the canonical
idempotent admission path; unkeyed sends insert the row and advance the same
recipient sequence atomically. Publication happens only after commit, exact
replays do not republish, and an incapable backend fails before insertion rather
than creating durable work that wake consumers cannot observe as new.
The experimental Claude notification adapter is explicitly opt-in again. The
shipped Claude Code host registers the custom notification handler, but
end-to-end delivery from a plain `.mcp.json` server through its plugin-scoped
gate remains unverified. An idle adapter would also acquire the one exact-agent
wake lease and exclude a useful long-running consumer.
`SAGE_CLAUDE_CHANNEL=true` enables it for an operator who has confirmed that
delivery path.
Pending-memory presentation is deterministic even when creation timestamps tie:
SQLite and PostgreSQL both use `memory_id` as the final ordering key. The
documentation citation guard now parses newline-separated and hyphenated paths,
pins every concrete declaration/lead/interior anchor, repairs only explicitly
accepted declaration anchors, refuses semantic locations it cannot reconstruct,
and inventories the remaining legacy skipped and bare references. This patch
introduces no new consensus application version or state migration. The ceiling
remains app-v26; **v11.18.15 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.15`. SDK 11.18.15.
## What's New in v11.18.14
**Durable agent messages now stay visible until the work is actually
finished.** Claiming a message no longer makes the payload-free wake surface go
quiet: both pending and claimed rows remain unfinished, a reconnect at the
current cursor receives an immediate wake, and `sage_inbox` reports an exact
payload-free claimed-elsewhere state instead of a bounded-scan false zero.
Claude Code project sessions arm the signed wake channel by default, while the
optional Stop hook reads a lease-free monotonic snapshot so new or stranded
work can nudge a session once without stealing the live SSE consumer lease.
The same recovery path is honest at its edges. A claimant-session fence
rejection remains a typed conflict instead of masquerading as a missing
message, and history plus explicit compare-and-swap handoff remain the only
way to recover another session's claim. Canonical retention migration now
rescues only the exact historical 24-hour stamp, preserving a sender's chosen
bounded TTL across every store reopen, including RFC3339 nanosecond timestamps.
**CEREBRUM's Connectome now identifies the agents it renders.** Hover details
are positioned and escaped reliably, while click, tap, and keyboard selection
open one persistent inspector with exact agent identity, visible retained
traffic, peers, activity, and an independently loading visible-memory lobe.
Selection survives authorized live refreshes, error and empty states stay
truthful, mobile uses a bounded sheet, and reduced-motion and established
Connectome guidance remain intact.
Agent-as-lobe corroborator reads now use one deterministically ordered bounded
batch instead of an N+1 query pattern, with matching SQLite and PostgreSQL
ordering. The MCP contract also states the server-enforced 31-day
`sage_timeline` range rather than advertising requests the server rejects.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.14 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.14`. SDK 11.18.14.
## What's New in v11.18.13
**Hubanov's distributed-engram contribution now connects memories to the
neurons that corroborated them.** CEREBRUM keeps agent and memory identities in
separate graph namespaces, rejects stale bloom generations, and removes every
transient bridge on focus or graph replacement. The server uses a deterministic,
indexed 96-row evidence prefix and exposes at most 12 authorized bridges without
turning historical corroboration into a claim of current possession.
**Claude's production wake source can now arm the payload-free message bus.**
When explicitly enabled with `SAGE_CLAUDE_CHANNEL`, the MCP runtime consumes the
existing signed SSE wake route with a random process lease and resumable cursor.
Delivery applies backpressure instead of dropping the newest wake, and shutdown
releases saturated readers without leaking goroutines or claiming message
content.
**The Connectome no longer floats an instructional card over the brain.** Its
guidance lives in the existing reading panel, the mode toggle keeps one stable
name and visible pressed state in both themes, keyboard focus remains clear,
mobile Reset behavior stays intentional, and view changes are announced to
assistive technology.
This patch also closes a claimant-session compatibility bypass: a current typed
404 is authoritative, the deprecated pipe-result alias carries the active MCP
session, and only a genuine old-node route miss may fall back. It introduces no
new consensus application version or state migration. The ceiling remains
app-v26; **v11.18.13 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.13`. SDK 11.18.13.
## What's New in v11.18.12
**CEREBRUM can now open an agent as a memory lobe.** Selecting a connectome
neuron lazily blooms that agent's highest-confidence visible memories as
engrams, while retaining the operator-only route and app-v23 per-record
projection checks. The indexed, bounded query avoids whole-brain scans; stale,
failed, and disposed frontend requests cannot leave another agent's lobe on
screen.
**Dashboard live activity is now guarded as one exact 20-event registry.** The
seven previously unwired operator events now reach the existing dashboard SSE
stream, while message wake, MCP, and wizard protocols stay route-local. A
fail-closed typed control-flow audit and executable browser contract reject
dead, aliased, escaped, build-tagged, or decoy event sinks.
**Signed task creation and message attribution now agree end to end.** Every
official task constructor explicitly signs the required initial `planned`
status, and REST fails fast instead of mutating an omitted signed field into a
transaction that app-v23 through app-v26 must reject. Authorized message and
pipe responses retain exact immutable agent IDs alongside mutable presentation
labels, use one bounded batch metadata query on healthy production stores with
a bounded exact-ID fallback, suppress foreign-chain label collisions, and keep
count-only responses identity-free.
This patch also repairs release-facing documentation drift, pins the current
33-tool MCP inventory, and adds fail-closed symbol/citation coverage for the
references it can verify. It introduces no new consensus application version
or state migration. The ceiling remains app-v26; **v11.18.12 introduces no
app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.12`. SDK 11.18.12.
## What's New in v11.18.11
**The CEREBRUM connectome now fires live without widening its operator-only
boundary.** Successful local message sends emit a contentless invalidation tick;
the browser then refetches the existing caller-filtered snapshot and pulses only
newly observed synapses. Monotonic generations preserve later ticks across
in-flight requests, ordinary reloads, failures, and retries, while initial loads
and unrelated refreshes never create false activity.
**Dashboard retrieval activity no longer duplicates authorized memory plaintext
into the global operator stream.** Recall, search, and hybrid events now expose
only their event type and result count. The obsolete expandable plaintext panel
is gone, and serialized-frame regressions pin the contentless contract and live,
non-replayed delivery.
**Claude bookend sessions can discover waiting SAGE messages without claiming or
revealing them.** A signed, payload-free inbox-status hook reports only the
current identity and unread count, makes failures visible, preserves unrelated
user hooks during self-heal, and exposes the read-only message tools needed to
perform the explicit inbox fetch.
This patch also keys local connectome locality by chain identity, removes a stale
app-v7 validator warning after app-v14, dims the connectome skull for legibility,
requires patched Go 1.25.13 throughout current builders and CI, and publishes
checksum sidecars for Windows executables. It introduces no new consensus
application version or state migration. The ceiling remains app-v26;
**v11.18.11 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.11`. SDK 11.18.11.
## What's New in v11.18.10
**Multiple MCP runtimes sharing one agent identity can no longer silently lose
track of claimed messages.** Every MCP conversation now has an opaque claimant
session ID. Atomic inbox claims persist that session in passive history, an
explicit compare-and-swap handoff transfers work between runtimes, and a stale
former owner is rejected if it tries to reply after ownership moved. Receive
tokens remain replay-safe after a lost response, while legacy direct REST
clients retain their existing agent-level compatibility path.
**CEREBRUM can render the agent message bus as a live connectome inside the 3D
brain.** Registered agents become domain-coloured neurons, directed channels
become traffic-weighted synapses, and hub agents settle toward the core. The
view consumes the existing RBAC-filtered synapse projection, drops ghost edges,
and fences asynchronous mode switches so a slow memory response can never be
displayed as connectome data.
**Upgrade-watchdog submissions can no longer hold a signing key's nonce lease
for the process lifetime when CometBFT wedges.** One bounded context now covers
both lease acquisition and the broadcast. A deadline after submission remains
a typed indeterminate outcome, so the exact signer and bytes stay fenced until
their fate is reconciled; elapsed time never releases the key fail-open.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.10 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.10`. SDK 11.18.10.
## What's New in v11.18.9
**Ambiguous CometBFT commit and sync outcomes are now typed at the shared
broadcaster boundary.** Transport, status, RPC, decode, shape, hash-binding, and
missing-height failures return `ErrSubmitIndeterminate` for valid signing keys,
while the existing live-registration path remains an independent fence
backstop. Pre-send request-construction failures remain definitive and do not
fence a key over bytes that never reached a transport.
**Federation sync now fails closed if its commit broadcaster ever violates its
contract by returning neither a result nor an error.** The exact signer and
encoded transaction remain fenced until reconciliation proves their fate,
instead of releasing the key for a potentially in-flight transaction. A new
cross-package decoder contract also pins the HTTP prologue shared by
`internal/tx` and the CEREBRUM web path while recording their deliberate verdict
and envelope-tolerance differences.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.9 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.9`. SDK 11.18.9.
## What's New in v11.18.8
**CometBFT transaction submissions no longer permit Go's HTTP transport to
transparently redeliver a fenced request after a reused connection fails while
reading the response.** Commit, sync, byte-identical nonce-fence reconciliation,
and CEREBRUM submission paths now share a non-reusing HTTP/1.1 transport seam.
Each submission call writes its transaction on one connection and returns an
indeterminate result instead of silently delivering the same signed bytes to a
second responder. Restart failure reporting also preserves the signer-fence
veto ahead of a generic drain timeout.
**MCP reply polling now fails safe when a caller presents an unsafe forward
watermark.** If `reply_since` is later than the authoritative retained-reply
head, or no head exists to validate it, `sage_inbox` returns the newest passive
reply page for deduplication instead of filtering a formal reply into a false
empty result. Complete recovered pages become a new safe baseline; truncated
pages require composite-cursor catch-up, and failed page reads never claim
recovery. A successful outbound `sage_message_send` also performs one bounded,
sender-exact passive inbox snapshot so an inbound message that arrived after an
earlier empty poll is surfaced during continued coordination.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.8 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.8`. SDK 11.18.8.
## What's New in v11.18.7
**Large signed transactions now use a bounded CometBFT transport instead of
overflowing request headers.** Existing smaller broadcasts keep the established
GET wire shape, while large commit, sync, and byte-identical nonce-fence
reconciliation requests use JSON-RPC POST with base64 transaction bytes. Client
transaction and JSON-RPC body limits are independently range-checked, capped at
8,000,000 bytes, and refuse an oversized request before send. Operators raising
them must configure matching CometBFT limits. Independently, every validator
enforces a 1,200,000-byte aggregate raw-transaction budget for app-v20 atomic
finalization, sufficient for the measured 1,304-entry SkillRegistry transaction.
Memory content remains bounded at 512 KiB, while the canonical signed
`AgentRequest` proof has its own 600,000-byte consensus bound, admitting the
measured 573,723-byte proof without widening the content or aggregate limits.
Response handling accepts strict quoted or numeric `int64` heights, rejects
fractional, exponent, null, malformed, and out-of-range heights, and refuses
unsupported content types.
**Federation route refresh no longer risks recursively acquiring the
sync-policy read lease from a peer-request caller.** Opportunistic refresh
admission is policy-free and bounded to one pending refresh per peer; the
agreement and binding lookup runs asynchronously after the request caller can
release its lease. Failed-request and successful-Direct triggers remain
covered, while the route-exchange endpoint does not self-trigger refresh.
**P2P-only peers can recover when their stored route snapshot is missing or
belongs to an older trust generation.** Only the authenticated
`/fed/v1/p2p/routes` bootstrap exchange may use stale or current route addresses
as connection hints; the current agreement's pinned mTLS identity remains
authoritative. Protected requests reject missing or cross-generation snapshots
with `trust_generation_mismatch`. A matching-generation empty target set remains
explicitly pinned and cannot fall back to current configuration.
**Federation diagnostics now give security evidence precedence over route
availability evidence.** Mixed route-availability plus certificate, SPKI, pin,
identity-mismatch, or security-block evidence is classified as
`security_blocked`; revocation, expired or unknown agreement, trust-failure, or
authentication evidence is classified as `trust_failure`. Both verdict classes
outrank route availability.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.7 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.7`. SDK 11.18.7.
## What's New in v11.18.6
**Updater snapshots now prove both supported CometBFT layouts before they are
published or reused.** Application Badger and persisted consensus state must
match at height `H` and agree on the application hash. A blockstore committed
through `H` is accepted only after its `H` block ID and seen commit match that
state. If the blockstore is durably one block ahead at `H+1`, SAGE additionally
verifies the complete block and part identity, direct-parent and state-derived
header fields, last and seen commits, validator signatures, and CometBFT's
replay-time block validation. Regression coverage restores the candidate and
runs the real CometBFT handshaker, proving exactly one replayed block and safe
restart reuse. Malformed or more-than-one-ahead provenance is rejected, and an
invalid prior publication is quarantined before a valid replacement can be
published. Cancellation always blocks executable updater handoff, although a
safe snapshot may already have been atomically published. Non-empty `H+1`
evidence is retryable until application and state catch up.
**Federation Retry now performs one bounded, exact-generation recovery
workflow.** Concurrent operator clicks share the same route refresh and
authenticated status probe. Direct and relay targets are frozen to the active
JOIN generation, HTTP `401`/`403` and certificate/identity failures stop before
re-probing, and a revoke or re-pair during the response invalidates the result.
Typed dashboard diagnostics distinguish missing or expired route bundles,
stale Direct routes, unavailable relays, trust-generation changes, and legacy
connections that must be paired again. Ordinary polling and mutating requests
do not enter this retry path.
**Memory-reassignment audit failures no longer place request-controlled agent
IDs in logs.** The source and target are represented by fixed 96-bit truncated
SHA-256 fingerprints (24 lowercase hexadecimal characters), preserving stable
incident correlation without allowing CR/LF or other control characters to
forge log records.
This patch does not change consensus state or application activation. The
ceiling remains app-v26; **v11.18.6 introduces no app-v27**. The signer fence
also remains process-local: unresolved submissions still require proof of fate,
and crash/restart or a separate signing process is not claimed safe until
durable cross-process pre-broadcast intent exists.
Container: `ghcr.io/l33tdawg/sage:11.18.6`. SDK 11.18.6.
## What's New in v11.18.5
**Long-lived stdio MCP sessions now follow an installed SAGE upgrade without
executing a request under stale tools.** The MCP process snapshots the exact
executable that started it. If the app bundle or binary is atomically replaced,
the next unread JSON-RPC frame is handed to the new executable together with
the remaining stdio stream. The upgraded runtime—not the stale process—receives
that request. The old runtime never executes the handed-off frame; transport
failure remains an ordinary indeterminate outcome for callers to reconcile.
Sessions initialized on 11.18.5 advertise MCP tool-list change support; the
replacement emits `notifications/tools/list_changed` only after the logical
session has completed initialization, so conforming clients refresh cached
definitions as well as runtime behavior.
**The unified coordination response identifies its live contract.** Every
`sage_inbox` result now carries `coordination_schema: "sage.inbox.v2"`, the
running `mcp_runtime_version`, and `sender_replies_embedded: true|false`. Monitors can
therefore reject or report a stale pointer-only session instead of silently
assuming that an empty addressed inbox also means no threaded reply arrived.
The existing bounded `reply_items`, inclusive watermark, composite catch-up
cursor, and passive sender-only authorization remain unchanged.
The upgrade from a pre-11.18.5 MCP process still requires one agent-session
restart because that already-running older process cannot contain this handoff
logic. Once a session starts on 11.18.5 or later, subsequent binary replacements
use the automatic request-preserving handoff. Clients that ignore the negotiated
tool-list notification must still re-list tools or reconnect to discover new
definitions.
The consensus ceiling remains app-v26; **v11.18.5 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.5`. SDK 11.18.5.
## What's New in v11.18.4
**One inbox poll now surfaces both new work and threaded answers.**
`sage_inbox` returns replies to messages you sent under the separate passive
`reply_items` key by default, while genuine inbound work remains under `items`.
Reply rows never inflate work counts and explicitly require no reply. Inclusive
`reply_since` polling prevents same-millisecond loss; truncated pages fail safe
with an exact composite-cursor catch-up action and forbid advancing the
watermark until the window is drained.
**Release builders now enforce the patched Go floor.** Root and `natter`
modules require Go 1.25.12, CI and release jobs resolve that exact `go.mod`
toolchain, every Go container builder uses 1.25.12, and pinned
`govulncheck v1.6.0` scans both modules before either CI fan-in or release
publication can pass.
**Legacy pipeline retention compares time chronologically and conservatively.**
SQLite purge eligibility no longer relies on variable-width RFC3339 text.
Cutoffs are floored to SQLite's millisecond precision, so ambiguous
same-millisecond rows are retained rather than deleted early; malformed read
evidence also retains fail safe.
The consensus ceiling remains app-v26; **v11.18.4 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.4`. SDK 11.18.4.
## What's New in v11.18.3
**Same-key consensus submissions now fail closed across every producer in the
running daemon.** The dashboard, REST API, federation manager, voter, and
upgrade watchdog share a per-key nonce lease. Once exact transaction bytes
reach CometBFT, any unproven transport, status, RPC, decode, shape, hash, or
height outcome fences that signing key until reconciliation proves those same
bytes committed or permanently refused. Strict shared Comet decoders require a
single bounded JSON document, explicit nested verdicts, the exact transaction
hash, and a positive committed height for success.
**Update restart advice now follows live fence state.** A completed download no
longer leaves stale restart guidance behind: retained update status reads
recompute whether restart is currently safe, and the dashboard renders
the server-provided instructions. Coordinated restarts are refused when a fence
is present. Crash, power-loss, cross-restart, and separate-process CLI exposure
still require durable pre-broadcast intent and remain explicitly out of scope.
The consensus ceiling remains app-v26; **v11.18.3 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.3`. SDK 11.18.3.
## What's New in v11.18.2
**A reply to a message you sent is readable again, through an advertised MCP
tool.** Previously a recipient could answer, the durable row flipped to
`completed`, and the answer was reachable only through the passive REST
projection `GET /v1/pipe/results` — which no MCP tool ever called. `sage_inbox`
shows work addressed to you, not answers to you, and `sage_message_status` is
sender-only but deliberately payload-free. So in MCP and bookend clients the
reply was invisible and work round-tripped. v11.18.2 adds `sage_message_replies`
as an explicit sender-side read (SAGE now advertises 32 MCP tools) plus a
payload-free pointer inside `sage_inbox` that reports how many replies are
retained without ever presenting them as new work.
**The reply read is exact-sender-only, passive, and honest about provenance.**
Authorization is the SQL predicate `from_agent = ?` against the caller's own
signed identity — not the wider `callerCanViewPipe` rule the workflow route
uses — and no parameter names another agent, so the tool cannot serve as a
message-existence oracle. Reading claims nothing, acknowledges nothing, and
re-queues nothing. Every body is labelled untrusted data and attributed to the
agent that actually wrote it rather than the agent you addressed.
`GET /v1/pipe/results` gains a payload-free `?count_only=1` probe and a
composite `(completed_at, pipe_id)` `before=` cursor, so replies sharing a
millisecond are never stranded behind the page boundary. A store backend
lacking the optional capability answers `501` instead of an empty page that
would read as "no replies".
Memory, agent, RBAC, federation, and consensus behavior are unchanged; **app-v26
remains the binary ceiling and v11.18.2 introduces no app-v27**.
Container: `ghcr.io/l33tdawg/sage:11.18.2`. SDK 11.18.2.
## What's New in v11.18.1
**MCP session guidance now uses the protocol surface intended for it.** SAGE
runs its per-session boot standing during `initialize` and returns the adaptive
full, bookend, on-demand, pending-review, or unavailable guidance through
`initialize.instructions`. The first real tool result is therefore only that
tool's payload instead of being prefixed with a 1.5–2.9 KB auto-connect block.
Repeated or concurrent initialization in one transport session reuses the same
standing without duplicating signed registration or caller-scoped reads.
Clients that skip the MCP initialization handshake keep the one-time first-tool
fallback for compatibility.
**Legacy-lineage recovery now represents real skip-ahead history truthfully.**
When retained Comet history proves a version jump such as `1→7` or `8→11`, the
app-v21 doctor emits a v2 transition claim at the real activation height and
records the skipped predecessors as virtual, subsumed coverage. It never
invents interleaved heights or writes synthetic `upgrade:applied:*` records.
Every validator independently replays the retained history and hashes before
an explicit vote, and the immutable audit is installed atomically only when
app-v22 activates. Existing valid v1 receipts on already-upgraded app-v22+
chains remain readable; new v1 repair proposals fail closed.
The lineage change is confined to the exceptional app-v21 → app-v22 recovery
ceremony. Memory, agent, RBAC, and federation policy are unchanged; **app-v26
remains the binary ceiling and v11.18.1 introduces no app-v27**.
## What's New in v11.18.0
**A connected pair is now the federation group users expect it to be.** Each
side explicitly exports the ordinary local agents it places in that pair. Every
active ordinary agent on the other SAGE may then live-read those exported
agents' owned domain trees by default—no matching local group, receiving
domain, or linked-reader grant is required. A receiving operator can narrow
that default with exact agent/domain denials. Local-only group membership is
never exported transitively, and adding another federated agent is an explicit
new export. Read remains borrowed; Copy still requires a source offer plus the
receiver's **Save here** subscription, while remote memory Write remains
reserved and fails closed.
**Federated authorization now stays true through disclosure.** The signed Read
plan and single-use challenge bind the exact source-agent standing, clearance,
export, agreement, policy generation, and negotiated authorization model. The
source authorization lease is revalidated and held until the destination query
finishes, so a concurrent rename-safe identity change, restriction, ownership
change, pause, or revoke cannot leak a result. CEREBRUM and `sage_federation`
also report authenticated-read readiness honestly, and the Docker acceptance
lane proves default Read, explicit denial, non-transitive exports, bidirectional
Copy backfill/incremental sync, and restart recovery.
**People can address agents without giving up canonical identity.** Local and
federated message targets accept a unique display or immutable registered name;
the resolved request and wire proof still carry only the canonical agent ID and
chain. Ambiguous local/remote collisions fail with bounded immutable choices
instead of selecting the first label. Federated replies now return an immutable
`reply_event_id`, and the replier can query that exact event's delivery status
without pretending it is a new inbox message.
**Access Controls is now one usable control surface.** Dedicated **Agents**,
**Groups**, and **Federation** tabs use compact searchable/sortable lists and
focused detail drawers instead of mounting every permission matrix at once.
Modern and legacy URL deep links preserve the selected tab and exact local or
federated identity. Dialog/drawer focus ownership, Escape/Tab handling, ARIA
labels, and narrow-screen behavior are covered by browser-contract tests.
**JOIN and upgrade recovery are bounded and explicit.** A JOIN session still
expires after 15 minutes, while each pasted/scanned code gets up to five minutes
of Direct/relay discovery as long as its pairing screen remains open. v11.18.0
is also the first concrete release containing stopped-node `backup --full`,
recoverable `restore --from`, `upgrade preflight`, and the app-v21 → app-v22
`upgrade lineage status|doctor|verify` workflow. A legacy-lineage repair is
create-only, chain/current-state bound, embedded in the exact immutable upgrade
proposal, never auto-voted, and requires every validator to verify and vote
explicitly; an unverified anchor requires a deliberate acknowledgement.
The federation/UI work is off-consensus. The narrow lineage ceremony repairs
only an eligible chain still at app-v21 before its governed app-v22 transition.
Existing app-v22 through app-v26 chains are not rewritten, **app-v26 remains the
binary ceiling, and v11.18.0 introduces no app-v27**. Both SAGEs should run
v11.18.0 for the complete signed federation tuple; older peers fail closed
rather than silently downgrade it.
Container: `ghcr.io/l33tdawg/sage:11.18.0`. SDK 11.18.0.
## What's New in v11.17.15
**Blank home-domain approval now does what the form promises.** When an
operator approves a writable pending agent without typing a home domain,
CEREBRUM derives a readable slug from that agent's committed name, adds a
cryptographically random suffix, and includes the resulting unowned domain in
the same dual-signed approval transaction. An explicitly entered domain still
wins. The unpublished v11.17.14 workflow was canceled after this browser-found
regression, so v11.17.15 is the first published release containing the changes
below.
**Bulk domain recovery now completes on idle personal chains.** CEREBRUM keeps
an explicitly confirmed multi-domain transfer alive across the existing
50-block governance cooldown, shows the current/required block while consensus
advances, and stops on every non-cooldown failure. Confirmed batches belong to
the CEREBRUM session rather than one screen, so operators may navigate away and
enqueue another transfer behind the active governance job. If an idle CometBFT clock
rejects the first app-v20 authorization as too far ahead, the server re-signs
the exact request once against the newly committed chain time; the proof window
and every consensus authorization check remain unchanged.
**Companion inbox setup now matches the profile’s purpose.** Choosing the
Companion/voice-bridge preset enables connected-SAGE inbox messaging by default;
the independent emergency block remains available afterward. If an existing
agent is blocked, Federation now keeps the warning visible and provides a
one-click path to that exact agent and inbox switch in Access Controls.
v11.17.15 also contains the v11.17.13 Agents directory and Linux packaging
changes below; v11.17.13 and v11.17.14 were never published after their release
runs were canceled.
## Included from v11.17.13
**New agents now appear where operators expect them.** Agents waiting for first
approval are separated from activated local principals and shown in a
conditional review queue at the top of **Agents**, with the existing atomic
approve/reject controls. **Access Controls** remains focused on activated local
agents. Exact ordinary agents advertised by connected SAGEs now have a distinct
**From federation** directory, including whether read-only group permissions are
unset or already linked; permission setup opens the existing Linked readers
control focused on that exact `agent_id@chain` pair. Federation transport,
ceremony, and Root identities are never cast as ordinary agents.
**Linux preview packaging survives transient helper outages.** The native-shell
gate preloads every Tauri AppImage helper through a three-attempt bounded retry,
an atomic reusable cache, and an exact SHA-256 allowlist. Partial or corrupt
entries are rejected, retries report the helper and attempt, and persistent or
changed upstream artifacts fail with deterministic diagnostics instead of being
silently trusted.
This patch also refreshes the pinned Go runtime dependencies and CodeQL action.
It changes no consensus rule, AppHash input, transaction type, key encoding,
fork target, or application version. Existing v11.17 chains upgrade in place.
Container: `ghcr.io/l33tdawg/sage:11.17.15`. SDK 11.17.15.
## What's New in v11.17.12
**Federation agent sharing now fails safely and explains the real policy.** The
agent picker checks the selected local agent's federated-inbox capability before
changing any shared domains, so an inbox blocked by policy can no longer leave a
partial domain share followed by a misleading refresh error. Access Controls now
shows an explicit **Allow messages from connected SAGEs** switch and changes only
the independent federation-deny bit; Companion agents keep their existing role,
clearance, home domain, and other restrictions.
**The Tasks board stays inside the viewport.** Four- and two-column layouts now
allow every track to shrink below its content's intrinsic width, so long Done or
Dropped cards wrap inside their columns instead of creating a page-level
horizontal scrollbar or clipping the final column.
This patch changes no consensus rule, AppHash input, transaction type, key
encoding, fork target, or application version. Existing v11.17 chains upgrade
in place without rewriting trust, domain grants, agent acceptance, memories, or
history.
Container: `ghcr.io/l33tdawg/sage:11.17.12`. SDK 11.17.12.
## What's New in v11.17.11
**CPU-only embeddings are faster, bounded, and observable.** Native Ollama and
OpenAI-compatible batches replace per-record request loops, concurrent identical
work is coalesced without retaining a cross-agent plaintext cache, imports embed
in bounded windows after authorization, and MCP clients let current SAGE nodes
authoritatively queue their own vectors. Provider, model, dimension, timeout,
managed-Ollama, and amid configuration now describe one coherent vector space.
A reproducible `sage-embedding-bench` command and CPU deployment guide cover
measurement and tuning.
**Idle nodes can transfer domains again.** Newly signed dashboard governance
proofs use the fresher safe clock when the latest committed block is old, while
the consensus proof window remains unchanged and future-skewed clocks still fail
closed. Federation connection details also expose Save and Revoke controls both
above and below long permission catalogs, avoiding a full-page scroll.
This patch changes no consensus rule, AppHash input, transaction type, key
encoding, fork target, or application version. Existing v11.17 chains upgrade
in place without rewriting trust, domain grants, agent acceptance, memories, or
history.
Container: `ghcr.io/l33tdawg/sage:11.17.11`. SDK 11.17.11.
## What's New in v11.17.10
**Federation visibility is symmetric again.** CEREBRUM's single authenticated
peer-status probe now preserves the peer-scoped domain permission and agent
contact projections that the remote SAGE returned. A reachable connection can
no longer show an agent from the other SAGE while claiming that its domains
were never reported, and the reverse side receives the same shared-agent view.
Transport binding internals remain hidden from the dashboard response.
This patch changes no consensus rule, AppHash input, transaction type, key
encoding, fork target, or application version. Existing v11.17 chains upgrade
in place without rewriting trust, domain grants, agent acceptance, memories, or
history.
Container: `ghcr.io/l33tdawg/sage:11.17.10`. SDK 11.17.10.
## What's New in v11.17.9
**CEREBRUM's agent and recovery surfaces now reflect the operator's model.**
Friendly renamed-agent labels are used consistently, the Access Controls agent
rail is wider, and the Agents directory is searchable by name or ID and sortable
by recent presence, recent committed memory, or name. The busy agent directory
now appears before the low-traffic governance controls. Federation permissions
use separate outgoing and incoming tabs, so a large local domain catalog no
longer buries the peer's shared-back view below an endless matrix.
**Domain transfer recovery is ownership-safe and retry-safe.** The dashboard
distinguishes immutable memory authorship from canonical domain ownership,
excludes the actual current owner from transfer targets, and treats a replay of
an already-committed transfer as success. Governance proof timestamps are bound
to the latest committed CometBFT time, preventing false five-minute-ahead
rejections on recovering or CPU-starved nodes.
**Messages now behave like an inbox, not a short-lived pipe.** Omitted/zero TTL
keeps local and federated work durable until handled, v11.17.8 unread rows are
extended during upgrade, and canonical inbox/outbox history is no longer swept
by the legacy 24/48-hour pipeline retention jobs. Callers can still request an
explicit 1–1440 minute expiry.
`sage_turn` now reports only `message_inbox_unread` and its count; it never
claims or injects message payloads. Agents call `sage_messages_receive` to read
the inbox and use status/history for replies and lifecycle evidence.
Container: `ghcr.io/l33tdawg/sage:11.17.9`. SDK 11.17.9.
## What's New in v11.17.8
**The v11.17 security backlog is cleared in code.** Pion DTLS and STUN are
upgraded to their patched releases in both the SAGE and Natter modules. Recall
result slices no longer use caller-derived allocation hints, app-v23 migration
keys avoid length-arithmetic preallocation, and the CEREBRUM inline-script
contract recognizes HTML tag case without a fragile sanitizer-style regexp.
The roadmap, architecture, federation guide, onboarding guide, and Python SDK
docs were reconciled to the then-current canonical Messages API and 24-hour
default TTL (superseded by v11.17.9 durable-until-handled delivery),
deprecated hidden `sage_pipe*` aliases, app-v26 authority names, signed macOS
in-place updater, and the remaining physical acceptance boundaries.
Container: `ghcr.io/l33tdawg/sage:11.17.8`. SDK 11.17.8.
## What's New in v11.17.7
**Releases no longer pause for a manual two-Mac approval.** Publication still
requires the exact staged macOS applications and DMGs to pass writable-copy,
launch, signature, Team ID, notarization, and stapling verification, then
continues automatically through immutable package and GitHub publication.
**Federation now recovers across LAN changes, internet relays, restarts, and
roaming addresses.** Signed route snapshots retain the stable peer identity,
rank safe Direct and Secure relay candidates, republish after relay reservation
changes, and migrate v11.17.4 `p2p_peers` state without treating stale routes as
authorization. Unsafe DNS, loopback, link-local, unspecified, multicast, mixed
peer-ID, and wrong-protocol routes fail closed.
**Federated agent discovery and Messages now work as one durable inbox.** Exact
`peer_chain` lookup disambiguates same-named agents. A previously authenticated
exact address can be queued while its node is offline, remains caller- and
policy-bound across restart, and is revalidated before any payload leaves the
sender. Canonical status independently reports transport, exact-recipient read,
and workflow completion to the original sender. Legacy `sage_pipe*` tools stay
callable for compatibility but are no longer advertised to new MCP clients.
**A reproducible Docker federation acceptance lane covers the real product
path.** It exercises same-LAN links, relay-only isolated networks, both-sided IP
churn, relay outage and recovery, expired route snapshots, v11.17.4 migration,
offline queueing, recipient inbox/read/reply, and final sender confirmation.
Container: `ghcr.io/l33tdawg/sage:11.17.7`. SDK 11.17.7.
## What's New in v11.17.5
**Federated agent sharing now sends the canonical permission wire shape.**
Choosing a named local agent may add the domains that agent owns to the trusted
connection. That automatic path now serializes the same `permissions` array as
the normal domain editor, so the peer can expose the agent contact and the two
agents can use canonical Messages/Inbox over the existing direct-or-relay link.
**Upgrade recovery accepts the first valid revision-zero snapshot.** Legacy
databases can legitimately publish their first preserved-record inventory at
projection revision zero. CEREBRUM can now deprecate an exact selected subset
of that inventory while still requiring the revision field, positive count,
typed confirmation, current Root authority, and atomic queue validation.
**Federation enrollment now carries one validated route bundle from JOIN to
roaming operation.** Direct and secure-relay candidates survive the ceremony,
the dashboard reports the route that actually carried authenticated traffic,
and stale host windows fail closed. Canonical agent messaging uses the exact
linked-reader relationship plus independent receiver-local consent on the same
direct-or-relay transport.
**Canonical Messages are the public agent-to-agent workflow.**
`sage_message_send`, `sage_inbox`, `sage_message_reply`,
`sage_message_status`, and `sage_message_history` cover idempotent send,
receive, reply, receipts, and restart-persistent history. Legacy `sage_pipe*`
MCP tools remain compatibility aliases but are explicitly deprecated. The
federated proof verifier accepts the sender-local idempotency field in the
exact signed request without exporting that replay token into the peer event.
New messages now default to the full supported 24-hour inbox lifetime, rather
than expiring after one hour while a recipient agent may be offline.
**CEREBRUM recovery and consensus stay usable on upgraded nodes.** The
consensus page authenticates its scope request, incompatible historical
domain-continuity candidates are retired instead of being reproposed every
block, and recovery deprecation records an honest recovery activity event.
The recovery authority controls use a responsive grid, so the explanatory
copy and selectors no longer collapse into a horizontally scrolling row.
Access Controls also normalizes historical empty groups to `members: []`, so a
valid empty group cannot throw during the first render and leave the page stuck
on “Loading consensus access policy…”.
**Historical app-v25 home defects no longer prevent app-v26 repair from
starting.** Nodes with the narrow legacy `shared_home` shape may rebuild their
local agent serving projection long enough for the existing deterministic
app-v26 migration to run. Eligibility and validation share one Badger snapshot,
completed app-v26 chains stay strict, and a concurrent repair falls back to one
strict retry. This changes no memory, historical author, ownership history, or
prior block outside the already-governed app-v26 repair.
**Large federation agreements stay responsive.** CEREBRUM renders bounded
75-domain windows, keeps existing grants and retained subscriptions first, and
skips reconciliation when polling returns identical state. Search, bulk
actions, and Save still operate on the complete filtered permission set and
full draft rather than only the rendered rows.
**Local MCP clients use the listener SAGE actually binds.** Generated configs,
hooks, bundles, and internal defaults now use `127.0.0.1` instead of allowing
`localhost` to resolve to an unbound IPv6 `::1`. `sage_find_agent` also
preserves its bounded federated continuation cursor when a fuzzy local result
exists, so a caller can explicitly request the next peer page without any
automatic federation walk.
**App-v26 makes Access Group authority explicit and reviewable.** Every local
group now stores one deterministic member authority: `read`, `read_write`, or
`read_write_modify`. Existing groups migrate to the safe `read` baseline at
the strict H+1 fork boundary. A domain owner always retains full control of its
own domain; group membership is additive, the strongest applicable group wins,
and removing an agent revokes only that cross-member relationship without
touching the agent's own domains. Linked federated agents remain read-only
guests and can never acquire local Write, Modify, ownership, or governance.
**Local agent messaging now has one canonical, durable receipt contract.** An
idempotent send, exact receive-batch replay, recipient-only reply/read
acknowledgement, and sender-only payload-free status projection use the existing
encrypted pipeline inbox rather than a second queue. Connected HTTP MCP SSE
sessions for the exact recipient may receive a metadata-only wake-up; this is a
best-effort hint, never presence, delivery, comprehension, or read evidence.
The enforced `sage_turn` reminder/checkpoint nags are removed.
**CEREBRUM helps Root finish historical recovery instead of leaving a warning.**
Unresolved preserved records can be inspected through bounded safe previews,
selected, assigned to an active local ordinary agent when exact verified
evidence permits it, or deprecated. Already-deprecated rows are excluded.
Authorship, content, domains, and chain history remain immutable; assignment
changes only current operational ownership. Conflicting or unverifiable rows
remain deprecate-only.
**Linked SAGE discovery closes over the relationship agents can actually use.**
Caller-scoped directory results include only consented linked peers and expose
their exact address plus registered/display name metadata. The same authority
is enforced for direct and secure-relay paths; discovery grants no remote
memory write or local group membership.
**Operator mutations and signed updates fail safely without lying.** CEREBRUM
reconciles uncertain consensus responses against canonical state and repairs
the local agent projection after a committed approval. Access Controls can
also commit a new agent display label without changing its immutable
registered name, agent ID, boot purpose, domains, or authorship; the rare Root
handover card now sits below everyday agent and group controls. The macOS release gate
mounts the signed DMG, copies the app to a fresh writable APFS location, verifies
the exact leaf identities and version before and after first execution, and
publishes only that verified immutable asset. CEREBRUM now stages that signed
DMG, verifies the replacement, swaps the installed application through a
separate helper, and restarts into the new build with bounded readiness checks
and rollback. Manual drag-and-drop remains the explicit fallback. Linux keeps
its verified in-place updater.
This is a governed consensus upgrade from app-v25 to app-v26. Existing chains
advance in place; memories, historical authors, domains, and prior blocks are
not rewritten.
Container: `ghcr.io/l33tdawg/sage:11.17.5`. SDK 11.17.5.
## What's New in v11.16.4
**Existing nodes recover from stale app-v23 serving projections at startup.** A
rebuildable local SQLite projection whose old duplicate policy fields disagree
with the canonical committed enrollment is normalized from that canonical
policy record instead of preventing the node from starting. This is a local
read-model repair only: it does not alter blocks, memory content, historical
authors, domains, access groups, or the consensus application version.
**The release pipeline verifies the installer that users actually download.**
After macOS packages upload, CI downloads the staged DMG, checks its checksum,
mounts it, and verifies the app signature, Gatekeeper assessment, and
notarization before publication. The MCP server also no longer spends an
agent's context budget on repeated per-tool `sage_turn` reminder messages.
**Claiming a message no longer makes it disappear for either participant.**
The active inbox remains a pending-only, claim-on-read work queue so old work
does not reappear in every turn. A new passive retained inbox/outbox history
lets the recipient reopen claimed or completed work and lets the sender revisit
its local lifecycle until the normal transient pipeline retention sweep.
Agents can also list the signed active local directory—with display name,
immutable registered name, provider, and exact agent ID—before addressing a
message, instead of guessing a recipient from a fuzzy provider label.
**CEREBRUM now settles operator actions against the canonical chain instead of
undoing them in the browser.** Clearing a terminal task column keeps cards out
of intermediate refreshes while the local projection catches up, then reloads
the authoritative board. A lost or late commit response is reported as
confirmation in progress rather than the false claim that nothing changed;
only a definite consensus rejection is red. A multi-manager deprecation that
opens a challenge is shown honestly as awaiting its distinct eligible
confirmation rather than called cleared.
**Access Groups and agent recovery are usable in the flow operators actually
use.** Dragging one active local agent onto another creates or extends the
narrowest local group, so members read each other's owned domains by default
until the operator explicitly selects Read + write or Read + write + modify
for that group. Global Manager labels never silently widen the selected group
permission. Dragging a member back out revokes only that group relationship.
CEREBRUM also settles agent
removal and first-use domain authority against committed state, rather than
leaving a stale progress screen or asking a newly-created domain to retry its
first operation.
**Federation no longer requires a relay reservation to use a working direct
route.** A trusted pair may connect immediately over its authenticated direct
candidate—especially useful on the same LAN—and keeps the secure relay as an
automatic roaming/NAT fallback. Direct-only route bundles now validate on both
the dashboard and peer transport paths.
This patch does not rewrite memories, domains, historical authors, existing
groups, or chain history. It keeps consensus application version 25 and the
existing governed upgrade path unchanged. Existing nodes upgrade in place.
Container: `ghcr.io/l33tdawg/sage:11.16.4`. SDK 11.16.4.
## What's New in v11.16.2
**App-v25 repairs historical continuity without rewriting history.** It is the
strict H+1 successor to app-v24. New submissions receive an immutable
canonical envelope: a memory ID can be replayed exactly, but cannot later be
reused for different content, author, domain, or classification. That closes
the old projection-overwrite path that could leave an agent able to write a
domain but unable to read it back.
On upgrade, SAGE scans historical SQL rows against canonical state in the
background. Complete, content-hash-verified records are adopted through
bounded Root-authorized, validator-attested governance batches. No memory
content, author attribution, domain, classification, or earlier block is
rewritten. For each recovered local domain, the earliest verified historical
writer is retained as the operational owner; every other verified local writer
is restored into the exact local Access Group with read/write continuity. If
the earliest writer is no longer a valid local principal, CEREBRUM Root owns
the recovered domain rather than promoting a later writer by guesswork.
**One bad historical row can no longer blank CEREBRUM or take agents offline.**
v11.16.2 quarantines each unverified record individually. Broad list/search,
graph, timeline, stats, and dashboard-health reads continue with the verified
set and disclose a partial-projection state. A completed audit returns
`/ready` as HTTP `200` / `degraded`; actual backend failures and incomplete
audits remain unavailable. This keeps supervisors, MCP bootstrap,
`sage_inception`, and healthy agent work online without pretending incomplete
data is safe.
Unreadable or conflicting records are preserved byte-for-byte. CEREBRUM Root
can retry the evidence scan or explicitly deprecate the exact unresolved
inventory after a typed confirmation; deprecation retires it from automatic
repair and normal views but does not delete historical data. See
[App-v25 upgrade and recovery](docs/reference/app-v25-upgrade-recovery.md).
Container: `ghcr.io/l33tdawg/sage:11.16.2`. SDK 11.16.2.
## What's New in v11.16.0
**App-v24 closes the canonical terminal-hash lifecycle defect without rewriting
history.** New memory submissions bind `content_hash` to the exact SHA-256 of
their content, and challenge, deprecate, and other terminal transitions preserve
that canonical hash. App-v24 activates at the strict height after its app-v23
predecessor, so the activation block and every earlier block retain their exact
historical semantics. A governed, Root-planned validator vote can re-anchor
eligible historical terminal rows in bounded, atomic, idempotent batches from
their unchanged canonical content. The repair changes neither content,
authorship, domain ownership, nor prior blocks.
**Fresh first-party Mynah nodes now wait for the safe protocol floor instead of
starting mute or writing through the vulnerable interval.** Direct app-v23
genesis remains the authenticated bootstrap origin, but `/ready` reports
`waiting_for_app_v24` until the next admitted transaction will execute under
app-v24. Consensus independently rejects direct-genesis Companion memory and
co-commit writes during that short governed climb, so bypassing the readiness
endpoint cannot reproduce the defect. Personal nodes require app-v24 even when
optional future auto-upgrades are disabled. This narrow barrier does not mute
ordinary upgraded nodes: existing agents retain their app-v23 write authority
while app-v24 activates.
**Agent recall and caller-scoped discovery work again under the new access
model.** `sage_turn` now uses the shared local semantic-recall path and forwards
the exact embedding provider returned by `/v1/embed`; it no longer
misclassifies every turn as federated and then trips the app-v23
federated-vector gate. The signed `sage_find_agent` path again searches active
ordinary local agents first and then only federated contacts authorized for
that caller. It is discovery metadata, not presence: an empty match does not
prove that a saved exact Agent ID is unreachable, and sends always revalidate
the destination.
**CEREBRUM RBAC now preserves the policy the operator actually approves.**
Companion enrollment accepts its documented `15`/`31` profiles, valid existing
federated-pipe restrictions are not silently stripped, and a newly pending
mask-`30` principal becomes the documented Companion mask `15` only after
approval. Encrypted and unencrypted loopback CEREBRUM use the same Root/Admin
authorization boundary; an encrypted vault additionally requires its valid
unlocked session. A level-2 grant is never presented as a cure for a hard
capability, pending-review, profile, or ownership denial.
**CEREBRUM no longer mistakes a missing ordinary-memory projection for an
empty brain.** App-v23 readiness now checks the complete canonical Badger
inventory against the local SQL serving projection, so deletion, rollback, or
partial projection loss returns `503` instead of a plausible zero-memory
dashboard or empty backup. A state-sync receiver seals and node-key-signs the
exact historical canonical IDs whose ordinary plaintext was intentionally not
transferred; every memory committed after that baseline remains mandatory. Such a node
reports `canonical_subset`, and portable full-brain export stays disabled
rather than producing a partial file labeled as a backup. Pre-v11.16 receivers
that do not have this exact authenticated baseline fail strict readiness and
must be explicitly repaired or state-synchronized again; upgrade-time SQL state
is never guessed into an omission allowlist.
Container: `ghcr.io/l33tdawg/sage:11.16.0`. SDK 11.16.0.
## What's New in v11.15.1
**Emergency CEREBRUM rendering recovery.** v11.15.0 shipped one malformed
nested-template expression in the Access Control view. Because CEREBRUM is a
browser-module application, that single parser error prevented the entry module
from executing and left the otherwise healthy local node behind a blank page.
v11.15.1 corrects the expression and changes the static JavaScript release gate
to parse every first-party file with browser-equivalent ES-module grammar, so
this class of packaging failure is rejected before publication. A
dependency-free Loading shell now turns future bootstrap failures into a
sanitized recovery panel, and missing module assets return a true `404` instead
of a misleading HTML `200`.
This patch does not migrate, delete, rewrite, reassign, or re-encrypt memories.
It changes no consensus rule, transaction, key encoding, AppHash input, fork
height, or application version; app-v23 and every historical block remain
byte-identical. Existing nodes upgrade in place. Container:
`ghcr.io/l33tdawg/sage:11.15.1`. SDK 11.15.1.
## What's New in v11.15.0
**App-v23 replaced capability-bit administration with roles, security profiles,
and Access Groups that match how people actually share a SAGE.** Members can
read the domains owned by other active local members of their groups. Managers
could also write and modify within those same group boundaries under the
original app-v23 rule; app-v26 supersedes that derivation with each group's
explicit authority tier. Admins have
sudo-equivalent authority over normal local data, policy, governance,
federation, and CEREBRUM operations. Clearance remains the maximum
classification an agent may read, and hard security-profile restrictions still
override roles, groups, and grants.
**CEREBRUM Root is now a separate, singleton authority rather than an agent
card.** It cannot be dragged into groups, messaged, demoted, or removed through
ordinary agent controls. A dedicated two-confirmation handover rotates the
current Root credential while preserving the immutable Root authority over its
existing domains, grants, and groups. Historical memories keep the exact
credential that authored them; new Root memories record the new credential.
No chain history is rewritten, no domain is bulk-transferred, and retired Root
credentials can never become agents or Root again.
**Federated agents are linked readers, never remote members.** A remote
`agent@chain` may be attached to a local Access Group for live,
classification-bounded reads only. It receives no Copy, Write, Modify, claim,
ownership, grant, role, governance, or transitive-agent authority. Agent
pipeline messages remain untrusted requests; any resulting memory action is a
separate local decision made under the receiving agent's own identity.
**First-party vendored companions no longer start mute.** A clean Mynah / SAGE
Voice Bridge installation atomically binds its exact key, reviewed Companion
profile, clearance, local enrollment, and owned non-shared home domain before
readiness succeeds by starting its fresh vendored node directly at app-v23.
Mynah has no released legacy population, so there is no Mynah-specific upgrade
or repair path. Other agents stranded by app-v22's default mask `30` remain
pending review until a local Admin completes the atomic onboarding operation;
they cannot self-promote or claim a domain.
**CEREBRUM now enforces the localhost-only promise already shown in its UI.**
The human control plane, including authentication, recovery, RBAC, federation
management, and the SPA itself, is unavailable over LAN or a federated link.
On an unencrypted personal node, the real same-origin loopback SPA has complete
Root control without inventing a password or copying the genesis key; when
vault encryption is enabled, the same local surface additionally requires its
unlocked session. Signed Admin/Root management is also local-only. Dedicated
signed agent APIs, pairing/claim redemption, health, and federation data-plane
traffic retain their designed network reachability.
App-v23 activates only after the canonical predecessor ladder through app-v22,
with the activation block retaining v22 semantics and v23 beginning at the next
height. Replay and state sync preserve every historical AppHash while validating
the new Root, role, enrollment, group, and revision invariants. Personal nodes
automatically walk the governed ladder to the required app-v23
security floor even when optional future auto-upgrades are disabled.
Multi-validator networks must first install this exact binary on every
validator, then activate app-v23 through their normal governed upgrade
ceremony. Legacy or
keyless MCP/OAuth bearers that could fall back to Root are revoked; current
tokens require a distinct pending-review keyed identity. Vault-enabled nodes
and unencrypted nodes both seal new token keys under the one-time bearer, so
credentials survive optional ledger state changes, the stored database digest
cannot decrypt them, and no bearer ever falls back to Root. Existing
vault-sealed token rows migrate on their next unlocked use. Public OAuth
authorization crosses an opaque,
short-lived, single-use handoff into a localhost-only approval page—CEREBRUM,
its cookies, and `/ui` are never exposed through the Cloudflare tunnel. SDK 11.15.0.
## What's New in v11.14.2
**Emergency CEREBRUM and updater recovery patch.** Local installations with
vault encryption disabled no longer open to a blank dashboard after upgrading:
the real loopback CEREBRUM browser can read memories, search, use the task
board, enable the vault, and apply or restart official verified updates.
Unsigned background processes, LAN and cross-site browsers, ordinary signed
agents, and sensitive operator mutations remain denied. The updater now prefers
GitHub's immutable release-asset SHA-256 digest and uses checksum sidecars only
as a fallback, removing the transient checksum-discovery failure that blocked
some v11.14.1 upgrades. Existing memories were never removed by this issue.
SDK 11.14.2.
## What's New in v11.14.1
**SAGE now gives co-located companion agents a consensus-enforced
least-privilege profile.** App-v22 adds operator-controlled capabilities for
clearance-bounded cross-domain reads while denying shared-domain writes,
foreign-domain writes, and domain claims. The companion preset keeps local and
federated agent inbox messaging enabled, so a voice bridge can delegate work to
a visible agent on another compatible SAGE and relay its eventual result.
Short-name agent lookup now searches bounded local metadata, so names such as
`mynah` resolve without requiring the full registered display name. Direct
remote memory Write remains unavailable: agents send a pipeline request to the
remote agent, which performs any separately authorized local action.
Codex's user-level MCP registration now derives a separate stable signing
identity from each workspace folder instead of silently reusing `global-codex`;
explicit custom key pins remain supported. CEREBRUM shows the exact signer ID
beside every access grant so a display-name match cannot hide an identity
mismatch, and its access matrix only filters and assigns domains already
created by agents rather than asking an administrator to create domain tags.
Fresh self-registrations after app-v22 start quarantined (mask `30`):
they cannot write or claim domains or use federated inbox routing until a
global administrator assigns an intentional profile; existing agents retain
their pre-upgrade mask.
App-v22 also refuses to be proposed, approved into a pending plan, activated,
or restored unless consensus storage proves the complete predecessor ladder.
The canonical persisted app-v6 record is the one compatibility proof for the
historical cumulative app-v2 through app-v5 activation; app-v7 through app-v21
must each have their own canonical applied-upgrade record, with the exact
target and strictly increasing positive activation heights. Missing,
synthesized, or out-of-order v7+ evidence fails closed. Historical pre-v22
block replay is unchanged.
**Agent inboxes now enforce an explicit prompt-injection trust boundary.**
Every local or federated payload is surfaced as an untrusted
`request_only` request, never as system, developer, or user instructions;
pipeline results are untrusted `data_only` content, and task notices are
notifications that must be confirmed against the exact current backlog
assignment. Tool descriptions, inception guidance, response metadata, docs,
and regression tests all carry the same rule.
SDK 11.14.1.
## What's New in v11.13.9
**SAGE now closes the WebTransport memory-exhaustion advisory and makes task
updates explicit.** Root and Natter modules use patched WebTransport/QUIC
dependencies. `sage_task` rejects immutable content replacements locally,
requires an explicit status transition, and supports link-only updates without
an implicit re-plan.
SDK 11.13.9.
## What's New in v11.13.8
**CEREBRUM now records committed permission changes in Chain Activity.** Access
saves, grants, and revocations show only after their transaction commits, with
the block and transaction available on expansion. Chain Activity can now be
resized even when it is empty, and its clear Expand/Collapse control works
reliably from the header.
SDK 11.13.8.
## What's New in v11.13.7
**MCP identities are now isolated by client provider, and federation shares an
agent with its owned domains in one guided action.** Claude Code and Codex get
distinct project keys, while explicit legacy keys remain stable; direct session
hooks use that exact configured identity too. Federation now loads the peer's
published contact snapshot when the panel opens. Selecting a local agent can
add its owned, shareable domains to the connection after one clear confirmation.
SDK 11.13.7.
## What's New in v11.13.5
**CEREBRUM now shows the live consensus app version and makes level-3 Modify
grants explicit.** Overview reads CometBFT's live ABCI application version,
instead of presenting a stale status-cache value after an upgrade. The domain
access matrix now has Read, Write, and Modify levels, with a server-enforced
permission ladder and real owner-signed level-3 grants on Save. Shared domains
remain read/write-only by design; CEREBRUM rejects Modify before it can display
an unenforceable permission, including dynamically shared domains.
- **Safer RBAC administration.** Only a local CEREBRUM operator can create an
agent or change its security-critical access policy. Signed agents cannot
self-elevate through the dashboard's admin/validator credentials.
- **App-v20 governance compatibility.** Domain reassignment and cancellation
use the canonical governance proof shape once the app-v20 gate is active,
while older chains retain their legacy transaction compatibility.
SDK 11.13.5.
## What's New in v11.13.4
**Challenges now respect corroborated knowledge, and clients can inspect the
evidence instead of bypassing the API.** Governed app-v21 snapshots the eligible
modify holders plus current read-authorized canonical corroborators for each new challenge and
requires `k+1` distinct challengers when `k` canonical corroborators support the
memory. Only a modify holder can open the dispute; snapshotted corroborators may
then reverse their support by endorsing it. Zero-corroborator noise still
resolves on the first authorized challenge; an eight-corroborator memory now
requires nine distinct challengers.
- **First-class, replay-safe challenge rounds.** The electorate, threshold,
round, and distinct challenge votes are AppHash-covered and committed
atomically. Grant churn cannot rewrite an open round, duplicate or stale votes
cannot accrue, and legacy app-v17 disputes finish under their original rules.
- **Evidence is visible everywhere.** REST query/search/detail, federated recall,
MCP recall, and the Python SDK now return distinct `corroboration_count` and
lifetime `challenge_count` values. `evidence_counts_available` is true only
when both queries succeed and no recovery/repair-incomplete marker is present;
after pristine recovery the numeric values remain useful canonical lower
bounds, but a zero is not proof that no historical evidence existed. Open
disputes also expose the current app-v21 round tally and threshold. Challenge
and forget responses report authoritative durable post-commit status instead
of assuming every challenge deprecated.
- **Safe state-sync upgrade.** Authorized state sync accepts app-v20 and app-v21
images, reconstructs canonical corroborator/challenger counts into a pristine
serving projection as explicitly incomplete lifetime lower bounds, and pins
each transfer to one exact application version. Older v20 sessions remain
compatible; mismatched or unsupported images fail closed.
Caller-asserted memory type, confidence, and challenge strength are deliberately
not consensus weights: they are not validator-attested facts and would otherwise
let a caller self-assign immunity. Existing chains retain the exact app-v17
policy until the governed app-v21 activation. SDK 11.13.4.
## What's New in v11.13.3
**CEREBRUM now manages federated agent contacts by name and keeps access
changes bounded to what the operator can actually see.** The federation panel
replaces raw 64-character agent-ID entry with the active local agent directory,
then verifies the chosen identity against current shared-domain access before
showing its default-off work-request switch.
- **Friendly selection, exact authorization.** Names, registered names, and
providers are shown for humans while every request still carries the exact
agent and opaque contact identities. Exact out-of-sample contacts are
revalidated through a bounded background projection and disappear promptly
after access, availability, agreement, or consent changes.
- **Visible means visible.** Access Control bulk actions now affect only the
filtered domain rows on screen. Their labels say so explicitly, preventing a
six-row search result from silently launching changes across the full domain
catalog.
- **Honest on-chain save state.** Duplicate saves, mid-save agent switching,
and edits to a submitted snapshot are blocked while consensus work is in
flight. Partial grant failures keep retry available and are not mislabeled as
saved; directory, lookup, and reconciliation failures remain actionable.
This release changes no SAGE consensus rule, AppHash input, transaction type,
key encoding, fork target, or application version. App-v20 and the v11.9
rollout boundary are unchanged; existing chains upgrade in place. SDK 11.13.3.
## What's New in v11.13.2
**This corrective release completes shared-domain federated recipient
discovery at scale.** v11.13.2 keeps a deterministic, valid v1 status subset
compatible with v11.13.0 (at most 1,024 contacts and 1 MiB), then resolves a
requested human name or exact agent address through a new authenticated,
RBAC-filtered lookup route.
So a shared domain can have more recipients without turning the whole snapshot
or a later cache entry into a failure.
- **Revocations linearize with delivery.** Direct grants, organization
membership/clearance, federation status, and department membership changes
wait for an in-flight authorized inbox admission, claim, completion, or
bounded result delivery; the next operation rebuilds the contact and rejects
the old route.
- **Fast, caller-safe cache.** Repeated lookup of the same name is cached for
one minute per signing caller. Each result retains one caller-authorized
domain basis and is rechecked locally on every hit. Keyless legacy bearer
tokens cannot use federated discovery or delivery as the node operator.
- **No change to consent or scope.** Contacts remain domain-scoped,
caller-authorized, and default-off until the recipient enables that exact
contact. This is still not a global directory.
This release changes no SAGE consensus rule, AppHash input, transaction type,
key encoding, fork target, or application version. App-v20 and the v11.9
rollout boundary are unchanged; existing chains upgrade in place. SDK 11.13.2.
## What's New in v11.13.0
**A shared domain can now route work to every active agent that holds current
RBAC access to it—not only its owner.** A level-1 reader or level-2 writer on
SAGE A can opt in to receiving federated work from authorized agents on SAGE B.
The existing `sage_find_agent` local-first lookup and short-lived,
caller-scoped cache then discover those opted-in contacts by name.
- **Domain-scoped, not a global directory.** Contacts are exposed only through
a live shared Read/Copy domain and retain that domain as their routing basis.
Open-shared and ownerless domains still publish no guessed recipient.
- **RBAC is rechecked at delivery.** The receiver rebuilds the contact from
current access grants before admitting, claiming, or completing foreign work.
While a grant is revoked or expired—or an agent, owner, or federation policy
changes—the old route is rejected. Inbound work remains default-off until the
local operator enables that exact contact.
This release changes no SAGE consensus rule, AppHash input, transaction type,
key encoding, fork target, or application version. App-v20 and the v11.9
rollout boundary are unchanged; existing chains upgrade in place. SDK 11.13.0.
## What's New in v11.12.2
**Agents can now resolve a human recipient name safely across a federation.**
The new `sage_find_agent` MCP tool searches active local registrations first,
then only the remote contacts already authorized for the signed caller. Its
short-lived, caller-scoped in-memory projection makes repeat lookups fast
without creating a global agent directory.
- **Immediate, policy-safe repeat lookup.** Cached remote contacts are bounded
and re-authorized against current local domain access on every cache hit, so
a local revoke applies to the very next lookup without a peer round trip.
- **Pipeline authorization matches discovery.** Federated pipe resolve and
direct send both recheck the caller against the target's currently disclosed
domain scope; a borrowed or stale route cannot bypass local RBAC. The outbox
still requires a fresh authenticated remote contact match before payload
bytes leave the SAGE.
This release changes no SAGE consensus rule, AppHash input, transaction type,
key encoding, fork target, or application version. App-v20 and the v11.9
rollout boundary are unchanged; existing chains upgrade in place. SDK 11.12.2.
## What's New in v11.12.1
**Federation now stays useful while another SAGE is slow or offline.** Trusted relationships and their last-known route state render immediately from local state, initial permission and agent-contact controls no longer wait on a remote round trip, repeated status probes are shared instead of multiplied across panels, and the bounded live-status check fails promptly without hiding saved controls behind a long “Loading…” state.
- **One domain surface in the Brain.** The duplicate right-side Domain tags rail is consolidated into the Local/Shared Domain sources panel. Local domains can filter the MRI directly, the panel includes domain search and the compact reading guide, and remote-only domains remain visibly separate from memories actually stored on this SAGE.
- **A workspace that stays where you put it.** Domain sources can be moved and resized, saves its geometry across reloads, clamps itself back into the visible canvas, and includes a one-click Reset.
- **Cached first paint, authenticated refresh.** CEREBRUM reuses manager route diagnostics and persisted local permission state immediately, then performs one authenticated peer refresh in the background. Manual Refresh still requests fresh remote RBAC and agent-contact state.
- **Native preview version alignment.** The alpha shell now accepts its version-matched v11.12 daemon instead of rejecting the daemon bundled by the v11.12 release pipeline.
This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.12.1.
## What's New in v11.12.0
**This release makes first run, sharing, recovery, and day-to-day federation understandable without technical knowledge.** CEREBRUM now presents one create-or-join decision, keeps a new SAGE private by default, explains that pairing alone shares nothing, and routes sharing into the same owner-controlled RBAC surface used everywhere else.
- **File-sharing-style groups with Active Directory semantics.** Owners choose already-trusted SAGEs and existing domains, guests control only their own receive role, and group deletion removes the group everywhere without deleting the trusted connections underneath it. Concurrent guest role changes are serialized by the owner, and **Refresh** waits for signed journal reconciliation before showing the result.
- **Federation visible to ordinary agents.** The read-only `sage_federation` MCP tool lets an authorized agent inspect the SAGE connections and Read/Copy scopes visible to its own subtree. An exact-domain `sage_recall` can opt into authorized peers with `scope:auto`, merges peer results under one global limit, preserves provenance, and falls back safely when peers use different embedding providers.
- **One automatic connection path.** Users no longer choose LAN versus internet. SAGE prepares direct and secure-relay candidates behind one **Connect** action, labels them as prepared until a real exchange selects one, prefers a working direct route, falls back without replaying a request, refreshes stale routes, and keeps route, trust, lock, compatibility, offline, degraded, and security failures distinct.
- **Clear local-versus-shared visibility.** Already-shared domains stay in a separate first section of the permissions list. The main Brain identifies local, remote, saved-here, and copied-from sources—even after a connection is revoked—while internal federation/RBAC audit records stay out of user memory views and sharing controls.
- **Recovery that is visible and honest.** Recovery-key backup acknowledgement survives reloads; a wrong recovery key is rejected before the vault is touched; successful recovery establishes the ordinary dashboard session; portable JSONL backups restore through Preview and Confirm; forgotten memories are excluded and cannot be resurrected from older backups.
- **Safe same-network join.** Join codes bind the exact SAGE executable as well as the version, and adopting the host chain clears only old chain-projection receipts while preserving the guest's local memories.
- **Accessible, consistent controls.** Destructive and privacy-affecting actions use explanatory dialogs that say what changes and what remains safe. Search filters, cleanup and preference switches, recall controls, and per-domain access switches expose useful screen-reader names.
The structured v11.12 proxy acceptance exercised first run, same-network join, three-node federation, group creation/removal, concurrent roles, restore, forgetting, cleanup, keyboard focus, and recovery on disposable nodes. The protected release workflow supplies the remaining signed/notarized clean-install artifact check.
This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.12.0.
## What's New in v11.11.2
**Sharing & Sync becomes operable at a glance.** Group owners can give a group a friendly, signed name; choose one or more existing controlled domains instead of typing fragile tags; see each member's friendly name, live reachability, and catch-up state; and add an already-trusted SAGE through a guided invitation without copying a chain ID or public key. Group names ride the established signed roster manifest, so v11.11.1 peers safely ignore the optional label while continuing to synchronize during a rolling patch upgrade.
**MCP reflection failures are now honest.** A completely unwritable reflection returns an error, partial writes report their lost components, and degraded embedding status is preserved. Permanent domain-write ACL denials are now typed so clients do not waste a registration-and-retry cycle on a refusal that cannot succeed.
This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.11.2.
## What's New in v11.11.1
**Release-pipeline fix for v11.11.0.** v11.11.0 was tagged but never published: the release workflow's native-shell evidence and publication jobs only execute for version 11.11 and above, so v11.11.0 was the first tag in the project's history to run them, and two latent defects surfaced in a path no pull request can exercise. The bundled daemon was staged after the Rust build that consumes it, and the publication gate expected an artifact-kind string the bundle verifier never records. Both are fixed and pinned by tests. No user received v11.11.0 on any channel.
Everything below shipped in this release.
## What's New in v11.11.0
**The Sharing & Sync control plane is complete, and the desktop shell foundation lands as an opt-in alpha that nothing depends on.** Browser CEREBRUM remains the product; the native shell is a background track that is built and runtime-tested in CI but not distributed and not intended for end-user use.
- **CEREBRUM sharing and sync controls completed.** The Sharing & Sync surface finishes the control plane over synchronization groups, member roles, selective-sync state, shared domains, ownership, and catch-up position.
- **Storage and task-board correctness.** Postgres now enforces the same content-hash dedup parity as SQLite, so the two backends no longer disagree about what counts as a duplicate memory. The task board persists lifecycle and ordering correctly, and terminal tasks retain their original agent attribution instead of losing authorship on completion.
- **Tighter local trust boundary.** Acceptance endpoints are isolated from the globally configured Codex endpoint, and RBAC key caching is bounded rather than growing without limit.
- **Native shell foundation (alpha, not distributed).** A Tauri 2 shell starts the bundled daemon through an authenticated SSCP startup proof, owns one window with fail-closed navigation pinned to the exact authenticated loopback origin, keeps a visible recovery surface, and hands off to an existing instance on relaunch. Its installed-package lifecycle is proven on hosted runners for macOS, Windows, and Linux — install, launch, single-instance handoff, ordinary close with daemon survival, uninstall preserving the node data root, and reinstall to a genuinely new instance generation. macOS additionally proves offline startup with no external requests. Every package is unpacked and must contain exactly one bundled daemon whose embedded OS/architecture and version match the build.
- **The shell does not gate releases.** v11.11 distributes no native shell, so signing, notarization, update/rollback, recovery, performance, and accessibility evidence are the bar for *distributing* it — which the roadmap places at v12 — not a v11.11 shipping requirement. Federation, agent-to-agent messaging, and the rest of the roadmap do not queue behind desktop packaging.
This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.11.1.
## What's New in v11.10.0
**Federation now feels like connecting two colleagues' SAGE nodes, not configuring infrastructure.** The reciprocal QR ceremony derives the exact listener or internet/P2P route, survives retries and rapid confirmation, and creates trust with zero implicit sharing. CEREBRUM keeps Read, Copy, Pause/Resume, and permanent revoke distinct, preserves saved choices while paused, explains peer revocation on both sides, and keeps historical connections out of the active list.
- **Independent, visible sharing controls.** Each operator chooses existing local domains at any time without reconnecting. Read borrows live answers; Copy requires both the source offer and the receiver's separate **Save here** opt-in. Long permission lists scroll cleanly, domain-owner contacts show exact `agent@chain` addresses plus friendly handles, and cross-host Write remains unavailable until it has connection-bound consensus authorization.
- **The agent inbox crosses trusted federation edges.** Existing `sage_pipe` work can target an explicitly visible remote agent over direct mTLS or the persisted roaming route. Receiver acceptance is default-off, payloads are marked untrusted, offline work queues durably, Pause and acceptance-off are retryable, reconnect resumes unchanged work, and delivery/result import is replay-safe and idempotent. This is agent-to-agent infrastructure—not a CEREBRUM user messaging client and not remote memory Write.
- **Fail-closed ceremony and operator polish.** Exact configured ports are preserved, incomplete endpoints cannot create or scan codes, internet pairing never invents a LAN fallback, double-submit is idempotent, and exact CA/operator/epoch identity still gates every action. Copy-save errors stay beside their controls; keyboard, QR, navigation, lock, and connection affordances have accessible names and clear feedback. The Python SDK also accepts legacy empty inboxes encoded as `items: null`.
This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.10.0.
## Older releases
<details>
<summary>v11.9.2 - colleague-style federation management</summary>
**Federation now behaves like colleague sharing in CEREBRUM.** JOIN establishes exact node/operator trust but shares zero domains by default. Each SAGE independently chooses and changes existing domains for live **Read** or optional **Copy** after pairing; remote **Write** remains explicitly unavailable until a future connection-bound consensus authorization exists.
- **Connections that stay manageable.** Every active row opens into clear local-versus-remote permissions, current Read/Copy state, and domain selection. Pause temporarily disconnects a colleague without losing the pairing or saved choices; Resume reconnects immediately. Permanent revoke remains available in details, not as everyday clutter, and the peer receives a durable explanation instead of a mysterious failure. Revoked history is collapsed out of the main list.
- **A shorter, clearer trust ceremony.** The common path is two reciprocal QR scans followed by one six-digit anti-swap fingerprint check per person. The host's redundant pre-confirmation screen is gone; peer identity and the “trust only—no domains shared” boundary now live on the single real confirmation screen. Wide layouts keep both scan cards side by side, while narrow and short screens scroll cleanly around the camera preview.
- **Fail-closed under races and retries.** JOIN activation, permission replacement, Pause/Resume, revocation, peer notification, stale reconciliation, and policy-label delivery are linearized against the exact CA/operator/epoch agreement generation. An old generation cannot disclose a newly built domain list, overwrite a fresh pairing, resurrect retired access, or clear a concurrent operator Pause.
This patch changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.9.2.
</details>
<details>
<summary>v11.9.1 - task-marker correctness and release hardening</summary>
**Task creation applies the `[TASK]` marker exactly once.** MCP `sage_task` and CEREBRUM's task-creation path preserve content that is already marked instead of storing `[TASK] [TASK] ...`; unmarked content still receives the canonical prefix. Direct regression tests cover both entry points and both marked/unmarked inputs.
- A failed publication can be resumed only from the current protected `main` workflow and always checks out the exact immutable tag. The staged Python wheel smoke test installs declared runtime dependencies before importing the SDK.
- The four-validator partition proof accepts observed reject activity on either symmetric firewall endpoint while still verifying the exact peer topology on every node before, during, and after healing.
- The Go database, compression, TOML, and SQLite dependencies were refreshed through the full race and fault matrix. GitHub's Go, Node, and CodeQL actions remain pinned to immutable commits.
</details>
<details>
<summary>v11.9.0 - scoped consensus and colleague-style federation</summary>
> **Release evidence:** the exact-source `make v119-state-sync` cold run passed on source identity `7080580b15e7e5158a04e8b294ab772e51f294633be2737f904276afec4c3458`. The branch and tag workflows independently rerun the complete race, lint, SDK/frontend, security, fault, packaging, and publication gates before exposing release artifacts.
> **Validator rollout boundary:** install and restart the exact frozen v11.9 artifact on **every participating validator** before anyone broadcasts the non-empty-domain `app-v20` / target-20 ceremony transaction. A merely >2/3 upgraded subset is unsafe: v11.8 does not understand the signed governance-domain tail. For operator-managed socket-mode Comet, keep `recheck=true`, cap `max_tx_bytes` at 1 MiB, and restart Comet as well so no pre-rollout oversized mempool entry survives.
**Selected domains can now become canonical, recoverable quorum state inside one SAGE consensus chain.** App-v20 adds exact-domain scopes whose on-chain roster and integer weights are fixed by validator governance. Each scoped memory pins its submission-time denominator, so later membership changes cannot rewrite an in-flight ballot; acceptance requires strictly greater than two-thirds of that pinned weight. Scope membership grants voting weight only—it does not grant domain ownership, RBAC, federation access, or administrator authority.
- **Canonical recovery instead of projection trust.** Scoped content, classification, tags, roster revisions, and ballots are AppHash-covered in Badger. A recovering replica verifies the canonical envelopes and rebuilds its discarded SQLite/PostgreSQL serving projection; `/ready` stays unavailable when required scoped content is missing, locked, or inconsistent.
- **Authorized, boot-only network state sync.** Real ABCI state-sync endpoints serve a bounded latest-visible consensus stream, never the private local rollback bundle. A strict local authorization binds the chain, existing validator/provider IDs, joining node and validator key, app version, height floor, and expiry. The effective Comet profile disables peer discovery and ordinary peer capacity, enables authenticated exact-ID filtering, and requires two distinct reachable RPC origins for light-client verification. A synchronized receiver remains a non-validator until a separate signed governance action admits its validator key.
- **Crash-safe seal-before-serving.** A pristine receiver verifies the candidate in isolation, activates a complete application bundle under an exclusive lease, waits for Comet's signed commit/state/block-sync handoff, durably writes the sealed activation journal, durably disarms `quorum.state_sync.receiving`, cleans recovery evidence, and only then publishes the runtime seal. Projection rebuild, snapshots, REST/dashboard/MCP/federation, voters, and background workers start from that final frozen bundle.
- **Validator-bound governance sessions.** The configured operator signs the exact REST/MCP action, while the live validator still owns the outer transaction, proposal, vote, and voting power. App-v20 binds delegated governance proofs to the target validator and a chain-derived governance domain, with deterministic freshness and single-use replay protection.
- **Colleague-style sharing between independent SAGE brains.** A fresh JOIN establishes exact chain/operator/CA/epoch trust and starts with zero shared domains. Each peer independently selects existing domains and can change them without pairing again: Read borrows live recall, while Copy also requires the receiver's separate “Save here” opt-in. Cross-host Write remains an authenticated `501` until it has connection-bound consensus authorization. Direct and synchronization-group traffic revalidate the exact live identity, and agreement set, JOIN activation, narrowing, and revocation are linearized so a completed change cannot leave stale access in flight.
- **Crash-atomic app-v20 blocks.** The one authenticated app-v20 bootstrap is isolated into a dedicated block; after its marker commits, FinalizeBlock evaluates each complete block in one speculative Badger transaction. Commit atomically persists every ordinary/governance write, validator reconfiguration, nonce, AppHash, and handshake height. A pre-Commit crash discards the whole transition, so ordinary mixed blocks replay exactly without an app-local result journal or ongoing governance-only block isolation.
- **Release evidence spans real failures.** The gate suite combines signed app-v20 scope formation/revision in independent OS processes, FinalizeBlock/Commit SIGKILL replay, held-replica catch-up, real four-validator Comet TCP crash/partition/heal checks, and the integrated provider/observer/unauthorized/two-receiver state-sync topology. The final exact-tree cold execution passed before the release branch was published.
This is same-chain validator replication, not a relabeling of v11.8 synchronization groups or independent-chain federation. Internet validators still need mutually routable Comet TCP, explicit port forwarding, or an operator VPN, plus reachable RPC origins. Federation is not a validator tunnel; a future tunnel layer is separate work and is not part of v11.9.0.
App-v20 remains dormant until the governed upgrade activates it, preserving byte-identical pre-activation replay. A rolling binary install is safe only while the tagged target-20 ceremony has not been submitted. SDK 11.9.0.
</details>
<details>
<summary>v11.8.5 - anatomical MRI boundary</summary>
**MRI memories now remain inside the anatomical cranium at every zoom and rotation.** The memory cloud previously used a vertically symmetric ellipsoid even though the bundled anatomical mesh has a much shallower lower cranial boundary outside its narrow, off-centre brainstem. Lower-hemisphere nodes could therefore protrude through the mesh, especially after the v11.8.3 spread increase. CEREBRUM now uses an asymmetric vertical envelope with explicit clearance for each rendered sphere and bloom halo. The upper cortex keeps its full spread, and the newest-to-outer / oldest-to-inner age ordering is unchanged.
The placement contract is directly regression-tested across the full age, radial-jitter, and elevation range, including a fixed lower-cranium safety threshold. This patch changes no consensus rule, AppHash, transaction type, key encoding, fork, graph API limit, or server workload; existing chains replay byte-identically and app version 20 remains unallocated.
SDK 11.8.5.
</details>
<details>
<summary>v11.8.4 - actionable domain write denials</summary>
**Domain write denials now say what is wrong and how to fix it.** When consensus rejects a memory because its authenticated agent lacks level-2 write access to an owned domain, the REST API now returns a distinct, sanitized RFC 7807 `domain-write-denied` problem instead of collapsing it into a generic 403. MCP preserves that machine-readable type, immediately points the agent to CEREBRUM Access Controls or the domain owner, and performs no pointless re-registration, retry loop, or `/mcp` reconnect suggestion. Older servers' generic denial remains on the bounded compatibility recovery path.
The built-in CEREBRUM guide also explains SAGE's token-efficiency story without pretending every session necessarily uses fewer tokens: durable context lives outside any one model and only the relevant pieces are brought back, so token spend carries useful memory instead of repeated explanations and each tool rebuilding the same history.
This patch changes no consensus rule, AppHash, transaction type, key encoding, fork, or authorization decision; existing chains replay byte-identically and app version 20 remains unallocated.
SDK 11.8.4.
</details>
<details>
<summary>v11.8.3 - anatomical MRI memory spacing</summary>
**A memory brain that uses its full anatomy while keeping age meaningful.** CEREBRUM now spreads its 2,500-memory representative sample through a substantially broader portion of the MRI mesh instead of crowding long-lived histories into the centre. Fresh memories remain nearest the outer cortex; memories move progressively inward as they age, and the oldest cohort settles toward the lower inner brainstem. A one-year age window replaces the old 90-day clamp, while a small deterministic radial offset separates same-age memories without turning the stable layout into a force simulation.
The placement calculation now lives in a pure, directly tested module with bounded mesh extents and monotonic age-to-depth checks. This patch changes no consensus rule, AppHash, transaction type, key encoding, fork, graph API limit, or server workload; existing chains replay byte-identically and app version 20 remains unallocated.
SDK 11.8.3.
</details>
<details>
<summary>v11.8.2 - synchronization groups and a denser MRI</summary>
**Synchronization groups — human-verified, signed memory sharing between separate SAGE brains.** A synchronization group coordinates memory sharing off-consensus through a partitioned, hash-chained, ed25519-signed audit journal: a roster sub-chain replicated to every member and independent per-domain sub-chains replicated only to the members who share that domain, so a node never learns of a domain it does not share. Group items are origin-signed, so a relaying peer can back-fill the mesh without being able to forge or mis-attribute them. Adding a shared domain is a two-party action — the owning member and the group controller both sign — members express selective-sync consent over the subset of domains they receive, and controller epoch rotation, member removal, and rejoin are all explicit signed roster events reconciled between peers by anti-entropy exchange.
At the time of v11.8.2, each MCP bearer minted and registered its own signing identity. Current app-v23 behavior supersedes that design: v11.18.26 binds new bearers to existing approved locally managed agents so token creation cannot strand an unapprovable identity. This release also hardens group authorization: a controller epoch rotation now re-attests the shared domain set under the incoming controller, so rotating control away from a node revokes that node's ability to admit or re-widen shared domains with its old key; and a removed or departed member cannot be silently re-activated with stale entitlements — re-entry requires a fresh, co-signed invitation. The v11.8 consensus fork gate is present but dormant.
The CEREBRUM MRI now renders a 2,500-memory representative sample instead of stopping at 500, filling large brains with a denser view while preserving a bounded GPU and API workload. The dashboard and fullscreen MRI share one limit, and operators can still tune the server ceiling with `SAGE_GRAPH_MAX_NODES`.
v11.8.2 is the first published build of the v11.8 line. It also clears the release lint gate and adds a replay-safety regression guard for the delegated-proof rules already committed by v11.7.6 and v11.7.7 chains. The recovery changes no production behavior beyond the reviewed v11.8 source tree apart from the denser MRI visualization.
SDK 11.8.2.
</details>
<details>
<summary>v11.7.7 - one CEREBRUM tab in Firefox</summary>
**One CEREBRUM tab in Firefox, including across app restarts.** v11.7.7 fixes the remaining macOS launch path that could create duplicate CEREBRUM tabs. The earlier tab-focus implementation could inspect Safari and Chromium-family tabs, but Firefox exposes no equivalent AppleScript tab API; the native app also incorrectly assumed a newly started tray process could not inherit a browser tab left open by the previous process. SAGE now checks a loopback-only live-dashboard presence signal before opening a URL and activates the default browser when CEREBRUM is already connected. Initial app launch, post-update restart, dock reopen, and the **Open CEREBRUM** menu all use the same reuse path.
This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.
SDK 11.7.7.
</details>
<details>
<summary>v11.7.6 - reliable MCP turns and complete task cards</summary>
**Reliable MCP turn writes and task cards that show the whole job.** v11.7.6 fixes two post-app-v17 delegated-proof failures that v11.7.4 exposed after making the node authoritative for embeddings. Consensus now keeps every agent-controlled memory field bound to the exact signed request while accepting the validator-signed node's derived embedding hash, so provider cutovers no longer turn valid `sage_turn` observations into opaque CheckTx rejections. Fresh requests also survive the first block after a long idle period even when deterministic chain time trails the already wall-clock-validated MCP request; captured old proofs remain rejected. Public REST/MCP errors now distinguish proof mismatch and expiry from a generic `request rejected`.
CEREBRUM task cards stay compact by default but can expand to show complete multiline text. Planned tasks can be edited and saved without rewriting consensus history: SAGE confirms a replacement task first, then retires the original card. Existing committed blocks replay byte-identically; this patch changes only admission of requests that older binaries incorrectly rejected.
SDK 11.7.6.
</details>
<details>
<summary>v11.7.5 - readable contextual help</summary>
**Readable contextual help at every CEREBRUM boundary.** Help tooltips now account for the nearest scroll-clipping container as well as the browser viewport, so hints near the top of Settings and other bounded panels flip downward instead of opening behind the fixed application chrome. The positioning check runs after the tooltip is rendered and keeps keyboard/focus behavior intact. This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.
SDK 11.7.5.
</details>
<details>
<summary>v11.7.4 - provider-safe Smart Memory and CEREBRUM launch</summary>
**Provider-safe Smart Memory, automatic repair, and one CEREBRUM tab.** The SAGE node is now authoritative for every stored vector: it regenerates agent submissions with the selected embedding provider, stamps the exact vector space, and filters vector recall to that same space. Switching between preferred Ollama embeddings and local hash embeddings cuts write/query authority over before background migration, so active agents cannot keep a migration alive forever and recall never compares incompatible vectors. Provider recovery is watched continuously, so vectorless observations left by a transient outage repair automatically after Ollama or another configured embedder returns. New MCP clients still attach a compatibility vector for older SAGE nodes, while v11.7.4 nodes safely regenerate it.
CEREBRUM Settings now presents Ollama/hash embeddings and the independent reranker On/Off control directly, and the top status strip shows reranker state. The macOS dock app focuses an existing localhost CEREBRUM tab before opening a new one, with bounded browser automation and a safe fallback. PostgreSQL mirrors the embedding-provider provenance used by personal SQLite nodes. This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.
SDK 11.7.4.
</details>
<details>
<summary>v11.7.3 - strict project memory, task ownership, and Settings efficiency</summary>
**Strict project memory and task ownership, plus a cooler Settings page.** `sage_turn` now treats its domain as an exact recall boundary, so one repository's session cannot be re-anchored by memories from another repository. Agent backlogs return only tasks whose assignee exactly matches the signature-verified agent ID; unassigned work stays in human CEREBRUM triage and cannot be self-claimed. Agent-created tasks are assigned to their creator, every `in_progress` task must have an owner, and historical ownerless running rows return to Planned on upgrade. Assignment also remains subject to the agent's domain-access policy.
CEREBRUM no longer polls health, full memory statistics, and the complete agent inventory every three seconds. Health refreshes at a calmer interval, the existing health payload supplies memory totals without a duplicate full-store scan, agents load only when Overview is visible, and all Settings polling pauses in background tabs. An RBAC save that fails on-chain now says clearly that access is not active and keeps Save enabled for an actual retry. This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.
SDK 11.7.3.
</details>
<details>
<summary>v11.7.2 - secure background updates and CEREBRUM fixes</summary>
**Background macOS updates are back, without compromising the signed app.** SAGE now downloads and installs directly from the update banner, verifies the architecture-specific DMG against its published SHA-256, mounts it read-only, enforces the expected bundle identifier and Developer ID team, and asks Gatekeeper to validate both the release app and its staged copy. Activation atomically exchanges the entire signed `SAGE.app` bundle while preserving the previous bundle for proof-of-boot rollback. CEREBRUM also restores Access Controls, fixes Task Board page scrolling, and isolates the live block countdown so it no longer re-renders the entire Settings screen. Existing chains replay byte-identically.
SDK 11.7.2.
</details>
<details>
<summary>v11.7.1 - smart-memory reliability and task-board maintenance</summary>
**Smart-memory reliability and task-board maintenance release.** Managed Smart Memory now stays managed: SAGE supervises the local Ollama runtime, adopts it across upgrades, and automatically restarts it after a crash instead of leaving semantic recall offline until manual repair. CEREBRUM tasks, imports, and pipeline journals now preserve embedding provenance, so newly indexed memories no longer drift back into the “needs fixing” queue after a successful repair. The task board also correctly fills the remaining application height, keeping the bottom of every column reachable. This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.
SDK 11.7.1.
</details>
<details>
<summary>v11.7.0 - administration, connection, and lifecycle</summary>
**Administration, connection, and lifecycle release.** The genesis admin can now give a locally installed agent read or read+write access to a domain another agent owns, directly from CEREBRUM: the original owner is shown before confirmation, bound into the consensus transaction, and the override is recorded as an ordinary on-chain grant/revoke. Consensus support ships behind the dormant `app-v18` gate; existing chains replay byte-identically. Connecting AI tools now follows OpenAI's current product surfaces: ChatGPT desktop's Codex mode gets a one-click app-wide local connection (shared with Codex CLI and the IDE extension), while ChatGPT Work uses the hosted connector path. Restarts and updates are coordinated end-to-end: a single-instance lock, clean draining of MCP sessions and dashboard streams, checksum-verified updates with automatic rollback and proof-of-boot verification. CEREBRUM now checks for new releases automatically and shows an update banner at the top of every page, with release notes and a direct path to update or restart options. This release also fixes the v11.6.1 reports of intermittent lost MCP connections and "cannot save to domain" errors (a boot-time key cache, transport blips mislabeled as permission denials, and a keep-alive race), hardens the HTTP MCP transport (operator-only bearer principal, nonce replay cache, exact origin allowlist), and rewrites the in-app CEREBRUM guide in plain language for non-technical users.
SDK 11.7.0.
</details>
<details>
<summary>v11.6.1 - security + task-handoff maintenance</summary>
**Security and task-handoff maintenance release.** v11.6.1 upgrades the transitive federation dependency quic-go to 0.59.1, incorporating the upstream fix for CVE-2026-40898. Assigned board tasks now reliably appear across provider boundaries, create dedicated one-way agent inbox notices, and are checked alongside backlog at agent boot. CEREBRUM also replaces browser-native confirmation prompts with accessible, themed SAGE dialogs. It changes no SAGE consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.
SDK 11.6.1.
</details>
<details>
<summary>v11.6.0 - internet federation + controlled memory sync</summary>
**SAGE federation can now travel with you, and selected memories can become a shared, durable two-node brain without turning the relay into a trusted server.** v11.6.0 is an off-consensus connectivity, replication-control, and UX release: it changes no consensus rule, AppHash, transaction type, key encoding, or fork. `app-v17` remains shipped-dormant until governed activation, and existing chains replay byte-identically.
- **Pair across the internet without port-forwarding.** Current CEREBRUM prepares direct and secure-relay candidates behind one connection flow; v11.6 introduced the bounded libp2p route bundle, NAT traversal, and Circuit Relay v2 fallback that make that possible. Federation mTLS, the pinned CA, active treaty, and signed requests remain the trust boundary; the relay sees encrypted bytes and connection metadata, never plaintext memories or federation keys.
- **LAN relationships roam without re-pairing.** A legacy-shaped LAN QR stays compatible with older guests. Once two v11.6 nodes finish signing, they exchange relay/direct routes over the authenticated agreement, persist them atomically, and can move LAN → internet → LAN without changing federation identity.
- **Memory sync is host-controlled and off by default.** After signing, the host can leave copying off or choose concrete domains permitted by both treaty scopes and local domain ownership. The selected set is the complete bidirectional replication allowlist; the guest can view it or disconnect, but cannot widen it. Existing pre-v11.6 links retain their legacy bilateral behavior until they re-pair.
- **Offline catch-up keeps domain boundaries intact.** The existing durable outbox and anti-entropy engine now propagate versioned host policy before data, preserve user tags, retry across restarts and outages, and catch a returning peer up. Memories outside selected domains never enter the sync outbox.
- **Crash-safe no-forward provenance.** A received copy is durably quarantined before its local consensus submission. Ambiguous timeouts, restarts, and revocation cannot make a foreign copy look native or leak into A→B→C forwarding; exact mirrors promote without rebroadcast, while identity mismatches fail closed.
- **Federation remains opt-in.** A fresh or upgraded node does not contact the project relay while federation is disabled and no persisted peer routes exist. The shipped relay is a connectivity dependency for relay-only paths, not a validator or memory store; operators can configure their own relay multiaddrs.
SDK 11.6.0.
</details>
<details>
<summary>v11.5.0 - quorum-governed memory lifecycle + pipe hardening</summary>
**Quorum-governed memory lifecycle plus pipe anti-DoS hardening: a two-phase challenge whose bar scales to the network, a first-class reinstate verb, disputed-but-recallable memories, and size caps and quotas on the agent pipe.** v11.5.0 introduces a new consensus fork **`app-v17`** that ships **dormant** - it changes no live-chain behavior until a network activates it through the governed upgrade ladder (a 2/3 quorum vote, past a 200-block floor). Until then `app-v15` stays the active v11 consensus fork, `app-v16` stays shipped-dormant, and historical replay of every existing chain stays **byte-identical**. The pipe hardening is off-consensus and active on upgrade.
- **Deprecation gates on a quorum that scales to the network (opt-in fork).** When a memory is challenged, `app-v17` counts the distinct modify-verb holders on its domain from committed state - the owner, ancestor-domain owners, and unexpired level-3 grantees, enumerated in sorted order. A personal node with one holder keeps the byte-identical legacy one-strike deprecate; where two or more holders exist the memory is parked as **challenged**, and a second, distinct holder must confirm before it deprecates - the original challenger cannot self-confirm. So a small-LAN node and a large federation apply proportionate bars instead of one hardcoded threshold.
- **Reinstate is a first-class verb again (opt-in fork).** A new `app-v17` transaction, `TxTypeMemoryReinstate`, takes a **challenged** memory back to **committed**, restoring its original content hash from the challenge record; a challenger who wants to withdraw rides the same tx even if their grant has since expired or been revoked. It is reachable through REST (`POST /v1/memory/{id}/reinstate`), MCP (`sage_reinstate`), the Chrome bridge, and both Python SDK clients.
- **Delegated agent proofs are action-bound on-chain (opt-in fork).** When a REST node signs a transaction for a different agent, `app-v17` carries the exact canonical signed request in a backward-compatible optional envelope. Consensus re-hashes and re-verifies it, reconstructs the authorized type-specific payload, applies the ±5-minute window against deterministic block time, and consumes an AppHash-folded proof marker once. A captured proof cannot be transplanted onto another action or rewrapped under a fresh node nonce. Node-originated transactions signed end-to-end by the same key keep the existing outer-signature + nonce path.
- **Challenged memories stay recallable, clearly marked.** A memory under a two-phase challenge is no longer hidden while the dispute resolves: recall (REST and MCP) still returns it with a new **`disputed`** flag set and a query-time confidence haircut already applied to `confidence_score`, so an agent sees the marker and the softened score instead of silently losing the memory.
- **The agent pipe has anti-DoS guards on every write path.** Pipe payloads and results are capped at 256 KiB and intents at 8 KiB at the store chokepoint, with matching **413** fast-fails in the REST and dashboard handlers. Open pipes are quota'd - **256** per verified agent identity, **10000** node-wide - checked and inserted under one write lock so a parallel burst cannot race past the cap, then rejected as **429 with Retry-After** (the same backpressure recipe as a full mempool). The quota keys on the Ed25519-verified `from_agent`, not the spoofable rate-limit header.
- **Stale pipes can't pile up.** A retention backstop force-expires pending or claimed pipe rows older than 48h regardless of their stamped TTL, wired into the existing 5-minute sweep plus a new boot one-shot; terminal rows still purge 24h after creation, and the dashboard's TTL input is now clamped to 24h.
- **CEREBRUM explains itself.** Polished hover/focus tooltips are on by default, with detailed explanations for every sidebar destination and consistent upgrades for existing icon, status, filter, and settings hints. They stay keyboard-accessible, avoid viewport clipping, and can still be disabled under **Settings → Maintenance → Preferences**.
SDK 11.5.0.
</details>
<details>
<summary>v11.4.11 - managed ChatGPT tunnel setup</summary>
**ChatGPT setup is now a background-managed CEREBRUM flow.** v11.4.11 is an off-consensus UX and packaging patch - it changes **no consensus rule, AppHash, transaction type, key-encoding, or fork**: `app-v15` stays the active v11 consensus fork, `app-v16` stays shipped-dormant, and historical replay stays **byte-identical**.
- **No terminal needed for ChatGPT.** The ChatGPT setup wizard now downloads the pinned OpenAI `tunnel-client`, writes the local profile, and starts the daemon from inside CEREBRUM. The user only opens the OpenAI and ChatGPT browser tabs.
- **The generated MCP command uses the running SAGE app.** CEREBRUM gets the real `sage-gui` executable path from the backend instead of assuming `sage-gui` is on PATH, so macOS app-bundle installs work.
- **The tunnel client avoids SAGE's port.** The managed `tunnel-client` admin UI binds `127.0.0.1:8081`, leaving SAGE's dashboard on `127.0.0.1:8080`.
- **No fake secret in copyable commands.** The runtime API key is accepted once to launch the child process and is not written to the profile or preferences. Advanced manual commands use an explicit placeholder, not a valid-looking `sk-...`.
- **Patch-release metadata is current.** The SDK, Docker/MCP registry metadata, dashboard fallback version, and release notes are bumped together for 11.4.11.
SDK 11.4.11.
</details>
<details>
<summary>v11.4.10 - join ceremony fix + MCP registry publishing</summary>
**Connecting two SAGEs works again.** v11.4.10 is an off-consensus bug-fix patch - it changes **no consensus rule, AppHash, transaction type, key-encoding, or fork**: `app-v15` stays the active v11 consensus fork, `app-v16` stays shipped-dormant, and historical replay stays **byte-identical**.
- **The join ceremony completes.** A URL-building regression in v11.4.8/v11.4.9 made the guest's "did they approve yet?" check fail silently, freezing every new connection at "1 of 2 confirmed" on both screens. The guest now sees the host's approval and the ceremony finishes.
- **The wizard tells you what's wrong.** If the guest can't check the host's side, the waiting screen now shows the actual reason instead of a generic network hint.
- **Read-back copy is clearer.** The host's "read this code" instruction now uses the other network's name.
- **The public MCP registry stays current.** Releases now publish SAGE's server manifest to the MCP registry automatically, and the public listing was refreshed to the current version.
- **Patch-release metadata is current.** The SDK, Docker/MCP registry metadata, dashboard fallback version, and release notes are bumped together for 11.4.10.
SDK 11.4.10.
</details>
<details>
<summary>v11.4.9 - ChatGPT via OpenAI Secure MCP Tunnel</summary>
**ChatGPT setup now follows OpenAI's official Secure MCP Tunnel path.** v11.4.9 is an off-consensus UX and packaging patch - it changes **no consensus rule, AppHash, transaction type, key-encoding, or fork**: `app-v15` stays the active v11 consensus fork, `app-v16` stays shipped-dormant, and historical replay stays **byte-identical**.
- **ChatGPT is first-class in Connect an AI tool.** The setup menu now shows ChatGPT directly instead of hiding it behind the generic remote-tool branch.
- **OpenAI Secure MCP Tunnel is the ChatGPT path.** The wizard gives a copyable `tunnel-client` runbook for SAGE's local stdio MCP server. No domain, no public SAGE URL, and no inbound firewall rule.
- **Remote-tool copy is clearer.** Non-ChatGPT remote tools now point to LAN/VPN or a reachable HTTPS endpoint you manage instead of mixing those cases into the ChatGPT flow.
- **Patch-release metadata is current.** The SDK, Docker/MCP registry metadata, dashboard fallback version, and release notes are bumped together for 11.4.9.
SDK 11.4.9.
</details>
<details>
<summary>v11.4.8 - join hardening + release maintenance</summary>
**The join ceremony guardrails are tighter, and the release pipeline is cleaner.** v11.4.8 is an off-consensus reliability and release-maintenance patch - it changes **no consensus rule, AppHash, transaction type, key-encoding, or fork**: `app-v15` stays the active v11 consensus fork, `app-v16` stays shipped-dormant, and historical replay stays **byte-identical**.
- **Join ceremony endpoint handling stays LAN-first.** The federation join client accepts only localhost/private-LAN endpoints, canonicalizes the base URL, and re-checks the destination in the HTTP transport at dial time.
- **Train-of-thought columns read cleaner.** Empty MRI related-memory columns now say "None yet" instead of a placeholder dash.
- **Release automation pins move in lockstep.** The analysis workflow now keeps its setup and reporting steps on the same action version, avoiding mixed-version release noise.
- **Patch-release metadata is current.** The SDK, Docker/MCP registry metadata, dashboard fallback version, and release notes are bumped together for 11.4.8.
SDK 11.4.8.
</details>
<details>
<summary>v11.4.7 - dependency refresh + release hardening</summary>
**Dependencies are current, agent pipeline replies are claimant-bound, and release gates now cover the nested natter module.** v11.4.7 is an off-consensus dependency and release-hardening patch - it changes **no consensus rule, AppHash, transaction type, key-encoding, or fork**: `app-v15` stays the active v11 consensus fork, `app-v16` stays shipped-dormant, and historical replay stays **byte-identical**. Everything here lives in dependency pins, local SQLite pipeline metadata, federation seed-at-rest handling, and CI/release automation.
- **Natter dependency refresh.** The nested `natter` Go module now carries the updated `quic-go`, `x/crypto`, and `x/net` dependency line, plus the matching `x/*` tidy updates. This keeps the optional connectivity service ready for the v11.5 internet-federation work without spending an app-version slot.
- **Agent pipeline claim/result hardening.** Pipeline claims now record `claimed_by`, and result submission is accepted only from the authenticated claimant (or a safe legacy recipient path for already-claimed pre-upgrade rows). Unrelated callers still get anti-enumeration 404s, senders can read their own pipe status but cannot complete recipient work, and failed/forged result attempts no longer create auto-journal memories.
- **Federation TOTP seeds follow the vault.** When a node starts with the vault already unlocked, federation TOTP seeds are wrapped at rest using that passphrase; legacy plaintext seed envelopes still load for backward compatibility. Changing the passphrase clears stale in-memory seed candidates before reload.
- **Release gates now see the real tree.** CI and release workflows now lint/test the nested `natter` module, run a cheap first-party JavaScript syntax check, and Dependabot is configured for root Go, `natter`, npm, the Python SDK, and GitHub Actions.
SDK 11.4.7.
</details>
<details>
<summary>v11.4.6 - network name + join reliability + QR lightbox + agent grouping</summary>
**Give your network a real name, connect without getting stuck, and scan a code your laptop camera can actually read.** v11.4.6 is an off-consensus federation reliability + UX release - it changes **no consensus rule, AppHash, transaction type, key-encoding, or fork**: `app-v15` stays the active v11 consensus fork and `app-v16` stays shipped-dormant, and historical replay stays **byte-identical**. Everything here lives on the federation transport (mTLS on `:8444`, outside consensus), a local display table, and the dashboard.
- **Name your network.** Your network was only ever identified by its raw id (something like `sage-personal-ybly7j6fzxp5n4zsvomjzway4w`) - so when someone tried to join you, that unreadable string was all you saw. You can now give your network a **friendly name** (e.g. "Dhillon's MacBook") from the Federation page. Peers see it during a join - the host's review step reads *"Dhillon's Mac wants to connect"* - and it labels the row in each side's connections list. The name is a cosmetic label carried alongside the permanent id, which never changes: it's **not** used to verify anyone (the scanned/spoken code still is that anchor), and it never touches the chain.
- **Joining no longer gets stuck at the last step.** A guest waiting for the host's approval polls for it every couple of seconds; that legitimate polling could trip the join listener's abuse rate-limit, so the host's approval sometimes never reached the guest and the ceremony hung on "waiting for them." The rate limit now separates read-only status polling (generous) from code-submitting steps (still tight), so a normal join always completes; a stalled connection now surfaces a reason instead of spinning forever.
- **A QR your webcam can lock onto.** Scanning with a laptop's built-in camera pointed at another laptop across a desk was fiddly. Click the QR (or **"Make it bigger"**) to blow it up to a full-screen, high-contrast code. The host's connection code also shows **immediately** now instead of behind an extra click, and the whole join flow is centered and written in plainer language.
- **Arrange your agents into groups.** On the Agents page you can now **drag one agent onto another to group them** - handy for organizing by machine or purpose - with collapsible, renamable groups. It's a local view convenience only; it changes nothing on the network.
- **ChatGPT setup wizard reads straight.** The "Connect to ChatGPT" wizard's callout used to point at a flow that can't list ChatGPT (OpenAI connectors need a public URL), and a mixed-content banner rendered scrambled. Both are fixed - the copy now says plainly that ChatGPT always needs the tunnel, and the banner lays out in order.
SDK 11.4.6.
</details>
<details>
<summary>v11.4.5 - federation opt-in + domain-sync preview + reliability</summary>
**Federation grows up: it's opt-in behind one master switch, it survives restarts and hours-long peer outages, and a topic's memories can now be copied across a link, not just borrowed live.** v11.4.5 is an off-consensus reliability and federation-UX release - it changes **no consensus rule, AppHash, transaction type, key-encoding, or fork**: `app-v15` stays the active v11 consensus fork and `app-v16` stays shipped-dormant, and historical replay stays **byte-identical**. Everything here lives on the federation transport (mTLS on `:8444`, outside consensus) and the dashboard; domain sync admits a copied memory as an ordinary locally-signed `MemorySubmit` on the receiver's own chain, so there is no new transaction and no fork.
- **Federation is opt-in now, behind one switch.** A fresh or upgraded node accepts **no** inbound connections until you turn federation on - upgrading never silently opens the `:8444` port. The Federation panel gains a master **On/Off** switch at the top, and the same toggle stays in Settings, so the control is discoverable in both places. While it's off, the join/host cards are hidden with a nudge to turn it on; when on, the listener still only admits peers pinned to an agreement you approved (on your LAN or a route you provide).
- **Domain sync (preview): copy a topic across a link, not just borrow answers.** A federated connection has always let each side *borrow* answers live within shared topics; now you can also *copy* a topic's memories across so they live on both brains. It's built from a durable outbox, an anti-entropy digest that reconciles what each side is missing, and a commit-tail watcher, and it stays **off until both sides turn it on** for a given topic. Copied memories are admitted on the receiver as ordinary locally-signed submissions - no new transaction type, no fork.
- **Federation survives being offline.** A peer that goes dark for hours no longer costs you the backlog: transport and environmental errors (peer offline, not-yet-upgraded, vault locked) no longer count toward the give-up cap, so queued memories keep retrying and drain when the peer returns. The rotating-seed cache is now loaded at boot, so federation no longer stops working after a node restart. Undeliverable and rejected items surface in the dashboard with a **resend** control and an out-of-office-style reason, so nothing fails silently.
- **A dashboard crash is fixed.** The Settings page (and the new Federation panel) could hit a `ReferenceError` that froze the section; the shared status-dot helper is now module-scoped so both render cleanly.
- **Groundwork for v11.5 internet federation.** The optional `natter` connectivity service (a separate binary, outside the SAGE trust boundary) gains a coordinator-only mode and explicit address advertisement for cloud hosts - plumbing for the NAT-traversal/relay work that lands as the v11.5 headline. Built-in internet traversal is **not** in v11.4.5 yet; federation today is LAN or a route you provide.
SDK 11.4.5.
</details>
<details>
<summary>v11.4.0 - search-selection "Transfer to agent" entry point for domain reassign</summary>
**Handing a memory's domain to another agent is now one click from the search results themselves.** v11.4.0 is a dashboard-only feature release: it changes **no consensus rule, AppHash, transaction type, key-encoding, or fork** - `app-v15` stays the active v11 consensus fork and `app-v16` stays shipped-dormant, and historical replay stays **byte-identical**. The new control reuses the existing v11.3 on-chain reassignment path, so there is no new transaction and no server change.
- **"Transfer to agent" from the memory selection.** The Search-page bulk action bar gains a "Transfer to agent" action alongside Move, Tag, and Forget: select one or more memories, pick a new owner, and their whole RBAC domain's ownership is handed over on-chain. This complements the existing filter-row "Transfer domain ownership" button (which starts from a source agent) with a second, more direct entry point that starts from the memories you are looking at. Both drive the same honest whole-domain transfer: it moves the **entire domain** (every memory in it, including ones not selected), transfers **ownership plus read/write access, not authorship** (`submitting_agent` stays immutable and auditable), and the previous owner is fully revoked. When a selection spans several domains, each is transferred in turn, and the confirmation copy spells out that unselected memories move too.
SDK 11.4.0.
</details>
<details>
<summary>v11.3.1 - dependency maintenance + tx-encoder overflow guard</summary>
**A maintenance patch: `golang.org/x/crypto` is refreshed, and a latent transaction-encoding overflow is closed.** v11.3.1 changes **no consensus rule, AppHash, transaction type, key-encoding, or fork**: `app-v15` stays the active v11 consensus fork and `app-v16` stays shipped-dormant, and historical replay stays **byte-identical**. Both fixes sit off the consensus hot path.
- **`golang.org/x/crypto` 0.51.0 to 0.52.0.** Keeps the crypto dependency line current for the `argon2` and `hkdf` packages SAGE actually imports.
- **The transaction encoder bounds the payload length.** `EncodeTx` now rejects a payload larger than `MaxInt32` up front, so the total-length arithmetic cannot overflow and the 4-byte length prefix cannot silently truncate a pathologically oversized transaction. This mirrors the guard `DecodeTx` already had. No real transaction approaches this size, so behavior is unchanged for all valid traffic.
SDK 11.3.1.
</details>
<details>
<summary>v11.3.0 - on-chain RBAC domain-ownership transfer + enforcing access matrix</summary>
**Transferring a domain to another agent, and setting who can read and write it, are now real on-chain RBAC operations from CEREBRUM - and the access matrix finally enforces what it shows.** v11.3.0 changes **no consensus rule, AppHash, transaction type, key-encoding, or fork**: `app-v15` stays the active v11 consensus fork and `app-v16` stays shipped-dormant, unchanged from v11.2.x. The RBAC domain-ownership transfer is built entirely from **existing** on-chain transactions - `DomainReassign` (tx-30), `AccessGrant` (tx-6), and `AccessRevoke` (tx-7), gated by an existing `gov_propose` (`operation=domain_reassign`) - so there is no new transaction and no new fork. There is exactly **one consensus-path code change** (`applyGovernanceProposal` now returns early for `OpDomainReassign` instead of falling through to validator-pubkey derivation, which logged a spurious error on every reassign), and it is proven **AppHash-neutral**: the caller appends a validator update only when the result is non-nil, so both the old error path and the new clean return append nothing - identical validator updates and state writes, so historical replay stays byte-identical, with only the error log gone. Memory **authorship (`submitting_agent`) is never rewritten** by any v11.3 path.
- **RBAC domain-ownership transfer, on-chain from CEREBRUM.** A new Search-page action "Transfer domain ownership" lets you pick a source agent, pick one of its domains, and hand it to a target agent. The historical v11.3 orchestration was all commit-confirmed: a governance proposal (`domain_reassign`) was accepted by the sole validator, `DomainReassign` flipped the owner and purged the domain's stale grants, and a redundant `AccessGrant` mirrored the new owner's access. App-v26 retires that trailing self-grant: canonical ownership itself gives immediate policy-limited authority, so transfer no longer depends on CEREBRUM holding the target private key. This transfers **ownership and current authority, not authorship** - every memory stays authored by whoever wrote it (`submitting_agent` is immutable and auditable), and the new owner gains access through ownership rather than by rewriting history. The old label-based "Transfer by Tag" paths, which rewrote authorship off-chain, are retired.
- **The access matrix now enforces what it shows.** The per-agent read/write Domain Access matrix previously wrote only a cosmetic JSON blob that the consensus access checks never read, while the tooltip claimed "enforced on every request." On Save it now issues real on-chain `AccessGrant` / `AccessRevoke` transactions (signed as the domain owner), diffed against the actual on-chain grant state so it is idempotent and self-healing. Per-domain results are reported honestly (including "you do not hold this domain owner's key" skips), and the misleading copy is corrected. No admin-bypass was added to the consensus grant/revoke handlers.
- **CEREBRUM light theme plus MRI redesign.** A full light-mode theme lands for the dashboard (persisted, with a sun/moon toggle), including a light-mode render of the 3D MRI memory brain. The MRI layout now places memories by recency - recent at the surface, older deeper - with a draggable, width-auto-fitting "Domain tags" side panel.
- **Search date filters plus `sage_rename`.** The Search page gains a created-at date-range filter and a "Last hour" preset. A new `sage_rename` MCP tool renames an agent's display name and boot bio on-chain (via `AgentUpdate`), failing closed to preserve the existing bio - an agent rename, not a memory or domain rename.
- **The version badge reads live.** The CEREBRUM version badge (header and Overview node card) now reads the live node version from `/health` instead of a hard-coded constant, with the fallback constant kept in sync with the release.
SDK 11.3.0.
</details>
<details>
<summary>v11.2.1 - sage_turn resilient to transient Ollama embed flakiness</summary>
**A reliability patch: `sage_turn` (and all embedding-backed recall/store) no longer fails on transient Ollama hiccups.** Agents reported intermittent embed errors — the local embedder (`nomic-embed-text`) blipping or disconnecting "from time to time." The root cause was the embedder client: a single, unretried request with no `keep_alive`, so Ollama's default 5-minute idle unload meant the next embed paid a cold model reload that could time out or fail. `sage_turn` embeds twice (recall + store), so the flakiness hit both legs. All fixes are off-consensus — no chain, fork, or API-contract change.
- **The embed model stays resident.** Every embed request now sends `keep_alive` (default `30m`, override `OLLAMA_KEEP_ALIVE`), so `nomic-embed-text` isn't unloaded between turns — eliminating the cold-reload behind most of the intermittent failures. Integer-form values (e.g. `OLLAMA_KEEP_ALIVE=-1` to pin it in memory) are translated to the wire form Ollama accepts.
- **Transient blips are retried; hangs fail fast.** The embedder client now retries a couple of times with backoff on transient errors (connection reset, model-loading `5xx`, empty result), but does *not* retry a timeout (a hung Ollama fails in one attempt instead of multiplying the wait) or a `4xx`.
- **An embedder outage never drops a `sage_turn` observation.** If the embedder is genuinely down after retries, the memory is still committed (without a vector) rather than lost, and the turn now reports `store_mode: "no_vector"` + `semantic_degraded: true` so you know it isn't semantically recallable until a re-embed backfills the vector.
SDK 11.2.1.
</details>
<details>
<summary>v11.2.0 — min_confidence decayed-floor fix + app-v16 domainless-forget remediation</summary>
**Two correctness fixes: `min_confidence` recall now filters the value it reports, and legacy "un-forgettable" memories can be deprecated again.** v11.2.0 introduces a new consensus fork **`app-v16`** that ships **dormant** — it changes no live-chain behavior until operators activate it via a governance vote. The recall fix is off-consensus and active on upgrade.
- **`min_confidence` filters the decayed confidence it reports.** Recall (`/v1/memory/query`, `/search`, `/hybrid`, and `sage_recall`) filtered `min_confidence` against the *stored* confidence but returned the *decayed* value — so a `min_confidence=0.7` query could hand back a result whose `confidence_score` was 0.54. The floor is now enforced on the same decayed, task-aware value that's serialized, over the full candidate set before the top-K trim (so corroboration-boosted memories aren't starved and `top_k` fills correctly). A new **`initial_confidence`** field exposes the stored value alongside the decayed one; open tasks are exempt from decay; federated results are re-checked against the floor.
- **Legacy "no recorded domain" memories can be deprecated again (opt-in fork).** Memories committed before `app-v8.4` never received an on-chain domain record, so `forget()`/`challenge()` rejected them — with a cryptic error — even for their owner. The new **`app-v16`** fork adds a governance-attested **domain repair** (`OpMemoryDomainRepair`, 2/3 supermajority) that backfills the missing domain — idempotent, existence-guarded, never overwriting — after which normal deprecation works. The deprecation gate now returns an actionable **409** (legacy, needs repair) / **404** (unknown id) / **403** (unauthorized) instead of a generic rejection, and new submits must carry a domain so the state can't recur. **`app-v16` activates only via a governance `{Name:"app-v16", TargetAppVersion:16}` upgrade** — the release binary changes no consensus behavior until you vote it in.
SDK 11.2.0.
</details>
<details>
<summary>v11.1.0 — cross-node federation fix + health/observability polish</summary>
**Historical v11.1 release note.** v11.1.0 introduced a startup
**network-identity re-mint** for legacy nodes. That mechanism is retired and
disabled in v11.16.1 because it reset canonical history.
> **Safety update (v11.16.1):** the automatic legacy re-mint described in this
> historical release note is disabled. It deleted canonical Badger/CometBFT
> history and SQLite cannot reconstruct that authority. Legacy ids now remain
> unchanged until a history-preserving governed migration exists.
- **Historical v11.1 behavior (retired in v11.16.1).** v11.1 attempted to replace
the shared pre-v11 `sage-personal` network id during startup. That mechanism
reset canonical history and is now disabled. Affected legacy ids remain
unchanged until a governed, history-preserving migration exists.
- **Turning on encryption is discoverable.** The System Status "Synaptic Ledger Encryption" row now has an inline **Enable →** button (opens Settings → Security), instead of a dead-end "Off".
- **Idle chains are explained.** A new operator doc (`concepts/block-production-and-idle.md`) makes clear that a SAGE chain has no heartbeat — an idle chain mints no blocks, and a frozen height with an empty mempool is **healthy, not stuck**. `/v1/dashboard/health` now exposes `chain.idle` / `chain.stuck` / `last_block_age_seconds` so monitors alert on *stuck*, not a still height.
- **Embedding health is visible.** `GET /ready` now reflects the embedding provider: a down semantic embedder reports `degraded` (HTTP 200; `?strict=1` → 503) instead of a misleading `ready`, refreshed by a background watchdog. And `sage_recall` / `sage_turn` results carry `recall_mode` / `semantic_degraded` / `degraded_reason` so an agent knows when recall silently fell back to keyword-only.
- **Mempool backpressure signals.** New `GET /v1/chain/backpressure` (+ an `X-Sage-Mempool-Pct` header on every submit) lets clients pace writes without polling raw CometBFT RPC, and a mempool-full submit returns `429 + Retry-After` (a distinct problem type) instead of an opaque 500.
- **Guaranteed auto-commit is operable.** `--require-voter` / `voter.required` makes a deployment that needs automatic `proposed → committed` flow fail-fast rather than silently run voterless; `sage_voter_running` + `sage_proposed_oldest_age_seconds` metrics and a `/ready` voter block turn a stuck backlog into a first-class alarm; a new `concepts/voter-operations.md` runbook covers per-mode ownership, key safety, quorum math, and triage.
- **Safer upgrades + hardened archive extraction.** The pre-upgrade backup is verified by content (integrity + memory row-count parity) rather than file size, and an un-checkpointable write-ahead log aborts the migration instead of being discarded. Archive extraction for the managed Ollama runtime now validates symlink/hardlink targets against the extract root.
SDK 11.1.0.
</details>
<details>
<summary>v11.0.2 — managed Ollama setup + docs polish</summary>
**Smart memory setup now manages Ollama end to end.** v11.0.2 is a patch release on top of v11.0.1: no consensus rule, AppHash, transaction, key-encoding, or migration change. Existing v11 chains update in place; `app-v15` remains the active v11 consensus fork.
- **Managed Ollama runtime for semantic memory.** The CEREBRUM smart-memory wizard can now install a pinned Ollama runtime, start/adopt the local sidecar, pull `nomic-embed-text`, verify the embedding dimension, and remember the managed runtime preference across restarts. This gives Ollama the same dashboard-first setup path as the managed reranker.
- **Setup endpoints are wizard-gated.** The new install/start/pull routes run behind the dashboard setup security gate, and archive extraction refuses traversal, oversized payloads, incomplete downloads, and checksum mismatches before anything becomes active.
- **Trust and deployment wording is clearer.** The public Security FAQ now separates SAGE Personal from Enterprise threat models, calls out local BadgerDB/SQLite storage accurately, and tightens the GitHub Pages privacy copy so optional connector traffic is not confused with a SAGE-hosted relay.
- **Docs stay current with v11 code truth.** The reference docs, benchmark READMEs, SDK README, roadmap, and environment-variable notes are updated for the v11.0.2 surface without changing consensus semantics.
SDK 11.0.2.
</details>
<details>
<summary>v11.0.1 — MRI-first CEREBRUM polish + dependency update</summary>
**CEREBRUM is now fully MRI-first.** v11.0.1 is a launch-polish patch on top of v11.0.0: no consensus rule, AppHash, transaction, key-encoding, or migration change. Existing v11 chains update in place; `app-v15` remains the active v11 consensus fork.
- **MRI is the CEREBRUM view.** The legacy 2D brain option is no longer exposed in the dashboard. CEREBRUM opens directly into the 3D MRI memory brain, with the same offline three.js / 3d-force-graph bundle and anatomical mesh fallback path.
- **Focused memories are clearer and easier to leave.** Clicking a memory brings it into focus with a visible white focus ring, and clicking open space exits the focused train-of-thought view back to all memories.
- **Launch visuals now match the product.** The README leads with the real MRI brain screenshot, and the supporting screenshots are tracked with the docs so GitHub, package archives, and release pages show the correct launch surface.
- **Federation wording is tightened.** v11.0 federation is LAN-first, or reachable over a VPN/tunnel/operator-provided route. First-class internet/NAT traversal remains scoped for v11.5.
- **Dependency update.** `golang.org/x/net` is bumped to `v0.55.0` in the Go module graph.
- **Docs and SDK metadata are lockstep.** The Python SDK version, reference headers, roadmap status, and MCP/Docker registry metadata are bumped to 11.0.1.
SDK 11.0.1.
</details>
<details>
<summary>v11.0.0 — CEREBRUM, managed reranker, federation join ceremony</summary>
**CEREBRUM becomes a real control board, semantic memory turns on in a few clicks, one click stands up a managed reranker, and two SAGE nodes can now federate their memory over a secure LAN-first join ceremony.** v11.0.0 activates a new `app-v15` consensus fork and ships as a major version: every validator must run this binary and fully converge before the `app-v15` activation height (the auto-vote readiness gate enforces this on the governance path, so an unsupported upgrade never reaches quorum). Every existing chain replays byte-identically until activation (the fork gate is dormant pre-activation), and a node-by-node rolling upgrade is safe: a mixed v10.x / v11.0.0 cluster computes the identical AppHash while `app-v15` is dormant. On personal/single-validator nodes the auto-advance ladder reaches `app-v15` automatically.
- **CEREBRUM dashboard overhaul.** A new top-level **Overview** control board gives you a glanceable, read-only picture of the node: a status banner plus cards for chain health, quorum and nodes, agents, federation, and embeddings, each polling independently so one dead feed never blanks the board. The **3D MRI brain is now the default view**, and it renders fully offline (three.js and 3d-force-graph are bundled locally instead of pulled from a CDN); established memories pull to the core and fresh ones ride to the rim, and clicking a memory blooms its "train of thought" as a labelled constellation with a side panel you can hop through. **Search is real full-text plus semantic** now (FTS5, relevance-ranked, RBAC-scoped) instead of a client-side filter over the newest 100, with status filters (all / committed / proposed / deprecated), corroboration counts, an editable memory domain, and **bulk curation** (multi-select with an action bar). A live **Tasks board** shows agent-vs-human authorship, supports drag-to-status, and uses an atomic compare-and-swap claim so two agents never double-work an assignment, and a **Messages tab** (the agent-to-agent pipeline, merged into Tasks) adds a human-to-agent note composer so a person can drop a note into an agent's inbox without impersonating one. A **first-run onboarding wizard** (welcome, semantic memory, connect an AI tool, pointers) shows only on a fresh node and is re-runnable any time from Settings > Maintenance > Run setup.
- **Semantic memory made effortless.** A "Turn on smart memory" flow switches the node off the keyword-only hash pseudo-embedder onto the bundled Ollama + `nomic-embed-text` (768-dim): it detects Ollama, downloads the model if missing, re-embeds your existing memories with a live **progress bar** (resumable, vault-gated, runs in the background), then restarts so every consumer picks it up. Memories orphaned by a past vault re-initialization (encrypted under a previous data key and undecryptable now) can be **recovered by re-keying in place**: paste the old recovery key, preview "X of N", and recover, with no new IDs and no new consensus records, since only content and embedding are encrypted while the content hash stays plaintext-derived. Deprecated memories are now audit-only and never surface in CEREBRUM.
- **One-click managed reranker.** SAGE gives the reranker the Ollama treatment: with one consent click it downloads a pinned llama.cpp release build itself (sha256-verified before any byte touches disk) and the `bge-reranker-v2-m3` GGUF (Q8_0, 636MB, sha256-verified, atomic install so a truncated or tampered file never lands), then spawns and manages a `llama-server` sidecar on loopback that serves a real cross-encoder `/v1/rerank`. It survives node restarts (a healthy survivor is adopted via a real rerank probe rather than blindly respawned, with a probe-before-kill guard on shutdown). The whole thing is a **zero-terminal** hands-off checklist (engine, model, start, done), and recall `k` is now tunable from **3 to 20** (was 4 to 10) with copy that explains the token cost and flips its guidance based on whether the reranker is actually on.
- **Federation v2.** Two SAGE nodes can now share memory on the same LAN, or over connectivity you explicitly provide, established through a **secure join ceremony**. First-class internet/NAT traversal is scoped for v11.5, not v11.0. The v11 ceremony uses RFC-6238 TOTP-based mutual verification with a QR enrollment plus spoken 6-digit confirm codes, a pin-bound short-authentication-string that provably diverges if an enrollment is relayed, and a fail-closed version gate. Two modes, both consent-gated with a "nothing is deleted" guarantee: **exchange mode** keeps foreign data on its owner's chain and queries it live off-consensus over a pinned mTLS federation listener and query proxy, and **co-commit mode** writes native memories on both chains, each ratified by its own chain and cross-anchored by a hash of the other side's signed commit receipt (you remember and I remember, each on our own chain). Guided guest and host wizards make "add another computer to my SAGE network" an end-to-end dashboard flow.
- **`app-v15` consensus fork.** The fork that makes federation v2 real on-chain: new co-commit transaction types (`CoCommitSubmit` / `CoCommitAttest`) and cross-federation exchange-terms types (set / revoke), a co-commit envelope validity window bound to jointly-signed times and to federation status, and an **access-grant verb ladder** that makes the level-3 "modify" verb grantable and requestable. It also **tightens the authorization gates** on existing consensus handlers as a hardening pass. Every one of these rules derives purely from committed state and the consensus block time (no wall clock, no per-node cache, no map-iteration order), so every replica reaches the same verdict; all of it is byte-identical pre-activation and reached through the same governed upgrade ladder every prior fork uses (auto-advanced on personal nodes, governance-activated on a quorum).
- **Quality.** New memories now stamp their embedding provider at insert, so a freshly-written memory stops posing as unembedded and the "needs re-reading" counter no longer creeps up forever over real vectors. Redeploy got a robustness pass: a single-validator agent add/remove no longer runs the destructive wipe-and-restart that could brick a personal node, a stuck "reconfiguration in progress" banner can no longer wedge forever, and redeploy status reports the real terminal outcome instead of flashing a false success. Underneath it all are dozens of fixes from multi-pass adversarial find-and-verify reviews across the consensus, transport, web, frontend, and crypto surfaces.
SDK 11.0.0.
</details>
<details>
<summary>v10.9.1 and earlier — full per-version changelog on the <a href="https://github.com/l33tdawg/sage/releases">Releases page</a></summary>
The v10.x line (MRI 3D brain, the app-v12/v13/v14 idle-block + AppHash fork ladder, multi-node-safe voting, per-domain read-ACLs) and the full v3–v9 history — consensus-first writes, PoE-weighted quorum, governance-gated upgrades, TLS, RBAC/multi-org, hybrid recall — are on the [Releases page](https://github.com/l33tdawg/sage/releases).
</details>
---
</details>
## Research
| Paper | Key Result |
|-------|------------|
| [Agent Memory Infrastructure](papers/Paper1%20-%20Agent%20Memory%20Infrastructure%20-%20Byzantine-Resilient%20Institutional%20Memory%20for%20Multi-Agent%20Systems.pdf) | BFT consensus architecture for agent memory |
| [Consensus-Validated Memory](papers/Paper2%20-%20Consensus-Validated%20Memory%20Improves%20Agent%20Performance%20on%20Complex%20Tasks.pdf) | 50-vs-50 study: memory agents outperform memoryless |
| [Institutional Memory](papers/Paper3%20-%20Institutional%20Memory%20as%20Organizational%20Knowledge%20-%20AI%20Agents%20That%20Learn%20Their%20Jobs%20from%20Experience%20Not%20Instructions.pdf) | Agents learn from experience, not instructions |
| [Longitudinal Learning](papers/Paper4%20-%20Longitudinal%20Learning%20in%20Governed%20Multi-Agent%20Systems%20-%20How%20Institutional%20Memory%20Improves%20Agent%20Performance%20Over%20Time.pdf) | Cumulative learning: rho=0.716 with memory vs 0.040 without |
---
## Documentation
| Doc | What's in it |
|-----|-------------|
| [Authoritative Reference Index](docs/reference/INDEX.md) | Current code-verified integration contracts; start here for exact behavior |
| [MCP Tools](docs/reference/mcp-tools.md) | Memory, tasks, inbox, handoff, replies, and recovery |
| [REST API](docs/reference/rest-api.md) | Authentication, request/response fields, and endpoint boundaries |
| [Python SDK](docs/reference/python-sdk.md) | Synchronous/asynchronous client methods and supported contracts |
| [Architecture & Deployment](docs/ARCHITECTURE.md) | Multi-agent networks, BFT, RBAC, federation, API reference |
| [Getting Started](docs/GETTING_STARTED.md) | Setup walkthrough, embedding providers, multi-agent network guide |
| [Upgrading](docs/UPGRADING.md) | Moving an existing node to a new release, including v10.x → v11: backup, preflight, the app-version ladder, and what app-v23 does to your admins |
| [Security FAQ](SECURITY_FAQ.md) | Threat model, encryption, auth, signature scheme |
| [Connect Your AI](https://l33tdawg.github.io/sage/connect.html) | Interactive setup wizard for any provider |
---
## Stack
Go / CometBFT v0.38 / chi / BadgerDB / SQLite or PostgreSQL + pgvector /
Ed25519 + AES-256-GCM + Argon2id / MCP
---
## License
Unless otherwise stated, SAGE source code is licensed under [Apache 2.0](LICENSE). Papers: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). Some bundled visual assets are third-party works under their own licenses (e.g. the 3D MRI brain mesh, CC BY 4.0) — see [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
## Author
Dhillon Andrew Kannabhiran ([@l33tdawg](https://github.com/l33tdawg))
---
<p align="center"><em>A tribute to <a href="http://phenoelit.darklab.org/fx.html">Felix 'FX' Lindner</a> — who showed us <b>how much further curiosity can go.</b></em></p>
TDQS
A3.8/5.0
Scored across 34 tools
Disambiguation4/5
Each tool targets a distinct operation across memory, messaging, governance, and identity, and the descriptions clearly separate near neighbors like sage_inbox, sage_messages_receive, and sage_message_history. A few pairs (sage_remember vs sage_reflect vs sage_turn, sage_message_replies vs sage_message_status) could be confused at a glance, but the detailed descriptions resolve most ambiguity.
Naming Consistency4/5
All 34 tools share the sage_ prefix and snake_case, and most follow a verb_noun pattern like sage_remember, sage_recall, and sage_message_send. Deviations include several noun-style commands (sage_backlog, sage_inbox, sage_directory) and a singular/plural mismatch between sage_message_* and sage_messages_receive.
Tool Count2/5
At 34 tools, the surface is above the comfortable range and spans four distinct subsystems: memory, messaging, identity/governance, and task tracking. Each tool is individually justified, but the sheer number makes discovery and tool selection heavier than ideal for an agent.
Completeness4/5
The surface covers the core lifecycle well: memory create/read/list/link/deprecate, task create/update/backlog, full messaging send/receive/reply/history, and registration/governance operations. Minor gaps exist, such as no explicit non-replacement memory update and no deregistration tool, but agents can work around these.
Maintenance
ActivityActive
ResponsivenessResponsive